A liability with three natures
Ask three functions what the loyalty programme is and you receive three answers. Commercial sees a currency it sells to banks and partners. Finance sees a deferred-revenue liability whose valuation swings with an assumption or two. IT sees a ledger of member accounts processing accruals and redemptions at transaction speed. All three are correct — which is exactly why loyalty escapes coherent assurance. Each function audits its own slice, and the risks live in the joins.
For the audit committee, the concern is straightforward: the liability is often one of the larger accrual balances on the airline's balance sheet, its value moves materially with assumptions that few people can independently challenge, and the underlying points are a currency that can be stolen, mispriced or misbilled without anything visible happening to an aircraft.
Breakage: the assumption that moves the balance sheet
Breakage — the proportion of points expected to expire unredeemed — is the single most sensitive input to the liability valuation. A modest change in the breakage assumption flows straight through deferred revenue into reported results. Internal audit does not need to re-perform the actuarial model; it needs to test the governance around it. The questions that matter:
- Who owns the assumption, and is the owner independent of anyone whose targets benefit from moving it?
- Is the model back-tested — are prior breakage predictions compared with what actually expired, and are persistent one-directional errors investigated?
- Do programme rule changes (expiry extensions, pandemic-style waivers, tier gifting) flow into the model promptly, or does the model assume rules that no longer exist?
- Is the redemption-cost assumption — what a point costs the airline when redeemed — refreshed as award pricing and displacement patterns change?
- Is there a documented trail from the member-ledger data to the valuation dataset, or does the model run on extracts nobody reconciles?
In our experience the model itself is usually competent. It is the feed, the back-testing and the change discipline around it that fail.
Partner billing: where the money actually moves
Selling points to co-brand banks, hotels and retail partners is real cash income, governed by contracts with negotiated rates, volume tiers, marketing contributions and true-up clauses. The audit question is the same one that applies to interline or ground handling: does what we invoiced match what the contract says and what the systems recorded? Points accrued in the member ledger against a partner code should reconcile to points billed to that partner at the contracted rate; tier thresholds should trigger when the volumes say they should; and expired promotional accruals should not linger unbilled or, worse, double-billed after a true-up. Because partner contracts are individually negotiated and frequently amended, a rate table maintained outside the billing system — in spreadsheets, typically — is a standing source of quiet leakage in either direction.
Points are a currency the airline both issues and sells. Any organisation running a currency needs reconciliation discipline, not just marketing enthusiasm.
Redemption: the fraud surface
Redemption is where loyalty stops being an accounting abstraction and becomes an asset that can be stolen. Account-takeover redemptions, staff-assisted transfers, manual points adjustments and award bookings issued outside programme rules are the recurring patterns. The controls internal audit should test are unglamorous: authentication and re-verification on high-value redemptions and profile changes; segregation and dual approval on manual adjustments, with adjustment volumes trended by agent; monitoring for velocity anomalies — accounts suddenly draining after years of dormancy, redemptions to third-party names, clusters sharing devices or addresses; and complete logging on service-centre override capabilities. The manual-adjustment channel deserves particular attention: it exists for legitimate service recovery, which is exactly what makes it a comfortable place to hide theft.
Auditing it as one system
The practical failure in most audit plans is fragmentation: finance audit covers the valuation, a commercial audit covers a partner contract or two, IT audit covers the platform — in different years, with different teams, never reconciling end to end. A better design is a single loyalty audit that follows the point through its life: earned or sold, valued, redeemed or expired — testing at each stage that the ledgers agree, the contracts are applied and the assumptions reflect reality. This is also where full-population analytics earn their keep, because every one of the tests above can be run across the entire member ledger rather than a sample. Where the programme sits in a separate subsidiary or joint venture, add one more test: that the intercompany pricing of points between airline and programme entity follows the agreement, not convenience.
Where to start
Request three things: the last back-test of the breakage assumption, the reconciliation between member-ledger accruals and partner billings for the largest partner, and the trend of manual points adjustments by agent for the past year. If any of the three does not exist, that absence is the finding — and the scope of your first proper loyalty audit has just written itself.