You cannot grade an AI investigator the way you grade a fraud detector, and conflating the two is the most common mistake carriers make when they evaluate a claims-investigation agent. A detection model earns its score on recall and precision of the flag: did it surface the suspicious claim. An investigation agent has to be graded on something detection never produces - the quality of the evidence it gathered, the completeness of the phases it ran, and whether its conclusion would hold up in an EUO, a SAR filing, or a state DOI exam. This post lays out the eight-dimension framework for doing that, offline before deployment and continuously in production.
The stakes are set by the loss numbers. Insurance fraud steals at least $308.6 billion a year from American consumers, according to the Coalition Against Insurance Fraud, and fraud is present in roughly 10% of property-casualty losses. An agent that reaches confident but poorly evidenced conclusions on that volume does not save money - it manufactures bad-faith exposure. So the evaluation is not a data-science nicety. It is the instrument an SIU director uses to answer one question: can I defend what this agent decided.
The framework here is written for the two people who actually run the bake-off: the SIU director who has to defend a conclusion in a deposition, EUO, or SAR filing, and the CIO who owns AI governance and model risk. It maps to the NIST AI Risk Management Framework's Measure function, and it covers the metric stack, golden test sets, offline versus online evaluation, LLM-as-judge, hallucination guardrails, drift, and regulatory defensibility. Grading the agent is the companion to building it - the orchestration, memory, and evaluation architecture is covered in the agent architecture for claims investigation - and this scorecard sits inside the broader autonomous AI claims investigation model.
What an AI agent evaluation framework is for fraud investigation
An AI agent evaluation framework for fraud investigation is the structured set of metrics, labeled test data, and human review processes used to measure whether an autonomous investigation agent produces correct, complete, well-evidenced, and defensible conclusions on flagged claims - scored offline against known outcomes before deployment, then continuously against sampled live cases after it goes into production.
The framework rests on one distinction: detection and investigation are different eval objects. Detection is upstream; investigation is downstream. A detector is graded on whether it surfaced a suspicious claim, which is recall and precision on the flag. An investigator has to be graded on what it did after the flag: which phases it ran, what evidence it gathered, whether each asserted fact is sourced, and whether the conclusion is defensible. Those dimensions do not exist in a detection score, because detection produces a score, not an investigation. This is the shift from fraud detection to fraud resolution, and it changes what you can measure.
The measurement discipline is not new. The NIST AI Risk Management Framework organizes AI governance into four functions - Govern, Map, Measure, and Manage - and ties the Measure function to TEVV: test, evaluation, verification, and validation. NIST is explicit that measurement runs before deployment and continuously across the lifecycle, not once. For an agent that touches claims drawn from a $308.6 billion annual US fraud loss, continuous measurement is the difference between a governed system and an ungoverned one.
Why detection accuracy metrics don't grade an investigator
Detection accuracy metrics - recall, precision, and false-positive rate on the flag - grade whether a suspicious claim was surfaced. They say nothing about whether the investigation that followed gathered the right evidence or reached a conclusion you could defend. A carrier can run a high-recall detector and still lose every downstream case for lack of documented work.
Start with why a single accuracy percentage is misleading. Fraud sits in roughly 10% of property-casualty losses, so the base rate is skewed. A model that predicts 'not fraud' on every claim is about 90% accurate and catches zero fraud. Accuracy alone rewards the lazy answer. This is why recall and precision, reported as a pair, are the floor for any fraud metric - and why a headline accuracy figure with no denominator behind it tells a buyer almost nothing.
Why raw accuracy is a broken metric at a ~10% fraud base rate
Detection vendors know this, which is why the serious ones publish performance the right way. Rules-based detection carries a 60-85% false-positive rate, and quantifying that is exactly the kind of number a good detection eval surfaces. Verisk's ClaimDirector expresses detection as a 0-999 propensity score, which is the correct eval object for detection. When a handler-assist vendor markets a headline like the greater-than-99% accuracy in claims assessment reported at Shift Technology's Shift Claims launch, the evaluation-first buyer does not dismiss it - the buyer decomposes it: accuracy on which task, against what adjudicated ground truth, on which held-out claim set, and does it break down into per-phase evidence quality. Those are real, useful outcome metrics for a handler-assist product. They are a headline, not an investigation eval. FRISS, Shift Technology, and Verisk are complementary to the investigation layer - not a replacement - and they grade a different object.
The metric stack: eight dimensions for grading an AI investigator
A complete evaluation of a fraud investigation agent scores eight dimensions, not one: fraud precision and recall, false-positive rate, investigation completeness (phase coverage), evidence and citation grounding, hallucinated-evidence rate, time-to-decision, cost per case, and human-escalation accuracy. The first two are borrowed from detection. The rest only exist once the agent produces an actual investigation.
Read the eight as two halves. The technical half - completeness, evidence grounding, hallucination rate, and escalation accuracy - tells an SIU director whether the work is defensible. The business half - time-to-decision, cost per case, and the precision-recall pair - tells a claims VP and a CFO whether the unit economics hold. Neither half alone is sufficient. An agent that is cheap and fast but skips phases fails the audit; an agent that is thorough but costs more than a manual investigator fails the budget. The scorecard forces both to be true at once. The business-outcome half - yield, leakage recovered, cost per case, and time-to-defensible-decision - is modeled in detail in measuring fraud investigation AI ROI.
Detection eval and investigation eval are different measurement problems
A detection eval asks whether a suspicious claim was surfaced and scores recall and precision on the flag. An investigation eval asks whether the flag was resolved with defensible evidence and scores phase completeness, grounding, hallucination rate, and defensibility. Buying more detection accuracy does not add investigation quality, and grading one with the other's metrics produces a score that looks fine and proves nothing.
A fraud detector earns one number. A fraud investigator has to earn eight - and six of them don't exist until the agent shows its work.
Building a golden test set of claims
A golden test set is a curated, labeled corpus of already-adjudicated claims - confirmed-fraud, confirmed-legitimate, and deliberately hard edge cases - each carrying its ground-truth outcome and the evidence trail that supports it, used to score the agent offline before it touches a live claim.
Ground truth for a fraud investigation golden set comes from closed cases: adjudicated SIU files, EUO outcomes, denials that held, and prosecutions. These are claims where the answer is known and documented. You stratify the set to mirror reality - because fraud is roughly 10% of claims, an unbalanced set lets a lazy model look accurate on the majority class while missing the fraud you built the agent to catch. Stratify by line as well, since auto BI, workers comp, and property fraud do not look alike.
Two failure modes ruin a golden set. The first is label leakage, where a clue to the answer hides in the input - a case note that reads 'referred to SIU, confirmed fraud' teaches the agent to read the note, not investigate the claim. Strip those. The second is staleness. A set built only from 2019 cases evaluates the agent against 2019 fraud. Include adversarial cases with AI-generated photos, synthetic identities, and fabricated documents so the eval reflects the fraud actually arriving in 2026.
For an investigation agent, the label is not just the verdict. Because Hesper runs 15+ phases in parallel on each flagged claim, the golden set should label the expected evidence for each phase - what document forensics should surface, what the timeline reconstruction should show, where OSINT should corroborate or contradict the claimant. That lets you score completeness phase by phase, rather than only checking whether the final verdict matched. A verdict-only label rewards an agent that guesses right for the wrong reasons, which is the opposite of a defensible investigation.
Offline vs online evaluation, and LLM-as-judge for investigation narratives
Offline evaluation scores the agent against the golden set before deployment. Online evaluation samples live cases for human quality control after deployment. LLM-as-judge can rubric-grade the narrative quality of investigation reports at scale - but only as a screen backed by human SIU review, never as the final word.
The reason LLM-as-judge is viable at all comes from the research. Zheng and colleagues (2023) found that a strong LLM judge such as GPT-4 agrees with human evaluators more than 80% of the time - roughly the rate at which humans agree with each other. That makes it a scalable way to rubric-grade thousands of investigation narratives: is the reasoning coherent, is every fact cited, does the conclusion follow from the evidence.
The same research is the reason you do not trust it blindly. It documented named failure modes - position bias, verbosity bias, and self-enhancement bias, where a model favors outputs resembling its own. An LLM judge is a screen, not a verdict. Use it to grade at volume and surface the weak reports, then route the final defensibility sign-off to a human SIU reviewer. This is where the investigator's role shifts from execution to decision-making: the agent runs the investigation, the LLM judge triages the reports, and the human owns the calls that carry legal weight.
Guardrails against hallucinated evidence, and drift monitoring
The two production failure modes are hallucinated evidence - the agent asserting a fact that is not in the record - and drift, where fraud typologies move faster than the agent's reference behavior. The guardrails are a source-citation requirement on every asserted fact, plus continuous monitoring of hallucination rate and drift over time.
Hallucinated evidence
The rule is simple and absolute: every factual assertion in an investigation must trace to a specific source in the case file - a document, a database record, a statement. Any claim the agent cannot ground gets flagged and withheld rather than reported. In evaluation you score a hallucinated-evidence rate by sampling outputs and checking each cited fact against the underlying record. This is not only a quality metric. An agent that fabricates support for a denial is a compliance liability, which is why audit-trail-native design - every conclusion carrying its sources, reasoning, and timestamps - is the structural defense, not a bolt-on.
Drift monitoring
Drift is why NIST ties Measure to continuous TEVV rather than a one-time test. The fraud the agent was validated against in the first quarter is not the fraud arriving in the fourth. Monitor the hallucination rate, the escalation rate, and the distribution of the agent's conclusions over time; a sudden move is a tripwire. The 60-85% false-positive rate of upstream rules-based detection is itself a drift signal worth tracking - when the flag mix changes, the investigation load changes with it, and the agent's behavior should be re-checked against a refreshed golden set.
Regulatory defensibility as a scored eval dimension
A fraud investigation agent is a regulated decision-support system, so 'does the output satisfy the reasonable-investigation and documented-decision standards' is itself a scored metric, not a legal afterthought. Completeness and auditability belong on the scorecard because regulators already require them.
The legal floor is the Unfair Claims Settlement Practices Act (NAIC Model #900), adopted in roughly 44 states, which prohibits refusing to pay a claim without conducting a reasonable investigation and requires reasonable standards for the prompt investigation of claims. An agent that skips a phase and jumps to a denial is not just low-quality; it is a reasonable-investigation problem. That is why investigation completeness is a compliance metric, not a nicety. On top of it, the NAIC Model Bulletin on the Use of AI Systems by Insurers, adopted in December 2023 and since taken up by nearly half of US states, requires a written AI governance program and documentation an insurer must produce on exam.
Bias testing is now statutory in places. Colorado's SB21-169 regulation, effective November 14, 2023, requires insurers to test algorithms and predictive models for unfair discrimination and file governance attestations - a scored fairness dimension, not an option. Internationally, the EU AI Act classifies AI for risk assessment and pricing in life and health insurance as high-risk under Annex III, with logging, human-oversight, and accuracy and robustness testing obligations applying from August 2, 2026; P&C sits in a grey zone, so do not overstate it. For a US compliance officer the practical test is narrower: does each finding reconstruct cleanly enough to satisfy California 10 CCR 2698.36's documented-decision requirement and appear in the antifraud plan filed under NAIC Model Act 680. An audit-trail-native report answers yes by construction.
How to run a vendor bake-off or pilot
A defensible vendor bake-off gives every vendor the same held-out golden set, blind-grades their outputs on the eight-dimension scorecard, and reports per-phase evidence quality, cost per case, and escalation accuracy - not a single top-line accuracy number. Same claims, same rubric, blind graders, and every vendor made to show its phase-level work.
The discipline that protects the pilot is refusing the headline. When a vendor offers a single accuracy figure, hand it back and ask for the decomposition: what evidence did it gather on this claim, what did it cite, where did it escalate. For the claims VP and CFO funding the pilot, the two numbers that decide the business case are cost per case - autonomous investigation runs near $150 against roughly $2,500 manual - and human-escalation accuracy, because an agent that escalates everything saves nothing and one that escalates nothing is unsafe. Score both on the same held-out set every vendor sees.
Keep the layered model in front of the committee throughout. A detection score grades whether a claim was flagged; an investigation grades whether the flag was resolved with defensible evidence. Detection vendors and investigation agents are complementary, not interchangeable - a carrier runs FRISS, Shift Technology, or Verisk for the flag and an investigation layer for the resolution. Fold the regulatory checks into the scorecard so compliance is scored, not assumed. For the procurement companion to this scorecard - the structured 12-point evaluation to run alongside it - use the AI fraud investigation vendor evaluation checklist.
Key takeaways
- You cannot grade an AI investigator the way you grade a fraud detector: detection metrics score the flag with recall and precision, while an investigation must be scored on the evidence it gathered, the phases it ran, and whether its conclusion is defensible - different eval objects entirely.
- A complete evaluation scores eight dimensions - fraud precision and recall, false-positive rate, investigation completeness, evidence grounding, hallucinated-evidence rate, time-to-decision, cost per case, and human-escalation accuracy - because a single accuracy percentage is meaningless at a ~10% fraud base rate, where a model that flags nothing scores about 90%.
- Ground truth comes from a stratified golden set of already-adjudicated claims that labels the expected evidence for each of the 15+ phases, guards against label leakage, and includes adversarial AI-generated cases so the eval reflects 2026 fraud rather than 2019 fraud.
- LLM-as-judge can rubric-grade investigation narratives at scale - GPT-4 agrees with human evaluators more than 80% of the time per Zheng et al. (2023) - but its position, verbosity, and self-enhancement biases make it a screen, not a verdict, so the final defensibility sign-off stays with a human SIU reviewer.
- Regulatory defensibility is a scored dimension: the UCSPA reasonable-investigation standard in roughly 44 states, the NAIC AI Model Bulletin, Colorado SB21-169 bias testing, and California 10 CCR 2698.36 make investigation completeness and audit-trail-native output measurable compliance requirements, not legal afterthoughts.