They can do this - and they do - because it doesn't breach the law.

It is hard to believe that the law is so deficient that insurers can sell these faulty products to the detriment of customers and get away with it. What is even more disappointing is that they do it. CommInsure, a Commonwealth Bank subsidiary, backdated its definitions after it was caught out and backdated further in the wake of the Australian Securities and Investments Commission review released on Thursday, but some are still dragging their heels.

It speaks to bad practice and bad faith. It yet another reason why we need a royal commission on the finance sector.

The ASIC investigation into CommInsure prompted the watchdog's deputy chairman Peter Kell to call for wide-ranging law reforms.

They include removing some ridiculous exemptions from corporation law that apply to insurance claims handling, stronger penalties for breaches of utmost good faith in claims handling and the removal of the carve-out for insurance from laws banning unfair terms in contracts.

Poor process

ASIC's investigation into CommInsure was triggered by a joint Fairfax Media and ABC Four Corners expose of the treatment of sick and dying customers. The report included the testimony of former chief medical officer Ben Koh who, as well as raising outdated definitions, alleged files were going missing and that doctors were being leaned on to change medical opinions.

ASIC published an executive summary of its year-long probe on Thursday supporting many of Dr Koh's allegations and providing a damning report card overall even if its language is not couched that way.

It described a database so deficient that it couldn't track changes and deletions to how medical opinions were recorded in relation to case files. Then, unsurprisingly, it didn't find any evidence that medical opinions stored on the database were changed by staff "other than for appropriate administrative functions".

Nevertheless, CommInsure has changed the database to make it more robust.

ASIC also found that the company financially incentivised some managers to knock back the claims of sick and dying people. This isn't illegal but speaks volumes about the culture that the executives and board of Commonwealth Bank have presided over. CBA has since also stopped the practice.

ASIC also found the advertising and marketing of some CommInsure products - Total Care Plan sold through financial advisers and Simple Life Insurance sold directly to customers - warranted further investigation. We await the findings.

But it didn't find evidence to support allegations that CommInsure claims managers applied undue pressure on doctors to change their medical opinions or that doctors were "cherry picked" to give preferred opinions.

This is contrary to Dr Koh's personal experience as a doctor working inside CommInsure. Nor does it stack up with media reports of a particular psychologist wheeled out by CommInsure to assess claims.

Claim improvements

ASIC is also pushing CommInsure to improve the way it treats its customers, including better and faster communications and enhanced training and assistance for claims managers.

Delaying claims is a huge problem, particularly when people are sick or dying and desperately need the money.

The media investigation found numerous cases of legitimate claims that were denied, or experienced unacceptable delays in the outcome.

For four years it rejected the claim of a former employee with multiple sclerosis. For three years a former CBA employee of the year, Matthew Attwater, had to fight even after he was medically retired on the basis of being mentally ill.

James Kessel, whose heart had stopped beating, had his claim rejected solely on the basis that his attack was not severe enough based on an out-of-date definition.

His case was escalated to an internal committee meeting in December 2014 that trawled through 14 years of his medical records. The committee found that Kessel had disclosed everything. It said if he wasn't now offered an ex-gratia payment CommInsure would not be acting in utmost good faith. CommInsure didn't make that payment. Somebody put a red line through his claim and we still don't know who.

Luckily for CommInsure, ASIC didn't interview customers as part of its investigation. If it had, the regulator would have heard some harrowing stories.

CBA has agreed to backdate its medical definition for heart attacks to 2012 in line with the rest of the industry. That is a small win. But for those who have severe rheumatoid arthritis the bank isn't as generous. It has backdated the definition only to 2014, despite it being years out of date.

For Michael Gill, who was diagnosed with severe rheumatoid arthritis in Christmas 2010, the bank is not acting in good faith. "The distance between consumer expectation and the legal letter of the law is exactly why CommInsure and others can exploit consumers," he said. Definitions should be updated as they occur not years after.

CBA's spinners might try to pitch the report as an exoneration. It is an indictment on the entire industry.