They claim they do but there's never been any 3rd party auditing or verification of this that I know of. In the gold business every reliable business has auditing and insurance while so far Bitcoin businesses are run like a regular startup with open offices. Who's cleaning the offices after hours with access to the workstations or servers, who are the hired developers and are they smuggling wallet stealing software inside to transfer to themselves while on a flight to Brazil, who is writing their custom wallet and is it robust, how do we know they didn't copy every address to themselves. Lot's of security questions I've never seen addressed by any of the big exchanges. There was a payment processor startup that posted their office to bitcointalk.org which was floor to ceiling open glass windows with laptops facing the outside. How many binoculars are trained on those laptops across the street to get logins.

Some friends of mine trade large amounts of Bitcoin on a regular basis and there's never been much of a delay withdrawing. I doubt they are going to a bank to physically take out printed keys everyday for every transaction over $10,000 or phoning 5 people to combine keys. I bet the backups are kept in a safe deposit box, the cold wallet is likely an offline system anybody can walk up to with some kind of feeble authentication judging by past Bitcoin exchange incompetence.

Many of the smaller exchanges are using Blockchain.info wallets as their hot wallet too but won't admit it.