It took eight years, but was there ever any doubt that Sarbanes/Oxley (SOX) would impact the insurance industry?  From early on, we heard insurance regulators’ theory of “inherent benefits” of Rule 404 if SOX was adopted.  Through heavily contested regulatory proposals, one fact remained constant – SOX was coming.  It has arrived.

The NAIC’s Model Audit Rule (MAR) will require insurance companies to establish Internal Controls over Financial Reporting (ICFR) similar to SOX Section 404.  In addition, the NAIC’s MAR establishes additional requirements related to audit committees, independent certified public accountants, management, and regulatory filings.

As prescribed by the MAR, Section 16, management will be required to file a report asserting the effectiveness of the insurer’s Internal Control over Financial Reporting (ICFR).  Management will be required to provide the “diligent inquiry” process and documentation to the State insurance examiners.  Under Section 9, the insurer’s auditor is required to consider management’s report on Internal Control over Financial Reporting in planning and performing the audit of the statutory financial statements.  In addition, the MAR, Section 11, requires the Commission to be notified when material weaknesses in the internal control over financial reporting are noted during the audit, and all information related to a significant deficiency must be made available to the State examiners.  Section 11 is applicable to all insurers.  Sections 9 and 16 are applicable to insurers with direct written premiums in excess of $500 million.

The MAR does not require a specific process for management’s review and evaluation of internal controls.  Management has discretion as to the scope and frequency of internal control testing and the documentation provided upon examination to support its assertions.

As stated earlier, the MAR is a direct cascading effect of the Sarbanes/Oxley guidance adopted by the SEC (Securities and Exchange Commission) for public companies.  SEC registrants typically use the COSO Internal Control-Integrated Framework in assessing the effectiveness of ICFR.  In addition, the COSO sponsored ERM (Enterprise Risk Management) and the Public Companies Accounting Oversight Board (PCAOB) Guidance for Smaller Public Companies Reporting on Internal Control over Financial Reporting are also often utilized as relative guidance to establish a framework for management’s review and documentation of the ICFR.

Management’s assessment of the ICFR can be a lengthy and intense process.  An organized approach to the significant financial processes and transactions will need to be developed as well as determination of the specific and inherent controls in the financial reporting process.  Management will also need to establish “tests of controls”; perform those tests of controls; and analyze the results of those tests.  Weakness in the ICFR will need to be mitigated with additional controls, and subsequently tested for effectiveness.

Management’s assessment of the ICFR process cannot be taken lightly, and should be implemented as soon as possible.  This process can take months to develop and perform.  The MAR becomes effective in 2010, and management’s first assertion report on the effectiveness of the internal controls over financial reporting for the year ending 2010 is due in early 2011.
 
As a PCAOB registered accounting firm, with over a decade of experience with SEC registrants already subject to Sarbanes/Oxley, as well as over forty (40) years of experience providing auditing and consulting services to insurance companies, we are well prepared to assist in developing and satisfying the Model Audit Rule’s requirements with regards to Section 16 “Management’s Report of Internal Control over Financial Reporting”.

Please contact us if you would like to discuss the impact of Sarbanes/Oxley on your Company.