Model Audit Rule

By Susan D. Sharp, Chief Fiscal Officer, New York State Insurance Fund, and Member of Finance and Investments Committee

The National Association of Insurance Commissioners (NAIC) started on the path to its own version of SOX several years ago. Advantages and disadvantages were debated among the commissioners, industry associations, and other interested parties. Those who were against the measure cited the high-cost of implementing Section 404-like requirements despite the thorough examination process currently in place. After considerable committee action and numerous rounds of comments, final revisions to the Annual Financial Reporting Model Regulation (Model Audit Rule) were adopted by the NAIC’s Financial Condition Committee in May 2006 and subsequently by the Executive Committee/Plenary at its meeting in June 2006.

The Model Audit Rule revisions relate to three main areas: auditor independence, corporate governance, and internal control over financial reporting.

Auditor Independence - The adopted revisions reduce the number of consecutive years an audit partner may participate on the audit of an insurer and also lists various non-audit services that auditors may not provide to an insurer in order to maintain its independence. Realizing that it may be difficult for small insurers to comply with the prohibited services requirement, a small company exemption is included that indicates that those insurance companies with less than $100 million in direct written and assumed premium may request an exemption from this requirement. The effective date in the model is January 1, 2010.

Corporate Governance - The adopted revisions require that insurance companies have an audit committee that is solely responsible for the appointment, compensation and oversight of the company’s auditor. The guidance also indicates that some audit committees, based on the insurer’s premium volume, would need to be comprised of a certain percentage of individuals that are independent from company management. Companies meeting certain requirements may request an exemption from its domiciliary commissioner based on hardship. The effective date in the model is January 1, 2010.

Internal Control Over Financial Reporting - The adopted revisions require that insurance companies with $500 million or more in direct and assumed premium file a report with the state insurance department regarding its assessment of internal control over financial reporting. This report will include a statement by management whether these controls are effective to provide reasonable assurance regarding the reliability of the statutory financial statements and disclosure of any unremediated material weaknesses in internal control over financial reporting. The independent certified public accountant should consider this report during the planning and performance of the annual audit. In addition, the proposed revisions require the insurer to file with the state insurance department the independent certified public accountant’s communication regarding any unremediated material weaknesses noted during the course of an audit. The effective date in the model is December 31, 2010.

Buy-in and support from top management is essential to the success of this kind of undertaking. Operating management will need to understand, cooperate, and direct adherence to this project. This is a job for the entire organization, not just for those preparing financial reports. For the internal controls over financial reporting requirement, you may need to hire internal controls experts, IT auditors, and business analysts. IT resources will be critical as most transactions are processed through computer applications prior to rolling up to the financial statements.

Remember that this in not a one-time project. Compliance must be continuous; once a Fund certifies, it will need to maintain compliance throughout the year. As with all critical projects, strong project management processes should be used. You may be inclined to make this an internal audit responsibility, but ideally it should be in the hands of internal control experts working closely with operations and finance staff.

If you’re feeling overwhelmed by all this, don’t worry, there are resources out there that can help you with this.

1. Visit the NAIC website at www.naic.org to obtain a copy of the Model Audit Rule as well as an Implementation Guide for it. You will find a reference to it on the Industry Quicklinks section on the right side of the home page. The Guide provides definitions, answers to frequently asked questions, and sample letters.

1. Go to the regulators in your State and ask if they have any additional guidance that they can provide to you.

1. Talk to your independent auditors. They may be able to assist you in planning a review on internal controls over financial reporting. A practice trial run through a department or business office as a pilot can be performed. This type of planning exercise is not in conflict with non-audit service restrictions.

1. Take a look at different software packages that are available, which will assist you in your documentation, testing, and certification of internal controls. You many want to start out using spreadsheets.

1. Attend related training and conferences.

As with much in business, as well as life in general, change is inevitable. The more prepared you are for the Model Audit Rule, the easier it will be to implement and the more benefits you will receive.