SOX controls apply to insurance companies whether or not they are public. An insurer whose parent files with the SEC is covered by section 404 of the Sarbanes-Oxley Act, which requires management's annual assessment of internal control over financial reporting and, for larger filers, an auditor's attestation. Every other insurer meets a close cousin of the same rule through state law: the NAIC's Annual Financial Reporting Model Regulation, known as the Model Audit Rule, requires an insurer with $500 million or more of annual direct written and assumed premium to file a management report on internal control over financial reporting, on the statutory basis, signed by its chief executive and chief financial officer. Below that line the rule still requires a CPA audit and a communication of any material weakness the auditor finds. Either way, most of the controls that matter sit in the quarter-end and year-end close: how inputs are checked, how reserves are set and booked, how reconciliations and journals are reviewed, and who signs. Botminds' Financial Close Management does not test controls or write the report, but it keeps the evidence each close control produces, enforces a reviewer who is not the preparer, and keeps every sign-off on the task's history for internal audit to read.
The rules quoted come from the U.S. Code, the NAIC Model Audit Rule (#205, in its 2015 text; states adopt it in their own words) and PCAOB auditing standards. Close examples come from a fictional sample insurance group, Northvale Casualty Group, in Financial Close Management.
The Model Audit Rule's lines, in premium and in days
$500M
direct written and assumed premium: management’s report on internal control is required
60days
after the audited report: the accountant’s communication, filed with management’s report
75%
of the audit committee independent, for insurers over $500M of premium
$500M / $1B
insurer or group premium at which an internal audit function is required
Do SOX controls apply to insurance companies?
Yes, to insurers in public groups directly, and to most larger insurers through the Model Audit Rule. Section 404 of the Sarbanes-Oxley Act requires each annual report filed with the SEC to contain an internal control report that, among other things, must "contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting". The auditor's attestation on that assessment applies to large accelerated and accelerated filers; smaller registrants and emerging growth companies are exempt from the attestation but not from management's assessment.
Mutual insurers, privately held insurers and the subsidiaries of foreign groups are not SEC registrants, so section 404 does not reach them. The Model Audit Rule does, through state law, and it is not optional for states that want to stay accredited: the NAIC's accreditation standards say state law "should contain a requirement for annual audits of domestic insurance companies by independent certified public accountants that is substantially similar to the NAIC’s Annual Financial Reporting Model Regulation". The internal control report sits inside that regulation. Banks have their own parallel in the FDIC's Part 363, covered in internal controls over financial reporting for banks.
What is the Model Audit Rule?
It is the NAIC's model regulation for insurers' annual audited financial reports, adopted by states as their own rule. Its stated purpose is to improve the state's surveillance of insurers' financial condition by requiring three things: an annual audit by an independent CPA, a communication of internal control related matters noted in the audit, and management's report of internal control over financial reporting. Insurers with less than $1 million of direct premium in the state and fewer than 1,000 policyholders nationwide are exempt, unless they assume $1 million or more of reinsurance.
Around the audit it sets the governance the close answers to. The audited report is due by 1 June. The lead audit partner may not serve more than five consecutive years. The audit committee is responsible for the auditor, and its independence scales with premium: a majority of independent members above $300 million, a supermajority of 75% above $500 million. An internal audit function, reporting to the audit committee, is required where the insurer has $500 million or more of premium, or its group $1 billion. The filing calendar these dates sit in is laid out in NAIC quarterly statement due dates.
Who files what under the Model Audit Rule, by premium
| Requirement | Applies to | Section |
|---|---|---|
| CPA audit and audited statutory report by 1 June | Every insurer, apart from the smallest | § 4 |
| Accountant’s communication of unremediated material weaknesses, within 60 days of the audited report | Every insurer that files an audited report | § 11 |
| Audit committee: majority independent | Prior-year direct written and assumed premium over $300 million | § 14 |
| Audit committee: supermajority (75%) independent | Prior-year premium over $500 million | § 14 |
| Internal audit function reporting to the audit committee | Insurer premium of $500 million or more, or group premium of $1 billion or more | § 15 |
| Management’s report of internal control over financial reporting | Direct written and assumed premium of $500 million or more, or as the commissioner requires | § 17 |
Which insurers must file an ICFR report?
Every insurer that files an audited report and has annual direct written and assumed premium of $500 million or more, excluding business reinsured with the federal crop and flood programmes. The rule says such an insurer "shall prepare a report of the insurer’s or group of insurers’ internal control over financial reporting", as of 31 December. The commissioner can also require the report from a smaller insurer that has a risk-based capital event or meets a standard for hazardous financial condition.
Groups can report together. The rule lets management define a group of insurers for the purpose of assessing internal control, and lets an insurer whose parent already files a section 404 report use that report with an addendum, provided the controls that matter to the statutory statements were in its scope. The addendum is a positive statement by management that "there are no material processes with respect to the preparation of the insurer’s or group of insurers’ audited statutory financial statements" left out of the section 404 report. Where some were left out, those controls need a report of their own.
Is the Model Audit Rule the same as SOX?
No. It borrows SOX's structure and much of its language, but differs on the basis of accounting, on who attests, and on who reads the report. The comparison below is the one a group that does both usually has to explain to its board.
Section 404 and the Model Audit Rule's internal control report, side by side
Sarbanes-Oxley section 404: SEC registrants and, through them, their insurance subsidiaries.
NAIC Model Audit Rule, Section 17: Insurers with $500M or more of direct written and assumed premium, or as the commissioner requires.
Sarbanes-Oxley section 404: The consolidated financial statements, usually U.S. GAAP.
NAIC Model Audit Rule, Section 17: The audited statutory financial statements, on statutory accounting principles.
Sarbanes-Oxley section 404: The end of the issuer’s fiscal year.
NAIC Model Audit Rule, Section 17: 31 December immediately preceding.
Sarbanes-Oxley section 404: Required for large accelerated and accelerated filers.
NAIC Model Audit Rule, Section 17: Not required; the CPA audits the statements and reports material weaknesses it notes.
Sarbanes-Oxley section 404: In the annual report on Form 10-K, which is public.
NAIC Model Audit Rule, Section 17: To the commissioner, kept confidential by the state insurance department.
Sarbanes-Oxley section 404: Management, with officer certifications under section 302.
NAIC Model Audit Rule, Section 17: The chief executive officer and the chief financial officer.
Sarbanes-Oxley section 404: —
NAIC Model Audit Rule, Section 17: A parent’s 404 report plus an addendum can satisfy it, if statutory processes were in scope.
The practical difference for the close is the statutory basis. A control set built for a group's GAAP 10-K can miss controls that matter only for the statutory statements: statutory reserve presentation, admitted and nonadmitted assets, the reconciliation of the audited statements to the annual statement filed in March. The addendum exists to force that question, and a controller should be able to answer it control by control.
When is the management report on internal control due?
With the accountant's communication of internal control matters, which is due within 60 days after the audited financial report is filed. For an audited report filed on 1 June, that is 31 July. If the commissioner extends the audited report's date, a similar 30-day extension applies to management's report. The report speaks as of 31 December, so the controls it covers are those that operated in the year-end close, most of which run in January and February, after the as-of date. The PCAOB makes the same point for public companies: because the annual period-end process normally happens after the as-of date, "those controls usually cannot be tested until after the as-of date".
What is a material weakness, and what does it do to the report?
A material weakness is a deficiency, or combination of deficiencies, serious enough that a material misstatement might not be caught in time. The PCAOB's definition for audits of public companies asks whether it is reasonably possible that a material error in the annual or interim statements slips through without being prevented or found in time (PCAOB AS 2201; the definition and its neighbour are set side by side in material weakness vs significant deficiency). A significant deficiency is less severe but still important enough to bring to the attention of those overseeing financial reporting.
The Model Audit Rule leaves no room for an effective conclusion with an open weakness. The report must disclose any unremediated material weaknesses identified by management as of 31 December, and "Management is not permitted to conclude that the internal control over financial reporting is effective" if one or more remains. In an insurer's close, the places where weaknesses most often matter are the estimates and the adjustments made around them, which is why the reserve committee and top-side adjustments carry the most scrutiny; top side entries meaning sets out the SEC cases that show why.
How a close control becomes an internal control assertion
- Control
A named check in the close, with its owner, its frequency and the risk it addresses: for example, booked reserves compared with the indication by company and line.
- Evidence
What the control leaves behind each time it runs: the committee minutes, the reconciliation with its threshold, the approval by a reviewer who did not prepare it.
- Test
Management or internal audit inspects a sample of that evidence over enough of the year to conclude the control works; deficiencies are logged and fixed.
- Report
Management asserts, as of 31 December, whether internal control over financial reporting is effective, and the CEO and CFO sign.
What are key controls in an insurance close?
The controls whose failure could let a material misstatement into the statements: in an insurer, those over the inputs to reserves, the setting and booking of reserves and recoverables, the reconciliations of the large balances, journals and adjustments, and consolidation. Each needs a preparer and, as a key control, a reviewer who did not prepare it. The list below is a typical set for a property and casualty group's close; your risk assessment will add and remove some.
Key controls in an insurer's quarter close, and the evidence each leaves
- Completeness of claims, premium and ceded data
Each extract and file accepted only with its row count and control total tying to the source system; re-runs logged.
- Reserves booked against the indication
Reserve committee minutes with booked against indicated by company and line, and the reason for any difference.
- Ceded recoveries by treaty
The ceded accrual prepared from the current ceded loss file and reviewed by someone other than the preparer.
- Reconciliations of the large balances
Premium receivable, claims payable, reinsurance recoverables, bank and investments: differences under threshold or explained item by item.
- Journal and top-side adjustment approval
Every journal approved by a reviewer who did not prepare it; adjustments outside the sub-ledgers carry a reason and a memo where they involve judgement.
- Intercompany, pooling and consolidation
Each company’s confirmation of its balances; eliminations reviewed.
- Statutory statements tie to the general ledger
Statements and schedules agreed to the locked general ledger before sign-off.
- Controller and CFO review
Opened only when flux review, tax provision and key controls are in; signed with the date.
Most of those controls fail the same way in practice: not because nobody performed them, but because the evidence that they were performed, on the right input, by the right people, cannot be found when the tester asks. In the sample close, the ceded accrual started on Friday from a file that was re-run on Monday. Under a tick-based checklist, that control would have been evidenced on a void file. In the solution, the evidence checker set the work back as soon as the file changed, and the accrual's controls panel still shows its preparer, Carla Brandt, and its reviewer, Dev Raghunathan, marked "not the preparer". How a checklist can refuse a tick without evidence is set out in month end close checklist software.
Every sign-off for every company: who prepares, who reviews, what is due
Who signs the ICFR report, and what must stand behind it?
The chief executive officer and the chief financial officer, or their equivalents. The report must state that management is responsible for internal control over financial reporting, assert whether it is effective, describe briefly how management evaluated it and what was in scope, disclose any unremediated material weaknesses, and note the inherent limitations of internal control. Management must document the basis for its assertions and make it available in a financial condition examination; it may rely in part on the review, monitoring and testing it does in the normal course of business.
That last permission is where a close process earns its keep. Evidence produced as the close runs, such as each reconciliation with its threshold, each journal with its preparer and reviewer, each reserve committee with booked against indicated, each sign-off with its date, is monitoring in the normal course. A control tested in January from evidence that was assembled in December is cheaper and more convincing than one reconstructed from folders and emails.
Where Financial Close Management helps, and where it does not
It helps with the evidence and the separation of duties. It marks a task done only on its evidence, refuses a review from the task's preparer for a key control, keeps every arrival, re-plan, recovery and sign-off on the task's history with who and when, and lets internal audit read every sign-off. Its rules, such as the evidence rule and the requirement of a judgement memo for an estimate booked in the quarter, are the controller's settings, versioned, so the rules in force at 31 December can be shown.
It does not design the control set, perform the testing, decide whether a deficiency is a material weakness or write management's report. It does not replace the general ledger's journal approvals or the access controls over the reserving models. Those remain with management, internal audit and the systems that hold the numbers. A group that already runs a section 404 programme will find the solution most useful as the place its close controls leave their evidence, not as a second controls tool.
Questions people ask
Do SOX controls apply to insurance companies?
Section 404 applies to insurers that are SEC registrants or part of a registrant's group. Other insurers with $500 million or more of direct written and assumed premium must file a management report on internal control under their state's version of the NAIC Model Audit Rule, which follows the same structure on the statutory basis.
Is the Model Audit Rule the same as SOX?
No. It covers the statutory statements, speaks as of 31 December, needs no auditor attestation and is filed confidentially with the commissioner. An insurer whose parent files a section 404 report can use it with an addendum, if the controls over the statutory statements were in scope.
When is the management report on internal control due?
With the accountant's communication of internal control matters, within 60 days after the audited financial report is filed, so by 31 July for a report filed on 1 June. An extension of the audited report's date brings a similar 30-day extension.
What is a material weakness?
A deficiency, or several together, serious enough that a material error could reasonably possibly go unprevented or unnoticed until too late. Under the Model Audit Rule, management cannot conclude its internal control is effective while one remains unremediated at 31 December.
What are key controls in an insurance close?
Controls over the completeness of claims, premium and ceded data, reserves booked against the actuary's indication, ceded recoveries, reconciliations of large balances, journal and top-side adjustment approval, consolidation, and the final reviews. Each needs evidence, a preparer and, as a key control, a different reviewer.
Do smaller insurers need an internal audit function?
Not under the Model Audit Rule if the insurer has under $500 million of premium and its group under $1 billion. The model encourages exempt insurers to weigh whether one is warranted against its cost.