The Corporate Governance Annual Disclosure Model Act is the NAIC model law, number 305, that requires an insurer, or the insurance group it belongs to, to submit a confidential corporate governance annual disclosure (CGAD) to its insurance commissioner no later than 1 June each year, signed by the chief executive officer or corporate secretary. Its companion, the Corporate Governance Annual Disclosure Model Regulation (#306), says what the filing must describe: the board and its committees, how the board works, how senior management is directed, and how the board oversees the company's critical risk areas. The work is hard less for its length than for its timing and its audiences: it lands on the same day as the audited financial report, it must be redrafted every year to show what changed, and the same governance details go to examiners and rating agencies in other forms. Botminds' Rating Agency & Exam Response exists for that last problem: it drafts each answer from the last approved one, refreshes the details, and checks them against what every audience has already been told.
The CGAD in four numbers
1June
the annual deadline in the model act and the model regulation
2016
the year the model act set for the first filing
4
areas the model regulation asks the disclosure to describe
8
example critical risk areas, from risk management to market conduct
What does the corporate governance annual disclosure model act require?
The model act requires one filing a year, by 1 June, from every insurer domiciled in the adopting state, with the group allowed to file for its insurers. Section 3A reads: an insurer, or its group, "shall, no later than June 1 of each calendar year, submit to the Commissioner a Corporate Governance Annual Disclosure (CGAD)" (Model #305, § 3A). If the insurer belongs to a group, the filing goes to the commissioner of the group's lead state, chosen by the procedures in the NAIC's Financial Analysis Handbook.
The act's stated purpose is narrow and worth reading twice. It is to give the commissioner a summary of the insurer's governance structure, policies and practices "to permit the Commissioner to gain and maintain an understanding of the insurer’s corporate governance framework." It also says that nothing in it imposes governance standards beyond what state corporate law already requires. The CGAD is a description, not a test. What examiners and analysts later do with the description is where the stakes are.
Three further rules shape the work. The filing is confidential by law, treated as proprietary and containing trade secrets, and is not subject to open-records requests, subpoena or discovery in private civil actions (§ 6A). An insurer not otherwise required to file must do so if the commissioner asks (§ 3C). And a late filing without just cause draws a penalty for each day of delay, after notice and hearing, in an amount each adopting state writes into its statute (§ 8). The NAIC made the disclosure an accreditation standard: state law "should include a requirement for insurers to provide a confidential annual disclosure of their corporate governance practices" substantially similar to the models (NAIC accreditation standards, 2026).
Why 1 June is crowded: the reporting year around the CGAD
The CGAD shares its deadline with the CPA-audited statutory financial report, which the NAIC's Model Audit Rule also sets at 1 June, and it follows the annual statement, the actuarial filings and the first-quarter statement by a few weeks. The same finance, actuarial and risk people produce all of them. The calendar below lays out the statutory year for a property and casualty insurer, with each date taken from the rule that sets it.
The statutory year around the CGAD, by month
March
1 Mar
Annual statement
Minnesota § 60A.13 is one example of the 1 March date
15 Mar
Actuarial Opinion Summary
to the domiciliary state, per the NAIC instructions
May
1 May
Actuarial Report
"generally due" on this date, per the NAIC instructions
15 May
First-quarter statement
45 days after 31 March
June
1 Jun
Audited financial report
NAIC Model #205, § 4
1 Jun
Corporate governance annual disclosure
NAIC Model #305, § 3A, and Model #306, § 4A
July
by 31 Jul
Internal control letter and management’s ICFR report
within 60 days of the audited report; ICFR at $500 million of premium or more
August
14 Aug
Second-quarter statement
45 days after 30 June
November
14 Nov
Third-quarter statement
45 days after 30 September
Once a year, date varies
annual
ORSA summary report
the state’s date, or the time the insurer tells the commissioner to expect it
own cycle
Rating agency questionnaires and meetings
each agency sets its own dates; put yours in this row
Two things stand out. First, June carries two filings that describe the same company from different sides: the audited report says what the numbers are, the CGAD says who oversees them. Second, the rows that matter most to a rating agency liaison have no fixed date at all. The ORSA summary report is filed once a year, on the state's date or on a timetable the insurer gives its commissioner, and the NAIC's 2026 ORSA manual now asks for it early enough in the year to be read alongside the holding company analysis. Rating agencies run their own cycles. A calendar that leaves those rows blank misses the weeks when the same figures and the same governance narrative are asked for three times.
The exam sits on a different clock. A domestic insurer is examined at least once every five years under the NAIC's Model Law on Examinations, and the examiners' first requests arrive months before fieldwork; the risk-focused examination process lays that timeline out phase by phase.
What goes in a corporate governance annual disclosure? The four areas
The model regulation lists four areas, and the model act gives the insurer "discretion over the responses" as long as the commissioner can understand its governance. The regulation also asks the filer to be "as descriptive as possible" and to attach the documents it actually uses, because they "may provide a means to demonstrate the strengths of their governance framework and practices" (Model #306, § 5A). In practice that makes the CGAD a curated set of charters, policies and minutes held together by narrative.
The four areas a CGAD describes, and the evidence each one draws on
| Area (Model #306) | What the regulation asks for | Where the material usually already exists |
|---|---|---|
| § 5B · Framework and structure | The board and committees that oversee the insurer, the level at which oversight happens (ultimate parent, intermediate holding company or legal entity), the rationale for board size and structure, committee duties, and the roles of CEO and chair. | Bylaws, committee charters, the group organisation chart, the holding company registration statement. |
| § 5C · Board policies and practices | How each director’s qualifications meet the insurer’s needs; how independence is kept; the number of board and committee meetings in the past year and attendance; nomination, term limits, election and any diversity policy; how the board evaluates itself and trains. | Minutes and attendance records, nomination committee papers, the board evaluation, director biographies. |
| § 5D · Directing senior management | Suitability standards for officers and key persons in control functions; the code of conduct and ethics; performance evaluation and compensation, in enough detail to show it does not reward excessive risk taking (risk adjustments, clawbacks); CEO and senior management succession. | Compensation committee papers, the code of conduct, fit-and-proper procedures, the succession plan. |
| § 5E · Oversight of critical risk areas | How responsibilities are delegated between board, committees and management; how the board is kept informed of strategy and risks; how reporting is organised for each critical risk area, and how often it reaches management and the board. | The ORSA summary report, the risk committee calendar, actuarial, investment, reinsurance and internal audit reporting. |
The fourth area is the one that ties the CGAD to the rest of an insurer's reporting. Section 5E gives eight example critical risk areas: risk management processes, the actuarial function, investment decision-making, reinsurance decision-making, business strategy and finance decision-making, the compliance function, financial reporting and internal auditing, and market conduct decision-making. For the first of these, an ORSA filer "may refer to its ORSA Summary Report." Each of the eight has an owner, and each owner already reports somewhere else in the year.
Who writes the CGAD, and who signs it?
The chief executive officer or the corporate secretary signs. The attestation states, to the best of that person's belief and knowledge, that the insurer has implemented the governance practices described and that a copy has gone to the board or the appropriate committee (Model #305, § 3B). The writing is spread across the people who own each area, and the attestation is only as good as their sections.
The people behind one CGAD, and what changes for each when drafting is shared with agents
Today
Collects charters, minutes and attendance from every committee, reconciles meeting counts by hand and edits last year’s Word file into this year’s.
With agents
Starts from last year’s approved text with every changed detail marked, and spends the time on what the board actually did differently.
Still theirs: the attestation, with the CEO, and the board copy
Today
Rewrites the risk-management section so it matches the ORSA summary report filed earlier in the year, often from memory of what that report said.
With agents
Sees the CGAD paragraph next to the ORSA wording it must agree with, and decides whether to cross-reference instead of repeating.
Still theirs: the ORSA attestation and the risk appetite statements
Today
Is asked late for a paragraph on how the actuarial function reports to the board.
With agents
Approves a drafted paragraph built from the reserving committee’s terms and calendar, with any change since last year flagged.
Still theirs: the description of actuarial oversight, and the opinion itself
Today
Signs off the audited report and reviews the CGAD in the same week.
With agents
Reviews only the paragraphs that changed, with a note on why each changed.
Still theirs: financial reporting and internal audit oversight
Today
Discovers in an examiner’s or analyst’s question that the CGAD said something different from a questionnaire answer.
With agents
Gets the CGAD checked against every governance answer sent to examiners and rating agencies in the look-back period.
Still theirs: the decision on how to word a real change
Can the CGAD cross-reference the ORSA, Form F or the proxy statement?
Yes, and the model act and regulation both invite it. The act says an insurer that already gives the commissioner substantially similar information elsewhere "shall not be required to duplicate that information in the CGAD, but shall only be required to cross reference the document in which the information is included" (Model #305, § 3F). The regulation names the documents: the ORSA summary report, holding company Form B or Form F filings, SEC proxy statements and foreign regulatory reports, provided the filer clearly points to where the information sits and attaches the document if the regulator does not already have it (Model #306, § 4F).
Cross-referencing saves pages but moves the consistency problem rather than removing it. A CGAD that refers to the ORSA for risk management is only accurate if the ORSA it refers to is the one filed, and if the ORSA's description of the risk committee matches what the CGAD says about committee duties. Where the two were written by different people in different months, the regulator reads both. The ORSA summary report, section by section, shows which of its statements recur in other filings.
What changes in the CGAD each year?
After the first filing, the CGAD becomes an amendment exercise. The model regulation requires the insurer to "file an amended version of the previously filed CGAD indicating where changes have been made," and, if nothing changed, the filing "should so state" (Model #306, § 4G). That turns the annual job into two tasks: find every detail that moved since last year, and show the regulator where.
What to check against last year's CGAD before 1 June
- Board and committee membership
Directors who joined or left, committee chairs, and whether the rationale for board size still holds (§ 5B).
- Meeting counts and attendance
The past year’s numbers, taken from minutes, not carried forward (§ 5C(3)).
- Nomination, term limits and evaluation
Any change to the nomination process, term limits, diversity policy or board evaluation and training (§ 5C(4)–(5)).
- Suitability standards
Positions newly covered, and any change in an officer’s or key person’s suitability (§ 5D(1)).
- Compensation programmes
New elements, risk adjustments or clawback provisions, and the board’s oversight role (§ 5D(3)).
- Succession
Changes to CEO and senior management succession plans (§ 5D(4)).
- Critical risk reporting
New risk areas, changed reporting frequency, and whether cross-referenced documents (ORSA, Form F) are this year’s versions (§§ 4F, 5E).
- Level of reporting
If the reporting level (parent, intermediate holding company or legal entity) changed, the regulation asks the filer to explain it (§ 4D).
This is also where errors creep in. A paragraph copied from last year keeps last year's numbers unless someone checks each one, and meeting counts, member names and committee lists are the details most often copied. The amended-version rule makes stale details more visible, not less: the regulator is told to expect a marked change, and an unmarked change that later surfaces in minutes reads as an omission.
How do examiners use the CGAD?
Examiners start from it. The NAIC's 2025 sound practices for risk-focused financial examinations tell exam teams to "Leverage the Corporate Governance Annual Disclosure (CGAD) filing and related analysis documentation as a starting point for assessment," to consider validating it on a test basis, and to "Highlight any inconsistencies or key information missing from the CGAD" in the summary that goes back to the department's analyst (NAIC sound practices, June 2025). Understanding governance is part of the first phase of every risk-focused exam, alongside board and committee minutes.
That makes the CGAD a document the exam team will test against primary records. If the CGAD says the audit committee met six times and the minutes show four, the gap is a finding about accuracy before it is a finding about governance. The same applies across audiences: governance questions in a rating agency questionnaire, the governance section of an exam request list and the CGAD describe the same board. The examiners' handbook and its first request list show where governance documents are asked for again during an exam.
Where the CGAD meets rating agencies: one governance story, many readers
Governance is not only a regulator's topic. Rating agency questionnaires and management meetings ask about board oversight, risk appetite and management, and the answers are written by the same people who wrote the CGAD, usually months apart. The CGAD itself stays confidential; the details in it do not. A board change described one way in a June CGAD and another way to an agency in the autumn is the kind of inconsistency an analyst asks about.
The practical answer is to treat governance statements the way finance treats filed figures: one approved statement of each point, with its date and its owner, reused wherever it is asked for and changed only on purpose. That is the logic of the reporting calendar above. The CGAD is one of several documents that should agree, and the rating agency presentation is usually the next place the same details appear.
How Rating Agency & Exam Response helps with the CGAD, and where it stops
Botminds' Rating Agency & Exam Response was built for rating agency questionnaires, exam request lists and auditor support lists, and the CGAD's annual amendment is the same kind of job: an approved answer from last year, details that may have moved, owners who must approve, and other audiences who have heard a version of the same story. The agents split the document into its sections, start each from the last approved and sent wording, mark every detail that has changed against its source, and route each section to its owner by topic. The consistency check compares the draft with every answer sent to agencies, examiners, the auditor and the board in the look-back window, and quotes both statements when they differ.
Every approved answer kept with its versions, and where each was sent
Where it stops matters as much. The agents do not decide how the company is governed, judge whether the board's practices are adequate, or decide what to disclose when a matter is sensitive; those are the board's and management's calls. They never file or send anything. The CEO's or corporate secretary's attestation stays a personal statement, made after each owner has approved their section.
Who owns which answers, and when each signs off
Questions people ask
Is the CGAD confidential?
Yes, under the model act. Section 6 treats the CGAD and related material as proprietary and containing trade secrets, confidential by law and privileged, not subject to open-records laws, subpoena or discovery in private civil actions. The commissioner may share it with other regulators and the NAIC that agree in writing to keep it confidential, and can use it in regulatory action.
When did insurers first have to file a CGAD?
The model act set an effective date of 1 January 2016, with the first filing in 2016. Each state's own adoption date governs its domestic insurers. The NAIC lists a substantially similar requirement among the standards it uses to accredit state insurance departments.
Does every insurer have to file a CGAD?
Under the model, the requirement applies to all insurers domiciled in the adopting state, and a group may file for its insurers with the lead state. An insurer that is not required to file must still do so on the commissioner's request. States can vary scope in their own versions, so read your domiciliary statute.
Can a group file one CGAD for all its insurers?
Yes. The regulation lets the filer describe governance at the ultimate controlling parent, an intermediate holding company or the legal entity, and encourages the level at which risk appetite is set or legal liability for governance would fall. A group-level CGAD goes to the lead state, with a copy to any other state with a domestic insurer in the group on request.
What happens if the CGAD is filed late?
The model act provides a penalty for each day of delay when an insurer fails, without just cause, to file on time, imposed after notice and hearing, up to a maximum each state sets. The commissioner may reduce it if the penalty would be a financial hardship. The dollar amounts are left blank in the model for each state to fill in.
Who should own each section of the CGAD?
The model names only the signer, the CEO or corporate secretary. A workable split follows the regulation's areas: the corporate secretary for structure and board practices, the compensation committee's secretary for senior management, and the owner of each critical risk area, from the chief risk officer to the chief actuary, for section 5E. Whoever owns a section should also own the same topic in rating agency and exam answers, so one person keeps the story straight.