Sec.38a-54-11c. Management’s report of internal control over financial reporting

(a) Each insurer required to file an audited financial report pursuant to Sections 38a-54-1 through 38a-54-14, inclusive, of the Regulations of the Connecticut State Agencies that has annual direct written and assumed premiums, excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of $500,000,000 or more shall prepare a report of the insurer’s or group of insurers’ internal control over financial reporting, as these terms are defined in Section 38a-54-2. The report shall be filed with the Commissioner along with the Communication of Internal Control Related Matters Noted in an Audit described under Section 38a-54-9a of the Regulations of Connecticut State Agencies. The Management’s Report of Internal Control Over Financial Reporting shall be as of December 31 immediately preceding.

(b) Notwithstanding the premium threshold in subsection (a) of this section, the Commissioner may require an insurer to file a Management’s Report of Internal Control over Financial Reporting if the insurer is in a risk-based capital level event, or meets any one or more of the standards of an insurer deemed to be in hazardous financial condition as defined in Sections 38a-8-101 to 38a-8-104, inclusive, 38a-72-1 to 38a-72-13, inclusive, and 38a-193-1 to 38a-193-13, inclusive, of the Regulations of the Connecticut State Agencies.

(c) An insurer or a group of insurers that is (1) directly subject to Section 404; (2) part of a holding company system whose parent is directly subject to Section 404; (3) not directly subject to Section 404 but is a SOX compliant entity; or (4) a member of a holding company system whose parent is not directly subject to Section 404 but is a SOX compliant entity, may file its or its parent’s Section 404 Report and an addendum in satisfaction of this section’s requirement, provided that the internal controls of the insurer or group of insurers having a material impact on the preparation of the insurer’s or group of insurers’ audited statutory financial statements (those items included in Section 38a-54-4 of the Regulations of Connecticut State Agencies) were included in the scope of Section 404 Reports. The addendum shall be a positive statement by management that there are no material processes with respect to the preparation of the insurer’s or group of insurers’ audited statutory financial statements (those items included in Section 38a-54-4 of the Regulations of Connecticut State Agencies) excluded from the Section 404 Report. If there are internal controls of the insurer or group of insurers or that have a material impact on the preparation of the insurer’s or group of insurers’ audited statutory financial statements and those internal controls were not included in the scope of the Section 404 Report, the insurer or group of insurers may either file a report pursuant to this section or a Section 404 Report and a report pursuant to this section for those internal controls that have a material impact on the preparation of the insurer’s or group of insurers’ audited statutory financial statements not covered by the Section 404 Report.

(d) The Management’s Report of Internal Control Over Financial Reporting shall include:

(1) A statement that management is responsible for establishing and maintaining adequate internal controls over financial reporting;

(2) A statement that management has established internal controls over financial reporting and an assertion, to the best of management’s knowledge and belief, after diligent inquiry, as to whether its internal controls over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements in accordance with statutory accounting principles;

(3) A statement that briefly describes the approach or processes by which management evaluated the effectiveness of its internal controls over financial reporting;

(4) A statement that briefly describes the scope of work that is included and whether any internal controls were excluded;

(5) Disclosure of any unremediated material weaknesses in the internal controls over financial reporting identified by management as of December 31 immediately preceding. Management shall not conclude that the internal controls over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements in accordance with statutory accounting principles if there is one or more unremediated material weaknesses in its Internal controls over financial reporting;

(6) A statement regarding the inherent limitations of internal control systems; and

(7) Signatures of the chief executive officer and the chief financial officer or equivalent position or title.

(e) (1) Management shall document and make available upon financial condition examination the basis upon which its assertions, required in subsection (d) of this section are made. Management may base its assertions, in part, upon its review, monitoring and testing of internal controls undertaken in the normal course of its activities.

(2) Management shall have discretion as to the nature of the internal control framework used, and the nature and extent of documentation, in order to make its assertion in a cost effective manner, and as such, may include assembly of or reference to existing documentation.

(3) Management’s Report on Internal Control Over Financial Reporting, required by subsection (a) of this section, and any documentation provided in support thereof during the course of a financial condition examination, shall be kept confidential by the insurance department.

(f) The requirements of this section shall be effective beginning with the reporting period ending December 31, 2010 and each year thereafter. An insurer or group of insurers that is not required to file a report because the total written premium is below the threshold that subsequently becomes subject to the reporting requirements shall have two years following the year the threshold is exceeded, but not earlier than December 31, 2010 to file a report. Likewise, an insurer acquired in a business combination shall have two calendar years following the date of acquisition or business combination to comply with the reporting requirements.

(Adopted effective December 23, 2008; Amended March 27, 2017)