§ 58-10-255. Management's report of internal control over financial reporting.
§ 58‑10‑255. Management's report of internal control over financial reporting.
(a) Every insurerrequired to file an audited financial report pursuant to this Part that hasannual direct written and assumed premiums, excluding premiums reinsured withthe Federal Crop Insurance Corporation and Federal Flood Program, of fivehundred million dollars ($500,000,000) or more shall prepare a report of theinsurer's or group of insurers' internal control over financial reporting, asthese terms are defined in G.S. 58‑10‑190. The report shall befiled with the Commissioner along with the communication of internal controlrelated matters noted in an audit described under G.S. 58‑10‑230.Management's report of internal control over financial reporting shall be as ofDecember 31 immediately preceding.
(b) Notwithstanding thepremium threshold in subsection (a) of this section, the Commissioner mayrequire an insurer to file management's report of internal control overfinancial reporting if the insurer is in any risk‑based capital levelevent, or meets any one or more of the standards of an insurer deemed to be inhazardous financial condition as defined in G.S. 58‑30‑60(b).
(c) An insurer or agroup of insurers that is:
(1) Directly subject toSection 404;
(2) Part of a holdingcompany system whose parent is directly subject to Section 404;
(3) Not directly subjectto Section 404 but is a SOX‑compliant entity; or
(4) A member of aholding company system whose parent is not directly subject to Section 404 butis a SOX‑compliant entity may file its or its parent's Section 404 reportand an addendum in satisfaction of this subsection's requirement provided thatthose internal controls of the insurer or group of insurers having a materialimpact on the preparation of the insurer's or group of insurers' auditedstatutory financial statements for items included in G.S. 58‑10‑200(b)(2)through G.S. 58‑10‑200(b)(6) were included in the scope of theSection 404 report. The addendum shall be a positive statement by managementthat there are no material processes with respect to the preparation of theinsurer's or group of insurers' audited statutory financial statements foritems included in G.S. 58‑10‑200(b)(2) through G.S. 58‑10‑200(b)(6)that were excluded from the Section 404 report. If there are internal controlsof the insurer or group of insurers that have a material impact on thepreparation of the insurer's or group of insurers' audited statutory financialstatements and those internal controls were not included in the scope of theSection 404 report, the insurer or group of insurers may either file (i) a G.S.58‑10‑255 report, or (ii) the Section 404 report and a G.S. 58‑10‑255report for those internal controls that have a material impact on thepreparation of the insurer's or group of insurers' audited statutory financialstatements not covered by the Section 404 report.
(d) Management's reportof internal control over financial reporting shall include all of thefollowing:
(1) A statement thatmanagement is responsible for establishing and maintaining adequate internalcontrol over financial reporting.
(2) A statement thatmanagement has established internal control over financial reporting and anassertion, to the best of management's knowledge and belief, after diligent inquiry,as to whether its internal control over financial reporting is effective toprovide reasonable assurance regarding the reliability of financial statementsin accordance with statutory accounting principles.
(3) A statement thatbriefly describes the approach or processes by which management evaluated theeffectiveness of its internal control over financial reporting.
(4) A statement thatbriefly describes the scope of work that is included and whether any internalcontrols were excluded.
(5) Disclosure of anyunremediated material weaknesses in the internal control over financialreporting identified by management as of December 31 immediately preceding.Management is not permitted to conclude that the internal control overfinancial reporting is effective to provide reasonable assurance regarding thereliability of financial statements in accordance with statutory accountingprinciples if there are one or more unremediated material weaknesses in itsinternal control over financial reporting.
(6) A statementregarding the inherent limitations of internal control systems.
(7) Signatures of thechief executive officer and the chief financial officer, or equivalentpositionitle.
(e) Management shalldocument and make available upon a financial condition examination the basisupon which its assertions, required in subsection (d) of this section, aremade. Management may base its assertions, in part, upon its review, monitoring,and testing of internal controls undertaken in the normal course of its activities.Management shall have discretion as to the nature of the internal controlframework used, and the nature and extent of documentation, in order to makeits assertion in a cost‑effective manner and, as such, may includeassembly of or reference to existing documentation. Management's report oninternal control over financial reporting, required by subsection (a) of thissection, and any documentation provided in support thereof during the course ofa financial condition examination, shall be kept confidential by theCommissioner. (2009‑384,s. 1.)