Title of Regulation: 14VAC5-270. Rules Governing Annual Financial Reporting (amending 14VAC5-270-40, 14VAC5-270-100, 14VAC5-270-110, 14VAC5-270-120, 14VAC5-270-144, 14VAC5-270-174; adding 14VAC5-270-145).

Statutory Authority: §§ 12.1-13 and 38.2-223 of the Code of Virginia.

Effective Date: January 1, 2016.

Agency Contact: Raquel C. Pino, Principal Insurance Analyst, Bureau of Insurance, State Corporation Commission, P.O. Box 1157, Richmond, VA 23218, telephone (804) 371-9499, FAX (804) 371-9511, or email raquel.pino@scc.virginia.gov.

Summary:

The amendments address revisions made to the National Association of Insurance Commissioners' Annual Financial Reporting Model Regulation pertaining to the State Corporation Commission's authority to require (i) all large insurers, that is those whose annual premiums exceed $500 million, and (ii) insurance groups, that is those whose annual premiums exceed $1 billion, to maintain an internal audit function that provides independent, objective, and reasonable assurance to the audit committee and insurer management regarding the insurer's governance, risk management, and internal controls. The audit function is required to be organizationally independent from management and to report at least annually to the audit committee on the results of internal audit activities.

AT RICHMOND, DECEMBER 7, 2015

COMMONWEALTH OF VIRGINIA, ex rel.

STATE CORPORATION COMMISSION

CASE NO. INS-2015-00141

Ex Parte: In the matter of
Amending the Rules Governing
Annual Financial Reporting

ORDER ADOPTING RULES

By Order to Take Notice ("Order") entered September 21, 2015,¹ all interested parties were ordered to take notice that subsequent to November 18, 2015, the State Corporation Commission ("Commission") would consider the entry of an order to adopt amendments to the rules set forth in Chapter 270 of Title 14 of the Virginia Administrative Code, entitled Rules Governing Annual Financial Reporting, 14 VAC 5-270-10 et seq. ("Rules"), which amend the Rules at 14 VAC 5-270-40, 14 VAC 5-270-100, 14 VAC 5-270-110, 14 VAC 5-270-120, 14 VAC 5-270-144, and 14 VAC 5-270-174, and add a new Rule at 14 VAC 5-270-145.

The amendments to the Rules were proposed by the Commission's Bureau of Insurance ("Bureau") due to the National Association of Insurance Commissioners' adoption of the revisions to the Annual Financial Reporting Model Regulation. The proposed amendments provide the Commission with the authority to require all insurers with annual premiums exceeding $500 million and insurance groups with annual premiums exceeding $1 billion to maintain an internal audit function that provides independent, objective, and reasonable assurance to the audit committee and management regarding the insurer's governance, risk management, and internal controls. The internal audit function is required to be organizationally independent from management and to report at least annually to the audit committee on the results of internal audit activities.

The Order required that on or before November 18, 2015, any person requesting a hearing on the amendments to the Rules shall have filed such request for a hearing with the Clerk of the Commission ("Clerk"). No request for a hearing was filed with the Clerk.

The Order also required all interested persons to file with the Clerk their comments in support of or in opposition to the amendments to the Rules on or before November 18, 2015. No comments were filed with the Clerk.

The Bureau recommends that the amendments to the Rules be adopted as proposed.

NOW THE COMMISSION, having considered this matter, is of the opinion that the Rules should be adopted as amended and revised.

Accordingly, IT IS ORDERED THAT:

(1) The proposed amendments to Rules Governing Insurance Holding Companies, which amend the Rules at 14 VAC 5-270-40, 14 VAC 5-270-100, 14 VAC 5-270-110, 14 VAC 5-270-120, 14 VAC 5-270-144, and 14 VAC 5-270-174, and add a new Rule at 14 VAC 5-270-145, which are attached hereto and made a part hereof, are hereby ADOPTED to be effective January 1, 2016.

(2) The Bureau forthwith shall give further notice of the adopted Rules by mailing a copy of this Order to every entity that is licensed, approved, registered, or accredited in the Commonwealth of Virginia ("Virginia") under the provisions of Title 38.2 of the Code of Virginia ("Code") and also subject to solvency regulation in Virginia pursuant to the provisions of Title 38.2 of the Code, as well as to all interested parties.

(3) The Commission's Division of Information Resources forthwith shall cause a copy of this Order, together with the attached adopted Rules, to be forwarded to the Virginia Registrar of Regulations for appropriate publication in the Virginia Register of Regulations.

(4) This Order and the attached adopted Rules shall be posted on the Commission's website: http://www.scc.virginia.gov/case.

(5) The Bureau shall file with the Clerk an affidavit of compliance with the notice requirements of Ordering Paragraph (2) above.

(6) This matter hereby is dismissed, and the papers filed herein shall be placed in the file for ended causes.

AN ATTESTED COPY hereof shall be sent by the Clerk of the Commission to the Commission's Office of General Counsel and the Bureau of Insurance in care of Deputy Commissioner Douglas C. Stolte.

_____________________

¹Doc. Con. Cen. No. 150940016.

14VAC5-270-40. Definitions.

The following words and terms when used in this chapter shall have the following meanings, unless the context clearly indicates otherwise:

"Accountant" or "independent certified public accountant" means an independent certified public accountant or accounting firm in good standing with the American Institute of Certified Public Accountants ("AICPA") and in all states in which the accountant or firm is licensed to practice; for Canadian and British companies, it means a Canadian-chartered or British-chartered accountant.

"Affiliate" of a specific person or a person "affiliated" with a specific person means a person that directly or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with the specific person.

"Audit Committee" means a committee (or equivalent body) established by the board of directors of an entity for the purpose of overseeing the accounting and financial reporting processes of an insurer or group of insurers, the internal audit function of an insurer or group of insurers (if applicable), and external audits of financial statements of the insurer or group of insurers. The Audit Committee of an entity that controls a group of insurers may be deemed to be the Audit Committee for one or more of these controlled insurers solely for the purposes of this chapter at the election of the controlling person. If an Audit Committee is not designated by the insurer, the insurer's entire board of directors shall constitute the Audit Committee.

"Audited Financial Report" means and includes those items specified in 14VAC5-270-60.

"Commission" means the State Corporation Commission when acting pursuant to or in accordance with Title 38.2 of the Code of Virginia.

"Due date" means (i) June 1 for all domestic insurers; (ii) June 30 for all foreign or alien companies domiciled or entered through a state in which similar law, regulation, or administrative practice provides for a June 30 filing date; and (iii) for all other insurers, the earlier of June 30 or the date established by the insurer's state of domicile or entry for filing similar audited financial reports.

"Group of insurers" means those licensed insurers included in the reporting requirements of Article 5 (§ 38.2-1322 et seq.) of Chapter 13 of Title 38.2 of the Code of Virginia, or a set of insurers as identified by an entity's management, for the purpose of assessing the effectiveness of internal control over financial reporting.

"Indemnification" means an agreement of indemnity or a release from liability where the intent or effect is to shift or limit in any manner the potential liability of the person or firm for failure to adhere to applicable auditing or professional standards, whether or not resulting in part from knowing or other misrepresentations made by the insurer or its representatives.

"Internal audit function" means a person or persons that provide independent, objective, and reasonable assurance designed to add value and improve an organization's operations and accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

"Internal control over financial reporting" means a process effected by an entity's board of directors, management, and other personnel designed to provide reasonable assurance regarding the reliability of the financial statements and includes those policies and procedures that:

1. Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of assets;

2. Provide reasonable assurance that transactions are recorded as necessary to permit preparation of the financial statements and that receipts and expenditures are being made only in accordance with authorizations of management and directors; and

3. Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of assets that could have a material effect on the financial statements.

"NAIC" means the National Association of Insurance Commissioners.

"RBC" means risk-based capital.

"RBC Level" means a licensee's Company Action Level RBC, Regulatory Action Level RBC, Authorized Control Level RBC, or Mandatory Control Level RBC where:

1. "Company Action Level RBC" means, with respect to any licensee, the product of 2.0 and its Authorized Control Level RBC;

2. "Regulatory Action Level RBC" means the product of 1.5 and its Authorized Control Level RBC;

3. "Authorized Control Level RBC" means the number determined under the risk-based capital formula in accordance with the RBC Instructions; and

4. "Mandatory Control Level RBC" means the product of 0.70 and the Authorized Control Level RBC.

"SEC" means the United States U.S. Securities and Exchange Commission.

"Section 404" means Section 404 of the Sarbanes-Oxley Act of 2002 (15 USC § 7201 et seq.) and the SEC's rules and regulations promulgated thereunder.

"Section 404 report" means management's report on "internal control over financial reporting" as defined by the SEC and the related attestation report of the independent certified public accountant.

"SOX compliant entity" means an entity that either is required to be compliant with, or voluntarily is compliant with, all of the following provisions of the Sarbanes-Oxley Act of 2002 (15 USC § 7201 et seq.): (i) the preapproval requirements of Section 201 (Section 10A(i) of the Securities Exchange Act of 1934 (15 USC § 78a et seq.)); (ii) the Audit Committee independence requirements of Section 301 (Section 10A(m)(3) of the Securities Exchange Act of 1934 (15 USC § 78a et seq.)); and (iii) the internal control over financial reporting requirements of Section 404 (Item 308 of SEC Regulation S-K).

"Workpapers" means the records kept by the accountant of the procedures followed, the tests performed, the information obtained, and the conclusions reached pertinent to the accountant's examination of the financial statements of an insurer. Workpapers, accordingly, may include work programs, analyses, memoranda, letters of confirmation and representation, abstracts of company documents, and schedules or commentaries prepared or obtained by the accountant in the course of the examination of the financial statements of an insurer and which support the accountant's opinion thereof.

14VAC5-270-100. Scope of audit and report of independent certified public accountant.

Financial statements furnished pursuant to 14VAC5-270-60 shall be examined by an accountant. The audit of the insurer's financial statements shall be conducted in accordance with generally accepted auditing standards. In accordance with U.S. Auditing (AU) Standards - AICPA Clarified (AU-C) Section 319 315 of the AICPA Professional Standards, Consideration of Internal Control in a Financial Statement Audit Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, the accountant shall obtain an understanding of internal control sufficient to plan the audit. To the extent required by AU AU-C Section 319 315, for those insurers required to file a Management's Report of Internal Control over Financial Reporting pursuant to 14VAC5-270-148, the accountant should consider (as the term should consider is defined in Statements on Auditing Standards (SAS) No. 102 AU-C Section 200 of the AICPA Professional Standards, Defining Professional Requirements in Statements on Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Generally Accepted Auditing Standards) the most recently available report in planning and performing the audit of the statutory financial statements. Consideration shall be given to the procedures illustrated in the Financial Condition Examiners Handbook promulgated by the NAIC as the accountant deems necessary.

14VAC5-270-110. Notification of adverse financial condition.

A. The insurer required to furnish the annual Audited Financial Report shall require the accountant to report in writing within five business days to the board of directors or its Audit Committee any determination by the accountant that the insurer has materially misstated its financial condition as reported to the commission as of the balance sheet date under examination or that the insurer does not meet its minimum statutory capital and surplus requirements as of that date pursuant to Virginia law. An insurer that has received a report pursuant to this subsection shall forward a copy of the report to the commission within five business days of receipt of the report and shall provide the accountant making the report with evidence of the report being furnished to the commission. If the accountant fails to receive the evidence within the required five-business-day period, the accountant shall furnish to the commission a copy of its report within the next five business days.

B. No accountant shall be liable in any manner to any person for any statement made in connection with subsection A of this section if the statement is made in good faith in compliance with subsection A of this section.

C. If the accountant, subsequent to the date of the Audited Financial Report filed pursuant to this chapter, becomes aware of facts which might have affected the report, the commission notes the obligation of the accountant to take action as prescribed in AU AU-C Section 561 560 of the AICPA Professional Standards, Subsequent Discovery of Events and Subsequently Discovered Facts Existing at the Date of the Auditor's Report.

14VAC5-270-120. Communicating internal control related matters identified in an audit.

A. In addition to the annual Audited Financial Report, each insurer shall furnish the commission with a written communication as to any unremediated material weaknesses in its internal controls over financial reporting identified during the audit. The communication shall be prepared by the accountant within 60 days after the filing of the annual Audited Financial Report, and shall contain a description of any unremediated material weakness (as the term material weakness is defined in SAS No. 112 AU-C Section 265 of the AICPA Professional Standards, Communicating Internal Control Related Matters Identified in an Audit) as of the immediately preceding December 31 (so as to coincide with the Audited Financial Report discussed in 14VAC5-270-50 A) in the insurer's internal control over financial reporting identified by the accountant during the course of the audit of the financial statements. If no unremediated material weaknesses were identified, the communication should so state.

B. The insurer is required to provide a description of remedial actions taken or proposed to correct unremediated material weaknesses, if the actions are not described in the accountant's communication.

C. The insurer is expected to maintain information about significant deficiencies communicated by the independent certified public accountant. The information should be made available to the examiner conducting a financial condition examination for review and kept in a manner as to remain confidential.

14VAC5-270-144. Requirements for Audit Committees.

A. This section shall not apply to foreign or alien insurers licensed in Virginia or an insurer that is a SOX compliant entity or a direct or indirect wholly-owned subsidiary of a SOX compliant entity.

B. The Audit Committee shall be directly responsible for the appointment, compensation and oversight of the work of any accountant (including resolution of disagreements between management and the accountant regarding financial reporting) for the purpose of preparing or issuing the Audited Financial Report or related work pursuant to this chapter. Each accountant shall report directly to the Audit Committee.

C. The Audit Committee of an insurer or group of insurers shall be responsible for overseeing the insurer's internal audit function and granting the person or persons performing the function suitable authority and resources to fulfill their responsibilities if required by 14VAC5-270-145.

D. Each member of the Audit Committee shall be a member of the board of directors of the insurer or a member of the board of directors of an entity elected pursuant to subsection F G of this section.

D. E. In order to be considered independent for purposes of this section, a member of the Audit Committee may not, other than in the capacity as a member of the Audit Committee, the board of directors, or any other board committee, accept any consulting, advisory, or other compensatory fee from the entity or be an affiliated person of the entity or subsidiary thereof. However, if Virginia law requires board participation by otherwise nonindependent members, that law shall prevail and such members may participate in the Audit Committee and be designated as independent for Audit Committee purposes, unless they are an officer or employee of the insurer or one of its affiliates.

E. F. If a member of the Audit Committee ceases to be independent for reasons outside the member's reasonable control, that member, with notice by the responsible entity to the commission, may remain an Audit Committee member of the responsible entity until the earlier of the next annual meeting of the responsible entity or one year from the occurrence of the event that caused the member to be no longer independent.

F. G. To exercise the election of the controlling person to designate the Audit Committee for purposes of this chapter, the ultimate controlling person shall provide written notice to the commission of the affected insurers. Notification shall be made timely prior to the issuance of the statutory audit report and include a description of the basis for the election. The election can be changed through notice to the commission by the insurer, which shall include a description of the basis for the change. The election shall remain in effect for perpetuity, unless rescinded.

G. H. The Audit Committee shall require the accountant that conducts for an insurer any audit required by this chapter to timely report to the Audit Committee in accordance with the requirements of SAS No. 114 AU-C Section 260 of the AICPA Professional Standards, The Auditor's Communication with those Charged with Governance, including:

1. All significant accounting policies and material permitted practices;

2. All material alternative treatments of financial information within statutory accounting principles that have been discussed with management officials of the insurer, ramifications of the use of the alternative disclosures and treatments, and the treatment preferred by the accountant; and

3. Other material written communications between the accountant and the management of the insurer, such as any management letter or schedule of unadjusted differences.

If an insurer is a member of an insurance holding company system, the reports required by this subsection may be provided to the Audit Committee on an aggregate basis for insurers in the holding company system, provided that any substantial differences among insurers in the system are identified to the Audit Committee.

H. I. The proportion of independent Audit Committee members shall meet or exceed the following criteria:

Prior Calendar Year Direct Written and Assumed Premiums
$0 - $300 million	Over $300 million - $500 million	Over $500 million
No minimum requirements. See Notes A and B.	Majority (50% or more) of members shall be independent. See Notes A and B.	Supermajority of members (75% or more) shall be independent. See Note A.

Note A: The commission has authority afforded by state law to require the entity's board to enact improvements to the independence of the Audit Committee membership if the insurer is in a RBC level event, meets one or more of the standards of an insurer deemed to be in hazardous financial condition, or otherwise exhibits qualities of a troubled insurer.

Note B: All insurers with less than $500 million in prior year direct written and assumed premiums are encouraged to structure their Audit Committees with at least a supermajority of independent Audit Committee members.

Note C: Prior calendar year direct written and assumed premiums shall be the combined total of direct premiums and assumed premiums from nonaffiliates for the reporting entities.

I. J. An insurer with direct written and assumed premiums, excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, less than $500 million may make application to the commission for a waiver from the requirements of this section based upon hardship. The insurer shall file, with its annual statement filing, the commission's letter granting relief from this section with the states in which it is licensed or doing business and the NAIC. If the nondomestic state accepts electronic filing with the NAIC, the insurer shall file the letter granting relief in an electronic format acceptable to the NAIC.

14VAC5-270-145. Internal audit function requirements.

A. An insurer is exempt from the requirements of this section if:

1. The insurer has annual direct written and unaffiliated assumed premium, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, less than $500 million; and

2. If the insurer is a member of a group of insurers, the group has annual direct written and unaffiliated assumed premium including international direct and assumed premium, but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, less than $1 billion.

B. The insurer or group of insurers shall establish an internal audit function providing independent, objective, and reasonable assurance to the Audit Committee and insurer management regarding the insurer's governance, risk management, and internal controls. This assurance shall be provided by performing general and specific audits, reviews, and tests and by employing other techniques deemed necessary to protect assets, evaluate control effectiveness and efficiency, and evaluate compliance with policies and regulations.

C. In order to ensure that internal auditors remain objective, the internal audit function must be organizationally independent. Specifically, the internal audit function will not defer ultimate judgment on audit matters to others and shall appoint an individual to head the internal audit function who will have direct and unrestricted access to the board of directors. Organizational independence does not preclude dual-reporting relationships.

D. The head of the internal audit function shall report to the Audit Committee regularly, but no less often than annually, on the periodic audit plan, factors that may adversely impact the internal audit function's independence or effectiveness, material findings from completed audits, and the appropriateness of corrective actions implemented by management as a result of audit findings.

E. If an insurer is a member of an insurance holding company system or included in a group of insurers, the insurer may satisfy the internal audit function requirements set forth in this section at the ultimate controlling parent level, an intermediate holding company level, or the individual legal entity level.

14VAC5-270-174. Retention of independent certified public accountant on or after January 1, 2010, and other effective dates.

A. Unless otherwise noted, the requirements of this chapter shall become effective for the reporting period ending December 31, 2010, and each year thereafter. An insurer or group of insurers not required to file a report because its total written premium is below the threshold that subsequently becomes subject to the reporting requirements shall have two years following the year the threshold is exceeded (but not earlier than December 31, 2010) to file a report. Likewise, an insurer acquired in a business combination shall have two calendar years following the date of acquisition or combination to comply with the reporting requirements.

B. The requirements of 14VAC5-270-80 D shall become effective for audits of the year beginning January 1, 2010, and thereafter.

C. The requirements of 14VAC5-270-144 shall become effective on January 1, 2010. An insurer or group of insurers that is not required to have independent Audit Committee members or only a majority of independent Audit Committee members (as opposed to a supermajority) because the total direct written and assumed premium is below the threshold and subsequently becomes subject to one of the independence requirements due to changes in premium shall have one year following the year the threshold is exceeded (but not earlier than January 1, 2010) to comply with the independence requirements. Likewise, an insurer that becomes subject to one of the independence requirements as a result of a business combination shall have one calendar year following the date of acquisition or combination to comply with the independence requirements.

D. The requirements of 14VAC5-270-145 are to become effective January 1, 2016. If an insurer or group of insurers that is exempt from the 14VAC5-270-145 requirements no longer qualifies for that exemption, it shall have one year after the year the threshold is exceeded to comply with the requirements of this chapter.

FORMS (14VAC5-270)

Affidavit for Exemption From Filing Audited Financial Reports, SCCBOI-16.

Audited Financial Statements Exemption Affidavit Year Ended December 31, 2014, R03 (eff. 10/2014)

DOCUMENTS INCORPORATED BY REFERENCE (14VAC5-270)

AICPA Professional Standards, Volume 1, June 1, 2007, American Institute of Certified Public Accountants.

AICPA Professional Standards, Volume 2, June 1, 2007, American Institute of Certified Public Accountants.

AICPA Professional Standards, Volume 1, as of June 1, 2015, American Institute of Certified Public Accountants, New York, New York 10036-8775, http://www.aicpa.org

AICPA Professional Standards, Volume 2, as of June 1, 2015, American Institute of Certified Public Accountants, New York, New York 10036-8775, http://www.aicpa.org