PURSUANT TO THE PROVISIONS OF THE State Administrative Procedure Act, NOTICE is hereby given of the following action:
Action taken:
Repeal of Part 89; and addition of new Part 89 (Regulation 118) to Title 11 NYCRR.
Statutory authority:
Insurance Law, sections 201, 301, 307(b), 1109, 4710(a)(2) and 5904(b)
Finding of necessity for emergency rule:
Preservation of general welfare.
Specific reasons underlying the finding of necessity:
In September 2009, the New York State Insurance Department, after several years of working closely with the National Association of Insurance Commissioners ("NAIC"), received its accreditation under the NAIC's Financial Regulations Standards and Accreditation Program ("accreditation program"). This accreditation program is the cornerstone of uniform solvency regulation across the country. By obtaining accreditation, New York was recognized as having demonstrated its continued commitment to the NAIC and state-based regulation of insurers and other regulated entities. The regulatory regime acknowledged through the accreditation program provides substantial protection for the policyholders and for state and local governments that rely on the stability and solvency of insurers that do an insurance business within their borders.
The accreditation program is designed principally to ensure that all regulated insurers are required to maintain financial solvency. Other goals achieved by states that have been approved by the accreditation program are verification that the state conducts effective and efficient financial analysis and examination process, and has in place the appropriate organizational and personnel practices.
The benefits of accreditation for the Insurance Department are many. The chief benefit is that New York's examinations, audits and other reviews of its regulated insurers will be recognized by her sister states so that other states will not subject New York domestic insurers to greater barriers of entry and operation than non-New York insurers. Further, accreditation indicates that the Insurance Department examination and audit operations and controls meet a nationally recognized standard assuring potential policyholders that the prospective insurers meet desirable levels of financial solvency.
Accreditation is not a one-time event. Accredited insurance departments are required to undergo a comprehensive review by an independent review team every five years to ensure departments continue to meet baseline financial solvency oversight standards. Newly accredited insurance departments undergo this review both to obtain the initial approval and, in the case of the New York State Insurance Department, an additional review within two years of accreditation. The accreditation standards require state insurance departments to have adequate statutory and administrative authority to regulate an insurer's corporate and financial affairs, and that they have the necessary resources to carry out that authority.
Among the commitments made by the Insurance Department to the NAIC as a condition of New York's approval under the accreditation program is an assurance that an NAIC model audit rule (NAIC model) would be timely adopted to be effective for regulated insurers as of January 1, 2010. The purpose of the NAIC model is to implement a state statute or regulation that contains a requirement for an annual audit of each domestic insurer by an independent certified public accountant (CPA), based on the June 1998 version of the NAIC's Model Rule Requiring Annual Audited Financial Reports. Further, the NAIC model, once adopted by a state, requires that an insurer comply with certain best practices related to auditor independence, corporate governance and internal controls over financial reporting. The NAIC model reflects a consensus of the insurance regulators of all states and territories of the United States as to scope, detail, needs and benefits. The NAIC model closely hews to the audit and controls standards established by the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq., and extends that statute's application to regulated companies.
Continuation of accreditation by the NAIC requires New York to adopt specific rules in addition to those already imposed by current 11 NYCRR 89 (Regulation 118). For example, New York must prohibit each CPA from entering into an agreement of indemnity or release from liability, and must require CPA partner rotation in a manner similar to the NAIC's model.
Each of the required elements is contained in the proposed rule, either as a result of the adoption of the standards of the NAIC model or the continuation of the standards contained in present Regulation 118. New York has made every effort to conform the proposed rule to the NAIC model, except where inconsistent with a statutory requirement expressly established by New York law. Furthermore, and critically, the effective date stated in the proposed rule is required to maintain accreditation – January 1, 2010.
This regulation was previously promulgated on an emergency basis on December 28, 2009; March 25, 2010; and June 23, 2010. The proposal was sent to the Governor's Office of Regulatory Reform (GORR) on March 12, 2010. The Department and GORR had a conference call on May 6, 2010 to discuss questions and comments on the rule package. The Department sent revisions to GORR on June 23, 2010 and GORR responded with written suggestions on July 14, 2010, which are currently being reviewed. Pending GORR's approval, this regulation must be continued on an emergency basis because of the accreditation deadline.
For the reasons stated above, this rule must be promulgated on an emergency basis for the furtherance of the general welfare.
Subject:
Audited Financial Statements.
Purpose:
To implement provisions of Insurance Law Section 307(b), and add provisions required pursuant to the federal Sarbanes-Oxley Act of 2002.
Substance of emergency rule:
Part 89 (Regulation No. 118) consists of 17 sections addressing the regulation of audits conducted by regulated insurers, fraternal benefit societies and managed care organizations (collectively the "companies").
Section 89.0 states that the purpose of the regulation is to apply audit and reporting standards upon each company.
Section 89.1 lists all definitions needed for the application of the regulation.
Section 89.2 contains the requirement that each company file audited financial statements and also directs each company to its correct filing location.
Section 89.3 sets forth the details of the items to be included in each audited financial statement.
Section 89.4 requires each company to notify the superintendent of the identity of its certified independent public accountant ("CPA") and any replacement.
Section 89.5 details the necessary qualifications for a CPA and restrictions upon employment of the same CPA for an extended period.
Section 89.6 provides rules for consolidated or combined audits of groups of companies.
Section 89.7 describes the scope of the audit and report of the CPA.
Section 89.8 requires both the company and its CPA to notify the superintendent upon the occurrence of a material misstatement or adverse financial condition.
Section 89.9 imposes a duty upon each company to report unremediated material weaknesses in its internal control over financial reporting.
Section 89.10 specifies terms to be included in the contract between a company and its CPA.
Section 89.11 requires each company to ensure that work papers of the CPA will be retained for review.
Section 89.12 contains rules for the appointment and duties of each company's audit committee.
Section 89.13 specifies the rules of conduct to be followed by the company with respect to the preparation of reports and documents.
Section 89.14 describes the requirements for management's report of internal control over financial reporting and incorporates the reports prepared by some of the companies to comply with the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq.
Section 89.15 sets forth special rules needed for Canadian and British insurers.
Section 89.16 contains the effective dates and special rules.
The full text of the regulation may be found at the Department's website (http://www.ins.state.ny.us/).
This notice is intended
to serve only as a notice of emergency adoption. This agency intends to adopt this emergency rule as a permanent rule and will publish a notice of proposed rule making in the State Register at some future date. The emergency rule will expire March 16, 2011.
Text of rule and any required statements and analyses may be obtained from:
Andrew Mais, New York State Insurance Department, 25 Beaver Street, New York, NY 10004, (212) 480-5257, email: amais@ins.state.ny.us
Regulatory Impact Statement
1. Statutory authority: Sections 201, 301, 307(b), 1109, 4710(a)(2) and 5904(b) of the Insurance Law.
These sections establish the superintendent's authority to promulgate regulations governing audited financial statements for authorized insurers as defined by section 107 of the Insurance Law and for fraternal benefit societies and managed care organizations.
Insurance Law Sections 201 and 301 authorize the superintendent to prescribe forms and regulations interpreting the Insurance Law, and to effectuate any power granted to the superintendent under the Insurance Law.
Insurance Law Section 307(b) requires insurers to file annual financial statements on forms prescribed by the superintendent.
Insurance Law Section 1109 provides that the superintendent may promulgate regulations in effectuating the purposes and provisions of the Insurance Law and Article 44 of the Public Health Law.
Insurance Law Section 4710(a)(2) requires municipal cooperative health benefit plans to file annual financial statements on forms prescribed by the superintendent.
Insurance Law Section 5904(b) requires risk retention groups not chartered and licensed as property/casualty insurers to file a copy of the annual financial statement submitted to the state in which the risk retention group is chartered and licensed.
2. Legislative objectives: 11 NYCRR 89 (Regulation 118) was originally promulgated in 1984 to implement the provisions of Section 307(b) of the Insurance Law. The proposed repeal of the current regulation and promulgation of the new regulation continues to implement the provisions of section 307(b), and add provisions required pursuant to the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX").
3. Needs and benefits: SOX imposes a comprehensive regime of audits and internal management controls and reports designed to ensure greater transparency and accountability.
The proposed regulation is closely patterned upon a National Association of Insurance Commissioners model regulation ("NAIC model") that reflects a consensus of the insurance regulators of all states and territories of the United States as to scope, detail, needs and benefits. The NAIC model is similar to current Regulation 118 but imposes additional rules patterned on SOX. For example, the NAIC model and proposed regulation both require the regulated insurer to forbid its CPA from entering into an agreement of indemnity or release from liability. The proposed regulation will apply not only to companies already subject to SOX, but also to other companies, such as mutual companies, fraternal benefits societies and managed care organizations, that are presently governed by Regulation 118.
The proposed regulation, once adopted, will ensure that regulated companies engage in best practices related to auditor independence, corporate governance and internal controls over financial reporting.
4. Costs: This regulation imposes no compliance costs on state or local governments. There will be no additional costs incurred by the Insurance Department. Costs to be incurred by the parties affected differ depending upon the size of the company and whether that company is publicly held and thus already required to comply with SOX. Companies regulated by SOX will incur few additional costs. Compliance cost estimates received from a cross-section of affected companies that are not subject to SOX are most often estimated to be minimal or negligible. Of those companies that stated compliance would require additional expenditures, the amounts range from $25,000 a year to in excess of $2 million (for one large mutual insurance company).
5. Local government mandates: The regulation imposes no new programs, services, duties or responsibilities on any county, city, town, village, school district, fire district or other special district.
6. Paperwork: Paperwork associated with filings to the superintendent should be minimal. The paperwork associated with the audit and controls regime required by the proposed regulation should also be minimal.
7. Duplication: None.
8. Alternatives: In developing this regulation, the Department obtained industry input and hued to the model regulation developed by the National Association of Insurance Commissioners (the "NAIC model") to implement SOX to the extent possible. However, the model has been modified as necessary to comply with New York statutes and regulations. The proposed regulation also restricts its application only to those entities over which the Department has jurisdiction unlike the NAIC model, which also contains rules that apply to CPAs.
Several comments received by the Department noted the compliance difficulties faced by foreign companies and United States branches of alien insurers, specifically with respect to the roles to be performed by persons not residing in the United States and for the reporting requirements to be imposed upon an integrated enterprise containing insurers in New York as well as entities with no nexus to New York. In response, the Department modified the regulation to provide detailed rules as to whether members of management may attest to filings, and to establish limited exceptions available only to these entities, in addition to the provision that permits a waiver of any provision of the regulation upon evidence of financial or organizational hardship.
One commenter requested that the definition of a managed care organization ("MCO"), entities that are included within the companies subject to this regulation, be restricted to exclude those entities that operate only in New York and that only serve public programs, i.e., Medicaid, Family Health Plus and Child Health Plus. After consideration and consultation with the Department of Health, the Department narrowed the definition of an MCO to exclude all MCOs that are primarily subject to the oversight of the Department of Health, and thatalso do not file financial documents with the Department other than for escrow accounts. Other MCOs that do file financial documents with the Insurance Department will still be governed by this regulation.
Another commenter objected to restrictions on using the same CPA for SOX audit work and tax return preparation for more than a five-year period for small companies. The exemption from any provision of the proposed regulation available upon proof of financial or organization hardship now addresses this comment.
Several comments noted that a company may be required to file both SOX reports and the reports required by the NAIC model as adopted by the various states. Companies want to avoid making duplicative filings to those required by the state of domicile. The proposed regulation contemplates accepting the domiciliary state filings as New York filings to the extent that they are substantially similar to those required by the proposed regulation.
Several comments noted differences between the NAIC model and the proposed regulation on filing deadlines, exceptions and the rules governing confidentiality of work papers. Different dates or deadlines are due to restrictions in New York law that require modification to the NAIC model. Certain automatic exclusions from the NAIC model could not be included in the proposed regulation to the extent that they conflict with New York law. Finally, the confidentiality of commercial information, including work papers, obtained by state and local government is already subject in New York to a comprehensive regime of rules, exceptions and requirements, and thus did not need to be addressed in the proposed regulation.
9. Federal standards: The federal rules under SOX are extensive. The provisions in the proposed regulation are similar to the comparable federal provisions. The regulation does not conflict with any federal rules.
10. Compliance schedule: The regulation applies to companies for reporting periods beginning on or after January 1, 2010. Provisions of the regulation allow the company time to bring audit systems and controls into compliance without the need to ask for an extension or waiver. This timetable is contemplated by the NAIC model and has been adopted by many, but not all, states. The Department believes it is highly desirable to conform the application date of this proposed regulation to the effective date in other states.
Regulatory Flexibility Analysis
The Insurance Department finds that this regulation would not impose reporting, recordkeeping or other requirements on small businesses since the provisions contained therein apply only to regulated insurers, fraternal benefit societies and managed care organizations authorized to do business in New York State. Inasmuch as most of these companies are not independently owned and operated and employ more than 100 individuals, they do not fall within the definition of "small business" as found in section 102(8) of the State Administrative Procedure Act.
This regulation specifically considers the impact of the requirements contained therein on small businesses by exempting assessment co-operative property/casualty insurance companies having direct premiums written in New York State of less than $250,0000 in any calendar year and having fewer than 500 policyholders at the end of such calendar year from the requirement to file an annual statement. Further, the proposed regulation allows any company, including a small business, to request an exemption from any and all of its requirements upon written application to the superintendent based upon a financial or organizational hardship upon the company.
This regulation contains, as does current Regulation No. 118, minimum requirements that must be included in the contract between a regulated company and the independent certified public accountant ("CPA") retained by the company. Accordingly, CPAs, regardless of whether they are small businesses or not, could be considered affected parties under this regulation. However, the Insurance Department estimates the impact of the continuation of these rules to be minimal, especially since if a CPA agrees to audit a regulated company, the price of the engagement will compensate the CPA for costs incurred. Additionally, CPAs retained by insurers tend to be large limited liability corporations or partnerships that are not small businesses. In any event, a CPA may choose not to audit a company that will require execution of a contract subject to this regulation.
If the pool of available CPAs in a particular rural area who are qualified to perform the services required by this regulation does not allow for periodic substitution of staff, the company may apply for an exception to the usual requirements requiring such replacements. The Insurance Department will view this circumstance as one of financial or organizational hardship.
The regulation does not impose any impact, including any adverse impact, or reporting, recordkeeping, or other compliance requirement on any local government.
Rural Area Flexibility Analysis
1. Types and estimated number of rural areas: Companies affected by the proposed regulation include regulated insurers, fraternal benefit societies, and managed care organizations authorized to do business in New York State. For this purpose, a managed care organization means the term as defined in 10 NYCRR 98-1.2(x), except for: (1) A prepaid health services plan, as defined in 10 NYCRR 98-1.2(ff); (2) A primary care partial capitation provider, as defined in 10 NYCRR 98-1.2(gg); and (3) A comprehensive HIV special needs plan, as defined in 10 NYCRR 98-1.2(i). The companies affected by this regulation do business in every county in this state, including "rural areas" as defined under section 102(1) of the State Administrative Procedure Act. Some of the home offices of these companies lie within rural areas. Further, companies may establish new office facilities and/or relocate in the future depending on their requirements and needs.
2. Reporting, recordkeeping and other compliance requirements: Many of the compliance requirements (such as filing due date and record retention period) are consistent with the requirements presently contained in Regulation 118 and should not impose upon any regulated party, regardless of whether they are located in a rural area or not, any additional paperwork, recordkeeping or compliance requirements. The obligations imposed by the proposed regulation with regard to establishment and maintenance of audit controls and standards are either consistent with or less than those required by current Regulation 118 and a federal statute, the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX"), that imposes similar rules. If there are failures in the audit and controls process, a company is required to notify the superintendent. The regulation contains automatic exclusions from compliance for certain small companies. Further, any company that faces organizational or financial hardship can seek an exemption from any requirement imposed by the regulation.
The proposed regulation requires a regulated company to perform the audit of its operation and controls with the assistance of a certified independent public accountant ("CPA"). The terms of the employment of the CPA and the period for which work papers and communications are to be retained (contained in 11 NYCRR 243 ["Standards of Record Retention by Insurance Companies"]) are both specified in the proposed regulation. Accordingly, CPAs, regardless of whether they are located in rural areas or not, could be considered affected parties under this regulation. However, the Insurance Department estimates the impact of these rules on CPAs, regardless of whether they are located in rural areas or not, should be negligible, if any at all. Indeed, if a CPA agrees to audit a regulated company, the price of the engagement will compensate the CPA for costs incurred. Additionally, CPAs retained by insurers tend to be large limited liability corporations or partnerships that are not small businesses. In any event, a CPA may choose not to audit a company that will require execution of a contract subject to this regulation.
If the pool of available CPAs in a particular rural area who are qualified to perform the services required by this regulation does not allow for periodic substitution of staff, the company may apply for an exception to the usual requirements requiring such replacements. The Insurance Department will view this circumstance as one of financial or organizational hardship.
3. Costs: The proposed regulation implements requirements largely based on the rules imposed by current Regulation 118 and SOX. The cost of complying with the new requirements will depend on the size of the company and whether the company is already subject to SOX because it is publicly held. Companies regulated by SOX will incur few additional costs beyond those imposed by current Regulation 118 and the federal statute. Compliance cost estimates with respect to the proposed regulation were received from a cross-section of companies that are not subject to SOX. If the company is already required to comply with similar regulations in other states, the additional expense of the New York proposed regulation is estimated to be minimal or negligible. Of those companies that stated compliance would require additional expenditures, the amounts range from $25,000 a year to in excess of $2 million (for one very large domestic mutual insurance company).
However, the proposed regulation requires a regulated company to perform the audit of its operation and controls with the assistance of a certified independent public accountant ("CPA"). The terms of the employment of a CPA is specified in the proposed regulation in a manner that is consistent with the current Regulation 118. Further, a CPA can obtain compensation for additional costs as part of the contract entered into with the regulated company. Accordingly, CPAs, regardless of whether they are located in rural areas or not, should not have to incur uncompensated additional costs to comply with the proposed regulation.
4. Minimizing adverse impact: The proposed regulation applies to regulated insurers, fraternal benefit societies and managed care organizations authorized to do business throughout New York State, including rural areas. It does not impose any adverse impacts unique to rural areas.
5. Rural area participation: In developing this regulation, the Department conducted extensive outreach to regulated insurers, fraternal benefit societies and managed care organizations authorized to do business throughout New York State, including those located or domiciled in rural areas.
Job Impact Statement
The Insurance Department finds that this regulation will have no adverse impact on jobs and employment opportunities since, for publicly held companies, its requirements largely reflect obligations already contained in the present Regulation 118 and those imposed by the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. (“SOX”). For insurers, fraternal benefit societies or managed care organizations not already subject to SOX, the regulation contain minor refinements of those companies’ current obligations under Regulation 118 to establish, maintain and report internal audit and oversight. Compliance may require the employment of additional personnel or outside contractors.
No region in New York should experience an adverse impact on jobs and employment opportunities. This regulation should not have a negative impact on self-employment opportunities.
