Section 89.0 states that the purpose of the regulation is to apply audit and reporting standards upon each company.

Section 89.1 lists all definitions needed for the application of the regulation.

Section 89.2 contains the requirement that each company file audited financial statements and also directs each company to its correct filing location.

Section 89.3 sets forth the details of the items to be included in each audited financial statement.

Section 89.4 requires each company to notify the superintendent of the identity of its certified independent public accountant ("CPA") and any replacement.

Section 89.5 details the necessary qualifications for a CPA and restrictions upon employment of the same CPA for an extended period.

Section 89.6 provides rules for consolidated or combined audits of groups of companies.

Section 89.7 describes the scope of the audit and report of the CPA.

Section 89.8 requires both the company and its CPA to notify the superintendent upon the occurrence of a material misstatement or adverse financial condition.

Section 89.9 imposes a duty upon each company to report unremediated material weaknesses in its internal control over financial reporting.

Section 89.10 specifies terms to be included in the contract between a company and its CPA.

Section 89.11 requires each company to ensure that work papers of the CPA will be retained for review.

Section 89.12 contains rules for the appointment and duties of each company's audit committee.

Section 89.13 specifies the rules of conduct to be followed by the company with respect to the preparation of reports and documents.

Section 89.14 describes the requirements for management's report of internal control over financial reporting and incorporates the reports prepared by some of the companies to comply with the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq.

Section 89.15 sets forth special rules needed for Canadian and British insurers.

Section 89.16 contains the effective dates and special rules.

The full text of the regulation may be found at the Department's website (http://www.ins.state.ny.us/).

1. Statutory authority: Sections 201, 301, 307(b), 1109 and 5904(b) of the Insurance Law. These sections establish the superintendent's authority to promulgate regulations governing audited financial statements for authorized insurers as defined by section 107 of the Insurance Law and for fraternal benefit societies and managed care organizations.

Insurance Law Sections 201 and 301 authorize the superintendent to prescribe forms and regulations interpreting the Insurance Law, and to effectuate any power granted to the superintendent under the Insurance Law.

Insurance Law Section 307(b) requires insurers to file annual financial statements on forms prescribed by the superintendent.

Insurance Law Section 1109 authorizes the superintendent to promulgate regulations to effectuate the purposes and provisions of the Insurance Law and Article 44 of the Public Health Law.

Insurance Law Section 5904(b) requires a risk retention group that is not chartered and licensed as a property/casualty insurer to file a copy of the annual financial statement submitted to the state in which the risk retention group is chartered and licensed.

2. Legislative objectives: 11 NYCRR 89 (Regulation 118) was originally promulgated in 1984 to implement the provisions of Section 307(b) of the Insurance Law. The proposed repeal of the current regulation and promulgation of the new regulation continues to implement the provisions of section 307(b), which requires all but specified small insurers to file annual statements with the superintendent for his review and oversight. The new regulation adds provisions modeled on those required pursuant to the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. (SOX).

3. Needs and benefits: SOX imposes on publicly held companies a comprehensive regime of audits and internal management controls and reports designed to ensure greater transparency and accountability. The concept is that a statutory mandate to regularly review internal processes and to disclose both the processes and the examination will lead to greater care in attending to the obligations owed shareholders and customers.

The proposed regulation is closely patterned upon a National Association of Insurance Commissioners model regulation (NAIC model) that reflects a consensus of the insurance regulators of all states and territories of the United States as to scope, detail, needs and benefits. The NAIC model is similar to current Regulation 118, but imposes additional rules patterned on SOX. For example, the NAIC model and proposed regulation both require the regulated insurer to prohibit its CPA from entering into an agreement of indemnity or release from liability. The proposed regulation will apply not only to companies already subject to SOX, but also to other companies, such as mutual companies, fraternal benefits societies and managed care organizations that are presently governed by Regulation 118.

The proposed regulation, once adopted, will ensure that regulated companies engage in best practices related to auditor independence, corporate governance and internal controls over financial reporting.

4. Costs: This regulation imposes no compliance costs on state or local governments. There will be no additional costs incurred by the Insurance Department. Costs to be incurred by the affected parties differ depending upon the size of the company and whether the company is publicly held and thus already required to comply with SOX. Publicly held companies, which are already regulated by SOX, will incur few additional costs. Many other companies are also regulated by other states, or by United States territories, that have already adopted a version of the NAIC model and thus have already incurred much of the compliance costs associated with this regulation. For this reason, a cross-section of affected companies, which range from large mutual life insurers to fraternal benefit societies, that are not subject to SOX most often estimated compliance costs to be minimal or negligible. Of those companies that stated compliance would require additional expenditures, the amounts ranged from $25,000 per year to in excess of $2 million (for one large mutual life insurer).

The proposed regulation includes provisions that allow small companies for which the expenditures may be material to seek a waiver of any or all of the proposal's requirements on the basis of organizational or financial hardship.

5. Local government mandates: The regulation imposes no new programs, services, duties or responsibilities on any county, city, town, village, school district, fire district or other special district.

6. Paperwork: Additional Paperwork associated with filings to the superintendent should be minimal. The additional paperwork associated with the audit and controls regime required by the proposed regulation should also be minimal.

7. Duplication: None.

8. Alternatives: In developing this regulation, the Department obtained industry input and hued to the NAIC model to implement SOX to the extent possible. However, the model has been modified, as necessary, to comply with New York statutes and regulations. The proposed regulation restricts its application to only those entities over which the Department has jurisdiction, unlike the NAIC model that also contains rules that apply to CPAs. The Department has also included an exemption process by which a company may seek a waiver of any provision based on financial or organizational hardship.

Comments received by the Department from an international law firm, two large insurer groups the American Institute of Certified Public Accountants (AICPA), and representatives of the major accounting firms noted the compliance difficulties faced by foreign companies and United States branches of alien insurers, specifically with respect to the roles to be performed by persons not residing in the United States and the reporting requirements to be imposed upon an integrated enterprise containing insurers in New York as well as entities with no nexus to New York. In response, the Department modified the regulation to provide detailed rules as to whether members of management may attest to filings, and to establish limited exceptions available only to these entities, in addition to the provision that permits a waiver of any provision of the regulation upon evidence of financial or organizational hardship.

The New York Health Plan Association requested that the definition of a managed care organization (MCO), entities that are included within the companies subject to this regulation, be restricted to exclude those entities that operate only in New York and that only serve public programs (i.e., Medicaid, Family Health Plus and Child Health Plus). After consideration and consultation with the Department of Health, the Department narrowed the definition of an MCO to exclude all MCOs that are primarily subject to the oversight of the Department of Health, and that also do not file financial documents with the Department other than for escrow accounts. Other MCOs that do file financial documents with the Department will still be governed by this regulation.

The New York Insurance Association, Inc. objected to restrictions on using the same CPA for SOX audit work and tax return preparation for more than a five-year period for small companies. The exemption from any provision of the proposed regulation available upon proof of financial or organization hardship now addresses this comment.

A large law firm and the major accounting firms noted that a company may be required to file both SOX reports and the reports required by the NAIC model as adopted by the various states. Companies want to avoid making duplicative filings to those required by the state of domicile. The proposed regulation contemplates accepting the domiciliary state filings as New York filings to the extent that they are substantially similar to those required by the proposed regulation.

The AICPA also noted differences between the NAIC model and the proposed regulation on filing deadlines, exceptions and the rules governing confidentiality of work papers. Different dates or deadlines are due to restrictions in New York laws that require modification to the NAIC model. Certain automatic exclusions from the NAIC model could not be included in the proposed regulation to the extent that they conflict with New York law. Finally, the confidentiality of commercial information, including work papers, obtained by state and local government is already subject in New York to a comprehensive regime of rules, exceptions and requirements, and thus did not need to be addressed in the proposed regulation.

The Life Insurance Council of New York, the AICPA and the major accounting firms requested clarification of the requirement to name the staff to be assigned to an audit. The commenters asked that transmittal to the Department of the specific personnel and their qualifications be delayed until the audit was submitted to the Department for review. The concern was that the accountants might be unable to provide an adequate response at the beginning of the audit as appeared to be required. The language has been modified as requested.

Finally, a reinsurer and an insurer group asked whether alien accredited reinsurers were included within the scope of the proposed regulation's rules. They are not, under the explicit definition of the companies that are to be governed, which does not include such reinsurers.

9. Federal standards: The federal rules under SOX are extensive. The provisions in the proposed regulation are similar to the comparable federal provisions. The regulation does not conflict with any federal rules.

10. Compliance schedule: The regulation applies to companies for reporting periods beginning on or after January 1, 2010. Provisions of the regulation allow the company time to bring audit systems and controls into compliance without the need to ask for an extension or waiver. This timetable is contemplated by the NAIC model and has been adopted by many, but not all, states. The Department believes it is highly desirable to conform the application date of this proposed regulation to the effective date in other states.

The Insurance Department finds that this regulation would not impose reporting, recordkeeping or other requirements on small businesses since the provisions contained therein apply only to regulated insurers, fraternal benefit societies and managed care organizations authorized to do business in New York State. Inasmuch as most of these companies are not independently owned and operated and employ more than 100 individuals, they do not fall within the definition of "small business" as found in section 102(8) of the State Administrative Procedure Act.

This regulation specifically considers the impact of the requirements contained therein on small businesses by exempting assessment co-operative property/casualty insurance companies having direct premiums written in New York State of less than $250,0000 in any calendar year and having fewer than 500 policyholders at the end of such calendar year from the requirement to file an annual statement. Further, the proposed regulation allows any company, including a small business, to request an exemption from any and all of its requirements upon written application to the superintendent based upon a financial or organizational hardship upon the company.

This regulation contains, as does current Regulation No. 118, minimum requirements that must be included in the contract between a regulated company and the independent certified public accountant ("CPA") retained by the company. Accordingly, CPAs, regardless of whether they are small businesses or not, could be considered affected parties under this regulation. However, the Insurance Department estimates the impact of the continuation of these rules to be minimal, especially since if a CPA agrees to audit a regulated company, the price of the engagement will compensate the CPA for costs incurred. Additionally, CPAs retained by insurers tend to be large limited liability corporations or partnerships that are not small businesses. In any event, a CPA may choose not to audit a company that will require execution of a contract subject to this regulation.

If the pool of available CPAs in a particular rural area who are qualified to perform the services required by this regulation does not allow for periodic substitution of staff, the company may apply for an exception to the usual requirements requiring such replacements. The Insurance Department will view this circumstance as one of financial or organizational hardship.

The regulation does not impose any impact, including any adverse impact, or reporting, recordkeeping, or other compliance requirement on any local government.

1. Types and estimated number of rural areas: Companies affected by the proposed regulation include regulated insurers, fraternal benefit societies, and managed care organizations authorized to do business in New York State. For this purpose, a managed care organization means the term as defined in 10 NYCRR 98-1.2(x), except for: (1) A prepaid health services plan, as defined in 10 NYCRR 98-1.2(ff); (2) A primary care partial capitation provider, as defined in 10 NYCRR 98-1.2(gg); and (3) A comprehensive HIV special needs plan, as defined in 10 NYCRR 98-1.2(i). The companies affected by this regulation do business in every county in this state, including "rural areas" as defined under section 102(1) of the State Administrative Procedure Act. Some of the home offices of these companies lie within rural areas. Further, companies may establish new office facilities and/or relocate in the future depending on their requirements and needs.

2. Reporting, recordkeeping and other compliance requirements: Many of the compliance requirements (such as filing due date and record retention period) are consistent with the requirements presently contained in Regulation 118 and should not impose upon any regulated party, regardless of whether they are located in a rural area or not, any additional paperwork, recordkeeping or compliance requirements. The obligations imposed by the proposed regulation with regard to establishment and maintenance of audit controls and standards are either consistent with or less than those required by current Regulation 118 and a federal statute, the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX"), that imposes similar rules. If there are failures in the audit and controls process, a company is required to notify the superintendent. The regulation contains automatic exclusions from compliance for certain small companies. Further, any company that faces organizational or financial hardship can seek an exemption from any requirement imposed by the regulation.

The proposed regulation requires a regulated company to perform the audit of its operation and controls with the assistance of a certified independent public accountant ("CPA"). The terms of the employment of the CPA and the period for which work papers and communications are to be retained (contained in 11 NYCRR 243 ("Standards of Record Retention by Insurance Companies")) are both specified in the proposed regulation. Accordingly, CPAs, regardless of whether they are located in rural areas or not, could be considered affected parties under this regulation. However, the Insurance Department estimates the impact of these rules on CPAs, regardless of whether they are located in rural areas or not, should be negligible, if any at all. Indeed, if a CPA agrees to audit a regulated company, the price of the engagement will compensate the CPA for costs incurred. Additionally, CPAs retained by insurers tend to be large limited liability corporations or partnerships that are not small businesses. In any event, a CPA may choose not to audit a company that will require execution of a contract subject to this regulation.

If the pool of available CPAs in a particular rural area who are qualified to perform the services required by this regulation does not allow for periodic substitution of staff, the company may apply for an exception to the usual requirements requiring such replacements. The Insurance Department will view this circumstance as one of financial or organizational hardship.

3. Costs: The proposed regulation implements requirements largely based on the rules imposed by current Regulation 118 and SOX. The cost of complying with the new requirements will depend on the size of the company and whether the company is already subject to SOX because it is publicly held. Companies regulated by SOX will incur few additional costs beyond those imposed by current Regulation 118 and the federal statute. Compliance cost estimates with respect to the proposed regulation were received from a cross-section of companies that are not subject to SOX. If the company is already required to comply with similar regulations in other states, the additional expense of the New York proposed regulation is estimated to be minimal or negligible. Of those companies that stated compliance would require additional expenditures, the amounts range from $25,000 a year to in excess of $2 million (for one very large domestic mutual insurance company).

However, the proposed regulation requires a regulated company to perform the audit of its operation and controls with the assistance of a certified independent public accountant ("CPA"). The terms of the employment of a CPA is specified in the proposed regulation in a manner that is consistent with the current Regulation 118. Further, a CPA can obtain compensation for additional costs as part of the contract entered into with the regulated company. Accordingly, CPAs, regardless of whether they are located in rural areas or not, should not have to incur uncompensated additional costs to comply with the proposed regulation.

4. Minimizing adverse impact: The proposed regulation applies to regulated insurers, fraternal benefit societies and managed care organizations authorized to do business throughout New York State, including rural areas. It does not impose any adverse impacts unique to rural areas.

5. Rural area participation: In developing this regulation, the Department conducted extensive outreach to regulated insurers, fraternal benefit societies and managed care organizations authorized to do business throughout New York State, including those located or domiciled in rural areas.

The Insurance Department finds that this regulation will have no adverse impact on jobs and employment opportunities since, for publicly held companies, its requirements largely reflect obligations already contained in the present Regulation 118 and those imposed by the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX"). For insurers, fraternal benefit societies or managed care organizations not already subject to SOX, the regulation contain minor refinements of those companies' current obligations under Regulation 118 to establish, maintain and report internal audit and oversight. Compliance may require the employment of additional personnel or outside contractors.

No region in New York should experience an adverse impact on jobs and employment opportunities. This regulation should not have a negative impact on self-employment opportunities.