Model Audit Rule 101: What Insurance Companies Need to Know

Your premium and market share are growing and this is an exciting time! Premium and surplus growth can provide new opportunities and expose new hurdles for an insurance company. State insurance regulators focus greater attention on larger insurance organizations, and impose additional layers of compliance, in a continuous effort to fulfill their duty to protect consumers and ensure fair, competitive, and healthy insurance markets. 

State-Based Regulation

Insurance companies are subject to state insurance regulation that is interconnected with the National Association of Insurance Commissioners (NAIC), whose role is to assist state insurance regulators in fulfilling their financial oversight responsibilities for insurance companies domiciled in the state. The NAIC sets standards and regulatory best practices for insurance companies that can be adopted by states partially or in whole. Certain standards are required to be adopted by states within a specific time frame in order for the state to retain its NAIC accreditation. Accreditation is a certification that confirms that a state insurance regulator meets various legal, financial and organizational standards, as determined by a peer review process.

One of the most consequential regulations developed by the NAIC in coordination with the American Institute of Certified Public Accountants (AICPA) is the Annual Financial Reporting Model Regulation 205, commonly known as Model Audit Rule (MAR) 205.

What is MAR 205? 

Established in 2006, and amended over time, MAR 205 requires all insurers in the United States that exceed certain amounts of direct and assumed written premiums to comply with specific independence, governance, and internal control requirements. 

The development of MAR 205 was significantly influenced by the Sarbanes Oxley Act of 2002, which enhanced financial reporting standards for public companies after a variety of significant accounting scandals in the early 2000’s, most notably Enron, led to large losses for investors. 

The regulation serves to improve state insurance department surveillance of the financial condition of insurers. Many elements of MAR 205 requirements are also necessary for state insurance department accreditation. Find a comparison of state requirements to MAR 205 on the NAIC’s website. 

Applicability and Requirements 

MAR 205 establishes requirements for all life and annuity, property and casualty, title, and health plans, as well as additional requirements as the insurance entity grows in size of direct and assumed written premiums. The table below summarizes the requirements by each premium level:

Compliance Timeline

MAR 205 also establishes a timeline for when insurers must be compliant with each of the requirements after reaching $300M in written premium. An insurer is deemed to have breached a premium threshold when the direct and assumed written premium amounts within the statutory annual statement exceed $300M or $500M. 

An insurer with direct and assumed written premiums over $300M has one year to be in compliance with the Audit Committee requirements. As the insurer grows and crosses $500M of direct and assumed written premiums the insurer will have one year to be in compliance with the new Audit Committee and Internal Audit requirements and two years to be in compliance with and submit management’s report of Internal Control over Financial Reporting (ICFR).

It can be challenging for insurance company internal controls and processes to grow and evolve alongside organizational growth. Controls that made sense in the past may no longer be efficient. Or there may be unnecessary duplication in internal controls testing. Significant data enhancements exist today such as robotic process automation that allow companies to test entire populations with the click of a button. Preparation for MAR 205 is an opportunity for insurance companies to streamline their internal controls and processes and enhance the overall internal control environment.

Insurance companies must maintain robust financial reporting practices and internal controls, particularly as they reach the higher MAR thresholds. Compliance with MAR 205 is a continuous effort that requires coordination across the entire organization. It is essential to become familiar with the regulation and start the conversation early to ensure appropriate knowledge and awareness exists throughout the organization. 

Need help getting started? Johnson Lambert’s team of MAR subject matter experts is here to guide you through the process. Contact us today.