§ 31–311.03. Management’s report of internal control over financial reporting.

(a) An insurer required to file an audited financial report pursuant to this chapter that has annual direct written and assumed premiums of at least $500 million, excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, shall prepare a management’s report of the insurer’s or group of insurers’ internal control over financial reporting. The report shall be filed with the Mayor along with the communication of internal control related matters noted in an audit described in § 31-309. A management’s report of internal control over financial reporting shall be made as of December 31 immediately preceding the date of the report.

(b) Notwithstanding subsection (a) of this section, the Mayor may require an insurer to file a management’s report of internal control over financial reporting if the insurer:

(1) Is in any RBC level event as provided in Chapter 20 of this title [§ 31-2001 et seq.], and Chapter 34A of this title [§ 31-3451.01 et seq.]; or

(2) Meets one or more of the standards of an insurer deemed to be in hazardous financial condition as provided in Chapter 21 of this title [§ 31-2101 et seq.].

(c)(1) An insurer or a group of insurers that is (A) directly subject to Section 404; (B) part of a holding company system whose parent is directly subject to Section 404; (C) not directly subject to Section 404, but is a SOX Compliant Entity; or (D) a member of a holding company system whose parent is not directly subject to Section 404 but is a SOX Compliant Entity, may file its, or its parent’s, Section 404 Report and an addendum that complies with the requirements of this section; provided, that those internal controls of the insurer or group of insurers having a material impact on the preparation of the insurer’s or group of insurers’ audited statutory financial statements were included in the scope of the Section 404 Report.

(2) An addendum filed with a Section 404 Report shall be an affirmative statement by management that no material processes were excluded in the scope of the Section 404 Report. If there are internal controls of the insurer or group of insurers that have a material impact on the preparation of the insurer’s or group of insurers’ audited statutory financial statements that were not included in the scope of the Section 404 Report, the insurer or group of insurers shall file:

(A) A report pursuant to this section; or

(B) A Section 404 Report and a report pursuant to this section that addresses those internal controls not covered by the Section 404 Report.

(d) A management’s report of internal control over financial reporting shall include:

(1) A statement that management is responsible for establishing and maintaining adequate internal control over financial reporting;

(2) A statement that management has established internal control over financial reporting and an assertion as to whether, to the best of management’s knowledge and belief, after diligent inquiry, the internal control over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements prepared in accordance with statutory accounting principles;

(3) A statement describing the framework or processes by which management evaluates the effectiveness of its internal control over financial reporting;

(4) A statement describing the scope of work that is included and whether any internal controls were excluded;

(5)(A) Disclosure of any unremediated material weaknesses in the internal control over financial reporting identified by management as of December 31 immediately preceding the date of the report.

(B) Management shall not be permitted to conclude that the internal control over financial reporting is effective if there is one or more unremediated material weaknesses in its internal control over financial reporting;

(6) A statement regarding the inherent limitations of internal control systems; and

(7) Signatures of the chief executive officer and the chief financial officer, or the equivalents thereof.

(e) Management shall document and make available during the course of any financial condition examination the basis upon which its assertions offered pursuant to this section are made. Management may base its assertions, in part, on its review, monitoring, and testing of internal controls undertaken in the normal course of its activities.

(f) Management shall have discretion as to the nature of the internal control framework used, and the nature and extent of documentation, to make its assertions in a cost effective manner and, as such, may include assembly of or reference to existing documentation.

(g) A management’s report on internal control over financial reporting filed with the Mayor pursuant to this section, including any supporting documentation submitted in support thereof, shall be kept confidential.