HAR §16-185-113. Requirements for audit committees

(a) This section shall not apply to foreign or alien insurers licensed in this State or an insurer that is a SOX compliant entity or a direct or indirect wholly- owned subsidiary of a SOX compliant entity. (b) The audit committee shall be directly responsible for the appointment, compensation, and oversight of the work of any accountant, including resolution of disagreements between management and the accountant regarding financial reporting, for the purpose of preparing or issuing the audited financial report or related work pursuant to this chapter. Each accountant shall report directly to the audit committee. (c) Beginning January 1, 2020, the audit committee of an insurer or group of insurers shall be responsible for overseeing the insurer's internal audit function and granting the person or persons performing the function suitable authority and resources to fulfill their responsibilities if required by section 16-185-113.1, Hawaii Administrative Rules. (d) Each member of the audit committee shall be a member of the board of directors of the insurer or a member of the board of directors of an entity elected pursuant to subsection (g). (e) In order to be considered independent for purposes of this section, a member of the audit committee may not, other than in his or her capacity as a member of the audit committee, the board of directors, or any other board committee, accept any consulting, advisory, or other compensatory fee from the entity or be an affiliated person of the entity or any subsidiary thereof. However, if law requires board participation by otherwise non-independent members, that law shall prevail and such members may participate in the audit committee and be designated as independent for audit committee purposes, unless they are an officer or employee of the insurer or one of its affiliates. (f) If a member of the audit committee ceases to be independent for reasons outside the member's §16-185-113 185-23 reasonable control, that person, with notice by the responsible entity to the commissioner, may remain an audit committee member of the responsible entity until the earlier of the next annual meeting of the responsible entity or one year from the occurrence of the event that caused the member to be no longer independent. In determining independence, the commissioner shall consider utilizing guidance provided in the Securities and Exchange Commission's Final Rule No. 33-8220, Standards Relating to Listed Company Audit Committees adopted April 9, 2003, as amended or replaced. (g) To exercise the election of the controlling person to designate the audit committee for purposes of this chapter, the ultimate controlling person shall provide written notice to the commissioners of the affected insurers. Notification shall be made timely prior to the issuance of the statutory audit report and include a description of the basis for the election. The election can be changed through notice to the commissioner by the insurer, which shall include a description of the basis for the change. The election shall remain in effect for perpetuity, until rescinded. (h) (1) The audit committee shall require the accountant, who performs for an insurer any audit required by this chapter, to timely report to the audit committee in accordance with the requirements of Statement on Auditing Standards 114, The Auditor's Communication with those charged with Governance, as amended or replaced, including: (A) All significant accounting policies and material permitted practices; (B) All material alternative treatments of financial information within statutory accounting principles that have been discussed with management officials of the insurer, ramifications of the use of the alternative disclosures and §16-185-113 185-24 treatments, and the treatment preferred by the accountant; and (C) Other material written communications between the accountant and the management of the insurer, such as any management letter or schedule of unadjusted differences. (2) If an insurer is a member of an insurance holding company system, the reports required by subsection (h)(1) may be provided to the audit committee on an aggregate basis for insurers in the holding company system, provided that any substantial differences among insurers in the system are identified to the audit committee. (i) (1) The proportion of independent audit committee members shall meet or exceed the following criteria: Prior Calendar Year Direct Written and Assumed Premiums $0 - $300,000,000 Over $300,000,000 -$500,000,000 Over $500,000,000 No minimum requirements. See also paragraphs (i)(2) and (i)(3). Majority (50% or more) of members shall be independent. See also paragraphs (i)(2) and (i)(3). Supermajority of members (75% or more) shall be independent. See also paragraph (i)(2). (2) The commissioner has authority afforded by state law to require the entity's board to enact improvements to the independence of the audit committee membership if the insurer is in a risk-based capital action level event, meets one or more of the standards of an insurer deemed to be in §16-185-113.1 185-25 hazardous financial condition, or otherwise exhibits qualities of a troubled insurer. (3) All insurers with less than $500,000,000 in prior year direct written and assumed premiums are encouraged to structure their audit committees with at least a supermajority of independent audit committee members. (4) Prior calendar year direct written and assumed premiums shall be the combined total of direct premiums and assumed premiums from non-affiliates for the reporting entities. (j) An insurer with direct written and assumed premium, excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, less than $500,000,000 may make application to the commissioner for a waiver from the section 16-185-113, Hawaii Administrative Rules, requirements based upon hardship. The insurer shall file, with its annual statement filing, the approval for relief from section 16-185-113, Hawaii Administrative Rules, with the states that it is licensed in or doing business in and the National Association of Insurance Commissioners. If the nondomestic state accepts electronic filing with the National Association of Insurance Commissioners, the insurer shall file the approval in an electronic format acceptable to the National Association of Insurance Commissioners. [Eff 2/04/10; am and comp 12/30/19] (Auth: HRS §431:2-201) (Imp: HRS §§431:2-201, 431:3-302.5) §16-185-113.1 Internal audit function requirements. (a) The insurer or group of insurers shall establish an internal audit function providing independent, objective, and reasonable assurance to the audit committee and insurer management regarding the insurer's governance, risk management, and internal controls. This assurance shall be provided by performing general and specific audits, reviews, and tests and by employing other techniques deemed §16-185-113.1 185-26 necessary to protect assets, evaluate control effectiveness and efficiency, and evaluate compliance with policies and regulations. (b) In order to ensure that internal auditors remain objective, the internal audit function must be organizationally independent. Specifically, the internal audit function will not defer ultimate judgement on audit matters to others, and shall appoint an individual to head the internal audit function who will have direct and unrestricted access to the board of directors. Organizational independence does not preclude dual-reporting relationships. (c) The head of the internal audit function shall report to the audit committee regularly, but no less than annually, on the periodic audit plan, factors that may adversely impact the internal audit function's independence or effectiveness, material findings from completed audits, and the appropriateness of corrective actions implemented by management as a result of audit findings. (d) If an insurer is a member of an insurance holding company system or included in a group of insurers, the insurer may satisfy the internal audit function requirements set forth in this section at the ultimate controlling parent level, an intermediate holding company level, or the individual legal entity level. (e) An insurer is exempt from the requirements of this section if: (1) The insurer has annual direct written and unaffiliated assumed premium, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, less than $500,000,000; and (2) If the insurer is a member of a group of insurers that has annual direct written and unaffiliated assumed premium including international direct and assumed premium, but excluding premiums reinsured with the §16-185-114 185-27 Federal Corp Insurance Corporation and Federal Flood Program, less than $1,000,000,000. [Eff 12/30/19] (Auth: HRS §431:2-201) (Imp: HRS §§431:2-201, 431:3- 302.5) §16-185-114 Conduct of insurer in connection with the preparation of required reports and documents. (a) No director or officer of an insurer shall, directly or indirectly: (1) Make or cause to be made a materially false or misleading statement to an accountant in connection with any audit, review, or communication required under this chapter; or (2) Omit to state, or cause another person to omit to state, any material fact necessary, in light of the circumstances under which the statements were made, so as to mislead an accountant in connection with any audit, review, or communication required under this chapter. (b) No officer or director of an insurer, or any other person acting under the direction thereof, shall directly or indirectly take any action to coerce, manipulate, mislead, or fraudulently influence any accountant engaged in the performance of an audit pursuant to this chapter if that person knew or should have known that the action, if successful, could result in rendering the insurer's financial statements materially misleading. (c) For purposes of subsection (b), actions that, "if successful, could result in rendering the insurer's financial statements materially misleading" include, but are not limited to, actions taken at any time with respect to the professional engagement period to coerce, manipulate, mislead, or fraudulently influence an accountant: (1) To issue or reissue a report on an insurer's financial statements that is not warranted §16-185-114 185-28 in the circumstances due to material violations of statutory accounting principles prescribed by the commissioner, generally accepted auditing standards, or other professional or regulatory standards; (2) Not to perform audit, review, or other procedures required by generally accepted auditing standards or other professional standards; (3) Not to withdraw an issued report; or (4) Not to communicate matters to an insurer's audit committee. [Eff 2/04/10; comp 12/30/19] (Auth: HRS §431:2-201) (Imp: HRS §§431:2-201, 431:3-302.5) §16-185-115 Management's report of internal control over financial reporting. (a) Every insurer required to file an audited financial report that has annual direct written and assumed premiums, excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of $500,000,000 or more shall prepare a report of the insurer's or group of insurers' internal control over financial reporting, as these terms are defined in section 16- 185-102, Hawaii Administrative Rules. The report shall be filed with the commissioner along with the communication of internal control related matters noted in an audit described under section 16-185-110, Hawaii Administrative Rules. Management's report of internal control over financial reporting shall be as of the December 31 immediately preceding. (b) Notwithstanding the premium threshold in subsection (a) the commissioner may require an insurer to file management's report of internal control over financial reporting if the insurer is in any risk- based capital level event, as defined in section 431:3-401, HRS, or meets any one or more of the standards of an insurer deemed to be in hazardous financial condition as defined in section 431:15- 103.5, HRS. §16-185-115 185-29 (c) An insurer or a group of insurers that is: (1) Directly subject to section 404; (2) Part of a holding company system whose parent is directly subject to section 404; (3) Not directly subject to section 404 but is a SOX compliant entity; or (4) A member of a holding company system whose parent is not directly subject to section 404 but is a SOX compliant entity; may file its or its parent's section 404 report and an addendum in satisfaction of this section's requirement provided that those internal controls of the insurer or group of insurers having a material impact on the preparation of the insurer's or group of insurers' audited statutory financial statements, those items included in section 16-185-104(2) through (7), Hawaii Administrative Rules, were included in the scope of the section 404 report. The addendum shall be a positive statement by management that there are no material processes with respect to the preparation of the insurer's or group of insurers' audited statutory financial statements excluded from the section 404 report. If there are internal controls of the insurer or group of insurers that have a material impact on the preparation of the insurer's or group of insurers' audited statutory financial statements and those internal controls were not included in the scope of the section 404 report, the insurer or group of insurers may either file a report required by this section, or the section 404 report and this section's report for those internal controls that have a material impact on the preparation of the insurer's or group of insurers' audited statutory financial statements not covered by the section 404 report. (d) Management's report of internal control over financial reporting shall include: (1) A statement that management is responsible for establishing and maintaining adequate internal control over financial reporting; (2) A statement that management has established internal control over financial reporting §16-185-115 185-30 and an assertion, to the best of management's knowledge and belief, after diligent inquiry, as to whether its internal control over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements in accordance with statutory accounting principles; (3) A statement that briefly describes the approach or processes by which management evaluated the effectiveness of its internal control over financial reporting; (4) A statement that briefly describes the scope of work that is included and whether any internal controls were excluded; (5) Disclosure of any unremediated material weaknesses in the internal control over financial reporting identified by management as of the December 31 immediately preceding. Management is not permitted to conclude that the internal control over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements in accordance with statutory accounting principles if there is one or more unremediated material weaknesses in its internal control over financial reporting; (6) A statement regarding the inherent limitations of internal control systems; and (7) Signatures of the chief executive officer and the chief financial officer or equivalent position or title. (e) Management shall document and make available upon financial condition examination the basis upon which its assertions required, in subsection (d), are made. Management may base its assertions, in part, upon its review, monitoring, and testing of internal controls undertaken in the normal course of its activities. Additionally: (1) Management shall have discretion as to the nature of the internal control framework §16-185-116 185-31 used, and the nature and extent of documentation, in order to make its assertion in a cost-effective manner and, as such, may include assembly of or reference to existing documentation; and (2) Management's report on internal control over financial reporting, required by subsection (a) and any documentation provided in support thereof during the course of a financial condition examination, shall be kept confidential by the insurance division. [Eff 2/04/10; am and comp 12/30/19] (Auth: HRS §431:2-201) (Imp: HRS §§431:2-201, 431:3-302.5, 431:3-401, 431:15-103.5)