Does the NAIC Model Audit Rule require an ICFR report for my insurer?
The NAIC's Annual Financial Reporting Model Regulation (#205), known as the Model Audit Rule, requires insurance companies with $500 million or more in direct and assumed premium to file a management report on internal control over financial reporting. Whether that requirement binds your company depends on the state that licenses it, because each state decides whether and how to adopt the model, and the adopted version is the rule that applies to your insurer. Start by confirming your direct and assumed premium figure against the threshold, then ask your domestic state regulator which version of the model it has adopted and whether any state-specific changes apply.
The premium test is not the only variable. The threshold, the state version and your own control environment together determine the answer. Check whether your premium is measured the way the model measures it, including assumed business, and whether any affiliates or group members are reported on a combined basis. Then ask how the report is expected to be prepared and attested under your state's version, since the NAIC/AICPA Working Group reviews Model #205 and its implementation guide on an ongoing basis and state adoption can lag those revisions. Document these answers in writing so the scope decision can be reviewed later.
Responsibility for the report stays with your company. Management owns the controls, makes the assessment and signs the report, while an implementation partner can help prepare systems, documentation and evidence for the IT controls that support financial reporting. Any attestation on the report must come from an independent auditor, and that auditor issues the opinion, not the partner. Before you engage anyone, ask for a written scope that separates preparation work from anything the auditor will test, and confirm with your state regulator and your external auditor what they expect to receive.
Which version of the rule applies to each insurer
When an insurer's domiciliary state has adopted Model #205 without material changes, the model text sets the obligation. The insurer measures its direct and assumed premium against the $500 million threshold and, if it meets it, prepares the management report on internal control over financial reporting that the model describes. The model's threshold is reviewed each year under Section 16, and the NAIC/AICPA Working Group intends the rule to capture at least approximately 90% of industry premium, so the threshold figure can move between years.
- Premium base: Count direct and assumed premium as the model defines it, not only the written premium on the domestic book.
- Annual threshold review: Confirm the figure in force for each reporting year, because Section 16 is reviewed annually.
- Report content: Prepare the management report against the model's requirements and its implementation guide, including the IT general controls that support financial reporting.
- Model revisions: The Working Group's 2026 charges direct continual review of the model and guide, so an as-written adoption can change when the model changes.
Confirm with the domiciliary regulator that the state's adopted text matches the current model and that no later amendment has been filed.
Many states adopt a model with changes to thresholds, timing, exemptions or the content of the report. A modified adoption means the state's enacted text controls, even where it still resembles Model #205. The insurer should not rely on the model's wording or the implementation guide alone, because a single changed clause can alter whether the report is required, which entities file it, or which IT controls the report must cover.
- Threshold variations: A state may set a different premium figure or define premium in a different way.
- Exemptions and carve-outs: Some insurers or lines may be excluded, or given a different schedule. Confirm each one against the state text.
- Report form and recipients: States can change what the report must address and who receives it.
- Effective dates: A change may take effect on a different date from the model, so the first year of a new requirement may not match the national timetable.
- Interaction with other obligations: For insurers that are also public companies, confirm how the state report sits alongside SOX 404 obligations of the parent.
Ask compliance counsel for a side-by-side comparison of the enacted state text against the model, with the effective date of each difference.
Some insurers operate in states whose internal control reporting rules do not track Model #205 closely, or whose rules are still being developed. In these cases the domiciliary state's own rules govern the insurer, and the model is a reference point rather than a binding text. The insurer should establish which rule applies before it designs the IT control scope, since an incorrect assumption about the threshold or the report can lead to work the regulator does not require or to a filing gap.
- No adoption: If the state has not adopted the model, confirm whether any internal control reporting requirement applies at all.
- Different framework or attestation: State rules may name a different control framework or a different level of review for the report.
- Entity scope: Confirm which legal entities in a group must file, and whether a group-level report or entity-level reports are expected.
- Multistate operations: Check how the domicile determines the governing rule when the insurer writes premium in several states.
Obtain a written determination from the domiciliary regulator and compliance counsel before scoping IT general controls, and record the date of that determination so the position can be reviewed when the model or state law changes.
How the NAIC report compares with SOX 404 for public insurers
A public insurer can owe both the SOX 404 assessment under Rule 13a-15 and the NAIC Model Audit Rule report. The two differ in who receives the report, which framework they use, who reviews them and who signs, but they rest on the same controls and the same IT general controls.
Management report versus auditor attestation
SOX 404 requires management's annual ICFR assessment and, for accelerated and large accelerated filers that are not emerging growth companies, an auditor attestation under Section 404(b). The NAIC report is a management report on ICFR filed with the regulator. Check whether your company is subject to the auditor attestation, because that determines whether an independent firm must also test your IT general controls for SOX purposes, while the NAIC filing may still require an independent CPA's audit opinion under the model. Confirm the exact requirements with your state of domicile.
Regulatory audience versus the SEC
SOX reports go to investors through SEC filings. The NAIC report goes to the insurance commissioner of each state that adopts Model #205. Your filing calendar, disclosure language and reviewers therefore differ. Map each report to its audience before drafting, and confirm with your regulators which state adoption applies to each insurance subsidiary, since adoption varies by state.
Framework expected
Rule 13a-15(c) requires management to evaluate ICFR against a suitable, recognized framework, and COSO's 2013 framework is the widely used choice. Confirm which framework the state regulator expects for the NAIC report and whether the implementation guide points to a different reference. Using one framework for both reports keeps control descriptions consistent and avoids two sets of deficiency definitions.
Review cycle and rule changes
The NAIC/AICPA Working Group reviews the premium threshold in Section 16 of Model #205 annually and continually reviews the model and its implementation guide under its 2026 charges. SOX requirements change through SEC rules and PCAOB standards on their own timetable. Assign one owner to track both sources, and record which version of each applies at each fiscal year end.
Who signs and who is accountable
For SOX, the chief executive and chief financial officers certify the filings, and management signs its ICFR assessment. The NAIC report is signed by the insurer's management under the model's requirements. Confirm the named signers, the sign-off sequence and the documentation each signer relies on. Independent auditors and certification bodies issue reports or opinions; DeployOpen prepares the systems and evidence that support them but signs nothing on the company's behalf.
One control inventory for both reports
A public insurer may face SOX 404 under Rule 13a-15 and the NAIC report at the same time. Build a single control inventory covering financial reporting controls, the IT general controls that keep automated controls reliable, and their owners, evidence and test results. Running two separate inventories invites contradictions between the SEC and state filings, so reconcile differences in scope or wording before each year end.
Which IT general controls the NAIC report brings into scope
The NAIC report puts IT general controls in scope only where they support financial reporting, and the insurer decides that scope itself. SEC guidance in Release 33-8810 names program development, program changes, computer operations and access to programs and data as areas management might consider, but it says these areas do not apply to every company. It also says IT general controls alone ordinarily do not address financial reporting risks, while automated controls often depend on them. For an insurer, the practical question is which automated controls produce or check numbers that reach the financial statements, and which ITGCs keep those controls reliable. No catalog of ITGCs exists, so the insurer must document its own scoping and the reasoning behind it.
A top-down, risk-based approach starts at the financial statements and works down to systems. Management first identifies significant accounts and disclosures, such as reserves, premium and ceded balances, and claim payments, then traces which applications record, calculate or summarize those amounts. A policy administration system that rates and issues policies, a claims system that sets case reserves and approves payments, and the general ledger that posts summarized results are typical candidates. Each one needs its own determination of which automated controls matter, and the ITGCs supporting those controls are then scoped in. Interfaces between systems and the databases and infrastructure underneath them should be considered too. Confirm with your auditor and state regulator how your filing reflects these decisions, since the NAIC rule itself does not prescribe a list.
Write the scoping decision down before testing begins. The document should list each in-scope application, database and infrastructure component, the financial statement risk it addresses, the automated controls that depend on it, and the reason any system was excluded. Ask whether a system that only affects operational efficiency, such as a workforce scheduling tool, falls outside the financial reporting scope, and record the answer. Revisit the scope when a system is replaced, a new line of business is added or a reporting process changes. An auditor or consultant can challenge the reasoning, but the insurer owns the conclusion and the evidence that supports it.
How the management report cycle runs for an insurer
The sequence moves from scoping the financial reporting controls to a signed management report on ICFR, with IT general controls tested along the way so that automated controls can be relied on. Each phase produces an artifact that the next phase depends on.
Scope the financial reporting controls
Finance, actuarial and the compliance lead identify the financial statement areas and accounts that drive the insurer's annual statutory and GAAP filings, including premium, claims reserves and reinsurance balances. The output is a scoping memo and a control inventory that lists each key control, its owner and the systems that run it. The step is complete when management can trace every material account to at least one documented control. Confirm the exact scoping expectations with your state regulator and the Model #205 implementation guide, since state adoption determines which rule applies.
Map applications and reports to controls
IT and finance work together to identify which policy administration, claims, actuarial, general ledger and reporting systems feed the key controls, and which system-generated reports management relies on. The output is a system and report inventory linked to the control inventory. The step is complete when each automated control and each report used in a control has a named system owner and a documented data source.
Document IT general controls over automated controls
IT documents the IT general controls that keep those automated controls and reports reliable, in the four areas SEC guidance names: access to programs and data, program changes, program development and computer operations. The output is a written ITGC narrative and a matrix that links each ITGC to the application and control it supports. The step is complete when the design of each relevant ITGC has been walked through with the control owner and recorded.
Test design and operating effectiveness
Internal audit or a qualified tester performs walkthroughs, then tests whether key controls and the supporting ITGCs were designed properly and operated consistently across the period. Testing samples access reviews, change tickets, job logs and backup restores, and records the population and sample for each test. The output is a test workpaper set and a list of exceptions. The step is complete when every key control and in-scope ITGC has a documented conclusion.
Evaluate and log deficiencies
Management evaluates each exception to decide whether it is a deficiency, a significant deficiency or a material weakness, considering the likelihood and magnitude of a misstatement and whether compensating controls exist. Where an ITGC failure affects an automated control, the evaluation covers that dependency too. The output is a deficiency log with severity, root cause, remediation owner and status. The step is complete when each deficiency has a documented conclusion reviewed by senior finance and the audit committee.
Remediate and retest before year end
Control owners fix confirmed deficiencies, and the tester retests the corrected controls over a period long enough to show they operate. The output is remediation evidence, updated workpapers and a retest conclusion for each item. The step is complete when remaining open items are documented, with their residual risk accepted by management in writing.
Complete management's year-end evaluation
At fiscal year end, management evaluates ICFR against a suitable, recognized framework, such as COSO's 2013 Internal Control, Integrated Framework, and concludes whether it is effective. The output is a management report on ICFR and a summary of the evaluation supporting that conclusion. The step is complete when the report has been reviewed by the chief executive, chief financial officer and audit committee and is ready for the external accountant's work under the rule.
Deliver the report and support the external accountant
Management files the management report on ICFR as the rule requires, and the external accountant performs the work the rule specifies on that report, including its review of the controls and related evidence. The output is the filed report, the accountant's report and a set of supporting workpapers that the accountant can re-perform. The step is complete when the accountant's questions are answered and the open items from the cycle are carried into the next year's scoping.
What an insurer needs in place before the first report
A management report on internal control under the Model Audit Rule rests on a few foundations that have to exist before the first report is due. The items below connect the framework, the owners, the evidence, the outsourced administrators and the deficiency process, and each one lists what to check.
Documented control framework on COSO 2013
Management's evaluation has to rest on a suitable, recognized framework. COSO's 2013 Internal Control, Integrated Framework superseded the 1992 version on December 15, 2014, so a framework built on the 1992 version is now out of date. Check that the control matrix maps each financial reporting control to a COSO component and principle, including Principle 11 on general control activities over technology. Confirm with the state regulator and your auditor which framework and documentation format they expect.
Named control owners
Each key control needs one accountable person who performs or reviews it and can explain it to the auditor. Owners should sit in finance, actuarial, claims or IT as the control requires, not only in the IT department. For each control, check that the owner is named, has a backup, has signed off on the control description, and has a record of the most recent performance. Gaps in ownership often surface first as undocumented reviews.
Access and change evidence for in-scope systems
Financial systems such as policy administration, claims, general ledger and reinsurance accounting need evidence that access is granted, reviewed and removed by authorized people, and that changes are approved and tested before production. Pull a sample of user access requests, periodic access reviews and terminated-user removals, along with change tickets showing approval and testing. Confirm that the system generating this evidence can produce it for the full period, not just the current quarter.
Third-party administrator inventory and reports
Many insurers rely on third-party administrators, claims vendors, hosted policy systems or cloud providers that run part of the financial process. Build a list of each provider, the processes and systems they run, and the independent reports that cover them, such as a SOC 1 report. Check the coverage period of each report, identify any gaps between the report period and the fiscal year, and document the complementary controls the insurer must perform itself.
Deficiency tracking process
Identified control weaknesses need a single log that records the description, severity, root cause, owner, remediation date and retest result. Severity assessment should follow the company's documented criteria and be reviewed by someone outside the control owner's line. Check that the log is reconciled to issues raised by internal audit, the external auditor and regulators, and that management can show how each deficiency was evaluated, including whether it affects IT-dependent controls.
What the NAIC report costs and who gets paid
This table lists each cost component of a NAIC Model Audit Rule ICFR report, who is paid for it, whether it is one-time or recurring, and what drives it up. No price figures are supplied for this rule, so use the table to structure requests for quotes and internal budgets. Read the rows as a checklist of what to ask each party to price separately.
| Cost component | Who is paid or who spends time | One-time or recurring | Main cost drivers |
|---|---|---|---|
| External CPA or auditor work under the rule | Independent CPA firm that audits the annual statement and reports on the management report | Recurring each year, with higher first-year effort when controls are documented for the first time | Number of legal entities filing, number of IT-dependent controls, and whether the auditor must test ITGCs directly |
| Management report preparation | Insurer finance and controls staff, and sometimes a consultant | Recurring each year | Maturity of the existing ICFR documentation and the number of control gaps found in the prior cycle |
| Internal finance and IT staff time | Insurer employees who walk through controls, pull reports and answer auditor requests | Recurring, with a heavier first year | Number of financially significant systems, reliance on manual reconciliations, and how evidence is stored |
| Evidence collection tooling | Software vendor or internal team that gathers access logs, change tickets and backup records | Often one-time setup plus recurring licenses or hosting | Number of systems integrated, retention periods set by the insurer, and whether tools run in the insurer's own environment |
| Consultant or implementation partner fees for scoping and evidence preparation | External firm that helps define the IT general controls in scope and prepares evidence for the CPA firm | Usually one-time for scoping and build, with optional recurring support | Written scope, number of systems and entities, and whether the partner also remediates gaps |
| Remediation of control deficiencies | Insurer IT and finance teams, plus any vendor needed to change configurations | One-time per deficiency, but recurs if the same gap reappears | Severity of the gap, age of legacy systems, and time left before the report is due |
| State adoption and regulator follow-up | Insurer compliance staff and legal counsel | Recurring, especially when a state adopts a revised model | Number of domiciliary states and changes to Model #205 and its implementation guide |
What makes the NAIC ICFR report more or less expensive
The cost of a Model Audit Rule ICFR report depends less on the rule itself than on how many systems feed the financial statements, who runs them, and how mature the evidence is. The cards below cover the factors an insurer can influence before the reporting year starts, and the checks to make on each.
Premium size against the threshold
The rule applies to insurers with $500 million or more in direct and assumed premium, so a company near the line may be asked to report in one year and not the next. Scope is set by premium, not by how complex the business is. Confirm your direct and assumed premium figures with your state regulator and track the trend, because growth across the threshold brings the full cost in at once rather than gradually.
Number of policy and claims systems
Each policy administration, claims, billing and reserving system that feeds the statutory financial statements adds key controls, IT general controls and walkthroughs. Consolidating onto fewer platforms or retiring duplicate feeds reduces the number of systems management must evaluate and the auditor must test. Before the reporting year, list every system that produces a financial number and mark which ones reach the general ledger without manual intervention.
Outsourced administrators and service providers
Third-party administrators, claims vendors and hosted policy platforms often process financially significant transactions that the insurer does not run itself. Ask each provider early for its independent controls report and confirm that it covers the period and the services in scope. Gaps in provider reports tend to add testing time late in the cycle, so request them well before fieldwork begins.
Legacy systems and manual workarounds
Older mainframe or homegrown systems often lack documented change approval, user access reviews or system-generated reports that can be relied on. Each undocumented process needs either remediation or additional manual testing. Identify which legacy applications feed reserves or premium figures, and decide whether to replace, wrap or document them before the first year of reporting.
State adoption variations
State adoption of Model #205 determines which version of the rule applies to each insurer, so the required report content can differ by domicile. Confirm with each state of domicile which implementation guide and report form apply, and whether the state accepts a single report for an insurance group. Mapping these requirements once avoids duplicate testing across states that look similar but are not identical.
Evidence maturity and automation
Automated access reviews, change tickets linked to deployments, and scheduled job logs reduce the sample work an auditor needs and shorten the close cycle. Evidence that exists only in email or spreadsheets must be recreated for each test. Pilot one control end to end, such as user access recertification for the core policy system, to see how much effort the evidence actually takes before scaling it.
Who owns the controls, who prepares evidence, and who attests
The insurer owns its internal control over financial reporting. Under the Model Audit Rule, the company's management prepares the report on internal control, so the board, the chief financial officer, and the executives who sign the report must be able to explain how each control works and why it addresses a financial reporting risk. Management cannot hand that responsibility to a vendor, even when a vendor builds the systems.
- Control ownership: Business owners for claims, premiums, reserving and investments own the key controls, and IT owns the general controls that keep the systems behind them reliable.
- Management assessment: Management evaluates the design and operation of controls against a recognized framework, and its written conclusion is the core of the report.
- Sign-off: Named executives approve the scope, the risk assessment, remediation plans and the final report before it goes to the state regulator.
- Evidence retention: The insurer keeps access reviews, change approvals, job logs and reconciliations in its own systems, ready for the accountant to sample.
- Oversight of providers: Management reviews the controls and reports of any third party that runs a system relevant to financial reporting.
Before you engage anyone, confirm with your state regulator which version of the model applies to your company and who on your executive team will sign the report.
An implementation partner such as DeployOpen works on the systems and documentation that the insurer's controls depend on. Its role is to plan, build, harden and document the environment, and to prepare the evidence that management and the accountant will examine. It works under a written scope and does not decide what the controls are, whether they are effective, or what the report says.
- Planning and build: The partner designs and deploys self-hosted open-source platforms inside the insurer's own cloud accounts, data centers or private networks.
- Control preparation: It configures access roles, change workflows, logging, backup jobs and job scheduling so that the controls can be tested.
- Evidence preparation: It sets up the exports, logs and reports that show a control operated, and documents how each is produced.
- Hardening and documentation: It writes system descriptions, runbooks and configuration records that make the environment understandable to the internal team and to auditors.
- Limits of the role: It does not issue reports, attestations or opinions, and it should not perform the management assessment for the insurer.
Ask any partner to put its responsibilities in writing, including which deliverables are documentation and which are operating controls the insurer must run itself.
The independent accountant or auditor is the only party that tests the controls and issues the attestation or report. Its work must be independent of the insurer's management, so it cannot design the controls it later tests or prepare the evidence it examines in a way that compromises that independence. Where the audit is conducted under professional standards, the accountant plans its procedures from its own risk assessment.
- Testing: The accountant selects samples of controls and general controls, inspects evidence and re-performs key procedures.
- Reporting: It issues the opinion or report that states whether management's assessment is fairly presented, based on its testing.
- Communications: It reports significant deficiencies and material weaknesses to management and the audit committee.
- Independence boundary: The accountant cannot prepare the management report, design remediation, or run the controls on the insurer's behalf without impairing its independence.
- Reliance on others: It may use the work of internal audit or a service auditor report for a provider, subject to its own judgment and procedures.
Confirm the accountant's independence rules and the engagement letter before the work starts, so you know which tasks the accountant will accept and which your team must complete.
Questions insurers ask about the NAIC Model Audit Rule
Does a premium below $500 million remove all obligations under the NAIC Model Audit Rule?
Usually yes for the internal control report, but only at the level of the model text. The Model Audit Rule (Model #205) requires insurers with $500 million or more in direct and assumed premium to file a management report on internal control over financial reporting. An insurer below that line is outside that specific requirement, yet the threshold is reviewed annually by the NAIC/AICPA Working Group, so premium can move across it. Confirm two things: your current direct and assumed premium for the relevant year, and whether your state has adopted the model and with what changes. Your state's insurance department decides what applies to you, and other state filing obligations may still apply.
How does the NAIC report relate to SOX 404 for a public insurer?
They are separate obligations that often draw on the same control evidence. SOX Section 404 requires management's annual assessment of internal control over financial reporting for public issuers, and an auditor attestation for accelerated and large accelerated filers that are not emerging growth companies. The Model Audit Rule asks insurers for a management report on that same subject matter under state insurance regulation. A public insurer should map both to one control inventory so that IT general controls are tested once and reported twice. Confirm with your auditors and state regulator which framework and report format each one expects, since the two regimes do not share a single catalog.
Which IT general controls does the management report expect to see?
The model itself does not publish a list, so scope comes from the controls that support financial reporting in your environment. SEC guidance names four common areas that management may consider: access to programs and data, program changes, program development, and computer operations. Those areas cover what the report typically needs:
- Access to the policy administration, claims and general ledger systems, including privileged accounts
- Change control over rating, reserving and reinsurance configurations
- Job scheduling, backups and recovery for financially significant processing
- Oversight of cloud and outsourced providers that host those systems
The SEC guidance also says ITGCs matter only where they keep other financial reporting controls working consistently, so start from the reporting controls and work back to IT.
Can the insurer prepare the ICFR evidence in house?
Yes, many insurers prepare evidence internally, and the report is management's responsibility either way. Management owns the controls, the assessment and the sign-off, and an independent CPA firm performs the examination work the rule requires of it. An implementation partner can prepare systems, configure logging and access reviews, and organize evidence, but it does not issue the report. The questions to settle are whether your team has the time and skills for control walkthroughs, whether you have a documented framework to cite, and whether your external auditor accepts evidence exported from open-source tools. Ask the auditor early which artifacts they will sample.
How long does preparation take, and what drives the timing?
No duration is set by the rule, so timing depends on your starting point. The main drivers are how many financially significant systems are in scope, how mature your access reviews and change tickets are, how many third parties host data, and whether a prior-year report already exists. A first report usually takes longer than later cycles because control design, documentation and a baseline test have to be built from scratch. Ask any consultant or partner for a written schedule tied to the scope, and ask your auditor for the testing period they expect, since interim and year-end testing change the calendar.
How do I confirm which version of the model applies in my state?
Check your state insurance department's adopted version and any amendments, because state adoption determines the rule that applies to each insurer. The NAIC/AICPA Working Group keeps the model and its implementation guide under continual review, and its 2026 charges direct it to revise them as needed, so a version you read last year may have changed. Start with the NAIC committee page for the Working Group, then confirm the state's current requirements in writing. Record the version, effective date and filing deadline in your compliance calendar, and ask your external auditor to confirm the same reading.
How DeployOpen prepares insurer ITGC evidence
DeployOpen's role in an insurer's Model Audit Rule program is to prepare the IT environment and the evidence behind it, not to attest to it. Working with the insurer, DeployOpen scopes the IT general controls that support financially significant systems, such as policy administration, claims, general ledger and reporting platforms, and then implements and hardens self-hosted open-source platforms inside the insurer's own cloud accounts, data centers or air-gapped networks. The scope, the systems covered and the deliverables are agreed in writing before work starts, so the insurer and its accountant know exactly what has been built, configured and documented.
Preparation work typically covers access provisioning and review records, change tickets with approvals and test results, backup and restore logs, job scheduling and monitoring output, and written control descriptions that tie each control to the risk it addresses. DeployOpen assembles this material and hands it over with the configuration baselines and runbooks that explain it. The insurer remains the owner of its controls and of its management report on internal control over financial reporting. Management should confirm with its independent accountant which evidence formats, sampling populations and retention periods that accountant expects before the work is scoped.
DeployOpen does not issue reports, attestations or opinions, and it does not certify any insurer's compliance with the Model Audit Rule. The independent certified public accountant or auditor performs the examination and reaches its own conclusions based on the evidence and testing it chooses. Nothing in this engagement guarantees a clean result, a particular finding or acceptance of any control by a regulator. Insurers should ask any implementation partner to state in writing which deliverables are documentation and configuration work, and which, if any, depend on decisions that only the insurer's management or accountant can make.
