INTERNAL AUDIT FUNCTIONS (Sections 375.1025, 375.1052, 375.1053, 375.1056, 375.1058)

Beginning January 1, 2018, this act requires certain insurers and insurance groups to establish an internal audit function.

An insurer is exempt from internal audit requirements if the insurer: (1) has a direct written and unaffiliated assumed premium totaling less than $500 million, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, and (2) is a member of a group of insurers that has annual direct written and unaffiliated assumed premium totaling less than $1 billion, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood program.

Insurers and groups of insurers who were previously exempt but lose their exemption have one year after the year the threshold was exceeded to come into compliance.

The insurer or group of insurers' auditing committee is responsible for overseeing the internal audit function and for granting a person or persons suitable authority and resources to fulfill the responsibilities required under this act. The internal audit function shall provide independent, objective, and reasonable assurance to the audit committee and insurer management regarding the insurer's governance, risk management, and internal controls. The internal audit function shall be provided by performing audits, reviews, tests, and other techniques as necessary to protect assets, evaluate control effectiveness and efficiency, and evaluate compliance with policies and regulations.

Internal audit functions shall be organizationally independent, though this does not preclude dual-reporting relationships.

The head of the internal audit function shall report to the audit committee at least annually.

These provisions are identical to SB 427 (2017) and HCS/HB 575 (2017).

CORPORATE GOVERNANCE ANNUAL DISCLOSURES (Sections 382.600, 382.605, 382.610, 382.615, 382.620, 382.625, 382.630, 382.635, and 382.640)

This act requires Missouri insurance companies to file a "Corporate Governance Annual Disclosure" (CGAD) with the Department of Insurance, Financial Institutions and Professional Registration (DIFP) no later than June first of each calendar year. Other insurers must file the same upon the Director's request. Insurers that are part of insurance groups shall submit this report to the Director or commissioner of insurance for the lead state for the insurance group if that state has adopted the National Association of Insurance Commissioners Corporate Governance Annual Disclosure Model Act and National Association of Insurance Commissioners Corporate Governance Annual Disclosure Model Regulations.

CGADs must include a statement, signed by the CEO or corporate secretary, that the insurer has implemented the corporate governance practices and that a copy of the disclosure has been provided to the board of directors or appropriate committee thereof. Information provided to the state in other filings can be incorporated by reference in the CGAD. A CGAD shall contain the information necessary to permit the Director to understand the company's governance structure, policies, and practices. The Director of DIFP may request additional information if needed. Documentation and supporting information shall be maintained and made available on the Director's request.

Insurers and insurance groups may provide information on their corporate governance at the ultimate controlling person level, the intermediate holding company level, or the individual entity level, depending on how the insurer or insurance group is structured. The insurer or insurance group is encouraged to make this determination based on certain criteria, and shall indicate which criteria were used to determine how the report would be made. Insurers and insurance groups shall explain subsequent changes in their reporting.

Documents, materials, and other information provided to the DIFP pursuant to this act shall be recognized by this state as proprietary and containing trade secrets. The documents, materials, and other information shall be confidential and privileged, but may be used in regulatory or legal proceedings brought by the Director. No one with whom documents, materials, or other CGAD-related information has been shared shall testify in any private civil action concerning any of the documents, materials, and other information.

In order to assist in the performance of his or her regulatory duties, the Director of DIFP may share and receive confidential or privileged documents, materials, and other information with other state, federal, and international financial regulatory agencies. Sharing such information shall not constitute waiver of the confidentiality or privilege.

The Director of DIFP may retain, at the insurer's expense, third-party consultants as may be reasonably necessary to review the CGAD. Such third parties shall verify they are free from a conflict of interest and have internal procedures to monitor compliance with a conflict and with confidentiality and privilege requirements.

Written agreements with the National Association of Insurance Commissioners or a third-party consultant governing sharing and use of information provided pursuant to this act shall require the written consent of the insurer prior to making public any information provided pursuant to this act, and shall contain certain other provisions.

This act provides that insurers failing to timely file a CGAD commit a level two regulatory violation for each day's delay, but sets a $5,000 maximum penalty.

These provisions are similar to SCS/SB 304 (2017), and HB 259 (2017).

This act is effective on January 1, 2018.

ERIC VANDER WEERD