Section 18.07.04.023 - MANAGEMENT'S REPORT OF INTERNAL CONTROL OVER FINANCIAL REPORTING01.Premium Threshold. Every insurer needs to file an audited financial report pursuant to this chapter that has annual direct written and assumed premiums, excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of five hundred million dollars ($500,000,000) or more will prepare a report of the insurer's or group of insurers' internal control over financial reporting, as these terms are defined in Section 010. The report will be filed with the Director along with the Communication of Internal Control Related Matters Noted in an Audit described under Section 018. Management's Report of Internal Control over Financial Reporting will be as of December 31 immediately preceding.02.RBC Level or Other Event. Notwithstanding the premium threshold in Subsection 023.01 of this rule, the Director may require an insurer to file Management's Report of Internal Control over Financial Reporting if the insurer is in any RBC level event, or meets any one (1) or more of the standards of an insurer deemed to be in hazardous financial condition as defined in IDAPA 18.07.05, "Director's Authority for Companies Deemed to be in Hazardous Financial Condition."03.Section 404. An insurer or a group of insurers may file its or its parent's Section 404 Report and an addendum in satisfaction of this Section 023 requirement provided that those internal controls of the insurer or group of insurers having a material impact on the preparation of the insurer's or group of insurers' audited statutory financial statements (those items included in Subsections 012.02 through 012.07 of this rule) were included in the scope of the Section 404 Report. The addendum will be a positive statement by management that there are no material processes with respect to the preparation of the insurer's or group of insurers' audited statutory financial statements (those items included in Subsections 012.02 through 012.07 of this rule) excluded from the Section 404 Report. If there are internal controls of the insurer or group of insurers that have a material impact on the preparation of the insurer's or group of insurers' audited statutory financial statements and those internal controls were not included in the scope of the Section 404 Report, the insurer or group of insurers may either file:a. A Section 023 report; orb. The Section 404 Report and a Section 023 report for those internal controls that have a material impact on the preparation of the insurer's or group of insurers' audited statutory financial statements not covered by the Section 404 Report, providing the insurer or group of insurers is: i. Directly subject to Section 404;ii. Part of a holding company system whose parent is directly subject to Section 404;iii. Not directly subject to Section 404 but is a SOX Compliant Entity; oriv. A member of a holding company system whose parent is not directly subject to Section 404 but is a SOX Compliant Entity.04.Requisite Elements. Management's Report of Internal Control over Financial Reporting will include: a. A statement that management is responsible for establishing and maintaining adequate Internal control over financial reporting;b. A statement that management has established Internal control over financial reporting and an assertion, to the best of management's knowledge and belief, after diligent inquiry, as to whether its Internal control over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements in accordance with statutory accounting principles; c. A statement that briefly describes the approach or processes by which management evaluated the effectiveness of its Internal control over financial reporting; andd. A statement that briefly describes the scope of work that is included and whether any internal controls were excluded;e. Disclosure of any unremediated material weaknesses in the Internal control over financial reporting identified by management as of December 31 immediately preceding. Management is not permitted to conclude that the Internal control over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements in accordance with statutory accounting principles if there is one (1) or more unremediated material weaknesses in its Internal control over financial reporting;f. A statement regarding the inherent limitations of internal control systems; andg. Signatures of the chief executive officer and the chief financial officer (or equivalent position/title).05.Documentation by Management. Management will document and make available upon financial condition examination the basis upon which its assertions, prescribed in Subsection 023.04 of this rule, are made. Management may base its assertions, in part, upon its review, monitoring and testing of internal controls undertaken in the normal course of its activities. Management may have discretion as to the nature of the internal control framework used, and the nature and extent of documentation, in order to make its assertion in a cost effective manner and, as such, may include assembly of or reference to existing documentation. Management's Report on Internal Control over Financial Reporting, prescribed by Subsection 023.01 of this rule, and any documentation provided in support thereof during the course of a financial condition examination, will be kept confidential by the Idaho Department of Insurance.Idaho Admin. Code r. 18.07.04.023