Section R590-254-15 - Internal Audit Function Requirements(1) An insurer is exempt from the requirements of this section if: (a) the insurer has annual direct written and unaffiliated assumed premium, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of less than $500,000,000; and(b) if the insurer is a member of a group of insurers, the group has annual direct written and unaffiliated assumed premium, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of less than $1,000,000,000.(2)(a) The insurer or group of insurers shall establish an internal audit function providing independent, objective, and reasonable assurance to the audit committee and insurer management regarding the insurer's governance, risk management, and internal controls.(b) The assurance required by Subsection (2)(a) shall be provided by:(i) performing general and specific audits, reviews, and tests; and(ii) employing other techniques deemed necessary to:(B) evaluate control, effectiveness, and efficiency; and(C) evaluate compliance with policies and regulations.(3) The internal audit function shall be organizationally independent.(4) The internal audit function may not defer ultimate judgment on audit matters to others.(5) An individual shall be appointed to head the internal audit function with direct and unrestricted access to the board of directors.(6) Nothing in Section R590-254-15 precludes dual-reporting relationships.(7) The head of the internal audit function shall report to the audit committee at least annually on: (a) the periodic audit plan;(b) factors that may adversely impact the internal audit function's independence or effectiveness;(c) material findings from completed audits; and(d) the appropriateness of corrective actions implemented by management as a result of audit findings.(8) If an insurer is a member of an insurance holding company system or is included in a group of insurers, the insurer may satisfy the internal audit function requirements set forth in Section R590-254-15 at: (a) the ultimate controlling parent level;(b) an intermediate holding company level; or(c) the individual legal entity level.Utah Admin. Code R590-254-15
Amended by Utah State Bulletin Number 2021-13, effective 6/22/2021Amended by Utah State Bulletin Number 2023-02, effective 1/10/2023