Identifying Appropriate Amount of Key Controls is Greatest Model Audit Rule Challenge for Insurers

A flash poll conducted by Baker Tilly Virchow Krause, LLP (Baker Tilly) indicates over half of insurance organizations specify identifying the “right amount” of key controls is the single-most challenging factor when maximizing the efficiency and effectiveness of its Model Audit Rule (MAR) program. The National Association of Insurance Commissioners’ (NAIC) Annual Financial Reporting Model Regulation #205 is commonly known as the Model Audit Rule.

“Insurance companies should be assessing key controls and compensating controls on an annual basis,” John Romano, CPA, CFE, CIA, senior manager in Baker Tilly’s risk, internal audit and cybersecurity insurance industry practice, said. “Particular attention should be made to procedures that have gone from manual or semi-manual to automated, to track and realize improved efficiencies throughout your organization’s processes.”

“If your organization has numerous compensating controls, the question should be asked if those controls should be designated as key,” Garrett Gosh, CPA, CITP, HITRUST CCSFP, senior manager in Baker Tilly’s risk, internal audit and cybersecurity insurance industry practice, said. “If your organization is referring to several key controls to address a specific risk or management assertion, however, that may be an indicator of areas where evaluation efforts are duplicated.”