(a) Every MCO required to file an audited financial report pursuant to this Subpart that has annual direct written and assumed premiums, excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of $500,000,000 or more shall prepare a report of the MCO’s or group of MCOs’ internal control over financial reporting. This report of internal control over financial reporting, together with any communication about unremediated material weaknesses discovered during the CPA’s audit described under section 98-3.10 of this Subpart shall be submitted to the commissioner upon the filing date upon which each audited financial report is required to be filed. Management’s report of internal control over financial reporting shall be as of December 31st immediately preceding.

1. (1) In lieu of the report required by subdivision (a) of this section, a MCO may file its or its parent’s SOX section 404 report with the commissioner, if the MCO is:

   1. (i) directly subject to SOX section 404;
   2. (ii) not directly subject to SOX section 404, but is a SOX compliant MCO; or

   3. (iii) a member of a holding MCO system whose parent is:

      1. (a) directly subject to SOX section 404; or
      2. (b) not directly subject to SOX section 404, but is a SOX compliant MCO.

2. (2) If a MCO elects to file the SOX section 404 report described in paragraph (1) of this subdivision, the MCO shall submit an addendum that contains:

   1. (i) a statement by the MCO’s chief executive officer and chief financial officer (or equivalent position or title) that no internal controls having a material impact on the preparation of the MCO’s audited statutory financial statements are excluded from the report. If either of these two officers is based in a holding MCO or other entity outside of the United States, the two most senior United States-based officers shall be the signatories; or
   2. (ii) if internal controls of the MCO that have a material impact on the preparation of the MCO’s audited statutory financial statements are not described in the SOX section 404 report, a report that sets forth the impact of these material internal controls on the preparation of the MCO’s audited financial reports that were not included in the report.

(b)

(c) Management’s report of internal control over financial reporting shall include:

1. (1) a statement that the MCO has established and continues to maintain adequate internal control over financial reporting and an assertion, to the best of the MCO’s knowledge and belief, after diligent inquiry, as to whether its internal control over financial reporting is effective to provide reasonable assurance regarding the reliability of financial statements in accordance with statutory accounting principles;
2. (2) a statement that briefly describes the approach or processes by which the MCO evaluated the effectiveness of its internal control over financial reporting;
3. (3) a statement that briefly describes the scope of work that is included and whether any internal controls were excluded;
4. (4) disclosure of any unremediated material weaknesses in the internal control over financial reporting identified by the MCO as of December 31st immediately preceding;
5. (5) a statement regarding the inherent limitations of internal control systems; and
6. (6) notarized signatures of the MCO’s chief executive officer and chief financial officer (or equivalent position or title) attesting to the statements and disclosures contained in paragraphs (1) through (5) of this subdivision. If either of these two officers is based in a holding MCO or other entity outside of the United States, the two most senior United States-based officers shall be the signatories.