Non-Lead States. When the model act requires filing the CGAD with the system's lead state, non-lead states may still request the filed CGAD from a domestic insurer. [12] Before a non‐lead state makes such a request, however, it "should consider obtaining and reviewing the Lead State’s analysis of CGAD to reduce duplication of analysis efforts." [13]

Subsequent Annual Filings of Amended CGAD Versions.  Each year following the initial CGAD filing, the insurer or its holding company system must file an amended version of the previously filed CGAD indicating where changes have been made to the previously filed CGAD (or stating that no changes have been made). ^[14]

Confidentiality.   The CGAD is recognized as containing confidential and sensitive information related to the internal operations of the insurer and its system, including proprietary and trade secret information with the potential for harm and competitive disadvantage to the insurer or its system if the information is made public. [15]  As a result, the model act contains numerous, stringent confidentiality protections intended to safeguard CGAD information and limit its use and disclosure. [16]

II.  Overview of CGAD Contents [17]  

Fundamentally, CGAD information is intended to provide regulators with a summary of the corporate governance structure, policies, and practices of an insurer and its system in order to convey and maintain an understanding of the filer's corporate governance framework.

A.  Introduction

Although a CGAD introductory section is not technically required under either the model act or the model regulation, its use allows for efficient inclusion of the following required information:  i) identification of the applicable insurer or holding company system and their corporate structure; ii) acknowledgement of the confidential nature of the report; iii) identification of the levels at which the report is completed (holding company or insurer); and iv) the criteria used to determine such level of disclosure. [18]  Use of an introductory section also provides an opportunity to reference any existing documents that are used to describe applicable corporate governance, as referenced above. [19]

The insurer or insurance group shall be as descriptive as possible in completing the CGAD, with inclusion of attachments or example documents that are used in the governance process, since these may provide a means to demonstrate the strengths of their governance framework and practices. [20]

B.  Corporate Governance Framework and Structure

Because filers have discretion regarding format when providing CGAD information, following the rule format below and simply repeating and responding to the instructions is acceptable.

The CGAD shall describe the insurer’s or insurance group’s corporate governance framework and structure including consideration of the following.

(1)        The Board and various committees thereof ultimately responsible for overseeing the insurer or insurance group and the level(s) at which that oversight occurs (e.g., ultimate control level, intermediate holding company, legal entity, etc.). The insurer or insurance group shall describe and discuss the rationale for the current Board size and structure; and

(2)        The duties of the Board and each of its significant committees and how they are governed (e.g., bylaws, charters, informal mandates, etc.), as well as how the Board’s leadership is structured, including a discussion of the roles of Chief Executive Officer (CEO) and Chairman of the Board within the organization. [21]

C.  Board and Committee Policies and Practices

The CGAD must describe board and committee members, including qualifications, backgrounds, experiences, and expertise, and how all of these integrate to benefit the applicable governing entity, insurer, and insurance group.   Board and committee independence must also be addressed, including related governance controls, and meeting attendance.  The nomination and election processes for the board and its committees should be explained, including the existence of a nomination committee, term limits on directors, elections and re-elections, whether a board diversity policy is in place, and if so, how it functions.  Finally, this section requires description of any board, committees, director performance review processes the board may have in place, and any recent measures (e.g., training and education programs) taken to improve the performance of the board, committees, or directors.

The insurer or insurance group shall describe the policies and practices of the most senior governing entity and significant committees thereof, including a discussion of the following factors:

(1)        How the qualifications, expertise and experience of each Board member meet the needs of the insurer or insurance group.

(2)        How an appropriate amount of independence is maintained on the Board and its significant committees.

(3)        The number of meetings held by the Board and its significant committees over the past year as well as information on director attendance.

(4)        How the insurer or insurance group identifies, nominates and elects members to the Board and its committees. The discussion should include, for example:

(a)        Whether a nomination committee is in place to identify and select individuals for consideration.

(b)        Whether term limits are placed on directors.

(c)        How the election and re-election processes function.

(d)        Whether a Board diversity policy is in place and if so, how it functions. 

(5)        The processes in place for the Board to evaluate its performance and the performance of its committees, as well as any recent measures taken to improve performance (including any Board or committee training programs that have been put in place). [22]

D.  Policies and Practices Directing Senior Management

The CGAD must describe the policies, procedures, and practices (i.e., suitability standards) used to determine the experience, skills, background, integrity, and education that senior management [23] must possess.  This includes identification of the specific positions for which suitability standards have been developed and a description of the standards employed, as well as identification of any changes in an executive's suitability as outlined by such standards.  The filer must also describe its code of business conduct and ethics, for example, standards on compliance with laws, rules, and regulations, and proactive reporting of any illegal or unethical behavior.  

The CGAD must also describe the filer's processes for senior management performance evaluation, compensation, and corrective actions, including significant compensation program objectives and rewards (e.g., the board’s role in management compensation oversight, compensation elements, the compensation relationship between insurer and individual performance, compensation program risk adjustments, claw back provisions, and whether an insurer's risk management objectives are met by employees' incentives).  

Finally, the CGAD must describe the filer’s plans for CEO and senior management succession planning.

The insurer or insurance group shall describe the policies and practices for directing Senior Management, including a description of the following factors:

(1)        Any processes or practices (i.e., suitability standards) to determine whether officers and key persons in control functions have the appropriate background, experience and integrity to fulfill their prospective roles, including:

(a)        Identification of the specific positions for which suitability standards have been developed and a description of the standards employed.

(b)        Any changes in an officer’s or key person’s suitability as outlined by the insurer’s or insurance group’s standards and procedures to monitor and evaluate such changes.

(2)        The insurer’s or insurance group’s code of business conduct and ethics, the discussion of which considers, for example:

(a)        Compliance with laws, rules, and regulations; and

(b)        Proactive reporting of any illegal or unethical behavior.

(3)        The insurer’s or insurance group’s processes for performance evaluation, compensation and corrective action to ensure effective senior management throughout the organization, including a description of the general objectives of significant compensation programs and what the programs are designed to reward. The description shall include sufficient detail to allow the Commissioner to understand how the organization ensures that compensation programs do not encourage and/or reward excessive risk taking. Elements to be discussed may include, for example:

(a)        The Board’s role in overseeing management compensation programs and practices;

(b)        The various elements of compensation awarded in the insurer’s or insurance group’s compensation programs and how the insurer or insurance group determines and calculates the amount of each element of compensation paid;

(c)        How compensation programs are related to both company and individual performance over time;

(d)        Whether compensation programs include risk adjustments and how those adjustments are incorporated into the programs for employees at different levels;

(e)        Any claw back provisions built into the programs to recover awards or payments if the performance measures upon which they are based are restated or otherwise adjusted;

(f)        Any other factors relevant in understanding how the insurer or insurance group monitors its compensation policies to determine whether its risk management objectives are met by incentivizing its employees.

(4)        The insurer’s or insurance group’s plans for CEO and Senior Management succession. [24]

E.  Management Processes for Oversight of Critical Risk Areas

In describing oversight processes, the CGAD must explain how oversight and management responsibilities are delegated among the board, its committees, and senior management, and how the board is kept informed of the insurer’s strategic plans, associated risks, and steps senior management is taking to monitor and manage those risks.  The insurer or insurance group must also address reporting responsibilities for critical risk areas, such as risk management processes, actuarial, compliance, financial reporting, internal auditing, and decision-making processes for investment, reinsurance, business strategy, finance, and market conduct.  For each critical risk area identified, the CGAD should identify how reporting responsibilities are organized and the frequency at which information is reported to and reviewed by senior management and the board.

The insurer or insurance group shall describe the processes by which the Board, its committees and Senior Management ensure an appropriate amount of oversight to the critical risk areas impacting the insurer’s business activities, including a discussion of:

(1)        How oversight and management responsibilities are delegated between the Board, its committees and Senior Management;

(2)        How the Board is kept informed of the insurer’s strategic plans, the associated risks, and steps that Senior Management is taking to monitor and manage those risks;

(3)        How reporting responsibilities are organized for each critical risk area.   The description should allow the Commissioner to understand the frequency at which information on each critical risk area is reported to and reviewed by Senior Management and the Board.   This description may include, for example, the following critical risk areas of the insurer:

(a)        Risk management processes (An ORSA Summary Report filer may refer to its ORSA Summary Report pursuant to the Risk Management and Own Risk and Solvency Assessment Model Act);

(b)        Actuarial function;

(c)        Investment decision-making processes;

(d)        Reinsurance decision-making processes;

(e)        Business strategy/finance decision-making processes;

(f)        Compliance function;

(g)        Financial reporting/internal auditing; and

(h)        Market conduct decision-making processes. [25]

III.  CGAD Differences by System Type

As is evident from the description above, the CGAD will vary from group to group, depending on the size, traditions, ownership structure, and other factors. For example, the company level that is the focus of the CGAD will be the ultimate holding company parent for many insurance holding company systems, but may be an intermediate holding company for the insurance business in a diversified holding company system. On the other hand, a stand-alone mutual insurance company will report at the level of the individual, mutual legal entity. Some basic considerations for public holding company systems, privately held systems, and nonprofit systems are described further below.

A.  Public Holding Company System

A publicly held holding company system, including mutual holding companies that have a publicly held subsidiary, will probably report at the level of the publicly held entity because that is likely to be the focus of governance and operations for the system. Moreover, the publicly held entity will be the one making filings with the SEC, which may be cross referenced for many components of the CGAD.

On the other hand, the insurance business is so different from other businesses, that a diversified holding company might use an intermediate holding company for insurance operations as the focus for oversight and risk assessment for those operations. Therefore, the diversified holding company might designate that intermediate insurance holding company as the CGAD reporting level. 

B.  Privately Held System

Insurance operations may be held by an individual or a group of individuals such as a family or a private equity fund. Such a system will probably report at the level of a holding company which has been formed to be the focus of governance and operations for the system and separate those functions from the individual owners. Like a publicly held system, a private system may hold only insurance operations or it may be diversified so, with respect to the latter, there is likely to be a separate holding company limited to insurance operations that should be the level of reporting for CGAD.

Given that a privately held system is controlled by one or a small number of individuals, regulators will probably be interested in policies and practices that prevent the owners from exercising their control to the detriment of the enterprise. For example, regulators may be more interested in efforts to include independent, expert voices on the board; to link management compensation to objective factors; and to build independent power centers around functions such as risk management, financial reporting, and compliance.

C.  Nonprofit system

Nonprofits will mainly be mutual or fraternal insurers which, in turn, will often be the ultimate parent and thus the likely level of CGAD reporting. However, there are many examples of insurers, whether for-profit or nonprofit, that are owned by nonprofits such as health systems or trade associations. For insurers owned by nonprofits, the CGAD reporting level may be the nonprofit or, if the insurer's operations are not integrated with those of the nonprofit, at the insurer level or the level of an intermediate holding company.

Because policyholder voting is not an effective governance device for mutuals, [26] regulators will probably be interested in policies and practices that provide a substitute check on management. And because nonprofits that own insurers are often engaged in efforts that do not involve insurance expertise, regulators will probably be interested in governance policies and practices that provide such expertise and insulate insurance management from nonprofit management to some extent. Thus, as with privately held systems, regulators may be more interested in efforts to include independent, expert voices on the board; to link management compensation to performance of insurance operations; and to build independent power centers around functions such as risk management, financial reporting, and compliance.

IV.  Conclusion

The CGAD is a complex report that will be due for the first time for many insurers this summer. Moreover, the process of preparing the CGAD for the first time may indicate the need for changes in corporate governance that may take some time to implement. Finally, regulators emphasize the importance of a thorough initial CGAD, as follow-on filings are only updates. In short, now is the time to get started on an initial CGAD filing.