Okla. Stat. tit. 36, § 36-311A.14.1: Internal audit function requirements - Exemptions

A. Exemption – An insurer is exempt from the requirements of

this section if:

1. The insurer has annual direct written and unaffiliated

assumed premium, including international direct and assumed premium,

but excluding premiums reinsured with the Federal Crop Insurance

Corporation and Federal Flood Program less than Five Hundred Million

Dollars ($500,000,000.00); or

2. If the insurer is a member of a group of insurers that has

annual direct written and unaffiliated assumed premium, including

international direct and assumed premium, but excluding premiums

reinsured with the Federal Crop Insurance Corporation and Federal

Flood Program, less than One Billion Dollars ($1,000,000,000.00).

B. Function – The insurer or group of insurers shall establish

an internal audit function providing independent, objective and

reasonable assurance to the audit committee and insurer management

regarding the insurer's governance, risk management and internal

controls. This assurance shall be provided by performing general

and specific audits, reviews and tests and by employing other

techniques deemed necessary to protect assets, evaluate control

effectiveness and efficiency and evaluate compliance with policies

and regulations.

C. Independence – In order to ensure that internal auditors

remain objective, the internal audit function must be

organizationally independent. Specifically, the internal audit

function will not defer ultimate judgment on audit matters to

others, and shall appoint an individual to head the internal audit

function who will have direct and unrestricted access to the board

of directors. Organizational independence does not preclude dual-

reporting relationships.

D. Reporting – The head of the internal audit function shall

report to the audit committee regularly, but no less than annually,

on the periodic audit plan, factors that may adversely impact the

internal audit function's independence or effectiveness, material

findings from completed audits and the appropriateness of corrective

actions implemented by management as a result of audit findings.

E. Additional Requirements – If an insurer is a member of an

insurance holding company system or included in a group of insurers,

the insurer may satisfy the internal audit function requirements set

forth in this section at the ultimate controlling parent level, an

intermediate holding company level or the individual legal entity

level.

F. Upon written request and with good cause shown, the

Insurance Commissioner may grant an exemption from the internal

audit function.