Okla. Stat. tit. 36, § 36-311A.16: Report of the insurer's internal control over

financial reporting.

A. Every insurer required to file an audited financial report

pursuant to the Oklahoma Annual Financial Report Act that has annual

direct written and assumed premiums, excluding premiums reinsured

with the Federal Crop Insurance Corporation and Federal Flood

Program, of Five Hundred Million Dollars ($500,000,000.00) or more

shall prepare a report of the insurer's or group of insurers'

internal control over financial reporting. The report shall be

filed with the Insurance Commissioner along with the Communication

of Internal Control Related Matters Noted in an Audit described

under Section 311A.11 of this title. Management's Report of

Internal Control over Financial Reporting shall be as of December 31

immediately preceding.

B. Notwithstanding the premium threshold in subsection A of

this section, the Commissioner may require an insurer to file

Management's Report of Internal Control over Financial Reporting if

the insurer is in any RBC level event, or meets any one or more of

the standards of an insurer deemed to be in hazardous financial

condition.

C. An insurer or a group of insurers that is:

1. Directly subject to Section 404;

2. Part of a holding company system whose parent is directly

subject to Section 404;

3. Not directly subject to Section 404 but is a SOX Compliant

Entity; or

4. A member of a holding company system whose parent is not

directly subject to Section 404 but is a SOX Compliant Entity,

may file its or its parent's Section 404 Report and an addendum in

satisfaction of the requirements of this section provided that those

internal controls of the insurer or group of insurers' audited

statutory financial statements included in paragraphs 2 through 7 of

subsection B of Section 311A.5 of this title were included in the

scope of the Section 404 Report. The addendum shall be a positive

statement by management that there are no material processes with

respect to the preparation of the insurer's or group of insurers'

audited statutory financial statements included in paragraphs 2

through 7 of subsection B of Section 311A.5 of this title excluded

from the Section 404 Report. If there are internal controls of the

insurer or group of insurers that have a material impact on the

preparation of the insurer's or group of insurers' audited statutory

financial statements and those internal controls were not included

in the scope of the Section 404 Report, the insurer or group of

insurers may either file a report pursuant to this section or the

Section 404 Report and a report pursuant to this section for those

internal controls that have a material impact on the preparation of

the insurer's or group of insurers' audited statutory financial

statements not covered by the Section 404 Report.

D. Management's Report of Internal Control over Financial

Reporting shall include:

1. A statement that management is responsible for establishing

and maintaining adequate internal control over financial reporting;

2. A statement that management has established internal control

over financial reporting and an assertion, to the best of the

knowledge and belief of management, after diligent inquiry, as to

whether its internal control over financial reporting is effective

to provide reasonable assurance regarding the reliability of

financial statements in accordance with statutory accounting

principles;

3. A statement that briefly describes the approach or processes

by which management evaluated the effectiveness of its internal

control over financial reporting;

4. A statement that briefly describes the scope of work that is

included and whether any internal controls were excluded;

5. Disclosure of any unremediated material weaknesses in the

internal control over financial reporting identified by management

as of December 31 immediately preceding. Management is not

agement evaluated the effectiveness of its internal

control over financial reporting;

4. A statement that briefly describes the scope of work that is

included and whether any internal controls were excluded;

5. Disclosure of any unremediated material weaknesses in the

internal control over financial reporting identified by management

as of December 31 immediately preceding. Management is not

permitted to conclude that the internal control over financial

reporting is effective to provide reasonable assurance regarding the

reliability of financial statements in accordance with statutory

accounting principles if there is one or more unremediated material

weaknesses in its internal control over financial reporting;

6. A statement regarding the inherent limitations of internal

control systems; and

7. Signatures of the chief executive officer and the chief

financial officer or equivalent positions or titles.

E. Management shall document and make available upon financial

condition examination the basis upon which its assertions, required

in subsection D of this section, are made. Management may base its

assertions, in part, upon its review, monitoring, and testing of

internal controls undertaken in the normal course of its activities.

1. Management shall have discretion as to the nature of the

internal control framework used, and the nature and extent of

documentation, in order to make its assertion in a cost-effective

manner and, as such, may include assembly of or reference to

existing documentation.

2. Management's Report of Internal Control over Financial

Reporting, required by subsection A of this section and any

documentation provided in support thereof during the course of a

financial condition examination, shall be kept confidential by the

Insurance Department.