United States General Accounting Office GAO Report to the Ranking Minority Member, Committee on Commerce, House of Representatives December 1999 YEAR 2000 Insurance Regulators Have Accelerated Oversight, but Some Gaps Remain GAO/GGD-00-42 United States General Accounting Office General Government Division Washington, D.C. 20548 B-284237 December 20, 1999 The Honorable John D. Dingell Ranking Minority Member Committee on Commerce House of Representatives Dear Mr. Dingell: This report responds to your request that we provide an update to information that we presented earlier this year on the readiness of the insurance industry to meet the Year 2000 date change. Specifically, our objectives were to provide (1) an updated assessment, as of September 30, 1999, of state regulatory oversight of the insurance industry’s Year 2000 preparations and (2) the status of the industry’s Year 2000 readiness. Under a long-established division of responsibilities between federal and state regulators, state insurance regulators have primary responsibility for 1 the regulatory oversight of the insurance industry. In March 1999, we reported that state insurance regulators were generally not as proactive in their oversight of the industry’s Year 2000 readiness as the banking and 2 securities regulators. Of particular concern was the limited extent of regulatory attention given to validating the status of Year 2000 3 preparedness among insurance companies. Specifically, we indicated that oversight efforts to validate the insurers’ self-reported Year 2000 readiness status generally began later and lacked the vigor demonstrated by bank and securities regulators. At that time, state regulators chiefly relied on surveys to obtain information on the Year 2000 preparedness of companies that were subject to their oversight, although examinations had been acknowledged as one of the primary means regulators could use to verify companies’ preparedness and validate their responses to surveys. In an April 1999 report, we also noted that the National Association of Insurance Commissioners (NAIC), which is a key coordinating group that serves to facilitate states’ oversight efforts, had been slow in providing 1 McCarran-Ferguson Act of 1945, 15 U.S.C. 1011-1015. 2 Insurance Industry: Regulators Are Less Active in Encouraging and Validating Year 2000 Preparedness (GAO/T-GGD-99-56, Mar. 11, 1999). 3 We use the term “insurance companies” in the broad sense to include all entities regulated by state insurance departments, not just life/health insurance companies and property/casualty insurance companies. Page 1 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 information and guidance to state regulators about the appropriate Year 4 2000 regulatory activities to undertake. Although both regulators and industry observers were generally confident that the insurance industry was in reasonably good condition regarding Year 2000 readiness, we cautioned in our April report that such observations were based on information that was self-reported by insurance companies and, for the most part, had not been validated. Additionally, industry experts expressed concerns about insurers’ liability exposures. Although it was too early to estimate the magnitude of costs associated with claims and legal defenses for Year 2000-related mishaps, evidence suggested that such costs could be substantial for some property/casualty insurers. We concluded in the report that insurers would continue to face uncertainties about their Year 2000-related liability exposures until answers to key legal issues and actual claims for Year 2000-related matters began to materialize. In the 8 months since our last report, NAIC stepped up its efforts to assess Results in Brief the insurance industry’s Year 2000 readiness by, among other things, (1) issuing expanded guidance to state insurance regulators on how to examine companies’ preparedness and (2) encouraging state regulators to conduct on-site examinations of insurers with the greatest potential public impact. Over the same period, some of the nation’s state regulators increased their use of examinations that are aimed at verifying the Year 2000 readiness of their insurers, particularly for their nationally significant 5 life/health and property/casualty insurers. These insurers account for approximately 86 percent of the premiums written and make up 27 percent of the companies in these two industry segments. Six of the 17 states we reviewed indicated that their goal was to conduct Year 2000 readiness examinations for all of the insurance companies 6 domiciled in their states. The remaining 11 states had set varying goals regarding which companies were to be subject to Year 2000 examinations, but most of these states attempted to cover their nationally significant 4 Year 2000: State Insurance Regulators Face Challenges in Determining Industry Readiness (GAO/GGD- 99-87, Apr. 30, 1999). 5 NAIC designates an insurance company as nationally significant if, in any of the past 3 years, its annual gross premium writings was greater than $30 million for a property/casualty company or greater than $50 million for a life/health company and the company is licensed in 17 or more states. NAIC uses this designation in other processes, including a peer review of how states analyze the financial standing of their insurers. 6 Insurance companies may sell insurance in one or more states. However, each company is chartered, or domiciled, in one state. This state acts as the primary regulator for the company. Page 2 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 insurers. At the time of our review, less information was available about major life/health and property/casualty insurers that were not considered nationally significant. In November, NAIC was still in the process of systematically collecting information on companies in the other insurance segments, such as health maintenance organizations (HMO) and health, medical and dental indemnities (HMDI). NAIC and state regulators remain confident about the insurance industry’s Year 2000 readiness. In October 1999, NAIC’s Year 2000 Industry 7 Preparedness Task Force reported that the insurance industry is expected to experience little disruption when 2000 begins, estimating that only 3 percent of the nation’s nationally significant companies had not made their systems Year 2000 ready. State responses to a nationwide survey we conducted indicated considerable confidence in the insurance industry’s preparation for the Year 2000 date change. Responses indicated that 78 percent of the states’ domiciled insurance companies were considered to be Year 2000 ready and making satisfactory progress in their contingency planning activities as of September 30. An additional 17 percent had not completed preparations for their mission-critical systems by September 30, but were expected to be Year 2000 ready by December 31, 1999. Uncertainties about the ability of the remaining 5 percent of the companies to become fully Year 2000 ready were largely unresolved at the time of our survey. Regulators indicated that they did not have adequate information to determine the readiness status for 4 percent of the companies and considered 1 percent to be at risk of not being ready by December. Regarding the latter, 13 states identified 49 companies, consisting mostly of small property/casualty insurers that they considered at risk of not being ready by the end of the year. In comparing the Year 2000 readiness of companies by type, we found that states appeared to have a slightly lower level of confidence in the readiness of HMOs and managed care organizations than those in other insurance segments. According to a task force official, health insurers represent one part of the industry that remains vulnerable because they depend on hospitals and doctors’ offices becoming Year 2000 ready. Rating companies and consultants we spoke with have generally remained confident about the industry’s efforts to prepare for 2000. One rating firm tempered the generally optimistic view of readiness in the industry by 7 Formed in 1998, the Year 2000 Industry Preparedness Task Force is responsible for addressing industry remediation, compliance and contingency planning, data confidentiality, and data sharing among the regulators and working with peer regulators to most efficiently address the preparedness of insurance companies. Page 3 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 reporting that 13 percent of the companies responding to its survey had made inadequate progress in their Year 2000 preparations. Industry observers continued to express uncertainty over potential costs associated with Year 2000-related liability exposures. Legal debates had yet to be resolved over insurance coverage for Year 2000-related mishaps as well as liability for costs that policyholders incur to avoid such mishaps. Rating companies we contacted in October 1999 indicated that it was still too early to tell how liability exposures might affect insurance companies, and, for this reason, the rating companies had not factored these exposures into their ratings. Each insurance company is chartered under the laws of a single state, Background known as its state of domicile. Although an insurance company can conduct business in multiple states, the regulator in the insurer’s state of domicile is its primary regulator. States in which an insurer is licensed to operate, but in which it is not chartered, typically rely on the company’s primary regulator in its state of domicile to oversee the insurer. Regarding Year 2000 issues, NAIC has emphasized this approach by encouraging each state to focus its Year 2000 oversight efforts on its domiciliary companies. In total, state-regulated insurance entities wrote an estimated $895.2 billion 8 in direct premiums sold nationally during 1998. Life/health and property/casualty insurance companies represent the key industry segments, accounting for 85 percent of the total direct premiums written in that year. HMOs; HMDIs; and other entities, such as fraternal organizations and title companies, accounted for the remaining 15 percent. To update our previous assessment of the regulatory oversight of the Scope and insurance industry’s Year 2000 readiness, we interviewed NAIC officials Methodology and reviewed documentation related to NAIC’s efforts to facilitate state oversight of the industry’s Year 2000 readiness. We also reviewed available state examination reports and executive summaries covering companies’ Year 2000 preparations, which were available at NAIC. While we did not verify the accuracy of the reports, this review included well over 200 reports and summaries prepared by or on behalf of 22 states. To the extent available through NAIC, we present updates pertaining to regulatory oversight through November 1999. In addition, we conducted follow-up 8 Direct premiums arise from policies or contracts issued by an insurance entity acting as the primary insurance carrier. Such premiums are defined as the contractually determined amount charged by the reporting entity to the policyholder for the effective period of the contract based on the expectation of risk, policy benefits, and expenses associated with the coverage provided by the terms of the contract. Direct premium figures do not include premiums related to reinsurance transactions. Page 4 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 work of Year 2000 validation efforts at the same 17 state insurance 9 departments on which we reported in April. Our follow-up work for the 17 states included (1) a second survey administered in July 1999 that covered their Year 2000 oversight activities, 10 including examination efforts in the area; (2) site visits to 6 of the 17 states to interview regulatory officials and review guidelines for conducting Year 2000-related examinations as well as available reports, summaries, and workpapers covering companies’ Year 2000 preparations; and (3) additional contacts in October 1999 with regulatory officials from each of the 17 states for a final update of their Year 2000-related examination efforts. The domiciliary companies of these 17 state insurance departments collectively accounted for 76 percent of the insurance sold nationally during 1998. See appendix I for a list of the 17 states and their 11 respective domiciled insurers’ market shares. Our review of examination-related documents was limited by restrictions at two of the states we visited and at NAIC, which had examination report summaries for the same two states. For one state, regulatory officials cited an existing law that restricted access to its examination reports and related workpapers by external parties. Regulatory officials for another state explained that, under special agreements reached with insurers prior to conducting Year 2000 examinations, their department was precluded from sharing examination-related documents with other states or external entities without the consent of the companies involved. Although one of the two states provided some limited access to their examination documents, we were unable to independently verify the adequacy of Year 2000 examination efforts for either state. To determine the status of the insurance industry’s Year 2000 readiness, we surveyed all 50 state insurance departments on the state of readiness of their domiciled companies as of September 30 and the extent of the departments’ on-site verification efforts. For each state, NAIC provided a Year 2000 contact to assist us in this survey effort. Appendix II contains a copy of the Year 2000 survey we administered to the states. With NAIC’s assistance, we obtained a 100-percent response rate from the 50 states. 9 GAO/GGD-99-87. 10 We administered a similar survey in January 1999 during our initial review in the area. 11 Market share information represents the proportion of total net premiums written nationally for all types of insurance accounted for by all companies domiciled in a given state. NAIC provided this information, which is based on 1998 financial data. Page 5 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 To obtain updated insights regarding the industry’s Year 2000 outlook pertaining to readiness and liability exposure issues, we contacted representatives of key rating companies, including A.M. Best Company, Standard and Poor’s, Moody’s Investors Service, and Weiss Ratings, Inc. We also obtained and reviewed information from (1) the Gartner Group, which is a business and technology advisory company that conducts research on the global state of Year 2000 readiness; (2) the American Academy of Actuaries, which is a public policy organization that presents actuarial analyses, comments on proposed federal regulation, and works with state officials on insurance-related issues; and (3) the Casualty Actuarial Society, which is a professional organization to advance knowledge of actuarial science applied to property, casualty, and similar risk exposures. In addition, we spoke to representatives of Milliman and Robertson, Inc., an actuarial and consulting firm, and the American Bar Association. We performed our work between June 1999 and December 1999 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from NAIC. Its written comments, which are included in appendix III, are discussed near the end of this letter. Since March 1999, NAIC has stepped up its Year 2000 efforts by (1) issuing NAIC and State expanded guidance to state regulators on how to examine companies’ Insurance Regulators preparedness and (2) encouraging state regulators to do on-site validation Have Accelerated reviews of companies with the greatest potential public impact. NAIC reports that many of the nation’s state regulators have also made Their Oversight of the substantial progress in conducting Year 2000 validation reviews. They Industry’s Year 2000 were projected to complete, by the end of November, on-site Year 2000 Readiness reviews for 91 percent of the nationally significant companies that accounted for about 84 percent of the direct premiums written by life/health and property/casualty insurers in 1998, according to NAIC. Despite this progress, uncertainties remain regarding the extent that on- site validation reviews have been conducted for some states’ companies, including some major health insurers and other segments of the insurance industry, such as HMOs and managed care organizations. In November 1999, NAIC was still in the process of quantifying the extent to which on- site verification was conducted at some of the major health insurers that did not fall into the category that NAIC had designated as nationally significant and at the larger managed care organizations, which had not been specifically covered by NAIC’s earlier efforts. Page 6 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 NAIC Has Stepped Up Its After we reported on the insurance industry’s Year 2000 readiness in March and April, 1999, NAIC stepped up its efforts to facilitate state Efforts to Encourage States’ actions to verify insurers’ reported information on their Year 2000 Validation of Reported Year preparations. For example, one undertaking involved NAIC’s provision of 2000 Information expanded examination guidance for assessing companies’ Year 2000 preparations and related training. Another important part of NAIC’s stepped up efforts has been its initiative that was aimed at prioritizing companies for review and encouraging states to perform on-site validation reviews. With only 9 months remaining before 2000 and 5,247 state- regulated insurance companies to account for, NAIC developed a pragmatic approach of focusing on the companies with the greatest potential impact on the public if they were to experience major computer problems. NAIC also worked with the states and encouraged them to implement this focused approach. Enhanced Guidance for In April 1999, NAIC provided the states with an enhanced version of the Examining Year 2000 Readiness Financial Examiners Handbook, which provided additional guidance for performing Year 2000 readiness reviews. According to NAIC, the guidance was borrowed from audit programs developed by the Federal Financial 12 Institutions Examination Council for federal examiners’ reviews of the Year 2000 readiness of U.S. financial institutions and a few of the state insurance departments that had been especially active in their Year 2000 oversight. NAIC also contracted for the services of a national consulting firm to develop and provide training to help state examiners better understand the review procedures and assist them in incorporating the procedures into their examinations. According to an NAIC official, this 2-day training, which was provided during the latter part of April in Atlanta, Chicago, and Denver, was attended by examiners representing almost 20 states. Compared to the timing of guidance provided by the banking and securities regulators, such Year 2000-related guidance and training would be considered late. However, we were told that this training and guidance were timely enough to be useful for some state insurance departments 12 The Federal Financial Institutions Examination Council is an interagency body created by Congress in 1979 to (1) prescribe uniform principles, standards, and report forms for federal examinations of financial institutions and (2) make recommendations to promote uniformity in the supervision of these institutions. The council’s membership is made up of the three federal bank regulators and the regulators for credit unions and thrift institutions. Page 7 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 13 because they did not start their targeted Year 2000 examination process until mid-1999. NAIC’s Year 2000 Initiative In March, NAIC’s Year 2000 Industry Preparedness Task Force launched an Focusing on Nationally initiative that was intended to (1) encourage states to perform on-site Significant Companies validation reviews and (2) determine the extent to which the states had verified the insurance industry’s Year 2000 readiness. The initiative focused on life/health and property/casualty insurance companies that NAIC had designated as nationally significant. This designation included 1,161 companies, located in 44 states and the District of Columbia, that were responsible for almost $650 billion in total premiums written during 14 1998. According to NAIC information, the insurance industry is relatively concentrated, with nationally significant companies representing approximately 86 percent of the premiums written for the life/health and property/casualty segments in 1998 and 27 percent of the 4,325 companies in the two insurer segments. It is also noteworthy, however, that many insurers that far exceeded NAIC’s criteria for the level of direct premiums written were not considered nationally significant because they did not meet the second criteria of being licensed in 17 states or more. These companies tended to conduct a significant amount of business on a more localized rather than national basis. We noted, for example, that 36 life/health insurers and 195 property/casualty insurers that each wrote more than $100 million in direct premiums during 1998 were not covered by NAIC’s nationally significant designation. Over the past several months, NAIC’s Year 2000 initiative focusing on nationally significant companies has involved an ongoing, interactive process with the individual state insurance departments. In April, NAIC administered a survey to all 50 states and the District of Columbia to develop preliminary baseline information on state efforts to conduct on- 13 Targeted Year 2000 examinations focus exclusively on reviewing companies’ Year 2000 preparations and their corresponding status of readiness. 14 According to NAIC information, when all types of insurance companies are included (not just life/health and property/casualty), there were 5,247 companies that wrote over $895 billion in direct premiums in 1998. While the companies designated as nationally significant represented only 22 percent of the nation’s state-regulated insurance companies, they wrote approximately 73 percent of the direct premiums written in 1998. Page 8 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 site examinations of companies’ Year 2000 compliance status, particularly, 15 the compliance of nationally significant companies. From June through August, 1999, NAIC also facilitated a series of conference calls that included members of the Year 2000 Industry Preparedness Task Force and, successively, representatives from each of the 50 states. According to NAIC officials, these conference call discussions focused on each state’s general approach to overseeing the industry’s Year 2000 preparations as well as its efforts to conduct on-site examinations to verify the Year 2000 compliance status of its domiciled insurance companies, particularly its nationally significant companies. These conference calls were a key mechanism that NAIC used to encourage states to conduct more on-site verification reviews and facilitate critical Year 2000 information-sharing among the participating states regarding, for example, licensed companies that wrote a large amount of insurance in a state but were domiciled elsewhere. Finally, these conference calls with each of the states enabled NAIC to quantify on a national basis the extent of the states’ on-site verification reviews of their nationally significant companies. To document its Year 2000 initiative, NAIC has maintained a summary schedule of all nationally significant companies with information on, among other things, whether each company had been subject to an on-site Year 2000 verification review. A company was considered to have been subject to an on-site verification review if the state of domicile, or another state where the company was licensed and doing business, indicated to the task force that a review had been completed or was scheduled to be completed by the end of September. A company was also considered to have been subject to an on-site verification review if it had been indirectly covered or would have been covered by the end of September through an on-site review of an affiliated company with which its computer system was fully integrated. On the basis of information obtained from the conference calls that were completed in August 1999, NAIC reported that 1,037 nationally significant 16 companies were to have been subject to an on-site Year 2000 review, 106 were not to have been subject to an on-site review, and the remaining 18 discontinued operations during 1999. The task force directed additional 15 Another stated objective was to develop quantifiable information on the industry’s readiness for us in connection with our Year 2000 reviews. 16 These nationally significant companies included three for which NAIC believed the nature and scope of reviews conducted by a state’s vendor were equivalent to an on-site review. Page 9 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 attention to certain companies that were viewed to be of particular concern. In a few cases, for example, NAIC officials noted that a state reconsidered its original position that an on-site verification was not needed. In one situation, NAIC provided financial assistance to facilitate the Year 2000 examination of a few key nationally significant companies in a particular state. In another case, a state agreed to conduct a targeted Year 2000 examination for a company domiciled in another state that had no plans to conduct on-site verification of the company. By November 1999, NAIC reported that the number of companies that would be subject to an on-site Year 2000 review by the end of November had increased to 1,059 companies, and it reported that the remaining 84 companies would not be subject to an on-site review. NAIC officials explained that, for the most part, the task force was satisfied with the level of information available on the remaining nationally significant companies that were not to be subject to on-site verification. NAIC has also taken the position that some comprehensive surveys were thorough enough to be equivalent to an examination. As we stated in our April 1999 report and continue to believe, the use of Year 2000 examinations is a principal mechanism for verifying self-reported information and providing assurances pertaining to the Year 2000 progress and readiness of regulated institutions. The ability to provide such assurances is particularly important for the industry’s nationally significant companies and others that do a substantial amount of business. In total, the number of companies that were to be subject to an on-site Year 2000 review by the end of November represented 98 percent of the direct premiums written by nationally significant companies. Regarding the total life/health and property/casualty insurer segments, the identified coverage through NAIC’s initiative suggests that companies that accounted for at least 84 percent of the direct premiums written during 1998 had been or were to have been subject to an on-site Year 2000 review by the end of November. The extent of on-site validation for the rest of the industry (including large HMO and HMDI companies), which accounted for an additional $137 billion in direct premiums written during 1998, was still unknown as of November 1999. NAIC’s Current Focus on In October 1999, NAIC reported that the Year 2000 Industry Preparedness Managed Care Organizations Task Force had recently expanded the scope of its review process to include the nation’s largest managed care organizations together with all of the Blue Cross and Blue Shield Plans, which represented some of the Page 10 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 17 major health care insurers not designated as nationally significant. NAIC estimated that the companies that fall into this category represent about 80 percent of the direct premiums written for all HMOs and HMDIs in 1998. The first task force conference to collect and summarize information on the status of on-site Year 2000 reviews for these managed care organizations was held in November 1999. NAIC officials acknowledged that with the Year 2000 deadline close at hand, the task force’s main objective was to quantify the extent of on-site verification that had been completed and identify any companies that may be of regulatory concern. State Insurance Regulators’ During 1999, most of the 17 state insurance regulators we reviewed increased their efforts to conduct targeted examinations that were aimed Efforts to Validate Industry at verifying companies’ Year 2000 readiness. In the beginning of the year, Year 2000 Readiness 10 of the 17 states were in the process of conducting targeted Through Targeted examinations or were planning to conduct such examinations, and the Examinations Increased remaining 7 states were either not planning to conduct such examinations or were uncertain whether they were going to conduct them, as shown in During 1999 table 1. By June 1999, the 17 states were either in the process of conducting targeted examinations or indicated that they planned to conduct them. Some states that started targeted Year 2000 examinations in the middle of 1999 used expedited approaches, such as suspending their regular financial examination process to devote their examiners solely to targeted Year 2000 examinations or hiring one or more private consultants to conduct such examinations in a short period of time. Table 1: Status of Targeted Year 2000 Examinations to Validate Company As of As of As of Readiness in 17 States Status 1/31/99 6/30/99 9/30/99 Fieldwork for planned targeted examinations 0 0 9 completed and reports finalized Targeted examinations in progress 8 13 8 Targeted examinations planned but not 2 4 0 started State expressed uncertainty regarding the 3 0 0 need for targeted examinations No plans to conduct targeted examinations 4 0 0 Total 17 17 17 Source: GAO interviews with state officials. By the end of September, all of the 17 states we reviewed had either completed or were in the process of completing their targeted Year 2000 examinations. Specifically, eight states had finished the fieldwork for over one-half of the companies that were targeted to be examined, but 17 These health care insurers tend to be concentrated in one or a few states. Page 11 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 corresponding reports for many of these examinations were still pending. We were told that one state was waiting for the completion of all its examination fieldwork before issuing a single summary report for all of its domiciled companies, rather than issuing separate reports for each company. A few states projected that they would not complete their Year 2000 examination process until the end of November, leaving little time for correcting identified deficiencies before the date change. In conducting targeted Year 2000 examinations, the states generally said they used the enhanced guidance that NAIC provided in April or guidelines developed by contractors, or in some cases both guidance, to improve the quality and consistency of their validation efforts. Our review of guidelines provided by the six states we visited indicated that they covered all key 18 areas of Year 2000 conversion cited in our Assessment Guide as well as those areas cited in the federal banking regulator examination guidelines. In turn, our review of reports available for 22 states’ targeted Year 2000 examinations indicated that the reports systematically addressed all major guideline components, and that they gave a particular emphasis to 19 companies’ contingency planning efforts. Coverage of Companies Through Like the banking industry, insurers depend on date-sensitive calculations On-site Examinations involving, for example, annuities, policy renewals, and claims processing. Recognizing their industry’s high level of date sensitivity, the nation’s banking regulators have completed multiple rounds of on-site 20 examinations for all financial institutions under their jurisdiction. Although 6 of the 17 states we reviewed indicated that their overall goal was to conduct 1 round of targeted examinations for all of their domiciled insurance companies, the remaining 11 states had established varying goals regarding which and how many companies would be subject to targeted Year 2000 examinations. These states’ goals were to cover from 6 to 76 percent of the domiciled companies within their jurisdictions. For the most part, these goals attempted to cover the states’ nationally significant companies. Two exceptions were states that had not planned to conduct on-site examinations for more than one-half of their nationally significant companies. One state official explained that a decision was made at the commissioner’s level that the limited time and staff resources available 18 Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14, Sept. 1997). 19 These reports were reviewed at five of the six states we visited and at NAIC. 20 Federal financial regulators report that they have conducted Year 2000 examinations in each insured financial institutions at least twice or, in some cases, three or more times. On the basis of such oversight efforts, the chair of the Federal Deposit Insurance Corporation has assured the public that, as of September 30, only 15 of the nation’s 10,292 insured banks were not ready for the Year 2000. Page 12 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 dictated that the state focus its on-site verification efforts on a select 21 number of key companies. Some state officials believed that insurance companies had a clear incentive to become Year 2000 ready to maintain their business in a highly competitive industry and, therefore, did not require a great deal of regulatory prodding in the area. Several state regulatory officials also explained that they believed that available self-reported information from companies was sometimes sufficient to satisfy regulatory needs, and that this information obviated the need for an on-site verification review. We found that the extent of such information available to state regulators ranged from one department that had, among other things, access to required quarterly reports of its companies’ Year 2000 progress since 1998 to one that relied primarily on company responses to a few Year 2000 surveys. The latter is of particular concern since the absence of corroborating evidence obtained through on-site verification or multiple contacts with companies to track their progress diminishes the extent of regulatory assurances about Year 2000 readiness. A few state officials also explained that some small companies were not sufficiently computer dependent (e.g., a company may use a single personal computer to conduct business) to experience major problems with the Year 2000 date change and warrant the need for an on-site verification. As we reported in April 1999, 2 of the 17 states we reviewed were comparatively more active in their efforts to ensure that insurance companies become Year 2000 ready. These states opted to forgo on-site examinations for some of their domiciled companies because of a comfort level that officials explained was derived from their close tracking of or continuous interaction with certain companies over time. In some cases, they chose instead to conduct targeted Year 2000 examinations for certain insurance companies that were licensed to write business but were not domiciled in the state. As of September 30, 1 of the 2 states had examined as many as 378 such licensed companies, and the other state had examined 29. Some of the states of domicile for these companies, as well as the Year 2000 Industry Preparedness Task Force, ultimately ended up relying on many of the targeted Year 2000 examinations conducted by the two licensing states to verify their readiness. 21 As of September 30, this state had conducted on-site verification examinations for six companies, which represented 3 percent of the net premium volume written by the state’s domiciled companies. Page 13 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 Information gathered by NAIC’s Year 2000 Industry Preparedness Task Available Information Force and responses to our survey of 50 states on U.S. insurers’ Year 2000 Continues to Suggest a readiness indicate that regulators have considerable confidence in the Positive Outlook for insurance industry’s readiness for Year 2000. In October, NAIC estimated that 3 percent of the nation’s nationally significant insurers had not made the Industry, but Some their systems Year 2000 ready. State regulators’ responses to our survey Uncertainties Remain indicated that 78 percent of all domiciled insurance companies were considered to be Year 2000 ready and making satisfactory progress in their contingency planning activities as of September 30. Of the remaining 22 percent of these companies, 17 percent, although not completed with their preparations as of September 30, were expected to become ready by December 31. Uncertainties about the status of the remaining 5 percent were largely unresolved at the time of our survey. With one exception, ratings companies and consultants we contacted were generally optimistic about the insurance industry’s Year 2000 outlook. However, some industry observers have raised questions about liability exposure issues, such as the coverage of Year 2000 remediation costs. They have also expressed concerns about insurance companies’ inability to accurately report their potential Year 2000-related liability exposures on their financial statements. NAIC and State Regulators In an October 1999 press release, NAIC’s Year 2000 task force reported that information obtained from its initiative focusing on nationally Remain Confident About significant insurers indicates that the insurance industry is expected to the Insurance Industry’s experience little disruption when 2000 begins. The task force pointed out Readiness for Year 2000 that state assessments of insurers’ readiness have identified a relatively small number of insurers for follow-up and continued monitoring. It also noted that regulators were expecting few problems in the new year, estimating that only 3 percent of the industry’s nationally significant companies had not made their systems Year 2000 ready. The task force chairman further stated that efforts by individual states indicated that most of the companies that were not designated as nationally significant were also on schedule, but data on the extent of validation efforts conducted for these companies had not been compiled at the time of our fieldwork in November. Our Survey of 50 States Our review of the 17 states previously discussed was intended to provide information on the status of regulatory oversight efforts. Separate from this effort, we conducted a survey of all 50 state insurance departments to obtain information on the Year 2000 readiness of insurance companies domiciled in each state as of September 30. Appendix IV provides the number of insurance companies by type of company identified by the 50 Page 14 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 state respondents. For purposes of the survey, a company was to be considered Year 2000 ready if the regulator was satisfied that the company had made adequate efforts to complete Year 2000 remediation, testing, and implementation activities for all mission-critical systems in preparation for 2000. Although our survey collected data on companies’ Year 2000 contingency planning activities, we did not specify that companies should have completed such activities to be considered Year 2000 ready. This definition of Year 2000 readiness was consistent with NAIC’s industry expectation that the last 6 months of 1999 should be used by companies to focus on less critical applications and systems and develop contingency plans in the event of a failure. Individual states were to base their responses to our questions about companies’ readiness and contingency planning activities on information obtained through their Year 2000 oversight efforts. State oversight efforts pertaining to Year 2000 could include (1) surveys administered to obtain information on companies’ Year 2000 preparations, (2) required Year 2000 disclosures with financial report filings, and (3) on-site verification reviews conducted as part of the state’s regular financial examination cycle or its targeted Year 2000 examination program. State responses to survey questions on the number of Year 2000 examinations conducted in 1998 and 1999 indicated that states were engaged in varying levels of on-site verification. Table 2 shows the proportion of states’ domiciled companies that, as of September 30, had been subject to an on-site verification review of their Year 2000 readiness. Table 2: Extent of On-site Verifications Conducted by States Percentage of state’s domiciled companies that were subject to Number of on-site verification examinations states Less than 25 percent 11 25 to 50 percent 10 51 to 75 percent 18 Greater than 75 percent 11 Total 50 Note 1: Five states also indicated that, in some cases, they had relied on on-site verification examinations conducted by another state. Note 2: On-site verification examinations include Year 2000 coverage during regular examinations as well as targeted Year 2000 examinations conducted during 1998 and 1999 (through Sept. 30). Note 3: Information presented excludes companies whose Year 2000 readiness status was not viewed by the states as relevant, such as companies in liquidation, companies operating without computer systems, and shell companies with no business. Source: State responses to GAO survey. Page 15 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 State Survey Responses Our survey indicated that state regulators had considerable confidence Indicated Considerable about the adequacy of the insurance industry’s preparation for the Year Confidence in the Industry 2000 date change. Seventy-eight percent of the states’ domiciled insurance companies were considered Year 2000 ready as of September 30 (see fig. 1). State regulators also generally viewed these insurers as making satisfactory progress in their contingency planning efforts. Figure 1: : Status of Insurance Industry’s Year 2000 Readiness, as of September 30, 1999 Note: This total excludes companies whose Year 2000 readiness status was not viewed as relevant, such as companies in liquidation, companies operating without computer systems, and shell companies with no business. Source: State responses to GAO survey. The remaining 22 percent of the states’ domiciled insurance companies represented companies that were (1) not Year 2000 ready by September 30, but that were projected to be ready by December 31; (2) not subject to categorization due to the lack of adequate information to determine their readiness status; or (3) considered at risk of not being ready. Some uncertainties exist, specific to the companies included in the last two categories, about their ability to become fully ready by the end of the year. These categories are discussed in the following sections. Page 16 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 Seventeen Percent of Companies State responses indicated that 17 percent of their domiciled insurance Were Not Year 2000 Ready by companies were not Year 2000 ready by September 30 but were projected September 30 but Were to be ready by December 31. These companies missed NAIC’s milestone Projected to be Ready by calling for all mission-critical systems to be Year 2000 ready by June 30, December 31 1999. States estimated that on average, 84 percent of the companies progressing toward becoming Year 2000 ready by December 31 were considered to be making satisfactory progress in their contingency planning efforts, which suggests that the remaining companies were not making adequate progress. This lack of adequate progress is of particular concern for companies that may be fully preoccupied with remediating their mission-critical systems during the last quarter of the year, leaving them little time to attend to their contingency plans. These companies would also have an increased likelihood of a system failure if any of their compliant mission-critical systems happen to be integrated with less critical systems that have not been fully remediated. Viable contingency plans are especially important for larger companies that may have complex systems that were not projected to be Year 2000 ready until the end of the year. Survey responses indicated that while 887, or 83 percent, of the companies not ready by September 30, but projected to be Year 2000 ready by December 31, were small, the remaining 188 companies each wrote $100 million or more in net premiums nationwide, as shown in table 3. Table 3: Companies Projected to Be Year 2000 Ready by December 31, 1999, Type Large Medium Small Total by Type and Size Property/casualty 5 70 416 491 Life/health 12 42 182 236 HMOs (including managed care 4 50 114 168 organizations) Other (e.g., fraternal organizations, 0 5 175 180 title companies) Total 21 167 887 1,075 Note: Size is based the estimated net premiums written nationwide, with large companies writing more than $1 billion, medium companies writing $100 million to $1 billion, and small companies writing less than $100 million. Source: State responses to GAO survey. Adequate Information Not The states indicated that as of September 30 they lacked sufficient Available for 4 Percent of information to determine the Year 2000 readiness of 4 percent of their Companies domiciled insurance companies. Specifically, 14 states placed 235 companies in this category. Many of these states indicated that they had some self-reported information from these companies, such as responses to the state’s Year 2000 surveys or the company’s Management Discussion Page 17 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 22 and Analysis Year 2000 disclosures. However, these states believed that they could not determine their readiness from information that had not been corroborated by an on-site verification review. One state official, for example, explained that although survey responses did not indicate any reason to question the prospective readiness of these companies, on-site examinations had not been performed to verify survey information or determine the companies’ readiness. On the basis of similar reasoning, an official from another state noted that he was waiting for the results of ongoing examinations at some companies before reaching any conclusions about their readiness. One situation involved a state where the insurance department was responsible for monitoring the annual statements submitted by HMOs but depended on another state department for survey and examination information. The insurance department was told that a Year 2000 survey had been administered to the HMOs, but their responses had not yet been received. Therefore, the insurance department identified these HMOs as companies for which it did not have adequate information to determine their Year 2000 readiness. One Percent of Companies Were In response to our survey, the states reported that about 1 percent of their Viewed at Risk of Not Being domiciled insurance companies were viewed as at risk of not being Year 23 Year 2000 Ready by December 2000 ready by the end of the year. Specifically, 13 states identified 49 31 companies, consisting mostly of small property/casualty insurers, that they considered at risk of not being ready by the end of the year, as shown in table 4. Thirty-eight of the companies considered at risk were small, 9 were medium, and the remaining 2 were large HMOs. 22 Most state regulators required insurance companies to include a disclosure of their Year 2000 status in the Management Discussion and Analysis section of their financial report filings. 23 This figure is not necessarily inconsistent with NAIC’s estimate in October 1999 that 3 percent of the nationally significant companies had not completed their Year 2000 preparations. The states’ responses regarding companies that were not projected to be ready by December 31, 1999, included all companies. Page 18 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 Table 4: Companies Viewed at Risk of Not Being Ready by December 31, 1999, Type Large Medium Small Total by Type and Size Property/casualty 0 4 20 24 Life/health 0 3 9 12 HMOs (including managed care 2 2 8 12 organizations) Other (e.g., fraternal organizations, 0 0 1 1 title companies) Total 2 9 38 49 Note: Size is based on the estimated net premiums written nationwide, with large companies writing more than $1 billion, medium companies writing $100 million to $1 billion, and small companies writing less than $100 million. Source: State responses to GAO survey. On average, states estimated that 57 percent of these at risk companies had not made satisfactory progress in their contingency planning efforts as of September 30, 1999. Virtually all of the states that identified companies as at risk of not being Year 2000 ready by the end of the year noted that they would continue to focus on the adequacy of these companies’ contingency plans during the last quarter of 1999. Other actions the states planned to take to deal with at risk companies included conducting management conferences and requiring monthly Year 2000 progress reports. In a few isolated cases, a state had resorted to or was planning to resort to enforcement actions. Regulators Have Slightly In reviewing state survey responses regarding the Year 2000 readiness of companies by type, we found that states identified a slightly lower level Lower Confidence in the proportion of HMOs considered to be Year 2000 ready when compared to Year 2000 Readiness of insurers in other categories. As of September 30, 1999, 69 percent of the HMOs states’ companies classified as HMOs, including managed care organizations, were considered Year 2000 ready. Of the remaining 31 percent, 23 percent had mission-critical systems that were not Year 2000 ready as of September 30 but that were projected to be ready by December 31, 6 percent were not subject to categorization due to the lack of adequate information, and 2 percent were considered at risk of not being ready by December 31. In contrast, 72 to 80 percent of insurers in the property/casualty, life/health, and other insurer categories were considered Year 2000 ready. Appendix V provides a graphic that compares the readiness status of companies by type of insurer. According to a task force official, health insurers represent one area that remains vulnerable because such insurers depend on hospitals and doctors’ offices becoming Year 2000 ready. A recent report issued by the President’s Council on Year 2000 Conversion states that many health care Page 19 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 providers and managed care organizations continue to exhibit troubling 24 levels of readiness. The report refers to July/August survey data indicating that (1) only 40 percent of the health care providers and organizations reported that they were Year 2000 ready and (2) roughly 25 percent of the organizations did not have documented Year 2000 plans. In July 1999, we reported that many surveys had been completed in 1999 on the Year 2000 readiness of health care providers, but none provided sufficient information with which to assess the Year 2000 status of the 25 health-care-provider community. We later testified in September 1999 that the Health Care Financing Administration, with assistance from a contractor, performed a Year 2000 risk assessment of 425 managed care organizations. This June 1999 risk assessment identified 22 percent of the organizations as being high risk, 74 percent as medium risk, and 17 percent 26 as low risk. During our fieldwork in November, we were told that NAIC was in contact with the Health Care Financing Administration to determine whether any of the managed care organizations assessed by the agency overlapped with those that were regulated by the state insurance departments. Other Sources Are The industry observers we contacted generally maintained a favorable view of the insurance industry’s Year 2000 preparedness efforts, but they Generally Positive About continued to express uncertainty over potential costs associated with Year Insurers’ Year 2000 2000-related liability exposures. With one exception, rating companies and Preparedness Efforts but consultants with whom we spoke have remained confident about the Are Uncertain About industry’s efforts to prepare and become ready for 2000. For instance, the Gartner Group continues to place the insurance industry among the Liability Exposure Impacts industry leaders in becoming Year 2000 ready, on the basis of its August report. Likewise, several rating companies we contacted, including Standard and Poor’s; A.M. Best; and Moody’s, indicated that, as of October, they had not downgraded any insurer’s rating due to Year 2000 readiness issues. One rating firm, Weiss Ratings, Inc., tempered the generally optimistic view of readiness in the industry by reporting that 13 percent of the companies responding to its survey had made inadequate progress in their Year 2000 preparations. The response rate to this June 1999 survey was 24 Fourth Summary of Assessment Information, President’s Council on Year 2000 Conversion, November 1999. 25 Year 2000 Computing Crisis: Status of Medicare Provider Unknown (GAO/AIMD-99-243, July 28, 1999). 26 Year 2000 Computing Challenge: HCFA Action Needed to Address Remaining Medicare Issues (GAO/T-AIMD-99-299, Sept. 27, 1999). Page 20 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 27 about 19 percent. While Weiss Ratings, Inc., considered a company’s progress to be inadequate if its mission-critical systems were not renovated and tested by August 1999, it also indicated that those companies viewed to be making inadequate progress still had a good chance of achieving Year 2000 compliance in the time remaining. Considerable uncertainty remains concerning the potential magnitude of insurers’ Year 2000-related liability exposures. In our April report, we noted that insurers’ liability exposures could not then be reasonably estimated because, among other factors, a claims history for the event did not exist and questions about key legal issues that could affect insurance policy coverage were still unresolved. Since then, the industry observers we contacted have continued to express uncertainties. The rating companies we contacted in October indicated that it was still too early to tell how liability exposures might affect insurance companies. For this reason, the rating companies had not factored liability exposures into their ratings. One actuarial consulting firm estimated that costs from Year 2000-related claims and legal expenses among U.S. property/casualty insurers could range between $15 billion and $35 billion. The firm acknowledged that its estimates were based on several assumptions associated with claims and legal outcomes that have not yet been 28 realized. The industry observers we contacted generally said that insurance companies will not likely be in a position to report their potential Year 2000-related liability exposures on their 1999 financial statements, because their liability exposures are not yet reasonably estimable due to uncertainties over claims and legal outcomes. Legal debates over insurance coverage for Year 2000-related mishaps, as well as for costs to avoid such mishaps, have yet to be fully resolved. Our 29 previous report described some of the legal debates associated with coverage for Year 2000-related problems and damages, including the coverage-related issues of “fortuity” and “triggers.” For example, it is not clear whether a Year 2000-related loss would be considered a fortuitous event covered by insurance, rather than an expected event that may not be covered. For some types of policies, coverage also depends on what event triggers coverage. Specifically, questions arise when coverage was 27 Weiss Ratings, Inc., administered its survey on June 30, 1999, to 5,654 insurance companies and HMOs. From the survey results, it developed Year 2000 readiness ratings for respondent companies that were separate from their financial safety ratings. 28 “Putting a Price Tag on the Millennium,” Best Review, Milliman and Robertson, Inc., June 1999. 29 GAO/GGD-99-87. Page 21 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 activated for a particular policy. Other debates focus on whether an insured party that takes remedial action to reduce its vulnerability to Year 2000-related problems may recover remediation costs under a particular policy. The Y2K Act, enacted in July 1999, does not directly address many of the unresolved legal issues that could affect insurers’ potential liability 30 exposures. The primary purposes of the act include facilitating alternative modes of dispute resolution, limiting certain liabilities for Year 2000- related claims, and providing pre-Year 2000 remedial measures aimed at reducing an insured’s vulnerability to Year 2000-related mishaps. The act also sets forth procedural requirements for class action suits and affirmative defenses for temporary noncompliance with certain federal standards caused by a Year 2000-related problem. The act, however, does not contain substantive standards to guide courts in deciding whether Year 31 2000-related mishaps or remediation costs should be covered. Such issues will principally be a matter of state law. Some current cases involving insurance coverage disputes and additional provisions of the Y2K Act are described in appendix VI. Since we first expressed concerns about the states’ regulatory oversight of Conclusions the insurance industry in March 1999, NAIC actively emphasized the value of state regulators’ validating insurance companies’ Year 2000 preparations through on-site examinations, particularly those undertaken by nationally significant insurers. We also found that, partly in response to this emphasis, some states have increased their efforts to conduct on-site examinations of their domiciled insurance companies’ Year 2000 preparations. Even with this increased emphasis, however, not all of the nation’s insurance companies will be subject to an on-site verification review. Gaps in Year 2000 verification coverage of the insurance industry can be attributed to several factors. One factor has been the late start of some states in conducting on-site verification reviews and the resulting need for them to focus on the potentially higher impact companies rather than conducting examinations of all domiciled insurance companies. Another factor has been regulators’ belief that, in some cases, comprehensive surveys were acceptable substitutes for examinations. Differing regulatory 30 Public Law No.106-37, 113 Stat. 185, July 20, 1999. 31 The act does require that all written contract terms, including exclusions of liability and disclaimers of warranty, are to be strictly enforced unless those terms are contrary to any applicable law in effect as of January 1, 1999. Page 22 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 perspectives have constituted yet another factor contributing to state decisions to forgo on-site examinations for some companies. Such perspectives ranged from satisfaction with the adequacy of off-site monitoring in a few states that had closely tracked the progress of their companies over the last few years to the view in a few other states that Year 2000 readiness would likely be adequately covered by insurers motivated to remain competitive without regulatory prodding. Finally, insurance regulators have indicated that some small insurance companies are not sufficiently dependent on computers to experience major problems with the Year 2000 date change. The strategy promulgated by NAIC to focus on nationally significant companies appears reasonable given the large number of state-regulated insurance companies subject to oversight and the limited time remaining before 2000. However, states’ generally late start in assuming a more proactive role regarding Year 2000 has affected their ability to complete their regulatory oversight of all the insurers they supervise. As of mid- November, for example, some states had not finished the planned on-site validation process for their companies, and NAIC was still in the process of collecting information about states’ regulatory assessments of the nation’s largest managed care organizations and major health insurers not designated as nationally significant. In addition, uncertainties exist about the readiness outcome for the 4 percent of the companies for which regulators did not have sufficient information, and 1 percent of the companies that regulators viewed at risk of not being ready by December 31 but were closely monitoring. Although they were projected to be ready by the end of the year, questions also remain unresolved regarding whether all of the 17 percent of the insurance companies that were not ready as of September 30, 1999, can complete all conversion activities to become fully compliant within the remaining time. Lastly, and arguably outside of the regulators’ control, uncertainties regarding insurers’ Year 2000 liability exposures continue to represent an area of concern that is being monitored by rating companies, and other industry observers, that can affect the overall Year 2000 outlook of the insurance industry. In summary, the intensive regulatory activity of the past several months provides additional support for the level of confidence that regulators place on the insurance industry’s Year 2000 preparations and their belief that most policyholders should not be concerned about their coverage. However, as previously indicated, remaining gaps in the on-site verification of insurance companies’ Year 2000 readiness and unfinished regulatory Page 23 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 efforts in the area leave uncertainties about the self-reported status of some companies’ readiness. As a point of comparison, banking regulators, who have conducted multiple examinations of all their financial institutions, can provide stronger assurances to support their assertions that, with relatively few exceptions, all banks were Year 2000 ready as of September 30, 1999. Insurance regulators, on the other hand, can say with some conviction that most insurance is sold by companies that are Year 2000 ready or appear to be on course to become ready by the end of the year. It remains true that a portion of the industry had not completed its Year 2000 preparations by September 30, 1999, and that some of these companies had not made satisfactory progress in contingency planning. However, the welcome news is that most consumers, especially those insured by nationally significant companies, can have greater confidence that their insurers will likely provide uninterrupted services into the new year. NAIC provided written comments on a draft of this report. A reprint of Agency Comments and NAIC’s letter can be found in appendix III. Our Evaluation NAIC disagrees with a perceived assertion that because states have not performed on-site verification of Year 2000 preparations of every insurance company, it represents an inability of states to complete their regulatory oversight of the industry. As noted on page 22, we attribute the inability of states to complete their regulatory oversight of the industry to states’ generally late start in assuming a more proactive role regarding year 2000. This late start, among other factors, has caused some states to forgo conducting Year 2000 on-site verifications for some of their domiciled companies which has, in turn, limited the level of assurances to support regulatory assertions of their companies’ readiness. We acknowledge on page 10 that, according to NAIC information, 98 percent of the direct premiums written by nationally significant companies had been or were to be subject to an on-site Year 2000 review by the end of November. However, the extent of on-site validation for the life/health and property/casualty companies that were not nationally significant and the other insurer segments, which together represent 27 percent of the total direct premiums written by the industry as a whole, was unknown at the time of our review. We continue to believe that most consumers, especially those insured by nationally significant companies, can have greater confidence that their insurer will likely provide uninterrupted services into the new year. The same level of assurances, however, cannot be provided for the portion of the industry that may not have been subject to an on-site verification or for which the extent of on-site verification is unknown. Page 24 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 NAIC believes that the draft report erroneously overemphasized statistics based on the number of insurance companies verified or the number of states performing on-site examinations and suggests that these statistics should focus on information supplied by the NAIC and, more emphatically, on premium-based statistics from our survey of the 50 states. Premium- based information supplied by the NAIC can be found throughout this report, but specifically on pages 2, 6, and 10 as it relates to the on-site verification of nationally significant companies. We did not provide premium-based statistics from our survey primarily because we found inconsistencies when we compared responses from many of the states to similar information provided by NAIC. For example, the total net premium volume written nationwide reported by 15 states to have been subject to an on-site verification was, on average, 126 percent more than the total net premium volume written nationwide identified by NAIC for each of these states. Such inconsistencies may have been the result of the states reporting gross premiums rather than net premiums as our survey requested or the result of duplicative counting for companies that may have been subject to Year 2000 on-site verifications conducted during both a regular and a targeted examination. Regardless of the reasons for such inconsistencies, they rendered the survey responses on net premiums subject to on-site verification unusable for reporting purposes. NAIC also indicated that statistics based on the number of companies impart an unnecessary negative bias because a significant number of companies either write a very small amount of premiums, are so small as to have no risk of Year 2000 failure, are dormant companies, or are companies that have been acquired by or merged into other insurers since 1998. To help minimize this type of bias, we have made an adjustment to the table on page 15 that shows the percentage of states’ domiciled companies that were subject to on-site verification examinations. Specifically, companies whose Year 2000 readiness status was not viewed by the states as relevant were excluded; this covered, for example, companies in liquidation, companies operating without computer systems, and shell companies with no business. The effect of this adjustment on the number of states falling into each category of on-site verifications conducted was minor. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 10 days from its date. At that time, we will provide copies to Representative Thomas Bliley, Chairman, House Committee on Commerce, and Senator Robert Bennett, Chairman, and Senator Christopher Dodd, Vice Chairman, Senate Special Committee on the Year 2000 Technology Problem. We will also provide Page 25 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight B-284237 copies of this report to other interested parties and will make copies available to others on request. Key contributors to this assignment are acknowledged in appendix VII. Please call me or Lawrence Cluff on (202) 512-8678 if you or your staff have any questions. Sincerely yours, Richard J. Hillman Associate Director, Financial Institutions and Markets Issues Page 26 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Page 27 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Contents Letter 1 Appendix I 30 Seventeen States Reviewed and Market Share of Their Domiciled Insurance Companies Appendix II 31 GAO Year 2000 Survey Administered to the 50 States Appendix III 34 Comments From the National Association of Insurance Commissioners Appendix IV 36 Universe of Domiciled Insurance Companies, by Type Appendix V 37 Status of Companies by Type of Insurer, as of September 30, 1999 Page 28 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Contents Appendix VI 38 Current Cases Involving Insurance Coverage 38 Current Court Cases The Y2K Act 39 Involving Insurance Coverage of Year 2000 Issues and Highlights of the Y2K Act Appendix VII 42 GAO Contacts and Staff Acknowledgments Tables Table 1: Status of Targeted Year 2000 Examinations to 11 Validate Company Readiness in 17 States Table 2: Extent of On-site Verifications Conducted by 15 States Table 3: Companies Projected to Be Year 2000 Ready by 17 December 31, 1999, by Type and Size Table 4: Companies Viewed at Risk of Not Being Ready 19 by December 31, 1999, by Type and Size Table I.1: States Reviewed and Market Share of Their 30 Domiciled Insurance Companies Table IV.1: Domiciled Insurance Companies, by Type 36 Figures Figure 1: Status of Insurance Industry’s Year 2000 16 Readiness, as of September 30, 1999 Figure V.1: Status of Companies by Type of Insurer, as of 37 September 30, 1999 Abbreviations HMDI Hospital, Medical, and Dental Service Indemnity Corporation HMO Health Maintenance Organization NAIC National Association of Insurance Commissioners Page 29 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix I Seventeen States Reviewed and Market Share of Their Domiciled Insurance Companies We focused part of our review on the same 17 state insurance departments visited during our previous review. These state departments’ domiciled insurance companies collectively accounted for almost 76 percent of insurance sold nationally during 1998. The departments represented the top 12 states, whose domiciled companies had combined market shares ranging from 3.4 percent to 14 percent, and 5 states with relatively smaller market shares ranging from 0.3 to 2.1 percent. Table I.1: States Reviewed and Market Share of Their Domiciled Insurance Market share of Companies domiciled insurance States reviewed companies Illinois 14.0% New York 11.4 Connecticut 7.1 Pennsylvania 5.3 California 4.3 Ohio 4.3 Wisconsin 4.2 Massachusetts 3.9 Texas 3.7 Indiana 3.5 Michigan 3.5 Delaware 3.4 New Jersey 2.1 Iowa 1.8 Arizona 1.8 Oregon 1.0 Utah 0.3 Total 75.6% Note: Market share information of each state’s domiciled insurance companies represents the percentage of net premium volume written nationwide ($703 billion) for all types of insurance. A domiciled insurance company is one that is incorporated under the laws of the state in which it is doing business. Source: Data extracted from information provided by NAIC, based on its 1998 financial database. Page 30 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix II GAO Year 2000 Survey Administered to the 50 States Page 31 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix II GAO Year 2000 Survey Administered to the 50 States Page 32 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix II GAO Year 2000 Survey Administered to the 50 States Page 33 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix III Comments From the National Association of Insurance Commissioners Page 34 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix III Comments From the National Association of Insurance Commissioners Page 35 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix IV Universe of Domiciled Insurance Companies, by Type Table IV.1: Domiciled Insurance Companies, by Type Number of Percentage of Type companies companies a Property/casualty insurers 2,830 46% b Life/health insurers 1,477 24 HMOs (including managed care organizations) 714 12 Other (e.g., fraternal organizations, title companies) 1,179 19 c d Total 6,200 101% a This number includes 692 companies designated as nationally significant. b This number includes 435 companies designated as nationally significant. c This total excludes 267 companies whose Year 2000 readiness status was not viewed by the states as relevant, such as companies in liquidation, companies operating without computer systems, and shell companies with no business. d Does not equal 100 percent due to rounding. Source: State responses to GAO survey. Page 36 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix V Status of Companies by Type of Insurer, as of September 30, 1999 Figure V.1: Status of Companies by Type of Insurer, as of September 30, 1999 Note: The last bar graph labeled “Total” represents the same information shown in figure 1 of this report. Source: State responses to GAO survey. Page 37 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix VI Current Court Cases Involving Insurance Coverage of Year 2000 Issues and Highlights of the Y2K Act As previously noted, our April report described some of the prevalent Current Cases 1 issues involved in coverage disputes. Some recent court cases raised a Involving Insurance new issue involving businesses seeking to recover from their insurers Coverage remediation costs they have incurred in their efforts to help prevent or reduce the costs of Year 2000-related mishaps. On the basis of an interpretation of a provision commonly referred to as the “sue and labor” clause, in some of the cases, the insured entities claimed that their insurance policies cover remediation costs. Some insurance policies, generally property/casualty insurance policies, contain a sue and labor provision accompanied by language specifically obligating the insurer to contribute to the expenses incurred by the insured in acting under the provision. The sue and labor clause originated centuries ago in ocean marine policies. Its purpose was to encourage or require policyholders to prevent or minimize imminent potential loss or damage covered by the policy without forfeiting recovery under the policy, thereby reducing the insured loss. According to one commentator, the classic example is the captain who orders the crew to jettison cargo to prevent the ship from foundering in stormy seas. The value of the jettisoned cargo is recoverable under the sue and labor clause. At least three cases were brought in 1999 seeking coverage of remediation costs under sue and labor provisions. The insured plaintiffs in those cases reportedly sought to recover remediation costs of at least $400 million and $183 million. Cases of this type contribute to the uncertainties associated with insurers’ potential liability exposure. Insurers opposing claims to recover remediation costs have raised several arguments. For example, they contend that remediation costs are covered only if they were incurred to protect against an insured loss, and that Year 2000 remediation costs are not insured losses. Among other things, costs recoverable pursuant to a sue and labor provision typically involve remedial measures to prevent or recover damage arising from covered events, such as lightning, fire, or theft. Insurers contend that Year 2000 remediation costs arise from a defect or inherent limitation in a product and not in connection with an insured event. In addition, insurers assert that the majority of losses an insured business seeks to protect against through remediation measures are not losses attributable to the physical loss or damage of insured property, but instead are uninsured economic losses, such as a decrease in market share, a loss of investor or consumer confidence, or regulatory sanctions. Another argument is that the loss to 1 GAO/GGD-99-87. Page 38 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix VI Current Court Cases Involving Insurance Coverage of Year 2000 Issues and Highlights of the Y2K Act be minimized or avoided must be actual or imminent. According to this argument, the Year 2000 event should not be considered imminent, because insured entities have been aware of it for several years and in many cases began remedial measures as early as the mid-1990s. Insurers argue that such remediation costs should be considered ordinary costs of doing business. The Y2K Act does not create any new causes of action. Instead, for “Year The Y2K Act 2000 actions,” it modifies existing state or federal procedures and remedies 2 concerning nonpersonal injury liability arising from Year 2000 failures. Among other things, the act (1) requires that notice of a Year 2000 claim be given to potential defendants before a “Year 2000 action” is filed; (2) establishes heightened pleading requirements; (3) sets caps and limitations on punitive damage awards; and (4) provides for the apportionment of damages, rather than joint and several liability, except in cases where it is found that the defendants acted with specific intent to injure the plaintiff 3 or knowingly committed fraud. The act applies to any “Year 2000 action” brought after January 1, 1999, for an actual or potential “Year 2000 failure” 4 occurring before January 1, 2003. The following is an overview of some provisions of the act that could have a direct or indirect impact on the amounts for which insurance companies may be liable. 2 However, the new law does not preempt state laws that provide stricter limits on damages and liabilities or afford greater protection in Year 2000-related lawsuits. 3 While there will undoubtedly be additional litigation, the first court to examine whether insurance policies are subject to the Y2K Act decided that the act was not intended to apply to insurance litigation. American Guaranty and Liability Insurance Co. v. Xerox Corp., Index No. 603/69/99 (N.Y. Sup. Ct., N.Y. County, July 1,1999). Xerox, which had not provided notice within the time limits provided in the insurance contract, argued that the Y2K Act’s prelitigation commencement procedures prevailed over the insurance contract notice provisions. The court rejected this argument, reasoning that Congress did not intend to subject insurance litigation to the requirements of the Y2K Act. In the court’s view, the Y2K Act was aimed at litigation involving damages that directly result from Y2K failures. The court noted that many of the procedural requirements of the Y2K Act are directed at providing an opportunity for the parties to settle their differences by allowing a period for the manufacturer, software provider, or system operator to correct Y2K defects. The court viewed these provisions as meaningless in collateral actions involving insurance litigations. 4 A “Y2K action” is defined in the Y2K Act as “a civil action commenced in any Federal or State court . . . in which the plaintiff’s alleged harm or injury arises from or is related to an actual or potential Y2K failure, or a claim or defense that arises from or is related to an actual or potential Y2K failure.” A “Y2K failure” is defined in the Y2K Act as a failure by “any device or system . . . or any software . . . to process, to calculate, to compare, to sequence, to display, to store, to transmit, or to receive Year-2000 date-related data.” Included in this definition are failures (1) “to deal with or account for transitions or comparisons from, into, and between the years 1999 and 2000 accurately”; (2) “to recognize or accurately to process any specific date in 1999, 2000, or 2001”; or (3) “accurately to account for the year 2000’s status as a leap year, including recognition and processing of the correct date on February 29, 2000.” The Y2K Act does not apply to claims for personal injury or wrongful death. Page 39 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix VI Current Court Cases Involving Insurance Coverage of Year 2000 Issues and Highlights of the Y2K Act 5 Most of the Y2K Act focuses on the litigation process. Under the notice provisions, prospective plaintiffs in a Year 2000 action (except for claims for injunctive relief) must send a written notice to each prospective defendant containing information about the pertinent event and including the remedy sought. Within 30 days after receiving the notice, the prospective defendant must provide each plaintiff with a written statement describing what, if any, remediation measures or alternative dispute resolution processes would be acceptable. If the defendant proposes a plan to remediate the problem, the prospective plaintiff must allow the prospective defendant an additional 60 days from the end of the 30-day notice period to complete the proposed remedial action before bringing suit. The purpose of this 90-day notice requirement is to create a procedure that might facilitate the parties’ resolution of the problem through voluntary efforts or through alternative dispute resolution. The Y2K Act also contains rules for pleading affirmative defenses, damages, warranty and liability disclaimers, proportionate liability, and class actions. One purpose of the pleading requirements is to reduce the potential for frivolous claims by requiring the plaintiff in a Year 2000 action to articulate certain bases for the claim and remedy. Provisions of the act for preserving warranties and contracts also are intended to discourage frivolous lawsuits. As previously discussed, the act generally requires that all written contract terms, including exclusions of liability and disclaimers of warranty, are to be strictly enforced unless those terms are contrary to any applicable state statute in effect as of January 1, 1999. The Y2K Act limits liability exposure and damages. Some limitations depend upon whether the lawsuit is a contract action or a tort action. For example, in tort actions, the act provides for proportionate liability, except with respect to certain suits brought by consumers. Generally, defendants will be liable only for that portion of a judgment that corresponds to their proportionate share of the total fault for the plaintiff’s loss, unless the defendants are found to have committed fraud in connection with the Year 2000 problem or to have specifically intended to injure the plaintiff. Such a finding would render the defendant jointly and severally liable. Other limitations include the following: (1) elimination of strict liability, (2) heightened proof requirements as a condition for recovering punitive damages and a cap on the amount of such damages for individuals with net 5 The Y2K Act also contains protections for homeowners who otherwise could be penalized should a Y2K failure disrupt the country’s payment systems. If such an event were to prevent a homeowner from timely making a mortgage payment, the homeowner would be protected from foreclosure unless payment is not made within the time period contained in the act. Page 40 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix VI Current Court Cases Involving Insurance Coverage of Year 2000 Issues and Highlights of the Y2K Act worth of less than $500,000 and small employers, and (3) limitations on the recovery of certain “economic losses” of the plaintiff alleged in connection with a tort claim. These losses, which include lost profits, business interruption losses, and consequential and indirect damages, may be recovered only if a contract provides for their recovery or the losses result directly from damage to tangible real or personal property caused by the Year 2000 failure. The limitation does not apply to claims of intentional torts. For contract actions, no category of damages may be awarded unless such damages are allowed by the contract expressly or, if the contract is silent on the matter, under applicable state or federal law. The act contains a special provision that excludes from damages the amount the plaintiff reasonably could have avoided by utilizing any available or reasonably ascertainable information “concerning means of remedying or avoiding the Year 2000 failure involved in the action.” Prospective plaintiffs are provided with an incentive to take reasonable steps to limit their damages. This duty to mitigate is in addition to any such duty imposed under state law. The duty is not absolute, however. Where a defendant intentionally misrepresents facts concerning the potential for a Year 2000 failure in the “device or system used or sold by the defendant” that caused plaintiff’s harm, the plaintiff will be relieved from this statutory mitigation duty. Depending upon the effects of the settlement incentives and litigation- related limitations contained in the Y2K Act, insurance liability exposure could be less than would be the case if liabilities for Year 2000 actions were determined under less limiting state laws. Whether an insurance policy covers a particular Year 2000 event, however, could depend upon a number of factors, including the extent to which state laws and cases apply to insurance coverage litigation. Page 41 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Appendix VII GAO Contacts and Staff Acknowledgments Richard J. Hillman, (202) 512-8678 GAO Contacts Lawrence D. Cluff, ( 202) 512-8678 In addition to the persons named above, Evelyn E Aquino, Gerhard Acknowledgments Brostrom, Barry A. Kirby, May M. Lee, Alexandra Martin-Arseneau,and Paul G. Thompson made key contributions to this report. Page 42 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Page 43 GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Order by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch- tone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send e-mail message with “info” in the body to: firstname.lastname@example.org or visit GAO’s World Wide Web Home Page at: http://www.gao.gov United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. G100 Official Business Penalty for Private Use $300 Address Correction Requested (233609)
Year 2000: Insurance Regulators Have Accelerated Oversight, but Some Gaps Remain
Published by the Government Accountability Office on 1999-12-20.
Below is a raw (and likely hideous) rendition of the original report. (PDF)