THE AUDIT OF INSURERS IN THE REPUBLIC OF IRELAND

Transcription

1 THE AUDIT OF INSURERS IN THE REPUBLIC OF IRELAND Contents Page Preface 2 Introduction 5 The Audit of Financial Statements 14 SAS 100: Objective and General Principles Governing the Audit of Financial Statements 15 SAS 110: Fraud and Error 16 SAS 120: Consideration of Law and Regulations 19 SAS 130: The Going Concern Basis in Financial Statements 26 SAS 140: Engagement Letters 28 SAS 150: Subsequent Events 29 SAS 160: Other information in documents containing audited financial statements 30 SAS 200: Planning 30 SAS 210: Knowledge of the Business 33 SAS 220: Materiality and the Audit 35 SAS 240: Quality Control for Audit Work (Revised) 36 SAS 300: Accounting and Internal Control Systems and Audit Risk Assessments 38 SAS 400: Audit Evidence 42 SAS 420: Audit of Accounting Estimates 43 SAS 440: Management Representations 47 SAS 460: Related Parties 48 SAS 480: Service Organisations 49 SAS 520: Using the Work of an Expert 50 SAS 600: Auditors Reports on Financial Statements 54 SAS 610 (Revised): Communication of Audit Matters to those Charged with Governance 58 SAS 620: The Auditors Right and Duty to Report to Regulators 59 Reporting on Regulatory Returns 69 Appendices 1-Matters of material significance: insurance companies 79 2-Contents of regulatory returns 87 3-Illustrative examples of auditors reports on regulatory returns 91 4-Contents of certificates required from directors 94 5-Acts, regulations and guidelines relevant to authorised insurers 100 1

2 PREFACE The purpose of Practice Notes issued by the Auditing Practices Board is to assist auditors in applying Auditing Standards of general application to particular circumstances and industries. They are persuasive rather than prescriptive. However they are indicative of good practice even though they may be developed without the full process of consultation and exposure used for Statements of Auditing Standards. This Practice Note contains guidance on the application of Statements of Auditing Standards ( SASs ) issued by the Auditing Practices Board ( APB ) to the audit of financial statements of insurance companies in the Republic of Ireland, hereinafter referred to as Ireland for the purposes of this Practice Note. SASs contain the basic principles and essential procedures, referred to as Auditing Standards, with which auditors are required to comply in the conduct of any audit of financial statements. This Practice Note also contains guidance in relation to auditors reports on regulatory returns. The guidance in this Practice Note is supplementary to, and should be read in conjunction with, SASs. This Practice Note sets out the special considerations relating to the audit of insurers in Ireland that arise from individual SASs listed in the contents. It is not the intention of the Practice Note to provide step-by-step guidance to the audit of insurers, so where no special considerations arise from a particular SAS, no material is included. The Practice Note does not provide guidance for the audits of syndicates and other vehicles in the Lloyd s insurance market. Guidance for such audits is provided in the UK Practice Note 20 issued by the APB. Auditing Standards include a requirement for auditors to comply with the ethical guidance issued by their relevant professional bodies in the conduct of any audit of financial statements. A fundamental principle embodied in such guidance is that practitioners do not accept or perform work which they are not competent to undertake. The importance of technical competence is also underlined in the Auditors Code, issued by the APB, which states that the necessary degree of professional skill demands an understanding of financial reporting and business. Practitioners should not undertake the audit of insurers unless they are satisfied that they have, or can obtain, the necessary level of competence. The Practice Note does not extend to audit appointments under legislation outside Ireland, nor does it give guidance to auditors of underwriting agents or brokers. This Practice Note is based on legislation and related regulations and guidelines in effect at 31 May The legislation, regulatory arrangements and documents referred to in the Practice Note may change subsequent to publication. This Practice Note has been prepared in consultation with the Department of Enterprise, Trade and Employment. References to the Department of Enterprise, Trade and Employment elsewhere in this Practice Note will be denoted by DETE. 2

3 The guidance in this Practice Note is applicable to auditors of insurance companies in Ireland. The term insurance companies is used in this document to refer to: Irish insurance companies authorised by the Department of Enterprise, Trade and Employment (insurers with their head offices in Ireland and Irish branches of insurers established outside the European Economic Area ( EEA )). Authorised insurers ( authorised insurers ) are ones that hold an authorisation granted by the Minister under the Regulations of , the Regulations of , the Non-Life Regulations of or the Life Regulations of to carry on a specified class or description of business; pure reinsurance companies accepting reinsurance business in accordance with section 22 of the Insurance Act, 1989, as amended by section 5 of the Insurance Act, 2000; and Voluntary Health Insurance Board ( VHI ). The supervision of the insurance industry in Ireland, other than VHI, is the responsibility of the DETE, acting under the authority of the Minister of State for Science, Technology and Commerce. References in this Practice Note to the regulator include the Minister and the DETE. Pure reinsurers are required to notify the Minister of their intention to carry on the business of reinsurance in Ireland but are not subject to the same regulatory reporting requirements as other insurers. VHI is subject to the provisions of the Health Insurance Acts and reports to the Minister of Health. It is not required to submit regulatory returns to the DETE. Throughout this Practice Note, references to an authorised insurer exclude pure reinsurers and VHI. Recent and proposed legislation will affect the legal and regulatory environment affecting companies and their auditors. A number of these are currently at different stages of completion, namely: the Company Law Enforcement Act, 2001; the Criminal Justice (Theft and Fraud Offences) Act, 2001; a prospective bill to implement the recommendations of the Review Group on Auditing ( RGA ) relating to companies generally and the regulation of the accountancy profession, including the establishment of an Irish Audit and Accountancy Supervisory Authority; and 1 European Communities (Non-life Insurance) Regulations, European Communities (Life Assurance) Regulations, European Communities (Non-life Insurance) Framework Regulations, European Communities (Life Assurance) Framework Regulations,

4 legislation to establish the single regulatory authority. 5 The single regulatory authority may, in due course, introduce further changes in the regulatory environment in the course of carrying out its obligations. The guidance contained in this Practice Note will be reviewed and updated as appropriate in response to new legislation applicable to insurers as its provisions become known. 5 The Irish Financial Services Regulatory Authority, (IFSRA), is scheduled to assume the supervision responsibilities of the DETE. 4

5 INTRODUCTION 1 This introduction summarises the key features of insurance business and of the environment within which auditors of insurers operate. Types of insurance business 2 There is considerable variation in the types of business underwritten by insurers, the degree of risk involved, and in the way that business is conducted: Non-life insurance Non-life insurance may take many different forms, ranging from low risk (e.g. the property element of insurance) to high risk (e.g. the indemnity element of insurance or large commercial risks, such as those relating to oil exploration and extraction). Contracts for larger risks may involve participation by a number of insurers who each subscribe to a proportion of the risk; Life assurance Life assurance, whilst more homogeneous than non-life insurance business, is also underwritten in a number of ways, including pure life protection, savings products with life protection, pensions and annuities. Reinsurance involves an insurer underwriting risks accepted by other insurers or reinsurers. Contracts for reinsurance may relate either to particular individual risks (facultative reinsurance) or to specified portfolios of risks (treaty reinsurance). 3 The nature of records and control systems maintained by an insurer vary considerably in accordance with the types of business underwritten, the nature and degree of risk involved and the way in which the insurer conducts business as well as other factors such as the volume of business, the geographic areas in which the risks are situated, and the identity of counterparties concerned. Non-life Business 4 Non-life business insurers provide protection against losses arising from various events (such as fire and theft or liabilities arising from injuries or damage to property). Premiums are, in the aggregate and taking one year with another, generally intended to cover anticipated claims costs (including claims handling expenses) resulting from insured events that occur during a fixed period of comparatively short duration. In some types of non-life business, the extent of claims can be established within a relatively short timescale, for example; most claims in relation to property damage. However, non-life business includes a number of areas in which claims may be slow to emerge and/or settle ( long tail business ), or are affected by legal decisions that have both extended the coverage of policies and lengthened the coverage period beyond those envisaged when the risk was underwritten (recent examples include latent diseases and environmental pollution). 5

6 Life Business 5 Insurers undertaking life business provide, inter alia, financial benefits at the time of death (or survival) or incapacity and savings products intended to provide benefits after a defined term. Premiums received include a combination of single and/or regular payments throughout the policy term, although the benefits and the services provided by the insurer are not expected to occur evenly over the term of the contract, which is generally an extended period. The term of the contract and the incidence of medical and health factors, and other uncertainties which may affect future claims result in the use of actuarial techniques in determining the provisions required in relation to policies in force. 6 Policyholder returns on life and other long term insurance policies may depend on investment returns. For some policies, investment risk is borne by the policyholder alone (e.g. unit linked policies); for others it is borne entirely by the insurer (e.g. fixed annuities); Ireland also has well developed with-profits products where policyholders share in the investment risk but returns may be supported by guarantees. Reinsurance 7 Reinsurance is a contract of insurance by which the original insurer transfers (or cedes) some or all of its risks to one or more other insurers. A reinsurer accepting the risk may in turn transfer some or all of its risks to other insurers. The primary purpose of reinsurance is to limit potential losses (particularly having regard to capital available to support underwriting and to avoid undue concentration of risks for one insurer in a single geographical area or market) so as to reduce exposure to the possibility of accumulation of a large number of claims from a single event, to large claims or to a series of events. Reinsurance may also be used for solvency management. The original insured party is normally unaware of the existence of reinsurance arrangements and the insurer s liability to the original insured is unaffected by reinsurance; consequently, where a reinsurer is unable to meet its obligations, the full cost of discharging the liability to the insured falls on the primary insurer which had taken out the reinsurance. 8 In the case of treaty reinsurance, information provided to the reinsurer relates only to the nature of business being reinsured - details of individual policies are not normally included. A reinsurer s decision as to whether to accept a reinsurance treaty is therefore likely to be based on an assessment of the perceived risks of the particular portfolio of business as a whole, rather than on the individual risks accepted by the insurer seeking reinsurance. Similarly, directors of the reinsurer do not normally have detailed information about specific policies when assessing the adequacy of provisions relating to treaty reinsurance. Implications for the way in which auditors obtain sufficient appropriate evidence in relation to treaty business are considered in the section dealing with SAS 400 Audit evidence. Key Characteristics of Insurance Business 9 Insurance business differs in a number of fundamental ways from other types of business activity. 6

7 10 The prime purpose of insurance is to spread risk. On the issue of a non-life insurance policy, the policyholder pays a premium as consideration for indemnity against the possible occurrence of a particular event during the period covered by the policy. A policy for life assurance provides financial protection against the uncertain timing of death or the occurrence of ill-health; in addition, many life policies also provide an important savings function, with proceeds from the policy being made available to the insured at its maturity. 11 Because it is not practicable for an insurer, when accepting a risk, to obtain a full understanding of its nature other than through information supplied by the policyholder, the doctrine of caveat emptor does not apply to insurance contracts in the same way as to other commercial contracts. 12 At the time at which the risk is underwritten, the insurer may not know whether or when a claim will result or, particularly for non-life insurance, how much will be paid. Consequently, insurers generally accumulate cash initially and settle claims over future periods, rather than incurring costs initially and subsequently receiving cash on sale of goods or delivery of services. This affects the nature of financial reporting by insurers in a number of ways, primarily: (c) in preparing the financial statements of a non-life insurer, applying the accounting principles of matching and prudence necessitates apportionment of premium income and acquisition costs over the period of cover, and estimation of both the final outcome of notified claims and of other claims payable in relation to events which have occurred whether or not notified to the insurer. For the financial statements of a life insurer, matching and prudence results in the deferral and amortisation of acquisition costs and consistency between the technical provisions and premiums and claims; a significant element of insurers accounting processes is driven not by the occurrence of events (such as delivery of goods or services) but by an assessment of the probable outcomes of liabilities, or potential liabilities, under existing contracts of insurance; and the accumulation of premium income results in substantial investment portfolios, returns from which form an integral component of an insurer s financial result. 13 Insurers frequently delegate particular activities relating to their business to agents or other third parties, who may have power to act on their behalf. For example: business may be conducted through intermediaries, rather than directly with policyholders; underwriting or claims settlement may be carried out by third parties under delegated authority; an insurer may outsource management of its investment portfolio, or custody of its investments; and 7

8 an insurer may outsource other functions. 14 Where an insurer conducts business through third parties, its auditors consider whether direct access to records and information maintained by them on the insurer s behalf is necessary in order to obtain sufficient appropriate audit evidence, as discussed in the sections of this Practice Note dealing with SAS 420 Audit of accounting estimates and SAS 480 Service organisations. Inherent Uncertainty 15 Because claims for some types of business and their notification can arise over a long period, the degree of inherent uncertainty 6 and judgment involved in the preparation of an insurer s financial statements exceeds that of most organisations. 16 An insurer s obligations to meet uncertain future claims results in particular emphasis on its solvency. Hence, regulatory requirements provide safeguards not only in relation to minimum solvency margins but also by requiring compliance with statutory provisions concerning the admissibility and valuation of assets, and the valuation of liabilities. 17 Determining claims provisions may be subject to a high degree of inherent uncertainty and frequently involve statistical techniques. When reporting on a non-life business insurer s financial statements, auditors assess whether such uncertainties fall within the category of fundamental 7 and so require to be disclosed in their report. In making this assessment, auditors take into account whether the financial statements provide a user with general information about the types of business written such that the overall level of inherent uncertainty likely to apply to those financial statements can be understood. 18 Further consideration of the impact of uncertainty on the work of the auditor is set out in the sections dealing with SAS 100 Objectives and general principles governing the audit of financial statements and SAS 220 Materiality and the audit. Legislative and Regulatory Framework 19 In addition to the Companies Acts, 1963 to 2001, which apply to all companies, including insurance companies, the European Communities (Insurance Undertakings: Accounts) Regulations, 1996 apply to insurance and reinsurance undertakings and certain holding companies of such undertakings. 20 Insurers operate within a complex framework of law and regulation 8 that differs in a number of significant respects from that applicable to the generality of commercial 6 An uncertainty is inherent when its resolution is dependent upon certain future events outside the control of the reporting entity s directors at the date the financial statements are approved (SAS 600, paragraph 12) 7 An uncertainty is fundamental when it is inherent and the magnitude of its potential impact is so great that, without clear disclosure of the nature and implications of the uncertainty, the view given by the financial statements would be seriously misleading (SAS 600, paragraph 13) 8 The Acts, Regulations and Guidelines which comprise the framework are listed in Appendix 5 8

9 enterprises. This framework involves statutory regulation of insurance activities established by EU Directive, under which insurance regulators have powers to establish specific requirements as well as to institute investigations into insurers and to suspend or remove authorisation to conduct insurance business where appropriate. 21 Other than VHI, insurance business may not be carried on in Ireland without authorisation, or in the case of a pure reinsurer without notifying the regulator of the insurers intention to carry on the business of reinsurance. Insurance may be undertaken by: (c) authorised insurers; companies accepting pure reinsurance business; and insurers authorised by other EEA member states, which may conduct insurance business in Ireland on a freedom of services basis or through the establishment of branches. 22 The principal objective of insurance regulation is to provide appropriate protection to policyholders. The principal responsibilities of the regulator are: (c) to ensure that insurers are directed by persons of good repute with appropriate professional qualifications or experience ; to ensure that the insurers have administrative and accounting procedures and internal control mechanisms which are sound and adequate; and to safeguard insurers solvency. 23 Auditors of insurers need to be familiar with the relevant legal and regulatory requirements as well as guidelines issued by the DETE. The extent to which auditors consider compliance with regulatory requirements in the course of auditing an insurer s financial statements is discussed in the section dealing with SAS 120 Consideration of law and regulations. Guidance on auditors responsibilities in relation to regulatory reporting is contained in the section Reporting on regulatory returns. 24 Auditors have a statutory duty to report certain matters of which they become aware under section 35 of the Insurance Act, 1989 and guidance relating to this duty is included in the section dealing with SAS 620 The Auditors Right and Duty to Report to Regulators. Solvency and adequacy of technical provisions 25 Much of the current regulatory framework consists of provisions intended to maintain the solvency of authorised insurers and so ensure their ability to meet future claims from policyholders. Accordingly, authorised insurers are required to comply with statutory solvency requirements and also to make annual or sometimes more frequent regulatory returns providing information concerning the value and type of assets held, claims arising under policies written and other financial information. 9

10 26 In the case of insurance companies undertaking life assurance business in Ireland, there is a statutory requirement to appoint an actuary (the Appointed Actuary ) with responsibility, in particular, for conducting investigations into the financial condition of the insurance company s life business once in every period of twelve months and at any other time when there is to be a distribution of surplus from the life fund. In carrying out such investigations, the Appointed Actuary is required: to value the liabilities attributable to life assurance business; and to determine any excess over those liabilities of the assets representing the life assurance business fund. The Appointed Actuary is required to provide a certificate to accompany the regulatory return, setting out the results of this investigation In the case of insurers undertaking non-life business there is a requirement contained in a DETE Guideline for an actuary to certify the adequacy of the provisions as stated in the annual returns to the regulator. This certification currently carries no responsibility for other aspects of solvency or technical solvency of the company and only applies to the provisions at that date. Exemption from certification may be sought by companies that have no third party business and who do not undertake motor, liability or financial guarantee business. Financial reporting requirements 28 Directors of insurance companies are required to prepare financial statements complying with relevant legal and accounting requirements and giving a true and fair view of the company s results and its state of affairs. 29 In the case of insurance companies, relevant legal requirements are set out in the Companies Acts, 1963 to 2001 and the European Communities (Insurance Undertakings: Accounts) Regulations, 1996 and accounting requirements are set out in Financial Reporting Standards and Statements of Standard Accounting Practice adopted by the Accounting Standards Board( ASB ) and statements from the Urgent Issues Task Force ( UITF ) 10 The European Communities (Insurance Undertakings: Accounts) Regulations, 1996 require directors of insurance companies to state in their financial statements whether the financial statements have been prepared in accordance with applicable accounting standards. Some 9 The Appointed Actuary follows guidance set out in Guidance Notes GN1 ROI Actuaries and long term insurance business and GN8 ROI Additional guidance for appointed actuaries and appropriate actuaries, issued by the Society of Actuaries in Ireland. 10 The Urgent Issues Task Force Abstracts are applicable to financial statements of a reporting entity that are intended to give a true and fair view of its state of affairs at the balance sheet date and of it profit and loss account for the financial period ending at that date. 10

11 insurance companies choose to comply with the requirements of the Statement of Recommended Practice Accounting for Insurance Business adopted by the Association of British Insurers If an authorised insurer undertakes life assurance business, computation of the technical provision for life assurance business to be included in its financial statements must be made by an actuary on the basis of recognised actuarial methods with due regard to the actuarial principles laid down in Council Directive 92/96/EEC (The Life Framework Directive). This requirement does not apply to any other technical provisions. The actuary carrying out the computation may, but is not required to, make a report in the financial statements relating to the provision. Responsibilities of Directors 31 The primary responsibility for the conduct of the business of an insurer is vested in the board of directors and the management appointed by it. Directors of insurance companies are required to comply with provisions of company law in the same way as directors of companies generally. Consequently, they are responsible for the preparation of financial statements that give a true and fair view of the results and state of affairs of the insurance company and meet other requirements of the Companies Acts, 1963 to 2001 and the European Communities (Insurance Undertakings: Accounts) Regulations, In addition, they have significant responsibilities under the legislative and regulatory framework contained in the Insurance Acts and Regulations and EU Directives, and as determined by the DETE. These include a requirement to: have administrative and accounting procedures and internal control mechanisms which are sound and adequate; and maintain specified margins of solvency. In compliance with section 11 of the Insurance Act, 1989, an authorised life assurance company is required to prepare regulatory returns in accordance with the requirements of the European Communities (Life Assurance) Framework Regulations, An authorised non-life insurance company is required to prepare regulatory returns in accordance with the requirements of the European Communities (Non-life Insurance) Framework Regulations, The form and content of the returns are determined in the case of life assurance, by the Life Framework Regulations, and in the case of non-life insurance by the European Communities (Non-life Insurance Accounts) Regulations, Responsibilities of auditors 32 The primary objective of an audit of the financial statements of an insurance company by an external auditor is to enable an independent auditor to express an opinion in accordance 11 The Statement of Recommended Practice on Accounting for Insurance Business is issued by the Association of British Insurers in accordance with the ASB s Code of Practice for the development and issue of SORPs. This SORP does not apply in Ireland. 11

12 with the requirements of the Companies Acts. The auditors opinion helps to establish the credibility of the financial statements. However it should not be interpreted as an assurance as to the future viability of the insurer or as an opinion as to the efficiency or effectiveness with which the management has conducted the affairs of the insurer, since these are not the objectives of the audit. 33 Auditors of insurers are required to possess the qualifications required of auditors under the Companies Act, Auditors normally qualify by virtue of membership of a recognised body of accountants and hence are required to comply with SASs issued by the APB and guidance relating to ethics issued by the relevant supervisory professional body. In general terms, responsibilities of insurers auditors are: to report on insurers financial statements, as required by section 193 of the Companies Act, 1990 and the European Communities (Insurance Undertakings: Accounts) Regulations, 1996; for authorised insurers, to report on matters in relation to the insurer s regulatory returns, as required by the European Communities (Life Assurance) Framework Regulations, 1994 and the European Communities (Non-life Insurance Accounts) Regulations, Guidance on the auditors work in relation to such returns is set out in the section of this Practice Note dealing with reporting on regulatory returns; (c) for authorised insurers, to report direct to the regulator matters of material significance that come to their attention as required by section 35 of the Insurance Act, This requirement to report has been extended by the European Communities (Non-life Insurance) Framework (Amendment), Regulations, 1997 to matters likely to materially affect the insurers ability to fulfil its obligations to policyholders or meet any of its material financial requirements under the Insurance Acts and Regulations while auditing an undertaking in a control relationship with the insurer. 12 The 1997 Regulations implement the EC Directive 95/26/EC The Post BCCI Regulations. This duty does not require auditors of insurers to undertake additional work directed at identifying matters to report over and above the work necessary to fulfil their obligations to report on financial statements and regulatory returns. Guidance on the identification of matters to be reported to the regulators is set out in the section dealing with SAS 620 The auditors right and duty to report to regulators ; and 12 An insurance company is in a control relationship with: any person who is, or if he were an undertaking would be, its parent undertaking; any undertaking which is its subsidiary undertaking; any undertaking which is, or if any person falling within were an undertaking would be, a fellow subsidiary undertaking; and any person in accordance with whose directions or instructions its directors are accustomed to act. 12

13 (d) to report to the Minister when, in accordance with section 35(3) of the Insurance Act, 1989, the Minister requires the auditor of authorised insurers to supply him with such information as he may specify in relation to the audit of the business of an insurer. Guidance as to steps to be taken by the auditor following such a request from the Minister is set out in the section dealing with SAS 620 The auditors right and duty to report to regulators. 34 Additionally auditors of insurance companies are required to comply with the provisions of legislation applicable to auditors generally including the Companies Acts, the Company Law Enforcement Act, 2001 and the Criminal Justice (Theft and Fraud) Act,

14 THE AUDIT OF FINANCIAL STATEMENTS Auditing Standards, as set out in the SASs, apply to the conduct of the audit of the financial statements of any entity, irrespective of its size, legal form, or the nature of its activities. The commentary in this section identifies the special considerations arising from the application of individual SASs to the audit of insurers financial statements, and indicates ways in which these can be addressed. The guidance it provides is relevant in the context of all insurers except when the text specifically limits a section or comment to a particular form or forms of insurers. Where no special considerations arise from a particular SAS, no material is included. For the specific requirements of Auditing Standards, auditors of insurers should refer to the SAS concerned. This Practice Note is based on APB Statements of Auditing Standards in issue as at 31 July,

15 SAS 100: OBJECTIVE AND GENERAL PRINCIPLES GOVERNING THE AUDIT OF FINANCIAL STATEMENTS Background note In undertaking an audit of financial statements, SAS 100 requires that auditors carry out procedures designed to obtain sufficient appropriate evidence, in accordance with Auditing Standards, to determine with reasonable confidence that the financial statements are free of material misstatement. The SAS also requires that auditors should evaluate the overall presentation of the financial statements to ascertain whether they have been prepared in accordance with relevant legislation and accounting standards. The SAS requires that auditors should issue a report containing a clear expression of their opinion on the financial statements. SAS 100 requires that auditors should comply with the ethical guidance issued by their relevant professional bodies in the conduct of any audit of financial statements. 1 Auditors are required to exercise their professional judgment within the framework provided by Auditing Standards in order to determine the extent of work necessary, in a particular instance, to provide reasonable assurance that the financial statements taken as a whole are free from material misstatement. 2 Financial statements of insurers are prepared following specific requirements set out in the European Communities (Insurance Undertakings: Accounts) Regulations, An insurer s financial statements are required by statute to give a true and fair view of its profit or loss and of its state of affairs. Compliance with applicable financial reporting and accounting standards and UITF abstracts issued by the ASB is normally necessary to meet this requirement. Inherent uncertainty 4 The preparation of insurers financial statements involves a considerable degree of judgement as to the outcome of business written at the reporting date. In relation to any individual insurance transaction, there is typically uncertainty as to one or more of the following: whether a claim will occur; when it will occur; 13 This is in addition to the requirement for financial statements to be prepared in accordance with the relevant legislation (Companies Acts 1963 to 2001), Financial Reporting Standards, Statements of Standard Accounting Practice and UITF abstracts. 15

16 (c) (d) what the cost will be; and when it will be paid. 5 Inherent uncertainty as to the final outcome of contracts of insurance is therefore a feature of the business. The degree of uncertainty varies according to a variety of factors including the type of business written and the insurer s arrangements for reinsurance. 6 Insurers writing non-life business, in particular those classes of business referred to as long tail, are generally subject to a far greater range of accounting estimates and potential outcomes than other insurers. Long tail business includes certain reinsurance business, employer s and general liability business, and may be affected by factors such as latent disease or pollution. 7 Auditors take account of uncertainties associated with a particular insurer when planning and conducting audit procedures and when considering the appropriateness of disclosure in the financial statements. 8 Auditors opinions on the financial statements of an insurer are intended to provide reasonable assurance that those statements are free of material misstatement in the context of the inherent uncertainties relating to the business underwritten. Key elements in forming an opinion are: the auditors assessment of whether appropriate provisions for liabilities arising from business underwritten at the balance sheet date are included in the financial statements; and the auditors consideration of the adequacy of disclosures relating to risks and uncertainties. SAS 110: FRAUD AND ERROR Background note The SAS requires that auditors should plan and perform their audit procedures, and evaluate the results thereof, recognising that fraud or error may materially affect the financial statements. The SAS requires that, when planning the audit, auditors should assess the risk that fraud or error may cause the financial statements to contain material misstatements. Based on their risk assessment, auditors should design audit procedures so as to have a reasonable expectation of detecting misstatements arising from fraud or error which are material to the financial statements. 16

17 Responsibilities 1 Responsibility for the prevention and detection of fraud and error lies with the directors of an insurance company even if they have delegated functions to third parties. In carrying out their responsibilities, the directors of authorised insurers have regard to statutory requirements for sound and prudent management (Regulation 9(2) of the Framework Regulations 1994) 14. The European Communities (Life Assurance) Framework Regulations 1994 and The European Communities (Non-life Insurance) Framework Regulations 1994 introduced into Irish insurance legislation the concept of persons of good repute with appropriate professional qualifications or experience as a ground for refusing or withdrawing authorisation or for supervisory intervention. 2 The Criminal Justice (Theft and Fraud Offences) Act, 2001 requires that auditors of all companies report to the Garda Siochana in certain specified circumstances; where during the course of an audit the auditor comes across an offence by the firm, partner, director, manager, secretary or other employee The audit planning process includes an assessment of the risk of material misstatements, whether arising from fraud or error. Insurers may be subject to: (c) policyholder fraud; fraud by directors and employees; and fraud by agents, brokers or other related parties 4 Under Regulation 10(3) (life) and 10(3) (non-life) of the Framework Regulations, 1994, authorised insurers should have administrative and accounting procedures and internal control mechanisms which in the opinion of the regulator are sound and adequate. The responsibility for the establishment and proper operation of administrative accounting controls and procedures and internal control mechanisms rests with the directors. Whilst the inherent risk of fraud may continue to exist, the establishment of accounting and internal controls systems sufficient to meet these requirements (particularly in the case of insurance companies that accept business involving a high volume of policies and claims of comparatively low individual financial value) frequently reduces the likelihood of such fraud giving rise to material misstatements in the financial statements. Guidance on the auditors consideration of accounting systems and internal control is provided in SAS 300 Accounting and internal control systems and audit risk assessments. 5 In the case of authorised insurers if auditors discover potential or actual fraud, they consider the regulatory implications, in particular their duty to report matters of material 14 The Framework Regulations 1994 encompass the European Communities (Life Assurance) Framework Regulations 1994 SI No.360 of 1994 and the European Communities (Non-life Insurance) Framework Regulations 1994 SI No. 359 of Section 59 of the Criminal Justice (Theft and Fraud Offences) Act,

18 significance to the regulator. Any suspected or actual fraud involving directors or managers is likely to give rise to a statutory duty to report. A duty to report may also arise when: directors fail to take appropriate steps to minimise risks of external fraud; or employee fraud is discovered. Whilst employee fraud may not have the same significance as that relating to directors or senior management, it may be indicative of an unsatisfactory culture or weaknesses in the internal control environment. Guidance on the circumstances giving rise to a duty to report to the regulator is an area contained in the section of this Practice Note dealing with SAS 620 The auditors right and duty to report to regulators. 6 If auditors discover potential or actual fraud in the course of their work in respect of pure reinsurers or VHI, they consider whether the matter may be one that ought to be reported to a proper authority in the public interest. This consideration also applies to auditors of authorised insurers. Guidance on the circumstances in which matters are reported to a proper authority is contained within SAS Assessing the risk of fraud or error 7 Factors which may indicate that there is an increased risk of the existence of fraud or error include: significant levels of high value surrenders of life policies; unusual features in new business trends; (c) poor support for the calculation of provisions and a large number of adjustments; (d) (e) (f) an abnormally high use of suspense accounts, old reconciling items, and poor support for items included in suspense accounts; unusual trends in commissions, including a long delay between the payment of commission and the initial premium payments and return premiums; and directors or management displaying a lack of candour in dealing with policyholders, actuaries, regulators and auditors. 8 Guidance on the internal control procedures which can be put in place by insurance companies to minimise the risk of fraud or error occurring, is included in the section on SAS 300, Accounting and internal control systems and audit risk assessments. 16 SAS

19 SAS 120 CONSIDERATION OF LAW AND REGULATIONS Background note The SAS requires that auditors plan and perform their audit procedures and evaluate and report on the results thereof, recognising that non-compliance by an entity with law or regulations may materially affect the financial statements. The SAS requires that auditors should obtain sufficient appropriate audit evidence about compliance with those laws and regulations which relate directly to the preparation of, or the inclusion or disclosure of specific items in, the financial statements. The SAS requires that the auditors should perform specified procedures to help identify possible or actual instances of non-compliance with those laws and regulations, which provide a legal framework within which the entity conducts its business and which are central to the entity s ability to conduct its business and hence to its financial statements. The SAS requires that, when carrying out their procedures for the purpose of forming an opinion on the financial statements, the auditors should in addition be alert for any instances of possible or actual non-compliance with law and regulations which may affect the financial statements. The legal and regulatory framework 1 The legal and regulatory framework within which insurance companies conduct their business is summarised in the Introduction to the Practice Note. The present regulatory framework applicable to insurers is complex and involves a number of aspects of insurers operations. 2 The principal purpose of prudential supervision is to ensure the protection of policyholders because of the promissory nature of transactions between insurers and the public. Much of the legislation for prudential supervision is based on EU Directives. 3 Prudential supervision of authorised insurers is carried out by the regulator under powers conferred by Insurance Acts and Regulations, and EU Directives. Ongoing prudential supervision of authorised insurers is conducted in part by means of the annual regulatory returns submitted by all authorised insurers, within six months of their balance sheet date. 4 Part 111 of the Insurance Act, 1989 as amended by section 7 of the Insurance Act, 2000 provides for the making of detailed rules in relation to commission payments and disclosures to be made to life and non-life policyholders. Section 7 also makes provision for the furnishing of information to trustees of occupational pension schemes. The Life Assurance (Provision of 19

20 Information) Regulations, prescribe the information to be provided to individual life policyholders resident in the state. Within one month of the end of each financial year, the insurer must submit to the regulator an actuary s certificate to the effect that certain of this information has been drawn up in accordance with the actuary s advice and relevant actuarial guidelines, and a declaration by the insurer that information required by the actuary for this purpose has been provided. 5 An Insurance Compensation Fund was established by statute in Section 31 of the Insurance Act, 1989 provides a mechanism whereby the liquidator of an insolvent non-life insurer may obtain funds to make payments to certain individuals who have claims against an insolvent insurer. Insurers may be required to contribute levies raised by these guarantee funds depending on the type of insurance business they undertake. There is also a compensation scheme set up under the Investor Compensation Act, which provides cover to customers of a wide variety of financial firms including insurance brokers, agents and field agents of insurers but excludes insurers. 6 Life and non-life members of the Irish Insurance Federation abide by a series of Self Regulatory Codes of Practice. These codes together with the disclosure regulations provide a framework of guidelines and recommendations for policyholders protection. 7 There are also consumer affairs bodies, such as the various Ombudsmen (who handle consumer complaints) and the Insurance Ombudsman which provide a direct means of redress for individual policyholders who have complaints against, or disputes with, insurers. Classification of laws and regulations 8 SAS 120 states that laws and regulations relevant to the audit can be regarded as falling into two main categories: those relating directly to the preparation of the entity s financial statements, or the inclusion or disclosure of specific items in the financial statements; and those which provide a legal framework within which the entity conducts its business and which are central to the entity s ability to conduct its business and hence to the preparation of its financial statements. Laws and regulations which do not fall into either category need not be taken into account in planning the audit work to be undertaken: however, auditors are required to remain alert to the possibility of breaches of other requirements and to consider the implications of any which come to their attention (SAS and 120.5). 17 SI no 15 of A Scheme is run by the Investor Compensation Company Limited (c/o Central Bank of Ireland) and (in general) covers transactions carried out after 1 August

21 Laws relating directly to the preparation of the financial statements 9 SAS requires auditors to obtain sufficient appropriate audit evidence about compliance with those laws and regulations which relate directly to the preparation of, or the inclusion or disclosure of specific items in, the financial statements. 10 The principal laws and regulations which relate directly to the preparation of financial statements of all insurance companies and insurance holding companies, and of which their auditors need to have an understanding, are, the Companies Acts 1963 to 2001, and the European Communities (Insurance Undertakings: Accounts) Regulations, Laws and guidelines which are central to the insurer s conduct of its business 11 SAS requires auditors to carry out specified steps to help identify possible or actual instances of non-compliance with those laws and regulations which fall into the category of those that are central to the entity s ability to conduct its business. 12 Non-compliance with laws and regulations that are central to an authorised insurer s activities is likely to give rise to a statutory duty, under section 35 of the Insurance Act, 1989, to report to the regulator. Such reports are made in accordance with the requirements of SAS 620 The auditors right and duty to report to regulators, following the guidance set out in the relevant section of this Practice Note. 13 Auditors need to consider whether to report non-compliance with laws and regulations that are central to a pure reinsurer s or VHI s activities to a proper authority in the public interest. This consideration also applies to auditors of authorised insurers Central is described in the SAS as relating to those laws and regulations where: compliance is a pre-requisite of obtaining a licence or permission to operate; or non-compliance may reasonably be expected to result in the insurer ceasing operations or call into question an insurance company s status as a going concern. 15 In the context of insurers, these two criteria indicate that laws and regulations are central to the conduct of business if breaches would have any of the following consequences: (c) removal of authorisation to carry out insurance business; the imposition of fines or restrictions on business activities the significance of which is such that the ability of the insurer to continue as a going concern is threatened; or intervention by the regulator. 16 The principal laws and regulations applicable to prudential supervision that are likely to 19 SAS

22 give rise to such action by the regulator in relation to authorised insurance companies are the Insurance Act, 1989 as amended by the Insurance Act, 2000, the European Communities (Life Assurance) Framework Regulations 1994 and the European Communities (Non-life Insurance) Framework Regulations These acts and regulations make provision for authorisation including a minimum capital requirement, margins of solvency and a matching requirement in relation to insurance assets and liabilities In particular, this legislation contains: the requirement for the insurer to be effectively run by persons of good repute with appropriate qualification or experience (Framework Regulations); and provisions concerning prudential supervision. For life assurance business, the provisions regarding prudential supervision consist of: separation of life assurance assets and liabilities (section 14 - Insurance Act, 1989); arrangements to avoid unfairness between separate insurance funds, etc. (section 14 Insurance Act, 1989); application of assets (section 15 Insurance Act, 1989); restrictions on dividends (section 15 Insurance Act, 1989); allocations to policyholders (section 15 Insurance Act, 1989); adequacy of premiums (Regulation Regulations); restriction on transactions with a related company (Part 2 Regulation 10(4) Regulations); margins of solvency (Regulation 12 (1) Regulations); adequacy of assets (Regulation12 (4) Regulations); and a register of assets (Regulation12 (6) Regulations); In relation to non-life business, relevant provisions are: adequacy of premiums (Regulation 8 (2) Regulations); margins of solvency (Regulation 13 (1) Regulations); adequacy of assets (Regulation13 (5) Regulations); a register of assets (Regulation13 (13) Regulations); and restriction on transactions with a related company (Regulation Regulations); 18 The regulator, in July 2001, issued a series of guidelines to assist it supervise insurers. 22