Spreadsheet Controls and the NAIC Model Audit Rule

Spreadsheet Controls and the NAIC Model Audit Rule White Paper

November 2008 P-01514, Revision A












Prodiance White Paper
Table of Contents
Table�of�Contents�........................................................................................................................................�1�
Spreadsheets�and�the�Model�Audit�Rule�....................................................................................................�2�
Auditor�Guidance�........................................................................................................................................�2�
Leveraging�Technology�...............................................................................................................................�5�
Prodiance�Enterprise�Spreadsheet�Manager�..............................................................................................�6�
Prodiance�eDiscovery�..................................................................................................................................�7�
Prodiance�Spreadsheet�IQ�..........................................................................................................................�8�
Prodiance�Link�Migration�Manager�............................................................................................................�9�
Prodiance�ESM�..........................................................................................................................................�10�
3�Levels�of�Control�....................................................................................................................................�11�
Proven�ROI�................................................................................................................................................�12�
About�Prodiance�.......................................................................................................................................�12�
Spreadsheet Controls & The Model Audit Rule 1 Prodiance White Paper
Spreadsheets and the Model Audit Rule
Since�the�National�Association�of�Insurance�Commissioners�(NAIC)�made�revisions�to�the�Financial�Reporting�Model�Regulation�(Model�Audit�Rule)�in�June�2006,�the�insurance�industry's�attention�to�the�risks�associated�with�financial�reporting�has�been�on�the�rise.�Structured�similarly�to�Section�404�of�the�Sarbanes-Oxley�Act,�the�Model�Audit�rule�places�a�significant�burden�on�C-level�executives�to�ensure�their�oversight�in�the�internal�controls�for�financial�reporting�(ICFR)�process.�Executives�within�these�insurance�organizations,�both�public�and�private,�will�be�required�to�evaluate�their�internal�controls�in�preparation�for�the�first�reports�due�in�2010�for�the�2009�reporting�period.�
One�major�hurdle�in�preparing�for�the�Model�Audit�Rule�is�in�understanding�how�to�manage�end�user�computing�(EUC)�applications�(including�critical�spreadsheets,�Access�databases,�and�BI�reports)�to�successfully�meet�the�outlined�compliance�requirements.�Insurance�organizations�rely�on�complex�and�mission�critical�spreadsheet�applications�as�forecasting�tools�to�determine�risk�and�uncertainty�for�property,�casualty,�pension,�health,�life,�annuities,�and�welfare�plans.�To�keep�up�with�ever-changing�compliance�mandates�such�as�ERISA,�PBGC,�FAS�87,�FAS�106/158,�and�IAS�19,�proprietary�algorithms�and�extensive�IP�is�often�created�within�these�spreadsheet�applications,�making�their�safe�keeping�and�integrity�paramount�to�business�operations.��
In�addition,�hundreds�and�even�thousands�of�critical�and�complex�spreadsheets�are�used�in�accounting�and�finance�operations�for�revenue�recognition,�account�reconciliation,�journal�entries,�and�closing�the�books.��These�spreadsheets�often�contain�many�external�links�and�data�feeds,�complex�formulas,�macros/VB�code,�hidden�data,�and�advanced�mathematical�functions.�This�complexity�easily�lends�itself�to�human�error,�and�when�these�critical�spreadsheets�are�left�unmanaged,�it�creates�an�open�door�for�non-compliance,�financial�loss�and�even�fraud.�As�such,�critical�spreadsheets�used�in�insurance�operations�need�to�be�manage... [download for more]