Each insurance company is chartered under the laws of a single state, known as its state of domicile. Although an insurance company can conduct business in multiple states, the regulator in the insurer’s state of domicile is its primary regulator. States in which an insurer is licensed to operate, but in which it is not chartered, typically rely on the company’s primary regulator in its state of domicile to oversee the insurer. Regarding Year 2000 issues, NAIC has emphasized this approach by encouraging each state to focus its Year 2000 oversight efforts on its domiciliary companies. In total, state-regulated insurance entities wrote an estimated $895.2 billion in direct premiums sold nationally during 1998. Life/health and property/casualty insurance companies represent the key industry segments, accounting for 85 percent of the total direct premiums written in that year. HMOs; HMDIs; and other entities, such as fraternal organizations and title companies, accounted for the remaining 15 percent. To update our previous assessment of the regulatory oversight of the insurance industry’s Year 2000 readiness, we interviewed NAIC officials and reviewed documentation related to NAIC’s efforts to facilitate state oversight of the industry’s Year 2000 readiness. We also reviewed available state examination reports and executive summaries covering companies’ Year 2000 preparations, which were available at NAIC. While we did not verify the accuracy of the reports, this review included well over 200 reports and summaries prepared by or on behalf of 22 states. To the extent available through NAIC, we present updates pertaining to regulatory oversight through November 1999. In addition, we conducted follow-up work of Year 2000 validation efforts at the same 17 state insurance departments on which we reported in April. Our follow-up work for the 17 states included (1) a second survey administered in July 1999 that covered their Year 2000 oversight activities, including examination efforts in the area; (2) site visits to 6 of the 17 states to interview regulatory officials and review guidelines for conducting Year 2000-related examinations as well as available reports, summaries, and workpapers covering companies’ Year 2000 preparations; and (3) additional contacts in October 1999 with regulatory officials from each of the 17 states for a final update of their Year 2000-related examination efforts. The domiciliary companies of these 17 state insurance departments collectively accounted for 76 percent of the insurance sold nationally during 1998. See appendix I for a list of the 17 states and their respective domiciled insurers’ market shares. Our review of examination-related documents was limited by restrictions at two of the states we visited and at NAIC, which had examination report summaries for the same two states. For one state, regulatory officials cited an existing law that restricted access to its examination reports and related workpapers by external parties. Regulatory officials for another state explained that, under special agreements reached with insurers prior to conducting Year 2000 examinations, their department was precluded from sharing examination-related documents with other states or external entities without the consent of the companies involved. Although one of the two states provided some limited access to their examination documents, we were unable to independently verify the adequacy of Year 2000 examination efforts for either state. To determine the status of the insurance industry’s Year 2000 readiness, we surveyed all 50 state insurance departments on the state of readiness of their domiciled companies as of September 30 and the extent of the departments’ on-site verification efforts. For each state, NAIC provided a Year 2000 contact to assist us in this survey effort. Appendix II contains a copy of the Year 2000 survey we administered to the states. With NAIC’s assistance, we obtained a 100-percent response rate from the 50 states. To obtain updated insights regarding the industry’s Year 2000 outlook pertaining to readiness and liability exposure issues, we contacted representatives of key rating companies, including A.M. Best Company, Standard and Poor’s, Moody’s Investors Service, and Weiss Ratings, Inc. We also obtained and reviewed information from (1) the Gartner Group, which is a business and technology advisory company that conducts research on the global state of Year 2000 readiness; (2) the American Academy of Actuaries, which is a public policy organization that presents actuarial analyses, comments on proposed federal regulation, and works with state officials on insurance-related issues; and (3) the Casualty Actuarial Society, which is a professional organization to advance knowledge of actuarial science applied to property, casualty, and similar risk exposures. In addition, we spoke to representatives of Milliman and Robertson, Inc., an actuarial and consulting firm, and the American Bar Association. We performed our work between June 1999 and December 1999 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from NAIC. Its written comments, which are included in appendix III, are discussed near the end of this letter. Since March 1999, NAIC has stepped up its Year 2000 efforts by (1) issuing expanded guidance to state regulators on how to examine companies’ preparedness and (2) encouraging state regulators to do on-site validation reviews of companies with the greatest potential public impact. NAIC reports that many of the nation’s state regulators have also made substantial progress in conducting Year 2000 validation reviews. They were projected to complete, by the end of November, on-site Year 2000 reviews for 91 percent of the nationally significant companies that accounted for about 84 percent of the direct premiums written by life/health and property/casualty insurers in 1998, according to NAIC. Despite this progress, uncertainties remain regarding the extent that on- site validation reviews have been conducted for some states’ companies, including some major health insurers and other segments of the insurance industry, such as HMOs and managed care organizations. In November 1999, NAIC was still in the process of quantifying the extent to which on- site verification was conducted at some of the major health insurers that did not fall into the category that NAIC had designated as nationally significant and at the larger managed care organizations, which had not been specifically covered by NAIC’s earlier efforts. After we reported on the insurance industry’s Year 2000 readiness in March and April, 1999, NAIC stepped up its efforts to facilitate state actions to verify insurers’ reported information on their Year 2000 preparations. For example, one undertaking involved NAIC’s provision of expanded examination guidance for assessing companies’ Year 2000 preparations and related training. Another important part of NAIC’s stepped up efforts has been its initiative that was aimed at prioritizing companies for review and encouraging states to perform on-site validation reviews. With only 9 months remaining before 2000 and 5,247 state- regulated insurance companies to account for, NAIC developed a pragmatic approach of focusing on the companies with the greatest potential impact on the public if they were to experience major computer problems. NAIC also worked with the states and encouraged them to implement this focused approach. In April 1999, NAIC provided the states with an enhanced version of the Financial Examiners Handbook, which provided additional guidance for performing Year 2000 readiness reviews. According to NAIC, the guidance was borrowed from audit programs developed by the Federal Financial Institutions Examination Council for federal examiners’ reviews of the Year 2000 readiness of U.S. financial institutions and a few of the state insurance departments that had been especially active in their Year 2000 oversight. NAIC also contracted for the services of a national consulting firm to develop and provide training to help state examiners better understand the review procedures and assist them in incorporating the procedures into their examinations. According to an NAIC official, this 2-day training, which was provided during the latter part of April in Atlanta, Chicago, and Denver, was attended by examiners representing almost 20 states. Compared to the timing of guidance provided by the banking and securities regulators, such Year 2000-related guidance and training would be considered late. However, we were told that this training and guidance were timely enough to be useful for some state insurance departments because they did not start their targeted Year 2000 examination process until mid-1999. In March, NAIC’s Year 2000 Industry Preparedness Task Force launched an initiative that was intended to (1) encourage states to perform on-site validation reviews and (2) determine the extent to which the states had verified the insurance industry’s Year 2000 readiness. The initiative focused on life/health and property/casualty insurance companies that NAIC had designated as nationally significant. This designation included 1,161 companies, located in 44 states and the District of Columbia, that were responsible for almost $650 billion in total premiums written during 1998. According to NAIC information, the insurance industry is relatively concentrated, with nationally significant companies representing approximately 86 percent of the premiums written for the life/health and property/casualty segments in 1998 and 27 percent of the 4,325 companies in the two insurer segments. It is also noteworthy, however, that many insurers that far exceeded NAIC’s criteria for the level of direct premiums written were not considered nationally significant because they did not meet the second criteria of being licensed in 17 states or more. These companies tended to conduct a significant amount of business on a more localized rather than national basis. We noted, for example, that 36 life/health insurers and 195 property/casualty insurers that each wrote more than $100 million in direct premiums during 1998 were not covered by NAIC’s nationally significant designation. Over the past several months, NAIC’s Year 2000 initiative focusing on nationally significant companies has involved an ongoing, interactive process with the individual state insurance departments. In April, NAIC administered a survey to all 50 states and the District of Columbia to develop preliminary baseline information on state efforts to conduct on- site examinations of companies’ Year 2000 compliance status, particularly, the compliance of nationally significant companies. From June through August, 1999, NAIC also facilitated a series of conference calls that included members of the Year 2000 Industry Preparedness Task Force and, successively, representatives from each of the 50 states. According to NAIC officials, these conference call discussions focused on each state’s general approach to overseeing the industry’s Year 2000 preparations as well as its efforts to conduct on-site examinations to verify the Year 2000 compliance status of its domiciled insurance companies, particularly its nationally significant companies. These conference calls were a key mechanism that NAIC used to encourage states to conduct more on-site verification reviews and facilitate critical Year 2000 information-sharing among the participating states regarding, for example, licensed companies that wrote a large amount of insurance in a state but were domiciled elsewhere. Finally, these conference calls with each of the states enabled NAIC to quantify on a national basis the extent of the states’ on-site verification reviews of their nationally significant companies. To document its Year 2000 initiative, NAIC has maintained a summary schedule of all nationally significant companies with information on, among other things, whether each company had been subject to an on-site Year 2000 verification review. A company was considered to have been subject to an on-site verification review if the state of domicile, or another state where the company was licensed and doing business, indicated to the task force that a review had been completed or was scheduled to be completed by the end of September. A company was also considered to have been subject to an on-site verification review if it had been indirectly covered or would have been covered by the end of September through an on-site review of an affiliated company with which its computer system was fully integrated. On the basis of information obtained from the conference calls that were completed in August 1999, NAIC reported that 1,037 nationally significant companies were to have been subject to an on-site Year 2000 review, 106 were not to have been subject to an on-site review, and the remaining 18 discontinued operations during 1999. The task force directed additional attention to certain companies that were viewed to be of particular concern. In a few cases, for example, NAIC officials noted that a state reconsidered its original position that an on-site verification was not needed. In one situation, NAIC provided financial assistance to facilitate the Year 2000 examination of a few key nationally significant companies in a particular state. In another case, a state agreed to conduct a targeted Year 2000 examination for a company domiciled in another state that had no plans to conduct on-site verification of the company. By November 1999, NAIC reported that the number of companies that would be subject to an on-site Year 2000 review by the end of November had increased to 1,059 companies, and it reported that the remaining 84 companies would not be subject to an on-site review. NAIC officials explained that, for the most part, the task force was satisfied with the level of information available on the remaining nationally significant companies that were not to be subject to on-site verification. NAIC has also taken the position that some comprehensive surveys were thorough enough to be equivalent to an examination. As we stated in our April 1999 report and continue to believe, the use of Year 2000 examinations is a principal mechanism for verifying self-reported information and providing assurances pertaining to the Year 2000 progress and readiness of regulated institutions. The ability to provide such assurances is particularly important for the industry’s nationally significant companies and others that do a substantial amount of business. In total, the number of companies that were to be subject to an on-site Year 2000 review by the end of November represented 98 percent of the direct premiums written by nationally significant companies. Regarding the total life/health and property/casualty insurer segments, the identified coverage through NAIC’s initiative suggests that companies that accounted for at least 84 percent of the direct premiums written during 1998 had been or were to have been subject to an on-site Year 2000 review by the end of November. The extent of on-site validation for the rest of the industry (including large HMO and HMDI companies), which accounted for an additional $137 billion in direct premiums written during 1998, was still unknown as of November 1999. In October 1999, NAIC reported that the Year 2000 Industry Preparedness Task Force had recently expanded the scope of its review process to include the nation’s largest managed care organizations together with all of the Blue Cross and Blue Shield Plans, which represented some of the major health care insurers not designated as nationally significant. NAIC estimated that the companies that fall into this category represent about 80 percent of the direct premiums written for all HMOs and HMDIs in 1998. The first task force conference to collect and summarize information on the status of on-site Year 2000 reviews for these managed care organizations was held in November 1999. NAIC officials acknowledged that with the Year 2000 deadline close at hand, the task force’s main objective was to quantify the extent of on-site verification that had been completed and identify any companies that may be of regulatory concern. During 1999, most of the 17 state insurance regulators we reviewed increased their efforts to conduct targeted examinations that were aimed at verifying companies’ Year 2000 readiness. In the beginning of the year, 10 of the 17 states were in the process of conducting targeted examinations or were planning to conduct such examinations, and the remaining 7 states were either not planning to conduct such examinations or were uncertain whether they were going to conduct them, as shown in table 1. By June 1999, the 17 states were either in the process of conducting targeted examinations or indicated that they planned to conduct them. Some states that started targeted Year 2000 examinations in the middle of 1999 used expedited approaches, such as suspending their regular financial examination process to devote their examiners solely to targeted Year 2000 examinations or hiring one or more private consultants to conduct such examinations in a short period of time. By the end of September, all of the 17 states we reviewed had either completed or were in the process of completing their targeted Year 2000 examinations. Specifically, eight states had finished the fieldwork for over one-half of the companies that were targeted to be examined, but corresponding reports for many of these examinations were still pending. We were told that one state was waiting for the completion of all its examination fieldwork before issuing a single summary report for all of its domiciled companies, rather than issuing separate reports for each company. A few states projected that they would not complete their Year 2000 examination process until the end of November, leaving little time for correcting identified deficiencies before the date change. In conducting targeted Year 2000 examinations, the states generally said they used the enhanced guidance that NAIC provided in April or guidelines developed by contractors, or in some cases both guidance, to improve the quality and consistency of their validation efforts. Our review of guidelines provided by the six states we visited indicated that they covered all key areas of Year 2000 conversion cited in our Assessment Guide as well as those areas cited in the federal banking regulator examination guidelines. In turn, our review of reports available for 22 states’ targeted Year 2000 examinations indicated that the reports systematically addressed all major guideline components, and that they gave a particular emphasis to companies’ contingency planning efforts. Like the banking industry, insurers depend on date-sensitive calculations involving, for example, annuities, policy renewals, and claims processing. Recognizing their industry’s high level of date sensitivity, the nation’s banking regulators have completed multiple rounds of on-site examinations for all financial institutions under their jurisdiction.Although 6 of the 17 states we reviewed indicated that their overall goal was to conduct 1 round of targeted examinations for all of their domiciled insurance companies, the remaining 11 states had established varying goals regarding which and how many companies would be subject to targeted Year 2000 examinations. These states’ goals were to cover from 6 to 76 percent of the domiciled companies within their jurisdictions. For the most part, these goals attempted to cover the states’ nationally significant companies. Two exceptions were states that had not planned to conduct on-site examinations for more than one-half of their nationally significant companies. One state official explained that a decision was made at the commissioner’s level that the limited time and staff resources available dictated that the state focus its on-site verification efforts on a select number of key companies. Some state officials believed that insurance companies had a clear incentive to become Year 2000 ready to maintain their business in a highly competitive industry and, therefore, did not require a great deal of regulatory prodding in the area. Several state regulatory officials also explained that they believed that available self-reported information from companies was sometimes sufficient to satisfy regulatory needs, and that this information obviated the need for an on-site verification review. We found that the extent of such information available to state regulators ranged from one department that had, among other things, access to required quarterly reports of its companies’ Year 2000 progress since 1998 to one that relied primarily on company responses to a few Year 2000 surveys. The latter is of particular concern since the absence of corroborating evidence obtained through on-site verification or multiple contacts with companies to track their progress diminishes the extent of regulatory assurances about Year 2000 readiness. A few state officials also explained that some small companies were not sufficiently computer dependent (e.g., a company may use a single personal computer to conduct business) to experience major problems with the Year 2000 date change and warrant the need for an on-site verification. As we reported in April 1999, 2 of the 17 states we reviewed were comparatively more active in their efforts to ensure that insurance companies become Year 2000 ready. These states opted to forgo on-site examinations for some of their domiciled companies because of a comfort level that officials explained was derived from their close tracking of or continuous interaction with certain companies over time. In some cases, they chose instead to conduct targeted Year 2000 examinations for certain insurance companies that were licensed to write business but were not domiciled in the state. As of September 30, 1 of the 2 states had examined as many as 378 such licensed companies, and the other state had examined 29. Some of the states of domicile for these companies, as well as the Year 2000 Industry Preparedness Task Force, ultimately ended up relying on many of the targeted Year 2000 examinations conducted by the two licensing states to verify their readiness. Information gathered by NAIC’s Year 2000 Industry Preparedness Task Force and responses to our survey of 50 states on U.S. insurers’ Year 2000 readiness indicate that regulators have considerable confidence in the insurance industry’s readiness for Year 2000. In October, NAIC estimated that 3 percent of the nation’s nationally significant insurers had not made their systems Year 2000 ready. State regulators’ responses to our survey indicated that 78 percent of all domiciled insurance companies were considered to be Year 2000 ready and making satisfactory progress in their contingency planning activities as of September 30. Of the remaining 22 percent of these companies, 17 percent, although not completed with their preparations as of September 30, were expected to become ready by December 31. Uncertainties about the status of the remaining 5 percent were largely unresolved at the time of our survey. With one exception, ratings companies and consultants we contacted were generally optimistic about the insurance industry’s Year 2000 outlook. However, some industry observers have raised questions about liability exposure issues, such as the coverage of Year 2000 remediation costs. They have also expressed concerns about insurance companies’ inability to accurately report their potential Year 2000-related liability exposures on their financial statements. In an October 1999 press release, NAIC’s Year 2000 task force reported that information obtained from its initiative focusing on nationally significant insurers indicates that the insurance industry is expected to experience little disruption when 2000 begins. The task force pointed out that state assessments of insurers’ readiness have identified a relatively small number of insurers for follow-up and continued monitoring. It also noted that regulators were expecting few problems in the new year, estimating that only 3 percent of the industry’s nationally significant companies had not made their systems Year 2000 ready. The task force chairman further stated that efforts by individual states indicated that most of the companies that were not designated as nationally significant were also on schedule, but data on the extent of validation efforts conducted for these companies had not been compiled at the time of our fieldwork in November. Our review of the 17 states previously discussed was intended to provide information on the status of regulatory oversight efforts. Separate from this effort, we conducted a survey of all 50 state insurance departments to obtain information on the Year 2000 readiness of insurance companies domiciled in each state as of September 30. Appendix IV provides the number of insurance companies by type of company identified by the 50 state respondents. For purposes of the survey, a company was to be considered Year 2000 ready if the regulator was satisfied that the company had made adequate efforts to complete Year 2000 remediation, testing, and implementation activities for all mission-critical systems in preparation for 2000. Although our survey collected data on companies’ Year 2000 contingency planning activities, we did not specify that companies should have completed such activities to be considered Year 2000 ready. This definition of Year 2000 readiness was consistent with NAIC’s industry expectation that the last 6 months of 1999 should be used by companies to focus on less critical applications and systems and develop contingency plans in the event of a failure. Individual states were to base their responses to our questions about companies’ readiness and contingency planning activities on information obtained through their Year 2000 oversight efforts. State oversight efforts pertaining to Year 2000 could include (1) surveys administered to obtain information on companies’ Year 2000 preparations, (2) required Year 2000 disclosures with financial report filings, and (3) on-site verification reviews conducted as part of the state’s regular financial examination cycle or its targeted Year 2000 examination program. State responses to survey questions on the number of Year 2000 examinations conducted in 1998 and 1999 indicated that states were engaged in varying levels of on-site verification. Table 2 shows the proportion of states’ domiciled companies that, as of September 30, had been subject to an on-site verification review of their Year 2000 readiness. Our survey indicated that state regulators had considerable confidence about the adequacy of the insurance industry’s preparation for the Year 2000 date change. Seventy-eight percent of the states’ domiciled insurance companies were considered Year 2000 ready as of September 30 (see fig. 1). State regulators also generally viewed these insurers as making satisfactory progress in their contingency planning efforts. The remaining 22 percent of the states’ domiciled insurance companies represented companies that were (1) not Year 2000 ready by September 30, but that were projected to be ready by December 31; (2) not subject to categorization due to the lack of adequate information to determine their readiness status; or (3) considered at risk of not being ready. Some uncertainties exist, specific to the companies included in the last two categories, about their ability to become fully ready by the end of the year. These categories are discussed in the following sections. State responses indicated that 17 percent of their domiciled insurance companies were not Year 2000 ready by September 30 but were projected to be ready by December 31. These companies missed NAIC’s milestone calling for all mission-critical systems to be Year 2000 ready by June 30, 1999. States estimated that on average, 84 percent of the companies progressing toward becoming Year 2000 ready by December 31 were considered to be making satisfactory progress in their contingency planning efforts, which suggests that the remaining companies were not making adequate progress. This lack of adequate progress is of particular concern for companies that may be fully preoccupied with remediating their mission-critical systems during the last quarter of the year, leaving them little time to attend to their contingency plans. These companies would also have an increased likelihood of a system failure if any of their compliant mission-critical systems happen to be integrated with less critical systems that have not been fully remediated. Viable contingency plans are especially important for larger companies that may have complex systems that were not projected to be Year 2000 ready until the end of the year. Survey responses indicated that while 887, or 83 percent, of the companies not ready by September 30, but projected to be Year 2000 ready by December 31, were small, the remaining 188 companies each wrote $100 million or more in net premiums nationwide, as shown in table 3. The states indicated that as of September 30 they lacked sufficient information to determine the Year 2000 readiness of 4 percent of their domiciled insurance companies. Specifically, 14 states placed 235 companies in this category. Many of these states indicated that they had some self-reported information from these companies, such as responses to the state’s Year 2000 surveys or the company’s Management Discussion and Analysis Year 2000 disclosures. However, these states believed that they could not determine their readiness from information that had not been corroborated by an on-site verification review. One state official, for example, explained that although survey responses did not indicate any reason to question the prospective readiness of these companies, on-site examinations had not been performed to verify survey information or determine the companies’ readiness. On the basis of similar reasoning, an official from another state noted that he was waiting for the results of ongoing examinations at some companies before reaching any conclusions about their readiness. One situation involved a state where the insurance department was responsible for monitoring the annual statements submitted by HMOs but depended on another state department for survey and examination information. The insurance department was told that a Year 2000 survey had been administered to the HMOs, but their responses had not yet been received. Therefore, the insurance department identified these HMOs as companies for which it did not have adequate information to determine their Year 2000 readiness. In response to our survey, the states reported that about 1 percent of their domiciled insurance companies were viewed as at risk of not being Year 2000 ready by the end of the year. Specifically, 13 states identified 49 companies, consisting mostly of small property/casualty insurers, that they considered at risk of not being ready by the end of the year, as shown in table 4. Thirty-eight of the companies considered at risk were small, 9 were medium, and the remaining 2 were large HMOs. On average, states estimated that 57 percent of these at risk companies had not made satisfactory progress in their contingency planning efforts as of September 30, 1999. Virtually all of the states that identified companies as at risk of not being Year 2000 ready by the end of the year noted that they would continue to focus on the adequacy of these companies’ contingency plans during the last quarter of 1999. Other actions the states planned to take to deal with at risk companies included conducting management conferences and requiring monthly Year 2000 progress reports. In a few isolated cases, a state had resorted to or was planning to resort to enforcement actions. In reviewing state survey responses regarding the Year 2000 readiness of companies by type, we found that states identified a slightly lower level proportion of HMOs considered to be Year 2000 ready when compared to insurers in other categories. As of September 30, 1999, 69 percent of the states’ companies classified as HMOs, including managed care organizations, were considered Year 2000 ready. Of the remaining 31 percent, 23 percent had mission-critical systems that were not Year 2000 ready as of September 30 but that were projected to be ready by December 31, 6 percent were not subject to categorization due to the lack of adequate information, and 2 percent were considered at risk of not being ready by December 31. In contrast, 72 to 80 percent of insurers in the property/casualty, life/health, and other insurer categories were considered Year 2000 ready. Appendix V provides a graphic that compares the readiness status of companies by type of insurer. According to a task force official, health insurers represent one area that remains vulnerable because such insurers depend on hospitals and doctors’ offices becoming Year 2000 ready. A recent report issued by the President’s Council on Year 2000 Conversion states that many health care providers and managed care organizations continue to exhibit troubling levels of readiness. The report refers to July/August survey data indicating that (1) only 40 percent of the health care providers and organizations reported that they were Year 2000 ready and (2) roughly 25 percent of the organizations did not have documented Year 2000 plans. In July 1999, we reported that many surveys had been completed in 1999 on the Year 2000 readiness of health care providers, but none provided sufficient information with which to assess the Year 2000 status of the health-care-provider community. We later testified in September 1999 that the Health Care Financing Administration, with assistance from a contractor, performed a Year 2000 risk assessment of 425 managed care organizations. This June 1999 risk assessment identified 22 percent of the organizations as being high risk, 74 percent as medium risk, and 17 percent as low risk. During our fieldwork in November, we were told that NAIC was in contact with the Health Care Financing Administration to determine whether any of the managed care organizations assessed by the agency overlapped with those that were regulated by the state insurance departments. The industry observers we contacted generally maintained a favorable view of the insurance industry’s Year 2000 preparedness efforts, but they continued to express uncertainty over potential costs associated with Year 2000-related liability exposures. With one exception, rating companies and consultants with whom we spoke have remained confident about the industry’s efforts to prepare and become ready for 2000. For instance, the Gartner Group continues to place the insurance industry among the industry leaders in becoming Year 2000 ready, on the basis of its August report. Likewise, several rating companies we contacted, including Standard and Poor’s; A.M. Best; and Moody’s, indicated that, as of October, they had not downgraded any insurer’s rating due to Year 2000 readiness issues. One rating firm, Weiss Ratings, Inc., tempered the generally optimistic view of readiness in the industry by reporting that 13 percent of the companies responding to its survey had made inadequate progress in their Year 2000 preparations. The response rate to this June 1999 survey was about 19 percent. While Weiss Ratings, Inc., considered a company’s progress to be inadequate if its mission-critical systems were not renovated and tested by August 1999, it also indicated that those companies viewed to be making inadequate progress still had a good chance of achieving Year 2000 compliance in the time remaining. Considerable uncertainty remains concerning the potential magnitude of insurers’ Year 2000-related liability exposures. In our April report, we noted that insurers’ liability exposures could not then be reasonably estimated because, among other factors, a claims history for the event did not exist and questions about key legal issues that could affect insurance policy coverage were still unresolved. Since then, the industry observers we contacted have continued to express uncertainties. The rating companies we contacted in October indicated that it was still too early to tell how liability exposures might affect insurance companies. For this reason, the rating companies had not factored liability exposures into their ratings. One actuarial consulting firm estimated that costs from Year 2000-related claims and legal expenses among U.S. property/casualty insurers could range between $15 billion and $35 billion. The firm acknowledged that its estimates were based on several assumptions associated with claims and legal outcomes that have not yet been realized. The industry observers we contacted generally said that insurance companies will not likely be in a position to report their potential Year 2000-related liability exposures on their 1999 financial statements, because their liability exposures are not yet reasonably estimable due to uncertainties over claims and legal outcomes. Legal debates over insurance coverage for Year 2000-related mishaps, as well as for costs to avoid such mishaps, have yet to be fully resolved. Our previous report described some of the legal debates associated with coverage for Year 2000-related problems and damages, including the coverage-related issues of “fortuity” and “triggers.” For example, it is not clear whether a Year 2000-related loss would be considered a fortuitous event covered by insurance, rather than an expected event that may not be covered. For some types of policies, coverage also depends on what event triggers coverage. Specifically, questions arise when coverage was activated for a particular policy. Other debates focus on whether an insured party that takes remedial action to reduce its vulnerability to Year 2000-related problems may recover remediation costs under a particular policy. The Y2K Act, enacted in July 1999, does not directly address many of the unresolved legal issues that could affect insurers’ potential liability exposures. The primary purposes of the act include facilitating alternative modes of dispute resolution, limiting certain liabilities for Year 2000- related claims, and providing pre-Year 2000 remedial measures aimed at reducing an insured’s vulnerability to Year 2000-related mishaps. The act also sets forth procedural requirements for class action suits and affirmative defenses for temporary noncompliance with certain federal standards caused by a Year 2000-related problem. The act, however, does not contain substantive standards to guide courts in deciding whether Year 2000-related mishaps or remediation costs should be covered. Such issues will principally be a matter of state law. Some current cases involving insurance coverage disputes and additional provisions of the Y2K Act are described in appendix VI. Since we first expressed concerns about the states’ regulatory oversight of the insurance industry in March 1999, NAIC actively emphasized the value of state regulators’ validating insurance companies’ Year 2000 preparations through on-site examinations, particularly those undertaken by nationally significant insurers. We also found that, partly in response to this emphasis, some states have increased their efforts to conduct on-site examinations of their domiciled insurance companies’ Year 2000 preparations. Even with this increased emphasis, however, not all of the nation’s insurance companies will be subject to an on-site verification review. Gaps in Year 2000 verification coverage of the insurance industry can be attributed to several factors. One factor has been the late start of some states in conducting on-site verification reviews and the resulting need for them to focus on the potentially higher impact companies rather than conducting examinations of all domiciled insurance companies. Another factor has been regulators’ belief that, in some cases, comprehensive surveys were acceptable substitutes for examinations. Differing regulatory perspectives have constituted yet another factor contributing to state decisions to forgo on-site examinations for some companies. Such perspectives ranged from satisfaction with the adequacy of off-site monitoring in a few states that had closely tracked the progress of their companies over the last few years to the view in a few other states that Year 2000 readiness would likely be adequately covered by insurers motivated to remain competitive without regulatory prodding. Finally, insurance regulators have indicated that some small insurance companies are not sufficiently dependent on computers to experience major problems with the Year 2000 date change. The strategy promulgated by NAIC to focus on nationally significant companies appears reasonable given the large number of state-regulated insurance companies subject to oversight and the limited time remaining before 2000. However, states’ generally late start in assuming a more proactive role regarding Year 2000 has affected their ability to complete their regulatory oversight of all the insurers they supervise. As of mid- November, for example, some states had not finished the planned on-site validation process for their companies, and NAIC was still in the process of collecting information about states’ regulatory assessments of the nation’s largest managed care organizations and major health insurers not designated as nationally significant. In addition, uncertainties exist about the readiness outcome for the 4 percent of the companies for which regulators did not have sufficient information, and 1 percent of the companies that regulators viewed at risk of not being ready by December 31 but were closely monitoring. Although they were projected to be ready by the end of the year, questions also remain unresolved regarding whether all of the 17 percent of the insurance companies that were not ready as of September 30, 1999, can complete all conversion activities to become fully compliant within the remaining time. Lastly, and arguably outside of the regulators’ control, uncertainties regarding insurers’ Year 2000 liability exposures continue to represent an area of concern that is being monitored by rating companies, and other industry observers, that can affect the overall Year 2000 outlook of the insurance industry. In summary, the intensive regulatory activity of the past several months provides additional support for the level of confidence that regulators place on the insurance industry’s Year 2000 preparations and their belief that most policyholders should not be concerned about their coverage. However, as previously indicated, remaining gaps in the on-site verification of insurance companies’ Year 2000 readiness and unfinished regulatory efforts in the area leave uncertainties about the self-reported status of some companies’ readiness. As a point of comparison, banking regulators, who have conducted multiple examinations of all their financial institutions, can provide stronger assurances to support their assertions that, with relatively few exceptions, all banks were Year 2000 ready as of September 30, 1999. Insurance regulators, on the other hand, can say with some conviction that most insurance is sold by companies that are Year 2000 ready or appear to be on course to become ready by the end of the year. It remains true that a portion of the industry had not completed its Year 2000 preparations by September 30, 1999, and that some of these companies had not made satisfactory progress in contingency planning. However, the welcome news is that most consumers, especially those insured by nationally significant companies, can have greater confidence that their insurers will likely provide uninterrupted services into the new year. NAIC provided written comments on a draft of this report. A reprint of NAIC’s letter can be found in appendix III. NAIC disagrees with a perceived assertion that because states have not performed on-site verification of Year 2000 preparations of every insurance company, it represents an inability of states to complete their regulatory oversight of the industry. As noted on page 22, we attribute the inability of states to complete their regulatory oversight of the industry to states’ generally late start in assuming a more proactive role regarding year 2000. This late start, among other factors, has caused some states to forgo conducting Year 2000 on-site verifications for some of their domiciled companies which has, in turn, limited the level of assurances to support regulatory assertions of their companies’ readiness. We acknowledge on page 10 that, according to NAIC information, 98 percent of the direct premiums written by nationally significant companies had been or were to be subject to an on-site Year 2000 review by the end of November. However, the extent of on-site validation for the life/health and property/casualty companies that were not nationally significant and the other insurer segments, which together represent 27 percent of the total direct premiums written by the industry as a whole, was unknown at the time of our review. We continue to believe that most consumers, especially those insured by nationally significant companies, can have greater confidence that their insurer will likely provide uninterrupted services into the new year. The same level of assurances, however, cannot be provided for the portion of the industry that may not have been subject to an on-site verification or for which the extent of on-site verification is unknown. NAIC believes that the draft report erroneously overemphasized statistics based on the number of insurance companies verified or the number of states performing on-site examinations and suggests that these statistics should focus on information supplied by the NAIC and, more emphatically, on premium-based statistics from our survey of the 50 states. Premium- based information supplied by the NAIC can be found throughout this report, but specifically on pages 2, 6, and 10 as it relates to the on-site verification of nationally significant companies. We did not provide premium-based statistics from our survey primarily because we found inconsistencies when we compared responses from many of the states to similar information provided by NAIC. For example, the total net premium volume written nationwide reported by 15 states to have been subject to an on-site verification was, on average, 126 percent more than the total net premium volume written nationwide identified by NAIC for each of these states. Such inconsistencies may have been the result of the states reporting gross premiums rather than net premiums as our survey requested or the result of duplicative counting for companies that may have been subject to Year 2000 on-site verifications conducted during both a regular and a targeted examination. Regardless of the reasons for such inconsistencies, they rendered the survey responses on net premiums subject to on-site verification unusable for reporting purposes. NAIC also indicated that statistics based on the number of companies impart an unnecessary negative bias because a significant number of companies either write a very small amount of premiums, are so small as to have no risk of Year 2000 failure, are dormant companies, or are companies that have been acquired by or merged into other insurers since 1998. To help minimize this type of bias, we have made an adjustment to the table on page 15 that shows the percentage of states’ domiciled companies that were subject to on-site verification examinations. Specifically, companies whose Year 2000 readiness status was not viewed by the states as relevant were excluded; this covered, for example, companies in liquidation, companies operating without computer systems, and shell companies with no business. The effect of this adjustment on the number of states falling into each category of on-site verifications conducted was minor. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 10 days from its date. At that time, we will provide copies to Representative Thomas Bliley, Chairman, House Committee on Commerce, and Senator Robert Bennett, Chairman, and Senator Christopher Dodd, Vice Chairman, Senate Special Committee on the Year 2000 Technology Problem. We will also provide copies of this report to other interested parties and will make copies available to others on request. Key contributors to this assignment are acknowledged in appendix VII. Please call me or Lawrence Cluff on (202) 512-8678 if you or your staff have any questions. We focused part of our review on the same 17 state insurance departments visited during our previous review. These state departments’ domiciled insurance companies collectively accounted for almost 76 percent of insurance sold nationally during 1998. The departments represented the top 12 states, whose domiciled companies had combined market shares ranging from 3.4 percent to 14 percent, and 5 states with relatively smaller market shares ranging from 0.3 to 2.1 percent. As previously noted, our April report described some of the prevalent issues involved in coverage disputes. Some recent court cases raised a new issue involving businesses seeking to recover from their insurers remediation costs they have incurred in their efforts to help prevent or reduce the costs of Year 2000-related mishaps. On the basis of an interpretation of a provision commonly referred to as the “sue and labor” clause, in some of the cases, the insured entities claimed that their insurance policies cover remediation costs. Some insurance policies, generally property/casualty insurance policies, contain a sue and labor provision accompanied by language specifically obligating the insurer to contribute to the expenses incurred by the insured in acting under the provision. The sue and labor clause originated centuries ago in ocean marine policies. Its purpose was to encourage or require policyholders to prevent or minimize imminent potential loss or damage covered by the policy without forfeiting recovery under the policy, thereby reducing the insured loss. According to one commentator, the classic example is the captain who orders the crew to jettison cargo to prevent the ship from foundering in stormy seas. The value of the jettisoned cargo is recoverable under the sue and labor clause. At least three cases were brought in 1999 seeking coverage of remediation costs under sue and labor provisions. The insured plaintiffs in those cases reportedly sought to recover remediation costs of at least $400 million and $183 million. Cases of this type contribute to the uncertainties associated with insurers’ potential liability exposure. Insurers opposing claims to recover remediation costs have raised several arguments. For example, they contend that remediation costs are covered only if they were incurred to protect against an insured loss, and that Year 2000 remediation costs are not insured losses. Among other things, costs recoverable pursuant to a sue and labor provision typically involve remedial measures to prevent or recover damage arising from covered events, such as lightning, fire, or theft. Insurers contend that Year 2000 remediation costs arise from a defect or inherent limitation in a product and not in connection with an insured event. In addition, insurers assert that the majority of losses an insured business seeks to protect against through remediation measures are not losses attributable to the physical loss or damage of insured property, but instead are uninsured economic losses, such as a decrease in market share, a loss of investor or consumer confidence, or regulatory sanctions. Another argument is that the loss to be minimized or avoided must be actual or imminent. According to this argument, the Year 2000 event should not be considered imminent, because insured entities have been aware of it for several years and in many cases began remedial measures as early as the mid-1990s. Insurers argue that such remediation costs should be considered ordinary costs of doing business. The Y2K Act does not create any new causes of action. Instead, for “Year 2000 actions,” it modifies existing state or federal procedures and remedies concerning nonpersonal injury liability arising from Year 2000 failures.Among other things, the act (1) requires that notice of a Year 2000 claim be given to potential defendants before a “Year 2000 action” is filed; (2) establishes heightened pleading requirements; (3) sets caps and limitations on punitive damage awards; and (4) provides for the apportionment of damages, rather than joint and several liability, except in cases where it is found that the defendants acted with specific intent to injure the plaintiff or knowingly committed fraud. The act applies to any “Year 2000 action” brought after January 1, 1999, for an actual or potential “Year 2000 failure” occurring before January 1, 2003. The following is an overview of some provisions of the act that could have a direct or indirect impact on the amounts for which insurance companies may be liable. Most of the Y2K Act focuses on the litigation process. Under the notice provisions, prospective plaintiffs in a Year 2000 action (except for claims for injunctive relief) must send a written notice to each prospective defendant containing information about the pertinent event and including the remedy sought. Within 30 days after receiving the notice, the prospective defendant must provide each plaintiff with a written statement describing what, if any, remediation measures or alternative dispute resolution processes would be acceptable. If the defendant proposes a plan to remediate the problem, the prospective plaintiff must allow the prospective defendant an additional 60 days from the end of the 30-day notice period to complete the proposed remedial action before bringing suit. The purpose of this 90-day notice requirement is to create a procedure that might facilitate the parties’ resolution of the problem through voluntary efforts or through alternative dispute resolution. The Y2K Act also contains rules for pleading affirmative defenses, damages, warranty and liability disclaimers, proportionate liability, and class actions. One purpose of the pleading requirements is to reduce the potential for frivolous claims by requiring the plaintiff in a Year 2000 action to articulate certain bases for the claim and remedy. Provisions of the act for preserving warranties and contracts also are intended to discourage frivolous lawsuits. As previously discussed, the act generally requires that all written contract terms, including exclusions of liability and disclaimers of warranty, are to be strictly enforced unless those terms are contrary to any applicable state statute in effect as of January 1, 1999. The Y2K Act limits liability exposure and damages. Some limitations depend upon whether the lawsuit is a contract action or a tort action. For example, in tort actions, the act provides for proportionate liability, except with respect to certain suits brought by consumers. Generally, defendants will be liable only for that portion of a judgment that corresponds to their proportionate share of the total fault for the plaintiff’s loss, unless the defendants are found to have committed fraud in connection with the Year 2000 problem or to have specifically intended to injure the plaintiff. Such a finding would render the defendant jointly and severally liable. Other limitations include the following: (1) elimination of strict liability, (2) heightened proof requirements as a condition for recovering punitive damages and a cap on the amount of such damages for individuals with net worth of less than $500,000 and small employers, and (3) limitations on the recovery of certain “economic losses” of the plaintiff alleged in connection with a tort claim. These losses, which include lost profits, business interruption losses, and consequential and indirect damages, may be recovered only if a contract provides for their recovery or the losses result directly from damage to tangible real or personal property caused by the Year 2000 failure. The limitation does not apply to claims of intentional torts. For contract actions, no category of damages may be awarded unless such damages are allowed by the contract expressly or, if the contract is silent on the matter, under applicable state or federal law. The act contains a special provision that excludes from damages the amount the plaintiff reasonably could have avoided by utilizing any available or reasonably ascertainable information “concerning means of remedying or avoiding the Year 2000 failure involved in the action.” Prospective plaintiffs are provided with an incentive to take reasonable steps to limit their damages. This duty to mitigate is in addition to any such duty imposed under state law. The duty is not absolute, however. Where a defendant intentionally misrepresents facts concerning the potential for a Year 2000 failure in the “device or system used or sold by the defendant” that caused plaintiff’s harm, the plaintiff will be relieved from this statutory mitigation duty. Depending upon the effects of the settlement incentives and litigation- related limitations contained in the Y2K Act, insurance liability exposure could be less than would be the case if liabilities for Year 2000 actions were determined under less limiting state laws. Whether an insurance policy covers a particular Year 2000 event, however, could depend upon a number of factors, including the extent to which state laws and cases apply to insurance coverage litigation. In addition to the persons named above, Evelyn E Aquino, Gerhard Brostrom, Barry A. Kirby, May M. Lee, Alexandra Martin-Arseneau,and Paul G. Thompson made key contributions to this report. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch- tone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO provided information on the readiness of the insurance industry to meet the year 2000 date change, focusing on: (1) an updated assessment, as of September 30, 1999, of state regulatory oversight of the insurance industry's year 2000 preparations; and (2) the status of the industry's year 2000 readiness. GAO noted that: (1) since GAO's last report, the National Association of Insurance Commissioners (NAIC) stepped up its efforts to assess the insurance industry's year 2000 readiness by: (a) issuing expanded guidance to state insurance regulators on how to examine companies' preparedness; and (b) encouraging state regulators to conduct on-site examinations of insurers with the greatest potential public impact; (2) some of the nation's state regulators increased their use of examinations aimed at verifying the year 2000 readiness of their insurers, particularly for their nationally significant life/health and property/casualty insurers; (3) six of the 17 states reviewed indicated that their goal was to conduct year 2000 readiness examinations for all of the insurance companies domiciled in their states; (4) the remaining 11 states had set varying goals regarding which companies were to be subject to year 2000 examinations, but most of these states attempted to cover their nationally significant insurers; (5) in October 1999, NAIC's Year 2000 Industry Preparedness Task Force reported the insurance industry expected to experience little disruption when 2000 begins; (6) state responses to a nationwide survey GAO conducted indicated considerable confidence in the insurance industry's preparation for the year 2000 date change; (7) uncertainties about the ability of the remaining 5 percent of the companies to be year 2000 ready were largely unresolved at time of survey; (8) regulators indicated they did not have adequate information to determine the readiness status for 4 percent of the companies and considered 1 percent to be at risk of not being ready by December; (9) states appeared to have a slightly lower level of confidence in the readiness of health maintenance organizations and managed care organizations than those in other insurance segments; (10) according to a task force official, health insurers represent one part of the industry that remains vulnerable because they depend on hospitals and doctors' offices becoming year 2000 ready; (11) industry observers continued to express uncertainty over potential costs associated with year 2000-related liability exposures; (12) legal debates had yet to be resolved over insurance coverage for year 2000-related mishaps as well as liability for costs that policyholders incur to avoid such mishaps; and (13) rating companies indicated that it was still too early to tell how liability exposures might affect insurance companies, and for this reason, the rating companies had not factored these exposures into their ratings.