The insurance industry, with policy reserves of approximately $2.5 trillion, is an important component of the financial system. These reserves are held in trust for policyholders, much like bank deposits are held for depositors. While there are important similarities between insurance companies and other financial intermediaries, there are important differences as well. One difference is that policy reserves are paid out when policyholders experience an insured loss. Thus, policyholders may get back more or less than they paid the insurance company. This is unlike a bank deposit, where bank depositors can expect to get their deposits, plus interest. A similarity between insurance companies and banks is that both use the money they receive to purchase income-earning assets until the money is needed. Furthermore, like banks and securities dealers, insurance companies are regulated to ensure that the money they collect now will be available to meet later obligations. To a large extent, it is the delayed delivery of the contracted product that makes the importance of addressing Year 2000 issues particularly acute in the financial services industry in general and in the insurance industry in particular. The Year 2000 problem exists because the data that computers store and process often use only the last two digits to designate the year. On January 1, 2000, such systems may mistake data referring to 2000 as meaning 1900, possibly leading to numerous errors and disruptions in processing. Financial services institutions are especially dependent upon the accurate transmission of electronic information; thus, the systems they use must be readied to correctly process 2000 dates. To provide a standard gauge for assessing the progress of federal agencies in becoming prepared for the Year 2000 date change, we issued guidance in 1997. While this Assessment Guide is directed specifically at federal agencies, the stages of Year 2000 preparation and corresponding milestones can generally be applied to all institutions, including private companies. The Assessment Guide discusses issues that are common to nearly all companies, as well as to the federal agencies, and can be used as a general measure of whether a company is on track to being prepared for the Year 2000 date change. Thus, a regulator of financial institutions could use this, or other similar guidance, as general criteria for assessing the state of preparedness of its regulated institutions. The Assessment Guide divides the process by which an institution could become Year 2000 compliant into five phases—awareness, assessment, renovation, validation, and implementation. Each of these phases is described in appendix I. The final deadline for becoming ready for 2000 is immovable. Furthermore, since the phases of preparation are sequential, it is important to establish intermediate milestones to help ensure that a company will be able to complete all Year 2000 preparations in time. A schedule for measuring progress toward Year 2000 readiness could allow regulators a degree of comfort concerning the status of their regulated companies. As shown in table 1, the Assessment Guide provides a schedule of suggested completion dates for each of the key phases of Year 2000 conversion. Other parties have developed alternative sets of phases and milestones. Subsequent to the issuance of our Assessment Guide, the Office of Management and Budget (OMB) provided standards that federal agencies are expected to follow. OMB’s milestones begin with the assessment phase, which was to be completed by June 30, 1997, followed by renovation, validation (internal testing), and implementation. All entities are to have completed the implementation phase by March 31, 1999. After that date, entities are to be engaged in testing of business processes and planning for contingencies. Throughout the remainder of this report, actions by insurance regulators are compared to the guidance found in our Assessment Guide. Year 2000-related system malfunctions in an insurance company can have serious business interruptions and even solvency implications. Specifically, Year 2000 problems could result in disruptions to processing policyholder payments and investments, insurance claims and payments, annuity payments, and data queries to verify insurance coverage. This means that some policyholders may be unable to obtain policy service, or worse, may be unable to collect on their policies at a time of need. It is also possible that the delivery of health care services could be affected if health insurers cannot readily process claims information. Pursuant to the McCarran-Ferguson Act of 1945, states exercise primary regulatory jurisdiction over the insurance business. Each state has a department of insurance that, among other things, is responsible for monitoring insurance companies’ solvency. Solvency, in turn, can be affected by operational issues, such as the failure to be ready for 2000. Companies that operate and write insurance policies in multiple states comprise much of the nation’s insurance industry. Although an insurance company can conduct business in multiple states, it is incorporated, or chartered, under the laws of a single state, which is referred to as its state of domicile. The regulator in an insurer’s state of domicile represents its primary regulator and is to assume lead responsibility for oversight issues, such as Year 2000 readiness. States where insurers are licensed to operate (but not chartered) generally rely on the companies’ primary regulator to exercise due diligence in overseeing domiciled companies and to voluntarily share information about them. NAIC is a voluntary association of the heads of each state insurance department, the District of Columbia, and four U.S. territories. It does not have any regulatory authority over the state insurance departments. NAIC provides a national forum for resolving major insurance issues and for allowing regulators to develop consistent policy on the regulation of insurance when consistency is deemed appropriate. State insurance commissioners created NAIC, in part, to help address problems that differing state-by-state authorities, laws, and regulations can cause as state insurance regulators oversee insurers that operate in more than one state. Although it has no regulatory function, NAIC is responsible for (1) serving as a clearinghouse for exchanges of information, (2) providing a structure for interstate cooperation in examinations of multistate insurers, (3) distributing model insurance laws and regulations for consideration by state legislatures and insurance departments, and (4) reviewing state insurance departments’ regulatory activities as part of a national accreditation program. Regarding Year 2000 issues, NAIC has assumed a key role as facilitator of states’ efforts to oversee the industry’s readiness. This role includes acting as a coordinator of information pertaining to state oversight efforts, the status of the industry’s readiness, and state regulators’ actions to become internally prepared for 2000. To determine what regulators were doing to oversee the Year 2000 readiness of the insurance industry, we interviewed officials of NAIC and reviewed available information on the organization’s efforts to facilitate states’ Year 2000 activities and summarize information in the area. We also visited 17 state insurance departments whose domiciliary companies collectively accounted for 75 percent of insurance sold nationally. In late January 1999, we surveyed these 17 state regulators to obtain an update on their Year 2000 oversight activities, including their efforts to set priorities for reviewing domiciled insurers. Unless otherwise indicated, observations throughout this report regarding state efforts and activities pertain specifically to the 17 states included in our review. See appendix II for a list of the states we visited and their respective domiciled insurers’ market shares. To compare Year 2000 oversight of the insurance, banking, and securities industries, we reviewed relevant documentation from their respective financial regulators, including industry guidance on Year 2000 readiness, related correspondence directed to financial institutions, audit programs for conducting Year 2000 examinations, and proposed rules covering Year 2000 issues. We also used information gathered and knowledge developed by our other teams that had conducted reviews of the Year 2000 preparedness of the banking and securities industries. Finally, we obtained updates on the status of various Year 2000 oversight activities, including conducting examinations that focus specifically on Year 2000 issues (referred to as Year 2000 targeted examinations) and monitoring companies’ actions to test their systems’ readiness. To determine the status of the insurance industry’s Year 2000 readiness, we interviewed regulatory officials who were responsible for Year 2000 oversight in the 17 states and reviewed available documentation on the readiness of the industry. To obtain additional insights regarding the readiness of the insurance industry, we interviewed representatives of key rating companies, including A.M. Best Company, Conning and Company, Standard and Poor’s, and Weiss Ratings, Inc., and reviewed their pertinent studies and reports issued in the area. We also spoke with representatives of and reviewed Year 2000-related documents from a few consulting and research firms, including the Gartner Group, which is a business and technology advisory company that conducts research on the global state of Year 2000 readiness, and Electronic Data Systems (EDS), which is a professional services firm that, among other things, assists financial services companies with becoming ready for 2000. To obtain industry perspectives regarding Year 2000 issues, particularly those involving potential liability exposures, we spoke with several of the largest property-casualty insurers and trade associations, including the Alliance of American Insurers, American Insurance Association, National Association of Independent Insurers, and National Association of Mutual Insurance Companies. Among other things, we inquired about these entities’ efforts to determine the nature and scope of potential liability exposures related to 2000. Finally, we reviewed available literature on various aspects of the Year 2000 liability exposure issue, reviewed relevant federal legislative proposals, and obtained related opinions from officials of the American Bar Association’s Tort and Insurance Practice Section. We did our work in accordance with generally accepted government auditing standards between September 1998 and April 1999. We requested comments on a draft of this report from the President and other officials of NAIC. NAIC’s written comments are included in appendix III and discussed near the end of this letter. We also discussed the contents of a draft of this report with officials from the Office of the Comptroller of the Currency (OCC) and the Securities and Exchange Commission (SEC). They provided technical comments that we have incorporated as appropriate in the report. Regulatory approaches and the level of oversight activity directed to the insurance industry’s Year 2000 readiness varied widely in the states we visited. The 17 states also differed in how they assessed and prioritized companies for regulatory attention in terms of Year 2000 readiness.