Rising Demand for SSAE16s for Captive Managers
Over the past few years, numerous prospective captive owners have asked captive managers to provide their Statements on Standards for Attestation Engagements 16 (SSAE 16) attestation (formerly SAS 70). Many captive managers outsource critical functions of their business, such as payroll processing, and they want to have full confidence in the quality of services received from their outsourced service providers. While not every prospective captive owner is currently requesting a captive manager’s SSAE 16, a recently circulated draft change in the regulatory environment may increase these requests. And there may well be a requirement for captive managers to have an SSAE 16 attestation performed as soon as June 30, 2016.
Captive managers play a key role in the success of a captive insurance enterprise. The captive manager guides the captive through a highly regulated environment, steers clear of the potential storms of state regulations, and performs many, if not all, management and back-office functions for the captive insurance company. Regulators are becoming more concerned about whether captive managers are diligently and effectively performing their regulated, assigned and contractual duties and responsibilities.
The Utah Captive Insurance Division (part of the Utah Insurance Department) is working to implement an attestation requirement for captive managers' processes and controls. A proposed regulation would require captive managers that manage 10 or more Utah domiciled captive insurance entities to have an attestation of their processes and internal controls. Under the proposed regulation this attestation would be performed annually. The current Utah draft regulation requires an attestation in the form of a Report on Controls at a Service Organization (SSAE 16 SOC 1 Type 2). This type of SSAE 16 requires documentation of procedures and controls, as well as testing of the effectiveness of the controls over a period of time. The period of time typically lasts 12 months; however, for the initial attestations, a period as short as six months is permitted under the relevant American Institute of Certified Public Accountants (AICPA) professional guidance. Although we are not aware of any other domiciles considering such a requirement at this time, it is possible that other regulators will consider this a beneficial component of their regulatory oversight authority and include a similar regulation in the near term.
Since there is a requirement for the SSAE16 attestation to cover a minimum period of time with documented processes and fully operational controls, captive managers should take a proactive approach to any new proposed regulatory requirements. By undertaking a cost-benefit analysis of having a SSAE 16 performed, captive managers can identify any gaps in controls/procedures, recognize potential operating efficiencies and gain a differentiator in marketing themselves to prospective captive owners.