Year 2000: Insurance Regulators Have Accelerated Oversight, but Some Gaps
Remain (Letter Report, 12/20/1999, GAO/GGD-00-42).

Pursuant to a congressional request, GAO provided information on the
readiness of the insurance industry to meet the year 2000 date change,
focusing on: (1) an updated assessment, as of September 30, 1999, of
state regulatory oversight of the insurance industry's year 2000
preparations; and (2) the status of the industry's year 2000 readiness.

GAO noted that: (1) since GAO's last report, the National Association of
Insurance Commissioners (NAIC) stepped up its efforts to assess the
insurance industry's year 2000 readiness by: (a) issuing expanded
guidance to state insurance regulators on how to examine companies'
preparedness; and (b) encouraging state regulators to conduct on-site
examinations of insurers with the greatest potential public impact; (2)
some of the nation's state regulators increased their use of
examinations aimed at verifying the year 2000 readiness of their
insurers, particularly for their nationally significant life/health and
property/casualty insurers; (3) six of the 17 states reviewed indicated
that their goal was to conduct year 2000 readiness examinations for all
of the insurance companies domiciled in their states; (4) the remaining
11 states had set varying goals regarding which companies were to be
subject to year 2000 examinations, but most of these states attempted to
cover their nationally significant insurers; (5) in October 1999, NAIC's
Year 2000 Industry Preparedness Task Force reported the insurance
industry expected to experience little disruption when 2000 begins; (6)
state responses to a nationwide survey GAO conducted indicated
considerable confidence in the insurance industry's preparation for the
year 2000 date change; (7) uncertainties about the ability of the
remaining 5 percent of the companies to be year 2000 ready were largely
unresolved at time of survey; (8) regulators indicated they did not have
adequate information to determine the readiness status for 4 percent of
the companies and considered 1 percent to be at risk of not being ready
by December; (9) states appeared to have a slightly lower level of
confidence in the readiness of health maintenance organizations and
managed care organizations than those in other insurance segments; (10)
according to a task force official, health insurers represent one part
of the industry that remains vulnerable because they depend on hospitals
and doctors' offices becoming year 2000 ready; (11) industry observers
continued to express uncertainty over potential costs associated with
year 2000-related liability exposures; (12) legal debates had yet to be
resolved over insurance coverage for year 2000-related mishaps as well
as liability for costs that policyholders incur to avoid such mishaps;
and (13) rating companies indicated that it was still too early to tell
how liability exposures might affect insurance companies, and for this
reason, the rating companies had not factored these exposures into their
ratings.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  GGD-00-42
     TITLE:  Year 2000: Insurance Regulators Have Accelerated
	     Oversight, but Some Gaps Remain
      DATE:  12/20/1999
   SUBJECT:  Insurance companies
	     Computer software verification and validation
	     Data integrity
	     Strategic information systems planning
	     Systems conversions
	     Y2K
	     Insurance regulation
	     Information resources management
IDENTIFIER:  Y2K

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************

United States General Accounting Office
GAO

Report to the Ranking Minority Member, Committee

on Commerce, House of Representatives

December 1999

GAO/GGD-00-42

YEAR 2000
Insurance Regulators Have Accelerated Oversight,

but Some Gaps Remain

Ordering Information

The first copy of each GAO report and testimony
is free. Additional copies are $2 each. Orders
should be sent to the following address,
accompanied by a check or money order made out
to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are
accepted, also. Orders for 100 or more copies to
be mailed to a single address are discounted 25
percent.

Order by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-
6000 or by using fax number (202) 512-6061, or
TDD (202) 512-2537.

Each day, GAO issues a list of newly available
reports and testimony. To receive facsimile
copies of the daily list or any list from the
past 30 days, please call (202) 512-6000 using a
touch-tone phone. A recorded menu will provide
information on how to obtain these lists.

For information on how to access GAO reports on
the INTERNET, send e-mail message with "info" in
the body to:

[email protected]

or visit GAO's World Wide Web Home Page at:

http://www.gao.gov

United States
General Accounting Office
Washington, D.C. 20548-0001
Official Business
Penalty for Private Use $300
Address Correction Requested

                    Bulk Rate
               Postage & Fees Paid
                       GAO
                 Permit No. G100

(233609)

Contents
Page 281GAO/GGD-00-42 Insurance Regulators Have Accelerated Oversight
Letter                                                                      1
                                                                             
Appendix I                                                                 30
Seventeen States
Reviewed and Market
Share of Their Domiciled
Insurance Companies
                                                                             
Appendix II                                                                31
GAO Year 2000 Survey
Administered to the 50
States
                                                                             
Appendix III                                                               34
Comments From the
National Association of
Insurance Commissioners
                                                                             
Appendix IV                                                                36
Universe of Domiciled
Insurance Companies, by
Type
                                                                             
Appendix V                                                                 37
Status of Companies by
Type of Insurer, as of
September 30, 1999
                                                                             
Appendix VI                                                                38
Current Court Cases
Involving Insurance
Coverage of Year 2000
Issues and Highlights of
the Y2K Act
                           Current Cases Involving Insurance               38
                           Coverage
                           The Y2K Act                                     39
                                                                             
Appendix VII                                                               42
GAO Contacts and Staff
Acknowledgments
                                                                             
Tables                     Table 1:  Status of Targeted Year 2000          11
                           Examinations to Validate Company
                           Readiness in 17 States
                           Table 2:  Extent of On-site                     15
                           Verifications Conducted by States
                           Table 3:  Companies Projected to Be             17
                           Year 2000 Ready by December 31, 1999,
                           by Type and Size
                           Table 4:  Companies Viewed at Risk of           19
                           Not Being Ready by December 31, 1999,
                           by Type and Size
                           Table I.1:  States Reviewed and Market          30
                           Share of Their Domiciled Insurance
                           Companies
                           Table IV.1:  Domiciled Insurance                36
                           Companies, by Type
                                                                             
Figures                    Figure 1:   Status of Insurance                 16
                           Industry's Year 2000 Readiness, as of
                           September 30, 1999
                           Figure V.1:  Status of Companies by             37
                           Type of Insurer, as of September 30,
                           1999
                                                                             

Abbreviations

HMDI      Hospital, Medical, and Dental Service
Indemnity Corporation
HMO       Health Maintenance Organization
NAIC      National Association of Insurance
Commissioners

B-284237

Page 8GAO/GGD-00-42 Insurance Regulators Have Acce
lerated Oversight
     B-284237

     December 20, 1999

The Honorable John D. Dingell
Ranking Minority Member
Committee on Commerce
House of Representatives
 
Dear Mr. Dingell:

This report responds to your request that we
provide an update to information that we presented
earlier this year on the readiness of the
insurance industry to meet the Year 2000 date
change. Specifically, our objectives were to
provide (1) an updated assessment, as of September
30, 1999, of state regulatory oversight of the
insurance industry's Year 2000 preparations and
(2) the status of the industry's Year 2000
readiness.

Under a long-established division of
responsibilities between federal and state
regulators, state insurance regulators have
primary responsibility for the regulatory
oversight of the insurance industry.1 In March
1999, we reported that state insurance regulators
were generally not as proactive in their oversight
of the industry's Year 2000 readiness as the
banking and securities regulators.2 Of particular
concern was the limited extent of regulatory
attention given to validating the status of Year
2000 preparedness among insurance companies.3
Specifically, we indicated that oversight efforts
to validate the insurers' self-reported Year 2000
readiness status generally began later and lacked
the vigor demonstrated by bank and securities
regulators. At that time, state regulators chiefly
relied on surveys to obtain information on the
Year 2000 preparedness of companies that were
subject to their oversight, although examinations
had been acknowledged as one of the primary means
regulators could use to verify companies'
preparedness and validate their responses to
surveys.

In an April 1999 report, we also noted that the
National Association of Insurance Commissioners
(NAIC), which is a key coordinating group that
serves to facilitate states' oversight efforts,
had been slow in providing information and
guidance to state regulators about the appropriate
Year 2000 regulatory activities to undertake.4

Although both regulators and industry observers
were generally confident that the insurance
industry was in reasonably good condition
regarding Year 2000 readiness, we cautioned in our
April report that such observations were based on
information that was self-reported by insurance
companies and, for the most part, had not been
validated. Additionally, industry experts
expressed concerns about insurers' liability
exposures. Although it was too early to estimate
the magnitude of costs associated with claims and
legal defenses for Year 2000-related mishaps,
evidence suggested that such costs could be
substantial for some property/casualty insurers.
We concluded in the report that insurers would
continue to face uncertainties about their Year
2000-related liability exposures until answers to
key legal issues and actual claims for Year 2000-
related matters began to materialize.

Results in Brief
In the 8 months since our last report, NAIC
stepped up its efforts to assess the insurance
industry's Year 2000 readiness by, among other
things, (1) issuing expanded guidance to state
insurance regulators on how to examine companies'
preparedness and (2) encouraging state regulators
to conduct on-site examinations of insurers with
the greatest potential public impact. Over the
same period, some of the nation's state regulators
increased their use of examinations that are aimed
at verifying the Year 2000 readiness of their
insurers, particularly for their nationally
significant life/health and property/casualty
insurers.5 These insurers account for
approximately 86 percent of the premiums written
and make up 27 percent of the companies in these
two industry segments.

Six of the 17 states we reviewed indicated that
their goal was to conduct Year 2000 readiness
examinations for all of the insurance companies
domiciled in their states.6 The remaining 11
states had set varying goals regarding which
companies were to be subject to Year 2000
examinations, but most of these states attempted
to cover their nationally significant insurers. At
the time of our review, less information was
available about major life/health and
property/casualty insurers that were not
considered nationally significant. In November,
NAIC was still in the process of systematically
collecting information on companies in the other
insurance segments, such as health maintenance
organizations (HMO) and health, medical and dental
indemnities (HMDI).

NAIC and state regulators remain confident about
the insurance industry's Year 2000 readiness. In
October 1999, NAIC's Year 2000 Industry
Preparedness Task Force7 reported that the
insurance industry is expected to experience
little disruption when 2000 begins, estimating
that only 3 percent of the nation's nationally
significant companies had not made their systems
Year 2000 ready. State responses to a nationwide
survey we conducted indicated considerable
confidence in the insurance industry's preparation
for the Year 2000 date change. Responses indicated
that 78 percent of the states' domiciled insurance
companies were considered to be Year 2000 ready
and making satisfactory progress in their
contingency planning activities as of September
30. An additional 17 percent had not completed
preparations for their mission-critical systems by
September 30, but were expected to be Year 2000
ready by December 31, 1999.

Uncertainties about the ability of the remaining 5
percent of the companies to become fully Year 2000
ready were largely unresolved at the time of our
survey. Regulators indicated that they did not
have adequate information to determine the
readiness status for 4 percent of the companies
and considered 1 percent to be at risk of not
being ready by December. Regarding the latter, 13
states identified 49 companies, consisting mostly
of small property/casualty insurers that they
considered at risk of not being ready by the end
of the year.

In comparing the Year 2000 readiness of companies
by type, we found that states appeared to have a
slightly lower level of confidence in the
readiness of HMOs and managed care organizations
than those in other insurance segments. According
to a task force official, health insurers
represent one part of the industry that remains
vulnerable because they depend on hospitals and
doctors' offices becoming Year 2000 ready. Rating
companies and consultants we spoke with have
generally remained confident about the industry's
efforts to prepare for 2000. One rating firm
tempered the generally optimistic view of
readiness in the industry by reporting that 13
percent of the companies responding to its survey
had made inadequate progress in their Year 2000
preparations.

Industry observers continued to express
uncertainty over potential costs associated with
Year 2000-related liability exposures. Legal
debates had yet to be resolved over insurance
coverage for Year 2000-related mishaps as well as
liability for costs that policyholders incur to
avoid such mishaps. Rating companies we contacted
in October 1999 indicated that it was still too
early to tell how liability exposures might affect
insurance companies, and, for this reason, the
rating companies had not factored these exposures
into their ratings.

Background
Each insurance company is chartered under the laws
of a single state, known as its state of domicile.
Although an insurance company can conduct business
in multiple states, the regulator in the insurer's
state of domicile is its primary regulator. States
in which an insurer is licensed to operate, but in
which it is not chartered, typically rely on the
company's primary regulator in its state of
domicile to oversee the insurer. Regarding Year
2000 issues, NAIC has emphasized this approach by
encouraging each state to focus its Year 2000
oversight efforts on its domiciliary companies.

In total, state-regulated insurance entities wrote
an estimated $895.2 billion in direct premiums
sold nationally during 1998.8 Life/health and
property/casualty insurance companies represent
the key industry segments, accounting for 85
percent of the total direct premiums written in
that year. HMOs; HMDIs; and other entities, such
as fraternal organizations and title companies,
accounted for the remaining 15 percent.

Scope and Methodology
To update our previous assessment of the
regulatory oversight of the insurance industry's
Year 2000 readiness, we interviewed NAIC officials
and reviewed documentation related to NAIC's
efforts to facilitate state oversight of the
industry's Year 2000 readiness. We also reviewed
available state examination reports and executive
summaries covering companies' Year 2000
preparations, which were available at NAIC. While
we did not verify the accuracy of the reports,
this review included well over 200 reports and
summaries prepared by or on behalf of 22 states.
To the extent available through NAIC, we present
updates pertaining to regulatory oversight through
November 1999. In addition, we conducted follow-up
work of Year 2000 validation efforts at the same
17 state insurance departments on which we
reported in April.9

Our follow-up work for the 17 states included (1)
a second survey administered in July 1999 that
covered their Year 2000 oversight activities,
including examination efforts in the area;10 (2)
site visits to 6 of the 17 states to interview
regulatory officials and review guidelines for
conducting Year 2000-related examinations as well
as available reports, summaries, and workpapers
covering companies' Year 2000 preparations; and
(3) additional contacts in October 1999 with
regulatory officials from each of the 17 states
for a final update of their Year 2000-related
examination efforts. The domiciliary companies of
these 17 state insurance departments collectively
accounted for 76 percent of the insurance sold
nationally during 1998. See appendix I for a list
of the 17 states and their respective domiciled
insurers' market shares.11

Our review of examination-related documents was
limited by restrictions at two of the states we
visited and at NAIC, which had examination report
summaries for the same two states. For one state,
regulatory officials cited an existing law that
restricted access to its examination reports and
related workpapers by external parties. Regulatory
officials for another state explained that, under
special agreements reached with insurers prior to
conducting Year 2000 examinations, their
department was precluded from sharing examination-
related documents with other states or external
entities without the consent of the companies
involved. Although one of the two states provided
some limited access to their examination
documents, we were unable to independently verify
the adequacy of Year 2000 examination efforts for
either state.

To determine the status of the insurance
industry's Year 2000 readiness, we surveyed all 50
state insurance departments on the state of
readiness of their domiciled companies as of
September 30 and the extent of the departments' on-
site verification efforts. For each state, NAIC
provided a Year 2000 contact to assist us in this
survey effort. Appendix II contains a copy of the
Year 2000 survey we administered to the states.
With NAIC's assistance, we obtained a 100-percent
response rate from the 50 states.

To obtain updated insights regarding the
industry's Year 2000 outlook pertaining to
readiness and liability exposure issues, we
contacted representatives of key rating companies,
including A.M. Best Company, Standard and Poor's,
Moody's Investors Service, and Weiss Ratings, Inc.
We also obtained and reviewed information from (1)
the Gartner Group, which is a business and
technology advisory company that conducts research
on the global state of Year 2000 readiness; (2)
the American Academy of Actuaries, which is a
public policy organization that presents actuarial
analyses, comments on proposed federal regulation,
and works with state officials on insurance-
related issues; and (3) the Casualty Actuarial
Society, which is a professional organization to
advance knowledge of actuarial science applied to
property, casualty, and similar risk exposures. In
addition, we spoke to representatives of Milliman
and Robertson, Inc., an actuarial and consulting
firm, and the American Bar Association.

We performed our work between June 1999 and
December 1999 in accordance with generally
accepted government auditing standards. We
requested comments on a draft of this report from
NAIC. Its written comments, which are included in
appendix III, are discussed near the end of this
letter.

NAIC and State Insurance Regulators Have
Accelerated Their Oversight of the Industry's Year
2000 Readiness
Since March 1999, NAIC has stepped up its Year
2000 efforts by (1) issuing expanded guidance to
state regulators on how to examine companies'
preparedness and (2) encouraging state regulators
to do on-site validation reviews of companies with
the greatest potential public impact. NAIC reports
that many of the nation's state regulators have
also made substantial progress in conducting Year
2000 validation reviews. They were projected to
complete, by the end of November, on-site Year
2000 reviews for 91 percent of the nationally
significant companies that accounted for about 84
percent of the direct premiums written by
life/health and property/casualty insurers in
1998, according to NAIC.

Despite this progress, uncertainties remain
regarding the extent that on-site validation
reviews have been conducted for some states'
companies, including some major health insurers
and other segments of the insurance industry, such
as HMOs and managed care organizations. In
November 1999, NAIC was still in the process of
quantifying the extent to which on-site
verification was conducted at some of the major
health insurers that did not fall into the
category that NAIC had designated as nationally
significant and at the larger managed care
organizations, which had not been specifically
covered by NAIC's earlier efforts.

NAIC Has Stepped Up Its Efforts to Encourage
States' Validation of Reported Year 2000
Information
After we reported on the insurance industry's Year
2000 readiness in March and April, 1999, NAIC
stepped up its efforts to facilitate state actions
to verify insurers' reported information on their
Year 2000 preparations. For example, one
undertaking involved NAIC's provision of expanded
examination guidance for assessing companies' Year
2000 preparations and related training. Another
important part of NAIC's stepped up efforts has
been its initiative that was aimed at prioritizing
companies for review and encouraging states to
perform on-site validation reviews. With only 9
months remaining before 2000 and 5,247 state-
regulated insurance companies to account for, NAIC
developed a pragmatic approach of focusing on the
companies with the greatest potential impact on
the public if they were to experience major
computer problems. NAIC also worked with the
states and encouraged them to implement this
focused approach.

Enhanced Guidance for Examining Year 2000
Readiness
In April 1999, NAIC provided the states with an
enhanced version of the Financial Examiners
Handbook, which provided additional guidance for
performing Year 2000 readiness reviews. According
to NAIC, the guidance was borrowed from audit
programs developed by the Federal Financial
Institutions Examination Council12 for federal
examiners' reviews of the Year 2000 readiness of
U.S. financial institutions and a few of the state
insurance departments that had been especially
active in their Year 2000 oversight.

NAIC also contracted for the services of a
national consulting firm to develop and provide
training to help state examiners better understand
the review procedures and assist them in
incorporating the procedures into their
examinations. According to an NAIC official, this
2-day training, which was provided during the
latter part of April in Atlanta, Chicago, and
Denver, was attended by examiners representing
almost 20 states. Compared to the timing of
guidance provided by the banking and securities
regulators, such Year 2000-related guidance and
training would be considered late. However, we
were told that this training and guidance were
timely enough to be useful for some state
insurance departments because they did not start
their targeted Year 2000 examination 13 process
until mid-1999.

NAIC's Year 2000 Initiative Focusing on Nationally
Significant Companies
In March, NAIC's Year 2000 Industry Preparedness
Task Force launched an initiative that was
intended to (1) encourage states to perform on-
site validation reviews and (2) determine the
extent to which the states had verified the
insurance industry's Year 2000 readiness. The
initiative focused on life/health and
property/casualty insurance companies that NAIC
had designated as nationally significant. This
designation included 1,161 companies, located in
44 states and the District of Columbia, that were
responsible for almost $650 billion in total
premiums written during 1998.14

According to NAIC information, the insurance
industry is relatively concentrated, with
nationally significant companies representing
approximately 86 percent of the premiums written
for the life/health and property/casualty segments
in 1998 and 27 percent of the 4,325 companies in
the two insurer segments. It is also noteworthy,
however, that many insurers that far exceeded
NAIC's criteria for the level of direct premiums
written were not considered nationally significant
because they did not meet the second criteria of
being licensed in 17 states or more. These
companies tended to conduct a significant amount
of business on a more localized rather than
national basis. We noted, for example, that 36
life/health insurers and 195 property/casualty
insurers that each wrote more than $100 million in
direct premiums during 1998 were not covered by
NAIC's nationally significant designation.

Over the past several months, NAIC's Year 2000
initiative focusing on nationally significant
companies has involved an ongoing, interactive
process with the individual state insurance
departments. In April, NAIC administered a survey
to all 50 states and the District of Columbia to
develop preliminary baseline information on state
efforts to conduct on-site examinations of
companies' Year 2000 compliance status,
particularly, the compliance of nationally
significant companies.15

From June through August, 1999, NAIC also
facilitated a series of conference calls that
included members of the Year 2000 Industry
Preparedness Task Force and, successively,
representatives from each of the 50 states.
According to NAIC officials, these conference call
discussions focused on each state's general
approach to overseeing the industry's Year 2000
preparations as well as its efforts to conduct on-
site examinations to verify the Year 2000
compliance status of its domiciled insurance
companies, particularly its nationally significant
companies. These conference calls were a key
mechanism that NAIC used to encourage states to
conduct more on-site verification reviews and
facilitate critical Year 2000 information-sharing
among the participating states regarding, for
example, licensed companies that wrote a large
amount of insurance in a state but were domiciled
elsewhere. Finally, these conference calls with
each of the states enabled NAIC to quantify on a
national basis the extent of the states' on-site
verification reviews of their nationally
significant companies.

To document its Year 2000 initiative, NAIC has
maintained a summary schedule of all nationally
significant companies with information on, among
other things, whether each company had been
subject to an on-site Year 2000 verification
review. A company was considered to have been
subject to an on-site verification review if the
state of domicile, or another state where the
company was licensed and doing business, indicated
to the task force that a review had been completed
or was scheduled to be completed by the end of
September. A company was also considered to have
been subject to an on-site verification review if
it had been indirectly covered or would have been
covered by the end of September through an on-site
review of an affiliated company with which its
computer system was fully integrated.

On the basis of information obtained from the
conference calls that were completed in August
1999, NAIC reported that 1,037 nationally
significant companies16 were to have been subject
to an on-site Year 2000 review, 106 were not to
have been subject to an on-site review, and the
remaining 18 discontinued operations during 1999.
The task force directed additional attention to
certain companies that were viewed to be of
particular concern. In a few cases, for example,
NAIC officials noted that a state reconsidered its
original position that an on-site verification was
not needed. In one situation, NAIC provided
financial assistance to facilitate the Year 2000
examination of a few key nationally significant
companies in a particular state. In another case,
a state agreed to conduct a targeted Year 2000
examination for a company domiciled in another
state that had no plans to conduct on-site
verification of the company.

By November 1999, NAIC reported that the number of
companies that would be subject to an on-site Year
2000 review by the end of November had increased
to 1,059 companies, and it reported that the
remaining 84 companies would not be subject to an
on-site review. NAIC officials explained that, for
the most part, the task force was satisfied with
the level of information available on the
remaining nationally significant companies that
were not to be subject to on-site verification.
NAIC has also taken the position that some
comprehensive surveys were thorough enough to be
equivalent to an examination. As we stated in our
April 1999 report and continue to believe, the use
of Year 2000 examinations is a principal mechanism
for verifying self-reported information and
providing assurances pertaining to the Year 2000
progress and readiness of regulated institutions.
The ability to provide such assurances is
particularly important for the industry's
nationally significant companies and others that
do a substantial amount of business.

In total, the number of companies that were to be
subject to an on-site Year 2000 review by the end
of November represented 98 percent of the direct
premiums written by nationally significant
companies. Regarding the total life/health and
property/casualty insurer segments, the identified
coverage through NAIC's initiative suggests that
companies that accounted for at least 84 percent
of the direct premiums written during 1998 had
been or were to have been subject to an on-site
Year 2000 review by the end of November. The
extent of on-site validation for the rest of the
industry (including large HMO and HMDI companies),
which accounted for an additional $137 billion in
direct premiums written during 1998, was still
unknown as of November 1999.

NAIC's Current Focus on Managed Care Organizations
In October 1999, NAIC reported that the Year 2000
Industry Preparedness Task Force had recently
expanded the scope of its review process to
include the nation's largest managed care
organizations together with all of the Blue Cross
and Blue Shield Plans, which represented some of
the major health care insurers not designated as
nationally significant.17 NAIC estimated that the
companies that fall into this category represent
about 80 percent of the direct premiums written
for all HMOs and HMDIs in 1998. The first task
force conference to collect and summarize
information on the status of on-site Year 2000
reviews for these managed care organizations was
held in November 1999. NAIC officials acknowledged
that with the Year 2000 deadline close at hand,
the task force's main objective was to quantify
the extent of on-site verification that had been
completed and identify any companies that may be
of regulatory concern.

State Insurance Regulators' Efforts to Validate
Industry Year 2000 Readiness Through Targeted
Examinations Increased During 1999
During 1999, most of the 17 state insurance
regulators we reviewed increased their efforts to
conduct targeted examinations that were aimed at
verifying companies' Year 2000 readiness. In the
beginning of the year, 10 of the 17 states were in
the process of conducting targeted examinations or
were planning to conduct such examinations, and
the remaining 7 states were either not planning to
conduct such examinations or were uncertain
whether they were going to conduct them, as shown
in table 1. By June 1999, the 17 states were
either in the process of conducting targeted
examinations or indicated that they planned to
conduct them. Some states that started targeted
Year 2000 examinations in the middle of 1999 used
expedited approaches, such as suspending their
regular financial examination process to devote
their examiners solely to targeted Year 2000
examinations or hiring one or more private
consultants to conduct such examinations in a
short period of time.

Table 1:  Status of Targeted Year 2000
Examinations to Validate Company Readiness in 17
States
Status                         As of  As of  As of
                             1/31/99 6/30/9 9/30/9
                                          9      9
Fieldwork for planned              0      0      9
targeted examinations
completed and reports
finalized
Targeted examinations in           8     13      8
progress
Targeted examinations              2      4      0
planned but not started
State expressed                    3      0      0
uncertainty regarding the
need for targeted
examinations
No plans to conduct                4      0      0
targeted examinations
Total                             17     17     17
Source: GAO interviews with state officials.

By the end of September, all of the 17 states we
reviewed had either completed or were in the
process of completing their targeted Year 2000
examinations.  Specifically, eight states had
finished the fieldwork for over one-half of the
companies that were targeted to be examined, but
corresponding reports for many of these
examinations were still pending. We were told that
one state was waiting for the completion of all
its examination fieldwork before issuing a single
summary report for all of its domiciled companies,
rather than issuing separate reports for each
company. A few states projected that they would
not complete their Year 2000 examination process
until the end of November, leaving little time for
correcting identified deficiencies before the date
change.

In conducting targeted Year 2000 examinations, the
states generally said they used the enhanced
guidance that NAIC provided in April or guidelines
developed by contractors, or in some cases both
guidance, to improve the quality and consistency
of their validation efforts. Our review of
guidelines provided by the six states we visited
indicated that they covered all key areas of Year
2000 conversion cited in our Assessment Guide18 as
well as those areas cited in the federal banking
regulator examination guidelines. In turn, our
review of reports available for 22 states'
targeted Year 2000 examinations indicated that the
reports systematically addressed all major
guideline components, and that they gave a
particular emphasis to companies' contingency
planning efforts.19

Coverage of Companies Through On-site Examinations
Like the banking industry, insurers depend on date-
sensitive calculations involving, for example,
annuities, policy renewals, and claims processing.
Recognizing their industry's high level of date
sensitivity, the nation's banking regulators have
completed multiple rounds of on-site examinations
for all financial institutions under their
jurisdiction.20 Although 6 of the 17 states we
reviewed indicated that their overall goal was to
conduct 1 round of targeted examinations for all
of their domiciled insurance companies, the
remaining 11 states had established varying goals
regarding which and how many companies would be
subject to targeted Year 2000 examinations. These
states' goals were to cover from 6 to 76 percent
of the domiciled companies within their
jurisdictions. For the most part, these goals
attempted to cover the states' nationally
significant companies. Two exceptions were states
that had not planned to conduct on-site
examinations for more than one-half of their
nationally significant companies. One state
official explained that a decision was made at the
commissioner's level that the limited time and
staff resources available dictated that the state
focus its on-site verification efforts on a select
number of key companies.21

Some state officials believed that insurance
companies had a clear incentive to become Year
2000 ready to maintain their business in a highly
competitive industry and, therefore, did not
require a great deal of regulatory prodding in the
area. Several state regulatory officials also
explained that they believed that available self-
reported information from companies was sometimes
sufficient to satisfy regulatory needs, and that
this information obviated the need for an on-site
verification review. We found that the extent of
such information available to state regulators
ranged from one department that had, among other
things, access to required quarterly reports of
its companies' Year 2000 progress since 1998 to
one that relied primarily on company responses to
a few Year 2000 surveys. The latter is of
particular concern since the absence of
corroborating evidence obtained through on-site
verification or multiple contacts with companies
to track their progress diminishes the extent of
regulatory assurances about Year 2000 readiness. A
few state officials also explained that some small
companies were not sufficiently computer dependent
(e.g., a company may use a single personal
computer to conduct business) to experience major
problems with the Year 2000 date change and
warrant the need for an on-site verification.

As we reported in April 1999, 2 of the 17 states
we reviewed were comparatively more active in
their efforts to ensure that insurance companies
become Year 2000 ready. These states opted to
forgo on-site examinations for some of their
domiciled companies because of a comfort level
that officials explained was derived from their
close tracking of or continuous interaction with
certain companies over time. In some cases, they
chose instead to conduct targeted Year 2000
examinations for certain insurance companies that
were licensed to write business but were not
domiciled in the state. As of September 30, 1 of
the 2 states had examined as many as 378 such
licensed companies, and the other state had
examined 29. Some of the states of domicile for
these companies, as well as the Year 2000 Industry
Preparedness Task Force, ultimately ended up
relying on many of the targeted Year 2000
examinations conducted by the two licensing states
to verify their readiness.

Available Information Continues to Suggest a
Positive Outlook for the Industry, but Some
Uncertainties Remain
Information gathered by NAIC's Year 2000 Industry
Preparedness Task Force and responses to our
survey of 50 states on U.S. insurers' Year 2000
readiness indicate that regulators have
considerable confidence in the insurance
industry's readiness for Year 2000. In October,
NAIC estimated that 3 percent of the nation's
nationally significant insurers had not made their
systems Year 2000 ready. State regulators'
responses to our survey indicated that 78 percent
of all domiciled insurance companies were
considered to be Year 2000 ready and making
satisfactory progress in their contingency
planning activities as of September 30. Of the
remaining 22 percent of these companies, 17
percent, although not completed with their
preparations as of September 30, were expected to
become ready by December 31. Uncertainties about
the status of the remaining 5 percent were largely
unresolved at the time of our survey.

With one exception, ratings companies and
consultants we contacted were generally optimistic
about the insurance industry's Year 2000 outlook.
However, some industry observers have raised
questions about liability exposure issues, such as
the coverage of Year 2000 remediation costs. They
have also expressed concerns about insurance
companies' inability to accurately report their
potential Year 2000-related liability exposures on
their financial statements.

NAIC and State Regulators Remain Confident About
the Insurance Industry's Readiness for Year 2000
In an October 1999 press release, NAIC's Year 2000
task force reported that information obtained from
its initiative focusing on nationally significant
insurers indicates that the insurance industry is
expected to experience little disruption when 2000
begins. The task force pointed out that state
assessments of insurers' readiness have identified
a relatively small number of insurers for follow-
up and continued monitoring. It also noted that
regulators were expecting few problems in the new
year, estimating that only 3 percent of the
industry's nationally significant companies had
not made their systems Year 2000 ready. The task
force chairman further stated that efforts by
individual states indicated that most of the
companies that were not designated as nationally
significant were also on schedule, but data on the
extent of validation efforts conducted for these
companies had not been compiled at the time of our
fieldwork in November.

Our Survey of 50 States
Our review of the 17 states previously discussed
was intended to provide information on the status
of regulatory oversight efforts. Separate from
this effort, we conducted a survey of all 50 state
insurance departments to obtain information on the
Year 2000 readiness of insurance companies
domiciled in each state as of September 30.
Appendix IV provides the number of insurance
companies by type of company identified by the 50
state respondents. For purposes of the survey, a
company was to be considered Year 2000 ready if
the regulator was satisfied that the company had
made adequate efforts to complete Year 2000
remediation, testing, and implementation
activities for all mission-critical systems in
preparation for 2000. Although our survey
collected data on companies' Year 2000 contingency
planning activities, we did not specify that
companies should have completed such activities to
be considered Year 2000 ready. This definition of
Year 2000 readiness was consistent with NAIC's
industry expectation that the last 6 months of
1999 should be used by companies to focus on less
critical applications and systems and develop
contingency plans in the event of a failure.

Individual states were to base their responses to
our questions about companies' readiness and
contingency planning activities on information
obtained through their Year 2000 oversight
efforts. State oversight efforts pertaining to
Year 2000 could include (1) surveys administered
to obtain information on companies' Year 2000
preparations, (2) required Year 2000 disclosures
with financial report filings, and (3) on-site
verification reviews conducted as part of the
state's regular financial examination cycle or its
targeted Year 2000 examination program. State
responses to survey questions on the number of
Year 2000 examinations conducted in 1998 and 1999
indicated that states were engaged in varying
levels of on-site verification. Table 2 shows the
proportion of states' domiciled companies that, as
of September 30, had been subject to an on-site
verification review of their Year 2000 readiness.

Table 2:  Extent of On-site Verifications
Conducted by States
Percentage of state's domiciled         Number of
companies that were subject to             states
on-site verification
examinations
Less than 25 percent                           11
25 to 50 percent                               10
51 to 75 percent                               18
Greater than 75 percent                        11
Total                                          50
Note 1: Five states also indicated that, in some
cases, they had relied on on-site verification
examinations conducted by another state.
Note 2: On-site verification examinations include
Year 2000 coverage during regular examinations as
well as targeted Year 2000 examinations conducted
during 1998 and 1999 (through Sept. 30).
Note 3: Information presented excludes companies
whose Year 2000 readiness status was not viewed by
the states as relevant, such as companies in
liquidation, companies operating without computer
systems, and shell companies with no business.
Source: State responses to GAO survey.

State Survey Responses Indicated Considerable
Confidence in the Industry
Our survey indicated that state regulators had
considerable confidence about the adequacy of the
insurance industry's preparation for the Year 2000
date change. Seventy-eight percent of the states'
domiciled insurance companies were considered Year
2000 ready as of September 30 (see fig. 1). State
regulators also generally viewed these insurers as
making satisfactory progress in their contingency
planning efforts.

Figure 1:   Status of Insurance Industry's Year
2000 Readiness, as of September 30, 1999

Note: This total excludes companies whose Year
2000 readiness status was not viewed as relevant,
such as companies in liquidation, companies
operating without computer systems, and shell
companies with no business.
Source: State responses to GAO survey.

The remaining 22 percent of the states' domiciled
insurance companies represented companies that
were (1) not Year 2000 ready by September 30, but
that were projected to be ready by December 31;
(2) not subject to categorization due to the lack
of adequate information to determine their
readiness status; or (3) considered at risk of not
being ready. Some uncertainties exist, specific to
the companies included in the last two categories,
about their ability to become fully ready by the
end of the year. These categories are discussed in
the following sections.

Seventeen Percent of Companies Were Not Year 2000
Ready by September 30 but Were Projected to be
Ready by December 31
State responses indicated that 17 percent of their
domiciled insurance companies were not Year 2000
ready by September 30 but were projected to be
ready by December 31. These companies missed
NAIC's milestone calling for all mission-critical
systems to be Year 2000 ready by June 30, 1999.
States estimated that on average, 84 percent of
the companies progressing toward becoming Year
2000 ready by December 31 were considered to be
making satisfactory progress in their contingency
planning efforts, which suggests that the
remaining companies were not making adequate
progress. This lack of adequate progress is of
particular concern for companies that may be fully
preoccupied with remediating their mission-
critical systems during the last quarter of the
year, leaving them little time to attend to their
contingency plans. These companies would also have
an increased likelihood of a system failure if any
of their compliant mission-critical systems happen
to be integrated with less critical systems that
have not been fully remediated.

Viable contingency plans are especially important
for larger companies that may have complex systems
that were not projected to be Year 2000 ready
until the end of the year. Survey responses
indicated that while 887, or 83 percent, of the
companies not ready by September 30, but projected
to be Year 2000 ready by December 31, were small,
the remaining 188 companies each wrote $100
million or more in net premiums nationwide, as
shown in table 3.

Table 3:  Companies Projected to Be Year 2000
Ready by December 31, 1999, by Type and Size
Type                     Large  Medium Small Total
Property/casualty            5      70   416   491
Life/health                 12      42   182   236
HMOs (including              4      50   114   168
managed care
organizations)
Other (e.g.,                 0       5   175   180
fraternal
organizations,
title companies)
Total                       21     167   887 1,075
Note: Size is based the estimated net premiums
written nationwide, with large companies writing
more than $1 billion, medium companies writing
$100 million to $1 billion, and small companies
writing less than $100 million.
Source: State responses to GAO survey.

Adequate Information Not Available for 4 Percent
of Companies
The states indicated that as of September 30 they
lacked sufficient information to determine the
Year 2000 readiness of 4 percent of their
domiciled insurance companies. Specifically, 14
states placed 235 companies in this category. Many
of these states indicated that they had some self-
reported information from these companies, such as
responses to the state's Year 2000 surveys or the
company's Management Discussion and Analysis Year
2000 disclosures.22 However, these states believed
that they could not determine their readiness from
information that had not been corroborated by an
on-site verification review. One state official,
for example, explained that although survey
responses did not indicate any reason to question
the prospective readiness of these companies, on-
site examinations had not been performed to verify
survey information or determine the companies'
readiness. On the basis of similar reasoning, an
official from another state noted that he was
waiting for the results of ongoing examinations at
some companies before reaching any conclusions
about their readiness.

One situation involved a state where the insurance
department was responsible for monitoring the
annual statements submitted by HMOs but depended
on another state department for survey and
examination information. The insurance department
was told that a Year 2000 survey had been
administered to the HMOs, but their responses had
not yet been received. Therefore, the insurance
department identified these HMOs as companies for
which it did not have adequate information to
determine their Year 2000 readiness.

One Percent of Companies Were Viewed at Risk of
Not Being Year 2000 Ready by December 31
In response to our survey, the states reported
that about 1 percent of their domiciled insurance
companies were viewed as at risk of not being Year
2000 ready by the end of the year.23 Specifically,
13 states identified 49 companies, consisting
mostly of small property/casualty insurers, that
they considered at risk of not being ready by the
end of the year, as shown in table 4. Thirty-eight
of the companies considered at risk were small, 9
were medium, and the remaining 2 were large HMOs.

Table 4:  Companies Viewed at Risk of Not Being
Ready by December 31, 1999, by Type and Size
Type                     Large  Medium Small Total
Property/casualty            0       4    20    24
Life/health                  0       3     9    12
HMOs (including              2       2     8    12
managed care
organizations)
Other (e.g.,                 0       0     1     1
fraternal
organizations, title
companies)
Total                        2       9    38    49
Note: Size is based on the estimated net premiums
written nationwide, with large companies writing
more than $1 billion, medium companies writing
$100 million to $1 billion, and small companies
writing less than $100 million.
Source: State responses to GAO survey.

On average, states estimated that 57 percent of
these at risk companies had not made satisfactory
progress in their contingency planning efforts as
of September 30, 1999. Virtually all of the states
that identified companies as at risk of not being
Year 2000 ready by the end of the year noted that
they would continue to focus on the adequacy of
these companies' contingency plans during the last
quarter of 1999.

     Other actions the states planned to take to
deal with at risk companies included conducting
management conferences and requiring monthly Year
2000 progress reports. In a few isolated cases, a
state had resorted to or was planning to resort to
enforcement actions.

Regulators Have Slightly Lower Confidence in the
Year 2000 Readiness of HMOs
In reviewing state survey responses regarding the
Year 2000 readiness of companies by type, we found
that states identified a slightly lower level
proportion of HMOs considered to be Year 2000
ready when compared to insurers in other
categories. As of September 30, 1999, 69 percent
of the states' companies classified as HMOs,
including managed care organizations, were
considered Year 2000 ready. Of the remaining 31
percent, 23 percent had mission-critical systems
that were not Year 2000 ready as of September 30
but that were projected to be ready by December
31, 6 percent were not subject to categorization
due to the lack of adequate information, and 2
percent were considered at risk of not being ready
by December 31. In contrast, 72 to 80 percent of
insurers in the property/casualty, life/health,
and other insurer categories were considered Year
2000 ready. Appendix V provides a graphic that
compares the readiness status of companies by type
of insurer.

According to a task force official, health
insurers represent one area that remains
vulnerable because such insurers depend on
hospitals and doctors' offices becoming Year 2000
ready. A recent report issued by the President's
Council on Year 2000 Conversion states that many
health care providers and managed care
organizations continue to exhibit troubling levels
of readiness.24 The report refers to July/August
survey data indicating that (1) only 40 percent of
the health care providers and organizations
reported that they were Year 2000 ready and (2)
roughly 25 percent of the organizations did not
have documented Year 2000 plans.

In July 1999, we reported that many surveys had
been completed in 1999 on the Year 2000 readiness
of health care providers, but none provided
sufficient information with which to assess the
Year 2000 status of the health-care-provider
community.25 We later testified in September 1999
that the Health Care Financing Administration,
with assistance from a contractor, performed a
Year 2000 risk assessment of 425 managed care
organizations. This June 1999 risk assessment
identified 22 percent of the organizations as
being high risk, 74 percent as medium risk, and 17
percent as low risk.26 During our fieldwork in
November, we were told that NAIC was in contact
with the Health Care Financing Administration to
determine whether any of the managed care
organizations assessed by the agency overlapped
with those that were regulated by the state
insurance departments.

Other Sources Are Generally Positive About
Insurers' Year 2000 Preparedness Efforts but Are
Uncertain About Liability Exposure Impacts
The industry observers we contacted generally
maintained a favorable view of the insurance
industry's Year 2000 preparedness efforts, but
they continued to express uncertainty over
potential costs associated with Year 2000-related
liability exposures. With one exception, rating
companies and consultants with whom we spoke have
remained confident about the industry's efforts to
prepare and become ready for 2000. For instance,
the Gartner Group continues to place the insurance
industry among the industry leaders in becoming
Year 2000 ready, on the basis of its August
report. Likewise, several rating companies we
contacted, including Standard and Poor's; A.M.
Best; and Moody's, indicated that, as of October,
they had not downgraded any insurer's rating due
to Year 2000 readiness issues.

One rating firm, Weiss Ratings, Inc., tempered the
generally optimistic view of readiness in the
industry by reporting that 13 percent of the
companies responding to its survey had made
inadequate progress in their Year 2000
preparations. The response rate to this June 1999
survey was about 19 percent.27 While Weiss Ratings,
Inc., considered a company's progress to be
inadequate if its mission-critical systems were
not renovated and tested by August 1999, it also
indicated that those companies viewed to be making
inadequate progress still had a good chance of
achieving Year 2000 compliance in the time
remaining.

Considerable uncertainty remains concerning the
potential magnitude of insurers' Year 2000-related
liability exposures. In our April report, we noted
that insurers' liability exposures could not then
be reasonably estimated because, among other
factors, a claims history for the event did not
exist and questions about key legal issues that
could affect insurance policy coverage were still
unresolved. Since then, the industry observers we
contacted have continued to express uncertainties.

The rating companies we contacted in October
indicated that it was still too early to tell how
liability exposures might affect insurance
companies. For this reason, the rating companies
had not factored liability exposures into their
ratings. One actuarial consulting firm estimated
that costs from Year 2000-related claims and legal
expenses among U.S. property/casualty insurers
could range between $15 billion and $35 billion.
The firm acknowledged that its estimates were
based on several assumptions associated with
claims and legal outcomes that have not yet been
realized.28 The industry observers we contacted
generally said that insurance companies will not
likely be in a position to report their potential
Year 2000-related liability exposures on their
1999 financial statements, because their liability
exposures are not yet reasonably estimable due to
uncertainties over claims and legal outcomes.

Legal debates over insurance coverage for Year
2000-related mishaps, as well as for costs to
avoid such mishaps, have yet to be fully resolved.
Our previous report29 described some of the legal
debates associated with coverage for Year 2000-
related problems and damages, including the
coverage-related issues of "fortuity" and
"triggers." For example, it is not clear whether a
Year 2000-related loss would be considered a
fortuitous event covered by insurance, rather than
an expected event that may not be covered. For
some types of policies, coverage also depends on
what event triggers coverage. Specifically,
questions arise when coverage was activated for a
particular policy. Other debates focus on whether
an insured party that takes remedial action to
reduce its vulnerability to Year 2000-related
problems may recover remediation costs under a
particular policy.

The Y2K Act, enacted in July 1999, does not
directly address many of the unresolved legal
issues that could affect insurers' potential
liability exposures.30 The primary purposes of the
act include facilitating alternative modes of
dispute resolution, limiting certain liabilities
for Year 2000-related claims, and providing pre-
Year 2000 remedial measures aimed at reducing an
insured's vulnerability to Year 2000-related
mishaps. The act also sets forth procedural
requirements for class action suits and
affirmative defenses for temporary noncompliance
with certain federal standards caused by a Year
2000-related problem. The act, however, does not
contain substantive standards to guide courts in
deciding whether Year 2000-related mishaps or
remediation costs should be covered.31 Such issues
will principally be a matter of state law. Some
current cases involving insurance coverage
disputes and additional provisions of the Y2K Act
are described in appendix VI.

Conclusions
Since we first expressed concerns about the
states' regulatory oversight of the insurance
industry in March 1999, NAIC actively emphasized
the value of state regulators' validating
insurance companies' Year 2000 preparations
through on-site examinations, particularly those
undertaken by nationally significant insurers. We
also found that, partly in response to this
emphasis, some states have increased their efforts
to conduct on-site examinations of their domiciled
insurance companies' Year 2000 preparations. Even
with this increased emphasis, however, not all of
the nation's insurance companies will be subject
to an on-site verification review.

Gaps in Year 2000 verification coverage of the
insurance industry can be attributed to several
factors. One factor has been the late start of
some states in conducting on-site verification
reviews and the resulting need for them to focus
on the potentially higher impact companies rather
than conducting examinations of all domiciled
insurance companies. Another factor has been
regulators' belief that, in some cases,
comprehensive surveys were acceptable substitutes
for examinations. Differing regulatory
perspectives have constituted yet another factor
contributing to state decisions to forgo on-site
examinations for some companies. Such perspectives
ranged from satisfaction with the adequacy of off-
site monitoring in a few states that had closely
tracked the progress of their companies over the
last few years to the view in a few other states
that Year 2000 readiness would likely be
adequately covered by insurers motivated to remain
competitive without regulatory prodding. Finally,
insurance regulators have indicated that some
small insurance companies are not sufficiently
dependent on computers to experience major
problems with the Year 2000 date change.

The strategy promulgated by NAIC to focus on
nationally significant companies appears
reasonable given the large number of state-
regulated insurance companies subject to oversight
and the limited time remaining before 2000.
However, states' generally late start in assuming
a more proactive role regarding Year 2000 has
affected their ability to complete their
regulatory oversight of all the insurers they
supervise. As of mid-November, for example, some
states had not finished the planned on-site
validation process for their companies, and NAIC
was still in the process of collecting information
about states' regulatory assessments of the
nation's largest managed care organizations and
major health insurers not designated as nationally
significant.

In addition, uncertainties exist about the
readiness outcome for the 4 percent of the
companies for which regulators did not have
sufficient information, and 1 percent of the
companies that regulators viewed at risk of not
being ready by December 31 but were closely
monitoring. Although they were projected to be
ready by the end of the year, questions also
remain unresolved regarding whether all of the 17
percent of the insurance companies that were not
ready as of September 30, 1999, can complete all
conversion activities to become fully compliant
within the remaining time. Lastly, and arguably
outside of the regulators' control, uncertainties
regarding insurers' Year 2000 liability exposures
continue to represent an area of concern that is
being monitored by rating companies, and other
industry observers, that can affect the overall
Year 2000 outlook of the insurance industry.

In summary, the intensive regulatory activity of
the past several months provides additional
support for the level of confidence that
regulators place on the insurance industry's Year
2000 preparations and their belief that most
policyholders should not be concerned about their
coverage. However, as previously indicated,
remaining gaps in the on-site verification of
insurance companies' Year 2000 readiness and
unfinished regulatory efforts in the area leave
uncertainties about the self-reported status of
some companies' readiness. As a point of
comparison, banking regulators, who have conducted
multiple examinations of all their financial
institutions, can provide stronger assurances to
support their assertions that, with relatively few
exceptions, all banks were Year 2000 ready as of
September 30, 1999. Insurance regulators, on the
other hand, can say with some conviction that most
insurance is sold by companies that are Year 2000
ready or appear to be on course to become ready by
the end of the year. It remains true that a
portion of the industry had not completed its Year
2000 preparations by September 30, 1999, and that
some of these companies had not made satisfactory
progress in contingency planning. However, the
welcome news is that most consumers, especially
those insured by nationally significant companies,
can have greater confidence that their insurers
will likely provide uninterrupted services into
the new year.

Agency Comments and Our Evaluation
NAIC provided written comments on a draft of this
report. A reprint of NAIC's letter can be found in
appendix III.

NAIC disagrees with a perceived assertion that
because states have not performed on-site
verification of Year 2000 preparations of every
insurance company, it represents an inability of
states to complete their regulatory oversight of
the industry. As noted on page 22, we attribute
the inability of states to complete their
regulatory oversight of the industry to states'
generally late start in assuming a more proactive
role regarding year 2000. This late start, among
other factors, has caused some states to forgo
conducting Year 2000 on-site verifications for
some of their domiciled companies which has, in
turn, limited the level of assurances to support
regulatory assertions of their companies'
readiness.

We acknowledge on page 10 that, according to NAIC
information, 98 percent of the direct premiums
written by nationally significant companies had
been or were to be subject to an on-site Year 2000
review by the end of November. However, the extent
of on-site validation for the life/health and
property/casualty companies that were not
nationally significant and the other insurer
segments, which together represent 27 percent of
the total direct premiums written by the industry
as a whole, was unknown at the time of our review.
We continue to believe that most consumers,
especially those insured by nationally significant
companies, can have greater confidence that their
insurer will likely provide uninterrupted services
into the new year. The same level of assurances,
however, cannot be provided for the portion of the
industry that may not have been subject to an on-
site verification or for which the extent of on-
site verification is unknown.

NAIC believes that the draft report erroneously
overemphasized statistics based on the number of
insurance companies verified or the number of
states performing on-site examinations and
suggests that these statistics should focus on
information supplied by the NAIC and, more
emphatically, on premium-based statistics from our
survey of the 50 states. Premium-based information
supplied by the NAIC can be found throughout this
report, but specifically on pages 2, 6, and 10 as
it relates to the on-site verification of
nationally significant companies. We did not
provide premium-based statistics from our survey
primarily because we found inconsistencies when we
compared responses from many of the states to
similar information provided by NAIC. For example,
the total net premium volume written nationwide
reported by 15 states to have been subject to an
on-site verification was, on average, 126 percent
more than the total net premium volume written
nationwide identified by NAIC for each of these
states. Such inconsistencies may have been the
result of the states reporting gross premiums
rather than net premiums as our survey requested
or the result of duplicative counting for
companies that may have been subject to Year 2000
on-site verifications conducted during both a
regular and a targeted examination. Regardless of
the reasons for such inconsistencies, they
rendered the survey responses on net premiums
subject to on-site verification unusable for
reporting purposes.

NAIC also indicated that statistics based on the
number of companies impart an unnecessary negative
bias because a significant number of companies
either write a very small amount of premiums, are
so small as to have no risk of Year 2000 failure,
are dormant companies, or are companies that have
been acquired by or merged into other insurers
since 1998. To help minimize this type of bias, we
have made an adjustment to the table on page 15
that shows the percentage of states' domiciled
companies that were subject to on-site
verification examinations. Specifically, companies
whose Year 2000 readiness status was not viewed by
the states as relevant were excluded; this
covered, for example, companies in liquidation,
companies operating without computer systems, and
shell companies with no business. The effect of
this adjustment on the number of states falling
into each category of on-site verifications
conducted was minor.

As agreed with your office, unless you publicly
announce its contents earlier, we plan no further
distribution of this report until 10 days from its
date. At that time, we will provide copies to
Representative Thomas Bliley, Chairman, House
Committee on Commerce, and Senator Robert Bennett,
Chairman, and Senator Christopher Dodd, Vice
Chairman, Senate Special Committee on the Year
2000 Technology Problem. We will also provide
copies of this report to other interested parties
and will make copies available to others on
request.

Key contributors to this assignment are
acknowledged in appendix VII. Please call me or
Lawrence Cluff on (202) 512-8678 if you or your
staff have any questions.

Sincerely yours,

Richard J. Hillman
Associate Director, Financial Institutions
  and Markets Issues
_______________________________
1McCarran-Ferguson Act of 1945, 15 U.S.C. 1011-
1015.
2Insurance Industry: Regulators Are Less Active in
Encouraging and Validating Year 2000 Preparedness
(GAO/T-GGD-99-56, Mar. 11, 1999).
3We use the term "insurance companies" in the
broad sense to include all entities regulated by
state insurance departments, not just life/health
insurance companies and property/casualty
insurance companies.
4Year 2000: State Insurance Regulators Face
Challenges in Determining Industry Readiness
(GAO/GGD-99-87, Apr. 30, 1999).
5NAIC designates an insurance company as
nationally significant if, in any of the past 3
years, its annual gross premium writings was
greater than $30 million for a property/casualty
company or greater than $50 million for a
life/health company and the company is licensed in
17 or more states. NAIC uses this designation in
other processes, including a peer review of how
states analyze the financial standing of their
insurers.
6Insurance companies may sell insurance in one or
more states. However, each company is chartered,
or domiciled, in one state. This state acts as the
primary regulator for the company.
7Formed in 1998, the Year 2000 Industry
Preparedness Task Force is responsible for
addressing  industry remediation, compliance and
contingency planning, data confidentiality, and
data sharing among the regulators and working with
peer regulators to most efficiently address the
preparedness of insurance companies.
8Direct premiums arise from policies or contracts
issued by an insurance entity acting as the
primary insurance carrier. Such premiums are
defined as the contractually determined amount
charged by the reporting entity to the
policyholder for the effective period of the
contract based on the expectation of risk, policy
benefits, and expenses associated with the
coverage provided by the terms of the contract.
Direct premium figures do not include premiums
related to reinsurance transactions.
9GAO/GGD-99-87.
10We administered a similar survey in January 1999
during our initial review in the area.
11Market share information represents the
proportion of total net premiums written
nationally for all types of insurance accounted
for by all companies domiciled in a given state.
NAIC provided this information, which is based on
1998 financial data.
12The Federal Financial Institutions Examination
Council is an interagency body created by Congress
in 1979 to (1) prescribe uniform principles,
standards, and report forms for federal
examinations of financial institutions and (2)
make recommendations to promote uniformity in the
supervision of these institutions. The council's
membership is made up of the three federal bank
regulators and the regulators for credit unions
and thrift institutions.
13Targeted Year 2000 examinations focus exclusively
on reviewing companies' Year 2000 preparations and
their corresponding status of readiness.
14According to NAIC information, when all types of
insurance companies are included (not just
life/health and property/casualty), there were
5,247 companies that wrote over $895 billion in
direct premiums in 1998. While the companies
designated as nationally significant represented
only 22 percent of the nation's state-regulated
insurance companies, they wrote approximately 73
percent of the direct premiums written in 1998.
15Another stated objective was to develop
quantifiable information on the industry's
readiness for us in connection with our Year 2000
reviews.
16These nationally significant companies included
three for which NAIC believed the nature and scope
of reviews conducted by a state's vendor were
equivalent to an on-site review.
17These health care insurers tend to be
concentrated in one or a few states.
18Year 2000 Computing Crisis: An Assessment Guide
(GAO/AIMD-10.1.14, Sept. 1997).
19These reports were reviewed at five of the six
states we visited and at NAIC.
20Federal financial regulators report that they
have conducted Year 2000 examinations in each
insured financial institutions at least twice or,
in some cases, three or more times. On the basis
of such oversight efforts, the chair of the
Federal Deposit Insurance Corporation has assured
the public that, as of September 30, only 15 of
the nation's 10,292 insured banks were not ready
for the Year 2000.
21As of September 30, this state had conducted on-
site verification examinations for six companies,
which represented 3 percent of the net premium
volume written by the state's domiciled companies.
22Most state regulators required insurance
companies to include a disclosure of their Year
2000 status in the Management Discussion and
Analysis section of their financial report
filings.
23This figure is not necessarily inconsistent with
NAIC's estimate in October 1999 that 3 percent of
the nationally significant companies had not
completed their Year 2000 preparations. The
states' responses regarding companies that were
not projected to be ready by December 31, 1999,
included all companies.
24Fourth Summary of Assessment Information,
President's Council on Year 2000 Conversion,
November 1999.
25Year 2000 Computing Crisis: Status of Medicare
Provider Unknown (GAO/AIMD-99-243, July 28, 1999).
26Year 2000 Computing Challenge: HCFA Action Needed
to Address Remaining Medicare Issues (GAO/T-AIMD-
99-299, Sept. 27, 1999).
27Weiss Ratings, Inc., administered its survey on
June 30, 1999, to 5,654 insurance companies and
HMOs. From the survey results, it developed Year
2000 readiness ratings for respondent companies
that were separate from their financial safety
ratings.
28"Putting a Price Tag on the Millennium," Best
Review, Milliman and Robertson, Inc., June 1999.
29GAO/GGD-99-87.
30Public Law No.106-37, 113 Stat. 185, July 20,
1999.
31The act does require that all written contract
terms, including exclusions of liability and
disclaimers of warranty, are to be strictly
enforced unless those terms are contrary to any
applicable law in effect as of January 1, 1999.

Appendix I
Seventeen States Reviewed and Market Share of
Their Domiciled Insurance Companies
Page 31GAO/GGD-00-42 Insurance Regulators Have Acc
elerated Oversight
We focused part of our review on the same 17 state
insurance departments visited during our previous
review. These state departments' domiciled
insurance companies collectively accounted for
almost 76 percent of insurance sold nationally
during 1998. The departments represented the top
12 states, whose domiciled companies had combined
market shares ranging from 3.4 percent to 14
percent, and 5 states with relatively smaller
market shares ranging from 0.3 to 2.1 percent.

Table I.1:  States Reviewed and Market Share of
Their Domiciled Insurance Companies
                                   Market share of
                               domiciled insurance
States reviewed                          companies
Illinois                                     14.0%
New York                                      11.4
Connecticut                                    7.1
Pennsylvania                                   5.3
California                                     4.3
Ohio                                           4.3
Wisconsin                                      4.2
Massachusetts                                  3.9
Texas                                          3.7
Indiana                                        3.5
Michigan                                       3.5
Delaware                                       3.4
New Jersey                                     2.1
Iowa                                           1.8
Arizona                                        1.8
Oregon                                         1.0
Utah                                           0.3
Total                                        75.6%
Note: Market share information of each state's
domiciled insurance companies represents the
percentage of net premium volume written
nationwide ($703 billion) for all types of
insurance. A domiciled insurance company is one
that is incorporated under the laws of the state
in which it is doing business.
Source: Data extracted from information provided
by NAIC, based on its 1998 financial database.

Appendix II
GAO Year 2000 Survey Administered to the 50 States
Page 32GAO/GGD-00-42 Insurance Regulators Have Acc
elerated Oversight

Appendix III
Comments From the National Association of
Insurance Commissioners
Page 35GAO/GGD-00-42 Insurance Regulators Have Acc
elerated Oversight

Appendix IV
Universe of Domiciled Insurance Companies, by Type
Page 36GAO/GGD-00-42 Insurance Regulators Have Acc
elerated Oversight

Table IV.1:  Domiciled Insurance Companies, by
Type
Type                            Number  Percentage
                                    of          of
                                compan   companies
                                   ies
Property/casualty insurers      2,830a         46%
Life/health insurers            1,477b            
                                                24
HMOs (including managed care       714            
organizations)                                  12
Other (e.g., fraternal           1,179            
organizations, title companies)                 19
Total                           6,200c       101%d
aThis number includes 692 companies designated as
nationally significant.
bThis number includes 435 companies designated as
nationally significant.
cThis total excludes 267 companies whose Year 2000
readiness status was not viewed by the states as
relevant, such as companies in liquidation,
companies operating without computer systems, and
shell companies with no business.
dDoes not equal 100 percent due to rounding.
Source:  State responses to GAO survey.

Appendix V
Status of Companies by Type of Insurer, as of
September 30, 1999
Page 38GAO/GGD-00-42 Insurance Regulators Have Acc
elerated Oversight
Figure V.1:  Status of Companies by Type of
Insurer, as of September 30, 1999

Note:  The last bar graph labeled "Total"
represents the same information shown in figure 1
of this report.
Source: State responses to GAO survey.

Appendix VI
Current Court Cases Involving Insurance Coverage
of Year 2000 Issues and Highlights of the Y2K Act
Page 39GAO/GGD-00-42 Insurance Regulators Have Acc
elerated Oversight
Current Cases Involving Insurance Coverage
As previously noted, our April report described
some of the prevalent issues involved in coverage
disputes.1 Some recent court cases raised a new
issue involving businesses seeking to recover from
their insurers remediation costs they have
incurred in their efforts to help prevent or
reduce the costs of Year 2000-related mishaps. On
the basis of an interpretation of a provision
commonly referred to as the "sue and labor"
clause, in some of the cases, the insured entities
claimed that their insurance policies cover
remediation costs.

Some insurance policies, generally
property/casualty insurance policies, contain a
sue and labor provision accompanied by language
specifically obligating the insurer to contribute
to the expenses incurred by the insured in acting
under the provision. The sue and labor clause
originated centuries ago in ocean marine policies.
Its purpose was to encourage or require
policyholders to prevent or minimize imminent
potential loss or damage covered by the policy
without forfeiting recovery under the policy,
thereby reducing the insured loss. According to
one commentator, the classic example is the
captain who orders the crew to jettison cargo to
prevent the ship from foundering in stormy seas.
The value of the jettisoned cargo is recoverable
under the sue and labor clause.

At least three cases were brought in 1999 seeking
coverage of remediation costs under sue and labor
provisions. The insured plaintiffs in those cases
reportedly sought to recover remediation costs of
at least $400 million and $183 million. Cases of
this type contribute to the uncertainties
associated with insurers' potential liability
exposure.

Insurers opposing claims to recover remediation
costs have raised several arguments. For example,
they contend that remediation costs are covered
only if they were incurred to protect against an
insured loss, and that Year 2000 remediation costs
are not insured losses. Among other things, costs
recoverable pursuant to a sue and labor provision
typically involve remedial measures to prevent or
recover damage arising from covered events, such
as lightning, fire, or theft. Insurers contend
that Year 2000 remediation costs arise from a
defect or inherent limitation in a product and not
in connection with an insured event. In addition,
insurers assert that the majority of losses an
insured business seeks to protect against through
remediation measures are not losses attributable
to the physical loss or damage of insured
property, but instead are uninsured economic
losses, such as a decrease in market share, a loss
of investor or consumer confidence, or regulatory
sanctions. Another argument is that the loss to be
minimized or avoided must be actual or imminent.
According to this argument, the Year 2000 event
should not be considered imminent, because insured
entities have been aware of it for several years
and in many cases began remedial measures as early
as the mid-1990s. Insurers argue that such
remediation costs should be considered ordinary
costs of doing business.

The Y2K Act
The Y2K Act does not create any new causes of
action. Instead, for "Year 2000 actions," it
modifies existing state or federal procedures and
remedies concerning nonpersonal injury liability
arising from Year 2000 failures.2 Among other
things, the act (1) requires that notice of a Year
2000 claim be given to potential defendants before
a "Year 2000 action" is filed; (2) establishes
heightened pleading requirements; (3) sets caps
and limitations on punitive damage awards; and (4)
provides for the apportionment of damages, rather
than joint and several liability, except in cases
where it is found that the defendants acted with
specific intent to injure the plaintiff or
knowingly committed fraud.3 The act applies to any
"Year 2000 action" brought after January 1, 1999,
for an actual or potential "Year 2000 failure"
occurring before January 1, 2003.4 The following
is an overview of some provisions of the act that
could have a direct or indirect impact on the
amounts for which insurance companies may be
liable.

Most of the Y2K Act focuses on the litigation
process.5 Under the notice provisions, prospective
plaintiffs in a Year 2000 action (except for
claims for injunctive relief) must send a written
notice to each prospective defendant containing
information about the pertinent event and
including the remedy sought. Within 30 days after
receiving the notice, the prospective defendant
must provide each plaintiff with a written
statement describing what, if any, remediation
measures or alternative dispute resolution
processes would be acceptable. If the defendant
proposes a plan to remediate the problem, the
prospective plaintiff must allow the prospective
defendant an additional 60 days from the end of
the 30-day notice period to complete the proposed
remedial action before bringing suit. The purpose
of this 90-day notice requirement is to create a
procedure that might facilitate the parties'
resolution of the problem through voluntary
efforts or through alternative dispute resolution.

The Y2K Act also contains rules for pleading
affirmative defenses, damages, warranty and
liability disclaimers, proportionate liability,
and class actions. One purpose of the pleading
requirements is to reduce the potential for
frivolous claims by requiring the plaintiff in a
Year 2000 action to articulate certain bases for
the claim and remedy. Provisions of the act for
preserving warranties and contracts also are
intended to discourage frivolous lawsuits. As
previously discussed, the act generally requires
that all written contract terms, including
exclusions of liability and disclaimers of
warranty, are to be strictly enforced unless those
terms are contrary to any applicable state statute
in effect as of January 1, 1999.

The Y2K Act limits liability exposure and damages.
Some limitations depend upon whether the lawsuit
is a contract action or a tort action. For
example, in tort actions, the act provides for
proportionate liability, except with respect to
certain suits brought by consumers. Generally,
defendants will be liable only for that portion of
a judgment that corresponds to their proportionate
share of the total fault for the plaintiff's loss,
unless the defendants are found to have committed
fraud in connection with the Year 2000 problem or
to have specifically intended to injure the
plaintiff. Such a finding would render the
defendant jointly and severally liable.

Other limitations include the following: (1)
elimination of strict liability, (2) heightened
proof requirements as a condition for recovering
punitive damages and a cap on the amount of such
damages for individuals with net worth of less
than $500,000 and small employers, and (3)
limitations on the recovery of certain "economic
losses" of the plaintiff alleged in connection
with a tort claim. These losses, which include
lost profits, business interruption losses, and
consequential and indirect damages, may be
recovered only if a contract provides for their
recovery or the losses result directly from damage
to tangible real or personal property caused by
the Year 2000 failure. The limitation does not
apply to claims of intentional torts. For contract
actions, no category of damages may be awarded
unless such damages are allowed by the contract
expressly or, if the contract is silent on the
matter, under applicable state or federal law.

The act contains a special provision that excludes
from damages the amount the plaintiff reasonably
could have avoided by utilizing any available or
reasonably ascertainable information "concerning
means of remedying or avoiding the Year 2000
failure involved in the action." Prospective
plaintiffs are provided with an incentive to take
reasonable steps to limit their damages. This duty
to mitigate is in addition to any such duty
imposed under state law. The duty is not absolute,
however. Where a defendant intentionally
misrepresents facts concerning the potential for a
Year 2000 failure in the "device or system used or
sold by the defendant" that caused plaintiff's
harm, the plaintiff will be relieved from this
statutory mitigation duty.

Depending upon the effects of the settlement
incentives and litigation-related limitations
contained in the Y2K Act, insurance liability
exposure could be less than would be the case if
liabilities for Year 2000 actions were determined
under less limiting state laws.  Whether an
insurance policy covers a particular Year 2000
event, however, could depend upon a number of
factors, including the extent to which state laws
and cases apply to insurance coverage litigation.

_______________________________
1GAO/GGD-99-87.
2However, the new law does not preempt state laws
that provide stricter limits on damages and
liabilities or afford greater protection in Year
2000-related lawsuits.
3While there will undoubtedly be additional
litigation, the first court to examine whether
insurance policies are subject to the Y2K Act
decided that the act was not intended to apply to
insurance litigation. American Guaranty and
Liability Insurance Co. v. Xerox Corp., Index No.
603/69/99 (N.Y. Sup. Ct., N.Y. County, July
1,1999).  Xerox, which had not provided notice
within the time limits provided in the insurance
contract, argued that the Y2K Act's prelitigation
commencement procedures prevailed over the
insurance contract notice provisions.  The court
rejected this argument, reasoning that Congress
did not intend to subject insurance litigation to
the requirements of the Y2K Act. In the court's
view, the Y2K Act was aimed at litigation
involving damages that directly result from Y2K
failures. The court noted that many of the
procedural requirements of the Y2K Act are
directed at providing an opportunity for the
parties to settle their differences by allowing a
period for the manufacturer, software provider, or
system operator to correct Y2K defects. The court
viewed these provisions as meaningless in
collateral  actions involving insurance
litigations.
4A "Y2K action" is defined in the Y2K Act as "a
civil action commenced in any Federal or State
court . . . in which the plaintiff's alleged harm
or injury arises from or is related to an actual
or potential Y2K failure, or a claim or defense
that arises from or is related to an actual or
potential Y2K failure." A "Y2K failure" is defined
in the Y2K Act as a failure by "any device or
system . . . or any software . . . to process, to
calculate, to compare, to sequence, to display, to
store, to transmit, or to receive Year-2000 date-
related data." Included in this definition are
failures (1) "to deal with or account for
transitions or comparisons from, into, and between
the years 1999 and 2000 accurately"; (2) "to
recognize or accurately to process any specific
date in 1999, 2000, or 2001"; or (3) "accurately
to account for the year 2000's status as a leap
year, including recognition and processing of the
correct date on February 29, 2000." The Y2K Act
does not apply to claims for personal injury or
wrongful death.
5The Y2K Act also contains protections for
homeowners who otherwise could be penalized should
a Y2K failure disrupt the country's payment
systems. If such an event were to prevent a
homeowner from timely making a mortgage payment,
the homeowner would be protected from foreclosure
unless payment is not made within the time period
contained in the act.

Appendix VII
GAO Contacts and Staff Acknowledgments
Page 42GAO/GGD-00-42 Insurance Regulators Have Acc
elerated Oversight
GAO Contacts
Richard J. Hillman, (202) 512-8678
Lawrence D. Cluff, ( 202) 512-8678

Acknowledgments
In addition to the persons named above, Evelyn E
Aquino, Gerhard Brostrom, Barry A. Kirby, May M.
Lee, Alexandra Martin-Arseneau,and Paul G.
Thompson made key contributions to this report.

*** End of Document ***