Setting the Standard
SRS has managed captives and other insurance vehicles for more than 25 years, and in that time, we’ve defined and operationalized the services a high-performing insurance company manager should provide to every client, no matter the size. Every decision we make is based on client needs and how best to serve them.
Rigorous Internal Controls and Compliance.
What makes a good captive manager? What does good service look like in the captive management industry? These aren’t easy questions to answer because “captive management” is not a well-defined service. Contracts tend to be long-term or evergreen, with little movement between managers. This means that an owner’s only frame of reference may be their experience with how the incumbent manager operates.
What should owners expect?
Your insurance company manager should be able to demonstrate it has a rigorous set of internal controls and compliance practices.
Right to the point. Prove it.
How do you know your potential insurance company manager has the internal controls and compliance practices in place to deliver consistent, reliable, high-quality service? Ask them to provide evidence of their commitment. Here’s where it gets a little tricky, though. How do you know that the processes they have in place are appropriate and effective? The truth is you don’t unless the evidence they provide follows a recognized standard.
Enter SSAE 18 / ISAE 3402 and why it matters
SRS is the first captive manager to make a global commitment to achieving the SSAE 18 / ISAE 3402 certification (Statement on Standards for Attestation Engagements No. 18), which is designed to evaluate and report on the controls and processes delivered by service organizations. It demonstrates that the company is capable of mitigating risks and protecting the interests of its clients.
SSAE 18 / ISAE 3402 is not specific to the insurance industry. It’s the standard for reporting on internal controls at companies providing outsourced services that affect another company’s financial statements. For those selecting an insurance company management firm, the certification provides evidence that the service provider has met stringent control standards and adheres to best practices. Some of the critical components included in the audit process include:
What it means for YOU
Data Privacy: Controls are Critical!
Protecting and maintaining the privacy of data is critical for all businesses today, but the insurance industry runs on data and lots of it. Depending on the type of captive, Personally Identifiable Information (PII) and Personal Health Information (PHI) may be needed for its operation.
The captive manager and anyone involved in receiving PII and PHI related to the captive must have the appropriate controls in place to protect the privacy of that data. The controls must comply with applicable data privacy regulations and to protect against liability for the captive.
How do you know that your captive manager has the appropriate controls in place? Ask your captive manager if they are following industry standards, such as NIST (National Institute of Standards and Technology) and/or ISO (International Organization for Standardization). If your captive is in a domicile that requires the captive insurance manager to have a Cybersecurity Framework, request a copy.