The NAIC Corporate Governance Annual Disclosure (CGAD) is a confidential report that an insurer or insurance group files each year with its lead state or domestic insurance regulator to explain how the company is governed, how its board operates, and how it oversees major risks. There is no fixed government form to fill in. Instead, you build a custom document that follows the structure set out in the NAIC CGAD Model Act #305 and the CGAD Model Regulation #306, both first effective for filings in 2016.
That freedom is what trips people up. Because you write the CGAD yourself, you decide the level of reporting, the order of the sections, and how much detail to give. Get the structure wrong and your regulator sends follow-up questions, asks for more material, or flags your filing during the next financial analysis cycle. The model framework has now been adopted in nearly every state, and the NAIC corporate governance page confirms it applies to insurers across the country.
Here is what this guide gives you:
- 📋 A plain-English breakdown of every required CGAD section and what to write in each
- ✍️ Word-for-word example entries from named insurers so you can see what real answers look like
- ⚖️ The exact statute, deadline, attestation rule, and penalty that govern your filing
- 🧭 Three full walkthroughs covering a single insurer, a large group, and a no-change update
- 🚫 The field-level mistakes that trigger regulator follow-up and how to avoid them
What the CGAD Is and Who Must File It
The CGAD is a yearly written disclosure of an insurer’s or insurance group’s corporate governance framework, board structure, management oversight, and risk controls. Its purpose, stated in Section 1 of Model Act #305, is to give the insurance commissioner a clear summary of how the company is run so the regulator can understand the governance framework. The report is treated as proprietary and trade-secret material, so it stays confidential and is not released to the public.
Every insurer domiciled in an adopting state must file, and the requirement reaches the whole insurance group. If you are part of a holding company system, you file at the group level with the lead state, which is identified through the procedures in the NAIC Financial Analysis Handbook. The Revised Statutes of Missouri show how a typical adopting state codifies this, requiring the CGAD before June 1 of each year.
The agency that receives your filing is your domestic state Department of Insurance, or the lead state if you file as a group. The statute that requires it is your state’s version of the model act. The deadline that governs it is June 1. The penalty that follows non-compliance is a daily fine set by your state. Each of these pieces connects: the statute creates the duty, the agency enforces it, the deadline sets the clock, and the penalty punishes a late or missing filing. The Virginia Corporate Governance Annual Disclosures article is one example of a state that codified the full framework, including its confidentiality shield.
One key point: smaller insurers are not exempt by size alone. Even an insurer not otherwise required to file must submit a CGAD if the commissioner requests one, under Section 3.C of the model act. So no insurer should assume it is permanently off the hook.
Before You Start: Documents and Information You Need
Gather your supporting material first. Because the CGAD lets you cross-reference existing filings, pulling these documents before you draft saves hours and prevents duplicate writing. Missing any one of them can force you to leave a section thin, which invites regulator questions.
- Board and committee charters. You need these to describe how each committee is governed; without them you cannot accurately state committee duties, and a vague description draws follow-up.
- Board roster with bios. You must show each director’s qualifications and experience; missing bios make the “board composition” section incomplete and weaken the filing.
- Bylaws. These confirm board size, leadership roles, and election rules; without them you risk stating facts that conflict with your governing documents.
- Most recent ORSA Summary Report. You can cross-reference it for risk management processes; if you cannot locate it, you must rewrite the risk section from scratch.
- Holding Company Form B or Form F filings. These cover group structure and enterprise risk; referencing them avoids repeating large blocks of text.
- SEC proxy statement (if public). This already describes director independence and compensation; without it you duplicate work the regulator can already see.
- Compensation plan summaries. You need these to explain pay structure and clawbacks; missing them leaves the senior management section exposed.
- Code of business conduct and ethics. Required to describe ethics policies; absence of this document leaves a clear gap reviewers notice immediately.
- Prior-year CGAD (for repeat filers). You must mark changes against it; without it you cannot prepare the required amended version.
- Lead state determination. Confirm your lead state from the NAIC Financial Analysis Handbook so you file with the right regulator; filing with the wrong state delays processing.
Where to Get the Form and How to Access It
There is no downloadable CGAD form. The “form” is a narrative document you create yourself, guided by the contents requirements in Section 5 of Model Regulation #306. Section 4.C of that regulation gives you discretion over format, so most filers build a Word or PDF document organized by the four content areas the regulation lists. This is different from almost every other insurance filing, where a fixed template exists.
To get the framework, download the model act and model regulation from the NAIC. Then check your own state’s adopted statute and any state-specific instructions, since each state inserts its own citations, penalty amounts, and submission method. The NAIC corporate governance topic page is the central hub that links the model documents and explains the program.
States set their own delivery channel. California, for example, posts detailed submission steps on its CGAD program page, including an encrypted PDF sent by email. Always confirm your state’s exact method before you finalize, because a correctly written CGAD sent the wrong way is still a late filing. Build the document early, because the June 1 deadline does not move for formatting problems.
Step-by-Step: How to Fill Out the CGAD Section by Section
The CGAD has no numbered boxes. Instead, Section 5 of Model Regulation #306 defines four content areas plus a signed attestation and a level-of-reporting statement. Treat each one as a “field” you must complete. Number them in the order below and write a full section for each. This walkthrough is the heart of your filing.
Field 1: Level of Reporting Statement
What it asks in plain English. This field asks you to state where in your corporate structure your governance happens: at the ultimate controlling parent, an intermediate holding company, or the individual legal entity.
How to answer it. Name the level you chose, then state which of the three criteria in Section 3.D of the model act drove your choice: where risk appetite is set, where earnings and capital are overseen collectively, or where legal liability for governance failure would sit. Write it as a short opening paragraph.
A specific example answer. Northgate Mutual Holdings writes: “This CGAD is filed at the ultimate controlling parent level. The level was selected because risk appetite for all group entities is determined by the parent board.”
A nuance or edge case. A single-entity insurer with no holding company simply reports at the legal entity level and says so. There is no need to invent a higher level you do not have.
A common mistake and its consequence. Filers often skip the criteria sentence and only name the level. The model act requires you to indicate which of the three criteria you used, so omitting it means an incomplete filing and a regulator request to clarify.
A misconception people hold. Some believe they must file at the highest possible level. That is false. You file at the level where governance truly occurs, even if that is a single legal entity.
Field 2: Board and Committee Structure
What it asks in plain English. This field asks you to describe your board and its committees, who oversees the company, and why the board is sized and built the way it is.
How to answer it. Per Section 5.B of the regulation, name the board and significant committees, state the level at which oversight occurs, and explain the rationale for board size and structure. Then describe each committee’s duties, how it is governed (bylaws, charters, or mandates), and how board leadership works, including the CEO and Chairman roles.
A specific example answer. Cedar Point Insurance Group writes: “The Board has nine directors and four standing committees: Audit, Risk, Compensation, and Nominating. Committee duties are set by written charters. The roles of CEO and Chairman are separate.”
A nuance or edge case. If the same person serves as CEO and Chairman, say so and explain how independence is preserved, such as through a lead independent director.
A common mistake and its consequence. Listing committees without explaining their duties or governing documents leaves the section hollow, and the commissioner will request the charters you should have summarized.
A misconception people hold. Some think naming the committees is enough. The regulation asks for duties, governance method, and leadership structure, not just a list.
Field 3: Board Policies and Practices
What it asks in plain English. This field asks how your board members are qualified, how independent the board is, how often it meets, how members are chosen, and how the board grades its own performance.
How to answer it. Following Section 5.C of the regulation, cover six points: how each member’s qualifications meet company needs, how independence is maintained, the number of board and committee meetings with director attendance, the nomination and election process, whether term limits or a diversity policy exist, and how the board evaluates its performance.
A specific example answer. Harbor Life writes: “The Board met six times in 2025 with 96% director attendance. The Nominating Committee identifies candidates, and directors stand for re-election every year. No term limits apply.”
A nuance or edge case. If you have no formal diversity policy, say that plainly and describe any informal practice. Silence reads as an omission, while a clear statement reads as a choice.
A common mistake and its consequence. Leaving out meeting counts and attendance is a frequent error. The regulation specifically asks for this data, so missing it triggers a direct follow-up request.
A misconception people hold. Many assume independence only applies to public companies. The regulation asks every filer to explain independence on the board and its significant committees.
Field 4: Directing Senior Management
What it asks in plain English. This field asks how you make sure your top officers are fit for their jobs, how you enforce ethics, how you pay and evaluate them, and how you plan for succession.
How to answer it. Per Section 5.D of the regulation, describe four things: suitability standards for officers and key control-function staff, your code of business conduct and ethics, your performance and compensation processes (including how pay avoids rewarding excessive risk and any clawback provisions), and your CEO and senior management succession plans.
A specific example answer. Summit Casualty writes: “Executive pay blends base salary, an annual bonus tied to risk-adjusted results, and deferred equity. A clawback policy allows recovery of awards if financial results are restated.”
A nuance or edge case. If you reference an SEC proxy statement for compensation detail, point to the exact section so the regulator does not hunt for it. The regulation allows cross-referencing but expects a clear location.
A common mistake and its consequence. Skipping the succession plan is common, especially at smaller insurers. The regulation lists CEO and senior management succession as a required element, so leaving it out is a clear gap.
A misconception people hold. Some think compensation detail is too sensitive to share. The CGAD is confidential by law, so you can describe pay structure without public exposure.
Field 5: Oversight of Critical Risk Areas
What it asks in plain English. This field asks how your board, committees, and management keep watch over the biggest risks in your business and how often they review each one.
How to answer it. Using Section 5.E of the regulation, explain how oversight duties are split between the board, committees, and senior management, how the board learns about strategic plans and risks, and how reporting is organized for each critical risk area. The regulation lists eight example areas: risk management, actuarial, investments, reinsurance, business strategy and finance, compliance, financial reporting and internal audit, and market conduct.
A specific example answer. Cedar Point writes: “The Risk Committee receives a quarterly enterprise risk report. For risk management processes, the Group refers to its 2025 ORSA Summary Report filed with the lead state.”
A nuance or edge case. An ORSA filer may cross-reference its ORSA Summary Report for the risk management process area, which saves duplication, but you must still cover the other risk areas.
A common mistake and its consequence. Filers often describe risks but forget to state how often each is reported to the board. The regulation asks for reporting frequency, so omitting it leaves the commissioner unable to judge oversight.
A misconception people hold. Some think all eight risk areas are mandatory line items. They are examples, so you address the ones that apply to your business and explain your choices.
Field 6: CEO or Corporate Secretary Attestation and Signature
What it asks in plain English. This field is the signed promise that your governance practices are real and that your board has seen the report.
How to answer it. Per Section 3.B of the model act, the chief executive officer or corporate secretary signs a statement attesting, to the best of that person’s knowledge, that the insurer has implemented the described practices and that a copy of the CGAD was given to the board or the appropriate committee.
A specific example answer. The signature block reads: “I, Dana Reyes, Corporate Secretary of Northgate Mutual Holdings, attest that the corporate governance practices described herein have been implemented and that a copy of this disclosure has been provided to the Board.” Signed and dated 05/15/2026.
A nuance or edge case. Only the CEO or corporate secretary may sign. A general counsel or compliance officer cannot stand in unless that person also holds one of those two titles.
A common mistake and its consequence. Filing without giving the board a copy first breaks the attestation, because the signer is certifying something untrue. This can expose the company and the signer if the regulator later checks board records.
A misconception people hold. Some think the attestation is a formality. It is a sworn certification, and a false statement carries real regulatory and legal weight.
Field 7: Cross-References to Existing Documents
What it asks in plain English. This field lets you point to documents you already filed instead of retyping the same information.
How to answer it. Under Section 4.F of the regulation, you may reference an ORSA Summary Report, Form B or F, SEC proxy statement, or similar filing when it covers comparable information. Name the document, point to the exact location of the relevant content, and attach the document if the regulator does not already have it.
A specific example answer. Harbor Life writes: “For director independence and compensation detail, see pages 14–22 of our 2026 DEF 14A proxy statement, attached as Exhibit A.”
A nuance or edge case. If a referenced document is already on file with your regulator, you do not need to attach it again, but you still must cite the precise location.
A common mistake and its consequence. Vague references like “see our proxy” force the reviewer to search, which slows review and often produces a request for specific page citations.
A misconception people hold. Some think cross-referencing means they can skip writing anything. You must still confirm the referenced material is comparable and point to it clearly.
Field 8: Annual Amendment or No-Change Statement
What it asks in plain English. After your first filing, this field asks you to show what changed since last year, or to confirm nothing changed.
How to answer it. Per Section 4.G of the regulation, each year after the initial CGAD you file an amended version that marks where changes were made. If nothing changed, the filing must say so plainly.
A specific example answer. Summit Casualty writes: “This is an amended CGAD. Changes since the 2025 filing are limited to the addition of one independent director and an updated clawback policy, both marked in red below.”
A nuance or edge case. Even a year with zero governance changes still requires a filing that states “no changes were made.” Silence is not an option.
A common mistake and its consequence. Re-filing last year’s document without marking changes defeats the purpose, and reviewers may treat it as a non-responsive filing.
A misconception people hold. Some believe a no-change year means no filing is due. The deadline still applies every year, change or not.
Three Filled-Out Examples Using Real Scenarios
Below are three common filing patterns. Each follows one named filer through the full CGAD so you can see how the sections come together.
Scenario 1: First-time single-entity filer. Maria Lopez is the corporate secretary of Riverbend Indemnity, a stand-alone insurer with no holding company, filing for the first time.
| CGAD Section | What Riverbend Enters |
|---|---|
| Level of reporting | “Filed at the individual legal entity level; this insurer has no holding company parent.” |
| Criteria used | “Legal liability for governance duties rests with this entity’s board.” |
| Board structure | “Seven-member board with Audit and Risk committees governed by written charters.” |
| Board policies | “Board met five times in 2025; directors re-elected annually; no term limits.” |
| Senior management | “Suitability standards apply to the CEO, CFO, and Chief Actuary; ethics code attached.” |
| Risk oversight | “Risk Committee reviews investments and reinsurance quarterly; compliance reviewed semiannually.” |
| Cross-references | “No external documents referenced; this is a stand-alone filing.” |
| Attestation | Signed by Maria Lopez, Corporate Secretary, 05/20/2026 |
Scenario 2: Large group filing at the parent level. James Okafor is the corporate secretary of Northgate Mutual Holdings, a multi-state group filing with its lead state and cross-referencing existing filings.
| CGAD Section | What Northgate Enters |
|---|---|
| Level of reporting | “Filed at the ultimate controlling parent level for all group insurers.” |
| Criteria used | “Risk appetite for the group is set by the parent board.” |
| Board structure | “Eleven-member parent board with Audit, Risk, Compensation, and Nominating committees.” |
| Board policies | “Parent board met seven times in 2025 with 95% attendance; diversity policy in place.” |
| Senior management | “Compensation detail cross-referenced to 2026 SEC proxy, pages 14–22, attached.” |
| Risk oversight | “Risk management processes refer to the 2025 ORSA Summary Report filed with the lead state.” |
| Cross-references | “References ORSA Summary Report and Holding Company Form B filings.” |
| Attestation | Signed by James Okafor, Corporate Secretary, 05/12/2026 |
Scenario 3: No-change annual update. Dana Price is the CEO of Summit Casualty, filing the third annual CGAD with only minor changes from the prior year.
| CGAD Section | What Summit Enters |
|---|---|
| Filing type | “Amended CGAD; changes marked in red against the 2025 version.” |
| Level of reporting | “No change; filed at intermediate holding company level.” |
| Board structure | “Added one independent director; board now has eight members.” |
| Board policies | “No change to meeting cadence or election process.” |
| Senior management | “Updated clawback policy; all other compensation practices unchanged.” |
| Risk oversight | “No change to risk reporting structure or frequency.” |
| Cross-references | “ORSA Summary Report reference updated to 2025 report.” |
| Attestation | Signed by Dana Price, CEO, 05/28/2026 |
How to File the Completed CGAD
Filing channels are set by each state, so confirm your method before the deadline. Most states accept the CGAD as an encrypted PDF by email or through a secure regulator portal. If you file as a group, you submit to your lead state, and you must also provide a copy to the chief regulatory official of any state where you have a domestic insurer, upon request, under Section 4.E of the regulation.
Here is how the main channels work, using California as a concrete example:
- Encrypted email (California). Send the encrypted PDF to the address listed on the California CGAD page, using the required subject-line format. There is no filing fee. Keep the encrypted file, the password transmission, and the sent-mail receipt as proof of filing. Processing is part of the ongoing financial analysis cycle rather than an instant confirmation.
- Secure regulator portal (varies by state). Some states route the CGAD through a secure online filing system. Upload the PDF, record the confirmation number, and save a screenshot. No fee typically applies. Proof of filing is the system confirmation receipt.
- Mail or in person (rare). A few states still accept paper or hand delivery to the Department of Insurance address. Send by tracked mail and keep the delivery receipt as proof. Processing takes longer because the document must be scanned and logged.
Whatever the channel, the deadline is June 1, the report goes to the lead or domestic regulator, and you should always keep a dated proof of submission in case the regulator questions timeliness.
What Happens After You File
After you file, the lead state reviews the CGAD as part of its ongoing financial analysis of your company. Under Section 3.E of the model act, the review and any follow-up requests run through the lead state. The regulator may ask for additional material it considers necessary to understand your governance, your reporting systems, or your controls.
Your filing stays confidential. The confidentiality protections in Section 6 treat the CGAD as proprietary trade-secret material, shield it from open-records requests and subpoenas, and bar its use as evidence in private civil actions. The commissioner can share it with other regulators, the NAIC, or third-party consultants only under written confidentiality agreements.
The regulator may also retain outside experts at your expense to help review the filing, under Section 7 of the model act. These consultants work under the commissioner’s direction, must be free of conflicts, and are bound by the same confidentiality rules. If your filing is clear and complete, this review usually proceeds quietly; if it is thin, expect questions.
Mistakes to Avoid When Filling Out the CGAD
Each section of the CGAD is its own chance to slip up. These are the errors that most often delay review or draw regulator follow-up.
- Naming a reporting level without stating the criteria used: the filing is incomplete and the regulator asks you to clarify.
- Listing committees but not their duties or charters: the structure section reads as hollow and prompts a document request.
- Leaving out board meeting counts and attendance: the regulator must ask for data the regulation already requires.
- Skipping the CEO and senior management succession plan: a required element is missing and the gap is obvious.
- Filing before the board has received a copy: the attestation becomes false and exposes the signer.
- Letting someone other than the CEO or corporate secretary sign: the attestation is invalid.
- Using vague cross-references like “see our proxy”: reviewers cannot find the content and request page citations.
- Re-filing last year’s document without marking changes: the amendment is treated as non-responsive.
- Assuming a no-change year means no filing: you miss the deadline and risk daily penalties.
- Filing with the wrong state instead of the lead state: processing stalls and the deadline may pass.
- Forgetting to state reporting frequency for each risk area: the regulator cannot judge oversight quality.
- Sending the file unencrypted where encryption is required: the submission may be rejected and re-filed late.
Do’s and Don’ts
These quick rules keep your CGAD clean and on time.
- Do confirm your lead state from the NAIC Financial Analysis Handbook, because filing with the wrong regulator wastes time you may not have.
- Do give the board a copy before you sign, because the attestation depends on it.
- Do cross-reference existing filings, because it saves duplication and shortens your document.
- Do point to exact page numbers in referenced documents, because vague references trigger follow-up.
- Do mark changes clearly each year, because the amendment rule requires it.
- Do keep dated proof of filing, because the deadline is strict and disputes happen.
- Don’t invent a reporting level you do not actually use, because the regulator can see your real structure.
- Don’t skip the succession plan, because it is a required element even for small insurers.
- Don’t treat the attestation as a formality, because it is a sworn certification with legal weight.
- Don’t assume size exempts you, because the commissioner can request a CGAD from any insurer.
- Don’t publish or share the CGAD freely, because its confidentiality protection depends on careful handling.
- Don’t wait until late May to start, because gathering charters and bios takes longer than expected.
Pros and Cons of Filing on Your Own vs. With Help
Many insurers debate whether to prepare the CGAD in-house or hire outside counsel or consultants. The right choice depends on your size, structure, and internal expertise.
| Filing In-House | Filing With Outside Help |
|---|---|
| Lower cost, because you use existing staff | Higher cost, because you pay legal or consulting fees |
| Faster for simple single-entity filers | Faster for complex multi-state groups, because experts know the framework |
| Keeps sensitive governance detail in-house | Adds a confidentiality agreement layer to manage |
| Builds internal knowledge for future years | Reduces the learning curve for first-time filers |
| Risk of missing a required element without expertise | Lower risk of omissions, because reviewers catch gaps |
The pros of going in-house are control, cost savings, and institutional knowledge that compounds each year. The cons are the risk of missing a required element and the time it takes staff to learn the framework. Outside help reduces omission risk and speeds complex group filings, but it costs more and adds another party to your confidentiality chain. A stand-alone insurer with a small board can often file in-house, while a large multi-state group filing at the parent level usually benefits from experienced help.
FAQs
Is the CGAD a fixed government form I download and fill in?
No. The CGAD is a narrative document you build yourself. The model regulation gives you discretion over format as long as you cover the four required content areas and sign the attestation.
Is there a filing deadline for the CGAD?
Yes. The CGAD is due no later than June 1 each year, under the model act and every adopting state’s statute, whether or not your governance changed that year.
Do small insurers have to file a CGAD?
Yes. Even an insurer not otherwise required to file must submit one if the commissioner requests it, so size alone does not create a permanent exemption.
Is the CGAD made public after I file it?
No. The CGAD is confidential by law, treated as trade-secret material, and shielded from open-records requests, subpoenas, and use in private civil actions.
Do I have to pick the ultimate parent as my reporting level?
No. You report at the level where governance actually occurs, which may be the parent, an intermediate holding company, or a single legal entity.
Can my general counsel sign the attestation?
No. Only the chief executive officer or the corporate secretary may sign the attestation, unless your general counsel also holds one of those two titles.
Do I need to state which criteria I used to pick my reporting level?
Yes. The model act requires you to indicate which of the three criteria drove your reporting level and to explain any later changes to that level.
Can I cross-reference my ORSA Summary Report for the risk section?
Yes. An ORSA filer may refer to its ORSA Summary Report for risk management processes, but you must still address the other applicable risk areas.
Do I have to list all eight critical risk areas?
No. The eight areas are examples, so you address the ones that apply to your business and explain how oversight and reporting work for each.
If nothing changed since last year, can I skip filing?
No. You must still file each year, and if there were no changes the amended filing must clearly state that no changes were made.
Do I file with my home state or the lead state if I am in a group?
Yes, the lead state, when you file at the group level, with a copy to any state where you have a domestic insurer upon request.
Is there a penalty for filing late?
Yes. Insurers that fail to file on time without just cause face a daily penalty set by their state’s statute, up to a state-specified maximum, after notice and a hearing.
Do I need to give my board a copy before I sign?
Yes. The attestation certifies that a copy was provided to the board or the appropriate committee, so the board must receive it before you sign and file.
Should I attach my committee charters?
No, not always; you must summarize committee duties and governance, and attach charters or example documents only when they help demonstrate your framework or when the regulator requests them.
Related reading
- How to Fill Out NAIC Form B (w/Examples) + FAQs
- How to Fill Out NAIC Form C (w/Examples) + FAQs
- How to Fill Out NAIC Form D (w/Examples) + FAQs
- How to Fill Out NAIC Form F (w/Examples) + FAQs
- How to Fill Out the NAIC ORSA Summary Report (w/Examples) + FAQs
- How to Fill Out the NAIC RBC Report (w/Examples) + FAQs