The NAIC MAR filing is Management’s Report of Internal Control over Financial Reporting (ICFR), required under Section 16 of the Annual Financial Reporting Model Regulation, known as Model Audit Rule (MAR) #205. Every large insurer that writes $500 million or more in direct and assumed premium, or that is already subject to Sarbanes-Oxley Section 404, must sign and file this report with its state insurance commissioner.
This report tells regulators that your company’s leaders have checked their own financial controls and stand behind the numbers. Getting it wrong is costly, because a missing signature, a vague material weakness disclosure, or a late filing can trigger regulatory follow-up, a financial condition exam, or even action against your certificate of authority. Roughly 200 insurers cross the $500 million premium line each year and must produce this report for the first time, and many stumble on the same fields.
Here is what you will learn in this guide:
- 📋 What the MAR report is, who must file it, and which statute forces it
- 🗂️ The exact documents and data you need before you start drafting
- ✍️ A line-by-line walkthrough of every required statement and signature block
- 👥 Three full filled-out examples using real-world insurer scenarios
- ⚠️ The field-level mistakes that get reports rejected and how to dodge them
What the MAR Report Is and Who Must File It
The Model Audit Rule, internally designated MDL 205 by the NAIC, is the Annual Financial Reporting Model Regulation co-developed by the NAIC and the American Institute of Certified Public Accountants (AICPA). It was issued with major revisions in 2006 and took full effect in 2010. The rule borrows heavily from the Sarbanes-Oxley Act of 2002, which Congress passed after the Enron collapse to tighten financial reporting for public companies.
The MAR has many parts, but the filing people mean when they say “the MAR filing” is Management’s Report of Internal Control over Financial Reporting under Section 16. This single report is the management-signed statement that your internal controls work. It sits alongside two other MAR submissions: the annual audited financial statement by an independent CPA (Section 4) and the communication of unremediated internal control matters (Section 11).
Because the NAIC is not a federal agency, the rule has no direct legal force on its own. Instead, each state adopts its own version, often word-for-word, to keep its NAIC accreditation. So the report you file is governed by your domiciliary state’s adopted statute, but the model language is nearly identical from state to state.
You must file the Section 16 report if your company writes $500,000,000 or more in direct and assumed written premium, or if your company is already subject to SOX Section 404 (with limited exceptions). Smaller insurers below the $500 million line do not file this report, though they still file the independent CPA audit. The rule applies across all lines: life and annuity, property and casualty, title, and health.
Before You Start: Documents and Information You Need
Gather everything below before you open a blank report. Filing season moves fast, and missing one item can push you past the deadline.
- Your statutory annual statement. You need the direct and assumed written premium figure to confirm you crossed the $500 million threshold. Without it, you cannot prove whether the report is even required.
- Prior-year audited statutory financial statements. The MAR report must coincide with your most recent annual financial statements, and a mismatch invites regulator questions.
- Your internal control framework documentation. Most insurers use the COSO Internal Control-Integrated Framework, and you must name the framework in the report.
- Management’s internal control assessment workpapers. These support every assertion you make, and the commissioner can demand them during a financial condition exam.
- The auditor’s communication of internal control matters (Section 11). This tells you whether any material weakness must be disclosed in your report.
- A current list of all insurers in your “Group of insurers.” You must identify this group by name, often on an attachment, and leaving an entity off can make the filing incomplete.
- The CEO’s and CFO’s names and titles. Both must sign, and an unsigned report is treated as not filed.
- Your SOX 404 report and Form 10-K, if you are a public filer. A public company can file its 404 report plus an addendum instead of a stand-alone report, saving duplicate work.
If you are a public filer, also confirm the filing date of your audited financial statements, because the report is generally due within 60 days of that filing. Missing the threshold check is the most common early error, because a company that grows past $500 million on December 31 does not realize the clock has already started.
Where to Get the Form and How to Access It
The MAR report is not a fill-in-the-blank PDF like a tax form. It is a management-drafted letter and statement that follows the content rules in Section 16 of your state’s adopted regulation. You build it from the model language, which is published in the Model Audit Rule #205 within the NAIC’s model laws library and mirrored in your state insurance code.
To get the exact required language, start with two places. First, pull your domiciliary state’s adopted version of the Annual Financial Reporting Model Regulation from your state insurance department’s statute pages, because the box numbers and defined terms there control your filing. Second, review the NAIC Financial Analysis Handbook and the Market Regulation Handbook for regulator expectations on contents and review.
Because the report is a drafted document, most insurers start from a template provided by their independent CPA firm or build one from the model’s sample report. The key is that the structure and required statements match Section 16(D) exactly. Regulators read these reports against the model checklist, so straying from the required statements is the fastest way to draw a follow-up letter.
You file the finished report directly with your state insurance commissioner, not through a national NAIC portal, since the report is a state submission. Confirm your state’s preferred channel, because some accept electronic submission through a state portal while others still want a signed paper original.
Step-by-Step: How to Fill Out the MAR Section 16 Report Line by Line
The Section 16 report under §16(D) has a fixed list of required statements, each of which acts like a field on a traditional form. Complete every one in order. Each statement below is mandatory, and skipping any single one means the report fails the regulator’s checklist.
Statement 1: Management’s Responsibility for Internal Control
This statement asks you to declare, in plain words, that your management owns the internal controls. You write a sentence saying that management is responsible for establishing and maintaining adequate internal control over statutory financial reporting. Format it as a direct declarative sentence near the top of the report.
For example, “Management of XYZ Holding Company, Inc. is responsible for establishing and maintaining adequate internal control over statutory financial reporting.” That is the exact tone and structure regulators expect to see first.
A common edge case is when controls are shared across a holding company group. In that case, name the group and tie responsibility to the group, not just one legal entity. The most common mistake here is leaving this statement out because it feels obvious, and the direct consequence is that the report reads as if no one accepts responsibility, which voids the filing. Many filers wrongly believe the auditor carries this responsibility, but under MAR the auditor does not attest to management’s assessment, so the duty rests entirely on management.
Statement 2: Confirmation That Internal Controls Have Been Established
This field asks you to confirm that management has, in fact, set up internal controls over financial reporting. You answer it with a clear statement that the controls exist and are designed to provide reasonable assurance about the reliability of statutory financial statements. Use the phrase reasonable assurance, because the rule never promises absolute certainty.
For example, Marcus, the controller drafting the report for Coastal Mutual, writes “Coastal Mutual’s internal control over statutory financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of statutory financial statements in accordance with statutory accounting principles.”
An edge case appears when your controls were redesigned mid-year, in which case describe the controls in place as of the assessment date. The common mistake is claiming the controls guarantee accuracy, and the consequence is that you overstate your position and create liability if a misstatement later surfaces. People often think this statement must list every control, but it only needs to confirm that a control process exists.
Statement 3: Statement on the Effectiveness of Internal Controls
This statement asks for management’s conclusion on whether the controls actually work. You write whether the controls are effective to provide reasonable assurance about the reliability of statutory financial statements as of your fiscal year-end date, usually December 31. The conclusion must be tied to a specific date and a named framework.
For example, “Based on our assessment under that framework, management concluded that the Group of insurers’ internal control over statutory financial reporting is effective as of December 31, 2025.” The date and the word effective (or not effective) are the load-bearing parts.
The key edge case is when you have an unremediated material weakness, because then you cannot conclude controls are effective and must say so. The most damaging mistake is writing “effective” while a known material weakness sits in your Section 11 letter, and the consequence is a direct contradiction that regulators will flag and investigate. A widespread misconception is that one control gap forces a “not effective” conclusion, but only an unremediated material weakness requires that downgrade.
Statement 4: Approach and Processes Used in the Evaluation
This field asks how management evaluated the controls. You name the internal control framework you used and briefly describe the assessment approach, such as testing and review of key processes. Most insurers cite the COSO Internal Control-Integrated Framework by name.
For example, “Management conducted an assessment of the effectiveness, as of December 31, 2025, of the Group of insurers’ internal control over statutory financial reporting, based on the framework established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”
An edge case is using a framework other than COSO, which the rule permits, as long as you name it and apply it consistently. The common mistake is naming no framework at all, and the consequence is that your conclusion has no recognized basis, so the regulator cannot judge it. Filers sometimes believe they must use a state-mandated framework, but §16(E) gives management discretion over the framework and the extent of documentation.
Statement 5: Scope of the Evaluation
This statement asks you to define what your assessment covered. You describe the scope, generally the internal control over the preparation of the audited statutory financial statements for the Group of insurers. The scope should match the entities and processes that feed your statutory numbers.
For example, Janet, the CFO of Prairie Life Group, writes that the assessment “covered the internal control over statutory financial reporting of the insurance companies listed on Attachment B.” Attaching the entity list keeps the scope precise.
The important edge case is a public-company insurer whose SOX 404 report excluded certain processes, which is exactly why the addendum exists. The common mistake is defining the scope so narrowly that key processes fall outside it, and the consequence is that excluded material processes go unreported, which can later look like concealment. A frequent misconception is that scope means the audit scope, but here it means management’s own internal control evaluation scope.
Statement 6: Disclosure of Unremediated Material Weaknesses
This is the field that carries the most weight. You must disclose any unremediated material weakness in internal control as of your fiscal year-end, or, if none exist, plainly state that fact. A material weakness is a deficiency, or a combination of deficiencies, that creates a reasonable possibility that a material misstatement will not be prevented or caught on time.
For example, when controls are clean, “there were no unremediated material weaknesses as of December 31, 2025 identified as part of the Group of insurers’ internal control structure.” When a weakness exists, describe it, just as in the Section 11 example where a reserve calculation in a regional office was not reviewed by the actuarial department.
The edge case is a weakness you fixed during the year, which need not be disclosed here if it was remediated by year-end. The most serious mistake is omitting a known unremediated weakness, and the consequence can rise to a §15 issue if leadership knew or should have known the omission made the report misleading. People often confuse a significant deficiency with a material weakness, but only the latter must be disclosed and only the latter blocks an “effective” conclusion.
Statement 7: Acknowledgment of Inherent Limitations
This statement asks you to admit that no control system is perfect. You include a short paragraph noting that because of inherent limitations, internal control may not prevent or detect every misstatement, and that projections to future periods carry risk. This is standard protective language drawn straight from the model.
For example, “Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements.” You add that conditions can change and compliance can deteriorate over time.
An edge case is a heavily automated control environment, where you still keep this language because automation does not remove inherent limitations. The common mistake is dropping this paragraph to sound more confident, and the consequence is that you implicitly overpromise and weaken your legal footing. A misconception is that this language admits weakness, when it actually protects management by setting honest expectations.
Statement 8: Signatures of the CEO and the CFO
This final field requires both the Chief Executive Officer and the Chief Financial Officer to sign and date the report. You provide a signature line and a date line for each officer, with their title printed below the line. Both signatures are mandatory and non-delegable.
For example, the report ends with “(Signed) __ (Date) ____ Chief Executive Officer” and “(Signed) __ (Date) ____ Chief Financial Officer.” Aisha, the CEO of Summit Title Insurance, signs first, and her CFO signs directly below.
The edge case is an officer who is out of office at deadline, which means you must plan signatures early or use an authorized acting officer with proper documentation. The common and costly mistake is filing with only one signature, and the consequence is that the report is treated as incomplete and effectively not filed by the deadline. Many filers wrongly assume a general counsel or controller may sign in place of the CEO or CFO, but the rule names those two officers specifically.
The SOX 404 Addendum Path (For Public Filers)
If your insurer or its parent is publicly traded and subject to SOX 404, you do not have to draft a separate report. Instead, you file your or your parent’s Section 404 report plus an addendum, as permitted under §16(C). This avoids duplicate internal control reports.
The addendum is a short statement affirming that “there are no material processes with respect to the preparation of the audited statutory financial statements of the Group of insurers that were excluded from the Section 404 Report.” You attach it to the 404 report you send the commissioner.
The edge case is when your 404 report did exclude some statutory processes, in which case the addendum must identify those excluded material processes rather than deny any exist. The common mistake is filing the 404 report with no addendum, and the consequence is that the filing fails to bridge the gap between SEC reporting and statutory reporting. Filers often assume the 404 report alone satisfies the MAR, but without the addendum it does not.
Three Filled-Out Examples Using Real Scenarios
Below are three common fact patterns, each following one named filer through the report.
Scenario 1: Coastal Mutual crosses $500M for the first time, clean controls. Marcus, the controller, drafts a stand-alone Section 16 report with no material weaknesses.
| Form Section | What Coastal Mutual Enters |
|---|---|
| Management responsibility | Management of Coastal Mutual is responsible for establishing and maintaining adequate internal control |
| Controls established | A process designed to provide reasonable assurance regarding statutory financial reporting |
| Effectiveness conclusion | Internal control is effective as of December 31, 2025 |
| Framework used | COSO Internal Control-Integrated Framework |
| Scope | Coastal Mutual’s statutory financial reporting processes |
| Material weakness disclosure | No unremediated material weaknesses as of December 31, 2025 |
| Inherent limitations | Controls may not prevent or detect all misstatements |
| Signatures | CEO and CFO signed and dated |
Scenario 2: Pacific Holdings, a public SOX 404 filer, uses the addendum path. Janet, the CFO, files the parent’s 404 report plus an addendum instead of a new report.
| Form Section | What Pacific Holdings Enters |
|---|---|
| Filing method | Files parent’s Section 404 report under §16(C) |
| Group of insurers | Insurance subsidiaries listed on Attachment B |
| Framework used | COSO, per the 404 report |
| Effectiveness conclusion | Effective as of December 31, 2025, per 404 report |
| Material weakness disclosure | No unremediated material weaknesses identified |
| Addendum statement | No material statutory processes excluded from the 404 Report |
| Attachments | Attachment A (Addendum), Attachment B (entity list) |
| Signatures | CEO and CFO signed and dated |
Scenario 3: Prairie Life Group reports an unremediated material weakness. Aisha, the CEO, must disclose a reserve-calculation weakness and conclude controls are not effective.
| Form Section | What Prairie Life Group Enters |
|---|---|
| Management responsibility | Management is responsible for internal control over statutory reporting |
| Effectiveness conclusion | Internal control is NOT effective as of December 31, 2025 |
| Framework used | COSO Internal Control-Integrated Framework |
| Material weakness description | Reserve estimates in the regional office not reviewed by Actuarial before posting |
| Remediation plan | Coding procedures changed, effective July 1, 2025 |
| Scope | Statutory reporting for entities on Attachment B |
| Inherent limitations | Controls may not prevent or detect all misstatements |
| Signatures | CEO and CFO signed and dated |
How to File the Completed MAR Report
You file the Section 16 report directly with the insurance commissioner of your domiciliary state, because this is a state submission rather than a national NAIC filing. Confirm your state’s exact channel before sending, since states differ on whether they want electronic or paper originals.
- By state electronic portal: Many states accept the signed report as a PDF upload through their financial filing portal. Keep the upload confirmation as your proof of filing.
- By mail: Send a signed original to your state insurance department’s financial analysis division at the address in your state code. Use certified mail and keep the receipt as proof.
- In person or by courier: Some departments accept hand delivery for last-minute filings, and you should request a date-stamped copy as proof.
The report is generally due June 1 following the December 31 year-end, the same anchor date as the audited financial statement under Section 4. Public filers using the 404 path generally file within 60 days of filing their audited financial statements. There is usually no separate fee for the report itself, and extensions may be granted for both the audit and the management report on request to the commissioner. Always keep your filing confirmation, because proof of timely filing is your defense if a deadline dispute arises.
What Happens After You File
After you file, your domiciliary state’s financial analysis team reviews the report against the Section 16 checklist and reads it alongside your audited statements and Section 11 communication. They confirm every required statement is present, the framework is named, and both officers signed. A clean, complete report usually moves through review without follow-up.
If you disclosed an unremediated material weakness, expect the regulator to track your remediation plan and possibly request updates. A material weakness does not automatically trigger enforcement, but it raises your profile and can feed into the decision to schedule a financial condition examination under the Financial Analysis Handbook.
During any later examination, the commissioner can demand the workpapers that support your internal control assertions, which is why §16(E) requires you to keep that basis available. If the report is incomplete or contradicts your other filings, the department will send a deficiency letter and require a corrected filing. Repeated or willful failures can escalate to action against your certificate of authority.
Mistakes to Avoid When Filling Out the Report
Each error below has tripped real filers, and each carries a direct consequence.
- Missing the threshold check. You assume you are exempt and skip the report, which means you file nothing and breach the rule.
- Filing with only one officer signature. The report is treated as incomplete, so it counts as not filed by the deadline.
- Concluding “effective” with a known material weakness. Your report contradicts your Section 11 letter and invites investigation.
- Omitting an unremediated material weakness. This can rise to a §15 improper-influence or misleading-report issue.
- Naming no internal control framework. Your effectiveness conclusion has no recognized basis and cannot be evaluated.
- Forgetting the SOX 404 addendum. Your 404 report fails to bridge to statutory reporting, leaving the filing incomplete.
- Defining scope too narrowly. Material processes go unreported and later look concealed.
- Listing the wrong entities in the Group of insurers. The report covers the wrong scope and misstates responsibility.
- Filing after June 1 without an extension. You face late-filing penalties and added regulatory scrutiny.
- Confusing a significant deficiency with a material weakness. You either over-disclose and alarm regulators or under-disclose and breach the rule.
- Using last year’s premium figure. You misjudge whether the report is even required this year.
- Dropping the inherent-limitations language. You overpromise control performance and weaken your legal position.
Do’s and Don’ts
Do:
- Do confirm your premium threshold early, because the two-year compliance clock starts the moment you cross $500 million.
- Do name your control framework, since regulators need a recognized basis to judge your conclusion.
- Do match the report to your latest audited statements, because the rule requires them to coincide.
- Do collect both officer signatures well before the deadline, since one missing signature voids the filing.
- Do keep your supporting workpapers, because §16(E) lets the commissioner demand them later.
- Do reconcile the report with your Section 11 letter, so your conclusions never contradict each other.
Don’t:
- Don’t claim absolute assurance, because the rule only ever promises reasonable assurance.
- Don’t let the auditor write your conclusion, since under MAR the auditor does not attest to management’s assessment.
- Don’t file the 404 report alone, because public filers still need the addendum.
- Don’t hide a known weakness, since concealment can become a fraud or gross-negligence issue under §15.
- Don’t guess your domiciliary state’s channel, because filing the wrong way can miss the deadline.
- Don’t reuse last year’s report verbatim, since the conclusion must reflect this year’s controls and date.
Filing on Your Own vs. With Professional Help
Pros of filing on your own:
- Lower cost, because you avoid outside consulting fees.
- Faster internal turnaround, since your team already knows your controls.
- Full control of messaging, so management frames its own assessment.
- Better institutional knowledge, because your staff learns the process for future years.
- No coordination lag, since you are not waiting on an external firm’s calendar.
Cons of filing on your own (vs. professional help):
- Higher error risk, because in-house teams may miss required §16(D) statements.
- Independence blind spots, since outside experts catch contradictions your team overlooks.
- Heavier first-year burden, as first-time filers face a steep learning curve.
- Weaker benchmarking, because a firm sees many filings and knows regulator expectations.
- Limited surge capacity, since your team handles this on top of close and audit season.
FAQs
Who must file the MAR Section 16 report?
Yes, any insurer writing $500 million or more in direct and assumed premium, or already subject to SOX Section 404, must file Management’s Report of Internal Control over Financial Reporting.
Is the MAR report the same as a SOX 404 report?
No, it is similar but separate, and unlike SOX 404, the external auditor does not attest to management’s internal control assessment under the Model Audit Rule.
When is the MAR report due?
Yes, it is generally due June 1 following the December 31 year-end, the same date as the audited statutory financial statement, with extensions available on request.
Do both the CEO and CFO have to sign?
Yes, both the Chief Executive Officer and the Chief Financial Officer must sign and date the report, and one missing signature makes the filing incomplete.
Can our general counsel sign instead of the CFO?
No, the rule names the CEO and CFO specifically, so neither general counsel nor the controller may sign in their place.
Do I name a control framework in the report?
Yes, you must name the framework used, most often the COSO Internal Control-Integrated Framework, so regulators can judge the basis of your conclusion.
If we have a material weakness, must we disclose it in this box?
Yes, you must disclose any unremediated material weakness as of year-end, and you cannot conclude that controls are effective when one exists.
Do I disclose a weakness we fixed during the year?
No, a material weakness remediated by your fiscal year-end does not have to be disclosed in the year-end report, though documentation should support the remediation.
Is a significant deficiency the same as a material weakness?
No, only a material weakness must be disclosed and only it blocks an “effective” conclusion, while a significant deficiency does not require this treatment.
As a public filer, can I just send my 404 report?
No, you must also include an addendum affirming no material statutory processes were excluded from the Section 404 report.
Do we list every insurer in the group?
Yes, you identify your full “Group of insurers,” usually on an attachment, because the report’s scope and responsibility statements depend on that list.
Is there a filing fee for the report?
No, there is generally no separate fee for the management report itself, though you should confirm your domiciliary state’s specific filing rules.
Can we get an extension on the report?
Yes, the commissioner may grant an extension for both the audit report and management’s internal control report when you request one in advance.
Related reading
- How to Fill Out the NAIC Annual Statement Blank
- How to Fill Out the NAIC Annual Statement – Health (Complete Line-by-Line Guide + FAQs)
- How to Fill Out the NAIC Annual Statement – Property and Casualty + FAQs
- How to Fill Out NAIC Form MCAS (w/Examples) + FAQs
- How to Fill Out the NAIC ORSA Summary Report (w/Examples) + FAQs
- How to Fill Out NAIC UCAA Corporate Amendments (w/Examples) + FAQs
- How to Fill Out NAIC Form C (w/Examples) + FAQs