[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-179504-105":53,"doc-detail-179504-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","iii-general-examination-considerations-information-technology-review","III. General EXAMINATION considerations - Information Technology Review","","General EXAMINATION considerations for conducting financial condition examinations are organized across key topics, including materiality, sampling, business continuity, specialist work, outsourcing, and insurer-specific run-off and troubled-company issues. The document highlights the increasing role of information technology in examiner reliability, focusing on IT general controls (ITGCs) that support completeness, integrity, and availability of IT systems and data. It outlines a formal general IT review process, emphasizing risk-focused sequencing and examiner–EIC coordination.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/iii-general-examination-considerations-information-technology-review/179504/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/iii-general-examination-considerations-information-technology-review/179504.png","ImageObject",442,249,{"name":88,"@type":89},"Olivia Brown","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/octet-stream","2026-10-16","2026-09-02",true,{"@type":98,"interactionType":99,"userInteractionCount":47},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What role do IT general controls (ITGCs) play in a financial condition examination?","Question",{"text":108,"@type":109},"ITGCs are policies and procedures that help ensure proper operation of insurer computer systems, supporting the completeness, integrity, and availability of IT systems and data. An effective ITGC environment increases examiner assurance and enables testing and reliance on automated application controls during Phase 3.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What information is gathered first for the general IT review?",{"text":113,"@type":109},"The process starts by collecting planning information, including the Information Technology Planning Questionnaire (ITPQ) from Exhibit C – Part One, plus prior examination workpapers, internal/external audit or consultant IT work, and information held by insurance department financial analysts. Third-party cyber self-assessment tool results may also be used.",{"name":115,"@type":106,"acceptedAnswer":116},"How are cyber self-assessment results used in Exhibit C risk statements and testing?",{"text":117,"@type":109},"Depending on tool scope, date, and quality of information (including independent validation), the state insurance regulator may determine what can be leveraged. Results may populate Exhibit C with risk statements and controls to be tested, reduce testing extent if sufficiently validated, or inform review of gathered information and related controls.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},179504,1788337253,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":47,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":125,"read_time":40},16904993612988,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","III.\tGeneral EXAMINATION considerations\nThis section covers procedures and considerations that are important when conducting financial condition examinations. The discussion here is divided as follows:\nA.\tGeneral Information Technology Review\nB.\tMateriality\nC.\tExamination Sampling\nD.\tBusiness Continuity\nE.\tUsing the Work of a Specialist\nF.\tOutsourcing of Critical Functions\nG.\tUse of Independent Contractors on Multi-State Examinations\nH.\tConsiderations for Insurers in Run-Off\nI. \tConsiderations for Potentially Troubled Insurance Companies\nJ. \tComments and Grievance Procedures Regarding Compliance with Examination Standards\nA.\tGeneral Information Technology Review\nThe examination of information technology (IT) utilized by an insurer has become an increasingly important part of the examination process as companies have placed a greater reliance on IT systems to run their business. IT general controls (ITGCs) are policies and procedures that help ensure proper operation of computer systems, including controls over network operations, software acquisition and maintenance, and access security. ITGCs provide a foundation necessary to ensure the completeness, integrity and availability of IT systems and data and comprise the environment from which application controls are designed, implemented and operated. An effective IT general control environment can, therefore, provide examiners with greater assurance regarding the overall reliability of a company’s IT systems and the reports generated from those systems. In addition, this allows the opportunity to test and rely on automated application controls during Phase 3 of the exam. As such, a formalized process to complete a general IT review has been developed to assist the IT examiner in completing this important section of the financial condition examination. In a risk-focused examination, steps 1–5 of the general IT review process should be performed prior to the completion of planning the overall financial condition examination. Step 6 of the IT review process should be performed in conjunction with the remaining portion of the overall examination. The following steps document the process to be followed in completing the general IT review:\nGather Necessary IT Planning Information\nThe first step in performing a general IT review is to gather the information necessary to plan the IT review of the insurer. At this time, the examiner-in-charge (EIC) and the IT examiner should work together to request that the insurer complete the Information Technology Planning Questionnaire (ITPQ), included in Exhibit C – Part One, to assist in the planning process. In addition, other relevant information to obtain in planning the IT review might include prior examination workpapers, work on IT systems performed by internal/external auditors or consultants, and information maintained by the insurance department’s financial analysts. The reports and results from third-party cyber self-assessment tools may also be utilized for an IT review. Note that if companies do not use these tools, the examiner can continue with the normal IT review process. There are a variety of cyber self-assessment tools that companies may opt to use depending on their business type. Examples of cyber assessment tools that have been developed include, but are not limited to, tools developed by, or to facilitate compliance with the following: the Financial Services Sector Coordinating Council (FSSCC), the Health Information Technology for Economic and Clinical Health Act (HITECH), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Based on a consideration of the assessment tool’s scope, date of preparation, and quality of information presented (including whether or not the information has been validated by an independent third party), the state insurance regulator may determine the information contained within the assessment that can be extensively leveraged during the IT review. Depending on the assessme","cbCaihloKhSzUes4","https://ap.wps.com/l/cbCaihloKhSzUes4","doc",532992,51,"English","# A. General Information Technology Review\n## IT general controls and reliance on application controls\n## General IT review process and risk-focused timing\n## Step 1-6: gathering planning information and reviewing risks","[{\"question\":\"What role do IT general controls (ITGCs) play in a financial condition examination?\",\"answer\":\"ITGCs are policies and procedures that help ensure proper operation of insurer computer systems, supporting the completeness, integrity, and availability of IT systems and data. An effective ITGC environment increases examiner assurance and enables testing and reliance on automated application controls during Phase 3.\"},{\"question\":\"What information is gathered first for the general IT review?\",\"answer\":\"The process starts by collecting planning information, including the Information Technology Planning Questionnaire (ITPQ) from Exhibit C – Part One, plus prior examination workpapers, internal/external audit or consultant IT work, and information held by insurance department financial analysts. Third-party cyber self-assessment tool results may also be used.\"},{\"question\":\"How are cyber self-assessment results used in Exhibit C risk statements and testing?\",\"answer\":\"Depending on tool scope, date, and quality of information (including independent validation), the state insurance regulator may determine what can be leveraged. Results may populate Exhibit C with risk statements and controls to be tested, reduce testing extent if sufficiently validated, or inform review of gathered information and related controls.\"}]","III. General EXAMINATION considerations - Information Technology Review | DOC"]