Congress is at work on more regulation in the same vein, cautioned Susan Geiger, a partner for the law firm of Preston, Gates, Ellis, Rouvelas, Meeds LLP in Washington.

Meanwhile, if they don't work harder to complete the third phase of implementation of existing Sarbanes-Oxley rules, many insurers, rather than a clean bill of financial health, will be hit with qualified audit opinions on Dec. 31, said Patricia Teufel, consulting actuary and principal for KPMG in Hartford, Conn.

Their views were aired at the spring meeting of the American Academy of Actuaries last week in Washington, D.C.

Ms. Teufel discussed Section 404, which requires company managements to report annually on the effectiveness of internal controls over financial reporting and auditors to separately test and opine on the controls. To meet these requirements, companies must design, document and test controls?and then remediate any that are found deficient, she said.

While many of her insurer clients have started the work involved with 404 compliance, "the difficulty I see is that most companies are saving the hardest processes for the end," she said, referring specifically to the loss reserving process.

By postponing the hard part, she said, "what you risk is that you, the company, or your external auditors find a problem" that you don't have time to fix before "the rubber hits the road on Dec. 31," she said, referring to the deadline for most insurance companies.

That means "you risk a qualified internal controls attestation" from the outside auditors, she said, adding that a dreaded consequence will be adverse investor reaction to a qualified opinion.

To avoid this, she suggested that companies must start looking at the controls on loss reserve reporting processes before June 30. That way they can remediate by Sept. 30 and auditors can have a quarter to test and sign off on controls by Dec. 31.

Explaining why she expects insurers to find problems that will need fixing, she said that internal controls to the reserving process don't simply mean checking the completeness of data underlying actuarial processes against data that's reported in the accounting general ledger. In addition, judgments need to be tested.

"The process that is supposed to be documented in 404 is the process by which management arrives at its recorded reserves," she said. What if management overrides a loss reserve estimate produced by a qualified actuary? "How do you effectively test professional judgment?" she asked.

Ms. Teufel and other audit firm representatives went on to debate the likelihood of companies actually receiving qualified opinions on processes like loss reserve estimation.

Some audience participants suggested that with loss reserves being the biggest liability on an insurer's balance sheet, insurers don't just risk qualified opinions on the reserve process, but risk adverse opinions on internal controls generally.

Others said pressures on both sides would make both qualified and adverse opinions unlikely?with firms accelerating their timetables because they fear unfavorable investor reactions to qualified opinions, and auditors moving to issue clean opinions given the fact that they've never uncovered material weaknesses in the past.

Ms. Geiger, who counsels clients on regulatory and legislative issues, delivered bad news on the possibility of more regulation. "This is only Act I," she said.

Rep. Richard Baker, R-La., and Rep. Michael Oxley, R-Ohio, have passed a bill out of the House Financial Services Committee "and it's not to retract provisions of Sarbanes-Oxley; it is to push it forward," she said.

The latest measure would substantially increase penalties for corporate wrongdoing by eliminating the ability "to hide behind state Homestead laws in bankruptcy." In other words, white-collar criminals wouldn't be able to keep their homes if they file for bankruptcy, she explained.

While Ms. Geiger noted that the amendments actually face a "very uphill battle" to get passed, "there's more coming," she predicted. "If it doesn't come from Congress, it will come from prosecutors and the Judiciary," she said, reasoning that these parties "want to see enforcement of Sarbanes-Oxley happen and happen now."

Last year, Congress allocated enough money to the Securities and Exchange Commission to hire 800 new people, and 188 of them are devoted to finding financial fraud. With that kind of backing, "they're going to find it," she said.

Also speaking during the session, Dave McRoberts, a CPA and business risk management consultant for Smart and Associates in Chicago, saw some good coming out of the 404 requirements to understand internal controls.

"My clients are going through this huge, massive, costly effort internally to document and test financial reporting controls. It virtually is a part-time job for everyone. [But] at the end of the day, these companies will have a much better understanding of what's going on in their companies, enhanced controls and better processes," he said.

In the insurance industry, in particular, he said that as insurance companies look at internal controls on information they get from third-party administrators, managing general agents and managing general underwriters, they are discovering the need for more controls. "There are a lot of loose situations out there," he said.