A man from a forensic accounting firm pointed out that with Sarbanes-Oxley, a firm must document their internal control system, including weaknesses. It seems that many insurance firms are refusing to pay up where cases of fraud invovled areas where identified internal control weaknesses were involved. Is any familiar with this?