On August 15, 2008, the members of the Canadian Securities Administrators (CSA) issued the final text of new National Instrument 52-109 Certification of Disclosure in Issuers’ Annual and Interim Filings, together with related new forms and new Companion Policy 52-109CP (collectively, the New Instrument).1 The New Instrument replaces — and expands upon — current certification and disclosure requirements with respect to financial reporting, and is substantially unchanged from the most recent proposed version published in April 2008.2 Its stated purpose is "to improve the quality and reliability of issuers’ annual and interim disclosure." The CSA believes this improvement "will help to maintain and enhance investor confidence in the integrity of our capital markets."
The New Instrument and its expanded requirements will apply to interim and annual filings of all reporting issuers other than investment funds, in all Canadian jurisdictions, in respect of financial periods ending on or after December 15, 2008, provided that all necessary ministerial approvals are obtained. Venture issuers3 will benefit from less onerous requirements under the New Instrument, as discussed below.
This Legal Update summarizes the key changes to existing certification and disclosure requirements for certifying officers — i.e., the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), or persons performing similar functions — implemented by the New Instrument.
Evaluation of the Effectiveness of Internal Control over Financial Reporting
The certifying officers of a reporting issuer, subject to certain exceptions discussed below, will be required to personally certify in their annual certificates that:
- they have evaluated, or caused to be evaluated under their supervision, the effectiveness of the issuer’s internal control over financial reporting (ICFR) as at the end of the financial year; and
- they have caused the issuer to disclose in its annual Management’s Discussion and Analysis (MD&A) their conclusions about the effectiveness of the issuer’s ICFR based on such evaluation.
These new certification requirements will be in addition to the current requirements that an issuer’s certifying officers certify that, among other things:
- the issuer’s annual filings and interim filings do not contain any misrepresentation;
- the issuer’s financial statements and other financial information in its annual filings and interim filings fairly present the financial condition, results of operations and cash flows of the issuer;
- they have designed disclosure controls and procedures (DC&P) and ICFR, or caused them to be designed under their supervision;
- they have, on an annual basis, evaluated the effectiveness of the issuer’s DC&P and caused the issuer to disclose the conclusions of their evaluation in the issuer’s MD&A; and
- they have caused the issuer to disclose in its MD&A any change in the issuer’s ICFR that has materially affected the issuer’s ICFR.
The New Instrument does not require issuers to obtain from their external auditors a report in respect of management’s evaluation of the effectiveness of ICFR.
Disclosure of Material Weaknesses
The New Instrument requires a non-venture issuer’s certifying officers to identify and disclose in its MD&A a material weakness in the design or operation of its ICFR. Matching the definition adopted by the U.S. Securities and Exchange Commission (SEC), a "material weakness" under the New Instrument is defined as "a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the reporting issuer’s annual or interim financial statements will not be prevented or detected on a timely basis."
If a non-venture issuer determines it has a material weakness that exists at the end of the annual or interim financial period covered by its filings, the New Instrument requires the issuer to disclose in its MD&A for the corresponding period and for each such material weakness:
- a description of the material weakness;
- the impact of the material weakness on the issuer’s financial reporting and its ICFR; and
- the issuer’s current plans, if any, or any actions already undertaken, for remediating the material weakness.
There is no provision requiring mandatory remediation. However, if the issuer plans to remediate any material weakness, its plans must be disclosed.
Use of a Control Framework
The New Instrument requires that a non-venture issuer use a control framework to design its ICFR. Consistent with the requirements of the SEC, a suitable control framework under the New Instrument is one "established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment." The control framework used must be named in both the issuer’s interim and annual certificates.
The use of a particular control framework is not mandated. The new Companion Policy includes the following examples of suitable frameworks that could be used by an issuer to design ICFR:
- Risk Management and Governance: Guidance on Control (COCO Framework) published by The Canadian Institute of Chartered Accountants;
- Internal Control – Integrated Framework (COSO Framework) published by The Committee of Sponsoring Organizations of the Treadway Commission (COSO); and
- Guidance on Internal Control (Turnbull Guidance) published by The Institute of Chartered Accountants in England and Wales.
Smaller issuers can make use of Internal Control over Financial Reporting – Guidance for Smaller Public Companies published by COSO. This is particularly relevant in light of the requirement that a venture issuer that chooses to file the full certificate (rather than the venture issuer basic certificate described below) for a financial period must use a control framework to design its ICFR.
Under the New Instrument, a non-venture issuer may limit the scope of its design of DC&P and ICFR to exclude controls, policies and procedures of a proportionately consolidated entity or a variable interest entity in which the issuer has an interest, but not sufficient access to design and evaluate DC&P or ICFR for the entity, or of a business that the issuer acquired not more than 365 days before the end of the financial period to which the certificate relates.4 If the scope is so limited, an issuer must disclose this limitation in its MD&A and provide summary financial information of the entity or business in the issuer’s financial statements.
Venture Issuer Basic Certificate
The additional certification requirements discussed above are mandatory for non-venture issuers only. The New Instrument does not require venture issuers to include representations in their certificates pertaining to the establishment and maintenance of DC&P and ICFR, including any related MD&A disclosure. In fact, this significant change is already in effect for venture issuers in all jurisdictions of Canada in respect of financial periods ending on or after December 31, 2007.5
The New Instrument includes distinct forms of annual and interim certificates for venture issuers. These certificates contain an explanatory note to the reader identifying the material differences as compared to the full certificates required to be filed by non-venture issuers.
Alternative Certificate for Use Following Certain Transactions
Recognizing the considerable resources that an issuer must commit to complete an initial public offering or a reverse takeover, or to become a non-venture issuer, the New Instrument permits such issuers to file an alternative form of certificate for the first financial period ending after any such transaction.6 The alternative form of certificate is similar to the venture issuer basic certificate in that (i) it does not require the certifying officers to make representations relating to the establishment and maintenance of DC&P and ICFR, and (ii) it includes an explanatory note to the reader that sets out the differences between the alternative certificate and the full certificate generally required for non-venture issuers.
Exemptions for Cross-Border and Certain Other Issuers
The requirements of the New Instrument do not apply to (i) issuers that comply with U.S. federal securities laws implementing the annual and quarterly certification requirements under the Sarbanes-Oxley Act of 2002, provided that the issuer files on SEDAR its corresponding U.S. documents as soon as practicable after they are filed with or furnished to the SEC, and (ii) certain other foreign issuers, certain exchangeable security issuers and certain support issuers.
The new Companion Policy is significantly expanded, and provides important guidance that is intended to assist issuers and certifying officers in designing, evaluating and certifying DC&P and ICFR. This guidance is with respect to, among other things:
- individuals who may sign certificates in particular circumstances or on behalf of certain types of issuers;
- considerations for the design and evaluation of operating effectiveness of DC&P and ICFR, including self-assessments, compensating controls and mitigating procedures;
- evaluating the operating effectiveness of DC&P and ICFR;
- an issuer’s ICFR when using outside service providers;
- identifying and disclosing deficiencies in ICFR or material weaknesses;
- the role of directors and audit committees in relation to DC&P and ICFR;
- certain long term investments; and
- certification of revised or restated annual or interim filings.