New rules on certification of annual and interim filings will come into effect on December 15, 2008. National Instrument 52-109 – Certification of Disclosure in Issuers’ Annual and Interim Filings (the Instrument) and its Companion Policy 52-109CP (the Companion Policy) will repeal and replace the current certification rules and will expand the certification and disclosure requirements with respect to internal controls over financial reporting (ICFR). The Instrument will apply to all reporting issuers, other than investment funds, across Canada, although venture issuers will be subject to reduced requirements. The new requirements will apply in respect of annual filings, which means the issuer’s Annual Information Form (AIF), if any, its annual financial statements and its annual MD&A (including all documents and information that are incorporated by reference in the AIF), and interim filings, which means the issuer’s interim financial statements and its interim MD&A, for financial periods ending on or after December 15, 2008. The forms of certification prescribed under the certification rules which are repealed by the Instrument will continue to apply in respect of financial periods ending before December 15, 2008.
REQUIREMENTS APPLICABLE TO NON-VENTURE ISSUERS
Currently, CEOs and CFOs of non-venture issuers are required to certify that:
- the annual and interim filings do not contain any misrepresentations;
- the financial statements, together with the financial information included in the annual or interim filings, fairly present in all material respects the financial condition, results of operations and cash flow of the issuer;
- they have designed disclosure controls and procedures (DC&P) and ICFR or caused them to be designed under their supervision;
- they have caused the issuer to disclose in its MD&A any change in the issuer’s ICFR that has materially affected or is reasonably likely to materially affect the issuer’s ICFR; and
- on an annual basis, they have evaluated the effectiveness of DC&P and caused the issuer to disclose their conclusions as to the effectiveness of DC&P in its MD&A.
The Instrument provides that all issuers, other than venture issuers and investment funds, must establish and maintain DC&P and ICFR and use a control framework to design their ICFR. In addition to the certification requirements set out above, the CEO and the CFO of a non-venture issuer must certify:
- the control framework used to design the issuer’s ICFR;
- that they are responsible for establishing and maintaining DC&P and ICFR;
- on an annual basis, that they have evaluated, or caused to be evaluated, the effectiveness of the issuer’s ICFR and caused the issuer to disclose their conclusions as to the effectiveness of ICFR in its MD&A;
- that the issuer has disclosed in its interim or annual MD&A any “material weakness” relating to the design of its ICFR and in its annual MD&A any “material weakness” relating to the operation of its ICFR existing at its financial year end and has included a description of any such weakness, the impact of such weakness on the issuer’s financial reporting and its ICFR, and the issuer’s current plans, if any, or any actions already undertaken to remediate such weakness (a “material weakness” is defined to mean a deficiency or combination of deficiencies in ICFR such that there is a reasonable possibility that a material misstatement of the reporting issuer’s annual or interim financial statements will not be prevented or detected on a timely basis); and
- on an annual basis, that they have disclosed to the issuer’s auditors and board of directors or audit committee any fraud involving management or employees who have a significant role in ICFR.
A non-venture issuer may limit the scope of the design of its DC&P or ICFR to exclude controls, policies and procedures of proportionately consolidated entities, variable interest entities or any business that the issuer acquired not more than 365 days before the end of the period to which the annual or interim filing relates. Limiting the design is only permitted, in the case of a consolidated or variable interest entity, where the certifying officers would not have a reasonable basis for making the certification due to insufficient access to such an entity and, in the case of a business acquired by the issuer, only in an annual certificate relating to the financial year in which the business was acquired and only in an interim certificate relating to the first, second or third interim period ending on or after the date the issuer acquired the business. The limitation must be disclosed in the issuer’s MD&A, together with summary financial information about such entity or business that has been proportionately consolidated or consolidated in the issuer’s financial statements. The CEO and CFO will also be required to certify that the issuer has made such disclosure.
Issuers are not required to obtain from their external auditors a report concerning management’s assessment of the effectiveness of ICFR. This represents a divergence from US requirements and will reduce the costs faced by issuers.
The Companion Policy to the Instrument provides guidance as to suitable control frameworks for ICFR. Common frameworks include the COCO Framework published by The Canadian Institute of Chartered Accountants, the COSO Framework published by The Committee of Sponsoring Organizations of the Treadway Commission and the Turnbull Guidance published by The Institute of Chartered Accountants in England and Wales. The Companion Policy confirms that using a top-down, risk-based approach to ICFR and DC&P certification is appropriate. In addition, the Companion Policy provides guidance on how the use of third parties such as service organizations and specialists would affect the design and evaluation processes.
The Companion Policy provides additional guidance with respect to, among other things, evaluating the operating effectiveness of DC&P and ICFR, individuals who may sign the certificates, the role of the board of directors and audit committee in the design and evaluation of DC&P and ICFR and certain long term investments.
As is currently the case, issuers who comply with the US rules on certification and ICFR will be exempt from the Instrument provided that they file the US certification and ICFR attestation report on management’s assessment of ICFR with the Canadian securities regulators.
REQUIREMENTS APPLICABLE TO VENTURE ISSUERS
Currently, as a result of blanket relief issued by the provincial securities regulators, venture issuers are not required to certify as to the design and effectiveness of DC&P or ICFR. This reduced certification has been maintained in the Instrument. Venture issuers will be allowed to file a “basic” certificate which will not include any representations regarding DC&P or ICFR. However, such a certificate must include a note to readers explaining that it does not include any representations as to DC&P and ICFR. In addition, a venture issuer will not be required to discuss the design or operating effectiveness of DC&P and ICFR in its annual and interim MD&A. If a venture issuer wishes to discuss DC&P or ICFR in its MD&A, then it is suggested the same explanatory note to readers be included in the MD&A as is included in the basic certificate.