On March 30, 2007, the members of the Canadian Securities Administrators (CSA) issued a notice and request for comments with respect to the proposed repeal and replacement of Multilateral Instrument 52-109 Certification of Disclosure in Issuers’ Annual and Interim Filings (proposed instrument).1 The proposed instrument reflects the suggested approach for additional provisions relating to internal control over financial reporting (ICFR) described in a CSA notice released in March 2006.2 Among other new requirements, it is proposed that the CEO and CFO of a reporting issuer, or persons performing similar functions, will be required to certify in their annual certificates that they have evaluated the effectiveness of the issuer's ICFR as of the end of the financial year and have caused the issuer to disclose in its annual MD&A their conclusions about the effectiveness of such internal control based on such evaluation.
In formulating their approach and the proposed instrument, the CSA carried out an extensive review and consultation with market participants in Canada, and observed the delays, debate and guidance in the United States with respect to the rules implementing Section 404 of the Sarbanes-Oxley Act of 2002 (Sarbanes Oxley). In the course of their deliberations, on March 10, 2006, the CSA previously withdrew proposed Multilateral Instrument 52-111 Reporting on Internal Controls over Financial Reporting that would have required, among other things, issuers listed on the TSX to obtain from their external auditors a report in respect of management’s evaluation of the effectiveness of ICFR.3
Instead, with the proposed instrument, the CSA intend to expand existing Multilateral Instrument 52-109 Certification of Disclosure in Issuers’ Annual and Interim Filings (existing certification instrument) to include a number of additional requirements. For instance, the CEO and CFO of a reporting issuer, or persons performing similar functions, will be required to certify in their annual certificates that they have evaluated the effectiveness of the issuer’s ICFR as of the end of the financial year and have caused the issuer to disclose in its annual MD&A their conclusions about the effectiveness of such internal control based on such evaluation.
The overall objective of the proposed new requirements is to improve the quality, reliability and transparency of financial reporting, without stifling Canadian capital markets with the burden of disproportionate compliance costs. The expanded requirements would apply to all reporting issuers, other than investment funds, in all Canadian jurisdictions in respect of financial years ending on or after June 30, 2008.
The new requirements
The proposed new internal control reporting requirements will be implemented by expanding the existing certification instrument to include the measures described below.
The CEO and CFO of a reporting issuer, or persons performing similar functions, will be required to certify in their annual certificates that:
- they have evaluated the effectiveness of the issuer’s ICFR as of the end of the financial year and that the issuer has disclosed in its MD&A (i) its conclusions about the effectiveness of the issuer’s ICFR as of the end of the financial year based on such evaluation, (ii) a description of the process used to evaluate the effectiveness of ICFR, (iii) a description of any reportable deficiency4 relating to operation of ICFR existing at the financial year end, and (iv) the issuer’s plans, if any, to remediate any such reportable deficiency relating to the operation of ICFR; and
- they have disclosed to the issuer’s auditors, board of directors and audit committee any fraud that involves management of other employees who have a significant role in ICFR.
The CEO and CFO of a reporting issuer, or persons performing similar functions, will be required to certify in their annual and interim certificates that:
the issuer has disclosed in its MD&A a statement identifying the control framework used to design the issuer’s ICFR or, if applicable, a statement that it did not use a framework;
- the issuer has disclosed in its MD&A, for any reportable deficiency relating to the design of ICFR, (i) a description of the reportable deficiency, (ii) a description of the remediation plan to address the reportable deficiency, and (iii) the completion date or expected completion date of the remediation plan. Venture issuers that cannot reasonably remediate a reportable deficiency will be entitled to rely on an accommodation measure that will require specific MD&A disclosure;5 and
- if applicable, the issuer has disclosed in its MD&A: (i) the fact that the scope of design of the issuer’s disclosure controls and procedures (DC&P) and ICFR is limited to exclude controls, policies and procedures of (a) any proportionately consolidated entity, (b) any variable interest entity, or (c) a business that the issuer acquired not more than 90 days before the issuer’s financial year end; and (ii) summary financial information of any proportionately consolidated entity, variable interest entity or business that the issuer acquired that has been proportionately consolidated or consolidated in the issuer’s financial statements.
For a copy of the proposed full annual certificate on Form 52-109F1, marked to identify substantive changes in officer certification requirements relative to the certificate on Form 52-109F1 that CEOs and CFOs are presently required to sign, click here.
The proposed new requirements represent, among other changes, an expansion of the requirements under the existing certification instrument, which currently require certification regarding the design of DC&P and ICFR as well as the disclosure in the issuer’s MD&A of any changes in the issuer’s ICFR and conclusions about the effectiveness of DC&P.
The proposed new requirements mean that an issuer’s board of directors and its audit committee will have to consider and approve disclosure with regard to the effectiveness of ICFR as part of its overall approval of the issuer’s annual MD&A, in addition to the currently mandated disclosure. While not required, an issuer’s board of directors or its audit committee may, in consultation with management, choose to engage the issuer’s auditor to assist in the discharge of its responsibilities with respect to the issuer’s internal control systems. As noted by the CSA,6 the requirements of the proposed instrument and the increased accountability of the certifying officers do not diminish the existing obligations of an issuer’s auditor under generally accepted auditing standards to understand the issuer’s internal controls relevant to the audit of the issuer’s financial statements or the auditor’s related responsibilities for reading and assessing the issuer’s materials with which the auditor is deemed to be associated.
The proposed instrument provides, in a significantly expanded Companion Policy, important guidance that is intended to assist issuers and officers in designing, evaluating and certifying DC&P and ICFR. This guidance includes (i) a list of available control frameworks that could provide certifying officers with a useful reference when designing and evaluating the effectiveness of ICFR, (ii) considerations for the design and evaluation of DC&P and ICFR, (iii) guidance for determining whether a reportable deficiency exists, and (iv) a discussion of the role of directors and audit committees in relation to DC&P and ICFR.
Who will be subject to the new requirements?
The new internal control reporting requirements will apply to all reporting issuers, other than investment funds, in all Canadian jurisdictions.
The proposed instrument includes exemptions for an issuer that complies with U.S. federal securities laws implementing the annual and quarterly certification requirements under Sarbanes Oxley, provided that the issuer files on SEDAR as soon as practicable after they are filed with or furnished to the U.S. Securities Exchange Commission (SEC):
- in the case of the issuer’s annual filings, the signed certificate relating to the annual report (in accordance with Section 302 of Sarbanes Oxley) and management’s annual report on ICFR and the auditor attestation report on management’s assessment of ICFR (in accordance with Section 404 of Sarbanes Oxley); and
- in the case of the issuer’s interim filings, the signed certificate relating to the quarterly report (in accordance with Section 302 of Sarbanes Oxley).
These exemptions are generally consistent with those provided for under the existing certification instrument and take into account the more recent implementation in the U.S. of expanded requirements relating to the evaluation and attestation of ICFR under Section 404 of Sarbanes Oxley. Where an issuer prepares two sets of financial statements and files Canadian GAAP statements in the applicable Canadian jurisdictions only, these exemptions will not be available. Additionally, the exemption from filing quarterly report certifications is not available under the proposed instrument if the issuer is only certifying its annual financial statements under Sarbanes Oxley. If an issuer is not certifying its quarterly financial statements under Sarbanes Oxley, then it would be required to certify its quarterly financial statements in accordance with the proposed instrument. This affects many Canadian issuers that comply with Sarbanes Oxley because, as a matter of practice and in accordance with clear SEC guidance on the point, foreign private issuers are not required to certify their quarterly financial statements that are “furnished” (as opposed to “filed”) with the SEC by way of Form 6-K (although some issuers do so on a voluntary basis).
When will the new requirements apply?
Recognizing that the planning and implementation of the process for evaluating the effectiveness of ICFR will be a significant undertaking for many issuers, the CSA propose that the new certification requirements and the new form of annual and interim certificate will apply in respect of financial periods ended on or after June 30, 2008. The proposed instrument also provides for a transitional form of officer certificate, which excludes certification regarding the evaluation and MD&A disclosure relating to ICFR, for financial years ending on or before June 29, 2008.
Next steps and ongoing review
The notice and request for comments issued by the CSA on March 30, 2007 invites written comments on the proposed instrument no later than June 28, 2007. Depending on the nature of the comments received by the CSA, we expect that, after careful consideration of such comments and having made the amendments deemed appropriate by the CSA, a revised and final version of the proposed instrument will be published later this year or early next year with an effective date of June 30, 2008, as presently contemplated. Accordingly, we encourage you to promptly communicate to us any comments or concerns you may have with respect to the proposed instrument.
After the effective date of the new requirements, the members of the CSA will review the disclosure regarding ICFR contained in issuers’ MD&A as part of their continuous disclosure review. Based on this review and monitoring of the experience in Canada and internationally, the CSA intend to consider whether auditor involvement in the process would contribute, in a cost-effective manner, to improving disclosure to investors.