No Audit Burden In Canadian Version Of SOX 404

As members of the U.S. business community grapple whether small public companies should be exempt from part or all of Section 404 of the Sarbanes-Oxley Act, Canadian regulators have made their own move—imposing their version of SOX on all corporations, but without the extensive auditing provisions of Section 404.

The Canadian Securities Administrators, the group of securities regulators that coordinates regulation for Canada’s capital markets, recently unveiled a plan to require companies to report on the effectiveness of their internal controls, but dropped a provision that required companies to get an opinion from external auditors on management’s evaluation of the effectiveness of internal controls. Instead, Canada’s regulation puts more emphasis on required quarterly certifications by management (see actual CSA notice in box at right).

Ramona Dzinkowski, vice president of Financial Executives International Canada, said the group was surprised by the decision to drop the external audit requirement and welcomed the news. “It came as quite a surprise,” Dzinkowski tells Compliance Week. “A collective sigh of relief was heard across the country. While our members are happy to report on the effectiveness of their internal controls, they’re happier not to pay an additional 50 percent in audit fees.”

The CSA said it decided against its proposed external audit requirement after “extensive review and consultation and in view of the delays and the debate underway in the U.S. over the rules implementing Section 404 of the Sarbanes-Oxley Act of 2002.”

St-Gelais

“We believe the proposed additional disclosure will increase management’s focus on, and accountability for, the quality of internal controls over financial reporting,” said Jean St-Gelais, chair of the CSA and chief executive of Québec’s Autorité des Marchés Financiers. He said the plan “will strengthen investor protection while appropriately balancing the costs and benefits associated with internal control reporting requirements for companies of all sizes.”

Canadian Influence?

Meanwhile, smaller public companies in the United States are still waiting to see if they’ll get their own break from Section 404. Next month the SEC’s Smaller Public Company Advisory Committee will issue its final report, which is expected to include a controversial proposal to exempt the smallest companies from the requirements of Section 404, while exempting some others from the external audit requirement.

The SEC has said it will give significant weight to the committee’s recommendations. However, several prominent members of the business community, including some SEC commissioners, have voiced opposition to the plan. Either way, the move of America’s largest trading partner and closest ally brings additional context to the question.

Thyen

“I am sure the Canadian proposal will have influence in the result in the U.S.,” says Jim Thyen, co-chair of the Smaller Company Advisory Committee and chief executive of Kimball International. “As our neighbor and as an important country on the world stage, the operation of the Canadian financial markets are important to all of us.”

Thyen says the committee has tried to listen effectively to public companies in the U.S. capital markets, and “also attempted to observe and learn from the capital markets of the world.”

The CSA plan will require publicly traded companies in all Canadian jurisdictions to report on the effectiveness of their internal controls over financial reporting. The earliest the requirements would be adopted would be for financial years ending on or after Dec. 31, 2007, which CSA said would allow “significant time” for companies to plan and implement activities needed to support the new disclosures.

Reducing "Disfunctional Consequences"

Richards

Dave Richards, president of the Institute of Internal Auditors, calls the move “a reasonable step on their part, given the size of companies it would affect.” He noted that most large Canadian companies are also listed in the United States and so are still subject to Section 404, while those that don’t list on American exchanges “are mostly small and midcap companies”—similar to those who would be exempted from Section 404 under a proposed recommendation by an advisory committee to the SEC.

PROPOSED AMENDMENT

The excerpt below is from the Canadian Securities Administrators Notice 52-313: "Status Of Proposed Multilateral Instrument 21-111 Reporting On Internal Control Over Financial Reporting," And Proposed Amended And Restated Multilateral Instrument 52-109 Certification Of Disclosure In Issuers' Annual And Interim Filings," Published March 10, 2006:

The securities regulatory authorities in all Canadian jurisdictions are issuing this notice to update market participants on the

status of our deliberations on proposed internal control reporting requirements.

After extensive review and consultation and in view of the delays and the debate underway in the US over the rules

implementing section 404 of the Sarbanes-Oxley Act of 2002 (the Sox 404 Rules), we have determined not to proceed with

proposed Multilateral Instrument 52-111 Reporting on Internal Control over Financial Reporting (Proposed MI 52-111).

As more fully discussed below, we propose to expand Multilateral Instrument 52-109 Certification of Disclosure in Issuers’

Annual and Interim Filings (MI 52-109) to include the following additional provisions in respect of internal control over financial

reporting:

The CEO and CFO of a reporting issuer, or persons performing similar functions, will be required to certify in their annual certificates that they have evaluated the effectiveness of the issuer’s internal control over financial reporting as of the end of the financial year and caused the issuer to disclose in its annual MD&A their conclusions about the effectiveness of internal control over financial reporting as of the end of the financial year based on such evaluation.

The issuer will not be required to obtain from its auditor an internal control audit opinion concerning management’s assessment of the effectiveness of internal control over financial reporting.

These requirements will apply to all reporting issuers, other than investment funds, in all Canadian jurisdictions.

The earliest that these requirements will apply is in respect of financial years ending on or after December 31, 2007.

Source

Canadian Securities Administrators Notice 52-313 (Published March 10, 2006)

“It seems to be in alignment with what’s going on in the U.S.,” Richards says. “The only difference I see is that [the CSA] is putting more emphasis on the filing of what in the U.S. is called the 302 quarterly report.”

Canada’s proposal calls for the CEO and CFO of a reporting issuer, or persons performing similar functions, to certify in their annual certificates that they have evaluated the effectiveness of the issuer’s internal control over financial reporting as of the end of the financial year. They must also certify that they were responsible for putting the conclusions about internal controls into the issuer’s MD&A.

The MD&A disclosure will include a description of the process for evaluating the effectiveness of the issuer’s internal control over financial reporting, and the conclusions about the controls’ effectiveness as of the end of the financial year. Issuers won’t, however, have to obtain an auditor opinion concerning management’s assessment of the effectiveness of internal control.

Leech

“They’ve basically beefed up Section 52-109—the equivalent of SOX Section 302—to require management to state their conclusion and also to describe the approach they used to reach their conclusion,” says Tim Leech, chief methodology officer at Paisley Consulting. “I think it’s the 90-10 rule. It achieves 90 percent of the benefits with a huge reduction in the dysfunctional consequences.”

Obtaining Balance

Leech, who says the problems with Section 404 stem from the way Sarbanes has been interpreted in the United States, contends that external auditors should report on the reliability of the assessment and reporting approach used by management—not give their own opinion on whether the internal controls over financial reporting are effective, as is currently required. “All that would take in the U.S. would be a reinterpretation of [SOX] Section 302 and Section 404 subsection B, without changing the Act,” says Leech.

Noting that the estimated impact of the changes on smaller public companies was “greatly understated and turned out to be very substantial,” Thyen says, “Balance needs to be obtained and the regulations need to recognize that the characteristics of smaller public companies is different that large companies … The approach of application and implementation must vary to achieve the same end result. That’s the essence of our preliminary recommendations.”

The CSA says it will monitor implementation of the proposed approach, including reviewing the disclosure in the MD&A regarding internal controls and the related certifications. The group may also inquire into the procedures that support the disclosure and certifications, “particularly where the continuous disclosure filings contain material misstatements or apparent errors.”

Based on the results of its monitoring and “in light of experience in Canada and internationally,” the CSA says it will “consider in the future” whether a requirement for auditor review of the evaluation of internal controls would “contribute in a cost-effective manner to further improving the quality and consistency of disclosure to investors.”

The CSA will seek public comment on the proposed requirements, together with other amendments to MI 52-109 previously published for comment in February 2005 and will publish an amended and restated MI 52-109 for comment later this year. Information on precisely when the comment period will begin, and how people can submit comments, was not available last week.