Home > Media Room > Media Releases > 2005 Media Releases

Executive Brief: Proposed Canadian Rule on Internal Control Reporting

The Institute thanks KPMG LLP for enabling us to use its recently published summary of the proposed rule as source material for this document. The KPMG summary is available in its entirety at www.kpmg.ca.

What does "internal control" mean?

According to the Canadian Securities Administrators (CSA), "internal control over financial reporting" means a process designed by, or under the supervision of, the CEO and CFO, and effected by the Board of Directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with Generally Accepted Accounting Principles (GAAP).

What does the rule require?

The proposed rule, published by the CSA, will require that management of certain Canadian issuers evaluate, under the direction of the CEO and CFO, the effectiveness of internal control over financial reporting (ICOFR). It also requires that auditors report on management’s assessment of ICOFR based on standards established by the Canadian Institute of Chartered Accountants. The proposed instrument is substantially the same as the requirements of Section 404 of the U.S. Sarbanes-Oxley Act of 2002 and related rules issued by the U.S. Securities and Exchange Commission.

The CSA also published proposed revisions to rules governing the certification of disclosure in issuers’ annual and interim filings.

What entities are subject to the new rules?

The proposed internal control rule applies to all reporting issuers other than investment funds and venture issuers. By contrast, the revised certification rules apply to all reporting issuers other than investment funds. As a result, venture issuers are subject to the requirements of the revised certification rules, but not to the proposed internal control rule.

What is their intended purpose?

The objective of these measures is to improve the quality and reliability of financial and other continuous disclosure reporting, in the belief that this will maintain and enhance investor confidence in the integrity of our capital markets.

What would issuers have to do?

The proposed rule directs every issuer to .le a report of management that describes management’s assessment of the effectiveness of the issuer’s ICOFR. That report must be approved by the Board of Directors and include:

• a statement of management’s responsibility for establishing and maintaining adequate ICOFR

• a statement identifying the control framework used by management to evaluate the effectiveness of ICOFR

• management’s assessment of the effectiveness of ICOFR as of the end of the issuer’s financial year, including a statement as to whether ICOFR is effective

• disclosure of any material weakness in ICOFR identified by management

• a statement that the participating audit firm that audited the issuer’s annual financial statements have issued an internal control audit report, and

• disclosure of any limitations in management’s assessment of the effectiveness of ICOFR

What is a "material weakness"?

"Material weakness" means a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. Deficiencies in ICOFR adversely affect an issuer’s ability to initiate, record, process or report external financial data reliably in accordance with GAAP. Any material weakness will preclude reporting that the issuer’s ICOFR is operating effectively and therefore results in an adverse internal control audit report.

What should be assessed?

Controls subject to the assessment should include:

• controls over initiating, authorizing, recording, processing and reporting signifi.cant accounts and disclosures and related assertions included in the financial statements

• controls over the selection and application of appropriate accounting policies that are in accordance with GAAP

• anti-fraud programs and controls

• controls, including information technology general controls, on which other controls are dependent

• controls over significant non-routine and non-systemic transactions, such as accounts involving judgments and estimates

• controls over the period-end financial reporting process, and

• company-level controls, including the control environment

What are the timelines?

The proposed rules will be phased in over four years, starting with financial years ended on or after June 30, 2006. The implementation dates are based on market capitalization as follows (first year-ends to which reporting requirements apply are set out in bold):

• Issuers with a market capitalization of greater than $500,000,000 (June 30, 2006)

• Issuers with a market capitalization of $250,000,000 or more but less than $500,000,000 (June 30, 2007)

• Issuers with a market capitalization of $75,000,000 or more but less than $250,000,000 (June 30, 2008)

• Issuers with a market capitalization of less than $75,000,000 (June 30, 2009)

What can you do?

Comments on the proposals are requested by June 6, 2005. The notice provided by the CSA invites comments generally, and raises a number of questions for specific.c consideration. Send comments to:

Mail: John Stevenson, Secretary, Ontario Securities Commission, 20 Queen Street West, Suite 1900, Box 55, Toronto, Ontario M5H 3S8; Fax: (416) 593-2318; E-mail: jstevenson@osc.gov.on.ca.