The Canadian Securities Administrators (CSA) announced in March that it would not require auditors to attest to the effectiveness of an issuer''s internal controls over financial reporting.
The decision extends to all Canadian issuers other than investment funds. It means that the CSA will not proceed with Proposed Multilateral Instrument 52-111: Reporting on Internal Control over Financial Reporting, put forward in February 2005 and substantially similar to s. 404 of the Sarbanes-Oxley Act (SOX 404) in the U.S.
Both SOX 404 and the CSA's original proposal have come under heavy criticism as costly and burdensome, especially to small companies.
"The CSA has shown that it was listening when it held cross-country consultations," says Paul Findlay of Borden Ladner Gervais LLP's Toronto office.
Instead, the CSA will strengthen the chief executive and chief financial officers' certification requirements by expanding Multilateral Instrument 52-109: Certificate of Disclosure in Issuers' Annual and Interim Filings.
Both executives will now have to certify that they have evaluated the effectiveness of their companies' internal controls over financial reporting.
Additionally, the management discussion and analysis portion of annual reports will now have to contain a description of the process followed by the CEO and CFO in conducting their evaluation. It must also state their conclusions about the controls' effectiveness.
Issuers may still choose to engage external auditors to assist in the evaluation process, but an audit opinion will not be required.
Although no date has been set for implementation of the new proposals, the earliest reports they will affect are those for financial years ending on Dec. 31, 2007.
Existing certification requirements will remain in place. This means that for any financial year ending on or after March 31, 2005, CEOs and CFOs must certify that they have evaluated the effectiveness of disclosure controls and procedures. And beginning with financial years ending on or after June 30, 2006, CEOs and CFOs must certify that the issuer has designed internal controls over financial reporting and reported changes in those controls in the company's MD&A.
In its notice of March 10 announcing its decision not to impose audits, the CSA specifically noted "the debate underway in the U.S." over SOX 404. As it turned out, a Securities and Exchange Commission advisory panel recommended on April 21 that some 6,000 small companies with market capitalization of less than U.S.$128 million, or 70 per cent of U.S. public companies, be exempted from SOX 404.
The recommendations must still be approved by the SEC's five commissioners. Four have indicated that they oppose it, including SEC Chairman Christopher Cox. Still, the advisory panel's co-chair, Herbert Hander, has stated his belief that Cox is receptive to the panel's recommendations.
A recent study by research firm CRA International estimated the cost of first-year SOX 404 to large companies (with caps over U.S.$700 million) at $8.5 million annually. CRA estimates that companies with caps between $75 million and $700 million spent $1.2 million complying with it.
The SEC originally estimated average costs of $91,000 per company.
On the other hand, costs appear to be dropping. CRA says they will fall by 40 per cent in the second year of implementation. A study commissioned by the Big Four accounting firms supports this. The study says larger companies reduced their costs by 44 per cent to $4.77 million, while smaller companies costs' dropped 31 per cent to $860,000.
Notably, the SEC has not yet required companies with caps under $75 million to comply with SOX 404.
"And it's important to remember that the size of Canadian companies is generally smaller than that of U.S. companies," Findlay says. "For example, audit confirmation of internal controls would be especially hard on companies listed on the TSX Venture Exchange."
Conversely, the reduced cost of compliance could be an advantage for TSX companies in general.
Robert Chapman of McCarthy T?trault LLP's Ottawa office says the removal of the audit requirement is a "big deal" for his clients.
"I tend to work in the technology area, and unless you're RIM or COGNOS, you're going to have modest resources, so cost is crucial," he says.
"As for the actual cost, it wouldn't shock me if you told me that an audit cost of $100,000 would double if auditors had to attest to the internal controls. We're talking serious dollars here."
While the CSA obviously paid attention to the U.S. studies and the surrounding controversy, it appears that it broke its own path.
"Canadian corporate governance legislation has never been a carbon copy of what exists south of the border," says Cynthia Sargeant of Blake Cassels & Graydon LLP's Toronto office. "The fact that the U.S. was having issues with SOX 404 may have been a factor in the CSA's deliberation, but it wasn't likely determinative."
All this doesn't mean that auditor involvement is dead.
The CSA intends to amend and restate its certification instrument later this year after seeking public comment. Afterwards, it will review the MD&As filed pursuant to the new instrument and monitor the experience throughout Canada and internationally by way of considering whether auditor involvement would improve disclosure in a cost-effective fashion.
"The CSA has been careful in considering what's workable, and I expect it will continue with that approach," says Chris Hewat of Blakes.
The decision extends to all Canadian issuers other than investment funds. It means that the CSA will not proceed with Proposed Multilateral Instrument 52-111: Reporting on Internal Control over Financial Reporting, put forward in February 2005 and substantially similar to s. 404 of the Sarbanes-Oxley Act (SOX 404) in the U.S.Both SOX 404 and the CSA's original proposal have come under heavy criticism as costly and burdensome, especially to small companies.
"The CSA has shown that it was listening when it held cross-country consultations," says Paul Findlay of Borden Ladner Gervais LLP's Toronto office.
Instead, the CSA will strengthen the chief executive and chief financial officers' certification requirements by expanding Multilateral Instrument 52-109: Certificate of Disclosure in Issuers' Annual and Interim Filings.
Both executives will now have to certify that they have evaluated the effectiveness of their companies' internal controls over financial reporting.
Additionally, the management discussion and analysis portion of annual reports will now have to contain a description of the process followed by the CEO and CFO in conducting their evaluation. It must also state their conclusions about the controls' effectiveness.
Issuers may still choose to engage external auditors to assist in the evaluation process, but an audit opinion will not be required.
Although no date has been set for implementation of the new proposals, the earliest reports they will affect are those for financial years ending on Dec. 31, 2007.
Existing certification requirements will remain in place. This means that for any financial year ending on or after March 31, 2005, CEOs and CFOs must certify that they have evaluated the effectiveness of disclosure controls and procedures. And beginning with financial years ending on or after June 30, 2006, CEOs and CFOs must certify that the issuer has designed internal controls over financial reporting and reported changes in those controls in the company's MD&A.
In its notice of March 10 announcing its decision not to impose audits, the CSA specifically noted "the debate underway in the U.S." over SOX 404. As it turned out, a Securities and Exchange Commission advisory panel recommended on April 21 that some 6,000 small companies with market capitalization of less than U.S.$128 million, or 70 per cent of U.S. public companies, be exempted from SOX 404.
The recommendations must still be approved by the SEC's five commissioners. Four have indicated that they oppose it, including SEC Chairman Christopher Cox. Still, the advisory panel's co-chair, Herbert Hander, has stated his belief that Cox is receptive to the panel's recommendations.
A recent study by research firm CRA International estimated the cost of first-year SOX 404 to large companies (with caps over U.S.$700 million) at $8.5 million annually. CRA estimates that companies with caps between $75 million and $700 million spent $1.2 million complying with it.
The SEC originally estimated average costs of $91,000 per company.
On the other hand, costs appear to be dropping. CRA says they will fall by 40 per cent in the second year of implementation. A study commissioned by the Big Four accounting firms supports this. The study says larger companies reduced their costs by 44 per cent to $4.77 million, while smaller companies costs' dropped 31 per cent to $860,000.
Notably, the SEC has not yet required companies with caps under $75 million to comply with SOX 404.
"And it's important to remember that the size of Canadian companies is generally smaller than that of U.S. companies," Findlay says. "For example, audit confirmation of internal controls would be especially hard on companies listed on the TSX Venture Exchange."
Conversely, the reduced cost of compliance could be an advantage for TSX companies in general.
Robert Chapman of McCarthy T?trault LLP's Ottawa office says the removal of the audit requirement is a "big deal" for his clients.
"I tend to work in the technology area, and unless you're RIM or COGNOS, you're going to have modest resources, so cost is crucial," he says.
"As for the actual cost, it wouldn't shock me if you told me that an audit cost of $100,000 would double if auditors had to attest to the internal controls. We're talking serious dollars here."
While the CSA obviously paid attention to the U.S. studies and the surrounding controversy, it appears that it broke its own path.
"Canadian corporate governance legislation has never been a carbon copy of what exists south of the border," says Cynthia Sargeant of Blake Cassels & Graydon LLP's Toronto office. "The fact that the U.S. was having issues with SOX 404 may have been a factor in the CSA's deliberation, but it wasn't likely determinative."
All this doesn't mean that auditor involvement is dead.
The CSA intends to amend and restate its certification instrument later this year after seeking public comment. Afterwards, it will review the MD&As filed pursuant to the new instrument and monitor the experience throughout Canada and internationally by way of considering whether auditor involvement would improve disclosure in a cost-effective fashion.
"The CSA has been careful in considering what's workable, and I expect it will continue with that approach," says Chris Hewat of Blakes.
