This article provides a brief overview of Information Technology (IT) internal controls, and how management can align the controls to enhance business operations, and regulatory requirements such as Bill 198 in Canada and Sarbanes Oxley (SOX) in the USA.

Internal controls within the Information Technology are some of the most important internal controls because of the pervasive reliance upon automated data processing and information systems throughout all organizations. As a result, it is important for companies to ensure that IT controls are designed properly and operating effectively.

As you might expect, there is a tremendous amount of literature regarding IT controls that has been developed and refined over the years by several different stakeholder organizations. Two control “frameworks” have been devised to assist both management and auditors in designing and assessing controls in computerized environments. One is the Information Technology Control Guidelines (IT Guidelines), first published by the Canadian Institute of Chartered Accountants (CICA) in 1970 (in its 3rd edition in 2011). The other is the Control Objectives for Information and related Technology (COBiT) developed by the Information Systems Audit and Control Association (ISACA). Further details of on both of these IT frameworks can be assessed by the web-links below.

IT Guidelines

COBiT

Both the IT Guidelines and COBiT are very detailed and used primarily by large organizations and external auditors. However, the general concepts essentially boil down to IT General controls, and IT Application controls, and are relevant to organizations of any size.

Let’s cut to the chase – which IT Controls do management within all organizations need to be aware of, and furthermore, from publicly listed entity point of view, which controls need to be reviewed and tested ongoing?

IT General Controls – are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems. These controls apply to mainframe, server, and end-user environments. General IT controls commonly include:
• Controls over data centre and network operations
• System software acquisition, change and maintenance
• Access security
• Application system acquisition, development, and maintenance.
• Physical security of assets, including adequate safeguards such as secured facilities over access to assets and records,
• Authorization for access to computer programs and data files.

Separation of the duties performed by analysts, programmers and operators is another important IT general control. The general idea is that anyone who designs a processing system should not do the technical programming work, and anyone who performs either of these tasks should not be the computer operator when “live” data are being processed. Persons performing each function should not have access to the equipment. Computer systems are susceptible to manipulative handling, and the lack of separation of duties along the lines described should be considered a serious weakness in general control. The control group or similar monitoring by the user departments can be an important compensating factor for weaknesses arising from lack of separation of duties in computerized systems”.

IT General Controls are one of the most important areas to review, especially as part of the CEO / CFO Certification at publicly listed entities in Canada. It makes sense – almost all business use some form of ERP system including automated financial reporting systems. The accuracy and reliability of financial reporting depend to a large extent on the IT controls that an organization has in place.

IT Application Controls – these are controls that relate to specific computer software applications and the individual transactions. For example, a company would usually place restrictions on which personnel have authorization to access its general ledger so as to revise its chart of accounts, posting / approving journal entries etc. In order to enact this policy and restrict access, the general ledger software package would require the necessary functionality. Furthermore, assuming the functionality exists, does the company have a policy in place, and is there evidence that the general ledger authorizations align with the policy? Controls around application access are obviously very important and need to be reviewed closely as part of the certification process.

The literature and regulations pertaining to the review and testing of IT Application controls by auditors and management, addresses 3 types of application controls; Input Controls (transactions captured, accurately recorded, and properly authorized), Processing Controls (transaction processing has been performed as intended), and Output Controls (accuracy of processing result). These control tests are typically performed when a new system has been implemented. Afterwards, once the controls have been confirmed to be operating effectively, for purposes of expediency, the focus tends to be on the “key” controls, such as who has system access to make changes to the various applications, and are the policies being followed.

In my experience, IT Application controls are extremely important to monitor. Consider the impact of in-correct pricing on reported revenues. The employees that have access to change pricing within the ERP system should be authorized by the appropriate level of management. A list of employees having access to pricing modifications should be reviewed periodically. Furthermore, the system should be secure so that only authorized employees can have access. This may sound very logical and straightforward, but without ongoing vigilance and monitoring by management, it is very likely that some unauthorized employees may have access. Incorrect pricing leads to incorrect revenues. Remember – revenue recognition has been cited as the number one cause of errors regarding financial reporting.

I hope this helps to bridge the understanding the theory behind IT General and IT Application Controls, and the practical realities and basic requirements that business should be aware of.

If you require further information, assistance in this area, or wish to comment on this, please don’t hesitate to contact GFS Consulting at info@gfsconsulting.ca or 905-630-1607.

Why is it so important to design and implement strong internal controls in all organizations small and large, and to check regularly to make sure they are working as intended? Some of the more obvious reasons include fraud prevention and compliance with regulations, but in my humble opinion, it just boils down to good business sense to do so. I will by-pass some of the more technical aspects, and present this internal control summary from a business person’s point of view.

The benefit of strong Internal Controls:

Authorizing contracts and transactions in accordance with company policy and procedures – this is probably the most obvious – every organization has, or should have some guidelines for such basic processes as purchasing goods / services and paying bills to suppliers etc. It’s very important that these internal controls are designed effectively, as they provide the rules for processing transactions. Strong internal controls begin with proper design, and then follow with them operating effectively – that is – are they being followed. In other words, does the organization have sufficient oversight to ensure that controls are actually being followed? I’ve seen it so many times where a control is thought to be in place, but in fact it is not being adhered to. Periodic reviews of internal controls (at least annual or more if there are changes in the business) can identify these issues. Consider it similar to ongoing maintenance of equipment or regular health check – you can catch and resolve problems before they develop into something much more serious.

Maintaining and increasing efficiencies in business processes – internal controls do not in of themselves translate into productivity and business efficiencies, but the design and in particular the ongoing review of them will highlight changes in processes which may provide opportunities for instance to eliminate redundancies, or implement an automated solution, which in turn can have cascading effects throughout other areas. For instance, in one company that I worked with recently on review of internal controls, we noted several “legacy” excel spreadsheet applications, which as it turned could be migrated into the company’s ERP system due to some recent enhancements. This not only saved time but also increased the timeliness of management reporting.

Ensuring adequate review of financial statements and management reports to detect errors – the internal controls involved here pertain to what is referred to as Entity Level controls or mitigating controls. These are controls such as variance reports (actual results compared to budget / forecast / prior year etc) which are designed to detect “out of line” transactions or balances. Most companies would have variance reports for revenue, pricing, costs, gross margin and expenses. These are a critical part of the organization’s overall internal control framework as they serve to provide an additional layer of review and oversight. Without them you might not “see the forest because of the trees”. They are sometimes viewed as the last line of defence, and present an opportunity to detect errors, omissions and operating issues. Accordingly, for this internal control to function effectively, it is important that the reporting be designed properly and reviewed on a timely basis. Weekly reporting and daily “Dashboard” metrics can also serve to provide similar oversight.

Segregation duties – fraud prevention – safeguarding assets – one of the most basic premises of internal controls is to ensure that an organization’s physical and financial assets are adequately safeguarded. This runs a wide gamut of things and includes separation of duties such that one person cannot complete an entire transaction themselves, without involvement / oversight from someone else – classic example is the set up of vendors, processing invoices, issuing & signing cheques, and reconciling the bank statement. Imbedded within this is fraud detection and prevention. It also includes ensuring that physical assets such as inventory and equipment are secure and that any transactions are accurately recorded. All of which seems obvious to do, but staff within lean organizations are extremely busy and may tend not have the necessary time or expertise to take this into consideration, especially if changes to personnel or processes occur. In these situations, it might be best to garner assistance from external resources.

Reducing external audit time and fees – as part of every audit planning, external auditors will decide whether or not, and to the extent that they can rely upon the organization’s internal controls to reduce “substantive testing” (analytical procedures and audit of details of transactions and balances). A reduction in substantive testing is typically associated with an organization having strong internal controls, and has a direct impact on the external audit fees – strong internal controls can reduce audit testing, which in turn can reduce audit fees. Not to mention time and effort by the organizations’ staff in obtaining the audit evidence and supporting the auditors.

Canadian Auditing Standards (CAS-620) allow external auditors to rely upon the work of internal auditor (or equivalent) as part the external audit testing. However, the external auditor must determine whether and to what extent to use the work of the internal auditors, and if using the specific work of the internal auditors, to determine whether that work is adequate for purposes of the audit. On the latter point of adequacy, there are several requirements including; objectivity, technical competence, due professional care, and effective communication between the auditors. Therefore, external auditors can consider relying on internal controls to reduce substantive testing, including the work done by internal audit, but the internal audit work must be of sufficient quality.

Publicly TSX listed companies – CEO / CFO Certifications – as required by Bill 198 (aka MI 52-109), all publicly traded non-venture companies on the Toronto Stock Exchange – TSX – Canada’s largest stock exchange, are required to implement disclosure controls and procedures (DC&P) and internal controls over financial reporting (ICFR). This is equivalent to SOX 302 in the USA. Combined, DC&P and ICFR provide a level of assurance to investors that internal controls are designed properly and operating effectively such that financial statements are presented fairly and do not contain any errors so significant (material) that they cannot be relied upon. The CEO and CFO of these companies must sign and publicly disclose quarterly and annual “Full Certificates” to this end. Underlying the certifications is a body of work which basically tests and documents the internal controls. For these companies, strong internal controls are not an option – they are required by law.

Summary – as mentioned previously, there is a great deal of technical information about internal controls and sometimes the overall importance and benefits of them to businesses can be lost in the details. Bottom-line – it’s always wise for organizations to invest ongoing in strong internal controls.

I hope this information about the importance and business benefits for strong internal controls is helpful. For further information about Internal Controls, Interim Controlling, Business Improvement, and other accounting matters, please contact Gary Schein at 905-630-1607 or send a message to me at info@gfsconsulting.ca

Interim Controllership at manufacturing company – best practices and areas of improvement noted:
After experiencing a significant downturn during the recession, manufacturing orders for this company are very strong and growing rapidly, primarily due to the company’s commitment to quality, on-time delivery, and investment in technologies which allowed them to provide unique products and services to its base of loyal customers.

Investments included upgrading the company’s ERP system with manufacturing software fully integrated with the financial reporting system, which provides automated product costing and gross margin capabilities, among other robust features.

Somewhat offsetting these strengths were many business processes which were manual, paper based, and basically anchored in the past as in “that’s how it has always been done, why change”. Existing staff did not have the time to develop or implement process improvements. For various reasons, the motivation to improve really wasn’t there either. The result was that there were many cost savings left to wither on the vine.

I think many companies and organizations are in a similar situation. They are doing fairly well given the recent economic conditions, but struggle to move forward to the next level of improvement. In this situation, the company needed external resources to provide the expertise, experience and time to implement change – some were system enhancements on an existing process, and some were changing the process itself.

Please feel free to contact Gary Schein, CGA, MBA of GFS Consulting at 905-630-1067 to discuss interim Controller and CFO requirements.

For further information regarding Interim Controller and CFO services, please refer to the GFS Consulting Services tab on the top left hand side of this web-site.

Services
Gary Schein is a Certified General Accountant registered with the Certified General Accountants of Ontario to provide Personal Income Tax Preparation services to the public. I have over 25 years of experience preparing and filing personal tax returns including sole proprietorships such rentals and other small businesses. As a professional tax practitioner, I have access to in-depth tax regulations through CGA Canada.

Furthermore, I have experience in preparing the T2209 and T2036 filings required by CRA to recover foreign tax credits pertaining to German taxation. The forms are available on the CRA web-site, but there is a significant amount of information that needs to be analyzed to complete these forms. Essentially my services entail a review of the taxpayer’s Canadian Income Tax returns and German Notice of Assessments for the periods 2005-2009, followed by preparation and filing of the required foreign tax credit forms.

I would be pleased to discuss how I can assist taxpayers with filings and the fees that would apply. Please don’t hesitate to contact me.

Gary Schein MBA, CMC, CGA
Certified General Accountant
Burlington, Ontario
Telephone: 905-630-1607
Fax:  888-501-1156
Email:  gpjschein@sympatico.ca

Tax preparation can be complicated and tax regulations are constantly changing. Unless you have a very basic situation, there is a possibility that you will miss out on deductions. (For instance, see below for Canadian Federal tax deductions available for 2010). As a professional accountant, I will ensure that taxpayers take full advantage of all tax deductions that are allowable, file the tax return accurately and on time, and provide guidance as required.

In addition, I will ensure that taxpayers are aware of, and tax advantage of any social programs that they may be entitled to. For example, for seniors – the Guaranteed Income Supplement (GIS), Veterans benefits, and Ontario tax credits etc.  All clients are treated with the upmost in confidentiality, professionalism, and courtesy.

I provide the following services:

• Prepare personal income tax returns based on information that the taxpayer provides to me.
• Review the preliminary income tax returns with the taxpayer, and explain results.
• Electronically file tax returns with CRA (Canada Revenue Agency).
• Return all tax information to the taxpayer, and provide a copy of the Summary of the tax return.
• Follow up with any questions or issues that might arise after the tax return has been filed and the taxpayer has received the “Notice of Assessment” from CRA.
• Any additional tax planning requirements, if required, will be charged separately.
• Pick up all tax information at the taxpayer’s residence, as required.

Note – the taxpayer is responsible for payment of any amount that might be owing to CRA.

I am bound by the Code of Ethics of the Certified General Accountants of Canada to protect client confidentiality, and to report tax information correctly.

Call now for an appointment. Leave the details to a tax professional, and let’s get your personal income taxes prepared and filed.

Gary Schein MBA, CMC, CGA
Certified General Accountant
Burlington, Ontario
Telephone: 905-630-1607
Fax:  888-501-1156
Email:  gpjschein@sympatico.ca
Member: Certified General Accountants of Ontario and Canada
Member: Burlington Chamber of Commerce

2010 Personal Income Tax Tips – Deductions

1. Public Transit Tax Credit
Did you buy a ticket to ride public transit in 2010? Then your monthly bus pass, commuter train card, or ferry fare could result in a tax credit. The rules are simple: Your pass must allow for unlimited travel for at least 20 days in any 28-day period — so your daily passes are a no-go. Because this is a non-refundable tax credit, the government won’t be sending you a refund cheque in the mail. Instead, the amount claimed is multiplied by 15% and then deducted from your tax owed. For example: If your monthly transit pass costs $125, the amount you could claim would be $1,500 for a tax credit of $225.

2. Moving Expenses
Relocating at least 40 kilometres closer to a new job or to your post-secondary institution could result in a tax credit. There’s a long list of eligible moving expenses — including the cost of a mover, meal expenses, storage fees, legal fees for the purchase of a new home, and vehicle expenses — so it could be worth it to hire an accountant so you don’t miss a single moving cost. See the CRA’s Moving Expenses you can deduct for the details. Along with moving expenses, students can also claim a myriad of other credits.

3. Disability Tax Credit
Canadians with a severe and prolonged mental or physical impairment may be eligible for a $1,086 federal tax credit. The disability must be certified by a medical professional to ‘markedly restrict’ your ability to perform a basic activity of daily living, such as speaking, hearing, walking, and feeding.

Answer the CRA’s questions to see if you’re eligible.

Canadians under the age of 60 who qualify for the Disability Tax Credit are also eligible to set up a Registered Disability Savings Plan (RDSP) — read Canadians with Disabilities Have a New Way to Save to see if you qualify for the RDSP grants and bonds.

4. First-Time Home Buyers’ Tax Credit
Did you buy your first home last year? You may qualify for a non-refundable tax credit of up to to $5,000, reducing your tax owed by $750. Read the CRA’s fact sheet to see if your new place qualifies.

5. Children’s Fitness Tax Credit
It doesn’t matter if your kid is a toddler or a teenage for the Children’s Fitness Tax Credit to pay off. Parents of children involved in sports and fitness activities under the age of 16, including babies, can claim up to $500 per child per year. Keep all your sports receipts and documents when claiming this non-refundable tax credit — you may have to prove your toddler’s swimming lessons or your teen’s dance club contains a valid fitness component.
 

Bill 198 C-SOX update – IFRS Impact
As Canadian companies transition to IFRS during 2011, CEOs and CFOs must continue to provide their internal control certifications throughout this period. Most companies are in the final stages of their changeover to International Financial Reporting Standards (IFRS), because IFRS will replace Canadian generally accepted accounting principles (GAAP) for fiscal years beginning on or after January 1, 2011.

The majority of Canadian-listed domestic issuers will be required to report their first set of IFRS financial statements in the first quarter of 2011. At the same time, certifying officers of non-venture issuers will also need to certify on the design and implementation of disclosure controls and procedures (DC&P) and internal control over financial reporting (ICFR).

Management will be required to make significant choices in the selection of accounting policies and elective exemptions as part of the company’s transition to IFRS. This e-newsletter highlights ICFR considerations regarding the design of controls for certain IFRS accounting policy choices and elective exemptions available on transition to IFRS. This includes only a sample of ICFR considerations and does not represent a complete list. In addition, these considerations are directional in nature only, as specific control impacts will depend on the facts and circumstances of each company. How can companies maintain effective control throughout the IFRS conversion and beyond? Read on…

Potential Impact of IFRS on Internal Control over Financial Reporting
• Accounting Policies
• Reconciliations
• Financial Statement Disclosures
• Certifying design of DC&P and ICFR
• Certifying operating effectiveness of DC&P and ICFR
• Testing Considerations

Accounting Policies
The conversion to IFRS requires numerous accounting policy selections. Some choices are required in applying IFRS for the first time through IFRS 1, while others relate to on-going accounting policies. In many areas, a company’s choices can have significant and wide-ranging implications for the design of its controls. As an example, a choice that will affect all companies—the IFRS requirement for financial statement presentation…

IFRS accounting treatment – IFRS requires, as an accounting policy choice, that expenses be presented either by nature or by function on the face of the statement of operations. This requirement as well as other aspects of IFRS can result in significant changes to captions in the statement of operations.

Implications for controls – having made its choice, a company may need to put in place controls over the creation of general ledger accounts and the mapping of these accounts to the financial statements. In addition, the company may need to consider any program change controls required for consolidation software and the related IT application controls.

Communication of accounting policies – the company will need to communicate new accounting policy selections to all affected parties throughout the organization. To the extent that written policy documents exist, they will require updating and distribution on a timely basis. The form of communication should be tailored, depending on the complexity of the changes being communicated. For example, simple changes may be handled via e-mail communication, while complicated changes should be communicated via in-person training sessions to facilitate knowledge sharing.

Reconciliations to previously reported Canadian GAAP
The first interim financial statements must include comparative figures restated to IFRS, and reconciliations between IFRS and Canadian GAAP. The condensed set of interim financial statements for the first reporting period must meet the requirements of IAS 34 Interim Financial Statements including:

• Complete set of significant accounting policies, including the selection of various ongoing IFRS accounting policy options and the elective exemptions at the transition date made under IFRS 1 First-Time Adoption of IFRS (IFRS 1).
• Reconciliation of equity from Canadian GAAP to IFRS at the date of transition, to the end of the comparative annual period, and the end of the comparative interim period.
• Reconciliation of comprehensive income from Canadian GAAP to IFRS for the end of the annual period, and the end of the comparative interim period.
• Additional financial statement disclosures.

Controls should be in place over both the creation of the opening balance sheet and the reconciliation process. The reconciliation process will need to be repeated for each quarter and for the annual financial statements. The reconciliations are most transparent and informative when done on a line-by-line basis.

The nature of the controls over the reconciliation process will depend on the number of reconciling adjustments expected and how your company chooses to track its accounting records concurrently under IFRS and Canadian GAAP. Your company’s current information systems will largely determine the available options.

Adjustments will be required to convert from Canadian GAAP to IFRS. If Excel spreadsheets are used to track the adjustments for the reconciliation, then detailed review over entries may be necessary, and end-user controls such as locking formulas and password protecting contents should be considered for implementation.

Financial statement disclosures
IFRS has significant additional disclosure requirements compared to Canadian GAAP. For example, additional disclosure is required when impairment losses are recognized or reversed at the date of transition, or material adjustments are made to the statement of cash flows. Possible additional disclosures may also be required around significant judgments made in applying IFRS accounting policies and new key sources of measurement uncertainty.

Companies will need to establish a process to:
• Identify the required quarterly and annual disclosures,
• Ensure the information is appropriately gathered,
• Consider whether the required disclosures are fairly presented.

To illustrate, controls over such a process might include the following elements:

A responsible person obtains, from the company’s auditor, a disclosure checklist to identify required disclosures. The person then amends any reporting package templates so that the required information is obtained from operating locations upstream for external reporting. Relevant controls could also be added at these locations to review the information provided for completeness and accuracy. At the time of external reporting, the disclosure checklist would be completed and approved as part of the financial statement review process.

Certifying design
For financial statements produced in compliance with IFRS, the CEO and CFO of a non-venture issuer will be required to certify for the first quarter of 2011 on the design of their DC&P and ICFR. “Design” refers to both developing and implementing the controls, policies and procedures that comprise DC&P and ICFR, and encompasses the documentation of these controls. Companies should put in place plans that will allow certifying officers to assess whether newly designed controls have been implemented. An assessment may be accomplished, for example, by completing a walkthrough. Plans should also consider how the documentation (“narratives”) required to support the certification of design will be updated.

Certifying operating effectiveness
For financial statements produced in compliance with IFRS, certification of the operating effectiveness of DC&P and ICFR will be required for the first annual period ending after January 1, 2011. However, in both 2010 and 2011, companies will need to address the impact of the IFRS conversion on the nature, extent and timing of testing required.

Testing considerations
If controls that affect the 2011 financial reporting year have already operated in 2010, companies may be well advised to complete the testing of these controls as early as possible in 2011. For example, if new IFRS accounting policy selections were approved in 2010, the approval of these policies could be tested as part of the 2011 Q1 test plan. Similarly, controls over IFRS systems development projects that were completed in 2010 could also be tested during 2011 Q1. This approach may contribute to both efficiency and effectiveness by reducing resource constraints in the year of transition, allowing for early detection and remediation of any DC&P or ICFR issues, and facilitating interviews of individuals involved in the conversion process while the details are still fresh.

In making risk assessments in 2011, certifying officers should consider whether the risk of error or fraud has increased due to resource constraints, system conversion projects or other ongoing change management issues arising out of the IFRS conversion project. Changes to the assessed risk of fraud or error may, in turn, require testing plans to be amended.

A company should reconsider its previous risk assessments, particularly in areas that have undergone a significant change in accounting policy or a retroactive restatement when IFRS was adopted. Management should consider whether the prior testing approach needs to be modified because employees’ level of knowledge of IFRS will not immediately approach their previous familiarity with Canadian GAAP. This knowledge difference may have particular impact when a company previously relied heavily on monitoring controls to reduce the extent of detailed process-level testing. In general, IFRS is less predictive than Canadian GAAP because IFRS uses more fair value measures, thus creating more earnings volatility, particularly in areas such as provisions and stock-based compensation. These factors may reduce the effectiveness of monitoring controls.

For example, as part of the certification process, management may have relied on centralized monitoring of the operating performance of subsidiary results in order to reduce or eliminate the need to test process level controls at certain locations. As results will be reported under a new framework, management should consider whether the degree to which amounts are predictable, and whether they have sufficient technical expertise in IFRS to perform an effective review at a level that would detect a material error. Until management becomes well versed in IFRS, and expectations and trends are predictable, management may choose to lower the threshold for amounts requiring investigation, so that more matters are reviewed. Alternatively, management could reduce the extent of reliance on monitoring controls and introduce some testing of process level controls.

In 2011, the monitoring of actual results versus budget will be effective only to the extent that relevant budgeting was also completed under IFRS. Management will need to put in place a process to ensure that employees developing budgets in 2010 are appropriately trained in IFRS and also receive appropriate communications regarding final approved accounting policy selections. Management must proactively make the appropriate changes to the company’s budgeting process. A flawed process may lead to significant budget to actual variances and make the monitoring of such variances a much less effective control.

In developing test plans, companies may be well advised to modify their test plans in areas where more significant changes in processes have occurred or where new knowledge of IFRS is required because of increased risk. Adjustments could include:

• Testing earlier. This approach will allow for remediation efforts if required, such as additional training, or the identification and testing of additional controls. In particular, areas with new controls or significant accounting policy choices should be targeted for early testing.
• Testing more. The extent of testing should reflect risk assessments. The extent of testing can be adjusted by either testing more of a particular control or by testing more than one control related to an assertion. For example, testing both a preventative control and a monitoring control might be appropriate.
• Changing the nature of a test. More persuasive evidence should be gathered as the degree of risk increases. For example, re-performance of revaluation adjustments is more persuasive than inquiry and inspection directed to such judgments. Entity Level controls may not be able to detect errors as effectively as substantive testing during the IFRS transition.
• Reviewing the major business cycles. IFRS will likely impact all of the major processes including; Accounting Policies, Note Disclosures, Revenue, Expenditures, Compensation, PP&E, Capital, Taxes and Inventory. Within each cycle it is important to understand how the financial reporting may have changed, even though the actual business process itself may not be much different. A cross-functional review may highlight issues.

In addition to the above, IT application controls take on heightened importance, particularly if Excel spreadsheets have been used to calculate data and serve as an information repository. Is access to the spreadsheets secure? Are formulas locked?

This information is based on my personal observations, opinions and IFRS training programs, and has been augmented with information publicly available from various accounting firms’ web-sites. Please remember to contact your accounting professional(s) for further guidance. I would be pleased to discuss how GFS Consulting can support your company’s certification process during 2011.

CEO CFO Certification templates – updated for IFRS
There are some changes to CEO CFO Certifications as a result of the transition to IFRS. On December 10, 2010, both the Ontario Securities Commission (OSC), and Canadian Securities Administrators (CSA) provided updates for revised terminology and templates. The details pertaining to NI 52-109 and other instruments impacted by IFRS can be obtained from the OSC web-site at the links below. The changes relate primarily to the replacement of Canadian GAAP terminology for IFRS terminology in the templates. For instance, Form 52-109F1 Certification of annual filings – full certificate is amended by replacing “results of operations” with “financial performance”. Readers should ensure they have a full understanding of the changes, and make the necessary revisions prior to the initial interim reporting period for 2011.

Click here for the Terminology link (Refer to Page 102)

Click here for the Certification Templates (Refer to Page 12)
 

The Canadian Securities Administrators Staff Notice 52-327 – Certification Compliance Update
On October 15, 2010 the Canadian Securities Administrators (CSA) Staff issued Notice 52-327, Certification Compliance Update, which summarizes issuer compliance with the requirements of National Instrument (NI) 52-109 Certification of Disclosure in Issuers’ Annual and Interim Filings. The results show moderate improvement in the level of compliance by issuers since a similar review was conducted last year.

CSA staff conducted the review of 2009 annual MD&A and annual certificates of a sample of 195 reporting issuers, composed of 145 non-venture issuers and 50 venture issuers. The sample included 45 issuers that were identified as non-compliant in last year’s CSA review of 2008 annual MD&A and annual certificates. Out of the total reporting issuers reviewed:
• 45 per cent appeared to comply or substantively comply with the provisions and no action was required, compared to 38 per cent in last year’s review;
• 33 per cent were required to make prospective changes in future filings, compared to 32 per cent in last year’s review; and
• 22 per cent were required to refile their annual MD&A and/or certificates, compared to 30 per cent in last year’s review.

For further information, please click here for the CSA web-site link.

I hope this helps. Thank you for taking the time to read this. Please don’t hesitate to contact GFS Consulting If you have any questions or require assistance. Best wishes to you.

Sincerely,

Gary Schein MBA, CMC, CGA
GFS Consulting
Cell: 905-630-1607
Fax: 888-501-1156
Email: gpjschein@sympatico.ca
Web: gfsconsulting.ca
The views and opinions expressed in the GFS Consulting E-Newsletter are those of Gary Schein, and include excerpts from other authors and web-sites as identified in the Newsletter. Readers should discuss details with their accounting and tax professionals. GFS Consulting disclaims any responsibility whatsoever in regards to interpretation and use of any of this information.
 

I have used a company known as easy TechCare on several occasions. The technicians were very knowledgeable, professional and able to resolve my PC lap top and networking technical issues swiftly – on one occasion the fix was done remotely. Pricing was fair – well worth it.

For more information visit easy TechCare’s web-site at the following link or contact then at 416-987-EASY (3279) or toll-free at 1-866-507-EASY (3279).

http://www.easytechcare.com/index.php

Hope this helps.

Best wishes,

Gary Schein MBA, CMC, CGA
GFS Consulting

• Business Process Improvement
• Bill 198 C-SOX – SyncBASE CERTRACK
• IFRS – SyncBASE IFRSTRACK

Business Process Improvement
During 2010, Canadian companies appear to be emerging from “survival mode” from the worst recession in a lifetime. Top line growth seems to be happening from a combination of organic growth, launching of new products / services, and business acquisitions. At the same time, growth in the bottom line is being supported by ongoing and continuous improvement in productivity occurring in some cases through investments, and in other cases through “good old” fashion cost containment. The latter is a discipline that is often the least exciting and often times the most tedious of functions within organizations. However, without this ongoing discipline, costs can quickly spiral out of control.

In the current economic environment, it is has been very challenging for companies to increase prices to customers, in fact most customers expect prices to remain the same, or decrease. For survival’s sake therefore, it has never been more important for companies to monitor costs, and seek ways to “stretch the dollar” – getting more value for each dollar spent, and saving money whenever possible.

Ongoing cost savings don’t have to be gargantuan. Smaller incremental improvements, if done continuously, can be equally effective.  In both cases, they will avoid the need for draconian measures when things come to a head, due to lack of controls.

Excel spreadsheet applications are a good way to implement smaller incremental improvements. Excel spreadsheet applications are prevalent throughout industry, but most employees only have a basic knowledge of its use. They know enough to perform the routines of their particular jobs, but not enough to significantly enhance their productivity. For most companies, employees are at the same time the greatest asset, and the greatest cost. Therefore, ensuring that staff are sufficiently trained and have the requisite skills to perform their tasks efficiently is one way to improve operational efficiencies.

Reviewing business processes within an organization is a time consuming and often “politically” charged process – employees are usually reluctant to adopt change. Furthermore, during their very busy days, operational staff lack the time (and energy), expertise and objectivity required to critically review the way work is being managed, to determine if best practices are being followed.

That’s where external resources can assist. For instance, over the years working as a consultant and financial professional, I have reviewed hundreds of operational functions. More often than not, Excel based solutions have been implemented, which have really improved efficiencies (and accuracies for that matter). Please contact GFS Consulting and go after the “low hanging fruit” with Excel applications to improve your business operations.

I discussed Excel training recently with Mr. Kevin Moloney, of DKM and Associates. Kevin’s company provides Excel training services to companies and has become very adept over the years in pinpointing and implementing solutions. His advice to companies looking to upgrade Excel skills is this…”don’t hesitate with this investment…it is probably the least costly and quickest way to improve employee and organizational productivity”.

Many times business improvements can only be achieved with the use of specialized software applications, which may be linked to, but are generally beyond the capabilities of Excel spreadsheets. It is often a question of debate – should the software application be tailored to the business process or vice versa? At first glance, it would be obvious that the business processes should be understood in their current state, and then a plan for improvement to follow. Mapping the processes using Microsoft Visio or other flowcharting is useful, because for most people “a picture is worth a thousand words”. It also ensures that all salient points of the process are documented and understood.  However, unless the business process is very basic, it may be necessary to “customize the software application”, to align with the optimal business process. This can be very expensive. For very large organizations having the resources and scale to cost justify this, it may be possible to do so. Realistically, for most companies however, there comes a point where the business process will more or less need to fit within the software application. Take heart – this in of itself will usually be a huge improvement over the manual, or less than ideal process, that it replaced. Once again, external consultants can provide the requisite time and expertise to assist with these changes. Yes, consultants charge fees for these services, but it’s important to look at the end result, and determine if the ongoing cost savings justify the investment. As businesses continue to expand, even if companies can hold the line on head count with these productivity improvements, it will be money well spent and earned many times over.

Business Process Improvement – “Case Study”
ASL Distribution Services

ASL is a full service 3rd party logistics company, providing outsourced warehousing, storage and transportation services to companies in Canada and USA. A privately held company, it has been in business for 51 years, and on numerous occasions been recognized as one of Canada’s 50 best managed companies, most recently in 2009.

The strategic goal of ASL is to be the foremost Canadian provider of total logistics systems for time critical product. ASL achieves this goal by leading the industry in customer service, with a pro-active and continuous focus on customers’ needs and expectations, and by providing “World Class” quality. ASL maintains this goal through continuous business improvement, initiated by their employees in a challenging and responsive environment.

Recently I had the opportunity to provide interim controlling consulting services to ASL, and I was very impressed with the company’s commitment to continuous process improvement. During the recent economic downturn, ASL has been able to grow their business, through a combination of shrewd acquisitions and some very impressive organic growth. However, as great as that sounds, there are challenges to support and sustain this type of growth. In response, ASL conducts ongoing reviews to its infrastructure and business processes, to ensure that they are as efficient as possible. Led by the company’s CFO, Mr. Robert Kheir MBA, CMA the daily mantra of improvement is very evident. The status quo is not acceptable. What is interesting is the manner in which Rob has been able to deliver the message – with an open dialogue that invites suggestions and engages staff.  Mr. Cole Dolny, President sums it up best…”in a competitive industry such as 3rd party logistics we owe it to our customers and stakeholders, to closely manage costs and improve productivity. Our customers expect us to hold the line on pricing. Ongoing productivity improvement is one of the most challenging things to do, but if we didn’t, we would quickly see our margins erode”.

Does your organization require 3rd party logistics? Based on 51 years of success, and my involvement with this company, I would highly recommend ASL Distribution Services. For more information, please contact Cole Dolny at (289) 291-4040.

Business Process – Key Controls
A further benefit of business process improvements is the review of internal controls. When I refer to internal controls, I am referring to the various controls that organizations have in place, such as proper segregation of duties, authorizing transactions etc, all of which are generally designed to prevent or detect errors or fraud, and ensure financial statements are produced accurately and timely.
Publicly traded companies in Canada are acutely aware of the work (and sometimes pain) that is required in this area as part of the ongoing CEO / CFO certifications (Bill 198 aka C-SOX). Many public companies are using this to their advantage – identifying business improvement opportunities as an adjunct to the review of key internal controls – creating a “win-win” situation. For privately held companies and other organizations, the review of key controls is every bit as relevant. Key controls can ensure that business processes are designed in such a way that transactions are processed within the prescribed limits of authorization. As part of business process reviews, it’s also a good time to review internal controls.

Bill 198 C-SOX update
Featured Software application – SyncBASE – CERTRACK

SyncBASE is a software development company that’s been doing business for about 10 years, and has 3 primary software applications; OPTRACK (Stock Option Valuation), IFRSTRACK, and CERTRACK. Mr. Ramy Taraboulsi, MBA, M.Sc, CFA is the founder of SyncBASE and I had the pleasure of meeting Ramy and several members of the SyncBASE team during May 2010 at their Toronto Head Office.

CERTRACK is a workflow and reporting tool that companies can use to comply with SOX 404 (United States), NI 52-109 and Bill 198 (Canada), and has some very impressive functionality. Please see below for key features of CERTRACK.

I am pleased to announce that GFS Consulting has now entered into a strategic partnership with SyncBASE, and we are working together to support companies on CERTRACK and other Bill 198 projects. Please contact GFS Consulting if you want to learn more.

CERTRACK – Complete Tracking of Internal Control Certification
CERTRACK is a workflow and reporting tool that companies can use to comply with SOX 404 (United States), NI 52-109 and Bill 198 (Canada). It is a web-based solution for companies to efficiently manage their internal control certification process by providing a secure platform for the documentation, walkthrough, testing and reporting of internal controls, presented in a structured and auditable manner.

CERTRACK streamlines the control documentation process by retaining the documents and evidences to each key control in an online repository. It organizes control testing by informing the relevant personnel of their schedules and deadlines, allowing them to collect and review evidences, conduct tests and sign off on-site. It facilitates the reporting process with pre-populated Management Assessment templates highlighting the key performance charting and statistics for each audit period, downloadable in Word, Excel or PDF format.

CERTRACK allows a firm to move quickly from establishing audit parameters to actual monitoring of Financial and IT processes throughout the enterprise by decentralizing the control management and evidence collection down to employees in different areas of operation.

CERTRACK introduces a unique framework and methodology that allows a firm to complete their internal control audit through a top-down risk based approach that involves different members (process owners, management, external auditors, etc.) from different operations (accounting, sales, human resource, IT, etc.) from various locations (head office, overseas locations, etc.) within a single online platform.

Risk Assessment: By looking at the financial statements of the recent period, based on the account balances, CERTRACK calculates the materiality of the accounts based on the COSO guidance from both quantitative and qualitative perspective.

Process Narrative and Walkthrough: Based on the user profile, CERTRACK provides a simple and easy template to fill in Walkthrough and/or Narrative information, which are date stamped. At a click of a mouse, users may generate a sophisticated Walkthrough and Narrative report or choose to do a comparison between the two. In addition, any walkthrough exhibits can be directly stored in CERTRACK.

Flow Chart: CERTRACK utilizes an online flowchart creation tool to allow users to draw and store their process activity flow, which can be connected to key controls and risks to give a visual representation of a well maintained process.

Control Documentation: In every new audit period, the control documentation is rolled forward. However should it change over time, users may choose to change the control attributes and descriptions. CERTRACK provides a complete audit trail on any updates happened to a control at a click of a mouse. Moreover, because all the data is maintained in a single database on CERTRACK, any changes made to a control will be automatically applied to all instances where the control is used in.

Control Testing: Testing information is provided by control owners/ process leaders/ compliance department, including test procedure and method, sample size, and sampling source. Test responsibilities are passed to internal testers or external auditors, who will conduct tests independently through a separate log-on and upload evidences for management review. Similar to the walkthrough exhibits, all testing papers can be directly stored within CERTRACK.

Remediation: Should any deficiencies be discovered, CERTRACK keeps track of the remediation process by allowing the remediation delegates to log-on separately, and provide updates on the progress of the remediation plan implementation.

Progress Charting, Monitoring, and Statistics: During the testing periods, tester performances are constantly monitored. At any time, users can see statistics for tests that are outstanding, completed or behind schedule. Furthermore, users may choose to generate reminder letters or allow CERTRACK to generate automatic alerts to remind testers any uncompleted tasks.

Conclusion and Reporting: Control conclusions are done at the end of the testing process, where the reviewer of each process retrieves the information provided by the testers and signs off on each control. During that process, reviewers will be presented with the statistics on test results by business units/ accounting processes, testing evidences collected, and any additional comments/ remediation/ suggestion provided by testers. Reviewers then make a final assertion on the control effectiveness. At this point, CERTRACK can pull out summary and detailed reports to automate C-SOX (SOX 404) reporting, which will save users a lot of time and effort to prepare and organize the information.

There is a vast array of C-SOX software available, and it would be very difficult for organizations to thoroughly research all of the alternatives. Therefore, I hope this overview of SyncBASE and CERTRACK software is helpful. I definitely think organizations should consider CERTRACK if they require software support for their SOX projects. To register for a free 30 minute online demonstration of CERTRACK, highlighting key features and functionality please visit: http://certrack.net/demo.html

Mention GFS consulting, and receive a 5% discount off the purchase price.

IFRS update
By the way, still working on completing your IFRS conversion? SyncBASE also has an IFRS project management tool known as IFRSTRACK, a web based application which manages all aspects of migration from GAAP to IFRS.  To register for a free 30 minute online demonstration of IFRSTRACK please visit: http://ifrstrack.net/demo.html

For further information about CERTRACK, IFRSTRACK and SyncBASE, you can also contact:

Ms. Lilian Hanna, Marketing Manager, SyncBASE
Tel: (647) 284-2244
Email:  lilian@optrack.net
Web-site: http://syncbase.net/

I hope this helps. Thank you for taking the time to read this. Please don’t hesitate to contact GFS Consulting If you have any questions or require assistance. Best wishes to you.

Gary Schein MBA, CMC, CGA
GFS Consulting
Cell: 905-630-1607
Email: gpjschein@sympatico.ca
Web: gfsconsulting.ca
The views and opinions expressed in the GFS Consulting E-Newsletter are those of Gary Schein, and include excerpts from other authors and web-sites as identified in the Newsletter. Readers should discuss details with their accounting and tax professionals. GFS Consulting disclaims any responsibility whatsoever in regards to interpretation and use of any of this information.

Most Canadian-listed domestic issuers will be required to report their first set of IFRS financial statements in the first quarter of 2011. At the same time, certifying officers of non-venture issuers will also need to certify on the design and implementation of disclosure controls and procedures (DC&P) and internal control over financial reporting (ICFR). How will companies maintain effective control throughout the IFRS conversion and beyond?

This blog is one in a series of 3 blogs, which addresses the following important considerations with regards to IFRS and NI-52-109 CEO and CFO Certifications:

• Regulatory (Part 1 of 3).
• Initial reporting under IFRS (Part 2 of 3).
• Ongoing certifications (Part 3 of 3).

A portion of this information is based on my personal observations and opinions. This has been augmented with information publicly available from KPMG. Therefore, acknowledgements are hereby made to KPMG.
 
Regulatory
CSA staff, in Notice 52-320 have outlined the disclosures expected in the three years preceding an issuer’s IFRS changeover date, and suggest that the key elements of a changeover plan would include addressing the impact of IFRS on:

• Accounting policies, including choices among policies permitted under IFRS, and implementation decisions such as whether certain changes will be applied on a retrospective or a prospective basis;
• Information technology and data systems,
• Internal control over financial reporting (ICFR),
• Design and implementation of disclosure controls and procedures (DC&P), including investor relations and external communication plans,
• Robustness of financial reporting expertise, including training requirements,
• Business activities, such as foreign currency and hedging activities, as well as areas that may be influenced by GAAP measures, such as debt covenants, capital requirements and compensation arrangements.

As indicated above, 2 of the considerations noted within Notice 52-320 directly impact the certification process. Therefore, it is extremely important that the impact of the IFRS transition on the certification process is well understood and managed.

Potential complexities arising from the IFRS changeover
When making their MD&A disclosures regarding DC&P, certifying officers of non-venture issuers need to consider whether they have appropriately designed and implemented controls to give them reasonable assurance that appropriate information has been gathered and reported in their MD&A filing.

The transition to IFRS adds another dimension to these certifications— certifying officers will have to consider whether their DC&P have been appropriately amended to capture the additional MD&A disclosures expected for the IFRS changeover.

Forward looking financial information for 2011
MD&A may also include forward looking financial information, such as revenue or earnings per share (EPS) guidance. Both Canadian and US regulators require any forward looking statements to be based on the future expected accounting policies that the issuer will have in place. Therefore, for a calendar-year-end issuer that provides EPS guidance in 2010 for its 2011 fiscal year – any EPS guidance must be in accordance with the anticipated IFRS framework. Management should therefore consider whether appropriate controls are in place so that forecasted figures reflect the appropriate IFRS accounting policies. Alternatively, issuers may choose to report meaningful non-financial measures, such as operating statistics.

Disclosing changes in ICFR
Each quarter, a non-venture issuer’s MD&A must also disclose any changes in ICFR that are reasonably likely to have a material effect on its ICFR. During the IFRS transition, depending on the size and complexity of the issuer, many factors can result in ICFR changes. Such changes can be very broad and have a significant impact, such as introducing a new ERP system, or more specific, such as a new process for capturing specific new disclosure information. Management should consider whether the company has a comprehensive process in place throughout the organization to capture any changes in ICFR. Such a process can aid management in evaluating changes and assessing the need to disclose material ICFR changes in MD&A. Many companies may need to make material change disclosures as a result of their IFRS conversion.

I hope this helps. This is one of a series of blogs that is meant to convey information relating to Canada’s transition from Canadian GAAP to IFRS, specifically as it pertains to CEO and CFO Certifications.

For further information, please refer to the ongoing series of IFRS blogs on the GFS Consulting web-site or send me a note, and please remember to contact your accounting professional for further guidance.

Most Canadian-listed domestic issuers will be required to report their first set of IFRS financial statements in the first quarter of 2011. At the same time, certifying officers of non-venture issuers will also need to certify on the design and implementation of disclosure controls and procedures (DC&P) and internal control over financial reporting (ICFR). How will companies maintain effective control throughout the IFRS conversion and beyond?

This blog is one in a series of 3 blogs, which addresses the following important considerations with regards to IFRS and NI-52-109 CEO and CFO Certifications:

• Regulatory (Part 1 of 3).
• Initial reporting under IFRS (Part 2 of 3).
• Ongoing certifications (Part 3 of 3).

A portion of this information is based on my personal observations and opinions. This has been augmented with information publicly available from KPMG. Therefore, acknowledgements are hereby made to KPMG.

Initial reporting under IFRS
For calendar-year-end issuers, the first reporting period under IFRS will be March 31, 2011. Several significant activities are required in 2011, including:

• Preparing interim and annual IFRS financial statements,
• Certifying design of DC&P and ICFR on an interim basis,
• Certifying operating effectiveness of DC&P and ICFR on an annual basis.

Tips:
• Prepare for the implications the IFRS changeover will have for many disclosures and their controls.
• Changes made for IFRS transition may represent ICFR changes that require disclosure.

Potential Impact of IFRS on Internal Control over Financial Reporting
Management will be required to make significant choices in the selection of accounting policies and elective exemptions as part of the company’s transition to IFRS. This blog highlights ICFR considerations regarding the design of controls for certain IFRS accounting policy choices and elective exemptions available on transition to IFRS. The blog includes only a sample of ICFR considerations and does not represent a complete list. In addition, these considerations are directional in nature only, as specific control impacts will depend on the facts and circumstances of each company.

Preparing IFRS financial statements
In the first interim reporting period, the condensed set of interim financial statements for the first reporting period must not only meet the requirements of IAS 34 Interim Financial Statements, but also contain:
• A complete set of significant accounting policies, including the selection of various ongoing IFRS accounting policy options and the elective exemptions at the transition date made under IFRS 1 First-Time Adoption of IFRS (IFRS 1).
• A reconciliation of equity from Canadian GAAP to IFRS at the date of transition (January 1, 2010), the end of the comparative annual period (December 31, 2010), and the end of the comparative interim period (March 31, 2010).
• A reconciliation of comprehensive income from Canadian GAAP to IFRS for the annual period ended December 31, 2010, and the three-month period ended March 31, 2010.
• Additional financial statement disclosures.

Annual financial statements require further financial statement disclosures.

Accounting policy selections
The conversion to IFRS requires numerous accounting policy selections. Some choices are required in applying IFRS for the first time through IFRS 1, while others relate to on-going accounting policies.
In many areas, a company’s choices can have significant and wide-ranging implications for the design of its controls. As an example, a choice that will affect all companies—the IFRS requirement for financial statement presentation…

IFRS accounting treatment: IFRS requires, as an accounting policy choice, that expenses be presented either by nature or by function on the face of the statement of operations. This requirement as well as other aspects of IFRS can result in significant changes to captions in the statement of operations.

Implications for controls: Having made its choice, a company may need to put in place controls over the creation of general ledger accounts and the mapping of these accounts to the financial statements. In addition, the company may need to consider any program change controls required for consolidation software and the related IT application controls.

Communication of accounting policies
The company will need to communicate new accounting policy selections to all affected parties throughout the organization. To the extent that written policy documents exist, they will require updating and distribution on a timely basis. The form of communication should be tailored, depending on the complexity of the changes being communicated. For example, simple changes may be handled via e-mail communication, while complicated changes should be communicated via in-person training sessions to facilitate knowledge sharing.

Reconciliations to previously reported Canadian GAAP
The first interim financial statements must include comparative figures restated to IFRS, and reconciliations between IFRS and Canadian GAAP. Controls should be in place over both the creation of the opening balance sheet and the reconciliation process. The reconciliation process will need to be repeated for each quarter and for the annual financial statements. The reconciliations are most transparent and informative when done on a line-by-line basis.

The nature of the controls over the reconciliation process will depend on the number of reconciling adjustments expected and how your company chooses to track its accounting records concurrently under IFRS and Canadian GAAP. Your company’s current information systems will largely determine the available options. Adjustments will be required to convert from Canadian GAAP to IFRS.

Tips:
• It is crucial that the accounting personnel responsible for approving the IFRS adjustments are appropriately knowledgeable of IFRS
• Only appropriate personnel have the authority to approve the adjustments.

If Excel spreadsheets are used to track the adjustments for the reconciliation, then detailed review over entries may be necessary, and end-user controls such as locking formulas and password protecting contents should be considered for implementation.

Additional financial statement disclosures
IFRS has significant additional disclosure requirements compared to Canadian GAAP. For example, additional disclosure is required when impairment losses are recognized or reversed at the date of transition, or material adjustments are made to the statement of cash flows. Possible additional disclosures may also be required around significant judgments made in applying IFRS accounting policies and new key sources of measurement uncertainty.

Tip:
• Ensure effective controls over the reconciliation process. Controls may be complex, depending on the company’s information systems.

Companies will need to establish a process to:
• Identify the required quarterly and annual disclosures,
• Ensure the information is appropriately gathered,
• Consider whether the required disclosures are fairly presented.

To illustrate, controls over such a process might include the following elements:

A responsible person obtains, from the company’s auditor, a disclosure checklist to identify required disclosures. The person then amends any reporting package templates so that the required information is obtained from operating locations upstream for external reporting. Relevant controls could also be added at these locations to review the information provided for completeness and accuracy. At the time of external reporting, the disclosure checklist would be completed and approved as part of the financial statement review process.

Certifying design
For financial statements produced in compliance with IFRS, the CEO and CFO of a non-venture issuer will be required to certify for the first quarter of 2011 on the design of their DC&P and ICFR. “Design” refers to both developing and implementing the controls, policies and procedures that comprise DC&P and ICFR, and encompasses the documentation of these controls. As noted earlier, Exhibit 1 illustrates some accounting areas in which we anticipate the conversion to IFRS may necessitate changes in the design of ICFR. Companies should put in place plans that will allow certifying officers to assess whether newly designed controls have been implemented. An assessment may be accomplished, for example, by completing a walkthrough. Plans should also consider how the documentation required to support the certification of design will be updated.

Certifying operating effectiveness
For financial statements produced in compliance with IFRS, certification of the operating effectiveness of DC&P and ICFR will be required for the first annual period ending after January 1, 2011. However, in both 2010 and 2011, companies will need to address the impact of the IFRS conversion on the nature, extent and timing of testing required.

Testing considerations in 2010
In making risk assessments in 2010, certifying officers should consider whether the risk of error or fraud has increased due to resource constraints, system conversion projects or other ongoing change management issues arising out of the IFRS conversion project. Changes to the assessed risk of fraud or error may, in turn, require testing plans to be amended.

Tips:
• Be prepared — IFRS requires significantly more disclosures than Canadian GAAP.
• For the first quarter of 2011, focus on controls introduced or redesigned for IFRS.

If controls that affect the 2011 financial reporting year have already operated in 2010, companies may be well advised to complete the testing of these controls in 2010. For example, if new IFRS accounting policy selections were approved in 2010, the approval of these policies could be tested as part of the 2010 test plan. Similarly, controls over IFRS systems development projects that were completed in 2010 could be tested as completed. This approach may contribute to both efficiency and effectiveness by reducing resource constraints in the year of transition, allowing for early detection and remediation of any DC&P or ICFR issues, and facilitating interviews of individuals involved in the conversion process while the details are still fresh.

Testing considerations in 2011
In 2011, a company should reconsider its previous risk assessments, particularly in areas that have undergone a significant change in accounting policy or a retroactive restatement when IFRS was adopted. Management should consider whether the prior testing approach needs to be modified because employees’ level of knowledge of IFRS will not immediately approach their previous familiarity with Canadian GAAP. This knowledge difference may have particular impact when a company previously relied heavily on monitoring controls to reduce the extent of detailed process-level testing. In general, IFRS is less predictive than Canadian GAAP because IFRS uses more fair value measures, thus creating more earnings volatility, particularly in areas such as provisions and stock-based compensation. These factors may reduce the effectiveness of monitoring controls.

For example, as part of the certification process, management may have relied on centralized monitoring of the operating performance of subsidiary results in order to reduce or eliminate the need to test process level controls at certain locations. As results will be reported under a new framework, management should consider whether the amounts are sufficiently predictable, and whether they have sufficient technical expertise in IFRS to perform an effective review at a level that would detect a material error. Until management becomes well versed in IFRS, and expectations and trends are predictable, management may choose to lower the threshold for amounts requiring investigation, so that more matters are investigated. Alternatively, management could reduce the extent of reliance on monitoring controls and introduce some testing of process level controls.

Tips:
• Conduct control testing early, if you can.
• Recognize the IFRS learning curve for your employees and its potential impact on control testing.

In 2011, the monitoring of actual results versus budget will be effective only to the extent that relevant budgeting was also completed under IFRS. Management will need to put in place a process to ensure that employees developing budgets in 2010 are appropriately trained in IFRS and also receive appropriate communications regarding final approved accounting policy selections. Management must proactively make the appropriate changes to the company’s budgeting process. A flawed process may lead to significant budget to actual variances and make the monitoring of such variances a much less effective control.

In developing test plans, companies may, to be prudent, adjust their test plans in areas where more significant changes in processes have occurred or where new knowledge of IFRS is required because of increased risk. Adjustments could include:

• Testing earlier. This approach will allow for remediation efforts if required, such as additional training, or the identification and testing of additional controls. In particular, areas with new controls or significant accounting policy choices should be targeted for early testing.
• Testing more. The extent of testing should reflect risk assessments. The extent of testing can be adjusted by either testing more of a particular control or by testing more than one control related to an assertion. For example, testing both a preventative control and a monitoring control might be appropriate.
• Changing the nature of a test. More persuasive evidence should be gathered as the degree of risk increases. For example, re-performance of revaluation adjustments is more persuasive than inquiry and inspection directed to such judgments.

I hope this helps. This is one of a series of blogs that is meant to convey information relating to Canada’s transition from Canadian GAAP to IFRS, specifically as it pertains to CEO and CFO Certifications.

For further information, please refer to the ongoing series of IFRS blogs on the GFS Consulting web-site or send me a note, and please remember to contact your accounting professional for further guidance.