On April 18, 2008 the Canadian Securities Administrators (CSA), in conjunction with the Ontario Securities Commission (OSC), released an update to MI 52-109.

This provided further refinements to the guidelines and regulations governing Bill 198 / C-SOX. The 166 page document is located on the OSC web-site for interested parties, but the following is a summary:

SUMMARY OF CHANGES TO THE MARCH 2007 PROPOSED MATERIALS

Significant proposed amendments

The significant proposed changes to the March 2007 Proposed Materials, as reflected in the Proposed Materials, are as follows:

• A new form of certificate for venture issuers, called a “venture issuer basic certificate” does not include representations relating to the establishment and maintenance of DC&P and ICFR;
• Non-venture issuers are required to use a control framework in the design of ICFR;
• The threshold for reporting a weakness in ICFR is a “material weakness” rather than the previous concept of “reportable deficiency”;
• An issuer does not have to remediate a material weakness; however, an issuer must disclose its plans, if any, to remediate a material weakness;
• An issuer may limit the scope of its design of DC&P and ICFR to exclude controls, policies and procedures of a business that the issuer acquired not more than 365 days before the end of the financial period to which the certificate relates; this compares to a 90-day period in the March 2007 Proposed Materials;
• We have increased the extent of guidance included in the Companion Policy.

These changes are described in more detail below.

Venture Issuer Basic Certificate

We have decided to remove the requirement for venture issuers to design and evaluate DC&P and ICFR. As a result of this change,
• Certifying officers of venture issuers are no longer required to include representations in their certificates relating to the establishment and maintenance of DC&P and ICFR.
• The venture issuer basic certificate includes a note to reader explaining how it differs from the full certificate required to be filed by reporting issuers other than venture issuers.
• A venture issuer filing a basic certificate is no longer required to discuss in its annual or interim MD&A the design or operating effectiveness of DC&P or ICFR. If a venture issuer files a basic certificate and chooses to discuss the design or operation of one or more components of its DC&P or ICFR, we suggest that the issuer include a discussion in its MD&A that is similar to the disclosure in the note to reader on its venture issuer basic certificate.
• Venture issuers that wish to do so may choose to file full certificates.

Control framework

A non-venture issuer must use a control framework to design the issuer’s ICFR. We believe this is appropriate now that the requirement to design ICFR only applies to non-venture issuers. Control frameworks commonly in use include:

(a) the Risk Management and Governance: Guidance on Control (COCO Framework), formerly known as Guidance of the Criteria of Control Board, published by The Canadian Institute of Chartered Accountants;
(b) the Internal Control – Integrated Framework (COSO Framework) published by The Committee of Sponsoring Organizations of the Treadway Commission (COSO); and
(c) the Guidance on Internal Control (Turnbull Guidance) published by The Institute of Chartered Accountants in England and Wales.

A smaller issuer can also refer to Internal Control over Financial Reporting – Guidance for Smaller Public Companies published by COSO, which provides guidance to smaller public companies on the implementation of the COSO Framework.

Material Weakness

Based on comments we received, we have decided to replace the concept of “reportable deficiency” which we proposed in the March 2007 Proposed Materials, with the concept of “material weakness”.
The definition of “material weakness” in the Proposed Instrument, which is the same as the corresponding U.S. definition, is as follows:

“material weakness” means a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the reporting issuer’s annual or interim financial statements will not be prevented or detected on a timely basis.

Under the Proposed Instrument, if a non-venture issuer determines it has a material weakness which exists as at the end of the period covered by its annual or interim filings, as the case may be, it must disclose in its annual or interim MD&A for each material weakness:

• a description of the material weakness;
• the impact of the material weakness on the issuer’s financial reporting and it’s ICFR; and
• the issuer’s current plans, if any, or any actions already undertaken, for remediating the material weakness.

Scope limitations

An issuer may limit the scope of its design of DC&P and ICFR to exclude controls, policies and procedures of a business that the issuer acquired not more than 365 days (formerly 90 days in the March 2007 Proposed Materials) before the end of the financial period to which the certificate relates.

Extent of guidance

As requested in the comments and roundtable discussions, the Companion Policy contains new guidance on various topics, including:
• Self-assessments – The guidance indicates that a certifying officer’s self-assessment, in certain circumstances, would provide sufficient evidence since the certifying officer signs the certificate.
• Compensating controls & mitigating procedures – Guidance is provided to assist certifying officers in determining whether a deficiency is addressed by a compensating control or a mitigating procedure and how that determination affects their conclusions on the effectiveness of ICFR.

• Use of a service organization or specialist for an issuer’s ICFR – Further guidance is provided relating to the use of service auditor reports and procedures to consider when using the work of a specialist.
• Weakness in DC&P – Guidance is provided for situations where the certifying officers identify a weakness in the design or operation of DC&P that is significant and exists as at the period end date.
• Disclosure of an external auditor report on ICFR – Guidance is provided on filing a copy of the internal control audit report if an issuer refers, in a continuous disclosure document, to an audit report relating to the issuer’s ICFR, prepared by its external auditor.

Proposed effective date

The proposed effective date of the Proposed Instrument, which will apply to all reporting issuers other than investment funds, is December 15, 2008.