CSA Staff Notice 52-310: MI - 52-111 - Reporting on Internal Control over Financial Reporting

CANADIAN SECURITIES ADMINISTRATORS NOTICE 52-310

REGARDING PROPOSED TIMING OF

PROPOSED MULTILATERAL INSTRUMENT 52-111

AND COMPANION POLICY 52-111CP

REPORTING ON INTERNAL CONTROL OVER FINANCIAL REPORTING

On February 4, 2005, we, the securities regulatory authorities in every Canadian jurisdiction other than British Columbia, published for comment a proposed instrument regarding reporting on internal control over financial reporting (the Proposed Internal Control Instrument).{1}

The comment period on the Proposed Internal Control Instrument expired on June 30, 2005.

Proposed project timeline

Under the Proposed Internal Control Instrument, as it was published for comment, internal control reporting requirements would be phased in over four years, beginning with financial years ending on or after June 30, 2006.

We propose to extend the timeline for our internal control reporting project in order to:

• allow us sufficient time to assess the potential impact of the developments in the U.S. discussed below on the Proposed Internal Control Instrument;

• consider the many submissions from commenters on the Proposed Internal Control Instrument; and

• respond to concerns from issuers and their advisors regarding our proposed timeline.

As a result, we propose that the earliest an internal control reporting instrument would apply is in respect of financial years ending on or after June 30, 2007. We will continue to update market participants on project developments and our timeline.

Background

Proposed internal control reporting requirements

The Proposed Internal Control Instrument, as it was published for comment, is substantially similar to the requirements of the rules implementing section 404 of the Sarbanes-Oxley Act of 2002 (the Sox 404 Rules).

Under the Proposed Internal Control Instrument, management of an issuer would be required to evaluate the effectiveness of the issuer's internal control over financial reporting, as at the end of the issuer's financial year, against a suitable control framework. In addition, the issuer would be required to file the following with the securities regulatory authorities:

• a report of management that describes management's assessment of the effectiveness of the issuer's internal control over financial reporting; and

• a report of the issuer's auditor prepared in accordance with the CICA's auditing standard for internal control audit engagements.

Please refer to the Proposed Internal Control Instrument for a complete description of the proposed internal control reporting requirements.

Project update

Consultation activities

Over the last several months, we have actively solicited feedback on the Proposed Internal Control Instrument, including in discussion forums held in Vancouver, Calgary and Toronto. In doing so, we have consulted with a wide range of groups, including reporting issuers, audit firms and legal advisers to reporting issuers, internal control consultants and investor groups.

Developments in the US

On March 2, 2005, the US Securities and Exchange Commission (the SEC) extended the compliance date of the Sox 404 Rules for SEC registrants that qualify as non-accelerated filers or foreign private issuers. As a result, non-accelerated filers and foreign private issuers now are required to comply with the Sox 404 Rules beginning with financial years ending on or after July 15, 2006. The SEC release announcing the extension of the compliance date can be found on the SEC's website at http://www.sec.gov/rules/final/33-8545.htm.

The SEC held a roundtable discussion on the implementation of the Sox 404 Rules on April 13, 2005. As a result of those discussions, additional guidance from the SEC and the Public Company Accounting Oversight Board (the PCAOB) on the implementation of the Sox 404 Rules was published on May 16, 2005. The guidance can be found on the SEC's website and the PCAOB's website at the following links:

• http://www.sec.gov/news/press/2005-74.htm;

• http://www.sec.gov/info/accountants/stafficreporting.pdf;

• http://www.pcaobus.org/Rules/Docket_008/2005-05-16_Release_2005-009.pdf; and

• http://www.pcaobus.org/Standards/Staff_Questions_and_Answers/2005/05-16.pdf.

In January 2005, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) convened a task force to provide guidance for small businesses with respect to the implementation of COSO's internal control framework published in 1992. We understand that the task force plans to issue an exposure draft of this guidance in August 2005.

Review of comment letters

We received 64 comment letters on the Proposed Internal Control Instrument during the comment period. We are in the process of reviewing these comment letters and we thank the commenters for their submissions. Copies of the comment letters placed in our public file can be found on the Ontario Securities Commission's website at http://www.osc.gov.on.ca/Regulation/Rulemaking/Current/Part5/Comments/52-111/com_52-111_index.jsp.

Current certification requirements

We remind issuers of their obligations under Multilateral Instrument 52-109 Certification of Disclosure in Issuers' Annual and Interim Filings (the Current Certification Instrument), as that instrument is currently in force. Please refer to the Current Certification Instrument for the required certifications.

Questions

Please refer your questions to any of:

Ontario Securities Commission

Alberta Securities Commission

Autorité des marchés financiers

Manitoba Securities Commission

{1} Please see proposed Multilateral Instrument 52-111 Reporting on Internal Control over Financial Reporting and Companion Policy 52-111CP.