CSA Finalizes Internal Control Certification Requirements

On August 15, 2008, the Canadian Securities Administrators (CSA) published a final revised National Instrument 52-109 Certification of Disclosure in Issuers' Annual and Interim Filings. This rule is substantially unchanged from the April 2008 proposals, and comes into effect on December 15, 2008.

Requirements differ significantly for venture and non-venture issuers. Non-venture issuers with calendar year-ends will need to certify the operating effectiveness of internal control over financial reporting.

Now is the time for both management and the audit committee to assess:

• How well prepared is the company to make these certifications?
• What needs to be done between now and the year-end to issue the certificates?

Non-Venture Issuers
Canadian requirements are substantially aligned with rules followed by SEC registrants, including the required use of a control framework and the definition of a material weakness.

A revised form of certificate applies to all non-venture issuers. Issuers should be sure to file the revised form of certificate. The CSA has commented that, in the past, some issuers have filed improper certificates. Clearly, securities regulators are monitoring the certificates being filed.

The core guidance on the design and evaluation of disclosure controls and procedures (DC&P) and internal control over financial reporting (ICFR) did not change significantly from the proposed rule. However, this guidance significantly expands the guidance provided in the current rule, especially for documentation and effectiveness. The guidance also reinforces that, if a material weakness exists at the end of the period covered by annual or interim filings, this fact must be disclosed in the annual or interim MD&A.

Substantive changes to the previous proposal include:

• A material weakness in ICFR will "almost always" represent a weakness that is significant in the issuer's disclosure controls and procedures. When a significant weakness is present, an issuer must conclude that DC&P is ineffective. This approach represents a change for many Canadian issuers but is consistent with US practices.
• The disclosure of procedures that mitigate the financial reporting risks caused by a material weakness should not imply that such procedures have eliminated the existence of a material weakness.
• The scope limitation for a business acquisition has been clarified to emphasize that the limitation applies only to material business acquisitions. Additionally, summary information on business acquisitions may be aggregated for related businesses. An issuer may limit the scope of its design of DC&P and ICFR to exclude controls, policies, and procedures of a business that the issuer acquired not more than 365 days before the end of the financial period to which the certificate relates.

Material Weakness

A material weakness is a deficiency or a combination of deficiencies in ICFR, such that there is a reasonable possibility that a material misstatement of the reporting issuer’s annual or interim financial statements will not be prevented or detected on a timely basis. For each material weakness, disclosure must include:

• a description of the material weakness
• the impact of the material weakness on financial reporting and ICFR
• the current plans, if any, or any actions already undertaken, for remediating the material weakness.

The description of the material weakness should provide investors with an accurate and complete picture of the material weakness by describing its cause and discussing the potential impact on, and importance to, the financial statements. Disclosure should distinguish between material weaknesses that have a pervasive impact and those that do not.

Initial Public Offering
For initial public offerings, a Canadian issuer is exempt from evaluating operating effectiveness of internal control over financial reporting only if the offering occurred during the final quarter. In contrast, an SEC registrant is exempt for an offering that occurred anytime during its year.

Any issuer planning to go public should make appropriate plans to meet the certification requirements.

Venture Issuers
In November 2007, the CSA announced that venture issuer certifications can exclude representations relating to the establishment and maintenance of DC&P and ICFR. This choice was effective for years ending on or after December 31, 2007. Since November, venture issuers have been able to file a "venture issuer basic certificate." This certificate includes a note to reader explaining how it differs from the full certificate filed by non-venture issuers.

A venture issuer filing a basic certificate is not required to discuss in its annual or interim MD&A the design or operating effectiveness of DC&P and ICFR. If a venture issuer voluntarily chooses to discuss its DC&P or ICFR in its MD&A when filing the "venture issuer basic certificate," then certain disclosures are recommended.

Conclusion
Non-venture reporting issues need to assess their preparedness for certification this year of operating effectiveness of internal controls. While some companies are making good progress, others will need to take immediate action to ensure they will be able to issue the certificates at year-end.

KPMG LLP (Canada) automatically sends these e-mail alerts to people who request them. You may request these e-mail newsletters by signing up at www.kpmg.ca/accountability or by clicking this link.