Bill 198 – Sarbanes-Oxley Comes to Canada

Source – Barry Shaw, Principal, BRS Management Consulting, 2005

The Countdown Has Begun

The Sarbanes-Oxley Act, which was recently implemented in the US to ensure corporate accountability and transparency, is soon to be emulated north of the border. The government of Canada’s province of Ontario has proposed the ‘Budget Measures Act’, known as Bill 198, and it closely duplicates the Sarbanes-Oxley Act in both wording and regulatory requirements.

Compliance to such regulations is not new to some large Canadian organizations. Canadian companies who are SEC registrants, meaning they are listed on US stock exchanges, have been subjected to the same rules that apply to US domestic companies. For most companies involved in Sarbanes-Oxley compliance (particularly with Section 404 and 302), the exercise has been difficult and expensive. CEO’s of Canadian firms listed on the Toronto or Vancouver Stock Exchange are relieved that they have been spared this onerous compliance effort up until now, but the reprieve is over.

The Toronto Stock Exchange, the British Columbia Securities Commission, and Canadian business executives have protested the implementation of such draconian measures, arguing that the Enron, Worldcom, and Adelphia corporate scandals have not happened in Canada. However, observers of the Northern Telecom profit restatement fiasco would argue otherwise.

In any event, there is a definite move towards tighter regulations internationally. Europe is moving to enact its own version of Sarbanes-Oxley. It makes sense to have an even playing field in the global investor community, otherwise investment capital will gravitate to only those countries with the most trustworthy financial accountability practices. Canada simply cannot afford to opt out of this movement.

Sarbanes-Oxley Regulations – A Refresher

For the unfamiliar, the Sarbanes-Oxley Act is an eleven-part document covering all the requirements for registrants of the US Securities and Exchange Commission. Most noteworthy are Sections 302 and 404, which impose new rules and responsibilities intended to ensure that financial reports are materially accurate present a fair and true picture of a company’s condition.

Section 302 requires CEO’s and CFO’s to sign off on the accuracy of their financial statements, obligating them to accept personal liability for those statements; a new and frightening responsibility.

Section 404 requires a company to submit quarterly and annual ‘internal control reports’ which attest to a company’s use of a proven control framework for accurate and timely financial reporting and disclosures. This innocuous little title of the SOX Act was the one that really sent corporations into a panic. If no such control structure existed, and for most organizations it didn’t, it had to be planned, implemented and tested to an external auditor’s satisfaction before the SEC filing deadline. The only guidance the SEC gave on what control framework might be acceptable was the mention of the COSO model (Committee of Sponsoring Organizations of the Treadway Commission), a multi-dimensional structure similar in nature to the COBIT (Control Objectives for IT) model for IT governance.

New Corporate Responsibilities – IT and the CEO/CFO

Aside from the costly diversion of funds and resources to the compliance effort, the SOX Act imposed new demands on two corporate roles in particular – the CEO/CFO executive and the IT Manager.

With his John Henry on the financial report, the CEO/CFO must be supremely confident that things are exactly as written. The days of trusting the reporting chain are gone. The CEO/CFO must now be ‘control infrastructure’ savvy, with a comprehensive knowledge of the extent and reliability of the organization’s checks and balances, audits, and risk mitigation mechanisms.

Life will never be the same for IT Managers, either. Current and legacy systems that have remained largely undocumented, regardless of whether they performed reliably in the past, must now be fully documented and catalogued to an extent never before required.

Sarbanes-Oxley vs Bill 198 – Key Differences

Bill 198 deals with virtually all of the same issues as Sarbanes-Oxley, including auditor independence, audit committee responsibilities, CEO and CFO accountability for financial reporting and internal controls, faster public disclosure, and stiffer penalties for illegal activities.

The most significant difference between the US SEC and Canadian OSC regulations is the deadline for full compliance. For ‘accelerated’ SEC registrants (those with a market capitalization of more than $75 million), the filing deadline was mid-November, 2004. For Canadian companies, the deadline for full compliance is near the end of 2006, almost two years away. That should be plenty of time to get internal controls in order. Note however that starting this year (under the MI 52-109 part of Bill 198), Canadian company CEO’s and CFO’s must certify that their annual and interim financial statements are ‘fairly presented’ and that they have effective internal controls in place.

The other key difference pertains to the quarterly and annual control attestation reports. The way Bill 198 is now proposed, Canadian companies do not have to submit an external auditor attestation of the adequacy of internal controls. That may change soon under proposed changes in Multilateral Instrument 58-101 and 58-201.

It should be added that like the Sarbanes-Oxley Act, Bill 198 has beefed up penalties for Ontario Securities Act offenses from $1 million and 1 year in prison to $5 million and 5 years in prison.

New Corporate Mindset for Canada

Recent surveys of Canadian companies have revealed that more than half of respondents feel Canada should NOT adopt Sarbanes-Oxley style governance regulations. While most are prepared to implement changes necessary to improve the quality and accuracy of financial reporting, they stop short of accepting the regulations concerning CEO and CFO certification of internal controls. Clearly there is a preference to avoid the expense and difficulties of governance program implementation.

Luckily, more than half of surveyed Canadian company executives feel the new regulations will have a positive impact on senior management’s ability to run the company. It appears that Canadian senior executives will play a crucial role in setting the ‘tone from the top’ and providing the driving force for a new corporate mindset.

For more information on BRS Management Consulting, visit www.brs-management.com.