The Migration of Sarbanes-Oxley

Article by Jonathan Lampe and Mark Spiro

Originally published in July 2003

On June 27, 2003, the Ontario Securities Commission (OSC) released for comment three rules that it believes are necessary to restore investor confidence in Canada’s capital markets. Following the pattern set by the Sarbanes-Oxley Act of 2002 in the United States, the rules contemplate:

• certification of annual and interim disclosures by an issuer’s chief executive officer and chief financial officer,
• increased independence, competence and responsibility for audit committees, and
• support for the Canadian Public Accountability Board in its oversight of external auditors.

With the exception of British Columbia (which has expressed some reservations about the need for these rules), the provincial and territorial securities regulators across Canada have joined the Commission in these initiatives. In describing the new rules, David Brown, the Chairman of the Commission, stated that:

The proposed rules are, in large measure, similar to those adopted south of the border. Issuers that are already subject to the U.S. regulatory regime will be largely unaffected by the proposed rules. The measures will, however, require other reporting issuers in Canada to begin to address the procedural and substantive requirements that have occupied significant amounts of time and resources over the past year for issuers subject to Sarbanes-Oxley.

The currently scheduled implementation date for a majority of the initiatives is January 1, 2004. The comment period for the new rules expires September 25, 2003.

The first of these rules (which is patterned on section 302 of Sarbanes-Oxley) will require CEOs and CFOs of all reporting issuers in Canada to certify, based on their knowledge, that their company’s annual filings (i.e., annual information form, annual financial statements and MD&A) and interim filings (i.e., interim financial statements and interim MD&A) do not contain a misrepresentation and that the company’s financial condition is fairly presented. The annual certificate will have to be filed at the same time the issuer files the last of its annual information form and its annual financial statements and MD&A.

The Commission has advised that it believes that fair presentation includes, but is not necessarily limited to:

• the selection and proper application of appropriate accounting policies;
• disclosure of financial information that is informative and reasonably reflects the underlying transactions; and
• the inclusion of additional disclosure necessary to provide investors with a materially accurate and complete picture of the financial condition, results of operations and cash flows of the issuer.

As under Sarbanes-Oxley, this certification will require financial information to be more than GAAP compliant and will require issuers to look more broadly at the financial information that they are presenting to the market.

Additionally, following a one-year transition period to January 1, 2005, CEOs and CFOs will be required to certify (again in a manner patterned on section 302 and section 402 of Sarbanes-Oxley) that:

• they have designed, or supervised the design of, disclosure controls and procedures and implemented those controls to provide reasonable assurances that material information relating to their company, including consolidated subsidiaries, is made known to them by others within those entities and that such material information is disclosed within the time periods specified under applicable securities legislation;
• they have designed, or supervised the design of, internal controls and implemented those controls to provide reasonable assurances that their company’s financial statements are fairly presented in accordance with GAAP;
• they have evaluated the effectiveness of such controls and have disclosed in the MD&A their conclusions about such effectiveness as well as any changes to, or factors which could significantly affect, the issuer’s internal controls; and
• they have disclosed any deficiencies to the company’s audit committee and external auditors.

Like Sarbanes-Oxley, but in contrast to the rules that have been proposed and implemented under Sarbanes-Oxley by the Securities and Exchange Commission, the rule proposed by the OSC does not define "disclosure controls and procedures" or "internal controls", and does not provide guidance as to what controls and procedures the OSC might consider to be appropriate (or in what circumstances the OSC may have concerns about controls and procedures). The OSC has indicated that it will be left to management’s judgement, based on factors specific to the issuer (and likely the practices and standards that have developed under Sarbanes-Oxley and that other issuers adopt in Canada) to design and implement controls and procedures that are appropriate.

Certain issuers, including those that comply with the annual and quarterly certification requirements prescribed by Sarbanes-Oxley, will be exempt from the certification requirements, provided they file their most recent annual report and signed SEC certifications on SEDAR.

An officer providing a false certification could be subject to quasi-criminal, administrative or civil proceedings under securities laws as well as private actions for damages at common law or under the Securities Act (Ontario) when amendments to the Securities Act that create statutory civil liability for misrepresentations in continuous disclosure documents are proclaimed in force.

Again following Sarbanes-Oxley, the Commission has proposed a rule (patterned on section 301 of Sarbanes-Oxley) dealing with the role and composition of audit committees. Most basically, the rule requires every reporting issuer to have an audit committee:

• to which the external auditors report directly, and
• that is comprised of a minimum of three members, each of whom is independent (with no direct or indirect relationship that could, in the view of the board, reasonably interfere with the exercise of such member’s independent judgement) and financially literate (having the ability to read and understand a set of financial statements that present a breadth and level of complexity of accounting issues that generally are comparable to the breadth and level of complexity of the issues that reasonably can be expected to be raised by the issuer’s financial statements).

The rule permits an independent director of a company to be a member of the audit committee of an affiliated entity, such that independent directors of a parent company would be permitted to serve as members of the audit committee of a subsidiary. The rule also deems certain persons (including those receiving consulting or advisory fees from the issuer or who received such fees during the previous three years) not to be independent.

Pursuant to the rule, an audit committee will be required to have a written charter that sets out its mandate and responsibilities, including recommending to the board of directors the external auditors to be nominated for the purpose of preparing or issuing an audit report as well as the compensation to be paid to such auditors. Each audit committee will also be responsible for, among other matters:

• overseeing the work of the external auditors;
• pre-approving all non-audit services to be provided to the issuer by the external auditors (other than non-audit services that constitute no more than 5% of the total amount paid to the external auditors, which must in any event be approved by the audit committee before completion of the audit);
• reviewing the issuer’s financial statements, MD&A and earnings press releases before they are publicly disclosed and being satisfied that adequate procedures are in place for the review of the issuer’s other disclosure of financial information extracted or derived from the financial statements;
• establishing procedures for the receipt, retention and treatment of complaints received by the issuer regarding accounting, internal accounting controls or auditing matters and the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters; and
• reviewing and approving the issuer’s hiring policies regarding employees and former employees of the present and former external auditors of the issuer.

Every reporting issuer will be required to disclose in its annual information form:

• the text of the audit committee’s charter;
• the composition of its audit committee, and if a member is not independent, the reason why;
• if it is relying on certain exemptions contained in the proposed rule;
• whether an "audit committee financial expert"¹ serves on the audit committee, and if not, why not;
• any recommendation of the audit committee to nominate or compensate external auditors that was not adopted by the board, and the reason for that recommendation;
• a description of any specific policies and procedures adopted by the audit committee for the engagement of the external auditors to provide non-audit services; and
• the aggregate fees billed by the external auditors for each of the last two fiscal years for professional services on account of audit fees, auditrelated fees, tax fees and all other fees.

The securities regulators have suggested that the proposed rule would constitute an unfair burden on the resources of "smaller companies" and could pose an unacceptable barrier to their ability to access the public markets and compete. In this context, the rule exempts certain issuers (including those listed on the TSX Venture Exchange) from the requirement that members of the audit committee be independent and financially literate and the disclosure requirements related to whether or not the audit committee includes a financial expert. As well, issuers that are listed on a major U.S. exchange or quotation system will be exempt from all of the substantive requirements of the rule provided that the issuer complies with the requirements of the U.S. exchange or quotation system with respect to the role and composition of audit committees and discloses in its annual information form if the board did not adopt a recommendation of the committee related to the nomination or compensation of the external auditor.

The OSC has also proposed a third rule, which it believes should enhance the quality of independent auditing, which will require financial statements of reporting issuers to be audited by an accounting firm that it is good standing with the Canadian Public Accountability Board (CPAB). The CPAB is a new independent public oversight system for accountants and accounting firms that audit reporting issuers. The CPAB is to develop and implement an oversight program with rigorous inspections of the auditors of public companies in Canada.

The three proposed rules effectively will require all Canadian issuers participating in the public markets to begin to address and respond to the basic requirements and practices that have arisen in the context of Sarbanes-Oxley, if they have not already done so. For some issuers, relatively few changes will be required to their existing governances structures and practices, while others will need to undertake a number of fundamental changes. Some of those changes, particularly those relating to audit committee composition, may take longer to implement than others.

In all instances it will be important that issuers, their directors and management adopt responses to these regulatory initiatives that work, and that will actually be followed by them. Adoption of "model" structures, charters and procedures that do not reflect the particular requirements of an issuer or that will fall out of use over time have the potential of subjecting issuers, their directors and management to increased costs without commensurate benefits and, potentially, enhanced liability.