CSA Publishes Proposed New Certification Rule (NI 52-109)

Written By Stephen P. Sibold, Q.C.

On March 30, 2007, the Canadian Securities Administrators (CSA) released for comment the much anticipated replacement to MI 52-109 – Certification of Disclosure in Issuers' Annual and Interim Filings. As published, the new rule would require management to evaluate an issuer's internal control over financial reporting (ICFR) and provide MD&A disclosure concerning the effectiveness of ICFR based on that evaluation. CSA did not require issuers to obtain from their auditors an internal control audit opinion concerning management's assessment of the effectiveness of ICFR. If adopted, the proposed new rule will apply to all reporting issuers, other than investment funds, effective June 30, 2008.

Summary of Significant Changes

Additional Certifications

In addition to the current certifications under MI 52-109, the new rule would require CEOs and CFOs to certify that:

• they have evaluated the effectiveness of ICFR and the issuer has disclosed in its annual MD&A:
  • their conclusions respecting the effectiveness of ICFR;
  • a description of the process used to evaluate ICFR;
  • a description of any reportable deficiency relating to the operation of ICFR; and
  • the issuer's plans, if any, to remediate any reportable deficiency;
• the issuer has included in its MD&A a statement identifying the control framework used to design ICFR or a statement that such a framework was not used, as applicable; and
• based on the evaluation of ICFR, they have disclosed to the auditors, the board of directors and the audit committee any fraud that involves management or other employees who have a significant role in ICFR.

Reportable Deficiency

The new rule introduces the concept of a “reportable deficiency”, defined as “a deficiency, or combination of deficiencies, in the design or operation of one or more controls that would cause a reasonable person to doubt that the design or operation of internal control over financial reporting provides reasonable assurance regarding the reliability of financial reporting and preparation of financial statements for external purposes in accordance with the issuer's GAAP.” Any shortcoming determined to be reportable would be required to be disclosed in an issuer's MD&A.

ICFR Design Accommodation for Venture Issuers

In recognition of the concern that small issuers may face challenges in designing their ICFR, the new rule includes an accommodation for venture issuers that cannot reasonably remediate a reportable deficiency relating to the design. In such a case, the venture issuer must disclose in its MD&A:

• the reportable deficiency;
• why the issuer cannot reasonably remediate the reportable deficiency;
• the risks the issuer faces relating to the reportable deficiency; and
• whether the issuer has mitigated those risks and if so, how.

Scope Limitation for JVs, VIEs and Acquisitions

Under the new rule, an issuer can cause its certifying officers to limit the scope of their design of disclosure controls and procedures (DC&P) and ICFR to exclude controls, policies and procedures carried out by:

• a proportionately consolidated entity in which the issuer has an interest, e.g., a joint venture;
• a variable interest entity in which the issuer has an interest; or
• a business that the issuer acquired not more than 90 days before the end of the period to which the certificate relates.

If the scope of the issuer's design is so limited, the issuer must disclose in its MD&A the scope limitation and summary financial information of such entity.

IPO/RTO Exemption

Under the new rule, certifying officers would be permitted to exclude certifications relating to (i) design and evaluation of ICFR in annual certificates and (ii) design of ICFR in interim certificates if the issuer's first annual or interim period (as the case may be) ends on or before the 90th day after becoming a reporting issuer or after certain reverse takeovers.

New Companion Policy

CSA has proposed an expanded companion policy to accompany the new rule. The proposed policy includes:

• a list of available control frameworks which certifying officers could reference when designing or evaluating the effectiveness of ICFR;
• considerations for the design of DC&P and ICFR, including:
  • use of a “top-down, risk-based” approach;
  • the components that should generally be included in the design of DC&P and ICFR; and
  • the key features of ICFR and related design challenges;
• considerations for the evaluation of DC&P and ICFR, including:
  • the evaluation tools that certifying officers might use to perform their DC&P and ICFR evaluations; and
  • the extent of documentation to support the certifying officers' evaluation of DC&P and ICFR;
• guidance for determining whether a reportable deficiency exists;
• a discussion of the role of directors and audit committees in relation to DC&P and ICFR; and
• a discussion of the effect on an issuer's DC&P and ICFR of various types of investments, including subsidiaries, variable interest entities, proportionately consolidated entities, equity investments and portfolio investments.

Timing

The following timeline is proposed:

• October 2007 – Approvals obtained to publish revised final rule
• January 2008 – Publish revised final rule
• June 30, 2008 – Effective date of final rule