C-SOX / Bill 198 – Update August 2008
During recent years, organizations have dedicated significant resources to internal controls – primarily publicly traded companies, to ensure compliance with the various “SOX” regulations in Canada and USA. The process can best be described as a long journey with an array of milestones, accomplishments (and emotions) occurring along the way. At this point, most Canadian publicly traded companies have completed the bulk of the regulatory requirements and are in the final stages of ensuring full compliance by the end of 2008. What’s next for internal controls? The companies that I have talked to are looking to maintain the appropriate level of ongoing SOX oversight, and looking to gain efficiencies where ever possible. Several SOX best practices have emerged recently that are worth noting:
• Review of Entity Level Controls (ELC). ELC’s include Corporate Governance Policies. Companies should reconsider the effectiveness of their ELC’s in mitigating financial reporting risk. As an example, if there is a robust monthly management review process between divisions and corporate, which includes a thorough explanation of variances and operating results, this ELC control should be included as part of the financial statement close and the financial notes (disclosure) process controls, and therefore could possibly reduce the amount of divisional testing. This also aligns with a “top down risk based approach” wherein the SOX process begins with a risk assessment and review of the consolidated financial statements, and then looks at the ELC’s in place as the first “line of defence”. For further information, please click here.
• Re-assess existing test designs, risks and materiality. The majority of the risk assessment and design work likely took place several years ago, and it is difficult from a resource perspective for some companies to review this ongoing. However, with the focus on top down risk reviews, there may be significant opportunities to gain efficiencies if a company re-assesses this. For example, processes that initially had very material consequences could have decreased in significance or may not longer exist. The level of testing may be reduced. Conversely, there might be new processes that were not included during the initial review. Perhaps an example of this would be financial derivatives. In any event, the best way to address this is to re-assess test designs, risks and materiality – and save time and money.
• Look for SOX efficiencies. This should be as part of the overall review mentioned above or separately if there are time constraints. At this stage of the SOX experience, most companies will be able to improve resource allocation by improving the testing process. Self-testing, whereby people involved with the process can perform periodic reviews, revised testing frequency, for instance by identifying tests can be done annually, and reduced sample sizes that will continue to provide assurances that controls are working, are ways that can improve efficiencies.
Further notes – During April 2008, the Canadian Securities Administrators (CSA) proposed changes to MI 52-109 (and invited public consultation), which would become effective December 15, 2008. For a summary of the proposed changes, please click here. Essentially the CSA has responded to feedback with some changes, but essentially is staying the course that they outlined previously. Furthermore, the public accounting oversight board in the USA (PCAOB) released Audit Standard # 5, which in my opinion more closely aligns SOX 404 with Canada’s MI 52-109.
Companies that have invested so much time and money into their SOX project will want to capitalize on this by maintaining strong internal controls, and not slip backwards. If done properly, this project can reap immeasurable benefits for companies and entrench internal controls throughout the organization.
If you have any questions, please don’t hesitate to contact me.
Edelkoort | Smethurst | Schein CPAs LLP is located in Burlington Ontario servicing the Golden Horseshoe and Greater Toronto Area and beyond. The firm is fully licensed with CPA Ontario to provide assurance, tax and accounting services as well as registered as tax preparers with the Canada Revenue Agency (CRA) & Internal Revenue Service (IRS). The firm is also registered as an IRS Certified Acceptance Agent.
All blog posts published on this site are for informational purposes only and do not constitute professional advice. Readers should contact a professional to discuss their individual situation. Neither the author or the accounting firm shall accept any liability for any reliance placed on the information posted.