Canadian SOX requirements

[Hana]

What is a good resource to help me identify Canadian requirement for Sarbanes Oxley. I need some general information regarding the differences.

[2thepoint]

Sox=Sox...
There or no differences in compliance...
Just follow the Sox-rules and regulations in USA, Europe, Canada or wherever you are...

[hana]

I have heard there are quite a few differences, and all sites I have found deal with US regulations. While they may be the same, is there a site directed towards Canadian regulations for SOX?..the associated Bill 198/ or 196?

[2thepoint]

[holger]

There're only differences regarding the deadlines. Not US Comp. have to be compliant by the end 2005. That's the first time you have to file the requested statements to the sec/pcaob.

[Hana]

Ok so if there isn't a difference between Canadian and US Requirements, what would be a good site to reference what I need to know to ensure compliance with SOX? THX.

[holger]

Obviously the act itself. Maybe the document "IT control requirements for sox" from www.itgi.org. You should pay close attention to the sec 302 and 404. The 404 work will take some effort, time and money. You maybe want you external auditor to perform some kind of pre-audit to point out the areas where you are required to solve some deficiencies.

[Tony]

This is my understanding too - we're a British subsidiary of a European company listed in the US. SOX is SOX, but "luckily" us FPIs get an extra year.

[Chris]

I'm a little late to this discussion but I've been using the PCAOB document to provide insight on how we'll be audited. One needs to remember that this document is directed at the responsibilities of auditors not "Management" however it does provide some interesting information.

Chris

[davedd]

[HW]

[Fletch]

Actually there are differences between SOX and it's counterpart legislation in Canada (Bill 198, Ontario (200)) (mostly timing of regs coming into force but some differences in regs as well). A quick overview of the Bill and the differences can be found at intaudit.edmonton.ab.ca/newsltr/iianews/ 2004/Dec%2004/Bill%20198%20(Overview)%20II%20A%20presentation.pdf

This only applies to companies which are listed solely in Canada. If your company is listed on an SEC regulated exchange then you do have to comply with SOX.

[Casper17]

The Candian standard is called MITS. It is very similar to SOX however there are some regualtory differences. Non-compliance carries penalities fromt he Canadian Government

[gmerkl]

In Canda the following applies (text from Ontario Securities Commission's website CANADIAN SECURITIES ADMINISTRATORS NOTICE 52-313):

After careful consideration of the feedback received and recent developments internationally, particularly in the US, we propose to expand MI 52-109 to include the internal control reporting requirements discussed below.

• The CEO and CFO of a reporting issuer, or persons performing similar functions, will be required to certify in their annual certificates that they have evaluated the effectiveness of the issuer's internal control over financial reporting as of the end of the financial year. They will also be required to certify that, based on their evaluation, they have caused the issuer to disclose in its annual MD&A their conclusions about the effectiveness of internal control over financial reporting as of the end of the financial year.

• As noted above, the issuer's annual MD&A will include disclosure regarding its internal control over financial reporting. This disclosure will include a description of the process for evaluating the effectiveness of the issuer's internal control over financial reporting and the conclusions about the effectiveness of internal control over financial reporting as of the end of the financial year.

The issuer will not be required to obtain from its auditor an internal control audit opinion concerning management's assessment of the effectiveness of internal control over financial reporting.

The board of directors and its audit committee, in consultation with management, may choose to consider whether they wish to engage the issuer's auditor to assist in discharging their respective responsibilities for (i) the issuer's internal control systems and (ii) review and approval of the issuer's annual MD&A. However, engagement of the auditor will not be a requirement under MI 52-109.

The proposed internal control reporting requirements discussed above do not diminish the existing obligations of the issuer's auditor under generally accepted auditing standards to (i) understand the issuer's internal controls relevant to the audit of the issuer's financial statements and (ii) read materials with which the auditor is deemed to be associated, such as the issuer's MD&A, assess whether they are inconsistent with their knowledge and take appropriate action if they are aware of any material misstatements of fact or, if applicable, misrepresentations.

I hope this clarifies the question on the Canadian requirements.

[jieran]

Another project I would recommend is a matrix of administrative authority (basically who does what and what is the limit of their limit of control (e.g. spending limits)).