The Ontario Securities Commission ("OSC") recently published OSC Staff Notice 52-724 Considerations for Public Accounting Firms in Developing Internal Ethics Policies and Procedures (the "Notice"). The Notice summarizes observations of OSC Staff, following inquiries they made in response to ethical violations that had been identified by regulators in Canada and other jurisdictions. The Notice also outlines recommendations, but does not create any new requirements, for public accounting firms.

Purpose and Scope of Inquiry

Last year, the OSC announced that it would be making targeted inquiries to certain public accounting firms that audit Ontario reporting issuers, in light of ethical violations identified by the Canadian Public Accountability Board and regulators in other jurisdictions. As actual or perceived issues with the ethical integrity of auditors may undermine investor confidence in financial reporting, OSC Staff aimed to assess how public accounting firms: (i) communicate the need for strong ethical behaviour to invoke a culture of internal compliance; and (ii) assess compliance with ethical requirements as part of their internal policies and procedures.

Observations and Recommendations

In the Notice, OSC Staff provide views on three areas of focus: (i) internal ethics policies and procedures; (ii) the dating of audit work performed; and (iii) internal professional training programs.

Internal ethics policies and procedures

While each of the firms with which the OSC engaged had a collection of internal ethics policies and procedures, supported by a Code of Conduct, which were accessible and required to be reviewed periodically by employees, OSC Staff identified a few additional items for consideration by public accounting firms to assess whether their existing policies and procedures are sufficiently robust. These include the:

  • development of an overarching ethics strategy to support the development and maintenance of a strong ethical culture and which includes: (i) ethics education training and guidance; (ii) processes to monitor and assess the need for updates to policies or guidance; and (iii) opportunities for employee feedback;
  • identification of a leader responsible for implementing the ethics strategy; and
  • establishment of a robust internal whistleblower program.

Dating of audit work performed

OSC Staff noted that firms generally relied on electronic software to prepare and evidence sign-off of audit working papers. To mitigate the risk of employees adding significant documentation to a file after the corresponding auditor's report has been approved and dated, OSC Staff suggest that public accounting firms:

  • continuously evaluate their electronic software controls to prevent backdating;
  • develop processes and controls to assess administrative documentation added following the date of the auditor's report; and
  • implement a centralized mechanism for the timely archiving of audit files and maintenance of final versions.

Internal professional training programs

OSC Staff observed that accounting firms primarily used systems-based platforms to deliver and monitor completion of mandatory training, including testing. They also relied mainly on internal whistleblower programs to detect violations of the requirement that training be completed independently. In this respect, OSC Staff recommend that public accounting firms:

  • implement preventative controls to minimize the risk of answers to training module assessments being shared;
  • implement appropriate detection level controls, distinct from reliance on internal whistleblower programs; and
  • communicate violations and consequences appropriately.

Implementation

OSC Staff strongly encourage public accounting firms to review and apply the recommendations in the Notice to develop appropriate ethical policies and procedures. The suggested areas of focus may be tailored to different types and sizes of public accounting firms and are not meant to imply that "one size fits all."

Finally, while the Notice does not introduce any new professional or regulatory requirements, OSC Staff note that they continue to monitor this area and will consider further measures if additional or ongoing concerns are identified in the future.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.