(1) Deficiency relating to the design of ICFR – A deficiency relating to the design of ICFR exists when:
(a) necessary components of ICFR are missing from the design;
(b) an existing component of ICFR is designed so that, even if the component operates as designed, the financial reporting risks would not be addressed; or
(c) a component of ICFR has not been implemented and, as a result, the financial reporting risks have not been addressed.
Subsection 6.6(2) of the Policy provides guidance on financial reporting risks.
(2) Deficiency relating to the operation of ICFR – A deficiency relating to the operation of ICFR exists when a properly designed component of ICFR does not operate as intended. For example, if an issuer’s ICFR design requires two individuals to sign a cheque in order to authorize a cash disbursement and the certifying officers conclude that this process is not being followed consistently, the control may be designed properly but is deficient in its operation.
(3) Compensating controls versus mitigating procedures – If the certifying officers identify a component of ICFR that does not operate as intended they should consider whether there is a compensating control that addresses the financial reporting risks that the deficient ICFR component failed to address. If the certifying officers are unable to identify a compensating control, then the issuer would have a deficiency relating to the operation of ICFR.
In the process of determining whether there is a compensating control, the certifying officers might identify mitigating procedures which help to reduce the financial reporting risks that the deficient ICFR component failed to address, but do not meet the threshold of being a compensating control because:
(a) the procedures only partially address the financial reporting risks or
(b) the procedures are not designed by, or under the supervision of, the issuer’s certifying officers, and thus may not represent an internal control.
In these circumstances, since the financial reporting risks are not addressed with an appropriate compensating control, the issuer would continue to have a deficiency relating to the operation of ICFR and would have to assess the significance of the deficiency. The issuer may have one or more mitigating procedures that reduce the financial reporting risks that the deficient ICFR component failed to address and may consider disclosure of those procedures, as discussed in section 9.7 of the Policy. In disclosing these mitigating procedures in its MD&A, an issuer should not imply that the procedures eliminate the existence of a material weakness.