Companion Policy to National Instrument 52-109 Certification of Disclosure in Issuers' Annual and Interim Filings

Part 8 Use of a Service Organization or Specialist For an Issuer's ICFR

An issuer might outsource a significant process to a service organization. Examples include payroll, production accounting for oil and gas companies, or other bookkeeping services. Based on their assessment of risks as discussed in subsection 6.6(2) of the Policy, the certifying officers might identify the need for controls, policies and procedures relating to an outsourced process. In considering the design and evaluation of such controls, policies and procedures, the officers should consider whether:

(a) the service organization can provide a service auditor’s report on the design and operation of controls placed in operation and tests of the operating effectiveness of controls at the service organization;

(b) the certifying officers have access to the controls in place at the service organization to evaluate the design and effectiveness of such controls; or

(c) the issuer has controls that might eliminate the need for the certifying officers to evaluate the design and effectiveness of the service organization’s controls relating to the outsourced process.

If a service auditor’s report on controls placed in operation and tests of the operating effectiveness of controls is available, the certifying officers should evaluate whether the report provides them sufficient evidence to assess the design and effectiveness of controls relating to the outsourced process. The following factors will be relevant in evaluating whether the report provides sufficient evidence:

(a) the time period covered by the tests of controls and its relation to the as-of date of the certifying officers’ assessment of the issuer’s ICFR;

(b) the scope of the examination and applications covered and the controls tested; and

(c) the results of the tests of controls and the service auditor’s opinion on the operating effectiveness of controls.

If a significant period of time has elapsed between the time period covered by the tests of controls in a service auditor’s report and the date of the certifying officer’s assessment of ICFR, the certifying officers should consider whether the service organization’s controls have changed subsequent to the period covered by the service auditor’s report. The service organization might communicate certain changes such as changes in its personnel or changes in reports or other data that it provides. Changes might also be indicated by errors identified in the service organization’s processing. If the certifying officers identify changes in the service organization’s controls, they should evaluate the effect of these changes and consider the need for additional procedures. These might include obtaining further information from the service organization, performing procedures at the service organization, or requesting that a service auditor perform specified procedures.

There could be circumstances in which a service auditor’s report is not available, the certifying officers do not have access to controls in place at the service organization and the certifying officers have not identified any compensating controls performed by the issuer. In these circumstances the inability to assess the service organization’s controls, policies and procedures might represent a material weakness since the certifying officers might not have sufficient evidence to conclude whether the components of the issuer’s ICFR at the service organization have been designed or are operating as intended.

A specialist is a person or firm possessing expertise in specific subject matter. A reporting issuer might arrange for a specialist to provide certain specialized expertise such as actuarial services, taxation services or valuation services. Based on their assessment of risks as discussed in subsection 6.6(2) of the Policy, the certifying officers might identify the need for the services provided by a specialist. The certifying officers should ensure the issuer has controls, policies or procedures in place relating to the source data and the reasonableness of the assumptions used to support the specialist’s findings. The certifying officers should also consider whether the specialist has the necessary competence, expertise and integrity.