Ticking time bomb? Initial Sarbanes-Oxley results show lax Canadian internal control practices

Canadian firms that have recently prepared internal control reports under the U.S. Sarbanes-Oxley Act (SOX) have worrisome accounting weaknesses, according to new research from Queen’s School of Business.

The Queen’s research team, led by Professor Steven Salterio and doctoral student Regan Schmidt, announced today the findings of the first-ever study of Canadian SOX compliance, which highlights internal control problems reported by Canadian companies. The study investigated SOX reports from 31 firms that are cross-listed in Canada and the U.S. and were required to file for the first time in 2004 or 2005.  These firms represent approximately 15 per cent of the largest 183 cross-listed Canadian companies, all of which will be required to report for 2006.

“What we found is that compared to similar-sized U.S. companies, Canadian firms reported higher rates of internal control problems at a similar stage,” said Schmidt. “These were not technical weaknesses about obscure accounting details but weaknesses in major items like accounts receivable, revenue recognition and miscalculation of expenses.  These activities are at the core of the ability of any company to make reliable financial reports to investors.”

Firms traded exclusively on Canadian exchanges are not subject to the same level of reporting because of a March decision by the Canadian Securities Administrators not to proceed with a Canadian equivalent of SOX.  This CSA decision results in what the researchers call an “almost invisible two-tier” level of investor protection in Canada. 

“We were shocked to find the overall rate of reported control problems for Canadian companies was higher than their U.S. counterparts,” said Salterio. In the first year of SOX reporting in the United States, 13 per cent of companies disclosed weaknesses in internal controls.  In comparison, 19 per cent of cross-listed Canadian firms reported errors.

“The data also shows that more than two-thirds of Canadian companies did not disclose major internal control weaknesses the quarter before their final preparations for being audited were in progress. While better than the U.S. rate of 87 per cent, this finding reflects the potential weak state of internal controls in corporate Canada – unbeknownst to management – even though CEOs and CFOs are required by SOX to certify they have effective control systems in place,” stated Salterio.

“We don’t want a WorldCom to take place here. Fortunately, most of the material errors associated with the control problems were caught by auditors in their financial statement audits,  but we can’t lose sight of the fact that weak internal controls can lead to potential problems,” said Salterio.

Although the sample size was small, the researchers feel these initial reports could be indicative of widespread poor internal controls in Canada.  And since the CSA’s decision not to adopt internal control audit requirements was made when concrete data was not available, the results of this study  provides important information for regulators and investors. 

“Boards and audit committees should be concerned that either management does not know about – or worse, does not disclose – material weaknesses in their internal controls. This is despite the fact that they are required by law to do so,” said Salterio. “Ultimately, this is a huge red flag for Canadian boards because the CSA will require such disclosures in management’s discussion and analysis for the first time in 2006.”

So what should Canadian companies be doing to ensure the integrity of their internal control standards? According to Salterio, “As a start, larger Canadian companies should voluntarily contract with their audit firms to conduct an internal control audit that mirrors SOX principles.”  As for regulators, Salterio suggests this research as solid evidence that internal control audits should be a requirement for all large Canadian companies.