Office of the Superintendent of Financial Institutions
Today OSFI is issuing for public comment the draft guideline, Assurance on Capital, Leverage and Liquidity Returns.
Regulatory returns are key contributors to the assessment of safety and soundness of a federally regulated financial institution (FRFI). The draft guideline seeks to better inform auditors and institutions on the work to be performed on regulatory returns in an effort to enhance and align OSFI’s assurance expectations across all FRFIs.
In developing the draft guideline, OSFI considered the range of feedback received from stakeholders in response to the 2021 discussion paper. OSFI thanks all stakeholders who provided feedback. The Annex below provides a non-attributed summary of key respondent comments and an explanation of how the comments are reflected in the draft guideline.
We invite feedback from all interested stakeholders on the draft guideline by May 31, 2022. All comments received will be considered in OSFI’s finalization of a guideline in the second half of 2022.
Please submit comments by e-mail to Assurance@osfi-bsif.gc.ca.
Assistant Superintendent, Regulation Sector
OSFI received feedback on the Discussion Paper from 35 respondents, including FRFIs, audit firms, industry, and professional associations. The summary of respondent feedback below reflects those issues raised by a large number of respondents.
Respondents questioned the need for the implementation of a system-wide assurance initiative, suggesting that OSFI rely on existing assurance practices (management policies and procedures, internal audit and external audit practices and opinions) and engage with individual institutions for additional assurance based on specific risk assessments.
OSFI acknowledges this view. However, it is important to recognize that there exists today a range of practice and varying levels of assurance with respect to regulatory returns. An industry-wide guideline is intended to promote consistency and clarity by better informing external auditors and FRFIs of the work to be performed on regulatory returns.
Respondents indicated that any new assurance requirements should remain risk-based, and principles-based, where the assurance approaches for federally regulated insurers (FRIs) and deposit-taking institutions (DTIs) consider the differences in inherent risks within the industries. Respondents also indicated that the new assurance requirements should consider proportionality.
OSFI agrees that assurance expectations should be principles-based and risk-based. OSFI has included language in the draft guideline to take into consideration the volume of returns in scope, whether they are new or existing requirements, as well as to ensure that the expectations are commensurate with OSFI’s proportionality initiative for small and medium sized deposit-taking institutions (SMSBs)Footnote 1.
Respondents suggested that duplication of internal and external audit efforts should be avoided across assurance requirements. They suggested that external audit should focus on a substantive audit of regulatory returns, excluding testing of controls, given that internal audit is best positioned to focus on controls and processes.
In consideration of respondent feedback, OSFI has revised the assurance expectations for external auditors to be able to rely on the internal audit opinion for the effectiveness of controls and processes around key regulatory returns.
Respondents commented that while examining the regulatory ratio’s numerator and denominator separately is feasible, such a requirement may increase the scope and cost of the audit.
OSFI believes that it is important to assess the numerator and denominator of regulatory ratios separately to prevent potential offsetting misstatements that may otherwise be undetected.
Respondents requested that OSFI provide further guidance on materiality with respect to the external audit assurance expectations.
The determination of materiality should be an independent process taking into consideration a range of quantitative and qualitative factors. While the draft guideline lists some items for consideration, this is not a comprehensive list. External auditors will need to use professional judgement to determine an appropriate, risk-based level of materiality.
Respondents indicated that the Summary of Unadjusted Errors can be made available to OSFI directly from FRFIs if limited to items impacting the calculation of regulatory ratios.
The draft guideline requests that the Summary of Errors accompany the FRFI senior management attestation on an annual basis. The draft guideline clarifies that submission may be limited to only those errors impacting the calculation of regulatory ratios and emphasizes that this report will be treated in a confidential manner.
Respondents recommended aligning the filing requirements for assurance on regulatory returns with financial statement audits, while others suggested retaining the existing filing date for branches.
In consideration of respondent feedback, filing requirements are generally aligned with financial statement audits. The draft guideline clarifies that for foreign branches, external audit opinions are expected to continue accompanying the May 31 filing submissions.
Respondents sought clarification if the scope of external audit assurance includes an opinion on whether the regulatory model is fit for purpose or whether implementation is consistent with the OSFI-approved model.
The draft guideline clarifies that the external auditor is expected to provide an opinion on whether model implementation, where applicable, is consistent with the OSFI-approved model.
Respondents suggested that OSFI should define senior management and clarify the lines of defence permitted to perform the independent review for the attestation.
FRFIs are expected to define the roles to fulfill their regulatory assurance responsibilities. The draft guideline clarifies that the review function should be independent of the business line responsible for preparation of the returns. OSFI believes this affords flexibility while still providing sufficiently clear guidance to institutions that may benefit from it.
Respondents suggested limiting the scope of the internal audit to the design and operating effectiveness of controls over the preparation of the return, which is consistent with the standard mandate of the function.
In consideration of respondent feedback, OSFI has revised the assurance expectations for internal auditors to an opinion on the processes and controls in place with respect to key regulatory returns.
Respondents commented that given their rotational frequency, annual internal audits may not be feasible.
OSFI appreciates this constraint. The draft guideline clarifies that an internal audit opinion is expected at a minimum once every three years based on a FRFI’s internal risk-based frequency of review.
Respondents requested deferring the effective date of the new assurance requirements until after the implementation of IFRS 17 and Basel III reforms.
In consideration of respondent feedback, the draft guideline proposes the following changes to the proposed effective dates:
See OSFI’s Guideline, Small and Medium-Sized Deposit-Taking Institutions (SMSBs) Capital and Liquidity Requirements.
Return to footnote 1