Preparing for the 2017 Reporting Season

Read our comprehensive coverage of the diverse range of considerations that the 2017 reporting season has in store for public companies.

Cybersecurity

The proliferation of data security breaches at public companies has put cybersecurity on the radar of securities regulators. Cybersecurity is identified as a priority in the 2016-2019 business plan of the Canadian Securities Administrators, and regulators globally have identified cybersecurity as a key risk to financial markets. Public companies, as part of their overall risk management programs, should have suitable prevention, preparedness and remediation plans in place and should be mindful in this context of the regulatory and stock exchange requirements to publicly disclose material information – including material cybersecurity information.

Canadian securities regulators plan to scrutinize companies’ cybersecurity disclosures more closely in 2017.

The risks of a cyber-breach—directed at the company’s systems or a third party’s systems to which the company is vulnerable—may include losses of customers or goodwill, revenue losses, the costs of investigation and remediation, legal damages or settlements, cyber-insurance costs, loss of investor confidence and others. Material events and uncertainties that are reasonably likely to affect a company’s business should be addressed in MD&A, and material cybersecurity risks should be addressed in the risk factors disclosure.

For guidance on cybersecurity risk management programs, public companies may consider the Cyber-Security Self-Assessment Guidance published by the Office of the Superintendent of Financial Institutions which governs Canadian banks and other federal financial institutions—who are often early adopters of governance best practices. Perhaps the most fundamental points in the IOSCO guidance are that an organization’s risk management programs, both internally and relating to relevant third parties, must encompass cybersecurity due diligence, and adequate financial resources and accountability for cybersecurity should be clearly established within the organization.

Non-GAAP Financial Measures

Securities regulators will be scrutinizing non-GAAP financial measures this year. The OSC has cautioned companies that regulatory action may be taken if non-GAAP financial measures are misleading and harmful to the public interest. The regulator has also stated that its new whistleblower program, which contemplates awards of up to $5M for robust, credible information, could play a role in helping identify misleading financial disclosures. Substantial media attention was given last year to a report published by Veritas Investment Research that was critical of market practices relating to non-GAAP measures. Non-GAAP measures were also highlighted in the Commonsense Corporate Governance Principles published by several leading asset managers, activists, public companies and pension funds in July 2016. That group affirmed the U.S. and Canadian regulatory requirement that non-GAAP measures may be used to explain and clarify a company’s financial performance but should not obscure GAAP results.

In light of the risks of liability and reputational harm, public companies should take a fresh look at how they present non-GAAP financial measures in 2017.

In a recent staff notice, the OSC’s Office of the Chief Accountant reminded companies that

• non-GAAP financial measures should not be given inappropriate prominence compared to GAAP measures;
• presenting numerous non-GAAP measures in MD&A increases the likelihood of confusing investors and obscuring material information; and
• non-GAAP financial measures, including in press releases, must be reconciled to the most comparable GAAP measure (and the reconciliation should be referenced at the first presentation of the non-GAAP financial measure).

The U.S. Securities Exchange Commission is also scrutinizing non-GAAP financial measures, and SEC Chair Mary Jo White has stated that the SEC is poised to act, as indicated last year when charges were brought against the former executives of a U.S. public company for falsifying a key non-GAAP measure in earnings guidance. Although most Canadian companies are largely exempt from SEC rules on non-GAAP measures, the two jurisdiction’s rules overlap substantially, and the U.S. anti-fraud and civil liability provisions apply to all SEC-reporting companies as a general prohibition against misleading disclosure.

Retaliation Against Whistleblowers

In mid-2016, the OSC adopted its whistleblower program and anti-retaliation provisions were added to the Ontario Securities Act. If they have not done so already, public companies should review their relevant documents and internal policies—such as confidentiality and employment agreements and codes of ethics—because provisions that inhibit whistleblowing are prohibited as are reprisals against employees. See The OSC’s Whistleblower Program: What Employers Need to Know for details.

Publish What You Pay

The first reports by mining and oil and gas companies under ESTMA (Extractive Sector Transparency Measures Act) must be posted online and submitted to Natural Resources Canada by May 30, 2017 (for fiscal years ending December 31). See Deadline to Enrol Under ESTMA and New Publish What You Pay Requirements for details. The SEC’s similar “publish what you pay” rules for resource extraction companies will be effective in 2019. Canadian cross-border companies will be able to file their ESTMA reports with the SEC in satisfaction of the U.S. rules.

Key Canadian Policy Updates from ISS

• Overboarded directors. Directors will be considered overboarded if they sit on more than four public company boards and their attendance record is below 75%. CEOs may only sit on one external public company board, again with a 75% attendance trigger.
• Director compensation. ISS may recommend withhold votes against compensation committee members based on problematic director compensation practices, including excessive inducement grants or performance-based equity awards aligning directors’ interest with management’s.
• Non-audit fees. Tax fees that are not directly related to tax compliance will be grouped with “other fees” for purposes of determining whether non-audit fees are excessive. If tax compliance fees are not separately disclosed, all tax-related fees may be treated as “other.” ISS will recommend a negative vote on ratifying the auditor and electing members of the audit committee if a company’s audit, audit-related and tax compliance/preparation fees, in aggregate, are less than the other fees paid to the auditor.
• Shareholder Rights Plans. ISS’ policy on poison pills now reflects the 105-day minimum deposit period under securities laws.

Key Glass Lewis Canadian Policy Updates

• Overboarding. Directors may receive a negative vote recommendation if they serve on more than five public company boards. For executive officers, a negative vote may be recommended if they serve on more than two public company boards. Note that Glass Lewis does not use an attendance trigger like ISS.
• Say-on-pay. Glass Lewis may recommend voting against members of the compensation committee if they have not addressed shareholders’ concerns following a say-on-pay proposal that failed to receive majority approval.
• Shareholder rights plans. Like ISS, Glass Lewis has updated its poison pill policy to reflect the 105-day minimum deposit period under securities laws.