On April 24, 2018, the Canadian Securities Administrators published the Oversight Review Report of the Investment Industry Regulatory Organization of Canada (Report). The Investment Industry Regulatory Organization of Canada (IIROC) is a not-for-profit self-regulatory organization that regulates investment dealers and trading on Canada’s capital markets with a view to protecting investors and maintaining fairness and order in the market.

To assess the risks associated with IIROC’s operations and to ultimately hold IIROC accountable for its internal controls and procedures, the provincial securities regulators conduct an annual risk-based oversight review of a number of IIROC’s processes. The most recent review, covering the period from August 1, 2016 to August 31, 2017 (Review), was conducted by eight of the provincial securities regulators, namely, the British Columbia Securities Commission, the Alberta Securities Commission, the Financial and Consumer Affairs Authority of Saskatchewan, the Manitoba Securities Commission, the Ontario Securities Commission, the Autorité des marchés financiers, the Financial and Consumer Services Commission of New Brunswick, and the Nova Scotia Securities Commission (Participating Regulators).  The Review focused on four areas: (1) Financial and Operations Compliance, (2) Corporate Governance, (3) Risk Management, and (4) Financial Operations.

With respect to IIROC’s Financial and Operations Compliance, the Participating Regulators assessed several key inherent risks considered to be above average risks. Such risks include the risk of inappropriately applied discretion in connection with dealer member firms not being designated in early warning based on their capital, profitability and liquidity position or the failure to impose early warning restrictions and reporting requirements as set out in the IIROC Dealer Member Rules; and the risk of inadequate review and assessment by management of members’ monthly financial reports (MFRs) which could increase the risk of member insolvencies and claims to the Canadian Investor Protection Fund (CIPF). To measure these risks, the Participating Regulators assessed the adequacy of IIROC’s policies and procedures and documentation relating to discretion applied by senior management when imposing early warning designations, restrictions and reporting requirements.  The Participating Regulators also assessed whether management’s MFR review process and documentation are adequate in order to determine whether the risk of member insolvencies and claims to the CIPF is sufficiently managed.  Following the Review, the Participating Regulators found that IIROC had established adequate controls to mitigate the risks identified in this category.

The risks identified in IIROC’s Corporate Governance processes were considered to be low risks, and include the risk of ineffective succession planning processes for IIROC’s board of directors and its committees; inadequate processes and guidelines to ensure that directors possess adequate skills and experience to fulfill IIROC’s mandate; and inadequate procedures to ensure that certain restricted funds collected by IIROC are used as required by the provincial securities regulators. The Participating Regulators measured these risks by assessing the effectiveness of specific processes relating to board and committee succession planning, director skills and self-assessment and the use of certain restricted funds collected by IIROC.

The Participating Regulators identified two action items for IIROC in respect of its Corporate Governance controls.  The first is a medium priority item concerning IIROC’s internal approval process for the use of monies held in a restricted fund. The restricted fund was established for the collection of fines and payments made under settlement agreements and may be used by IIROC for limited purposes, such as the administration of hearings and the education of market participants and the general public.  The Review revealed that written requests to IIROC management regarding the use of the restricted funds were inadequate and lacked certain required information, resulting in a risk that management may make an incorrect decision in respect of the use of the restricted funds.  To address this gap in procedure, IIROC amended its Restricted Fund Policy to require that written requests for funding must specifically describe how a proposed project complies with the rules governing the use of the restricted fund.

The second action item identified is a low priority item concerning a lack of written procedures to monitor IIROC’s compliance with laws of general application in Quebec.  During the course of the Review, it was determined that IIROC had informal procedures in place to ensure compliance with applicable Quebec laws, but no formal processes had been established.  The risk here was that IIROC could incorrectly or inconsistently apply the informal controls it had established, resulting in a failure to comply with applicable Quebec laws.  The Report states that IIROC resolved this issue by recording the informal procedures it had previously adopted.

In respect of IIROC’s Risk Management processes, the Participating Regulators found that the processes related to IIROC’s enterprise risk management (ERM) framework were adequate to mitigate the risks in this area, such as the risk of ineffective ERM controls which could result in IIROC failing to adequately perform its mandate (e.g., risk governance, risk strategy, and risk execution). The risks in this area were considered to be above average.

Finally, the Report states that IIROC has sufficient controls in place to address the moderate risks associated with its Financial Operations, such as the risk of inadequate budgeting methods and inadequate communication and authorizations among financial staff and with the board of directors.

Based on the results of the Review, it appears that on balance, IIROC has adequate controls in place to mitigate the risks associated with its operations.  Action was required to be taken, however, to address the gap in procedure concerning IIROC’s use of restricted funds and its compliance with applicable Quebec laws, which action has been taken by IIROC.  The Participating Regulators expect that IIROC will continue to improve upon its internal processes on an ongoing basis in order to reduce any operational risks that may affect its ability to carry out its mandate.