Canada OSFI/BSIF Assurance Expectations For Federally Regulated Financial Institutions
After the massive overhaul of some of its most critical requirements – Basel Capital Adequacy Reporting (BCAR), Pillar 3, Leverage Requirements Return (LRR), and new credit risk (NCR) – in 2023, the Office of the Superintendent of Financial Institutions/Bureau du surintendant des institutions financières (OSFI/BSIF) has new initiatives for Canada’s federally regulated financial institutions (FRFIs). This October, assurance expectations for senior-management attestation go into effect ahead of the final rule to be issued
November 7, 2024, a month later. The new regulation covers capital returns for federally regulated insurers (FRIs) as well as capital, leverage, and liquidity returns for deposit-taking institutions (DTIs).
In general, assurances in auditing help companies address risks and potential problems affecting the accuracy, impartiality, integrity, and usability of the reporting/information they provide to shareholders, regulators, etc. Specifically, OSFI assurance expectations require company initiatives to be risk- and principles-based; reflect the institution’s size, nature, complexity, and activities; consider OSFI’s reliance on external auditors and the work of others; and contribute to public confidence in the Canadian financial system.
With this Guideline, OSFI sets out expectations for capital, leverage, and liquidity returns and puts both external auditors and institutions on notice regarding the work to be performed on their regulatory returns.
OSFI key regulatory returns for DTIs include BCAR, LRR, LCR, NSFR, NCCF, and OCFS.
OSFI Standardized Controls Impact Institutions On Several Levels
The Guideline standardizes controls over regulatory submissions and expectations across FRFIs with a three-step phased-in approach that includes internal and external audits and senior-management attestation.
- 1. An internal audit opinion provides assurance of proper processes and controls around key regulatory returns.
- 2. Management attestation provides assurance of internal governance around accuracy and completeness.
- 3. An external audit opinion provides independent, third-party assurance of an FRFI’s key regulatory ratios.
For DTIs, key regulatory returns include BCAR, LRR, liquidity coverage ratio (LCR), net stable funding ratio (NSFR), net cumulative cash flow (NCCF), and operating cash flow statement (OCFS).
An OSFI review assesses the effectiveness of the work undertaken by an internal audit and prescribes timely and corrective action for any identified control weaknesses. It then specifies additional reviews by internal and/or external auditors for areas of concern. It may even go as far as requiring executive management to personally endorse the accuracy of their submission, substantially increasing the scope of potential fallout for the institution.
OSFI Assurance Expectation Requirements Functional Drivers
The initiative, which began in October 2023 with internal audit requirements and runs through October 2025, may compel many institutions to enhance or replace their processes and/or systems to comply with the Guideline.
- Internal audit opinions hinge on enhanced visibility into data, including that which enables teams to understand how categorization and calculation attributes are derived and applied as well as the controls surrounding the generation of key regulatory returns.
- Senior management attestation, which goes live October 2024, requires insight into functional roles involved in the process, users/user groups assigned to those roles, and processes – data sourcing, calculation steps, and how these calculations align with regulatory requirements – to attest to the accuracy and completeness of the reporting.
- External audit opinions are based on data and explanations of key regulatory ratios provided by internal respondents who must be able to quickly and efficiently identify and provide the requested data elements as well as prove-out full data lineage from source to report. This requirement goes into effect October 2025.
Technical Challenges For Auditors and Senior Management
Meeting OSFI’s mandate to produce high-quality financial, liquidity, and risk reports with consolidated views over multiple time dimensions necessitates significant automation and enhancement to institutions’ data management and technology infrastructures. FRFIs must ensure that auditors and senior management easily understand the methodologies their regulatory reporting teams use to arrive at reported figures and can verify that those methodologies are accurately applied.
With their institutions’ reputations on the line, senior management must also guarantee that:
- Aggregations or calculations are timely and efficiently performed, and quickly repeatable if adjustments are necessary.
- Regulatory updates are seamlessly incorporated into calculation and reporting processes.
- Supporting infrastructure scales to meet these requirements.
These objectives are achievable with a combination of systematic documentation, annotation, variance reporting, drill-down capabilities, intuitive visual interfaces, automation, and a well-defined permissions system.
Single-Platform Solution For Liquidity and Capital Requirements
Proper controls must be in place to ensure not only accurate automated outputs, but also an auditable process that tracks the lineage of any adjustments from source data to top-side report figures. However, such a compliance effort can easily overwhelm existing legacy systems and related human- and capital-intensive processes. With November only a few months away, FRFIs and specifically DTIs are running out of time to enhance their processes with a solution that provides insight into key regulatory returns the OSFI Guideline requires; end-to-end automation of the reporting process, from data loading to report generation and notification of the required parties; and transparency into constituent parts as well as the impact of changes in calculations for quick comparison against the original.
Such a solution would also be flexible enough to include a:
- Common liquidity data dictionary that streamlines LCR, NSFR, and NCCF calculations; classifies and weights individual exposures; and facilitates data adjustments.
- Capital risk-calculation engine that optimizes risk-weighted assets (RWA) and provides visibility into the risk weighting and mitigation for every exposure as they drive reporting for BCAR, Pillar 3, LRR, and NCR. A common data dictionary would also help here.
OSFI assurance expectations can be achieved with a combination of systematic documentation, variance reporting, drill-down capabilities, automation, and well-defined permissioning.
