OSC | News & Events - Speeches & Events - 2006 - "A Work in Progress: Lessons in Risk-based Supervision from the Canadian Marketplace" - Brazilian Securities Commission (CVM) International Seminar

Remarks by Susan Wolburgh Jenah
Vice-Chair, Ontario Securities Commission


"A Work in Progress: Lessons in Risk-based Supervision from
the Canadian Marketplace"


Brazilian Securities Commission (CVM) International Seminar
Rio de Janeiro, Brazil


September 5, 2006

 

Our governing legislation sets out a number of principles which we have regard to and balance in pursuing our mandate under the Act. One of these principles underscores the need for a risk-based approach to regulation and directs us to ensure that business and regulatory costs and other restrictions on market participants should be proportionate to the significance of the regulatory objectives sought to be achieved.

Another governing principle directs us to rely on the enforcement capability and regulatory expertise of recognized self-regulatory organizations (SROs) subject to an appropriate system of supervision. We have a few recognized SROs in Canada who we rely on to perform front-line regulatory functions with regard to the markets or intermediaries they are responsible for. Recognized SROs must file their proposed rules, policies and by-laws with us for review. We have adopted a rigorous oversight program through which we continually monitor the activities and outputs of the SROs to ensure that our trust and reliance continues to be appropriate.

In recent years, some jurisdictions that historically relied heavily on SROs - notably the U.K. - retreated from this model entirely. Other jurisdictions - like Canada - continue to have a robust, albeit evolving, SRO system. We devote significant effort both at the CSA level and in collaboration with our self-regulatory partners in articulating our expectations and appropriate performance benchmarks through detailed terms of recognition, MOUs and extensive oversight review programs which are conducted on a regular basis.

To quote the words of former SEC Chairman William Douglas: "By and large governments can operate satisfactorily only by proscription. That leaves untouched large areas of conduct and activity: some of it susceptible of government regulation but in fact too minute for satisfactory control: some of it lying beyond the periphery of the laws in the realm of ethics and morality. Into these large areas self-government, and self-government alone, can effectively reach."

You might well wonder why I'm focusing on SROs in speaking about risk-based regulation. I believe that there is a connection. Reliance on SROs to conduct front line regulation, subject to well established expectations and robust independent oversight, is an example of a risk-based approach to regulation. The regulator effectively forbears from regulation in those fields best occupied and those issues best addressed at the SRO level. The risk of conflicts of interest getting in the way of strong and effective self-regulatory action is mitigated and subject to the checks and balances of strong governance at the SRO board level and oversight by the recognizing regulator. This, in turn, frees the oversight regulator to focus its limited resources on broader, strategic issues and challenges.

The job of regulating complex, dynamic and fast-changing markets is a tall order. To do an effective job, regulators around the world are embracing or thinking about embracing some form of risk-based regulation of necessity.

I.         Setting Priorities

Regulators are increasingly challenged to establish priorities and develop and implement strategies to see that they are achieved.

Under our legislation, the OSC is required to publish our statement of priorities annually for comment and deliver the finalized statement to our Minister. As part of this exercise, we voluntarily publish our performance against the previous year's priorities.

The process of establishing organizational priorities is, in effect, an exercise in attempting to define the most important risks we face.

For the 2006-2007 fiscal year, we established five organizational goals.

They are:

1) To provide fair, vigorous and timely enforcement;

2) To better understand and address the needs of the retail investor;

3) To promote a harmonized, simplified and strengthened securities regulatory framework in Canada;

4) To achieve regulatory integration or convergence with North American and global capital markets, as appropriate; and

5) To support and promote a flexible, efficient and accountable organization.

Let me elaborate a bit with an example relating to priority number two - e.g. addressing the needs of the retail investor. The level of retail investor participation in our markets, directly and indirectly, through collective investment vehicles such as mutual funds, has been on the increase over the past two decades.

This dynamic leads to a growing need for objective and impartial investor education and a desire on our part to benefit from the retail investor perspective on what we do. We have responded to this in several ways.

Several years ago, we established the Investor Education Fund which has been funded from the proceeds of enforcement actions and OSC settlements. The Fund operates independently from the OSC but is subject to our oversight. It operates a website which offers, in plain language, basic unbiased information on a variety of subjects - from basic principles of investing, to how to file a complaint, to how to choose and work with a financial advisor - and provides investor alerts about investment scams and frauds.

Last year, we hosted a Town Hall initiative involving the heads of the OSC, the SROs and Ombudsman for Banking and Securities. This event drew a crowd of 400, mostly retail investors.

Since the Town Hall, we have created an Investor Advisory Committee with broad representation, chaired by a University of Toronto Professor, to provide the Commission with an investor perspective on the issues and concerns they face.

II.         Applying a Risk-based Approach to our Basic Statutory Functions and Responsibilities

We all face the challenge of applying limited resources to achieve the maximum impact. Our success depends on how efficiently we allocate our resources. Put simply: how much risk can we mitigate with the resources available?

A risk-based approach demands that we target those activities and market participants where problems are more likely to arise. Turning the goal into a reality means that we have to try and determine which issues, intermediaries or market conduct merit regulatory scrutiny.

At the OSC, our first experiment with this approach was about 15 years ago when we shifted away from our historic practice of reviewing all prospectuses filed with us. Instead, we adopted a selective review approach based on the formulation of criteria that would assist us in making smart choices about which disclosure documents we reviewed.

Subsequently, we expanded this approach into other areas of our operations - e.g. continuous disclosure reviews and compliance reviews (both desk and field) of registrants and enforcement.

Over the ensuing years, we have revised and refined our model.

1) Compliance Reviews

We conduct detailed on-site reviews of advisers, fund managers and those dealers subject to our direct oversight. Most dealers are members of the Mutual Fund Dealers Association and/or the Investment Dealers Association - and are subject to on-site reviews by SRO staff.

We now risk-rank registrants based on the nature of their business and the range and type of activities conducted. We use these risk-rankings to help us determine which participants and which activities we should focus on and how often. The risk-ranking is a numeric proxy for four types of risk which we attempt to define and measure:

• inherent risk;
• external risk;
• internal risk; and
• risk controls.

This exercise is an art - not a science. Risk-rankings are nothing more than an attempt to more objectively quantify risk. It is not a substitute for the exercise of judgement and reliance on instinct and experience.

All of this measuring and weighing is only a means to an end, not an end in itself. The purpose is simply to help us keep focused on identifying and fixing important problems.

2) Enforcement Case Selection

In the enforcement area, many matters that are investigated never go beyond the investigation stage. A thorough investigation can be a time consuming and resource intensive exercise. In selecting the cases that should be pursued either to a settlement agreement or a contested hearing before our administrative tribunal or the courts, we focus on:

• the most serious offences - those that are likely to have the greatest negative impact on the integrity of our markets;
• those that involve a significant number of investors and/or significant investor losses;
• those where there is a reasonable likelihood of success;
• whether the activity is still ongoing and whether investors' assets are still at risk; and
• the deterrent impact, both specific and general, of enforcement action.

We encourage market participants - whether issuers or registrants - who uncover wrongdoing to self investigate, report and address the problems they've identified. In appropriate cases, this can lead to less severe allegations and terms of settlement or even no allegations being issued.

Conversely, in deciding not to pursue a case, the following factors may be relevant: the conduct, while illegal, did not cause harm, the conduct involved may fairly be characterized as a technical breach, whether a disproportionate commitment of resources would be required to address the issue, whether there are alternative and more appropriate remedies available to address the issue and/or another enforcement authority has primary jurisdiction over the matter.

In the enforcement area, identifying the priority areas of focus - which may well vary from time to time - (e.g., insider trading, tipping, market manipulation, misleading, inaccurate or fraudulent financial results) and establishing objective criteria to identify that conduct which poses the greatest risk and potential harm, helps to bring focus, objectivity and discipline to a very complex and important process. Most importantly, such an approach helps to ensure that enforcement-related decisions are not made on an arbitrary or ad hoc basis but, rather, against a well-considered framework and a consistent set of criteria. This reinforces the message that effective enforcement is critical to the achievement of our institutional mandate and must be integrated within the Commission's overall strategic objectives and priorities.

3) Prospectus Reviews

The way we conduct prospectus reviews has changed significantly over the years. Staff screen all prospectuses filed with us against a set of criteria to identify those offering documents which should be subjected to a full review.

When we do review a prospectus, our goal is not to prevent risky investments from coming to market. Rather, it is to ensure that the disclosure is full, true and plain particularly in relation to fees, related party transactions and conflict of interest issues. We also focus on structural unfairness and any public interest concerns that are otherwise apparent.

We do not do due diligence on particular products or offerings and we retain a statutory public interest discretion to refuse to receipt a prospectus in appropriate circumstances.

4) Continuous Disclosure Reviews

Adopting a selective, risk-based approach to the review of prospectuses has allowed us to focus more resources on reviewing issuers' continuous disclosure. This is, after all, the disclosure base upon which approximately 95 % of market trading occurs. And, unlike the extensive prospectus due diligence of the issuer and its many advisers, continuous disclosure does not attract anywhere near this level of due diligence.

Our stated target is to review each of our reporting issues which are Ontario-based once every 4 years on average. In practice, reviews have in fact been conducted on a more frequent basis.

A key decision we faced was whether to publish our risk-based criteria as they relate to the regulatory functions discussed above. Bearing in mind the considerations that might favour keeping the criteria confidential, we decided in favour of publication. Our governing legislation underscores the need for transparency in the administration and enforcement of the Act and we believed, on balance, that more benefits would be gained than lost by making our views known. We haven't had any reason to doubt or regret that decision.

III.         When and How Should Regulators Intervene to Impose Regulatory Solutions to Market Problems ?

Not every marketplace problem requires or demands a regulatory solution. Some problems are better left to natural market discipline. Sometimes, a combination of private and regulatory response will be appropriate.

In Canada, we have a strong tradition of protection of minority shareholders interest. Many of these protections - such as dissent and appraisal rights, oppression remedies and derivative rights of action - are enshrined in corporate law. But given the high percentage of Canadian public companies which are closely-held , whether family owned or majority shareholder controlled, we introduced a policy statement, now adopted as a rule in Ontario and Québec, which is specifically aimed at the protection of minority shareholders. It provides for enhanced disclosure, independent valuations, scrutiny by a special committee of independent directors and a majority of the minority approval requirements where certain types of transactions, including those involving a related party to the issuer, are undertaken.

Regulators face the challenge of choosing wisely when it comes to intervening with regulatory responses to problems. There is often tremendous pressure, both political and practical, to "be seen to be doing something." Sometimes the hardest thing to do is to resist the pressure for an immediate response in favour of a more measured, deliberative and consultative approach. But this may also be the right thing to do.

An important first step in designing effective regulatory strategy is to spend the time up-front to properly understand the problem or issue to be addressed, identify the alternatives available to address the issue and understand the implications of proceeding down one path over the other.

Balancing the costs and benefits of regulation is very important. Although many regulators are required to conduct a cost-benefit analysis before adopting new regulation, we have found it to be a challenge to meaningfully integrate the necessary cost benefit analysis into the decision-making process instead of allowing it to become a justification for a pre-determined policy approach or outcome.

When a regulatory solution is necessary, it is important to strike the right balance. Easier said than done, of course.

Regulatory intervention is appropriate where necessary to protect investors and to foster fair and efficient capital markets, but it should be no more than what is necessary. After all, it is the investor that ultimately bears the cost of unnecessary, burdensome and overly intrusive regulatory requirements.

In trying to strike the right balance to achieve a regulatory objective without stifling competition, innovation and imposing unnecessary costs on business, we rely on the following strategies:

• cost-benefit analysis;
• disclosure-based solutions;
• market-based solutions (to the extent possible);
• extensive consultation; and
• principle-based regulation.

A good example of a blended disclosure, market and principle-based regulatory approach was the response to the famous Dey Committee Report issued in Canada in 1993. The Report, similar to the Cadbury Report in the U.K., established certain good governance principles and guidelines which were initially adopted as stock exchange listing standards. Current regulatory requirements and guidelines were built on and evolved from these initial listing standards to create our "comply or explain" regime. The practices identified are not mandatory - one size does not fit all - but disclosure against the guidelines is mandatory and carefully monitored by the marketplace.

Principle-based solutions are always the best starting point. They may not alone be enough. The extent to which we need to go further in imposing more prescriptive regulatory requirements varies according to the problem, the surrounding facts and circumstances and the desired goal.

Not every problem requires a rule-based solution. We do have other tools available to us to drive changes in behaviour:

• education of market participants through communications;
• compliance reviews and follow-up reports to industry;
• policy statements which set out our views on various matters and afford guidance as to how we would be likely to apply our discretion in interpreting and administering the legislation; and finally
• enforcement action when appropriate.

A debate has been playing out in Canada over the past few years as to the relative merits of a principle-based approach to regulation v. a rules-based approach. Certainly, there are dangers which can result from an excessive reliance on rules in an effort to influence personal or organizational behaviour. An overly rules-based culture can encourage a loophole mentality when it comes to compliance. Other regulatory tools can be just as effective in the right circumstances. But the debate is often cast as a choice between two extremes. In fact, the goal should be to strike the right balance between principle-based and prescriptive regulation.

CONCLUSION

In conclusion, I see risk-based regulation as code for smarter regulation.

We need to constantly be looking for ways to leverage our limited resources, financial and human, to deliver the greatest bang for the regulatory buck.

To do this effectively requires balance and focus: pick the important problems and fix them.

Lastly, risk-based regulation is a means to an end - not a destination in itself.

Thank you.