Skip Ribbon Commands
Skip to main content

ERCB Directive 76: SOX for the Measurement World

03/02/2011


Operators in Alberta are required to submit a formal declaration regarding the operating effectiveness of their controls over ERCB measurement and reporting requirements. The purpose of this declaration is to reduce the ERCB’s reliance on substantive audits and to instead, rely on the effectiveness of operators’ controls.

Who Is Required to Comply

This directive applies to all operators subject to ERCB measurement and reporting requirements and reporting to the Petroleum Registry of Alberta (PRA) and applies to conventional oil, heavy oil, crude bitumen and natural gas facilities. Mineable oil sands are not required to comply with this directive.

Requirements
  • Senior executives with provincial authority for field operations and production accounting will be required to annually declare their compliance with measurement and reporting requirements. The declaration is an attestation and must include the following:
    • The existence or absence of controls;
    • The extent to which controls have been evaluated; and,
    • The degree to which controls have been found to be effective.
  • Operators must determine a declaration period prior to the first declaration submission to the ERCB and submit within one month after the end of the declaration period. The declaration period does not have to align with the operator’s fiscal year end or calendar year end.
  • It is the operator’s responsibility to implement controls that allow them to either prevent or detect, in a timely manner, noncompliance with these ERCB measurement and reporting requirements.
  • Operators must maintain sufficient documentation to support their evaluation of the design and operating effectiveness of their controls over measurement and reporting requirements. This is not required to be included in the annual declaration but must be made available upon request.

Learning From the Past

The process to comply with Directive 76 virtually mirrors Section 404 of the Sarbanes-Oxley Act (“SOX 404”) or Canada’s National Instruments 52-109; however, the focus is on internal controls over measurement and reporting rather than on financial reporting.

Many of us may remember the early days of SOX 404 when companies in effect documented all of their business processes and tested all of their controls. This resulted in companies wasting valuable time and financial resources to achieve compliance. Operators should embrace the lessons learned from the past and implement a “pure” top-down, risk-based approach that will meet the compliance requirements in a practical and cost-effective manner.

Steps to Achieve Compliance

We recommend that operators adopt a top-down, risk-based approach to achieve sustained compliance as outlined below:

Step 1: Scope and Plan Evaluation

  • Understand EPAP requirements and evaluate the control environment.
  • Identify all operated facilities.
  • Identify high risk facilities by ranking them based on risk and impact considering qualitative and quantitative factors.

Step 2: Document Processes and Controls

  • Understand and document applicable operational, production accounting and engineering business processes and related internal control activities. Documentation should include background relating to the business process, associated risks of non-compliance, process owners, process description and control descriptions.

Step 3: Evaluate Risks and Controls

  • Identify high risks of non-compliance applicable for each high risk facility.
  • Map existing controls at the company, operating area and facility level to risks and evaluate the design of these controls by assessing how well the controls mitigate risk of non-compliance. Where feasible, redesign existing controls or implement new controls to mitigate significant risks that have not been addressed adequately.
  • Identify key controls addressing high risks of non-compliance.

Step 4: Test Key Controls

  • Test key controls to ensure they are appropriately designed and are operating effectively.

Step 5: Report Results

  • Report control design gaps and testing exceptions by declaring:
    • Number of facilities;
    • Number of controls; and,
    • Number of deficiencies.
  • Provide effective Measurement and Reporting solutions to address design gaps and required remediation actions.

Take Action

Complying with Directive 76 can be a complex and overwhelming process. Companies that act now will be in a better position to provide their declarations with comfort and avoid the repercussions of failing to comply.

At MNP, our internal control specialists have teamed with measurement specialist to help operators through each step of the compliance process.

For more information on how to successfully implement Directive 76, please contact Gordon Chan, CA, Enterprise Risk Services National Lead or any member of the Enterprise Risk Services team.