The CSA last issued cybersecurity governance and disclosure guidance in 2016 as part of an initiative to increase cybersecurity awareness and resilience among market participants. As we anticipated that year in Davies’ Governance Insights , we believed that managing cybersecurity risks and their potentially significant exposures would continue to be a top priority for many boards. Since then, virtually all Canadian public company boards have adopted formal cybersecurity risk management practices and policies as a key part of their overall risk oversight frameworks. Although Canadian securities regulators have not yet issued updated cybersecurity guidance, we expect cybersecurity to remain at the fore of boards’ risk management priorities in 2024. This view is informed partly by new cybersecurity risk management, strategy, governance and incident disclosure rules adopted by the SEC in 2023, and partly by shareholder expectations. In its 2024 benchmark policy guidelines for Canada, Glass Lewis expanded its cybersecurity voting guidelines adopted just last year to caution that, in instances in which a company has been materially impacted by a cyberattack, Glass Lewis may recommend against appropriate directors should it find the board’s oversight, response or disclosure concerning cybersecurity-related issues to be insufficient or not sufficiently transparent. In light of a number of high-profile cyberattacks that affected Canadian public companies in 2023, it would be prudent for issuers to review and update their existing cybersecurity practices and policies against best practices. 4 | Cybersecurity: A Renewed Governance Frontier climate training of directors. Similarly, in its 2024 benchmark policy guidelines for Canada, Glass Lewis & Co. (Glass Lewis) expanded its climate-related disclosure policy adopted just last year to apply to TSX 60 companies operating in industries that the Sustainability Accounting Standards Board has determined have material exposure to climate risk. While Canadian public companies await the enactment of formal climate- related disclosure rules, investor expectations are likely to drive enhanced climate-related disclosure during this interim period. In June 2023, Canada implemented new mandatory disclosure rules relating to reportable and notifiable transactions and reporting of uncertain tax positions. These rules are very broad, potentially requiring disclosure in respect of many “ordinary course” commercial transactions. In particular, the reportable transaction rules provide for reporting in respect of any transaction that includes one or more steps, one of the main purposes of which was to achieve a tax benefit involving any of the following three purported hallmarks 5 | Transaction Structuring and Mandatory CRA Disclosure Rules
3
A Preview of 2024: 10 Trends That GCs and Boards Need to Know
Powered by FlippingBook