The CSA code is used as a template at the moment, rather than as an enforcement mechanism. One thing that could be done is more explicit recognition, probably in section 24, that the commissioner may require registration to that standard. It might also be more explicitly stated in subsection 18(2), under which the commissioner is empowered to delegate the powers of audit.
The point is that there's a ready-made enforcement mechanism embodied in the legislation, and I think it could have more explicit recognition in those sections.