Sweeping Securities Law Reform Will Affect Issuers, Officers and Directors
This article also was published by The Legal Intelligencer and The New Jersey Law Journal.
On July 30, 2002, President Bush signed into law the most sweeping piece of securities legislation since the original securities laws were adopted. The new law, the Sarbanes-Oxley Act of 2002, passed both houses of Congress with overwhelming support, all in response to a series of major corporate scandals.
The Act amends and supplements the existing securities statutes, the federal criminal code and other statutes dealing with a wide array of topics. Much of what it does still needs interpretation by the courts and regulators before it can be fully understood. Much of what it covers must be implemented by rules to be issued at various intervals over the next year by the Securities and Exchange Commission. This client alert summarizes the key provisions of the Act, with a particular focus on the provisions that will most directly impact and require early attention by public companies and their officers and directors.
A. The New Certification Requirements for CEOs and CFOs
The Section 906 Certification and Its Criminal Penalties. This requirement of the Act affects corporate officers immediately. Section 906 of the Act requires that all periodic financial reports must be accompanied by a certification signed by the company’s Chief Executive Officer and Chief Financial Officer (or equivalent). The CEO and CFO must certify (i) that the report "fully complies" with Section 13(a) or 15(d) of the Securities Exchange Act of 1934 and (ii) that the information contained in the report "fairly presents, in all material respects, the financial condition and results of operations" of the company. This certification applies to all public companies and is different from the much-publicized look-back certification, attesting to prior filings, that the largest 947 public companies must file under a June 28, 2002 SEC investigative order.
Section 906 contains criminal penalties for violations. If the corporate officer provides the certification while knowing that the periodic report does not comply with Section 906, the officer risks a fine up to $1 million and up to 10 years imprisonment. The sanction increases to a fine of up to $5 million and up to 20 years imprisonment if the officer willfully files a certification that the officer knows does not comply.
The Additional Section 302 Certification. Section 302 requires the SEC by August 29, 2002, to issue rules requiring CEOs and CFOs to make an additional and separate certification, not subject to particular criminal sanctions, in annual and quarterly reports. The Section 302 certification is: (i) that the officer has reviewed the report; (ii) that, based on the officer’s knowledge, the report is materially correct and complete; (iii) that the financial statements and other financial information "fairly present in all material respects the financial condition and results of operations" of the issuer. (The Section 302 certification somewhat overlaps the Section 906 certification, and for this reason, the SEC may determine to include in its new rules a certification form that will cover both provisions.)
In addition to these substantive certifications, Section 302 requires the officer to make the following procedural certifications: (i) that the CEO and CFO are responsible for establishing and maintaining internal controls; (ii) that they have appropriately designed the internal controls to flush out material information; (iii) that they have evaluated the effectiveness of the internal controls within the last 90 days; (iv) that they have stated their conclusions about the effectiveness of the internal controls in the periodic report; (v) that they have disclosed to their auditors and audit committee all significant deficiencies in their internal controls; (vi) that they have disclosed to their auditors and audit committee "any fraud, whether or not material, that involves management or other employees who have a significant role" in internal controls; and (vii) whether there were changes in internal controls or other factors that could significantly affect internal controls following the date of their evaluation.
Dealing With Both Certification Requirements. The best guidance contained in the Act on how a CEO or CFO can assure compliance with both certification requirements, and avoid a criminal sanction under Section 906, can be found in the procedural certifications under Section 302. Based on its approach in other contexts, the SEC will typically want to see that an issuer has maintained appropriate books and records to accurately reflect its activities, and whether the issuer had in place adequate systems of internal controls, such that the CEO and CFO could reasonably rely on what they were reading and hearing from subordinates. Such record-keeping and control systems have long been required by statute. Compliance with the steps outlined in Section 302’s procedural certification will go a long way in assuring that the right internal controls are in place.
CEOs and CFOs should take action well before the date for their certifications to evaluate their record-keeping and systems of internal controls, and to begin asking questions of their management team concerning any possible issues that, with the benefit of hindsight, the SEC may later think they should have known. In addition, CEOs and CFOs may want to obtain certifications from those who report to them, upon which the CEO and CFO can rely in part making their own certifications to the SEC. Finally, it would be prudent to document extensively the steps the CEO and CFO took as a basis for making their certifications.
The SEC also will likely be interested in whether there were any "red flags" that should have made the CEO and CFO ask questions (and possibly do a more formal investigation assisted by outside counsel) before making the certification. If "red flags" do appear upon preliminary inquiry, the best answer may be a "swat team" approach. The issuer should engage counsel, who would then retain forensic accountants or professionals with other necessary competencies, to conduct an in-depth probe of the area causing concern. Having counsel conduct the investigation and retain other professionals may allow the issuer the option to assert privilege to protect the investigative process from public view. The mission would be to assemble quickly the evidence the executive would need to be sure the certification is correct.
B. New Provisions Directly Impacting Officers and Directors
Relaxed Standards for Officer and Director Bars. In 1990, Congress added to the SEC’s arsenal of remedies the power to ask federal courts handling SEC civil litigation to issue orders barring individuals from future service as officers and directors. However, Congress imposed two important limitations on the SEC’s power in seeking this remedy. First, the SEC would have to prove that the individual’s conduct demonstrated "substantial unfitness" to serve as an officer or director. Second, the SEC would have to go to federal court to seek this relief; it could not order officer and director bars in its own administrative proceedings.
The Act significantly cuts back on both of these checks. First, Section 305 reduces the SEC’s burden by lowering the standard from "substantial unfitness" to "unfitness." This lower standard also releases the SEC from existing judicial restraint on its ability to obtain such bars. Second, Section 1105 lets the SEC obtain such bars without going to court. Instead, the SEC itself will now be able to issue officer and director bars in its own administrative proceedings. As with bars obtained in court, the SEC can administratively issue such bars simply on the lowered showing of unfitness.
Refunding Bonuses and Stock Profits Following Restatements. Section 304 provides that where an issuer restates previously issued financial results "as a result of misconduct," the CEO and the CFO must reimburse the issuer for "any bonus or other incentive-based or equity-based compensation" they received during the 12 months following the filing giving rise to the restatement. Additionally, the CEO and the CFO must reimburse the issuer for "any profits realized from the sale of securities of the issuer during the same 12-month period." If the restatement covers several years of previously issued financial statements, the SEC would likely take the position that the executive must refund such compensation and profits received over several years. However, the provision gives the SEC power to exempt individuals from this requirement, and it may be that such exemptions will be available to settle cases, particularly where the executive has chosen to fully cooperate with the SEC under its "Seaboard" cooperation doctrine announced last year. (For more details on the Seaboard doctrine, see the article by Stephen J. Crimmins, "SEC’s New Cooperation Policy May Create Opportunities for Counsel and Issuers," Securities Regulation and Law Report (BNA), Vol. 33, No. 43, Nov. 5, 2001)
Freezing Extraordinary Compensation. Section 1103 lets the SEC freeze "extraordinary payments (whether compensation or otherwise)" to an issuer’s directors, officers, partners, controlling persons, agents or employees, from the issuer during an SEC investigation of the issuer or any of these categories of individuals. To impose the freeze, the SEC must apply to federal district court, and the freeze will last for 45 days, subject to a possible extension for another 45 days. If the SEC files litigation during the freeze period, then the freeze can continue for the duration of the litigation. The money is to be held in escrow in an interest-bearing account.
Accelerated Filing Date for Section 16 Reports. Section 403 significantly shortens the time for directors, executive officers and 10 percent shareholders of public companies to file reports of acquisitions or dispositions of company securities under Securities Exchange Act §16 and related rules. Beginning August 29, 2002, the reports must be filed no later than the second business day following a transaction. The old time period was the 10 th day of the month following the date of the transaction. Beginning July 30, 2003, such reports will have to be filed electronically and be made available on the issuer’s Web site.
Issuers currently without a pre-clearance policy for all trading activity by directors and executive officers should consider implementing such a policy now. By requiring directors and executive officers to pre-clear purchases or sales (or other acquisitions or dispositions) with an in-house counsel or compliance officer, issuers can better avoid inadvertent violations, and also prepare Section 16 reports for review, signature and filing within the new two-day deadline. Insiders also can facilitate the timely filing by granting a power of attorney to a legal or compliance officer. The combination of a pre-clearance policy on insider trades and a Section 16 power of attorney will streamline the Section 16 process.
Prohibition on Personal Loans to Insiders. Section 402 prohibits personal loans to directors and executive officers. The section grandfathers loans existing on July 30, 2002, provided that there is no renewal, extension or material modification of the loan. Narrow exceptions to the prohibition permit issuers that are in the business of extending consumer credit to provide loans to their executive officers and directors on terms no more favorable than those offered to the general public, as long as the loan is not used to buy stock of the issuer.
Prohibition of Insider Trading During Pension Fund Blackout Periods. Under Section 306 of the Act, from and after January 26, 2003, directors and executive officers will be prohibited from buying or selling, during any pension fund "blackout periods," equity securities acquired in connection with his or her service as a director or officer. Such blackout periods are typically imposed on plan participants only on those infrequent occasions when there is a change in plan administrators.
Code of Ethics for Senior Financial Officers. Section 406 of the Act requires the SEC to adopt rules by January 26, 2003 requiring each issuer to disclose in periodic reports whether it has adopted a code of ethics for senior financial officers, including the chief financial officer and the comptroller or principal accounting officer, or persons performing similar functions. A code of ethics would include standards to promote honest and ethical conduct, including the ethical handling of conflicts of interest between personal and professional relationships; accurate, timely and understandable disclosures in the issuer’s periodic reports; and compliance with laws and regulations. Issuers should report on Form 8-K or other electronic means (as determined by the SEC) any changes to its code of ethics, or any waiver of the code of ethics for senior financial officers.
Re-evaluation of "Executive Officers." The Act places a number of restrictions on directors and executive officers of public companies, including accelerated filing of Section 16 reports, prohibition against personal loans and mandated black-out periods. SEC rules define executive officers as the president, any vice president in charge of a principal business unit, division or function (such as sales, administration or finance) and any other officer who performs a policy-making function for the issuer. In addition, executive officers of subsidiaries may constitute executive officers of the parent if they perform a policy-making function for the parent. Because potential adverse consequences of a failure to properly identify a management member as an executive officer have increased under the Act, public companies should re-evaluate who should be designated as the company’s executive officers. Companies with senior management not identified as executive officers will have to take a hard look to be sure their determinations are appropriate.
A Bigger and More Active SEC. The Act dramatically increased the SEC’s funding, raising its budget by about $300 million to $776 million for the next fiscal year. The increase will fund pay raises for existing staff, add at least 200 more professional staff, and fund information technology and security enhancements. The practical consequence for issuers and their executives is that the agency will be bringing more and bigger enforcement cases. Even where issuers do not have a problem, they can expect to have to respond to more frequent staff inquiries.
C. Private Securities Litigation
Longer Statute of Limitations. Only a few years after enacting legislation designed to cut back on securities class actions against issuers and their officers and directors, Congress has decided to move the ball in the other direction. Section 804 roughly doubles the statute of limitations for filing class actions charging securities fraud to the earlier of two years from discovery or five years from violation. Previously, such actions had to be filed by the earlier of one year from discovery or three years from violation. The new statute of limitations applies to all proceedings "commenced on or after the date of enactment" of the Act.
Elimination of Bankruptcy Discharge. Section 803 eliminates the possibility of a bankruptcy discharge for amounts awarded in court orders or judgments, administrative orders or settlements, in cases involving violation of federal or state securities laws or regulations, or common law fraud, deceit or manipulation in connection with securities transactions. The provision applies to amounts awarded as damages, disgorgement, restitution, penalties and other types of recoveries. The elimination of the bankruptcy discharge is applicable to both private securities litigation and to the SEC’s civil enforcement litigation.
D. Encouraging Informant Activity
Whistleblowers. Section 806 allows a whistleblower to file a complaint with the Secretary of Labor if the person was discharged, demoted, suspended, threatened, harassed or otherwise discriminated against, on account of providing information, testimony or other materials to government investigators or corporate superiors. Recovery may include reinstatement, back pay with interest and special damages. Section 1107 provides for a new crime punishable by up to 10 years in jail and a fine for anyone who retaliates against any informant by taking any action harmful to any person for "providing to a law enforcement officer any truthful information" "relating to" violations or "possible" violations of any federal law.
Attorney Reporting Requirements. Section 307 instructs the SEC to amend its professional conduct rules to require attorneys to report "evidence" of material securities law violations or a "breach of fiduciary duty or similar violation" by the issuer or its agents. The attorney must report this "evidence" to the chief legal officer or to the CEO. If no appropriate remedial measures or sanctions are taken, the attorney must report such evidence to the audit committee or board.
E. New Criminal Laws and Enhanced Criminal Penalties
New Securities Fraud Crime. The Act contains several new substantive criminal laws. In addition to criminal penalties for violations of Section 906, Section 807 provides for a new offense of securities fraud, which prohibits knowingly executing or attempting to execute a scheme or artifice to defraud investors in publicly traded companies. There is a statutory maximum penalty of up to 25 years in jail and a fine. The new investor fraud provision is modeled on the existing provisions of the venerable mail and wire fraud statutes (18 U.S.C. §§1341 and 1343), which already prohibit the execution of schemes to defraud through use of the mails or through interstate transmissions and are regularly charged in securities fraud cases.
The 25-year statutory maximum jail penalty provides a potentially severe sentence for any single violation of the statute, but the actual sentence to be imposed by a sentencing court for violation will still be largely determined by the U.S. Sentencing Guidelines, which have not been changed by the new law. In other words, the new investor fraud statute by itself appears likely to do little to encourage additional federal prosecutions of shareholder or investor fraud, or ultimately to further deter those who would commit such crimes in the first instance.
New Obstruction Crimes. The new law provides for new crimes in connection with conduct that was traditionally reached under the federal obstruction of justice statutes. Sections 802 and 1102 each contain separate provisions with criminal penalties prohibiting the alteration or destruction of records or objects. Section 802 prohibits the knowing alteration, destruction, mutilation or making of a false entry "with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction" of the United States or in bankruptcy cases. Section 1102 also prohibits corruptly altering, destroying or mutilating a record or other object with the intent to impair its integrity or availability for use in an official proceeding, or otherwise obstructing, or attempting to obstruct, any official proceeding. Violation of either of these obstruction statutes brings a sentence of up to 20 years in jail and a fine.
New Accountant Work Papers Crime. Section 802 makes it a crime punishable by up to 10 years in jail and a fine for any accountant to knowingly and willfully fail to maintain all audit or review work papers for five years, and for any person, including a company employee, to violate any rules to be issued by the SEC concerning records retention for audit related documents.
Enhanced Penalty Provisions. In addition to adding new substantive criminal laws, the Act also increases the maximum penalties and fines for certain existing crimes. The Act increases the maximum sentences for mail and wire fraud from 5 years to 20 years in jail, and also increases the maximum sentence for violation of Section 32 of the Securities Exchange Act of 1934 from 10 to 20 years in jail. Maximum sentences for criminal violations of ERISA are increased from one year to 10 years. Finally, the general federal conspiracy statute, which formerly provided for a five-year maximum prison sentence, has been amended to provide that the maximum sentence for its violation shall be the maximum sentence provided under the statute which the conspirators agreed to violate.
Sentencing Guidelines. Sections 805, 905 and 1104 of the Act direct the U.S. Sentencing Commission, within six months, to review the U.S. Sentencing Guidelines principally with respect to white collar crimes, securities laws, obstruction offenses and in connection with the punishment of organizations convicted of crimes. The Act gives the Sentencing Commission authority to amend the Guidelines to implement the Act. We will have to wait to see if the Sentencing Commission decides to substantially increase the sentencing ranges applicable to white collar crimes and to conduct criminalized by the Act to determine whether the Act will have much impact on deterring such crime or in encouraging additional and more vigorous prosecutions of corporate misconduct.
F. Enhanced Financial Disclosures
Correcting Audit Adjustments. Section 401 requires periodic reports containing financial statements to reflect all material correcting adjustments that have been identified by the issuer’s accountants in accordance with GAAP and SEC rules and regulations.
Reconciliation of Pro Forma Financial Information. Also under Section 401, the SEC will issue rules requiring that all pro forma financial information included in any periodic report be correct, complete and reconciled with the issuer’s financial condition and results of operations under GAAP.
Disclosure of Material Off-Balance Sheet Transactions. Section 401 requires the SEC to issue rules requiring that annual and quarterly reports disclose all material off-balance sheet transactions, arrangements and obligations, as well as all relationships of the issuer with unconsolidated entities or other persons, that may have a material current or future effect on financial condition, changes in financial condition, results of operations, liquidity, capital expenditures, capital resources, or significant components of revenues or expenses. Companies engaging in off-balance sheet transactions will have to pay closer attention to how those transactions will appear to investors.
Management Assessment of Internal Controls. Under Section 404, the SEC will issue rules requiring each annual report to include an internal control report, stating the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. The annual report also will need to contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. The issuer’s independent auditors will be required to attest to and report on the assessment made in the issuer’s internal control report.
Enhanced Review of Periodic Reports. Under Section 408, the SEC is required to review a public company’s periodic reports no less frequently than once every three years. Historically, the SEC has not been subject to any external requirement to review public companies’ periodic reports. While the SEC has previously announced that it would increase the frequency of its review of periodic reports and such reviews have become more common given the decline in public offerings since the late 1990s, it would have been uncommon for an issuer to have received a full SEC review of periodic reports every three years before enactment of the Act.
Real-Time Issuer Disclosures. Section 409 of the Act permits the SEC to prescribe rules requiring each public company to disclose to the public, in plain English and on a "rapid and current basis," information concerning material changes in the financial condition or operations of the company. The Act specifies, by way of example, that the type of information which could be required to be disclosed may include trend and qualitative information and graphic presentations. The thrust of Section 409 is to cause the SEC to mandate more frequent and timely disclosures by public companies of material developments, a theme consistent with rule changes the SEC proposed earlier this year.
G. Role of Audit Committees
Auditors Reporting to Audit Committee. Section 204 imposes new reporting obligations on a company’s independent public accountants. Specifically, the Act requires accountants to timely report to a company’s audit committee regarding the following accounting issues: (i) all critical accounting policies to be used; (ii) all alternative treatments of financial information within GAAP that have been discussed with management, ramifications for the use of such alternative disclosures and treatments and the treatment preferred by the accounting firm; and (iii) other material written communications between the auditor and management, including any management letter or schedule of unadjusted differences.
New Standards for Audit Committees. Section 301 of the Act requires the SEC to adopt rules directing the national securities exchanges and national securities associations to impose the following additional listing standards by April 26, 2003: (i) each public company will be required to maintain an audit committee composed solely of "independent" directors; (ii) audit committees will be directly responsible for the appointment, compensation and oversight of auditors, and public accountants will be required to report directly to the audit committee, as opposed to the full board; (iii) each issuer’s audit committee will be required to establish procedures for the company to receive, retain and respond to complaints regarding accounting, internal accounting controls or auditing matters; (iv) the audit committee will be responsible for establishing procedures to allow for employees to make anonymous submissions regarding concerns over questionable accounting or auditing matters; and (v) issuers must give their audit committees the authority and funding necessary for the audit committee to engage independent counsel and other advisers to assist them in carrying our their duties.
Additionally, Section 407 of the Act requires the SEC to adopt rules by April 26, 2003 requiring public companies to disclose in their annual and quarterly reports whether at least one member of their audit committee is a "financial expert." The Act imposes more stringent requirements for audit committees with regard to independence and financial expertise than those imposed under current NewYork Stock Exchange, American Stock Exchange and Nasdaq rules. Public companies will have to evaluate whether a change to their current complement of audit committee members is required under the new requirements.
H. Issuer’s Relationship With Its Auditors
Certain Non-Audit Services Prohibited. Issuers will have to change outsourcing arrangements they may have had with their audit firms. After an accounting firm registers with the newly created Public Company Accounting Oversight Board, Section 201 will prohibit the firm from providing the following non-audit services to an audit client: (i) bookkeeping or other services related to the accounting records or financial statements of the company; (ii) financial information systems design and implementation; (iii) appraisal or valuation services, fairness opinions, or contribution-in-kind reports; (iv) actuarial services; (v) internal audit outsourcing services; (vi) management functions or human resources; (vii) broker or dealer, investment adviser, or investment banking services; (viii) legal services and expert services unrelated to the audit; and (ix) any other service that the Public Company Accounting Oversight Board determines, by regulation, is impermissible. The Act gives the new Public Company Accounting Oversight Board the power to exempt, on a case-by-case basis, any person, issuer, public accounting firm, or transaction from the above prohibitions.
Required Pre-Approval of Audit and Non-Audit Services by Audit Committee. Effective immediately, Section 202 requires that all audit and non-audit services (to the extent not specifically prohibited by the Act), including tax services, may be provided only if the audit committee has pre-approved the services. The audit committee may delegate the authority to grant pre-approvals to one or more members of the audit committee. The delegate is required to present the approval at the next scheduled meeting of the full audit committee. Issuers are required to disclose in periodic SEC reports the approval by the audit committee of the provision of any non-audit services by the issuer's independent auditors.
Audit Partner Rotation. Section 203 of the Act makes it unlawful for a lead audit or review audit partner at public accounting firms to audit the same company for more than five consecutive years. This new provision codifies the internal rotation of audit and concurring partners within accounting firms currently required by applicable rules, reducing the mandated rotation cycle from seven years to five years. Section 207 of the Act also directs the U.S. Comptroller General to complete a study of the merits and potential effects of requiring the rotation of auditing firms.
Hiring a Former Auditor. Under Section 206 of the Act, a public accounting firm is prohibited from auditing a public company if the company’s CEO, controller, CFO, chief accounting officer, or other person in a similar position, both was employed by the public accounting firm and participated in any capacity in the company’s audit within one year of the audit initiation.
I. Public Company Accounting Oversight Board
A new independent regulatory body, to be known as the Public Company Accounting Oversight Board, will be created to regulate auditors of public companies. The Oversight Board will be required to establish and enforce auditing standards and to investigate and discipline accountants and accounting firms that violate those standards.
The Oversight Board will commence operations by April 26, 2003. Beginning 180 days thereafter, only public accounting firms that are registered with the Oversight Board may audit public company financial statements. The operations of the Oversight Board will be funded through annual assessments imposed on public companies based on each company’s average annual market capitalization. The board will be composed of five members, with no more than two of them CPAs and with a chair who has not been a practicing CPA for five years.
J. Conclusion
With the Act signed into law, public companies can be sure that the "cost of being public" has just gone up. They will need to review and increase internal staff resources and rely even more on counsel and auditors to minimize the risk of bars, civil suits, criminal indictments and more. Whether these changes will make enough of a difference to deter corporate fraud and restore investor confidence in the public equity markets will not be known for some time. Meanwhile, there is much to do to understand and assure compliance with these new laws.
Pepper Hamilton’s Corporate and Securities Practice Group is composed of many attorneys with skill and practical experience in helping companies, and their officers and directors, comply with the requirements of the federal securities laws. We constantly monitor changes in the laws and rules to keep our clients aware of these changes and the impact on their reporting obligations. We also are experienced in representing clients in investigations and proceedings brought by the SEC’s Enforcement Division and the Justice Department.
If you would like to discuss these new requirements, or would like assistance in making sure your reporting processes are in compliance with these new laws, please contact one of the authors or any member of Pepper Hamilton's Corporate and Securities Practice Group.
©2002 Pepper Hamilton LLP. All rights reserved.
Jeremy D. Frey, Robert A. Friedel, Steven J. Feder and Stephen J. Crimmins
The authors would also like to thank Peter O. Clauss, Christopher E. Kaltenbach, Daniel V. Logue and Mark R. Sullivan for their assistance.
The material in this publication is based on laws, court decisions, administrative rulings and congressional materials, and should not be construed as legal advice or legal opinions on specific facts.