United States: Portions of Sarbanes-Oxley Act are Immediately Effective: Steps That You Should Take Now

Co-authored by Ms Jan Davidson and Ms Deborah Froling

On Tuesday, President Bush signed into law the Sarbanes-Oxley Act of 2002. As mentioned in our Legal Alert dated July 26, 2002, the Act contains certain provisions relating to CEO and CFO certifications of periodic reports and to the prohibition of personal loans to executive officers and directors by issuers. These provisions, contained in Sections 906 and 402 of the Act, respectively, took effect immediately and require prompt attention by all public companies. In addition, Section 302 of the Act directs the SEC to adopt, by August 29, 2002, rules requiring the certifications required in that section of the Act.

Pursuant to Section 906 of the Act, each periodic report containing financial statements filed under the Securities Exchange Act of 1934 on or after July 30, 2002, must be "accompanied by" a certification by each of the CEO and CFO that:

• the periodic report fully complies with the requirements of Section 13(a) or 15(d) of the Exchange Act; and
• the information contained in the report fairly presents, in all material respects, the financial condition and results of operations of the company.

The Act contains no guidance on where and how to certify under Section 906. After discussions with members of the SEC staff, we understand that the SEC is recommending that certifications may be made by:

1. Including the certification as part of the signature block for the periodic report (which is then signed by both the CEO and CFO);

2. Filing the required certifications as an Exhibit 99 to the periodic report; or

3. Filing the required certifications separately from the periodic report as Item 5 exhibits to a Form 8-K.

In a memorandum to the members of the Committee on Federal Regulation of Securities of the American Bar Association, the Committee chairman suggested transmitting the certifications separately under a correspondence tag under EDGAR or by delivery to the SEC in paper format. That memorandum also mentioned the possibility of including a disclaimer in the certification that would limit the certification’s purpose to complying with the requirement of the Act. Only time will tell what the SEC will accept.

Each of the three approaches informally recommended by the SEC would cause the certification to be filed under the Exchange Act. The ABA Committee Chairman’s approach would not.

The Section 906 certification requirement, which is an addition to the federal mail fraud criminal statutes, only requires that periodic reports containing financial statements "be accompanied" by the CEO and CFO certifications. It is unclear whether the term "accompanied by" will be interpreted to require the certificate to be filed under the Exchange Act. Filing the certification raises the issue of exposing the CEO and CFO to risk of civil liability for the certification, in addition to the criminal sanctions expressly provided.

On the other hand, if the certification is not filed (but is transmitted in the manner suggested by the ABA Committee Chairman), then discussing the certification with persons outside the company (as set forth in Regulation FD) could raise a selective disclosure issue under Regulation FD, if the certifications are considered material.

The ability to trust the quality of the company’s internal procedures and controls regarding preparation of its SEC reports is the only way that CEOs and CFOs will be able to give confidently the certifications required of them. Given that many certifications of company periodic reports must be filed in the next two weeks, public companies must take immediate, interim actions to support the CEO’s and CFO’s upcoming certifications. The company must later take steps to put in place comprehensive due diligence procedures for future filings, so that the CEOs and CFOs can comfortably make the certifications that will be required in the future.

1. Engage the CEO and the CFO Directly. Clearly, the CEO and CFO must critically review all filings that they certify. The CEO and CFO should discuss with the principal drafters of the report any significant issues that arose in connection with preparation of disclosures, the alternatives presented and the resolution of the issues. In addition, they must discuss with the outside auditors their review of the financial statements contained in the report and the auditors’ discussions with the audit committee. Once the SEC Reports Committee is formed (discussed below), the CEO and CFO should discuss later reports with that committee.

2. Establish an SEC Reports Committee. The SEC made one suggestion concerning the internal procedures companies should adopt: establish a "committee with responsibility for considering the materiality of information and determining disclosure obligations on a timely basis," reporting to senior management.

The SEC suggested that the committee could be comprised of persons such as the principal accounting officer or controller, the general counsel or other senior in-house attorney with securities compliance responsibility, the principal risk management officer and the chief investor relations officer. In smaller companies (without in-house counsel, risk management officers or investor relations officers), we believe that the CEO and/or CFO might be members themselves of the committee and include outside securities counsel as an ex-officio member.

Whether or not called a committee, the core group of persons who have primary responsibility for creating SEC reports and assuring their accuracy and completeness should be clearly identified and charged with specific responsibility for the disclosure. These persons must be familiar with the requirements of the various SEC reports, including that the reports must contain neither material misstatements nor material omissions, and understand both the specific duties allocated to them and the general responsibility applicable to every manager throughout the company who provides information for the preparation process. It would be appropriate to delegate to these persons specific responsibilities for the collection of the various types of information required in SEC reports that correlate to their roles within the company.

3. For early 10-Q filers, consider waiting to file closer to due date. Given that there are many unanswered questions regarding this certification, companies may wish to wait to file closer to the due date. Guidance, interpretations or other useful information could be published by the SEC that would help shed some light on some of these unanswered questions.

Under Section 906, it is a crime punishable by fines of up to $1 million and imprisonment for up to 10 years to give the certification knowing that it is false, and a crime punishable by fines of up to $5 million and imprisonment for up to 20 years to willfully give the certification knowing that it is false.

1. Although Section 906 does not contain a "knowledge" qualification to the certification, it imposes criminal penalties only for false certifications that were made knowingly or willfully.

2. Section 906 requires a certification that the report "fully complies" with the relevant Exchange Act provisions. There is no materiality threshold in Section 906. However, many of the requirements in the Exchange Act contain a materiality standard with respect to the information required to be disclosed, so that "fully complies" would, as a result, include a materiality qualifier.

3. The term "periodic report containing financial statements" is not defined in the Act, and it is unclear whether the certification would also apply to Form 8-K filings that contain financial statements. Many practitioners are taking the position that the certification does not apply to Form 8-Ks.

4. It is unclear for penalty purposes ($1 million and 10 years vs. $.5 million and 20 years) whether there is a difference between knowingly certifying the report and willfully certifying the report – in both cases, knowing that the report does not comply with the certification.

The 947 companies subject to the SEC’s June 27^th Section 21(a) order must file two certifications – one complying with the SEC’s Section 21(a) order and the other complying with Section 906 of the Act. If CEOs and CFOs have already provided the SEC with their Section 21(a) orders in advance of filing the company’s next quarterly Form 10-Q and therefore did not include that Form 10-Q as part of the Section 21(a) order, they will nonetheless have to certify that Form 10-Q pursuant to the Section 906 certification.

Section 302 of the Act directs the SEC to adopt rules, by August 29, 2002, requiring certifications by CEOs and CFOs of public companies as to various matters in periodic and annual reports filed with the SEC. The specific requirements of the Section 302 certifications, which are quite detailed, are set forth in our Legal Alert dated July 26, 2002.

Section 906 appears to be inconsistent with Section 302, both as to the standards for certification and the consequences. We expect some clarification from the SEC when it adopts final rules under Section 302. In addition, in making its rules pursuant to Section 302, the SEC will most likely integrate its June 17, 2002 proposed certification rules with the Section 302 rules. We understand that the SEC will be issuing some preliminary guidance on Section 302, possibly as early as today.

Section 402 of the Act amends Section 13 of the Exchange Act by prohibiting public companies and their subsidiaries from, directly or indirectly, extending, or arranging for the extension of, credit in the form of personal loans to or for their directors and executive officers.

Although the term "executive officer" is not defined in the Act, presumably these are the officers required to be disclosed pursuant to the proxy rules.

Although existing loans are not affected, material modifications and renewals to such loans are now prohibited. There are certain narrow exceptions for loans made in the ordinary course by consumer credit businesses and loans made by insured depository institutions to their insiders pursuant to applicable regulations, but otherwise the prohibition is broad on its face.

The full extent of this prohibition is unclear and staff at the SEC has indicated that there is no rulemaking contemplated at this time with respect to this issue. Therefore, many currently prevalent arrangements, in addition to the clearly prohibited monetary loans, that could be prohibited under the broad language of the Act include:

• split-dollar life insurance arrangements
• company advances of tax withholdings
• cashless option exercise arrangements

We believe, based on conversations with the SEC staff, that arrangements such as split-dollar life insurance, currently in place, should be entitled to rely on the grandfathering provisions of this Section. However, each such arrangement should be reviewed in light of Section 402.

Each public company should immediately undertake a review of its compensation policies to identify whether they include arrangements that could be considered prohibited loans. Each such arrangement identified should be discussed with securities counsel.

In light of the uncertainty as to the scope of the prohibition, we recommend a conservative approach with respect to the implementation, modification or renewal of any arrangement with executive officers or directors that could possibly be construed as a "personal loan" under the Act.

The staff at the SEC has informally indicated that typical arrangements of the sorts made generally available to all employees (and not just executive officers and directors), such as advances for travel expenses, job relocation expenses, and the like, would presumably not be prohibited under Section 402.

Since Section 402 amends Section 13 of the Exchange Act, a violation of the prohibition contained in Section 402 constitutes a violation of the Exchange Act. An individual who willfully violates the Exchange Act, or the rules promulgated thereunder, can be punished by fines of up to $5 million (increased from $1 million) or sentenced to up to 20 years in prison (increased from 10 years) or both.

We will continue to monitor all of these issues very closely and will provide updates of important developments. The Chair of our Securities Practice Team served on the Business Advisory Group to a Congressional Committee that worked on initiatives leading to the Act. We would be pleased to discuss any of the issues presented in this Legal Alert with interested readers.