United States: The SEC Adopts Final Rules Under The Sarbanes-Oxley Act of 2002

Over the past two weeks, the SEC has adopted final rules to implement certain provisions of the Sarbanes-Oxley Act of 2002. This legal alert summarizes the final rules and indicates the time frames in which companies will be required to comply with them. Because the SEC has only just recently posted the text of the final rules on its website, this legal alert relies on information provided by the SEC at its open meetings and in its press releases. As a result, this legal alert may not reflect some of the finer points that appear in the text of the final rules. Among other things, the final rules will require public companies to:

• Reconcile non-GAAP financial information in all public communications with GAAP;
• Furnish earnings releases to the SEC on Form 8-K (to the extent the company voluntarily issues an earning release);
• Disclose whether they have an "audit committee financial expert";
• Disclose whether they have adopted a code of ethics covering their principal executive officer, principal financial officer, principal accounting officer or controller, or persons performing similar functions;
• Provide extensive MD&A disclosure regarding off-balance sheet arrangements and certain contractual obligations;
• Establish procedures by which their audit committees pre-approve all audit and non-audit services rendered by their auditors; and
• Prohibit directors and executive officers from trading during a pension plan blackout period.

Also, the SEC has adopted rules establishing standards of professional conduct for attorneys who represent publicly traded companies and other issuers of SEC-registered securities. These new rules require attorneys with evidence of a public company client’s misconduct to report the misconduct "up the ladder" within the company.

Although many of the final rules contain grace periods prior to required compliance, companies should begin to synthesize the new requirements and establish a plan for complying with them, including the development of policies and procedures, if necessary. (For your convenience, attached hereto as Appendix A is a compliance timeline indicating when the final rules become effective).

These final rules stem from Section 401(b) of Sarbanes-Oxley, which directs the SEC to regulate the disclosure of non-GAAP financial measures. The final rules define "non-GAAP financial measure" as a numerical measure of historical or future financial performance, financial position or cash flows that:

• excludes amounts that are included in the comparable GAAP presentation of the same measure in the financial statements; or
• includes amounts that are excluded in the comparable GAAP presentation of the same measure in the financial statements.

Non-GAAP financial measures would not include operating and other statistical measures (such as unit sales, numbers of employees, numbers of subscribers, or numbers of advertisers).

The SEC’s final rules take a two-step approach with respect to the regulation of the use of non-GAAP financial information by public companies:

• New Regulation G applies to all communications (such as press releases) and will require reconciliation of non-GAAP financial measures (such as EBITDA and net income excluding certain "non-recurring" items) to GAAP; and
• Amendments to Regulation S-K and related rules will apply to all SEC filings and will (i) require a similar reconciliation to GAAP, (ii) require a description of the purpose and usefulness of the non-GAAP measures, and (iii) prohibit the use of certain non-GAAP financial measures.

Regulation G will apply to all subject disclosures as of March 28, 2003. The amendments to Regulation S-K will apply to any periodic or current report filed with respect to a fiscal period ending after March 28, 2003.

Section 409 of Sarbanes-Oxley requires the SEC to promulgate rules to require public companies to disclose, on a rapid and current basis, information concerning material changes in financial condition or operations. The final rules will add a new Form 8-K disclosure item requiring earnings releases (irrespective of whether such earnings releases contain non-GAAP financial information) for completed fiscal periods to be furnished to the SEC on Form 8-K within five business days. The final rules do not affirmatively require the issuance of earnings releases or similar disclosures. However, when made, such disclosures or releases trigger the new reporting requirement of Form 8-K.

Significantly, the new Form 8-K disclosure item would require earnings and other material non-public information regarding financial results and financial condition that is disclosed orally (i.e., quarterly earnings conference calls or webcasts) to be furnished on Form 8-K within five business days unless the following conditions are met:

• the oral disclosure is part of a presentation that occurs within 48 hours of a related earnings release or announcement that is filed on Form 8-K;
• the presentation is accessible to the public via conference call, webcast, or similar method;
• the "financial or other statistical information" disclosed in the presentation is posted on the company’s website, together with the comparable GAAP information and reconciliation that would be required by Regulation G; and
• the presentation was announced in a widely disseminated press release describing when and how to access the presentation and the information posted on the website.

The requirement to furnish earnings releases to the SEC on Form 8-K will apply to earnings releases and similar announcements made after March 28, 2003.

Section 407 of Sarbanes-Oxley requires the SEC to adopt rules (i) requiring a company to disclose whether its audit committee includes at least one member who is a financial expert, and (ii) defining the term "financial expert." The SEC has adopted new rules substituting the term "audit committee financial expert" for the more generic "financial expert" and outlining the disclosure requirements.¹

The rules define "audit committee financial expert" to mean a person with all the following attributes:

• an understanding of financial statements and GAAP;
• an ability to assess the general application of such principles in connection with the accounting for estimates, accruals and reserves;
• experience in preparing, auditing, analyzing or evaluating financial statements that present a breadth and level of complexity of accounting issues that are generally comparable to the breadth and complexity of issues that can reasonably be expected to be raised by the company’s financial statements, or experience actively supervising one or more persons engaged in such activities;
• an understanding of internal controls and procedures for financial reporting; and
• an understanding of audit committee functions.

The rules permit greater flexibility in how the above attributes are acquired than originally proposed. The attributes may be acquired through:

• education and experience as a principal financial officer, principal accounting officer, controller, public accountant or auditor or experience in one or more positions that involve the performance of similar functions;
• experience actively supervising a principal financial officer, principal accounting officer, controller, public accountant, auditor or person performing similar functions;
• experience overseeing or assessing the performance of companies or public accountants with respect to the preparation, auditing or evaluation of financial statements; or
• other relevant experience.

As adopted, the final rules eliminate the proposed requirement that the person’s experience applying GAAP in connection with accounting for estimates, accruals and reserves be "generally comparable" to those used in the company’s financial statements.

The proposed rules stated that the mere designation of a member of the audit committee as an "audit committee financial expert" should not impose a higher degree of responsibility or obligation on that member. To codify this position, the final rules contain a safe harbor in the new audit committee disclosure item to clarify that:

• A person who is determined to be an audit committee financial expert will not be deemed an "expert" for any purpose, including without limitation for purposes of Section 11 of the Securities Act of 1933, as a result of being designated or identified as an audit committee financial expert pursuant to the new disclosure item;
• The designation or identification of a person as an audit committee financial expert pursuant to the new disclosure item does not impose on such person any duties, obligations or liability that are greater than the duties, obligations and liability imposed on such person as a member of the audit committee and board of directors in the absence of such designation or identification; and
• The designation or identification of a person as an audit committee financial expert pursuant to the new disclosure item does not affect the duties, obligations or liability of any other member of the audit committee or board of directors.

Companies will be required to provide the new disclosures in annual reports on Form 10-K for fiscal years ending on or after July 15, 2003.

Section 406 of Sarbanes-Oxley requires the SEC to adopt rules requiring a company to disclose whether it has adopted a code of ethics for the company’s senior financial officers, and if not, the reasons, as well as any changes to, or waiver of any provision of, that code of ethics. The SEC final rules extend Section 406 of Sarbanes-Oxley to include disclosure of whether a company has a code of ethics for its principal executive officer. In addition, any changes to, or waiver of, the code would be required to be reported within five business days (as opposed to "promptly" in Section 406 of Sarbanes-Oxley and two business days in the proposed rules), either on Form 8-K or, under certain circumstances, by posting a notice on the company’s website.²

The term "code of ethics" is defined as a codification of standards that is reasonably designed to deter wrongdoing and to promote:

• Honest and ethical conduct, including the ethical handling of actual or apparent conflicts of interest between personal and professional relationships;
• Full, fair, accurate, timely and understandable disclosure in reports and documents that a company files with, or submits to, the SEC and in other public communications made by the company;
• Compliance with applicable governmental laws, rules and regulations;
• The prompt internal reporting to an appropriate person or persons identified in the code of violations of the code; and
• Accountability for adherence to the code.

The code of ethics, or the portion of the code applicable to the principal executive officer and senior financial officers, will be required to be made publicly available in one of three alternate ways: (i) filing it as an exhibit to the company’s annual report on Form 10-K, (ii) providing it on the company’s website, or (iii) providing an undertaking in its Form 10-K to provide a copy of the code of ethics to any person without charge upon request.

Public companies will be required to provide the new disclosures in annual reports on Form 10-K for fiscal years ending on or after July 15, 2003.

The SEC adopted final rules to require public companies to make additional disclosures in the MD&A sections of their public filings. These final rules, which implement Section 401(a) of Sarbanes-Oxley, will specifically require a company to disclose in its annual and quarterly reports all off-balance sheet arrangements that may have, or are reasonably likely to have, a material effect on the current or future financial condition of the company. Additionally, the final rules will require MD&A disclosure of certain aggregate contractual obligations in tabular format.

Perhaps the most significant change in the final rules from the proposed rules relates to the threshold for disclosure of off-balance sheet arrangements. Under the proposed rules, the SEC would have required disclosure of the potential effects of off-balance sheet arrangements if "the likelihood of the occurrence of a future event and its material effect is higher than remote." Put another way, information regarding the potential impact of off-balance sheet arrangements would be required unless the occurrence of an event triggering a material impact is "outside the realm of reasonable possibility." However, the final rules adopt the more familiar "reasonably likely" standard generally applicable to MD&A disclosure relating to trends, demands, commitments, events or uncertainties known to management.³

Registrants must comply with the disclosure requirements for off-balance sheet arrangements in any SEC filing that requires financial statements for fiscal years ending on or after June 15, 2003. Registrants must comply with the tabular disclosure requirements for certain contractual obligations in any SEC filing that requires financial statements for fiscal years ending on or after December 15, 2003.

The SEC adopted final rules to implement Section 208(a) of Sarbanes-Oxley. Among other things, the final rules relate to: (1) prohibited non-audit services; (2) pre-approval requirements for audit and permitted non-audit services; (3) required audit partner rotation; (4) required additional disclosure of services provided by, and fees paid to, a company’s auditing firm; and (5) auditor conflicts of interest.⁴

Certain Prohibited Non-Audit Services. The new rules prohibit auditors from concurrently performing an audit required by the SEC and certain enumerated non-audit services including: (i) bookkeeping or other services related to the accounting records or financial statements of the audit client; (ii) financial information systems design and implementation; (iii) appraisal or valuation services, fairness opinions, or contribution-in-kind reports; (iv) actuarial services; (v) internal audit outsourcing services; (vi) management functions or human resource services; (vii) broker-dealer, investment adviser, or investment banking services; and (viii) legal services; and (ix) expert services unrelated to the audit.

Pre-Approval Required for Audit and Permitted Non-Audit Services. The new rules require that a company’s audit committee approve in advance any audit or permitted non-audit services to be performed by an auditing firm. The rules provide a narrow "de minimis" exception to the pre-approval requirement when minor non-audit services (accounting for no more than five percent of the total revenues paid by the audit client to the audit firm in the fiscal year when the services were rendered) are mistakenly performed without approval.

Disclosure to Investors of Services Provided. The new rules require that a company disclose in its proxy statement the following: (i) fees paid to the independent auditors for audit services, audit-related services, tax services, and other services; (ii) the audit committee’s policies and procedures for pre-approving auditor services; and (iii) the percentage of services other than audit services approved under the de minimis exception.

Rotation of Audit Partners. The new rules require that the lead and concurring audit partners must rotate after five years and be subject to a five-year waiting period before they can serve again in such positions on the engagement team. Certain other significant audit partners are subject to a seven-year rotation requirement and a two-year waiting period.

For purposes of the new rules, the term "audit partner" is defined as a partner who is a member of the audit engagement team and who either: (i) has decision-making responsibility on significant auditing, accounting and reporting matters that affect the financial statements or (ii) maintains regular contact with management and the audit committee of the company.

Auditor Communications with Audit Committees. The new rules require the auditing firms to report to the audit committee, prior to filing its audit report with the SEC, on the following information: (i) all critical accounting policies and practices to be used by the company; (ii) all alternative treatments within GAAP for policies and practices related to material items that have been discussed with management, including the ramifications of each alternative and the treatment preferred by the auditing firm; and (iii) other material written communications between the accounting firm and management, such as management letters or schedules of unadjusted differences.

Conflicts of Interest. The new rules provide that an auditing firm is not independent when:

• a member of the company’s management currently involved in overseeing financial reporting matters was previously the lead partner, the concurring partner, or any other member of the audit engagement team providing more than ten hours of audit, review or attest services for the company within the one-year period preceding the current audit; or
• at any time during the engagement period, any audit partner earns or receives compensation based on that partner procuring engagements with the audit client to provide any services other than audit, review or attest services.

The new rules governing auditor independence standards will become effective 90 days after their publication in the Federal Register, with additional transition periods for certain provisions. Notably, the rules governing the pre-approval of audit and permitted non-audit services by the audit committee become effective 90 days after their publication in the Federal Register.

Section 306(a) of Sarbanes-Oxley prohibits any director or executive officer of a public company from trading in the equity securities of that public company during a pension plan blackout period. The SEC has adopted Regulation Blackout Trading Restriction ("Regulation BTR") to clarify the application and to prevent the evasion of Section 306(a) of Sarbanes-Oxley.⁵

In particular, Regulation BTR clarifies that the prohibition under Section 306(a) of Sarbanes-Oxley applies to any equity security of a public company including derivative securities relating to such equity security. For each individual, the prohibition is limited to those equity securities acquired in connection with his or her service or employment as a director or executive officer; although the individual has the burden of establishing that any of the company’s equity securities sold or transferred during the blackout period were not acquired in connection with such service or employment. Regulation BTR exempts certain categories of transactions that occur outside the direct control of the director or executive officer (including acquisitions as a result of stock splits or dividend reinvestment plans, or transactions pursuant to a Rule 10b5-1 trading plan).

In addition, Regulation BTR clarifies that the prohibition is triggered whenever a blackout period lasts more than three consecutive business days and temporarily suspends the ability of at least 50% of the plan participants to acquire or dispose of an interest in equity securities held in an individual account plan (such as a 401(k) plan). Application of this prohibition to foreign private issuers is limited to situations where the trading suspension affects at least 50% of the U.S. participants in the company’s individual account plans and either (i) the affected U.S. participants exceed 15% of the company’s worldwide employees, or (ii) more than 50,000 U.S. participants are affected.

Regulation BTR also specifies the content and timing of the notice that a company is required to provide to its directors and executive officers and to the SEC about an impending blackout period. In the case of a U.S. company, the notice to the SEC will be provided in a Form 8-K report.

A violation of the trading restrictions by a director or executive officer would be a violation of the Securities Exchange Act of 1934 and would be subject to possible SEC action. In addition, similar to actions for violations of the short-swing profit recovery rules under Section 16 of the Securities Exchange Act of 1934, a company, or a shareholder of a company, may bring a suit to recover profits realized by a director or executive officer resulting from a prohibited transaction during a blackout period.

Section 306(a) of Sarbanes-Oxley and Regulation BTR became effective on January 26, 2003.

The SEC adopted new rules establishing standards of professional conduct for attorneys who represent publicly traded companies and other issuers of SEC-registered securities. These rules were mandated by Section 307 of Sarbanes-Oxley. These final rules implement a number of changes to the SEC’s initial proposed rules, which were released for public comment in November of 2002.

As required by Section 307, and consistent with the SEC’s proposed rules, the new rules will require attorneys with evidence of a corporate client’s misconduct to report the misconduct "up the ladder" within the organization, all the way to the board of directors, if necessary. However, faced with substantial negative reaction to the "noisy withdrawal" provisions of the proposed rules, the SEC extended the comment period on these provisions for an additional 60 days and proposed alternative provisions that would require the company, rather than the attorney, to disclose the attorney’s withdrawal from representation. Other aspects of the proposed rules also were revised in response to public comments.⁶

To allow both public companies and their attorneys time to establish procedures to comply with the new rules, the rules will not go into effect until 180 days from the date of their publication in the Federal Register. The SEC indicated in the open meeting, however, that it may consider the additional comments and adopt the remaining proposals within that 180-day period.