Corporate Update: The Sarbanes-Oxley Act Of 2002 And Related Developments

Article by David S. Rosenthal and Sean P. McGuinness

On July 30, 2002, President George W. Bush signed into law the Sarbanes-Oxley Act of 2002. In the most comprehensive revision of the securities laws in many years, the Act includes wide-ranging provisions designed to enhance corporate responsibility and safeguard the integrity of the capital markets. It has significant ramifications for public companies and their officers, directors and stockholders, as well as for the accounting and legal professions.

The reforms envisioned by the Act may be grouped into five broad categories:

• corporate governance requirements;
• obligations regarding public disclosure by issuers;
• disclosure obligations and limitations on the behavior of officers, directors and significant stockholders;
• regulations regarding auditor independence and oversight of the audit process; and
• toughened penalties for securities law fraud and other violations.

Some provisions of the Act are effective immediately upon its enactment, whereas others will become effective at later dates. The Act calls upon the SEC, the stock exchanges and Nasdaq (the "SROs") to adopt additional regulations implementing its provisions over the course of time. The NYSE already has filed with the SEC formal rules regarding its proposed corporate governance standards. Most of the corporate standards proposed by Nasdaq have not yet been so filed, and to date Nasdaq has provided only a summary of its proposals. We expect that an effort will be made to achieve consistency between the SRO’s proposals and the Act. The complexity of the Act, and the fact that the numerous regulations that it calls for will not be promulgated for an extended period, suggest that for the time being a considerable measure of uncertainty will surround its interpretation and application.

This memorandum presents only a summary of the Act and the related rules that have been adopted by the SEC to date, dividing them into the five categories identified above. We will provide additional information regarding these matters and related developments as they arise.

Section 906 Certifications. Effective July 30, 2002, Section 906 of the Act requires public company CEOs and CFOs to certify that each periodic report (i.e., each annual and quarterly report) filed with the SEC (1) fully complies with the requirements of Section 13(a) or 15(d) of the Exchange Act and (2) fairly presents, in all material respects, the financial condition and results of operations of the issuer. Section 906 further subjects the certifying persons to fines of up to $5 million and imprisonment of up to 20 years for "willfully" false certifications, and to fines of up to $1 million and imprisonment of up to ten years for "knowingly" false certifications. This Section 906 certification must "accompany" the report to which it relates. Most issuers have satisfied this requirement by filing the certification as an exhibit to the related report.

Section 302 Certifications. Final rules promulgated by the SEC pursuant to Section 302 of the Act that became effective August 29, 2002¹ require public company CEOs and CFOs to provide a separate certification that for each of the issuer’s quarterly and annual financial reports:

• the signing officers have reviewed the report;
• based on the officers’ knowledge:

- the report does not contain any untrue statement of material fact or omit to state a material fact necessary to make the statements made, in the light of the circumstances under which they were made, not misleading; and

- the financial statements, and other financial information included in the report, fairly present in all material respects the financial condition and results of operation and cash flows of the issuer as of, and for, the periods presented in the report;

• the signing officers:

- are responsible for establishing and maintaining disclosure controls and procedures;

- have designed such disclosure controls and procedures to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to such officers by others in those entities, particularly during the period in which the periodic reports are being prepared;

- have evaluated the effectiveness of such disclosure controls and procedures as of a date not later than 90 days prior to the report; and

- have presented in the report their conclusions about the effectiveness of such disclosure controls and procedures based on their evaluation;

• the signing officers have disclosed to the issuer’s auditors and audit committee:

- all significant deficiencies in the design or operation of internal controls which could adversely affect the issuer’s ability to record, process, summarize and report financial data, and have identified for the issuer’s auditors any material weaknesses in the internal controls; and

- any fraud, whether or not material, involving management or other employees of the issuer who have a significant role in the issuer’s internal controls; and

• the signing officers have indicated in the report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of their evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses.

The final rules define "disclosure controls and procedures" as controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports filed or submitted by it under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. The new rules do not define the term "internal controls." However, the adoptive release states that internal controls concern an issuer’s controls and procedures for financial reporting purposes.

The adoptive release explains that the SEC is not requiring any particular procedures for conducting the required review and evaluation. Instead, issuers are urged to develop processes consistent with their business and internal management and supervisory practices. The SEC does recommend that issuers create a committee responsible for determining the materiality of information and determining disclosure obligations on a timely basis. We understand that the SEC will issue a release in the near future elaborating on its position regarding these maters. The final Section 302 rules are described in greater detail in our Corporate Update titled "CEO and CFO Certifications and Corporate Disclosure Controls."

Section 404 of the Act requires the SEC to adopt rules requiring each annual report required by Section 13(a) or 15(d) of the Exchange Act to contain an internal control report, which shall:

• state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and
• contain an assessment, as of the end of the most recent fiscal year, of the effectiveness of the issuer’s internal control structure and procedures for financial reporting.

Section 404 does not specify a date by which these rules must be implemented.

In addition, Section 404 requires the issuer’s auditors to attest to, and report on, the assessment made by the issuer’s management of its system of internal controls. The attestation is to be made under standards to be issued by the newly established Accounting Oversight Board.

Section 406 of the Act requires the SEC to propose rules by October 28, 2002 and to adopt final rules by January 26, 2003 requiring all issuers to disclose whether they have adopted a code of ethics for senior financial officers, and if not to explain why. In addition, the SEC is required to amend Form 8-K to require immediate disclosure of all changes to or waivers of the code of ethics. For purposes of Section 406, a "code of ethics" means such standards as may be reasonably necessary to promote:

• honest and ethical conduct, including the handling of conflicts of interest;
• full, fair, accurate, timely and understandable disclosure in periodic reports; and
• compliance with applicable laws and regulations.

The Act does not require public companies to adopt a code of ethics, but merely to disclose whether they have done so. In contrast, the corporate governance proposals adopted by the NYSE and Nasdaq do require listed companies to adopt a code of ethics. The proposed corporate governance proposals filed by the NYSE for SEC approval require listed companies to adopt and disclose a code of business conduct and ethics for directors, officers and employees, and enumerate certain topics that should be addressed in the code, such as conflicts of interest, corporate opportunities, confidentiality, fair dealing, protection and proper use of company assets, compliance with laws and encouraging the reporting of any illegal or unethical behavior. Nasdaq has not yet provided any such guidance as to the content of the code of conduct it intends to require listed companies to adopt, other than to note that it should address conflicts of interest and compliance with law. The NYSE’s proposals also require the adoption and disclosure of corporate governance guidelines and an annual certification by the listed company’s CEO that he is unaware of any violation by the company of the NYSE corporate governance listing standards.

Financial Experts.

Section 407 of the Act requires the SEC to propose rules by October 28, 2002 and to adopt final rules by January 26, 2003 requiring all issuers to disclose whether their audit committees include a "financial expert," and if not to explain why. In defining "financial expert," the Act directs the SEC to consider whether a person has:

• an understanding of GAAP and financial statements;
• experience in preparing or auditing financial statements and applying accounting principles in connection with accounting for estimates, accruals and reserves;
• experience with internal accounting controls; and
• an understanding of audit committee functions.

The NYSE currently requires that the audit committee members of its listed companies be financially literate, and that at least one have accounting or financial management expertise. Although the Corporate Accountability and Listing Standards Committee appointed by the NYSE to review its listing standards had recommended that the chair of the audit committee be required to have such expertise, the NYSE has announced that it will wait for the SEC’s interpretation of the definition of "financial expert" before acting upon such recommendation. The Nasdaq’s corporate governance proposals require that all audit committee members be able to read and create financial statements at the time of their appointment.

Audit Committee Composition. Section 301 of the Act requires the SEC to adopt rules by April 26, 2003 that prohibit the SROs from listing the securities of any issuer whose audit committee is not comprised solely of independent directors, and whose audit committee does not perform the following functions:

• have direct responsibility for the appointment, compensation and oversight of the issuer’s auditors, who shall report directly to the audit committee;
• establish procedures for the receipt and handling of complaints regarding the issuer’s accounting, accounting controls or auditing matters; including adopting procedures to facilitate anonymous, confidential submissions from employees; and
• have the authority to engage independent counsel and other advisers, as it deems necessary, at the issuer’s expense.

For purposes of the foregoing, Section 301 specifies that a director will be considered independent only if he or she does not accept consulting, advisory or other compensatory fees from the issuer (other than directors’ fees), and is not an affiliated person of the issuer or any of its subsidiaries. Section 301, however, grants the SEC authority to grant exemptions from these extremely broad independence standards.

The audit committee independence standards ultimately will be governed by the related corporate governance standards to be established by the SROs. The corporate governance proposals adopted by both the NYSE and Nasdaq tighten the definition of "independent" director, and expand the role of the audit committee. Among other things, the NYSE would require the board of directors of a listed company affirmatively to determine a director’s independence and disclose the basis of such determination in the company’s proxy statement. In addition, there would be a five-year cooling off period for former employees, former auditors, persons who have been part of interlocking directorates, and immediate family members of the foregoing. Nasdaq would impose a three-year cooling off period for such persons, and also would consider a director who owns or controls 20% or more of a listed company’s voting securities to be non-independent. It is expected that public companies will have a period of time after SEC approval of the proposals to comply with the new standards adopted by the SRO that are applicable to them.

Effective July 30, 2002, Section 408 of the Act requires the SEC to review the periodic filings of issuers listed on an exchange or Nasdaq at least once every three years. The Act directs the SEC to consider the following factors in selecting issuers for review:

• whether the issuer has issued material restatements of its financial results or experienced significant volatility in its stock price relative to other issuers;
• issuers with largest market capitalization;
• emerging companies with disparities in price-to-earnings ratios; and
• issuers whose operations significantly affect any material sector of the economy.

Section 401 of the Act requires the SEC to adopt final rules by January 26, 2003:

• requiring disclosure in quarterly and annual reports of all material off-balance sheet transactions, arrangements, obligations (contingent or otherwise) and other material relationships of the issuer with unconsolidated entities or persons that may have a material current or future effect on the issuer’s financial condition, changes in financial condition, results of operations, liquidity, capital expenditures, capital resources or significant components of revenues or expenses; and
• requiring that pro forma figures in periodic and other reports (1) not contain an untrue statement or material fact or omit to state a material fact necessary to make such pro forma figures not misleading, and (2) be reconciled with the issuer’s reported GAAP financial statements.

In addition, Section 401 directs the SEC to conduct a study of special purpose entitles, including an assessment of whether, under GAAP, issuers’ financial statements reflect the economics of off-balance sheet transactions in a transparent fashion. This study is to be completed one year after the promulgation of the final rules relating to off-balance sheet transactions.

Section 409 of the Act amends Section 13 of the Exchange Act to require issuers to make real time disclosures, in plain English, of such material changes in their financial condition or results of operations as the SEC may require by rule. Section 409 does not specify a date by which these rules must be implemented.

The SEC recently adopted final rules² that accelerate the filing deadlines for quarterly and annual reports for domestic reporting companies with a public float of at least $75 million that have been subject to Exchange Act reporting requirements for at least 12 months and that are not eligible to use form 10-KSB and 7 10-QSB. The accelerated filing deadlines by which these "accelerated filers" must file their quarterly and annual reports are summarized in the following table:

These final rules are described in greater detail in our Corporate Update entitled "Accelerated Filing Deadlines for Quarterly and Annual Reports and Disclosure Concerning Website Access to Reports."

Accelerated 8-K Filing Proposal. In June 2002, the SEC proposed rules that would require the disclosure of additional matters on Form 8-K, and accelerate the Form 8-K filing deadline to two days. These proposed rules could form the basis for the final rules to be adopted under Section 409.

Effective July 30, 2002, Section 304 of the Act requires public company CEOs and CFOs to disgorge to their employers any bonus or other incentive-based or equity-based compensation received, and profits from their sale of the issuer’s securities realized, during the 12 months following the initial public disclosure of or filing with the SEC of financial statements that must later be restated due to material noncompliance with any financial reporting requirement under the securities laws resulting from misconduct. The Act does not specify what constitutes misconduct for these purposes, or require that there by any causal relationship between the misconduct and the restatement.

Effective July 30, 2002, Section 402 of the Act amends Section 13 of the Exchange Act to prohibit issuers from making or arranging for personal loans to their executive officers and directors. Existing loans may remain outstanding, but may not be extended or materially amended.

There are exceptions for certain commercial arrangements made in the ordinary course of the issuer’s business, including principally the following:

• home improvement and manufactured home loans, consumer credit and credit extended under credit cards, provided the loans are (1) made in the ordinary course of the issuer’s consumer credit business, (2) of a type generally made available by the issuer to the public and (3) made on market terms no more favorable than those offered to the general public; and
• loans made by FDIC-insured banks and thrifts that are subject to existing restrictions on loans to insiders pursuant to the Federal Reserve Act.

Section 403 of the Act and final rules promulgated by the SEC thereunder that became effective August 29, 2002³ effect significant changes to the beneficial ownership reporting requirements imposed upon officers, directors and 10% beneficial owners of public companies under Section 16(a) of the Exchange Act and the related SEC rules. The changes shorten the deadlines by which such persons must report most changes in their beneficial ownership of their company’s equity securities to two business days following the transaction date. This includes reportable transactions exempt under Rule 16b-3, which previously could be reported on Form 5 but now must be reported on Form 4. If an insider does not select the execution date and the transaction is either subject to Rule 10b-5(c) or is a discretionary transaction under Rule 16b- 3(b)(1), the transaction must be reported by the second business day following the deemed execution date. The deemed execution date of such a transaction is the earlier of the date on which the reporting person is notified of the transaction or the third business day after the actual trade date.⁴

The accelerated reporting deadline applies to all transactions occurring on or after August 29, 2002. Transactions previously exempt from the reporting requirements of Section 16(a) remain exempt. Additionally, effective July 30, 2003, all statements on Form 4 must be filed electronically via EDGAR, and an issuer must post the filings on its corporate web site (if it maintains one) not later than the close of business on the day after the filing date.

These final rules are described in greater detail in our Corporate Update titled "SEC Adopts New Section 16 Reporting Deadlines Pursuant to the Sarbanes-Oxley Act of 2002."

Pursuant to Section 306 of the Act, effective January 26, 2003, and subject to further SEC rulemaking, directors and officers of an issuer will be prohibited, during any pension fund blackout period, from purchasing, selling, or in any way acquiring or transferring any equity securities of the issuer that were acquired in connection with service as a director or officer. Section 306 empowers the issuer to sue directors and officers to recover profits earned in violation of this prohibition. For these purposes, a blackout period is defined generally to include any period of more than three consecutive business days during which the ability of at least 50% of the participants or beneficiaries under all individual account plans maintained by the issuer to trade in issuer’s equity securities held in such an individual account plan is temporarily suspended by the issuer or a plan fiduciary.

The Act requires issuers to provide timely notice to their officers and directors, as well as the SEC, of blackout periods, without specifying what constitutes timely notice, or how notice is to be given. The Act also amends ERISA to add blackout period notice requirements for plan administrators, and related matters.

Section 307 of the Act requires the SEC to adopt final rules by January 26, 2003 establishing minimum standards of professional conduct for attorneys appearing and practicing before the SEC, including requirements that these attorneys report evidence of a material violation of securities law or breach of fiduciary duty or similar violation by an issuer or any of its agents to its chief legal counsel or CEO. If such counsel or officer of the issuer does not appropriately respond to the evidence, the attorney must report that evidence to the board of directors, or to the audit committee or another board committee comprised of independent directors. The law appears to apply to both inside and outside counsel.

Section 201 of the Act amends Section 10A of the Exchange Act to prohibit auditing firms from providing the following types of non-audit services for their audit clients:

• Bookkeeping or other services related to accounting records or financial statements;
• Financial information systems design and implementation;
• Appraisal or valuation services, fairness opinions or contribution-in-kind reports;
• Actuarial services;
• Internal audit outsourcing services;
• Management functions or human resources;
• Broker or dealer, investment adviser, or investment banking services;
• Legal services and expert services unrelated to the audit; or
• Any other service that the Accounting Board determines is impermissible.

However, an auditor still may provide non-audit services that are not specifically prohibited under Sarbanes-Oxley, including tax services, if (1) the aggregate amount of such non-audit services that an auditor provides to an issuer in a fiscal year is less than 5% of the total revenues the issuer pays to that auditor in that fiscal year, or (2) the audit committee of the issuer preapproves the provision of such non-audit services by the auditor and reports such preapproval to investors in the issuer’s next quarterly or annual report.

Section 202 of the Act amends Section 10A of the Exchange Act to require pre-approval by the audit committee of all audit and non-audit services to be provided by the issuer’s auditor (subject to the de minimus exemption described in the preceding paragraph).

Section 203 amends Section 10A of the Exchange Act to prohibit an auditing firm from providing audit services if either the lead audit partner or reviewing partner has performed audit services for that issuer in each of the five previous years.

Section 204 of the Act amends Section 10A of the Exchange Act to obligate the auditor to report to the audit committee regarding critical accounting policies and practices used in the audit, alternative GAAP treatments and other material written communications between the auditor and management, such as management letters.

Section 206 of the Act amends Section 10A of the Exchange Act to prohibit an auditor from performing any audit services for an issuer if any of the issuer’s principal accounting officers were employed by the auditor during the one-year period preceding the date of the initiation of the audit.

Section 208 of the Act requires the SEC to adopt rules implementing the foregoing provisions of the Act by January 26, 2003. Nevertheless, those provisions are effective pending adoption of the implementing regulations.

Title I of the Act establishes the Public Company Accounting Oversight Board to oversee the auditing of public companies and set standards for the preparation of audit reports for public companies. The Board will consist of five members, who the SEC will appoint. The SEC is required to appoint the initial members of the Board by October 28, 2002. By April 26, 2003, the Board is required to hire staff, adopt rules and take such other actions as may be necessary to enable the SEC to determine that the Board is able to begin operations. Six months after that determination, outside accounting firms must be registered with the Board in order to be able to continue to serve as auditors to public companies.

The Act calls on the Accounting Board, once established, to impose upon auditors the following new obligations, among others:

• an auditor will be required to prepare, and maintain for not less than seven years, audit work papers in sufficient detail to support the conclusions reached in an audit report; and
• an auditor will be required to include in its audit report a discussion of the auditor’s testing of the issuer’s internal control structure and procedures, including a description of material weaknesses and material noncompliance found on the basis of such testing (see "Management Assessment of Internal Controls," above, for a discussion of the new requirement on issuers to conduct annual management assessments of internal controls).

Interference With Audits. Section 303 of the Act makes it unlawful, under rules to be issued by the SEC, for an officer or director, or anyone acting under their direction, to fraudulently influence, coerce, manipulate or mislead an independent auditor for the purpose of rendering the financial statements being audited materially misleading. No private cause of action is authorized. The SEC is required to propose rules by October 28, 2002, and to issue final rules by April 26, 2003.

Destruction of or Tampering With Records. Section 802 of the Act adds new Sections 1519 and 1520 to Title 18 of the U.S. Code. Section 1519 imposes fines and imprisonment for up to 20 years for violations involving the destruction of or tampering with any document with the intent to impede any U.S. Government investigation. Section 1520 obligates accountants to maintain their work papers for five years from the end of the year in which the audit is performed, and imposes fines and imprisonment for up to ten years for knowing and willful violations. Section 1102 of the Act amends 18 U.S.C. § 1102 to impose fines and imprisonment for up to 20 years on persons that alter or destroy documents with the intent of impairing their integrity or availability for use in connection with any official proceeding, or otherwise obstructs an official proceeding.

New Securities Fraud Offense. Section 807 of the Act creates a new criminal securities fraud offence, 18 U.S.C. § 1348, for knowingly executing a scheme or artifice to defraud any person in connection with any security of a public company, or to obtain by means of false or fraudulent pretenses, representations or promises, any money or property in connection with the purchase or sale of any security of a public company. Violations are punishable by fines and imprisonment for up to 25 years.

Retaliation Against Informants. Section 1107 of the Act amends 18 U.S.C. § 1513 to prohibit taking any action knowingly, with the intent to retaliate, that is harmful to any person for providing truthful information to a law enforcement officer relating to the commission or possible commission of any federal offense. Violations are punishable by fines and imprisonment for up to ten years.

Penalty Increases. The Act increases the penalties applicable under certain existing criminal and civil statutes, and directs the U.S. Sentencing commission to review and amend the related Federal Sentencing Guidelines. The increased penalties include the following:

• Section 903 increases the maximum penalty for mail and wire fraud from five to 20 years;
• Section 904 increases the criminal penalties for ERISA violations from one to ten years’ imprisonment and raises the maximum fine to $500,000; and
• Section 1107 amends Section 32(a) of the Exchange Act to raise the maximum individual penalties from $1 million and ten years’ imprisonment to $5 million and 20 years’ imprisonment, and to raise the maximum corporate fine from $2.5 million to $25 million.

Officer and Director Bars. Section 1105 of the Act authorizes the SEC to bar, in an administrative cease-and-desist proceeding, any person who has violated Section 10(b) of the Exchange Act or Section 17(a)(1) of the Securities Act, or the regulations thereunder, from acting as an officer or director of a public company if the person’s conduct demonstrates "unfitness" to serve as such. Previously, a showing of "substantial unfitness" was required. In addition, the SEC was not permitted to proceed administratively, and was instead required to obtain a court order. Section 305 of the Act correspondingly lowers the standard for imposition of officer and director bars in judicial proceedings under Section 21(d)(2) of the Exchange Act and Section 20(e) of the Securities Act to a showing of "unfitness."

Statute of Limitations for Securities Fraud. Section 804 of the Act amends 28 U.S.C. § 1658 to extend the statute of limitations for private rights of action for securities fraud claims to the earlier of (1) two years after discovery of the facts constituting the violation or (2) five years after the occurrence of the violation.

Whistle Blower Protections. Section 806 of the Act creates 18 U.S.C. § 1514A, which creates a private right of action against public companies and their employees and agents who discriminate against employees who participate in whistle blowing activities. Potential relief includes reinstatement with back pay and interest, and compensation for attorneys fees and other litigation costs.

Nondischargeable Debts in Bankruptcy. Section 803 of the Act provides that debts arising from judgments or settlements in civil and criminal securities fraud proceedings, including common law fraud in connection with the purchase or sale of a security, cannot be discharged in bankruptcy.

In determining how to go about complying with Sarbanes-Oxley’s obligations, each issuer should assess its needs based on its particular facts and circumstances. We would be pleased to discuss any compliance program features that you and your company may be considering or provide any assistance that may be required in developing a compliance program. Regardless of how you choose to proceed, you and your company should promptly formulate and document whatever procedures and policies are currently in place so as to create a record of the steps taken to comply with the new requirements.

ENDNOTES

1 The rules are available at http://www.sec.gov/rules/final/33-8124.htm.

2 The rules are available at http://www.sec.gov/rules/final/33-8128.htm.

3 The rules are available at http://www.sec.gov/rules/final/34-46421.htm.

4 The SEC has modified Forms 4 and 5 to reflect the changes to the related rules. The new Form 4 is available at http://www.sec.gov/about/forms/form4.pdf. Instructions to the new Form 4 are available at http://www.sec.gov/about/forms/form4data.pdf.

© 2002 Swidler Berlin Shereff Friedman, LLP