Key Provisions of the Sarbanes-Oxley Act of 2002

Article by Michael L Zuppone, Kirby D Behre, Rob Carlson

In response to recently publicized corporate scandals, Congress passed the Sarbanes-Oxley Act of 2002 (the "Act"), which was signed by the President on July 30, 2002. The Act contains sweeping measures dealing with financial reporting, conflicts of interest, corporate ethics and the oversight of the accounting profession, as well as establishing new civil and criminal penalties.

As discussed below, certain provisions of the Act were effective immediately, while other provisions require the SEC to promulgate rules in order to carry out the purposes of the Act. Paul Hastings will continue to monitor the SEC’s rulemaking activities, as well as the corporate governance reforms being undertaken by the national securities exchanges and Nasdaq. Please visit www.paulhastings.com for current information on all material developments.

In Section 906 of the Act, Congress mandated that each periodic report containing financial statements which is filed with the SEC be accompanied by the certification of the CEO and CFO that:

• the report fully complies with the requirements Section 13(a) or Section 15(d) of the Securities Exchange Act of 1934 (the "Exchange Act"); and
• the information contained in the report fairly presents, in all material respects, the financial condition and results of operations of the issuer.

The Section 906 reference to periodic reports clearly captures Forms 10-Q and 10-K.The term "periodic report," however, is not defined by U. S. securities law. Thus, a debate has arisen as to whether the Section 906 certification requirement applies to Forms 8-K containing earnings releases or financial statements. Because Form 8-K is not a "periodic report" (i.e., issuers are not required to file Form 8-K at regular intervals), a majority of issuers have taken the position that the Section 906 certification requirement does not apply to Form 8-K. The SEC has taken the position that the Section 302 certification requirement (see the discussion of Section 302 below) does not apply to Forms 8-K; however, the SEC has to date not released guidance on the Section 906 certification requirement at this time. Consequently, unless the SEC issues guidance indicating that the Section 906 certification requirement applies to Forms 8-K at some later date, we believe it is appropriate to assume that the Section 906 certification does not apply to Forms 8-K as well.

Under the Act those who provide a Section 906 certification knowing that the certification does not meet the criteria stated above may be fined up to $1 million and imprisoned for up to 10 years. Furthermore, those who willfully provide a Section 906 certification knowing that the certification does not meet the required criteria may be punished with a fine of up to $5 million and with a prison term of up to 20 years.

Section 906 is silent on how the certification is to accompany the periodic report. We have advised our clients that the certification can be filed as an exhibit to the periodic report as one means of complying with the provision.

Paul Hastings will issue a Client Alert providing a more detailed discussion of the effect the Section 302 and Section 906 certifications may have on securities litigation.

Except in very limited circumstances, public companies may no longer extend or arrange for personal loans and other forms of credit to directors and executive officers. Existing loans will be grandfathered but may not be renewed or materially modified.

Please refer to the Paul Hastings Client Alert Loan Prohibitions and Anti-Retaliation Provisions of the Sarbanes-Oxley Act of 2002 for a more detailed discussion of the prohibition of loans to directors and executive officers.

Beginning on August 29, 2002, directors, officers and 10% beneficial owners will be required to file Form 4 within two business days after a reportable transaction, as opposed to the current deadline of the tenth day after the month in which the transaction took place. Furthermore, based on SEC rulemaking, many transactions for which deferred reporting was available (i.e., reporting as of year end on Form 5) will now be reportable within the two business day period.

Please refer to the Paul Hastings Client Alert Accelerated Form 4 Reporting Requirements Under the Sarbanes-Oxley Act of 2002 for a more detailed discussion of accelerated reporting requirements.

The Act mandates that the SEC review "on a regular and systematic basis" the disclosures made by issuers. In order to determine the scheduling of reviews the SEC is required to consider the following factors:

• material restatements of an issuer’s financial results;
• significant volatility in an issuer’s stock price;
• issuers with a large market capitalization;
• emerging issuers with disparities in their price-to-earnings ratios; and
• issuers whose operations significantly affect any material sector of the economy.

Even though the SEC is required to consider the foregoing factors in the scheduling of reviews, the Act requires the SEC to review all issuers at least once every three years.

Pursuant to Section 302 of the Act, the SEC was required to adopt new rules requiring that the principal executive officer and the principal financial officer of an issuer make certain certifications in each annual and quarterly report filed with the SEC. On August 29, 2002, the SEC adopted new rules implementing the Section 302 certification requirement. Under these rules, the principal executive officer and the principal financial officer will be required to certify that:

• they have reviewed the applicable report;
• to their knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which they were made, not misleading;
• to their knowledge, the financial statements, and other financial information included in the report, fairly present in all material respects the financial condition, results of operations and cash flows of the issuer as of, and for, the periods presented in the report;
• the officers are responsible for establishing and maintaining "disclosure controls and procedures" to ensure that material information relating to the issuer, including consolidated subsidiaries, is made known to them by others within those entities, particularly during the period in which the periodic report is being prepared;
• the officers have evaluated the effectiveness of the issuer’s disclosure controls and procedures as of a date within 90 days prior to the filing date of the report ("Evaluation Date") and have presented in the report their conclusions about the effectiveness of the disclosure controls and procedures based on their Evaluation Date; and
• the officers have disclosed, based on their most recent evaluation, to the issuer’s auditors and the audit committee of the board of directors (or persons fulfilling the equivalent function) the following:

1. all significant deficiencies in the design or operation of internal controls which could adversely affect the issuer’s ability to record, process, summarize, and report financial data and have identified for the issuer’s auditors any material weaknesses in internal controls;
2. any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer’s internal controls; and
3. the officers have indicated in the report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of their most recent evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses.

"Disclosure and control procedures" represents new terminology not previously employed in U.S. securities laws and SEC rules and regulations. According to the SEC, it embodies controls and procedures that address the quality and timeliness of disclosure generally, as distinguished from the pre-existing concept of "internal controls" that pertains to financial reporting and control of assets.

Paul Hastings will issue a separate Client Alert discussing the Section 302 certification.

By January 26, 2003 the SEC must promulgate rules relating to the presentation of pro forma financial information. Specifically, the Act mandates that the SEC issue rules requiring any press release or report filed with the SEC to contain a reconciliation of the pro forma financial information contained in the press release or report with the company’s GAAP financial statements. Furthermore, the press release or report may not contain "an untrue statement of a material fact or omit to state a material fact necessary in order to make the pro forma financial information, in the light of the circumstances presented, not misleading."

The Act generally requires a plan administrator to provide individual account plan participants in certain types of employee benefit plans (e.g., participants in a 401(k) plan) with 30 days advance written notice of the implementation of a "blackout period." For this purpose, a "blackout period" occurs when an individual account plan participant is prohibited from making changes to his or her individual account investment elections for more than three consecutive business days where company stock is involved.

Furthermore, the Act prohibits directors and executive officers from purchasing or selling company stock during a "blackout period" applicable to individual account plan participants if the director or executive officer acquired the stock in connection with his or her service or employment as a director or executive officer. For such purposes, a "blackout period" is defined as a period of more than three consecutive business days during which an employer or a plan fiduciary temporarily suspends the ability of 50% or more individual account plan participants to transfer employer stock held in the plan.

The notice requirement and the prohibition on officers and directors purchasing or selling company stock during a "blackout period" go into effect on January 26, 2003.

Please refer to the Paul Hastings Client Alert Pension Reform Act I: Accounting Industry Reform Act Enacted; Next Step: Pension Reform Legislation for a more detailed discussion of black-out periods.

The Act mandates that by October 28, 2002 the SEC implement rules requiring issuers to state in their periodic reports whether or not they have adopted a code of ethics for senior financial officers (e.g., chief financial officer, comptroller, chief accounting officer) and the reasons for non-adoption, if applicable. The SEC must also implement rules requiring each issuer to immediately disclose on Form 8-K changes to or waivers of the issuer’s code of ethics.

The Act defines a "code of ethics" as the standards reasonably necessary to promote:

• honest and ethical conduct, including the ethical handling of actual and apparent conflicts of interest between personal and professional relationships;
• full, fair, accurate, timely and understandable disclosure in the periodic reports required to be filed by the issuer; and
• compliance with applicable governmental rules and regulations.

The SEC is required to implement rules requiring issuers to provide an internal control report as a part of their annual reports. Although the Act does not impose a deadline on the SEC to implement the rules on internal control reports, the Act does require that rules address the content of the internal control report. Specifically, the internal control report must:

• state that management is responsible for establishing and maintaining adequate internal control structures and procedures for financial reporting; and
• contain an assessment, as of the end of the most recent fiscal year, of the effectiveness of the issuer’s internal control structure and procedures for financial reporting.

In its annual audit report the issuer’s auditor is required to attest to the issuer’s internal control report.

By January 26, 2003 the SEC is required to issue rules providing that all quarterly and annual financial reports required to be filed with the SEC disclose all material off-balance sheet transactions, arrangements, obligations (including contingent obligations) and other relationships of the issuer with unconsolidated entities and other persons that may have a material current or future effect on the issuer’s financial condition, results of operations, liquidity, capital expenditures, capital resources or significant components of revenue or expenses.

The Act requires issuers to disclose to the public "on a rapid and current basis" certain additional information, as determined by the SEC, concerning material changes in the issuer’s financial condition or operations. The additional information must be presented in plain English and may include trend and quantitative information. The Act does not impose a deadline for the SEC to implement the rules regarding "real time" disclosure.

By July 30, 2003 the SEC (or if at the direction of the SEC, the registered securities associations or national securities exchanges) must adopt rules regarding conflicts of interests that may arise when analysts recommend equity securities in their research reports. The new rules will:

• restrict the pre-publication clearance of analysts’ research reports by investment bankers or other persons not directly responsible for investment research, other than legal or compliance staff;
• limit the supervision and compensatory evaluation of securities analysts to officials who are not employed in a broker’s or dealer’s investment banking activities;
• protect analysts from retaliation as a result of the analysts issuing negative or otherwise unfavorable research reports on companies that have a present or prospective investment banking relationship with the analysts’ employer;
• define periods during which brokers or dealers, who have participated or will participate in a public offering of securities as underwriters or dealers, may not publish or distribute research reports relating to the securities to be issued or to the company issuing them; and
• establish structural and institutional safeguards within registered brokers and dealers to assure that securities analysts are separated by appropriate informational partitions.

Additionally, by July 30, 2003 the SEC (or if at the direction of the SEC, the registered securities associations or national securities exchanges) must adopt rules requiring (i) analysts to disclose during their public appearances, and (ii) brokers and dealers to disclose in their research reports conflicts of interest that are known or should have been known at the time of the public appearance or at the time the report was issued. Such conflicts of interest include:

• the analyst’s debt or equity investments in the issuer that is the subject of the public appearance or research report;
• whether the analyst, broker or dealer has received any compensation from the issuer that is the subject of the public appearance or research report;
• whether during the prior year the issuer that is the subject of the public appearance or research report has been a client of the securities firm, and if so, the disclosure must state the types of services provided to the issuer; and
• whether the analyst received compensation with respect to the research report based on, among other things, the investment banking revenues of the securities firm.

The Act requires the establishment of an independent Public Company Accounting Oversight Board (the "Oversight Board") comprised of five members. The initial members of the Oversight Board must be appointed by the SEC no later than October 28, 2002, and the Oversight Board must be fully functional by April 26, 2003.

All accounting firms that prepare or issue (or participate in the preparation or issuance of) any audit report with respect to an issuer will be required to register with the Oversight Board. Accounting firms subject to registration will be required to register with the Oversight Board no later than October 23, 2003.

Once established the Oversight Board will be responsible for:

• establishing auditing, quality control, ethics, independence and other standards for registered public accounting firms;
• the registration of public accounting firms;
• conducting inspections of registered public accounting firms. Public accounting firms that provide audit reports for more than 100 issuers will be inspected annually. Public accounting firms providing audit reports for 100 or fewer issuers will be inspected at least once every three years; and
• investigating and bringing disciplinary proceedings against registered public accounting firms. The Oversight Board has the authority to levy sanctions against a registered public accounting firm. Sanctions may include revocation of the accounting firm’s registration, suspension or limitation of its auditing activities, as well as censure and monetary penalties.

The Act also mandates that the Oversight Board adopt certain rules. In particular, the Oversight Board must adopt rules requiring:

• registered public accounting firms to retain their work papers for at least seven years;
• the review and approval of each audit report by an independent second partner; and
• each audit report to contain a description of the public accounting firm’s testing of the issuer’s internal controls and the results of the testing of those internal controls - in particular any weaknesses in the issuer’s internal controls.

The quality control standards to be adopted by the Oversight Board must address a registered public accounting firm’s:

• monitoring of ethics and independence;
• consultation with the Oversight Board on accounting and auditing questions;
• supervision of audit work;
• hiring, professional development and advancement of personnel;
• acceptance and continuance of engagements; and
• internal inspection.

The following provisions of the Act apply to "registered public accounting firms." Because the public accounting firms required to register with the Oversight Board are not required to register with the Oversight Board until 180 days after the SEC determines that the Oversight Board is operational, the following provisions will not go into effect until public accounting firms actually register (or become required to register) with the Oversight Board.

Pursuant to the Act, the lead partner and the reviewing partner are prohibited from auditing the same issuer for more than five consecutive years. Furthermore, registered public accounting firms are completely prohibited from performing the following services for their audit clients:

• bookkeeping;
• financial information systems design;
• appraisal or valuation services;
• fairness opinions;
• actuarial services;
• internal audit outsourcing services;
• management or human resources functions;
• broker-dealer, investment banking or advising services;
• legal and expert services unrelated to the audit; and
• any other services prohibited by the Oversight Board.

Those non-audit services which are not prohibited by the Act must be preapproved by the issuer’s audit committee. Please see the section addressing audit committees, below, for a discussion of the audit committee preapproval requirement.

Additionally, a registered public accounting firm is prohibited from auditing an issuer if during the preceding one-year period the issuer’s CEO, controller, CFO, chief accounting officer or any person serving in an equivalent position was employed by the accounting firm and participated in the audit of the issuer.

In addition to prohibiting registered public accounting firms from rendering certain services to their audit clients and establishing the one-year "cooling off " period, the Act requires registered public accounting firms to timely report the following matters to the issuer’s audit committee:

• all critical accounting policies and practices;
• all alternative treatments of financial information within generally accepted accounting principles ("GAAP") that have been discussed with management, as well as the ramifications of the use of such alternative disclosures and treatments and the treatment preferred by the registered public accounting firm; and
• other material written communications (e.g., management letter, schedule of unadjusted differences) between the accounting firm and the issuer’s management.

The Act also requires that all financial statements that are prepared in accordance with (or reconciled to) U.S. GAAP and filed with the SEC to reflect all "material correcting adjustments" that have been identified by a registered public accounting firm.

By April 26, 2003, the SEC must direct the national securities exchanges and national securities associations to prohibit the listing of any issuer that fails to meet certain audit committee standards, including:

• independence¹ - an audit committee member may not have any affiliation with the issuer or any subsidiary of the issuer other than in his or her capacity as a board or committee member of the issuer, and members may not receive any consulting, advisory or other compensatory fee, other than normal and customary director’s fees;
• authority - the audit committee must be directly responsible for the appointment, termination, compensation and oversight of the issuer’s auditors;
• oversight - the audit committee must establish procedures for (a) the receipt, retention and treatment of complaints about accounting, internal auditing controls or auditing matters and (b) the anonymous submission by employees of concerns regarding auditing matters.

Beginning on January 26, 2003, issuers must disclose in their SEC reports whether their audit committees include a "financial expert." The criteria for determining whether a person is a "financial expert" will include such individual’s understanding of GAAP financial statements, the application of GAAP principles in connection with the accounting for estimates, accruals and revenues, experience in the preparation or filing of financial statements of comparable companies, experience with internal auditing controls and understanding of audit committee functions.

Furthermore, an issuer’s audit committee must preapprove all auditing services, including comfort letters to be provided in connection with securities offerings, and non-audit services provided by the issuer’s "auditor." The fact that the Act says "auditor," not "registered public accounting firm" means that the preapproval requirement went into effect on July 30, 2002, rather than the future date when public accounting firms will be required to register with the Oversight Board. The Act also contains a de minimis exception to the audit committee preapproval requirement with respect to certain non-audit services. If the non-audit services meet the following requirements, then the issuer may avail itself of the de minimis exception:

• the aggregate amount of all such non-audit services together constitute not more than 5% of the total fees paid by the issuer to the auditor during the fiscal year in which the non-audit services are rendered;
• at the time of the engagement the services were not recognized by the issuer to be non-audit services;
• the services are promptly brought to the attention of the audit committee; and
• the services are approved by the audit committee prior to the completion of the audit for that year.

The audit committee may delegate the authority to approve audit and non-audit services to one or more independent members of the audit committee.

The audit committee’s approval of audit and non-audit services must be disclosed in the issuer’s periodic reports.

Although certain exemptions from the Act for foreign issuers were discussed, the final Act makes virtually no distinction between U.S. based companies and foreign companies whose shares have been offered for sale and trade in the U.S. Although the Act applies to foreign private issuers, the Act does not alter foreign private issuers’ exemption from Section 16 of the Exchange Act. Consequently, the accelerated reporting of insider transactions mandated by the Act does not apply to foreign private issuers.

The Act requires foreign public accounting firms that audit companies trading in the U.S. to register with the Oversight Board. More specifically, registration is required if the foreign accounting firm prepares or furnishes (or, if required by Oversight Board implementing regulation, plays a substantial role in the preparation or furnishing of) audit reports for one or more public companies trading in the U.S.

The Oversight Board will have the authority to regulate such foreign accounting firms to the same degree the Oversight Board may regulate registered U.S. accounting firms. Furthermore, foreign accounting firms that are required to register with the Oversight Board will be subject to the jurisdiction of U.S. courts for controversies between the accounting firm and the Oversight Board. The Oversight Board and the SEC may also require a foreign accounting firm that is subject to registration to produce its audit workpapers in connection with an investigation of an audit report.

If an issuer is required to make an accounting restatement due to material noncompliance with any financial reporting requirement under the securities laws and the noncompliance was a result of misconduct (the term "misconduct" is not defined in the Act), the CEO and the CFO of must reimburse the issuer for:

• any bonus or equity-based compensation received during the 12-month period following the first public issuance or filing of the report being restated; and
• any profits realized from the sale of the issuer’s securities during that same 12-month period.

The Act gives the SEC the power to seek a court order to bar an individual from serving as an officer or director of an issuer if the individual’s conduct demonstrates "unfitness" to serve as an officer or director of an issuer. This is a change from prior law which required the SEC to show that an individual’s conduct demonstrated "substantial unfitness" to serve as an officer or director of an issuer.

The Act provides that individuals who knowingly retaliate against whistleblowers may be fined and imprisoned for up to 10 years. Furthermore, the Act provides employees who are retaliated against as a result of whistleblowing with a civil cause of action for money damages.

Please refer to the Paul Hastings Client Alert Loan Prohibitions and Anti-Retaliation Provisions of the Sarbanes-Oxley Act of 2002 for a more detailed discussion of the protection of whistleblowers.

The destruction of documents in order to obstruct a federal investigation or bankruptcy proceeding is punishable by fines and imprisonment of up to 20 years. Accountants who audit issuers may be fined and imprisoned for up to 10 years for knowingly and willfully failing to maintain all audit or review workpapers for a period of five years after the end of the fiscal period in which the audit or review was conducted.

The Act amends the Bankruptcy Code to provide that liabilities for securities law violations and common law fraud in connection with the purchase or sale of a security are not dischargeable in bankruptcy.

Under the Act, anyone who knowingly executes or attempts to execute a scheme to:

• defraud any person in connection with the securities of an issuer, or
• obtain, by means of fraud, any money or property in connection with the purchase or sale of the security of an issuer,

may be fined or imprisoned for up to 25 years.

• The statute of limitations for private rights of action involving claims of securities fraud are extended to the earlier of (i) two years after the discovery of the facts constituting the fraud or (ii) five years after the fraud.
• The criminal penalties section of ERISA is amended to increase the maximum fine from $5,000 to $100,000 and to increase the maximum prison term from one year to 10 years.
• The criminal penalties section of the Exchange Act is amended to increase to increase the maximum fine from $1 million to $5 million and to increase the maximum prison term from 10 years to 20 years.
• The federal mail and wire statutes are amended to increase the maximum prison term from five years to 20 years.
• The Act provides that the SEC may obtain in its enforcement proceedings any equitable relief that may be appropriate or necessary for the benefit of investors.
• The Act imposes the same degree of criminal liability for attempting or conspiring to commit certain crimes as if the underlying crime had been committed.
• During the course of an investigation into possible violations of the securities laws the SEC has the authority to seek an injunction to freeze and hold in escrow for 45 days extraordinary payments that appear likely to be made by an issuer to certain insiders.
• The Act makes it unlawful for an officer or director of an issuer (or any person acting under the direction of an officer or director) to fraudulently coerce or mislead an accountant engaged in an audit of the issuer "for the purpose of rendering such financial statements materially misleading."
• In any proceeding in which the SEC obtains a judgment or settlement that includes disgorgement and a civil penalty, the SEC may add the civil penalty to a disgorgement fund for the benefit of the victims of the securities law violation.

The following is a sample list of steps which we recommend companies undertake currently in order to ensure compliance with the Act. The list is non-exhaustive, and each company should carefully craft a list of action items specifically tailored to the environment in which the company operates.

• Assess whether all members of the company’s audit committee (and a majority of board of directors as a whole) are independent under the standards for independence set forth in the Act, as well as the standards promulgated by Nasdaq or the exchange on which the company’s securities are traded. In conjunction with the assessment of the independence of the audit committee, the company should also evaluate the financial expertise of each of the members of the audit committee.
• The company’s audit committee and executive officers, in conjunction with the company’s independent auditors, should assess the effectiveness of the company’s internal controls and implement a plan to correct any weaknesses identified. Furthermore, the company’s audit committee and executive officers should establish procedures for performing the quarterly review of the company’s "disclosure controls and procedures" mandated by the Act.
• The company should assess its Section 16 filing procedures in order to ensure that directors and officers comply with the accelerated deadlines for reporting insider transactions.
• The audit committee should review the types of non-audit services provided by the company’s independent auditor and assess whether any of those services are among the prohibited services enumerated in the Act. Furthermore, the audit committee should give its approval for those audit services and permitted non-audit services that the company’s auditor will provide.
• The company should consult with its benefits counsel to review the company’s benefit plans in order to ensure that the plans comply with the Act’s restrictions on blackout periods.
• The company, in conjunction with its outside counsel, should evaluate the adequacy of its existing code of ethics in light of the Act, as well as the code of ethics requirements imposed by Nasdaq or the exchange on which the company’s securities are traded. If the company does not have a code of ethics, the company and its outside counsel should prepare and implement a code of ethics.
• Given that the Act has substantially modified the legal landscape, the company, in conjunction with its insurance broker, should review its directors and officers liability insurance coverage in order to ensure that there are no gaps in coverage and that the policy limits provides adequate protection.