SEC Proposes Rules Implementing Provisions of the Sarbanes-Oxley Act of 2002

Today, the United States Securities and Exchange Commission ("SEC") approved the proposal of several rules implementing the Sarbanes-Oxley Act of 2002. These proposed rules will be included in two SEC releases to be issued shortly and posted on the SEC website. The first release includes rules proposed under Sections 404 (Management Assessment of Internal Controls), 406 (Code of Ethics) and 407 (Audit Committee Financial Experts). The second release covers Section 303 (Improper Influence on Conduct of Audits). This summary is based on information provided at the SEC's open meeting and therefore may not reflect nuances that appear in the official text.

The SEC has indicated that comments will be collected for 30 days following publication of these proposals in the Federal Register.

1. Management Assessment of Internal Controls.

The SEC proposed rules to implement Section 404 of the Sarbanes-Oxley Act, which requires that annual reports mandated by Section 13(a) or 15(d) of the Securities Exchange Act of 1934 contain an internal control report.

Under the proposed rules, every annual report filed with the SEC will have to include an internal control report that: (1) states the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) contains an assessment by management, as of the end of the issuer's most recent fiscal year, of the effectiveness of the internal control structure and procedures. In addition, the issuer's outside auditor will be required to attest to, and report on, management's evaluation of the issuer's internal controls and procedures for financial reports.

According to SEC Chief Accountant Robert Herdman, the proposed rules will have a profound impact on how audits are performed, requiring auditors to undertake more detailed testing of internal control procedures. He expects that significant training by accounting firms may be required to comply with the new rules. Mr. Herdman also noted that specific standards for the required auditor attestations will be provided by the new Public Company Accounting Oversight Board.

The SEC has indicated that it will harmonize its Section 404 requirements with the internal control certifications mandated by Section 302 of the Act. Based on today's discussion, it appears that the internal control report required by Section 404 will satisfy the Section 302 certification requirement for annual reports on Form 10-K. In addition, the SEC press release issued today indicates that the proposed rules will require companies to conduct quarterly evaluations of their internal controls and procedures for financial reporting. A modification of the rules previously adopted under Section 302 will be included in the release.

At the open meeting today, Chairman Harvey Pitt pointed out that the proposed rules do not specify detailed criteria for internal control procedures. Instead, the SEC intends for each issuer's management to have the flexibility to tailor its internal control structure and processes to individual circumstances. The proposal does, however, make reference to the definition of internal controls in current auditing standards. (See Statement on Auditing Standards No. 78 (AU 319), amending Statement on Auditing Standards No. 55.)

In response to a question from Commissioner Roel Campos, staff from the SEC's Division of Corporation Finance stated that they plan to monitor changes in internal controls disclosed by issuers. They also are looking into ways to "target review" compliance with this and other Sarbanes-Oxley Act requirements.

2. Code of Ethics.

The SEC also proposed rules implementing Section 406 of the Sarbanes-Oxley Act, which requires disclosure about company codes of ethics. The proposed rules, which go beyond the requirements of Section 406, require an issuer to disclose in its annual report whether or not it has a code of ethics applicable to its chief executive officer and senior financial officers. An issuer that has adopted a code of ethics must attach a copy of that code as an exhibit to its annual report on Form 10-K. Issuers that have not adopted a code of ethics must disclose their reasons for failing to do so.

Significantly, a question will be included in the proposing release - specific enough that it may be adopted without re-proposal - asking whether the code of ethics requirement should be expanded to cover a broader class of officers and even directors.

The proposed rules define a code of ethics as a "codification of standards" that is reasonably necessary to deter wrongdoing and promote honest and ethical conduct; avoidance of conflicts of interest; full, fair, accurate, timely and understandable disclosure in public reports; compliance with applicable laws; the prompt internal reporting of code violations; and accountability for adherence to the code.

The proposed rules will require the prompt disclosure of any change in or waiver of an issuer's code of ethics. This disclosure may be made by a Form 8-K filing or by publishing a statement on the issuer's website. However, issuers who elect to disclose this information on their websites must give advance notice of that election in their annual reports on Form 10-K. They also must disclose the specific website address where the code of ethics information may be found.

Commissioner Campos questioned whether an issuer will be required under the proposed rules to disclose "post-hoc" waivers of its code of ethics. For example, an issuer's board may decide - after learning of a material violation of the code of ethics - not to sanction the offender or enforce the code's disciplinary provisions. According to Commissioner Campos and Division of Corporation Finance staff, the proposed rules would require the issuer to disclose this "after-the-fact" waiver on Form 8-K or the issuer's website.

Finally, foreign issuers will be required under the proposed rules to disclose annually, on Form 20F, whether or not they have adopted a code of ethics. Because foreign issuers are not required to file current reports (similar to Form 8-K) under U.S. law, the press release indicates that they should disclose modifications to and waivers of their codes in their periodic reports or on their websites.

3. Audit Committee Financial Experts.

The SEC also proposed rules implementing Section 407 of the Sarbanes-Oxley Act, which requires annual disclosure regarding the identification of audit committee "financial experts." Under the proposal, an issuer must disclose whether or not its audit committee is comprised of at least one member who is a financial expert, as defined by the proposed rules. If an issuer's audit committee does not have a financial expert, the issuer must explain why not. The proposed rules also require the issuer to disclose the number and names of the "financial experts" serving on its audit committee. Finally, the issuer must disclose whether the financial expert or experts serving on its audit committee are "independent" of management.

The proposed rules define the term "financial expert" to require such a person to have all of the attributes listed in Section 407, including an understanding of generally accepted accounting principles and financial statements, experience in the preparation or auditing of financial statements, experience with internal accounting controls, and an understanding of audit committee functions. Thus, it appears that the definition of "financial expert" in the proposed rules will be significantly narrower than the definition reflected in current New York Stock Exchange ("NYSE") and NASDAQ listing standards. Division of Corporation Finance Director Alan Beller acknowledged that there will be tension between the proposed rules and current market listing standards, noting that Section 407 "raises the bar higher" than what is required by existing standards. He indicated that the SEC will work with the NYSE and NASDAQ to reconcile these differences.

The proposed rules implementing Section 407 will apply to foreign issuers. Mr. Beller indicated that a foreign issuer may consider a proposed expert's familiarity with foreign accounting standards if the issuer does not use U.S. Generally Accepted Accounting Principles to prepare its financial statements.

4. Improper Influence on Conduct of Audits.

The second release approved today includes proposed rules implementing Section 303 of the Sarbanes-Oxley Act, which bars an issuer's officers and directors (and persons acting under their direction) from taking any steps to fraudulently influence, coerce, manipulate or mislead any independent accountant engaged in the performance of an audit of that issuer's financial statements.

The statute forbids officers and directors from taking steps for the purpose of rendering financial statements materially misleading. At today's meeting, however, the commissioners discussed proposing a rule prohibiting officers and directors from taking actions that they "know" or "are unreasonable in not knowing" will render financial statements misleading. This language reflects Chairman Pitt's comment that there should not be a "scienter test" for violations of Section 303.

Chairman Pitt also requested that the release solicit comments on applying the proposed rules to anyone acting "at the behest or on behalf" of officers or directors, rather than just persons acting "under the direction" of officers or directors. In addition, the Chairman proposed that the term "fraudulently" be replaced with the word "improperly," suggesting a lower threshold for liability.

Copyright © 2002 Gibson, Dunn & Crutcher LLP