United States: The Perplexity and Perversity of the New Lawyer Conduct Rules©†

Sarbanes-Oxley Act (SOx) § 307 is a fact of life, as are at least the first round of the rules required by it—now codified at Part 205 of Title 17 of the CFR.¹ Unfortunately, those rules are unnecessarily perplexing (given their relatively modest goals), far more intricate than they need be, and almost certain to be perverse in at least some of their effects. In some respects, of course, these conclusions may be premature. If what has come to be called the "dirty withdrawal" requirement is ultimately adopted (whether in a clear or thinly disguised format), the stakes are significantly higher, and some of the issues that seem unnecessarily complex now may appear to be more (or, in some instances, even less) reasonable. Nonetheless, we cannot always wait to see if the other shoe drops.

Consider the following:

1. SOx § 307 was adopted in response to a Congressionally perceived need to change the manner in which corporate and securities advisors counsel their corporate clients. To the extent the new rules actually affect lawyers’ behavior, however, they are far more likely to influence practitioners with legal specialties other than the providing of such advice.
2. While the new rules probably won’t affect the behavior of corporate and securities advisors, as a practical matter they may well result in a reallocation of decision-making authority from clients to lawyers, which is fundamentally counter to normal processes in a capitalist system, and should be highly offensive to corporate clients.
3. Many argue that "the problem"—assuming (as has not been legitimately established) that there is significant lawyer responsibility for the chain of frauds that led to Sox²—is the result of structural changes in the relative roles of inside and outside counsel to the corporation. Yet the new rules are likely to exacerbate that problem.
4. While the new rules may not affect behavior, they almost certainly will increase the frequency with which lawyers face disciplinary exposure as a result of the misdeeds—or claimed misdeeds—of their clients.
5. Most of the perplexing issues inherent in the new rules—and there are many—are likely to be "resolved" in proceedings that are settled rather than litigated and adjudicated, even though they affect fundamental issues of the relationship between lawyers and their clients.

These five claims warrant—perhaps demand —justification. It will follow, but first a somewhat less inflammatory analysis: for the most part, the new rules (absent noisy withdrawal) will probably do little harm, and may even provide some marginal social benefits. While the rules in their entirety are intricate and complex, their fundamental thrust can be easily stated, and for the vast majority of corporate/securities practitioners, in the vast majority of instances, easily applied:

But there is an unfortunate corollary:

Following the fundamental mandate identified above is unlikely to affect the practice of most corporate advisors for the simple reason that there already are incentives aplenty for lawyers to avoid being present at a scene that they perceive to involve fraudulent conduct. If what happened in the market to Enron (or others) had been anticipated, it could equally have been anticipated that the lawyers representing the involved companies would encounter financial burdens (not to mention potential exposure to liability) well in excess of fees received. The reason such law firms proceeded as they did seems almost certainly to be that they simply did not perceive what now, in retrospect, appears obvious. Put differently, is it conceivable that those firms, now, are pleased that they took on the Enron representation? Is there any particular reason to think that more explicitly identifying an undesirable consequence of having the wrong client in the wrong situation will make lawyers more adept at recognizing those risks? And if the risks are not perceived by the lawyers involved, no amount of rulemaking will likely succeed in affecting their behavior.

In short, it won’t be lawyers’ imperviousness to consequences that makes the new rules ineffective. Rather, new rules are not likely to provide much additional impetus simply because lawyers are already aware of sufficient adverse consequences. They may affect sensitivity to some of the concerns that generated the rules, but in the post-Enron, post-Anderson, post- WorldCom, post-Adelphia, post-Tyco world, such sensitivities were already on high alert.

Curiously, the impact of the new rules may be far greater on those who represent public companies in a capacity other than as corporate or securities counsel. Corporate advisors are to some degree accustomed to thinking about whether their clients pose the sorts of risks that are the subject of the new rules, and are accustomed to thinking (typically in consultation with general counsel) about the kinds of issues that should be brought to the attention of the Board of Directors, Audit Committee, etc. But those who represent corporations in material litigation, the conduct of internal investigations, the design of compensation, and in other capacities—all of which may arguably bring them within the definition of "appearing and practicing before the Commission" —may well, if unsuspectingly, be subject to the mandates of the new rules.

At first blush, even that may not appear troublesome. If I am representing a corporation in litigation, and in the course of depositions I learn that the company’s exposure is far greater and far more likely than had been anticipated, there is at least some basis in existing practice to charge me with a responsibility to be aware of the corporation’s related disclosure obligations, to raise the issue with the general counsel if necessary, and to appeal to the board (or audit committee) if I am dissatisfied with the corporation’s treatment of the issue. But what if the information of which I "become aware" (the language of the rules) during a deposition relates to a violation of law that has nothing whatever to do with the case I am handling? What if, in a case involving a contract dispute, the answer of a corporate officer to a question in a deposition leads me— or should lead any reasonable lawyer—to believe that the company has committed an entirely unrelated violation of the Foreign Corrupt Practices Act? Under the rules, the same standards appear to apply. If the evidence is credible (which seems likely in a deposition) and material (by hypothesis, here) I have a duty to report to the general counsel and to initiate the investigatory and reporting process envisioned by the rules.

Some would no doubt argue that such a result is appropriate. But is it within the litigator’s perception of her role? Is it the kind of thing that she will be attentive to when representing the corporation in the contractual litigation? If not, there is at least some risk that occasions will arise in which lawyers become subject to SEC (and possibly even criminal) sanctions as a result of (mis)conduct that may have come to their awareness in some sense, but to which we should not expect them to have sensitivity. The same can be said of the compensation expert drafting a contract that will be an exhibit to the corporation’s SEC filings, the labor lawyer drafting a collective bargaining agreement, or any of a number of other legal specialists.³ The SEC would never, of course, bring an action against a lawyer under these circumstances. That is, unless the SEC had some other good reason—at least in its judgment—for wanting to visit sanctions on the lawyer. But it was fear of such governmental judgments that caused John Adams to recognize the need for "a government of laws, and not of men."⁴ While we have wandered fairly far from that admonition— some have argued that in the post-SOx world, all corporations and officers are continuously guilty of at least some legal violations, and the only remaining questions are those of prosecutorial discretion—we should not be comfortable with such wanderings.

While it is not at all clear that there is significant lawyer responsibility for the litany of corporate failures that gave rise to SOx, it is undeniable that there is a general perception of lawyer responsibility. Some have suggested that the core of the problem is increased internalization of the legal function. Because of internalization, it is thought, there is a decline both in the frequency with which SEC filings are reviewed by outside counsel, who often have greater specific expertise, and in the degree to which any one outside law firm knows the various activities and involvements of the corporation that must be disclosed. Thus, as a result of circumstance much more than intent, it is thought that corporate filings may be less well considered, with the result that cancers spread further and more readily, without the curative effects of disclosure, than may previously have been the case.

If that is indeed the problem (or at least a problem), an additional perverse aspect of SOx § 307 and the new rules is that they are quite likely to exacerbate the problem. First, they may well drive the relevant aspects of public company representation further in house. From the general counsel’s perspective, the new rules present a risk of an uncontrolled escalation of reports and investigations. When a matter is turned over to a law firm, it may be far too easy for information that appears on the surface to be troublesome (but that does not in fact reflect a violation of law) to be turned into a report, requiring an investigation and perhaps further action. Inside counsel may be understandably loathe to set those processes in motion, and may prefer to retain control of workflow within the department where lawyers are likely to be sensitive to the difference between real and imagined issues. Second, as to those matters that are referred to outside counsel, inside counsel may prefer to direct issues away from customary securities counsel. Such lawyers may well be better positioned to argue that they are not "appearing and practicing" before the Commission (so that reporting obligations will not arise). Should such a pattern emerge, it will clearly increase the balkanization of legal representation.

From the perspective of outside counsel, undertaking any broad-based inquiry regarding corporate information—as a 10-K report certainly should be—carries with it a heightened risk that the firm will come across "evidence of a material violation" in a situation where the lawyer is unquestionably appearing and practicing before the Commission. Without increased fees to compensate for the increased risk, many outside firms may well be reluctant to seek or encourage such representation.

In short, the new rules likely will prompt a decline, at least at the margin, in the frequency and thoroughness with which a public company’s SEC filings are reviewed by an outside law firm that is fully conversant with the issues generally facing the company.

For the reasons indicated, the new rules are not likely to have much affect on the behavior of those corporate and securities advisors to whom they were directed. That does not mean, however, that they will not impinge on those lawyers. In fiscal 2002, the SEC initiated 598 enforcement cases. In some significant number of those cases, the respondents were issuers of Exchange Act registered securities, and thus were SOx "issuers". It seems likely that, with the clarity of hindsight, in the vast majority of those cases, there would have been facts that came to the attention of some lawyers who were "appearing . . . before the Commission." It also seems reasonable to expect that in many of those cases, there was no report from the lawyer that went through the Part 205-mandated steps (which were not, of course, yet mandated). Those would appear to be sufficient facts to establish a basis for lawyer discipline under the new rules, and one can expect the SEC’s Enforcement Division to be on the lookout for just such cases. Thus, over the next several years, the new rules will provide the basis for sanctions when clients’ missteps are not detected, or are not sufficiently addressed. In the near term, debate over the new rules will revolve around the question "what are we supposed to do?" For corporate and securities advisors, that will lead to greater sensitivity, perhaps, but not much difference in routines and practices. In the longer term, the debate will be over the application of a difficult set of rules to actual practices; they will prove fodder for the enforcement litigation practice. From the perspective of the legal system, three other unfortunate aspects of the current process will then come into play. First, most of the proceedings that will be brought against lawyers will be settled, just as most other SEC actions are ultimately resolved through settlement. Second, the settling lawyers will understandably be concerned with the resolution of their own cases, not with what is socially desirable, while the SEC will focus on the impact of each case on the overall program of the Commission. Finally, the SEC will continue to view settled cases, and the statements of the law embedded in them, as "precedent" governing future interpretations of the rules.⁵

The "QLCC," of course, is the new board committee, first suggested in the proposed rules and embedded in the final rules. The QLCC ideally is formed of independent directors to consider reports from attorneys who have become aware of "credible evidence" of a "material violation." Good idea or not? If there is no dirty withdrawal obligation, there seems little reason for a company to form a QLCC. Without getting into the linguistic analysis of whether a QLCC might have to have an obligation to report out where nobody else would,⁶ the advantages of having such a committee, when the only required response to a report is to investigate and, if necessary, make sure decisions are made at the board (or audit committee) level, seem insufficient to warrant the added level of board complexity. If some form of noisy withdrawal requirement is adopted, however, the cost-benefit analysis changes. From counsel’s perspective, the QLCC is a useful device to eliminate the potential obligation to report a client to the SEC. From the perspective of independent directors, it is a potential added burden. From the corporation’s perspective, it keeps the decision-making authority closer to the corporation (although the body of independent directors may be the internal corporate constituency whose personal cost benefit analysis is least well synchronized with that of the corporation and its shareholders). How those factors will be weighed in different corporations is at this stage unpredictable. An interesting question, but one that seems sufficiently unusual that it may never get resolved, is what exposure the members of a QLCC might actually have. Assume a QLCC has been formed with a clearly-defined duty to report violations to the SEC in the absence of an appropriate response (for argument’s sake assume also that a noisy withdrawal requirement, in one variant or another, has been adopted). Now, assume a violation, an absence of any appropriate response, and a clear failure by the QLCC to satisfy this charter-imposed reporting duty. What liability do the QLCC members have, and to whom?

The rules exist under the SOx requirement to adopt standards for the professional conduct of attorneys. Will that statutory base support discipline against corporate directors who fail in what would ordinarily be a state-law duty? Does the § 205.7(a) denial of private rights of action in the new rules (assuming it is valid—discussed below) apply here? Are there damages to the corporation that would support a derivative action? Or is this a violation without a remedy?

Let’s turn to some of the more difficult issues embedded in the new rules. In most instances, these issues—like the rules in general—are not important for corporate and securities practitioners. The "safer" answer will generally be apparent, and (at least for now) the mandates of the rules are not particularly onerous. For one in the position of establishing the facts, compliance will be the preferred course. Resolution of these issues is therefore likely to await enforcement actions, or civil cases, when lawyers are defending the course that was taken rather than deciding what course to take.

The new rules suggest that the only potential consequences of a violation are those that might result from SEC enforcement action,⁷ and specifically negate any private right of action.⁸ That is important, for there is reason to expect that the Commission will not authorize action in inappropriate cases.

However, while it would seem that the negation of private rights of action should be effective,⁹ arguments to the contrary are being voiced. The SEC may have the authority to exempt activities or classes of persons from statutory and regulatory obligations that would otherwise exist, it is said, but the courts, not the SEC, have the exclusive authority to determine who has rights against those who violate the laws and rules, and what remedies are available to them. Harking back to Cort v. Ash¹⁰ and its progeny, it would seem the better view that the provisions were not adopted for the "especial benefit" of investors when the Congress has delegated authority to the Commission and the Commission has determined that investors should not have individual causes of action, but the point likely will be argued in court. The possibility of criminal action should also not be ignored. While the new rules are silent on the issue, SOx itself provides that a violation of SOx, or of Commission rules adopted under it, is to be "treated for all purposes in the same manner as a violation of the Securities Exchange Act of 1934 . . . or the rules and regulations issued thereunder . . . and any such person shall be subject to the same penalties, and to the same extent, as for a violation of that Act or such rules or regulations."¹¹ The precise meaning of that provision may not be entirely clear, but since some provisions of the Exchange Act give rise to criminal liability, the potential for criminal exposure under SOx § 307 and the new rules cannot be blithely dismissed.¹²

One of the points on which the new rules have been most heavily criticized is the double negative definition of "evidence of a material violation," awareness of which triggers an attorney’s obligation to make a report. That criticism is probably too simplistic; double negatives may serve a purpose and that is not the real problem. A far more important criticism is that the rule is simply difficult to understand. "Evidence of a material violation" is defined as "credible evidence, based upon which it would be unreasonable, under the circumstances, for a prudent and competent attorney not to conclude that it is reasonably likely that a material violation has occurred, is ongoing, or is about to occur." The phrase "unreasonable . . . for a prudent and competent attorney not to conclude" suggests a quite high standard. It appears to mean, by its terms, that no prudent and competent attorney, acting reasonably, could conclude otherwise. But it is adjacent to "reasonably likely," a standard that the SEC views as quite a bit lower.¹³ The definition would appear to be roughly translatable as "Every reasonable attorney would conclude that there is at least some possibility that a violation has occurred." How that standard might be applied in practice is quite difficult to predict.

At least equally important is the context in which this definition will be interpreted—by hypothesis, a situation in which a violation has in fact occurred, because that is what will have generated the enforcement action that causes the SEC to look at the lawyer’s conduct. So the lawyer who seeks to establish that he did not become aware of credible evidence of a material violation will be trying to do so in the light of a then-existing conclusion that a material violation did occur. Under those circumstances, the argument will not easily carry the day.

It is particularly important to note that once a lawyer is "appearing and practicing" before the Commission with respect to an issuer, if that lawyer becomes aware of credible evidence of a material violation, the rules’ duties spring into existence. There is no required nexus between the representation of the issuer and the source or subject matter of the information. That is, if the lawyer who is so appearing and practicing receives information that is credible (and otherwise meets the standards) from any source at all—including, for example, in casual conversation with a neighbor (not an officer or director of the client)—about a material violation of any nature at all, the duties arise.

This duty suggests a host of potential difficulties. In as inter-related a commercial world as we now have, it is not unusual for lawyers and law firms to appear in a role that is in some sense adverse to an existing client with the client’s consent. Bank lawyers may represent borrowers from their bank clients; underwriters’ counsel may have represented issuers in offerings of the same managing underwriter; litigation counsel periodically retained by insurance companies may also represent claimants against those carriers or their affiliates. In many such situations, it has become routine for the clients to consent to the actual or potential conflicts and to waive their rights to object.

How, then, should counsel treat evidence when it is received in the context of such a representation? Specifically, assume a lawyer often represents client A, for whom she "appears and practices before the Commission." Now assume, with A’s consent, she represents B in a matter adverse to A. (Of course, neither she nor her firm represents A in that matter.) As she develops evidence in her case for B, is she supposed to report it to the chief legal officer of A? Certainly it would seem that the new obligations should not be stretched so far, but there is no provision in the rules to suggest otherwise. To some extent, firms may face this dilemma whenever they receive information from one client that suggests a material violation by another client; it will prove particularly troublesome if the information is received from the first client in a privileged context.

The handling of fiduciary duties in SOx and in the rules is extraordinarily difficult. SOx § 307 provides that the SEC’s rules are to address the situation of lawyers who have "evidence of a material violation of securities law or breach of fiduciary duty or similar violation by the company or any agent thereof." This reference to a fiduciary breach "by the company or any agent" appears to refer to a duty that the company breaches, or that an agent, acting in an agency capacity, breaches. While we ordinarily think of a director’s duties when we hear such language, the commonly considered breaches of a director’s fiduciary duty arise out of the relationship between the director himself and the shareholders. They are not breaches of an agent of the corporation to the shareholders. Thus, SOx itself probably does not well state what the Congress would seem to have intended.

The Commission, in the rules, implicitly corrected the Congress: the rules refer to breaches by a director or officer of a duty to the corporation. But the application of that apparently sensible principle rapidly descends into incomprehensibility. If it is a violation of this nature that an attorney, representing an issuer, becomes aware of, it is a violation that is not being perpetrated by the issuer. Indeed, the issuer/client is the victim of the wrong in the SEC’s formulation. So why should an attorney, finding a violation by someone not the issuer (and, therefore, not his client) have a securities law imposed duty to report that violation to the issuer’s chief legal officer? And why should the chief legal officer have a securities-law imposed obligation to investigate it?

These concerns are theoretical, of course. There is no harm in the lawyer reporting it or in the CLO investigating it; the question is merely why those processes warrant a mandate under the federal securities laws. More disconcerting is defining an "appropriate response" in these circumstances. The issuer has no particular power to correct or remedy the violation. Is the business judgment rule to be abandoned and the board to be given a clear obligation to initiate litigation against the officer or director? That hardly seems a result that the Congress was seeking, but what other "appropriate response" might there be?

Assume the violation is a violation of the insider trading laws—clearly implicating a breach of a fiduciary duty. What is required as an appropriate response? Reporting the violator to the criminal authorities? Seeking private disgorgement? Dismissal? We have, under the rules, no guidance whatever.

One of the important exemptions from the attorney’s reporting requirement is that provided for a board-authorized investigation.¹⁴ If the board (or a committee) consents to an investigation, then conducting an investigation and receiving advice that the investigating attorney can maintain a colorable defense of the conduct is itself an "appropriate response" to the report of a violation. The rule is unclear, however, as to whether the board authorization must be in response to the specifically reported evidence, or whether a blanket authorization, adopted (for example) at the beginning of the year, would suffice for any subsequently-reported violations. The SEC Staff has informally indicated that the latter was not intended, but it would appear to be within the language of the rule.

The Commission has clearly indicated that the new rules’ authority to report violations to the SEC—even though not (at least yet) mandated —is intended to preempt conflicting provisions of state law, including state bar codes, that would prohibit reporting out.¹⁵ Is it effective in that regard? State laws prohibiting disclosure are not "in conflict with" the federal rule authorizing disclosure in the usual sense that a lawyer cannot comply with both. In this context, satisfying the state disclosure prohibition does not create a risk of violating the federally authorized disclosure. Thus, the SEC would be reaching out (and without clear congressional authority) to pre-empt a non-conflicting state rule. In these circumstances, it seems unlikely that the rule’s permissive language would be interpreted as creating a preemption of state law when there is no true conflict;¹⁶ more likely, the interaction would be read as leaving the attorney with a nondisclosure duty to the client.

The concerns suggested above are what currently appear to be the rules’ most difficult interpretive issues, but they are far from the only issues and, as we experience unanticipated factual settings, may prove not to be the most important. Certainly others exist.

The statute, SOx § 307(1), provides that the rules are to require that a report be made "to the chief legal counsel or the chief executive officer." In contrast, the rules do not permit reporting to the chief executive officer alone. There is no apparent reason for this alteration, and its effect is unclear. At the other extreme, what if the chief executive officer and the chief legal officer both appear to be complicit in the wrongdoing?

While the rules make no provision for outside counsel going directly to the audit committee or a QLCC if one exists, it would seem, since that is the ultimate goal in the case of no appropriate response, that counsel should escape sanction if suspected wrongdoing were reported directly to the higher authority rather than through the rule-sanctioned, but tainted, channels.

Presumably (although this is decidedly not what the language of the rule provides) the chief legal officer may order remedial action immediately upon receiving a report without causing an "inquiry" to be undertaken where the report, together with her existing knowledge, is sufficient to compel the conclusion that there is a problem. On the other hand, one could imagine a situation in which the reported problem is corrected, but an investigation, if one had been undertaken (as the terms of the rule require) would have disclosed additional, more severe violations. What then?

The language of § 205.3(b)(3)(iii) appears to suggest that reporting to the full board is not acceptable (notwithstanding the contrary language of SOx § 307) unless the board has no committee composed solely of independent directors. Is there potential exposure if the report is made to the full board? What if the full board does not act but the independent committee members all testify that they would have? The rule requires that the reporting attorney must personally report the evidence to the board or a committee. May he not rely in good faith on a general counsel who assures him that it has been taken up to the board? Does he do so at his own peril?

Section 205.3(b)(5) provides that in all instances, an "attorney retained or directed by an issuer to investigate evidence . . . shall be deemed to be appearing and practicing before the Commission. . . ." This may appear unremarkable, but it may surprise some investigative attorneys to learn that their work in such an endeavor may subject them more generally to the jurisdiction of the Commission.

Under the terms of § 205.3(b)(6)(i)(B), if the reporting attorney is satisfied that there was no material violation, but the chief legal officer does not share that conclusion, the reporting attorney nonetheless has an obligation to ensure that the chief legal officer does in fact report the matter to the board or a committee. Can this provision really mean what its words say? In most, perhaps all of these instances, the observation may fairly be made that the SEC would not likely commence an action. But extenuating circumstances are always possible. The outside counsel who reports to the CEO, as permitted by SOx § 307, rather than the CEO and the CLO, as required by the new rules, may appear less innocent if the CEO buries the evidence and precludes an effective response. One of the significant risks arising from the fact that these rules will likely be interpreted in the enforcement process is that circumstances will have evolved in unexpected ways. In many of the cases suggested above, a process that seems functionally equivalent will be open to question if the actual development of facts is such as to suggest "but for" responsibility.

This brief article cannot hope to anticipate all, or even a majority, of the unexpected factual settings that may arise and that may trigger application of the new attorney conduct rules. It is, however, enough of an analysis to support what is now a readily apparent observation: the new rules are sufficiently intricate to create considerable risk that, over time, their effect will be perverse. They may not much affect the way in which corporate advisors go about their business of advising clients, but they may significantly increase the frequency with which unsuspecting lawyers face difficult enforcement actions from the wrong end of the rifle scope.