Experience

August 2002

The Sarbanes-Oxley Act of 2002

On Tuesday, July 30, 2002, President Bush signed into law the Sarbanes-Oxley Act of 2002 (the "Act"), which has also been referred to as the Corporate Fraud Bill. Many commentators believe that the Act may be the most sweeping package of securities law reforms in decades. The Act dramatically increases regulation of the public accounting industry and corporate governance, and impacts many aspects of public company reporting and compliance. The Act also enhances the criminal penalties for securities fraud and other white collar crimes.

Because of its size and importance, we felt you would find the following summary of the Act useful. We have highlighted the effective dates of the various provisions, many of which require new rulemaking from the SEC. The entire text of the Act can be found on the Internet at http://thomas.loc.gov by entering "Sarbanes-Oxley" in the "Word/Phrase" search box.

I. Public Company Accounting Oversight Board.

The Act requires the establishment of a "Public Company Accounting Oversight Board" (the "Oversight Board"), a private entity subject to oversight by the Securities and Exchange Commission (the "SEC"). The Oversight Board, which is to be established within 270 days (i.e., April 26, 2003), will be comprised of 5 members initially selected by the SEC, two of whom (and only two) must have prior CPA experience. The Board will be authorized to, among other things:

• Register public accounting firms that prepare audit reports for issuers;
  
  
• Establish or adopt rules concerning audit, quality control, ethics and independence standards relating to the preparation of audit reports, including rules requiring -
  • Accounting firms to maintain audit work papers for 7 years;
    
    
  • Concurring or second partner review and approval of audit reports; and
    
    
  • Audit reports to contain descriptions of the scope of the auditor's testing of the issuer's internal control structure and procedures; and
  
  
• Conduct investigations and disciplinary proceedings.

II. Auditor Independence Provisions.

A. Provision of Non-Audit Services Prohibited. The Act includes several provisions amending Section 10A of the Securities and Exchange Act of 1934 (the "Exchange Act"), all aimed at maintaining the independence of accounting firms in connection with rendering audit services. Most importantly, the Act prohibits an accounting firm providing audit services to an issuer to also provide that issuer, "contemporaneously with the audit," any of the following 9 categories of non-audit services:

1. bookkeeping or other services related to the accounting records or financial statements of the audit client;
2. financial information system design and implementation;
3. appraisal or valuation services, fairness opinions, or contribution in-kind reports;
4. actuarial services;
5. internal audit outsourcing services;
6. management functions or human resources;
7. broker or dealer, investment advisor, or investment banking services;
8. legal services and expert services unrelated to the audit; and
9. any other service that the Public Accounting Oversight Board determines, by regulation, is impermissible.

The ban on providing non-audit services becomes effective 180 days after the date the Oversight Board commences operations. With respect to non-audit services not specified above, including tax services, accounting firms may engage their audit clients to perform such services but only if the activity has been pre-approved by the issuer's audit committee (which can delegate to one of its members the authority to grant pre-approvals). The Act also includes a limited de minimus exception to the pre-approval requirement in situations where the issuer failed to recognize the services as prohibited non-audit services at the time of engagement, the services represent less that 5% of the total revenues paid to the accounting firm in the year such services were performed, and the engagement is promptly brought to the attention of the audit committee and approved prior to completion of the audit.

B. Rotation of Audit Partners. The Act makes it unlawful for an accounting firm to provide audit services to an issuer if the lead/coordinating audit partner has performed audit services for the issuer in each of the previous 5 fiscal years. The Act also requires the Comptroller General's office to conduct a study of the potential effects of requiring mandatory rotation of accounting firms.

C. Reports to Audit Committee. The Act requires that auditors timely report to the issuer's audit committee:

• all critical accounting policies and practices to be used;
  
  
• all alternative treatments of financial information within GAAP that have been discussed with management, the ramifications of using such treatments, and the treatment preferred by the auditor; and
  
  
• "other material written communications" between the auditor and management, such as any management letter or schedule of unadjusted differences.

D. Conflicts of Interest. The Act makes it unlawful for accounting firms to provide audit services to an issuer if the issuer's CEO, controller, CFO, or chief accounting officer (or their equivalents) was employed by the accounting firm and participated in the audit of that issuer during the 1-year period preceding the date of initiation of the audit.

E. SEC Rulemaking. The SEC is required to issue final rules to carry out the auditor independence provisions of the Act within 180 days (by January 26, 2003).

III. Corporate Responsibility Provisions.

A. Audit Committees. The Act requires the SEC to issue rules within 270 days (i.e., by April 26, 2003) directing national securities exchanges and quotation systems (e.g., the New York Stock Exchange and Nasdaq) to prohibit the listing of any security of an issuer not in compliance with the following provisions:

• Oversight of Auditors. Audit committees must be directly responsible for the appointment, compensation and oversight of auditors (including resolution of disagreements between auditor and management) and auditors must report directly to the audit committee.
  
  
• Independence. Each member of the audit committee must be independent, meaning no member can be an affiliate of the issuer (including subsidiaries) nor can any member accept consulting, advisory or other compensatory fees from the issuer. The SEC can, by rule, exempt certain relationships as it deems appropriate.
  
  
• Complaints. Audit committees must establish procedures for the -
  
  
  • Receipt, retention and treatment of complaints received by the issuer concerning accounting, internal controls and auditing matters; and
    
    
  • Confidential, anonymous submission by the issuer's employees regarding questionable accounting/auditing matters.
  
  
• Miscellaneous. The audit committee must have the authority to engage independent counsel and other advisors as it deems appropriate. Issuers are required to provide appropriate funding, as determined by the audit committee, for payment of compensation to the auditors and to any advisors retained by the audit committee.

B. Officer Certification of Financial Reports. The Act contains two different (and somewhat inconsistent) provisions requiring officer certification of reports filed with the SEC containing financial statements:

• That such officer has reviewed the Form 10-K or 10-Q;
  
  
• That, based on such officer's knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances, not misleading;
  
  
• That, based on such officer's knowledge, the financial statements and other financial information included in the report fairly present in all material respects the financial condition and operating results of the issuer with respect to the periods presented;
  
  
• That the signing officers -
  
  
  • Are responsible for establishing and maintaining internal controls;
    
    
  • Have designed such controls to ensure that material information is made known to the officer by others in the organization, particularly during the period in which the reports are being prepared;
    
    
  • Have evaluated the effectiveness of the internal controls "as of a date within 90 days prior to the report;" and
    
    
  • Have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date;
  
  
• That the signing officers have disclosed to the auditors and the audit committee -
  
  
  • All significant deficiencies in the design or operation of internal controls that could adversely affect the issuer's ability to record, process, summarize and report financial data; and have identified to the auditors all material weaknesses in the internal controls; and
    
    
  • Any fraud, whether or not material, involving management or other employees with a significant role in the issuer's internal controls.
  
  
• That the signing officer has indicated in the report whether or not there were significant changes in internal controls or other factors that could significantly affect internal controls after the date of their evaluation, including corrective actions.

NOTE: On June 14, 2002, the SEC proposed to issue new rules requiring specified CEO and CFO certification of company financial statements. Also included in this proposal was a requirement that reporting companies "maintain procedures to provide reasonable assurances that the company is able to collect, process and disclose the information required in the company's quarterly and annual reports." On August 2, 2002, the SEC issued a new release re-proposing these regulations, which have been modified to conform to the Act. The comment period for these proposed rules ends on August 19, 2002. The SEC also confirmed that it would adopt the new rules regarding by August 29, 2002, as required by the Act.

It is worth noting the following in connection with Section 906 certifications:

• The first item of certification - that the report fully complies with Exchange Act Sections 13(a) and 15(d) - is not limited by a materiality standard;
  
  
• The required certifications are not limited to the officer's knowledge, however, to constitute a crime, the officer must have made the certification "knowing" it was false;
  
  
• It is not clear whether the term "periodic report" would include Form 8-Ks that contain financial statements;
  
  
• Because this provision requires the certification to "accompany" the periodic report, it should suffice to include the certification as an exhibit to the report (as opposed to the more comprehensive Section 302 certification, which will be included in the Form 10-K or 10-Q itself); and
  
  
• Unlike Section 302, the certifications required by Section 906 became effective immediately. The SEC has also made clear that the rules to be promulgated under Section 302 of the Act are unrelated to the certification requirements of Section 906. CEOs and CFOs of public companies should therefore plan to make the Section 906 certifications in connection with the next periodic report required to be filed with the SEC. We expect that, when the SEC adopts the Section 302 certification procedures in late August, the SEC will integrate the two sets of requirements into one comprehensive certification procedure.

NOTE: Both officer certification provisions contained in the Act are separate from the SEC's recently-issued order requiring chief executive officers and chief financial officers of large issuers (at least $1.2 billion in revenues) to file sworn statements on or before the date by which the issuer's next Form 10-K or 10-Q is due (August 14, 2002 for calendar year companies) certifying the most recent Form 10-K and all subsequently filed Form 10-Qs. That SEC "one-time" order is unaffected by the Sarbanes-Oxley Act.

C. Other Prohibited Conduct/Penalties Applicable to Officers and Directors.

• It is unlawful for officers and directors to "fraudulently influence, coerce, manipulate or mislead" the auditors. The SEC shall, within 90 days (by October 28, 2002), propose rules concerning this prohibition and shall issue final rules within 270 days (by April 26, 2003) of enactment.
  
  
• If an issuer is required to restate finance due to material noncompliance with any financial reporting requirement resulting from misconduct, the issuer's CEO and CFO must return -
  
  
  • any bonus / incentive-based / equity-based compensation received during the 12-month period following the first public issuance or filing with the SEC of the erroneous financial report; and
    
    
  • Any profits realized from stock sales during that 12-month period.
  
  
• Blackout Period Sales. Except as otherwise provided by rule of the SEC, it is unlawful for a director or executive officer of an issuer, directly or indirectly, to buy, sell or otherwise acquire or transfer the issuer's equity securities (other than exempted securities) during any "blackout period" where the issuer's employees are prohibited from trading securities in an issuer-sponsored retirement plan if the officer or director acquired the securities in connection with his or her services to, or employment with, the issuer.
  
  
  • Profits realized by such transactions shall inure to, and are recoverable by, the issuer, regardless of the officer or director's intention in entering into the transaction.
    
    
  • The SEC is required to issue rules clarifying the application of this provision. The Act does not specify a time frame in which these rules are to be issued.

D. Attorney Professional Responsibility. The Act requires the SEC to issue rules within 180 days (by January 26, 2003) setting forth standards of professional conduct for attorneys representing issuers before the SEC, including a rule (1) requiring attorneys to report to the CEO or chief legal counsel all material violations of securities laws or breaches of fiduciary duties by the issuer, or an agent of the issuer, and (2) if such officers do not appropriately respond, then requiring the attorney to report such violations to the audit committee.

IV. Enhanced Disclosure Provisions.

A. Disclosures Required in Periodic Reports. The Act amends Section 13 of the Exchange Act requiring disclosure of all material correcting adjustments identified by auditors in periodic reports filed with the SEC. The SEC is also directed to issue, within 180 days (by January 26, 2003), new rules -

• requiring disclosure of all material off-balance sheet transactions and other obligations of the issuer with unconsolidated entities that may have a material current or future effect on the issuer's financial condition, operating results, liquidity, etc.; and
  
  
• concerning presentation of pro forma financial information.

B. Conflict of Interest Provisions. The Act includes several provisions directed at prohibiting or increasing disclosure of certain transactions or relationships that may result in a conflict of interest.

• Prohibition on Personal Loans. The Act amends Section 13 of the Exchange Act, effective immediately, to make it unlawful for an issuer to make loans or otherwise extend credit to any director or executive officer. Loans or other extensions of credit existing as of July 30, 2002 may be maintained, provided there is no material modification to the terms of such transaction. Certain personal loans made by the issuer in its ordinary course of business and on terms no more favorable than those available to the general public are excepted from the ban.
  
  
• Section 16 Reporting. Section 16(a) of the Exchange Act has been amended to require Section 16 filers (i.e., executive officers, directors and 10% holders) to file their change of ownership forms (Form 4s) within 2 business days after a change in ownership (or a later time if the SEC determines 2 days is not feasible). This provision becomes effective on August 29, 2002. Within 1 year of enactment, Form 4s will be required to be filed electronically and issuers will be required to maintain the forms on their corporate web site.
  
  
• Internal Control Reports. The SEC is directed to promulgate rules requiring Form 10-Ks to include an internal control report, which states the responsibility of management to establish/maintain adequate controls and assesses the effectiveness of the controls. Auditors will also be required to attest to, and report on, the internal control reports. The Act does not specify a time frame for the issuance of these rules.
  
  
• Code of Ethics for Senior Financial Officers. The SEC is directed to issue rules requiring issuers to disclose whether they have adopted (and if not, why not) a code of ethics for senior financial officers. The SEC is also directed to amend Form 8-K to require disclosure of changes in, or a waiver of, a provision included in the issuer's code of ethics. These new rules are required to be proposed within 90 days (by October 28, 2002) and to be final within 180 days (by January 26, 2003).
  
  
• Disclosure of Audit Committee "Financial Expert." The Act directs the SEC to issue rules requiring issuers to disclose whether (and if not, why not) the audit committee has at least 1 member who is a "financial expert." In defining the term, the SEC is to consider whether the person has experience as a public accountant, principal financial officer, comptroller or principal accounting officer of an issuer, or from performing similar functions, has an understanding of, among other things, GAAP and the preparation of financial statements, including application of GAAP to accounting for estimates, accruals and reserves. The SEC is required to issue proposed rules within 90 days (by October 28, 2002) and final rules in 180 days (by January 26, 2003).
  
  
• SEC Review of Periodic Reports. The SEC is required to undertake a systematic review of disclosures made by issuers reporting under Section 13(a) and having a class of securities listed on a national exchange or quotation system. For purposes of scheduling the reviews, the SEC is required to consider, in addition to other factors the it determines relevant -
  
  
  • Issuers that have issued material restatements;
    
    
  • Issuers that experience significant volatility in stock price compared to others;
    
    
  • Issuers with large market capitalizations;
    
    
  • Emerging companies with disparities in P/E ratios; and
    
    
  • Issuers whose operations significantly affect a material sector of the economy.
  
  In any event, all reporting companies are required to be reviewed at least once every 3 years.
  
  
• Real-Time Disclosures. Issuers will be required to disclose to the public in plain English on a "rapid and current basis" such additional information concerning material changes in the financial condition or operations of the issuer, including trend and qualitative information, as the SEC determines by rule. The Act does not specify a time frame for such SEC rulemaking.

V. Research Analyst Conflicts of Interest.

The Act directs the SEC to promulgate within 1 year rules designed to address conflicts of interest that can arise when research analysts publicly recommend equity securities, including conflicts known, or which should have been known, to the analyst. Even before the Act was passed by the Congress, the SEC had already undertaken to propose new rules in this area. On July 25, 2002, the SEC proposed new "Regulation AC (Analyst Certification)" for public comment. Regulation AC would require research analysts to certify the truthfulness of their views in research reports and public appearances and disclose whether they have received any compensation related to the specific recommendation provided in those reports and appearances. Previously, in May 2002, the SEC approved amendments to NASD and New York Stock Exchange rules relating to conflict of interest concerns in connection with analysts' research reports and public appearances.

VI. Enhanced Criminal Penalties.

The Act also contains several provisions relating to penalties for criminal violations of the Act and other federal securities laws, including, among others, the following provisions:

• Persons who "knowingly" alter, destroy, falsify, etc. records in connection with a Federal investigation are subject to a fine and/or 20 years in prison;
  
  
• Accountants who "knowingly and willfully" fail to maintain audit work papers for at least 5 years are subject to fines and/or 10 years' imprisonment;
  
  
• Debts incurred in violation of securities fraud laws are not dischargeable in bankruptcy;
  
  
• The statute of limitations for private securities law actions is extended to the earlier of (i) 2 years from discovery of the facts constituting the violation, or (ii) 5 years after the violation (up from 1 and 3 years);
  
  
• Employees of issuers providing information concerning securities law violations to (i) Federal authorities, (ii) Congress, or (iii) supervisors of the employee, are afforded whistleblower protection;
  
  
• The maximum prison sentence for mail and wire fraud was increased to 20 years.
  
  
• The maximum fine and prison sentence for natural persons "willfully" violating the provisions of the Exchange Act was increased from $1 million/10 years to $5 million and 20 years. For persons other than natural persons, the maximum fine has been increased from $2.5 million to $25 million.

VII. Interaction with Other Proposals

As you are also probably aware, the SEC has already been busy proposing new rules aimed at enhancing and accelerating disclosure of certain transactions, especially those involving insiders. The SEC is also considering corporate governance standards recently adopted by the New York Stock Exchange and Nasdaq, which are subject to SEC approval. Many of these rules and standards overlap, or may even conflict with, provisions of the Sarbanes-Oxley Act:

• Two separate SEC proposals to provide accelerated and expanded current disclosures on Form 8-K, including quick reporting of stock trading by management.
  
  
• Accelerated filing deadlines for Forms 10-K and 10-Q (for companies that have at least $75 million in market value of securities held by non-affiliates).
  
  
• Detailed disclosure of critical accounting policies in the management's discussion and analysis sections of annual and quarterly reports.
  
  
• Nasdaq standards for listed companies that, among other things, require a majority of independent directors on corporate boards; change standards for service on audit and compensation committees; strengthen the use of corporate codes of conduct; require shareholder approval for all stock option plans in which officers and directors participate, with few exceptions; and provide for delisting if the issuer fails to provide information required by Nasdaq or if any communication to Nasdaq contains a material misrepresentation or omission. These standards were proposed on June 6, 2002 and subject to a public comment period and SEC approval. A new set of proposals was issued on July 25, 2002 but has not yet been submitted to the SEC, although many of these proposals are similar to those contained in the Sarbanes-Oxley Act.
  
  
• New York Stock Exchange standards for listed companies that, among other things, require a majority of independent directors on corporate boards and change the definition of "independent" directors; change standards for service on audit, compensation and nominating committees, and restrict the compensation of audit committee members to director's fees only; and require shareholder approval of all equity-based compensation plans and amendments. These standards are expected to be considered by the NYSE Board on August 1, 2002 and would be subject to SEC approval.

We are monitoring the SEC's rulemaking and actions of the NYSE and Nasdaq and will update you accordingly.

For more information on any of the topics covered by this letter, please contact any of the members of the Business & Securities Group: