Sarbanes-Oxley Act of 2002
By: MELODIE ROSE
August 2002
As you know, the Sarbanes-Oxley Act of 2002 (the “Act”) was signed into law by President Bush on July 30, 2002, in response to the recent accounting issues at large public companies. The Act made significant changes in the laws governing public companies, their directors, officers and stockholders, their disclosure obligations, and the accounting and legal professions. Some of the provisions of the Act became effective immediately upon enactment, while others require the SEC to adopt rules within a specified time period.
This memorandum summarizes the key provisions of the Act. It is not a complete description of the Act. This memo also includes some practical recommendations based on the current status of the legislation. Obviously, the landscape surrounding this legislation is changing rapidly, resulting in evolving legal interpretations and related recommendations. We will endeavor to keep you informed of changes in rules and recommendations. We urge you to consult with us as you implement policies and procedures in response to the legislation.
EXECUTIVE SUMMARY
CEO/CFO Certification
The Act requires the CEO and CFO of public companies to certify the correctness and completeness in all material respects of their financial reports. If a company is required to restate its financials due to material noncompliance as a result of misconduct with any financial reporting requirements, the CEO and CFO must reimburse certain bonus and profits to the company. Knowing or willful violations by the CEO or CFO are subject to criminal penalties. Loans by an issuer to its directors or executives are prohibited. Existing loans are not subject to the prohibition as long as they are not materially modified or renewed.
Enhanced Disclosure and SEC Review
The Act mandates the SEC to adopt rules obligating public companies to disclose certain information on a real time basis, disclose all off-balance sheet transactions and related party transactions, improve pro forma information reporting results, and to make additional disclosure relating to internal controls. Corporate insiders are required to report transactions involving company securities within two business days. In addition, a public company is also required to disclose whether it has adopted a code of ethics for its senior financial officers and whether there is at least one financial expert on its audit committee. The SEC shall review each company’s filings “on a regular and systematic basis” and in any event no less than once every 3 years.
Audit Independence
The Act imposes stricter independence standards for audit committees, enhanced audit committee responsibility for audit oversight, including pre-approval of all non-audit services by the independent auditor, requirements that the audit committee establish procedures for handling complaints regarding the company’s accounting and compliance with securities law, and additional disclosure regarding audit committee activities and responsibilities.
Regulation of Attorneys
Attorneys will have the obligation to report evidence of material violations of securities laws or breaches of fiduciary duty to an issuer’s CEO or general counsel, and under certain circumstances, to the board of directors.
Accounting Oversight Board
The Public Company Oversight Accounting Board is to be established to oversee the auditing of public companies and to adopt auditing, quality control, ethics, independence and other standards regarding auditing. The five-member board will adopt rules relating to audit services.
Enhancement of Enforcement
The Act created a number of federal crimes related to violation of the securities laws and this Act and increased the penalties of certain existing laws. Employees of public companies will be shielded by whistleblower protection. The statute of limitation for securities fraud actions are significantly extended. The Act also provides other protections for stockholders.
Coverage of the Act
The Act generally applies to all companies that are required to file periodic reports under the Securities Exchange Act of 1934 with the SEC or have filed a registration statement under the Securities Act of 1933 that has not become effective and has not been withdrawn.
SUMMARY OF KEY PROVISIONS OF THE ACT
Corporate Governance
CEO and CFO Certification
The Act requires that public companies comply with two separate certification requirements.
Section 906 is effective immediately and applies to all public companies. The certification statement must certify that the periodic filings containing financial statements fully comply with the requirements of the Securities Exchange Act of 1934 and that information contained in the filings fairly represents, in all material respects, the financial condition and results of operations of the issuer.
If the CEO or CFO certifies any statement under this provision knowing that the periodic filing does not comply with all the requirements under this provision, he or she will be fined not more than $1 million or imprisoned not more than 10 years, or both. If he or she willfully certifies any statement with knowledge of noncompliance, he or she will be fined not more than $5 million, or imprisoned not more than 20 years, or both. Section 906.
Section 302 requires the SEC to adopt rules providing for the CEOs and CFOs of public companies to certify each annual or quarterly report filed under the Exchange Act. These rules will be effective before August 29, 2002. Section 302.
Under Section 302, the CEO and CFO are required to certify that:
- the signing officer has reviewed the report;
- based on the officer’s knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statement made, in light of the circumstances under which the statements were made, not misleading;
- based on the officer’s knowledge, the financial statements and other financial information included in the report, fairly represent in all material respects the financial condition and results of operations of the issuer for the period presented in the report;
- the signing officers (i) are responsible for establishing and maintaining internal controls, (ii) have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to such officers, (iii) have evaluated the effectiveness of the issuer’s internal controls as of a date within 90 days prior to the report, and (iv) have presented in the filing their conclusions as to the effectiveness of the internal controls based on that evaluation;
- the signing officers have disclosed to the issuer’s auditors and the audit committee (i) all significant deficiencies in the design or operation of internal controls that could adversely affect the issuer’s ability to record, process, summarize, and report financial data, and (ii) any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer’s internal controls; and
- the signing officers have indicated in the report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of their evaluation.
The 906 and 302 certifications are in addition to the SEC’s Order that CEOs and CFOs of 947 large public companies with revenue over $1.2 billion submit sworn statements regarding their recent periodic filings.
Insider Trades during Pension Fund Blackout Periods
Directors and executive officers are prohibited from purchasing, selling, acquiring or transferring company equity securities during blackout periods under employee benefit plans if such director or officer acquires the security in connection with his or her service or employment as a director or executive officer. The term blackout period means any period of more than 3 consecutive business days during which half or more of the participants or beneficiaries under the plan are prohibited from purchasing, selling or transferring an interest in the company’s equity securities in the plan, whether by the issuer or a fiduciary of the plan. The issuer may recover any profits realized upon the purchase, sale or other transfer regardless of the intention of the director or officer in engaging in the transaction. Lawsuits for recovery must be filed not more than 2 years after the profit is made. Notice of a blackout must be furnished to all participants and beneficiaries under the plan to whom the blackout period applies at least 30 days in advance of the blackout period. This provision will become effective 180 days after the date of the enactment of the Act. Section 306.
Prohibition on Personal Loans to Executives
Loans or extensions of credit by an issuer to its directors or executives are prohibited. Existing loans are not subject to the prohibition as long as they are not materially modified or renewed. Certain limited exceptions are available. Section 402.
Forfeiture of Certain Bonus and Profits
If a company is required to restate its financials due to material noncompliance with any financial reporting requirements as a result of misconduct, the CEO and CFO must reimburse the company for (1) any bonus or other incentive-based or equity-based compensation received during the 12 months following the first public issuance of the non-complying document, and (2) any profits realized from the sale of securities of the company during those 12 months. Section 304.
Bar on Service as a Director or Officer
Under pre-existing law, an individual could be barred from serving as a director or officer if he or she violated the applicable anti-fraud provisions of the securities laws and his or her conduct demonstrated “substantial unfitness” to serve. The Act reduces the standard to “unfitness” permitting the bar to be imposed if any “unfitness” has been found. Section 305.
Public Company Audit Committees
- All audit committee members must be independent board members. A person is considered independent if, other than in his or her capacity as a member of the audit committee, the board of directors or any other board committee, he or she does not accept any consulting, advisory, or other compensatory fee from the company, and is not affiliated with the company or its subsidiaries. Section 301.
- The audit committee is responsible for the appointment, compensation, and oversight of the company’s auditor. The auditor must report directly to the audit committee. The Committee must be authorized to engage independent counsel and other advisers.
- Within 270 days, national securities exchanges or associations are required to adopt rules requiring each public company to assure the responsibilities, procedures, authorities and the independence of the audit committee to comply with these new requirements.
Attorney Reporting
Within 180 days, the SEC is required to issue rules setting forth the minimum professional conduct standard for attorneys. The rules will require attorneys to report evidence of a material violation of securities law or breach of fiduciary duty or similar violation by the company or any agent to the chief counsel or the CEO, and if that officer does not appropriately respond to the evidence, to the audit committee or to another committee composed entirely of outside directors or to the board of directors. Section 307.
Enhanced Disclosure and SEC Review
Accuracy of Financial Reports
Each GAAP financial statement filed with the SEC must reflect all “material correcting adjustments” that have been identified by a registered public accounting firm. Section 401.
Off-Balance Sheet Transactions
SEC is to adopt rules within 180 days requiring that each annual and quarterly financial report filed with the SEC disclose all material off-balance sheet transactions, arrangements and obligations and other relationships with unconsolidated entities or other persons that may have a material current or future effect on financial condition, changes in financial condition, results of operations, liquidity, capital expenditures, capital resources, or significant components of revenues or expenses. Section 401.
Pro Forma Information
Within 180 days, the SEC is to required to adopt rules requiring that pro forma financial information included in any SEC filings (i) does not contain an untrue statement of a material fact necessary in order to make the pro forma financial information, in light of the circumstances under which it is presented, not misleading, and (ii) reconciles with the financial condition and results of the issuer under GAAP. Section 401.
Reports of Changes of Beneficial Ownership - Amendment of Section 16
The Act amends Section 16 of the Exchange Act to require directors, officers and 10% shareholders of an issuer to file reports of changes in beneficial ownership by the end of the 2nd business day after the day of execution of the transaction, rather than the 10th day of the calendar month following the transaction under pre-existing law. The SEC is authorized to adopt exceptions from the 2-day deadline if compliance is not feasible. The new deadline will become effective August 29, 2002. Within one year after enactment, insiders will file their Section 16 statements electronically and the SEC will provide these statements on a publicly accessible Internet site no later than the end of the business day following the filing. Companies are also required to post these filings on their corporate website no later than the end of business day following the filing. Section 403.
Management Assessment of Internal Controls
The Act requires the SEC to adopt rules requiring each public company’s annual report to contain an internal control report (1) stating the responsibility of management for establishing and maintaining an internal control structure and procedures for financial reporting, and (2) containing an assessment of the effectiveness of the internal control structure and procedures for financial reporting. The Act does not specify a time period during which the SEC has to issue these rules. Section 404.
Code of Ethics for Senior Financial Officers
The SEC is required to issue final rules within 180 days requiring each public company to disclose in its periodic reports whether it has adopted a code of ethics for senior financial officers and if not, the reasons therefor. Any change in or waiver of the code of ethics must be disclosed immediately on Form 8-K. Section 406.
Financial Expert on the Audit Committee
The SEC will adopt rules within 180 days requiring each public company to disclose, together with its periodic filings, whether its audit committee comprised at least one “financial expert,” as such term is to be defined by SEC. Section 407.
Regular SEC Review of Public Companies
The SEC shall review each issuer’s filings “on a regular and systematic basis” and, in any event, no less than once every 3 years. Section 408.
Real Time Issuer Disclosures
The Act requires each public company to disclose to the public on “a rapid and current basis” material changes in its financial condition or operations, which may include trend and qualitative information and graphic presentations, as the SEC determines is necessary or useful to protect investors and the public interest. Section 409.
Auditor Independence
Prohibited Services
“Registered accounting firms” (see discussion below) are prohibited from providing any non audit services to a public company contemporaneously with an audit, including, but not limited to, the following:
Bookkeeping or other services related to accounting records or financial statements;
- Financial information systems design and implementation;
- Appraisal or valuation services, fairness opinions or contribution-in-kind reports;
- Actuarial services;
- Internal audit outsourcing services;
- Management functions or human resources;
- Broker or dealer, investment adviser, or investment banking services;
- Legal and expert services unrelated to the audit; and
- Any other service the Oversight Board determines is not permissible.
Pre-approval Requirement
All auditing and non-audit services, other than the de minimus exception as defined in the Act, provided to an issuer by its auditor must be pre-approved by the issuer’s audit committee. Section 202.
De Minimus Exception
The pre-approval requirement is waived for non-audit services if (i) the aggregate amount of all non-audit services constitutes not more than 5% of the total revenues paid by the public company to the auditor during the fiscal year in which non-audit services are provided, (ii) such services were not recognized by the public company to be non-audit services at the time of the engagement, and (iii) such services are promptly brought to the attention of the audit committee and approved prior to the completion of the audit by audit committee or by one or more members of the audit committee who are members of the board having the authority to grant such approvals. Section 202.
Audit Partner Rotation
A registered public accounting firm may not provide audit services to a public company if the lead audit partner or the partner responsible for reviewing the audit has performed audit services for that company in each of the 5 previous fiscal years. Section 203.
Audit Report to Audit Committee
Each registered public accounting firm is required to report “timely” to the audit committee of the issuer on matters including:
- Critical accounting policies and practices to be used;
- All alternative treatments of financial information within GAAP that have been discussed with management, ramifications of the use of these alternative disclosures and treatments; and
- Other material written communications between the registered accounting firm and the management of the issuer, such as any management letter or schedule of unadjusted differences. Section 204.
Employment Restrictions on Accountants
A registered public accounting firm may not provide audit services for a public company if the company’s CEO, controller, CFO, chief accounting officer or person holding an equivalent position was employed by the accounting firm and participated in any capacity the audit of such public company during the one-year period preceding the initiation of the audit. Section 206.
Improper Influence on Conduct of Audits
The Act prohibits any officer or director of a public company or person acting under an officer’s or director’s direction from fraudulently influencing, coercing, manipulating or misleading any independent public or certified accountant that is engaged in the performance of an audit of the public company’s financial statements for the purpose of rendering the statements materially misleading in violation of such rules as the SEC adopts. The SEC must propose rules proscribing such conduct by October 28, 2002, and it must issue final rules by April 26, 2003. The Act gives the SEC exclusive authority to enforce this provision in any civil proceeding. Section 303.
Accounting Oversight Board
Establishment
The Act mandates the establishment of a Public Company Accounting Oversight Board (the “Oversight Board” or the “Board”) to oversee the audit of public companies. The Oversight Board will be a private, non-profit corporate entity subject to oversight by the SEC. It will be composed of five members, initially appointed by the SEC. Two and only two members must be current or former certified public accountants. The Oversight Board will be required to:
- Register public accounting firms that prepare audit reports;
- Establish or adopt, or both, auditing, quality control, ethics, independence and other standards relating to the preparation of audit reports for issuers;
- Conduct inspection of registered public accounting firms;
- Conduct investigations and disciplinary proceedings, and impose sanctions upon registered public accounting firms and their associated persons;
- Promote high professional standards and improve the quality of audit services offered by registered public accounting firms and their associated persons;
- Enforce compliance with the Act, Oversight Board rules, professional standards and the securities laws relating to the preparation and issuance of audit reports; and
- Set the budget and manage the operations of the Oversight Board.
Registration with the Oversight Board
The Board must take necessary actions to enable the SEC to determine, within 270 days, that the Board is operational. Beginning 180 days after such SEC determination, only registered public accounting firms may perform audits of public companies. Sections 101 & 102.
Accounting Standards
The Act directs the SEC to designate a standard setting body to establish generally accepted accounting principles and improve the accuracy and effectiveness of financial reporting. The standard setting body will submit an annual report to the SEC and the public containing audited financial statements of the standard setting body. Section 108.
Funding
The Oversight Board and the accounting standard setting body will be funded by annual accounting support fees paid by public companies. Each registered public accounting firm will pay a registration fee and an annual fee. Section 109.
Corporate Accountability and Criminal Fraud; White Collar Penalty Enhancement
Destruction of Documents
The obstruction of justice provisions of the criminal code were amended by the Act. A section is added that imposes fines and/or a sentence of up to 20 years in prison for “knowingly” altering, destroying or falsifying documents, or making a false entry in any document, in order to obstruct an investigation by any U.S. department or agency. Another section is amended to impose a fine and/or sentence of up to 20 years in prison for “corruptly” altering, destroying, or concealing a record in order to impair its availability or use in an official proceeding or for otherwise obstructing or attempting to obstruct any official proceeding. Sections 802 & 1102.
Destruction of Corporate Audit Records
Accountants conducting an audit of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 applies are required to retain all audit and review workpapers for at least 5 years. Any knowing and willful violation of this retention requirement is punishable by a fine and/or a prison sentence of up to 10 years. Section 802.
Criminal Penalties for Defrauding Shareholders
The mail fraud provisions of the criminal code are amended by the Act, which adds a section imposing fines and/or prison sentence of 25 years for “[w]hoever knowingly executes, or attempts to execute, a scheme or artifice” to defraud any person in connection with any security of a public company or to obtain by false or fraudulent pretenses any money or property in connection with the purchase or sale of any security of a public company. Use of the mail or wires is not an element of the offense. (The maximum prison sentence prior to this amendment was 10 years.) Section 807.
Attempts and Conspiracies to Commit Criminal Fraud Offenses
The Act makes it a crime to attempt or conspire to commit any of the fraud offenses listed in the mail fraud provisions of the criminal code, including the newly added securities fraud provisions. One convicted of an attempt or conspiracy to commit these frauds will face the same penalties as those for the underlying offenses. Section 902.
Criminal Penalties for Mail and Wire Fraud
The maximum prison sentence terms for mail fraud and wire fraud are increased from 5 years to 20 years. Section 903.
Criminal Penalties for Violations of ERISA
Penalties for violations of ERISA are increased. The maximum fine for an individual is increased from $5,000 to $100,000, and the maximum term of imprisonment is increased from 1 year to 10 years. Fines for corporations are increased from $100,000 to $500,000. Section 904.
Violations of the Securities Exchange Act of 1934
Criminal penalties for an individual are increased under the Act. The maximum prison term is increased from 10 years to 20 years, and the maximum fine is increased from $1,000,000 to $5,000,000. Fines for corporations are increased from $2,500,000 to $25,000,000. Section 1106.
Retaliation Against Informants
The witness tampering provisions of the criminal code are strengthened by the Act, which provides for a fine and/or imprisonment of up to 10 years for any person who intentionally retaliates against one who provides any truthful information to a law enforcement officer relating to the commission of a Federal offense. Section 1107.
Non-Dischargeable Debts in Bankruptcy
Title 11 of the U.S. Code is amended by the Act to prohibit persons from being released under bankruptcy for any damages, fines, penalties, disgorgement payments, restitutionary payments and attorney’s fees incurred due to violations of the Federal or state securities laws. Section 803.
Statute of Limitations for Securities Fraud
The statute of limitations for investors to file a private action for securities fraud is extended by the Act to 2 years after discovery of the facts or 5 years after the occurrence of the alleged violations (the current limitations are 1 and 3 years, respectively). All actions filed on or after July 30, 2002, will be subject to this provision. Section 804.
Review of the Federal Sentencing Guidelines
The U.S. Sentencing Commission is ordered under the Act to review and amend, as appropriate, the Federal Sentencing Guidelines for both individuals and organizations to ensure that offense levels and sentence enhancements related to obstruction of justice, criminal fraud, fraud and other white collar crimes and securities and accounting fraud take into account the number of victims and otherwise are sufficient to deter and punish such activity. This review and amendment of the Guidelines is to be completed within 180 days. Sections 805, 905 & 1104.
Whistleblower Protection
Employees of public companies are given protection under the Act against retaliatory discharge, demotions, threats, harassment and other discriminatory actions for providing information or assisting in investigations conducted by government agencies, members of Congress, or those with supervisory authority over the employees involving alleged violations of the securities laws, SEC rules or regulations or securities fraud. Such employees are also protected when filing, testifying or participating in proceedings relating to such alleged violations. Employees must bring claims within 90 days of the alleged retaliatory act. Relief includes reinstatement, back pay with interest, and compensation for any special damages. Section 806.
Temporary Freeze Authority for the SEC
The Act grants to the SEC the authority to petition a court for an order to freeze “extraordinary payments” of a public company to any of its officers, directors, partners or controlling persons, agents, or employees during an investigation of the company for possible violations of securities laws. Under such an order, the payments would be held in escrow for 45 days. This period may be extended upon good cause shown for no longer than 45 additional days. Section 1103.
SEC Authority to Prohibit Persons from Serving as Officers and Directors
The Act amends the Securities Acts of 1933 and 1934, granting the SEC authority in cease-and-desist proceedings to ban persons who have violated certain anti-fraud provisions of the securities laws or their corresponding rules and regulations from serving as officers and directors of any issuer that has a class of securities registered pursuant to section 12, or that is required to file reports pursuant to Section 15(d) of the 1934 Exchange Act, if the conduct of the person demonstrates “unfitness” to serve. Section 1105.
