Corporate Reform: The Heat Is On
from January/February 2003
by Rob Norton
No wonder board members are still trying to figure it out. The Public Company Accounting Reform and Investor Protection Act, better known as the Sarbanes-Oxley Act of 2002, is one of the most sweeping pieces of legislation in the history of American business. In places, it may also be one of the most muddled. It shifts power from the executive suite to the boardroom, imposes a vast number of new responsibilities and procedures on directors—and backs many of its prescriptions with the threat of prison sentences that can run as long as 25 years for securities fraud. The audit committee reforms contained in the law increase directors’ liability to shareholder suits.
Congress obviously wanted to put an end to the laissez-faire governance that contributed to the scandals at Adelphia Communications, Enron, Tyco International, and WorldCom, and it just may have done so. “When we look back on this in 20 years,” says Rebecca S. Walker, an associate specializing in corporate compliance in the Washington, D.C., office of Skadden Arps Slate Meagher & Flom, “we’ll see this as a watershed moment in corporate law.”
We will also look back on it as an instance of lawmaking in a hurry. Major legislation is usually enacted only after months or even years of debate, comment, hearings, and refinement. In the case of Sarbanes-Oxley, barely a month went by from the time the bill was tossed into the congressional hopper until President Bush signed it into law on July 30. In many respects, it’s still a law in the making. Some of its provisions became effective immediately, like the ban on insider loans. Others, such as new rules governing audit committees, are being phased in. Some, including enhanced, real-time disclosure of financial information, won’t kick in until the Securities and Exchange Commission provides detailed rules, which might not happen for many months. A handful of provisions are vague—or seem to contradict one another, such as rules about what tax services may be provided by outside auditors. How others will interact with existing laws and with rules promulgated by the New York Stock Exchange and the National Association of Securities Dealers is difficult to predict. Meanwhile, the law empowers the new Public Company Accounting Oversight Board to set standards for auditing, quality control, and ethics.
Robert L. Estep, a partner at Jones Day Reavis & Pogue in Dallas who specializes in corporate-finance and securities work, notes with considerable understatement, “A profound change is taking place, and there are a lot of implications that people don’t yet understand.”
Which provisions in Sarbanes-Oxley’s legislative tangle should directors be worrying about now? To find out, Corporate Board Member interviewed attorneys at a dozen of the nation’s leading law firms. What follows is a close look at seven specific areas of the new law that are of particular boardroom interest.
1. Loans
The most immediately troublesome provision of the law is its blanket ban on loans to CEOs and other top officers. These new rules, already in effect, are both sweeping and vague. At face value, the insider-loan provisions seem to be a flat prohibition of almost any kind of personal loan or extension of credit a company might make, but significant questions exist as to what Congress intended. Are relocation loans and “retention” bonuses, both often provided when a new CEO is hired, now illegal? Are loans that would enable a CEO to buy stock or exercise options also proscribed? Can a corporation forgive loans that were made to executives and directors before the law went into effect? And does the ban on making loans also mean that executives can’t borrow from their 401(k) savings? Use their company credit cards? Or exercise stock options via a “cashless” program in which the company or its broker, in effect, lends them enough to buy the shares, if only momentarily, until they can be sold again on the open market?
Most attorneys advise boards to be cautious in making loans—and in forgiving them—until the SEC comes up with detailed rules. “A highly conservative board will say, ‘Don’t do anything that’s in the gray area,’” says Ira H. Jolles, senior counsel at New York City’s Thelen Reid & Priest. Adds Maureen S. Brundage, co-head of the worldwide securities group at White & Case in New York: “Given the language of the act and the uncertainties about what Congress actually intended to do, it’s dangerous for companies to take chances.”
Recommended board action: Trivial “loans,” such as authorizing the CEO to use his corporate credit card, are probably safe. Otherwise, don’t make any potentially troublesome loans—and don’t forgive any that are still on the books. Let executives exercise stock options through their own brokers, and if you want to help your CEO buy a house, pay a bonus that enables him or her to do so rather than making a loan. The bonus will show up as part of his or her compensation, one of the transparencies that Sarbanes-Oxley surely had in mind.
2. Whistleblowers
One provision that directors need to note is the law’s new whistleblower rules. Employees who provide information about conduct they reasonably believe violates securities or anti-fraud laws get much more protection under Sarbanes-Oxley than previously. Management must have procedures in place to ensure that whistleblowers can be heard without the risk of punishment or retaliation. The ultimate oversight for these procedures rests with the board and the audit committee. The board will have to set up a system capable of discriminating between whistleblower complaints that are serious enough to go directly to the audit committee, such as an allegation that a division is improperly booking earnings, and those that are more routine and can be safely collected and sent at a later date, such as an anonymous tip that an executive is using the corporate jet for personal travel. As Robert Estep of Jones Day points out, few if any boards have figured out how to do this. In the meantime, the new law undermines the whistleblower protection many companies are now using, namely outsourced hotlines that handle employee complaints.
Recommended board action: The audit committee should institute procedures for receiving, retaining, and dealing with complaints in regard to accounting, internal accounting controls, and auditing matters—especially confidential, anonymous allegations. Although the SEC may provide more guidance about the general whistleblower provisions, attorneys doubt that the agency will recommend specific processes.
3. The Lawyers
Complexity also surrounds a company’s attorneys—both its corporate counsel and its outside law firms. Sarbanes-Oxley prescribes that these lawyers inform the CEO or the general counsel of any evidence of material violations of securities laws or any breach of fiduciary duty that they come across in their work. If the response is insufficient, the lawyers must report their concerns directly to the audit committee.
The SEC has issued proposed rules fleshing out the circumstances in which lawyers are required to report violations and wrongdoing under Sarbanes-Oxley. But because the law is a major step toward the federalization of rules of attorney conduct in corporations, this will continue to be fraught with uncertainty.
Recommended board action: Find out what management has done to ensure that inside and outside attorneys have set up ways of communicating with the general counsel and the CEO—and make sure that there are procedures in place by which they can contact the audit committee when they think they need to.
4. Financial Statements
One of Sarbanes-Oxley’s clearest provisions is that the CEO and CFO certify the accuracy of the company’s reports to the SEC. Though this responsibility is placed firmly on them (and is backed up by the threat of a prison sentence for noncompliance), the full board and members of the audit committee are responsible for oversight. The CEO and CFO are specifically directed by the law to disclose to the audit committee “all significant deficiencies in the design or operation of internal controls which could adversely affect the issuer’s ability to record, process, summarize, and report financial data,” and “any fraud, whether or not material,” involving management or other employees who have a significant role in the internal controls. “People are looking for guidance on the whole issue of disclosure controls and internal controls,” says Michael P. Rogan, head of Skadden Arps’s Washington, D.C., office. “Are they adequate? What are the right procedures? A lot of time is being spent on this.”
Recommended board action: Directors must assure themselves that the CEO and CFO are signing off on accurate numbers. This means making sure that the company’s internal controls meet the new SEC rules, that transactions are properly authorized and documented, and that company assets are safeguarded against improper use. A new internal-controls management report must be included in the company’s 10-K, along with internal updates quarterly. Although these rules don’t take full effect until September 2003, the board should already be saying to management, “Tell us exactly what you’re doing about this.”
5. The Auditors
Sarbanes-Oxley forbids outside auditors to provide eight specific non-audit services, including designing and implementing financial systems and providing legal and expert services. The Public Company Accounting Oversight Board, which will have broad powers in this area, will be free to outlaw various other non-audit services. In the meantime, the law requires that the audit committee preapprove all auditing and non-auditing services provided by the outside accounting firm. A source of possible confusion: tax preparation, which is typically done by outside auditors. While the act prohibits outside auditors from performing legal and expert services, it also states that doing tax-preparation work is acceptable—a seeming contradiction in that tax preparation ordinarily includes some expert services. “My guess is that an auditor can provide advice when he does tax work,” says Ira Jolles of Thelen Reid. “He has to, in order to set up the company’s tax reserves.” The SEC has already proposed a rule to answer one issue that the law left in the air: Auditors will no longer be allowed to represent a company in tax disputes with the Internal Revenue Service. This means that a company will have to hire a different accounting firm to make its case, though the auditors would be permitted to explain the tax consulting work they’d done for their client. Jolles thinks other tax services that auditors have sometimes provided, such as selling specific tax-saving arrangements, will be banned too. Even then, says Ronald O. Mueller, a partner at Gibson Dunn & Crutcher in Washington, D.C., “There are still a lot of questions about the scope of the act’s definitions.”
Recommended board action: Be conservative. The intent of the law—to make sure that outside auditors act independently rather than align themselves too closely with management—is clear, and should help decide any close calls. Review the relationship with the independent auditors for compliance with Sarbanes-Oxley. Establish preapproval procedures for all audit and non-audit services.
6. Disclosure
Companies went into conniptions over Regulation Fair Disclosure in early 2002, and more upheaval is to come. Reg FD aims to prevent selective disclosure of material information to favored analysts and investors—but it also permits companies to keep quiet. In contrast, Sarbanes-Oxley wants a nonstop stream of information. It obliges companies to give “rapid and current disclosure,” in plain English, of all material changes in their financial condition or operations. How far the SEC will push this concept is unclear, and the act doesn’t impose a deadline for rulemaking. Earlier this year the agency promulgated rules requiring companies to disclose more in 8-K filings, which are used to report material events that might affect a company’s financial situation. The new law requires that the form be filed within two days of a triggering event, compared with the former deadlines of five days to two weeks.
Recommended board action: The audit committee should begin to prepare now for a future in which companies will be expected to disclose much more information about financial and business changes than in the past, and to do so much more quickly. This means making sure management sets up appropriate procedures and controls.
7. The Audit Committee
Perhaps the most sweeping provisions for directors are those that make the audit committee the new locus of corporate oversight. In addition to the specific responsibilities noted so far—oversight of the company’s financial controls and reporting, compliance with regulatory requirements, and handling of whistleblower complaints—the law requires major changes in the audit committee’s configuration and procedures. No members of the committee, for example, may be officers, insiders, or paid consultants to the company or its affiliates. The audit committee is charged with direct responsibility for “the appointment, compensation, and oversight” of any work done by the firm’s outside auditors. At least one “financial expert” must serve on the committee—and the SEC has issued rules defining the term. Yes, the new law’s provisions overlap and in some cases conflict with recent proposals by the New York Stock Exchange and the National Association of Securities Dealers, as well as with reform ideas put forth by organizations like the Business Roundtable. But since Sarbanes-Oxley requires the SEC to delist any company that doesn’t comply with its provisions, it will override other plans.
The audit committee reforms will carry one unwelcome implication for directors: increased liability to shareholder lawsuits. Outside directors in the past were somewhat insulated from securities suits because they were not considered responsible for managing the company or for the preparation of financial statements. Now that the new legislation has given directors more responsibility, they’re likely to find themselves potential targets in the future.
Recommended board action: Evaluate the audit committee for independence, expertise, and ability to meet its expanded obligations. The new law essentially makes this committee the company’s primary guardian of shareholder interests. One defensive measure directors can take is to hire their own independent counsel and expert advisers—something the law gives them express authority to do.
The Sarbanes-Oxley Act will generate thousands of pages of criticism, analysis, and commentary, reams of SEC regulations, and untold legal wrangling for years to come. Further legislation is possible: It’s likely that Sarbanes-Oxley would have had more to say about executive compensation, for example, had the scandals over executive perks erupted before, instead of after, the law was written. Many corporate attorneys think the compensation committee will be next on legislators’ agendas.
The nature of the board of directors will change as well. For one thing, the average size of boards will probably fall, if only because smaller groups are more likely to get things done. Recruiting and retaining directors will become more difficult. Teamwork between board members and management will have to be closer and nimbler. Board members will need to become more skeptical—and should be prepared to be assertive and even rude, says Philip J. Innes, director of the financial investigations practice at FTI Consulting in Houston. “With the competitive and aggressive nature of business leadership today,” says Innes, “a director needs to be competitive and aggressive in gaining knowledge about the actions of the company. It is better to demand answers today than to be the target of such questioning later. You may feel foolish asking certain questions. But that’s better than being a fool who didn’t know the answers.”
Boards will also need to become more process-oriented, and to leave a careful paper trail showing how they’ve complied with the new law’s requirements. “It’s clear that we’re coming into an era in which board members will have a much more active participation in the management of the company,” says Joseph M. Berl, a partner in corporate and securities law at Powell Goldstein Frazer & Murphy in Washington, D.C. “It will be far more than coming to a meeting, looking at the earnings report, and trusting management to make those reports accurate and complete.”
Uncle Sam will be watching. “While board members have always had the fiduciary duty to keep themselves informed and to make informed judgments,” says Morton A. Pierce, chairman of the mergers and acquisitions group at Dewey Ballantine in New York City, “this is a reminder from Congress—a very strong reminder—that they need to take those duties very seriously.”
About one part of the Sarbanes-Oxley Act there is no ambiguity or debate: Directors will be working considerably harder, and under ever-closer scrutiny.
