The Sarbanes-Oxley Act: costs, benefits and business impacts

The Sarbanes–Oxley Act Costs, Benefits and Business Impact

Michael F. Holt

AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO CIMA Publishing is an imprint of Elsevier

CIMA Publishing An imprint of Elsevier Linacre House, Jordan Hill, Oxford OX2 8DP 30 Corporate Drive, Burlington, MA 01803, USA First published 2008 Copyright © 2008 Elsevier Ltd. All rights reserved No part of this publication may be reproduced in any material form (including photocopying or storing in any medium by electronic means and whether or not transiently or incidentally to some other use of this publication) without the written permission of the copyright holder except in accordance with the provisions of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency Ltd, 90 Tottenham Court Road, London, England W1T 4LP. Applications for the copyright holder’s written permission to reproduce any part of this publication should be addressed to the publisher Permissions may be sought directly from Elsevier’s Science and Technology Rights Department in Oxford, UK: phone: (+44) (0) 1865 843830; fax: (+44) (0) 1865 853333; e-mail: [email protected]. You may also complete your request on-line via the Elsevier homepage (http://www.elsevier.com), by selecting ‘Customer Support’ and then ‘Obtaining Permissions’ British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library ISBN

978 0 7506 8023 3

For information on all CIMA Publishing Publications visit our website at www.cimapublishing.com Typeset by Integra Software Services Pvt. Ltd, Pondicherry, India www.integra-india.com Printed and bound in Hungary 08 09 10 11 12

10 9 8 7 6 5 4 3 2 1

Working together to grow libraries in developing countries www.elsevier.com | www.bookaid.org | www.sabre.org

Contents 1 The Background

1

2 The Impact on Public Corporations

11

3 The Impact on Private Companies and Small Businesses

23

4 The Impact on the Financial Community

31

5 The Impact on Accountants and Auditors

41

6 The Impact on Foreign Corporations and Governments

45

7 The Impact on the Public

51

8 “SOXPACKED”

65

9 Conclusions

73

10 An Interview with a CFO

79

Appendices Appendix A – The Sarbanes–Oxley Act of 2002 (abridged)

147

Appendix C – OSHA Whistleblower Complaint 157

Appendix D – A Typical Code of Ethics

201

Notes

205

Index

209



Procedures – Final Rules

Contents

Appendix B – Securities Exchange Act of 1934

87

iii

This page intentionally left blank

1 The Background

This page intentionally left blank

In 1886 the Illinois Supreme Court struck down 230 state laws designed to regulate corporations. The most significant decision was the ruling in Santa Clara County v. Southern Pacific Railroad declaring that corporations were persons under the 15th Amendment. When the case began, the Chief Justice, Morrison R. Waite stated: The Court does not wish to hear argument on the question whether the provision in the Fourteenth Amendment to the Constitution, which forbids a state to deny to any person the equal protection of the laws, applies to these corporations. We are all of the opinion that it does.

While corporations are theoretically considered to be the product of their shareholders’ wishes, in fact they are more likely to be the result of the efforts, desires and ambitions of their senior executives, mainly because these people are the ones with the knowledge and power to direct the path of the corporation, and hopefully with the expertise and judgement to attain their corporate objectives. This is, after all, their job, to make the corporation successful and profitable. As long as they do so, and the shareholders share in increased profits, they will probably receive little in the way of complaints or criticism, that is, unless they do something really outrageous. Even then, examples of shareholders revolting over the practices of their corporation when their share price or dividends aren’t affected are scarce to say the least. Avariciousness is not the private domain of executives; it infects every shareholder to some degree.



This was the time of the great “Robber Barons” of American history, those entrepreneurs and industrialists who built the railroads, steamship lines and the factories of the burgeoning US economy. Whatever your view of these men, whether they epitomized the daring, innovative, creative and hard working pioneers of this fresh young country, or whether they stood for exploitation, crooked dealing, nepotism and political manipulation for their own greedy ends, the facts are that they formed the model for the modern American Corporation.

The Sarbanes–Oxley Act

And so began the change from people controlling corporations to corporations controlling people. The ruling gave corporations the same rights as persons, but with none of the obligations and social responsibility carried with those rights. It paved the way for rendering people subservient to corporations.

3

The Sarbanes–Oxley Act

What does infuriate shareholders is when their executives pay themselves exorbitant salaries or benefits, or make decisions that cause their share value to drop. When the activities of management adversely affect the financial welfare of their shareholders, then things tend to get hot. Which is why, of course, any financial shenanigans or dubious practices on the part of the management and executives is carefully disguised and hidden.

 4

It seems that shareholders generally don’t mind their corporations paying large salaries and bonuses to their executives, provided the boards can justify the expense on the grounds that they need to attract competent and successful CEOs, CFOs and COOs by outpaying the competition. Because simple, huge salaries don’t provide much incentive for executives to strain themselves to do a good job, in the 1990s companies created different types of financial packages to lure top executives. Performance-based systems evolved, under the reasoning that tying executives’ compensation to the performance of the company would motivate them to maximize shareholder value. It seems that shareholders and boards of directors did not consider the potential for senior management to devise methods, including falsification of financial information, to “beat the system” for personal gain. The current stock option “backdating” scandals is a prime example of this (See Chapter 2, Impact on Public Corporations). Incentive compensation plans were factors in the demise of Enron, Global Crossing and WorldCom. Exercising their stock options for huge personal gains, the senior management and executives both contributed to and foresaw the impending collapse of their companies, and quickly abandoned the ship, leaving the shareholders with empty pockets, financial collapse and broken dreams. The US government, as well as most of the other western governments, saw the collapse of these companies with their obviously fraudulent executive behaviour as a threat to shareholder confidence in the stock markets. It was apparent that in addition to calling the executives to account in court, some tightening of the rules was necessary to prevent similar events from happening again. President George W. Bush charged Senator Paul Sarbanes and Congressman Mike Oxley with the job of creating some tough new laws that would prevent or at least diminish the possibility of corporate scandals like Enron, WorldCom et al from happening again.

On 30 July 2002, President Bush signed the Sarbanes–Oxley (SOX) Act of 2002 into law, with the following comments.          and now with a tough new law we will act against those who have shaken confidence in our markets, using the full authority of government to expose corruption, punish wrongdoers and defend the rights and interests of American workers and investors.

This law says to honest corporate leaders: your integrity will be recognized and rewarded, because the shadow of suspicion will be lifted from good companies that respect the rules.

This law says to shareholders that the financial information you receive from a company will be true and reliable, for those who deliberately sign their names to deception will be punished. This law says to workers: we will not tolerate reckless practices that artificially drive up stock prices and eventually destroy the companies, and the pensions, and your jobs. And this law says to every American: there will not be a different ethical standard for corporate America than the standard that applies to everyone else. The honesty you expect in your small businesses, or in your workplaces, in your community or in your home, will be expected and enforced in every corporate suite in this country.1

So the SOX Act came into being and when the contents of the Act became known, the shockwaves travelled throughout the boardrooms of corporations, not only in the United States, but around the world (See the text of the Act in the Appendices, abridged to take out some of the legalese, footnotes etc. and with a note for each Section indicating what action was required of affected companies).



This law says to corporate accountants: the high standards of your profession will be enforced without exception; the auditors will be audited; the accountants will be held to account.

The Sarbanes–Oxley Act

My administration pressed for greater corporate integrity. A united Congress has written it into law. And today I sign the most farreaching reforms of American business practices since the time of Franklin Delano Roosevelt. This new law sends very clear messages that all concerned must heed. This law says to every dishonest corporate leader: you will be exposed and punished; the era of low standards and false profits is over; no boardroom in America is above or beyond the law.

5

The Sarbanes–Oxley Act

 6

Sarbanes–Oxley isn’t a one time blip on the radar screens of corporations; it’s an on-going, growing and developing new way of conducting business. As the feedback comes in, legislators and bureaucrats, watchdogs like the SEC and professional associations like the American Institute of Certified Public Accountants, international and global groups like the International Accounting Standards Board and the Federal Accounting Standards Board, all continue to develop and refine the processes and standards for both satisfying the requirements of SOX and clarifying the standards for the accounting and auditing professions and for corporate behaviour generally. Convergence is a big buzzword. Governments and multinational, international or transnational corporations (whatever they choose to be called) are striving to reach an international agreement to produce a set of standard, cross border rules and standards in the accounting world. As this book goes to press, Rep. Barney Frank (D-MA), Chairman of the House Financial Services Committee, introduced legislation on Thursday, 1 March 2007 that would allow shareholders to vote on executive pay. H.R. 1257 would complement new executive pay disclosure requirements that the SEC adopted last year. The SOX Act (which is presented in slightly abridged form in Appendix A) contains a lot of legal and bureaucratic verbiage, and I have appended notes on each Section of the Act which indicates any actions a company needs to take to become compliant, but the specific articles that are of interest to most companies are as follows: Section 108 defines what “accepted accounting principles and practices” are and which a company is obliged to use in its accounting system. Sections 201 and 202 define which services an external auditor can perform for the company. Section 204, 205 and 301 require the establishment of an Audit Committee. Section 302 the big one, requires that the CEO and CFO certify that their Internal Control System is working and that their reports are correct. Section 403 effectively prohibits loans to executives by the company. Section 404 302’s partner, makes the establishment of an effective and complete Internal Control System mandatory.

Section 406 requires all senior financial executives to sign a code of ethics. Section 409 requires that the company disclose material financial changes in the company’s condition in a rapid and timely manner. Section 802 and 1101 prohibit the altering, destruction or falsification of any documents with the intent to impede the investigation of ANY matter within the jurisdiction of ANY agency of the US government. Keep, file and archive everything! Section 806 and 1107 are the whistleblower protection sections. Section 807 defines shareholder defrauding penalties which may relate to the “backdating” issues if they were done improperly. Section 906 defines the requirements of periodic reports and importance of making sure they contain all material information.

In broad terms, what a company needs to do is: Establish the company’s “Control Environment”. This means, to quote COSO,2 The Control Environment sets the tone of the entire organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values and competence of the entity’s people; management’s philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors. (COSO)

Perform a company wide “Risk Assessment” Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and



Most companies have adopted the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework for building their Internal Control System, the core element of compliance.

The Sarbanes–Oxley Act

In a nutshell, what is required is that every public company listed on a US Exchange or having more than 300 US shareholders (if a foreign corporation) must comply with SOX.

7

analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change. (COSO)

The Sarbanes–Oxley Act

Establish the company’s “Control Activities” Control Activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity’s objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties. (COSO)



The Policies and Procedures Manual forms the heart of the Internal Control System.

8

Establish a Monitoring System to ensure that the foregoing activities are carried out and adhered to. Internal Control Systems need to be monitored – a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board. (COSO)

To accomplish these objectives, the IT department will need to structure systems that coordinate, record, control and archive all the myriad activities that the company employees perform in order to accomplish the company’s objectives. It will be necessary to appoint an internal auditor or audit team to monitor the Internal Control

System and make sure that it is effective and complete. In a smaller company, the internal auditor may double as a compliance officer whose job is to keep track of the constantly changing laws, regulations and practices that govern company activities. The CFO and CEO will rely heavily on the reports from the auditor and the audit committee when signing off the periodic financial reports.

The Sarbanes–Oxley Act

 9

This page intentionally left blank

2 The Impact on Public Corporations

This page intentionally left blank

How much is this costing? Well, let’s take a look at the reported costs by some of the medium sized and large corporations. Proportionally, large corporations tend not to be hit as hard as smaller ones when it comes to the costs of compliance. While the actual dollar costs for a multinational will likely be anywhere from $1 million to $10 million, this represents a much smaller percentage of their net revenues than does the $250,000–$500,000 it will cost smaller companies.

For a good report on SOX costs (2005) check out the “ARC Morgan” Report at www.auditnet.org/articles/Sarbanes–Oxley_ Implementation_Costs.pdf The most expensive aspects of SOX are the installation and maintenance of an adequate Internal Control System, and the increased costs of the auditing process. Most of the other aspects of SOX compliance are necessary but not particularly costly to implement. The Internal Control framework as described by the COSO model is based on an assumption of the traditional hierarchical model of company structure. Management issues policies and the employees carry them out based on procedures designed to ensure that the policies are followed down to the smallest detail. This methodology goes a long way to minimizing employee fraud and inefficiency because it leave little room for deviance from set procedures, but it does little to avoid management fraud. Management simply overrides the controls if it wishes to, or at least ignores them.



Every industry analyst has a different estimate of the initial costs and the on-going costs of compliance. What is obvious is that for larger companies the initial costs are in the millions and the maintenance and audit costs are also in the millions. Audit costs alone have instantly risen by anywhere from 20 to 40 per cent depending upon who is doing the estimating.

The Sarbanes–Oxley Act

Some estimates of the initial cost of compliance for larger companies are for 20,000 staff hours – which translates to around half a million dollars – to a company like AIG, one of the world’s largest insurers- who reported spending $300 million a year on compliance. GE reported spending $30 million on internal controls alone, and Intel apparently is spending $25 million a year. RTI International Metals reported spending for 2004 of $6.5 million.

13

The Sarbanes–Oxley Act

An example of the way management tried to get around controls is the way they have recently been caught using “backdating” of stock options to provide their executives, and sometimes their employees, with extra cash. Backdating of stock option grants is apparently not illegal, in the United States anyway, if no documents have been forged and the shareholders are informed of the transaction., The grants must also be properly reflected in earnings, which means that the reported earnings for the year of the grants must be reduced by the actual value of the grants, not the backdated value, and also be properly reflected in taxes, both for the employee and the company.

 14

A very thorough review of backdating can be found at www.biz.uiowa.edu/faculty/elie/backdating.htm based on a study by Erik Lie of the University of Iowa. The people who are defrauded, of course, are the ordinary shareholders who don’t get the chance to re-price their shares, not to mention consumers who end up paying for all the financial malfeasance and the efforts to prevent it. Crooked executives cost us all billions of dollars every year. Whether it is backdating, forward dating or holding the issue date open to see where the stock goes, many of the current flock of scandals involve deliberate fraud and these will end up in court. Some already have, like Gregory Reyes, former CEO of Brocade Systems and his VP of Human Resources, Stephanie Jensen. Jacob “Kobi” Alexander, CEO of Comverse Technology is still facing extradition from Namibia, where he ran from the FBI following exposure of his backdating practices that enriched himself and some of his top executives. He was arrested in Namibia in September 2006, then released on bail and has started a new company in Namibia, presumably expecting to beat the extradition suit. Myron F. Olesnyckyj, the former general counsel of Monster Worldwide Inc, a huge Internet job listing site, was permanently banned from working as a director or officer of a public company as settlement of an SEC lawsuit over backdating options (March 2007). What started as an incentive programme to lure senior executives and valued employees became an entitlement. Which is where the system began to be abused. The fat is in the fire right now, and there are some moves afoot to scrap the entire stock option system. Whether this is a good idea or not probably depends on whether

you are someone who is in line for options or are just an ordinary shareholder.

If you are interested in keeping abreast of the latest developments in the backdating issue, check in at www.issproxy.com/optionsback dating/index.jsp where Institutional Shareholder Services are maintaining an on-going information centre on the subject.

When SOX was first enacted, many software suppliers quickly cobbled together systems that purported to provide solutions for SOX compliance. Over time, these systems have been refined and SOX specific systems have been developed. There are now dozens of solutions available suitable for a wide range of companies and at a great variance in cost. One company that provides an IT solution is “Imperva, Inc” who market “SecureSphere” as a comprehensive system for SOX compliance. To quote from their website, The Sarbanes–Oxley Act (SOX) of 2002 sets new requirements for the integrity of the source data related to financial transactions and reporting. To prove the integrity of data, companies must extend audit processes to the financial information stored within corporate databases.



The IT department is obviously key to achieving compliance. That the workload and costs have increased considerably is a given. Not only must a system be in place to track, file and archive all the company’s electronic communications, it needs to provide the necessary audit trail to ensure that the Internal Control System is in place and working, and that the company financial statements are accurate, true and complete.

The Sarbanes–Oxley Act

As it is, close to a hundred companies are under investigation and more are being scrutinized. A recent (July 2006) study by Erik Lie of the University of Iowa suggested that close to 30 per cent of the companies studied (7774) used backdating of options. The companies found to be performing illegal or fraudulent backdating will likely have to resubmit financial statements and may be liable to civil and criminal actions by regulators, tax collectors and shareholders. It should be noted that since the SEC brought in the requirement that ESOs must be reported (filed) within two days of their being issued (August 2002) the number of backdating occurrences has been significantly reduced.

15

Auditors and information technology (IT) professionals must work together to prove that data usage in Oracle E-Business Suite, SAP, PeopleSoft and other package or custom applications meets SOX control requirements. Also, database administrator (DBA) and developer activity that takes place outside the structured business process of these applications must be monitored against controls.”

The Sarbanes–Oxley Act

To read more about their solution, visit their website at, www. imperva.com.

 16

Another company providing a solution is “Global Relay”. Their emphasis is on the archiving, security, search, retrieval and monitoring of messaging, which is a large part of the compliance package. Taking a look at their description of what their product can accomplish helps to get an idea of the scope of the requirements.

Global Relay’s Sarbanes–Oxley Solution Global Relay’s suite of hosted services ensures reliability and integrity of electronic records while providing economical and efficient use of company resources. Global Relay’s Message Archiver, Compliance Reviewer, Bloomberg Converter and IM Interpreter are specifically engineered to provide a total compliance solution for public companies subject to Sarbanes–Oxley with: 1. Recordkeeping 2. Internal controls and supervision 3. Audit controls

Recordkeeping The Message Archiver, Global Relay’s message archiving and compliance system, captures and archives an authentic and complete record of all electronic business communications in a secure but easily accessible offsite storage system. Compliance features include: N Message Capture of email, attachments, IM & Bloomberg N Archives messages up to a 7 year term (or as defined by deletion policies)

Internal Controls and Supervision The Compliance Reviewer, Global Relay’s monitoring system, provides organizations with a turn-key, flexible, online supervisory system with advanced monitoring, filtering and eDiscovery features enabling enforcement of your firm’s email & IM policies for compliance, proper usage and corporate governance. Compliance features include: N Scan & Monitor email, attachments, IM & Bloomberg from online Archiver N Content Filtering with company-defined rules to identify prohibited content N Advanced Analysis with Boolean logic, criteria lists, proximities & action alerts N Random Sampling of each employee’s messages customized by percentage & user



How does the Message Archiver work? All email, attachments, Bloomberg and IM and are securely captured and centrally unified together with imported legacy email and .pst files, in Global Relay’s Message Archiver for rapid online search, retrieval & monitoring. With secure web-based access and real-time indexing powered by search engine technology, every employee and Compliance Officer has the ability to find any current or historical message in seconds.

The Sarbanes–Oxley Act

N Access includes web-based instant access for all employees to their messages N Tamperproof protection of data on dedicated WORM (Write Once, Read Many) N Offsite, mirrored, single instance storage in East/West Coast Data Centers N Indexes & serializes messages, Bcc & Distribution Lists, metadata & audit trails N Search & retrieval of any message in seconds using Google-like search engines N Security & encryption of systems, networks & messages N Migration of legacy data (.pst files, backup tapes) & to archive with new messages N Retention Term flexibility for Litigation Holds & SEC investigations

17

The Sarbanes–Oxley Act

 18

N Keyword Search results are highlighted within the message for quick discovery N Full Review of messages & attachments, or bulk review of headers only N Reviewer approval, rejection, escalation based on action icons & defined notes N Multi-tiered Review structure for review escalation to Super Reviewers N Access Rights of authorized Reviewers governed by customized security rules N Notifications of compliance violations by email or IM N Audit Trail with detailed time history of reviews and related actions taken N Web-based Control Center to modify surveillance & monitoring procedures N Exclude Words, phrases or email accounts (e.g. disclaimers, attorney-client privileged mail, newsletters) from Flagging Rules N Wizard Commands for pre-defined, single-click compliance using folders, flags, priorities & labels How does the Compliance Reviewer work? Using powerful search engines, the Compliance Reviewer is able to retrieve your firm’s messages from the Message Archiver and apply easy-to-use, company-defined filters and Wizard Commands for efficient review and monitoring of all archived email, IM, and Bloomberg messages. Messages of any user are analyzed on import and flagged for review if violations are detected as follows: 1. real time filtering for keyword or phrase violations (start-up list provided) 2. specific query using flexible search criteria 3. advanced rule-based keyword & phrase proximity analysis 4. random sampling (by User, User Group, or firm-wide, using percentages).

Audits Global Relay’s Message Archiver & Compliance Reviewer Audit Tools are designed to facilitate efficient responses to regulatory audits and evidentiary requests. Global Relay has successfully assisted hundreds of companies and SOX-regulated firms during

their audits and regulatory investigations. Currently, Global Relay participates in approximately 3 to 6 customer audits/subpoenas per week.

How do Global Relay’s Audit Tools assist with an Audit? Global Relay provides flexible and efficient methods to produce records according to the specific criteria of the audit request. Messages are made readily available for examination either by:

N create online search parameters based on Audit request N restrict access to the exact scope of the audit (by date, user, subject etc.) N assign Auditors temporary online review privileges N block attorney-client privileged, personal or restricted messages N generate an automatic audit trail of Auditor’s review (ie: audit the Auditor!) N side benefit of data no longer in Auditor’s possession once audit is complete 2. Compilation of data for delivery to Regulators N fast discovery, consolidation and organization of data for export & delivery N compile requested information on regulator-qualified media such as DVD or CD”. Details of the company’s products can be found at www. globalrelay.com



1. Online review of messages via an “auditor account” in Message Archiver

The Sarbanes–Oxley Act

N Search & retrieval of any message in seconds using Google-like search engine N Audit Request response within minutes using online search and eDiscovery tools N Statistics & reporting on Compliance Officer reviews & related actions taken N Retention Term flexibility for Litigation Holds & anticipated SOX investigations N Legal Compliance in-house specialists to assist during audits N Case Management via folder system with shared folders (e.g. external attorney review)

19

There are many, many companies offering solutions by now. Type in “Sarbanes–Oxley compliance solutions” into Google and you will get 1,300,000 results! The company’s IT department, audit committee, financial officers, and production people all need to get together to sort through the available solutions and find out which combination fits best with the company’s operations and already in-place systems, because rarely does one solution do the whole job.

The Sarbanes–Oxley Act

This is no small job and it will take the combined efforts of all involved for some time to come up with the best solution for the company.

 20

A problem to avoid when setting up an Internal Control System is that of making the procedures so rigid that they stifle innovation and creativity. This can be avoided partly by making the employees part of the procedure writing process. After all who knows better how they do their job? Then, some procedure should be established that encourages employees to suggest improvements and come up with ideas that will increase productivity or quality. Incorporating and enforcing new or even existing procedures can easily cause some employee dissatisfaction and unrest. People don’t generally like to be told how to do a job they have already been doing for a long time, and they may resent the increased attention being paid to what they do. It will take some creative and concerned human resources management to explain why this has to be done and that it does not reflect on them or how they perform their tasks. If there is a union involved, the union leaders and shop stewards will obviously have to be fully aware of exactly what SOX is and how it is affecting the company. They have to be onside to make the implementation go smoothly. A company’s suppliers and clients may also be affected as the company works towards compliance. Purchasing, ordering, invoicing and delivery methods may need changing or modifying to suit the requirements of the new Internal Control System. Suppliers and clients, who may not be public companies themselves and who are probably not well versed in the SOX requirements, may be upset at the tightening of business methods and controls. The company needs to explain exactly why all this is necessary.

The prequel to this book, The Sarbanes–Oxley Act, Overview and Implementation Procedures3 , contains a CD which has a PowerPoint Presentation describing the SOX Act and compliance requirements aimed at employees and others with limited knowledge of the Act. So that they can understand why compliance is necessary and what it implies.

The Sarbanes–Oxley Act

 21

This page intentionally left blank

3 The Impact on Private Companies and Small Businesses

This page intentionally left blank

Sarbanes–Oxley legislation is only binding on reporting, or public corporations. Having said that, we can also say that the effects of SOX are having a far-reaching impact on private companies and on small businesses.



A good example of this trickle down effect is the cost of auditing for non-profit companies and societies. While private businesses don’t necessarily require annual external auditing, non-profits usually do, and the shareholders of private corporations may demand it. The cost of these external audits has risen by 30–40 per cent typically, because the auditing companies are using the same criteria and methodology for them as for the public companies. Why? Because they have the system set up and established and there is a potential for liability if any wrong doing or material errors are found after an audit, particularly if it was not done with the same thoroughness as they would use for a larger, and particularly public, company. It echoes the old legal concept that if you don’t use something that is available and in common use, and there is a problem that arises because you didn’t, then you are liable for the results because of your neglect. Besides, once a system is set up and being used successfully, people are loath to change it.

The Sarbanes–Oxley Act

The main reason is that there is now a huge public awareness of the need for good corporate governance on the part of every company we do business with. Banks and other lenders, accountants, attorneys, insurers, government contract issuers and shareholders – if there are any – want to know that the company they are dealing with is doing things right. They want to know that management knows what is going on in the company, that it has some form of adequate internal control mechanism in operation, that its reporting is accurate and honest and that the management team are willing to take responsibility for the outcomes of company activities. Additionally, accountants, auditors, lawyers and others whose reputations and liabilities are at stake when they perform services for these non-public companies tend to apply the same rules and procedures as they are now required to do for public companies. In part this is because they realize that the governance principles defined by SOX are a reasonable and useful foundation for good business practices, so they form a practical template for servicing non-public companies, and in part because their professions are under greater scrutiny at all levels.

25

If you are a bank manager considering a loan, or a government body considering awarding a contract, or an insurer considering a liability insurance policy, you are going to want to know that the company and its management are operating under good corporate governance principles. SOX rules provide a template to measure against.

The Sarbanes–Oxley Act

Business writers often get called on to prepare business plans. Good plans written post-SOX will have a comprehensive section dealing with the Internal Control System and governance structure of the company. Investors will likely want to ensure that there is a Policies and Procedures Manual in place, no matter how small the company is.

 26

Policies and Procedures are the backbone of the Internal Control System. They define the corporate policy of the company in all aspects of its operations, and define the procedures to be carried out by the employees of the company, including management responsibilities. Even if there are only two people in the company, there should be a document that outlines in considerable detail the responsibilities of each person and the criteria they will use to perform their functions. A very significant impact on private companies is the effect SOX has on their plans for going public. From the standpoint of the IPO, having an existing effective and functional Internal Control System, and being SOX compliant in the other areas also, will make the company much more attractive to potential investors as well as the underwriters and market makers. They know that if the company is not compliant now, it will have to spend a chunk of money right away to become compliant once it is listed. The same principle applies to mergers and acquisitions. If a public company takes over another company, then its corporate compliance responsibility extends to its new acquisition. Consequently, if the company being acquired doesn’t have an Internal Control System that is adequate, or has other gaps in its structure, the acquiring company is going to have to spend some significant money bringing it up to scratch. Since many small companies look to either going public or being bought out as their initial investors’ exit strategy as well as the means to future growth, not being SOX compliant can be an obstacle. SOX compliant companies make better take-over targets. Any private company considering a public offering or being considered by another company for acquisition or merger will soon

discover that it must have audited financials for three years from an independent auditor, it must have independent directors, and it must have a functioning, independent audit committee. Nor can there be any outstanding loans to directors. Granted that in the great scheme of things, the cost of becoming SOX compliant is not all that great compared to the other expenses involved, and they can be absorbed comfortably by most healthy companies, it is still a factor.

Perhaps the best reason for becoming SOX compliant though is that the requirements, when adopted, will make the company more efficient, and help to reduce such negative influences such as theft, incompetence, redundancies and dishonest dealings. Let’s not forget that, despite some problems, SOX was created to solve problems that were real, and in general has succeeded. It helps if one can look at the trouble and expense of becoming compliant not as an onerous chore that is being imposed on the company, but as a normal and inevitable aspect of company growth and development. From a small, private company standpoint then, what would be practical to undertake in order to become reasonably compliant? (1) Create a Policies and Procedures (P&P) Manual if you don’t already have one, and update it if you do.



This study makes for interesting reading for anyone wishing to delve a bit deeper into this aspect of SOX and private companies. It can be found at: http://www.foley.com/files/tbl_s31Publications/ FileUpload137/3511/ndi%202006%20private%20study.pdf

The Sarbanes–Oxley Act

If the company has any outside investors it is going to be a good idea to take a good look at bringing in some corporate governance reforms along the lines of SOX. While the rather onerous audit requirements don’t normally apply to them, it’s a good bet that any investor complaints or charges are going to be looked at and scrutinized with SOX principles in mind. Many executives seem to think that it is a good idea to bring in some form of internal control and other good governance practices into their companies. A recent (January 2006) survey performed by Foley & Lardner LLP and presented to the National Directors Institute indicated that 70 per cent of the respondents had instituted self-imposed corporate governance reforms.4

27

It’s a good idea to include a preamble to the P&P that outlines the company’s (and management’s) corporate philosophy, its general goals and aims, and the expectations it has for its people.

The Sarbanes–Oxley Act

All management people should understand and sign a Code of Ethics, (example in Appendix D). This is a good thing, and it tends to inspire confidence and trust both inside and outside the company, and may give an executive pause before he or she does something dubious.

 28

(2) Designate or hire someone as an internal auditor and/or as a compliance manager. This person will become the company watchdog, ensuring that Policies and Procedures are being followed, and that the rules and expectations of governments and other regulators are being followed. This person can also be the designated recipient of “whistleblower” actions and must be given clear instructions and authority to deal with situations correctly and effectively. This function could also be delegated to the Human Resources Manager, depending on the size of the company, work loads and so on. Whistleblowers should not be considered as sneaks or traitors, but as people who honestly believe that there is something going on which negatively impacts the company and needs to be fixed. Because that’s what it usually is. Their disclosures will almost certainly expose something that requires attention, even if they are misreading something or mistaken. A proper Internal Control System requires that a set of rules or procedures be established, together with a system of ensuring that they are followed. This becomes the job of the Internal Auditor, ensuring that the system is working. He or she will report directly to the Board on these matters, or to the Audit Committee if the company is large enough to have one. Many companies have spent most of their time on the P&P side of the Internal Control System and have neglected the equally important side of Monitoring. It’s no good having a detailed and excellent set of P&Ps if no-one is following them! (3) Have at least one independent director on the Board. It used to be a given that, short of deliberate malfeasance or illegal actions, a director, either company or independent, was shielded from personal liability for errors or mistakes in judgement if they

were able to demonstrate that they had exercised normally prudent business judgement.

This is an area that tends to fall behind. People don’t have time to archive their emails in a way that they can be found easily; papers get shoved into “miscellaneous” folders where they are effectively lost to future searchers. Passwords are forgotten or not passed on when someone changes jobs or particularly if he or she quits or is fired, and electronic files become inaccessible to the next person to hold the job, or to the auditors. Organizing a company’s documentation is a big job, and an important one. Getting everyone to follow the plan is even tougher.



(4) If there is any intention of going public or contemplating a merger or acquisition, call in any corporate loans to insiders. It is often difficult to clear them from the books quickly, particularly if they are long-standing. (5) Appoint a documentation manager. This person will ensure that all company documents – records, transactions, financial records, communications, reports, e-mails and any other kind of documentation, either electronic or paper – are properly retained, filed, recorded and accessible when needed. If there is one thing that is supremely important when problems arise, it is the availability of a solid paper trail. Paper nowadays includes electronic communications.

The Sarbanes–Oxley Act

Generally, the business-judgment rule defence has not been available if the director isn’t independent or does not act in good faith or exercise due care. If there is no evidence of fraud, bad faith, or self-dealing, the business-judgment rule usually applies to shield individual directors from personal liability. In making their business decisions, they are presumed to act on an informed basis, in good faith, and in the honest belief they are acting in the best interests of the corporation and by inference, the shareholders. The law does not require them to do the best job possible, just a reasonable job under the circumstances. There is some evidence that this shield is disappearing and directors are becoming more exposed to liability for their actions or more so, their inactions. Directors may be held responsible if they are indifferent to important matters that result in problems, particularly if that indifference resulted in investors or shareholders losing money.

29

This page intentionally left blank

4 The Impact on the Financial Community

This page intentionally left blank

Credit rating firms are partly blamed in the major corporate failures which prompted the SOX Act for their lack of diligence in identifying credit problems. Standard & Poor’s (S&P) and Moody’s did not reduce Enron’s credit ratings from investment grade to junk level until four days before Enron’s doors shut. Considering that WorldCom and Global Crossing were also rated investment grade only months before bankruptcy, a disturbing pattern emerged. Congress was keen to target the credit rating sector for failing to identify weaknesses at Enron and other companies as it pressured the SEC to re-examine the role of credit rating agencies and to propose greater oversight of the rating firms’ anticompetitive practices and conflicts of interest. Recognizing how important credit ratings are to securities markets, Section 702 of SOX contains a directive for the SEC to re-examine the role and function of credit rating agencies in the securities markets. Pursuant to section 702, the SEC released an initial report in January 2003, followed in June 2003 by a Concept Release, “Rating Agencies and the Use of Credit Ratings Under the Federal Securities Laws.”

The Sarbanes–Oxley Act

The full text of the report can be found at www.sec.gov/news/ studies/credratingreport0103.pdf



The fallout from the studies by the SEC and others damaged the credibility of the Credit Reporting Agencies and they immediately tightened up their ratings methodology. Some significant problems did emerge from the various studies, submissions and reports, such as conflicts of interest, lack of competition, information flow, the ratings process and degree of regulatory oversight of the rating firms. Subsequently, and emerging from the reports and studies, a new Act was passed by the US Senate. The Credit Rating Reform Act of 2006 came into law in September 2006. This is a summary of the new law. The full text can be viewed at: http://frwebgate.access. gpo.gov/cgi-bin/getdoc.cgi?dbname=109_cong_public_laws&docid= f:publ291.109 The Credit Rating Agency Reform Act of 2006 – (Sec. 4): N Amends the Securities Exchange Act of 1934 to require nationally recognized statistical rating organizations (NRSROs) to register with the Securities and Exchange Commission (SEC).

33

N Requires registration applications, among other items, to include on a confidential basis:

The Sarbanes–Oxley Act

(1) a list of the twenty largest securities issuers and subscribers that use the applicant’s rating services; and (2) certifications from at least ten qualified institutional buyers (QIBs) that they have used the ratings for at least the three most recent years, including two certifications for each type of rating the applicant will issue.

 34

N Exempts from the latter written certification requirement any credit rating agency which has received, or been the subject of, a no-action letter from the SEC staff before 2 August 2006, stating that such staff would not recommend enforcement action against any broker or dealer that considers credit ratings issued by such credit rating agency to be ratings from an NRSRO. N Requires the SEC within ninety days of receiving an application to grant registration or institute proceedings to determine whether not to. N Requires the SEC to grant registration unless the applicant does not have adequate financial and managerial resources to consistently produce credit ratings with integrity and to comply materially with the procedures and methodologies disclosed in its application. N Requires each NRSRO to certify annually that the application documents (other than the QIB certifications) remain accurate, and to list any material changes that occurred. N Grants the SEC exclusive enforcement authority over any NRSRO that issues credit ratings in material contravention of the procedures included in its registration application. N Prohibits the SEC or any state or local government from regulating the substance of credit ratings or the procedures and methodologies by which a NRSRO determines credit ratings. N Requires SEC rules to be narrowly tailored, and not purport to regulate either the substance of credit ratings or the procedures and methodologies by which NRSROs determine credit ratings. N Provides for censure, denial, suspension or revocation of NRSRO registration. N States that it shall be unlawful for: (1) an NRSRO to represent or imply that it has been designated, sponsored, recommended or approved, or that its abilities or

qualifications have in any respect been passed upon, by the United States or any federal agency, officer, or employee; or (2) a credit rating agency that is not registered as a NRSRO under this Act to state that it is so registered. N Requires each NRSRO to establish and enforce written policies and procedures to: (1) prevent the misuse of non-public information; and (2) manage conflicts of interest. N Directs the SEC to issue final rules to prohibit unfair, coercive, or abusive acts or practices by NRSROs. Includes among such acts:

(1) designate a compliance officer to ensure compliance with securities laws, rules, and regulations; and (2) furnish the SEC with financial statements certified by an independent public accountant. N Makes registration under this Act the sole method of NRSRO registration. Prohibits any credit rating agency treated as an NRSRO before enactment of this Act from relying on no-action relief for continued treatment as an NRSRO in lieu of active registration. N Pre-empts any state and local law requiring the registration, licensing, or qualification of an NRSRO (or any employee or contractor) as a credit rating agency or an NRSRO. Declares, however, that nothing in this pre-emption prohibits a state securities commission (or similar agency or office) from investigating and bringing an enforcement action with respect to fraud or deceit against any NRSRO or associated person.



N Requires an NRSRO to:

The Sarbanes–Oxley Act

(1) conditioning or threatening to condition an issuer’s credit rating on the purchase of other services or products; (2) lowering or threatening to lower a credit rating, or refusing to rate securities or money market instruments issued by an asset pool, unless a portion of the assets in the pool also is rated by the NRSRO; and (3) modifying or threatening to modify a credit rating based on whether the issuer or an affiliate will purchase other services from the NRSRO.

35

N Amends the following Acts to reflect the provisions of this Act:

The Sarbanes–Oxley Act

(1) (2) (3) (4) (5)

 36

Securities Exchange Act of 1934; Investment Company Act of 1940; Investment Advisers Act of 1940; Housing and Community Development Act of 1992; and Higher Education Act of 1965.

N Amends the Investment Advisers Act of 1940 to exclude any NRSRO from the meaning of investment adviser unless it engages in issuing recommendations as to purchasing, selling, or holding securities or in managing assets, consisting in whole or in part of securities, on behalf of others. N Directs the SEC to report annually to specified congressional committees on: (1) applicants for NRSRO registration; (2) actions taken on such applications; and (3) the views of the SEC on the state of competition, transparency, and conflicts of interest among NRSROs. N Requires the Comptroller General to study and report to certain congressional committees on the impact of this Act upon: (1) (2) (3) (4)

the quality of credit ratings issued by NRSROs; the financial markets; competition among credit rating agencies; and the incidence of inappropriate conflicts of interest and sales practices by NRSROs.

Section 705 of the SOX Act ordered the GAO to conduct a study of the role of Investment Banks in the financial scandals involving Enron and Global Crossing. They presented this study in March 2003. The summary is as follows. The full text can be found at: www.gao.gov/new.items/d03511.pdf. Investment Banks: The Role of Firms and Their Analysts with Enron and Global Crossing GAO-03-511 March 17, 2003 (59 pages). In the wake of a series of recent corporate scandals and bankruptcies, the Sarbanes–Oxley Act mandated that GAO study the involvement of investment banks with two companies, Enron and Global Crossing. In this report, the term “investment bank” includes not only securities firms but also those bank holding companies with securities affiliated or business divisions that assist clients in

obtaining funds to finance investment projects. Since the activities identified in this report are the subject of ongoing and extensive investigations and litigation by competent authorities, it is not our role to determine the propriety of any of the parties’ activities. To help the Congress better understand the activities of investment banks with respect to these companies we agreed to provide publicly available information on the roles investment banks played in designing, executing, and participating in certain structured finance transactions, investment banks’ and federal regulators’ oversight of these transactions, and the role that the banks’ research analysts played with Enron and Global Crossing.

In the wake of the scandals, research analysts at investment banks who made favorable recommendations for failed firms have also come under public scrutiny. Investment banks allegedly pressured analysts covering Enron and Global Crossing to give investors



Oversight responsibility for the investment banks’ part in these transactions lay with both the banks themselves and the federal regulators. Investment banks told us that they had vetted transactions involving Enron through their risk management and Internal Control Systems. Since Enron’s collapse, these firms reportedly have been taking some steps to strengthen their internal controls, in part because they are now more sensitive to reputation risk. Federal financial regulators noted that before Enron’s collapse they had not viewed structured transactions with investment-grade counterparties as particularly high risk in their exams. They subsequently are refining their approach to supervising structured transactions, and bank regulators now plan to include more transactions in their exams. Regulators are currently conducting targeted reviews of structured finance transactions at large firms and plan to develop guidance or best practices that clarify their expectations for sound control and oversight mechanisms.

The Sarbanes–Oxley Act

Certain investment banks facilitated and participated in complex financial transactions with Enron despite allegedly knowing that the intent of the transactions was to manipulate and obscure Enron’s true financial condition. The investment banks involved in the transactions we reviewed contended that their actions were appropriate and that Enron had not revealed its true purpose in obtaining their assistance. While investment banks are not responsible for the financial reporting of their clients, if it is proven that the investment banks knowingly assisted Enron in engaging in securities law violations, SEC has the authority to take legal action against them.

37

The Sarbanes–Oxley Act

favorable or misleading investment recommendations in order to keep or win lucrative work from the companies, creating serious conflicts of interest. Although the investment banks denied the allegations, several have been investigated by regulators and involved in litigation about conflicts of interest between their research and investment banking departments. Certain federal regulators and self-regulatory organizations have all adopted additional regulations addressing such conflicts. Although investment banks are not typically responsible for their client’s accounting, it is a violation of law to facilitate transactions that an investment bank knows will materially misstate the client’s financial statements. Since investment banks may be tempted to participate in profitable but questionable transactions, it is especially important that regulators be alert to this and be ready to use their enforcement tools to deter such actions. We are encouraged that investment banks and regulators are strengthening their oversight of the appropriateness of transactions, but it is too soon to evaluate the effectiveness of reforms.



This study was a wake-up call to the banks that they need to be a bit more careful about accommodating their clients’ requests for dubious financial transactions.

38

Another effect of SOX on the financial community is the movement to privatize public corporations to avoid the costs and regulatory requirements that placed a large financial and work burden on their companies. While there are other factors besides SOX that may be affecting this trend, like the current availability of large amounts of private equity cash, the constant pressure from the market for increasing stock and earnings performance, and the increasing regulatory burdens placed on companies wanting to go public, the burden of SOX is also a factor. How big a factor depends largely on who is doing the guessing. As a result of all these factors, the fact remains that private equity buyouts, which represented 2 per cent of all mergers and acquisitions in the United States between 1996 and 2002 (3 per cent in the rest of the world) increased to 11 per cent between 2002 and 2006 in the United States and 10 per cent in the rest of the world. Other than the effects of a market that has seen some significant changes since SOX was introduced, stockbrokers probably haven’t been significantly affected. It would seem that a broker would seek to understand SOX and its implications, and relate that information

The Sarbanes–Oxley Act

to stocks that he or she was trading and recommending if only to ensure the company in question was likely to be compliant and thus avoid any unpleasantness in the future, and that would entail some extra work. The decline of foreign listings in the US markets is prompting the SEC to look towards opening up US exchanges to foreign investors by changing the brokerage rules, and Canada and other G7 countries look set to follow. This idea of “mutual recognition”, which suggests that the laws of the jurisdiction where the exchange is located would protect investors, is gaining momentum, particularly as these countries adopt SOX-like legislation of their own, which eases the SEC’s fears for US investors in foreign markets. Such moves should benefit brokers who pursue foreign investors by promoting home country listings in foreign markets. Maybe it won’t increase the size of the pie, but it will rearrange the distribution of the pieces.

 39

This page intentionally left blank

5 The Impact on Accountants and Auditors

This page intentionally left blank

In this way, the accounting profession instantly increased its workload, and hence its value to businesses, not only by overseeing the Internal Control over Financial Reporting (ICFR) but also by fulfilling the internal and external auditing requirements. Jobs for accountants have surged and salaries have gone up because of the shortage and increased responsibilities. Universities, Colleges and Business Schools are all experiencing increased enrolment as young people become aware of the opportunities. The US Government Department of Labor (USDOL) says that, “Employment of accountants and auditors is expected to grow faster than average for all occupations through 2014.” Since a large part of the causes of this increase can be laid at the door of SOX, it goes without saying that those accountants and auditors who specialize in, or at least become proficient in, the



The American Institute of Chartered Public Accountants (AICPA) early on adopted the COSO framework for Internal Control Systems. The AICPA is one of the members of COSO, along with the American Accounting Association, Financial Executives International, the Institute of Internal Auditors and the Institute of Management Accountants. This framework provided a guiding methodology for instituting an Internal Control System adequate to meet the requirements of SOX compliance, and a model against which the Internal Control System of any company can be evaluated (See Chapter 2 for more discussion of the Internal Control System).

The Sarbanes–Oxley Act

The major thrust of SOX was aimed at the financial accountability of public corporations. As such it naturally concerned the accounting profession more than any other discipline, since accountants are the people who oversee the financial operations of companies and prepare the financial reports published by those companies. Consequently, the accounting profession essentially took over responsibility for SOX compliance and reporting. This meant that not only did the accounting department have to tighten up the procedures and documentation of the accounting aspects of the business, it had to monitor – and probably install – the Internal Control System affecting all aspects of the company’s business in order to ensure that it was working to detect any material weaknesses that might affect the financial well-being of the company. The onus was now on the accounting department to detect fraud as well as inefficiencies.

43

nuances and details of SOX related subjects will seriously enhance their job prospects.

The Sarbanes–Oxley Act

Since the collapse of Arthur Anderson, there are now only four major accounting firms left. To lose any one of them because of a liability settlement, or any other reason, would cause a severe disruption to business all over the world. Even the EU’s internal market commissioner has called for the big four to be shielded from potentially ruinous lawsuits. Liability caps exist in Germany, Austria, Belgium, Greece and Slovenia already.

 44

The huge responsibility laid on auditors by SOX has made them vulnerable to liability lawsuits. Sixteen suits in the EU sought damages in excess of $200 million and five were for over $1 billion. Needless to say, if one of those is awarded, the damage will be serious. The problem is, in part, because of the principle of joint and several liability where if an accounting firm is found to be only 1 per cent responsible for a situation, it can be held to account for 100 per cent of a claim. Many people are pushing for a more equitable arrangement such as proportionate liability. It seems reasonable that they should be shielded from having to accept full responsibility. Once again, the cost of whatever liability insurance the auditing firms can carry will be tacked onto the companies’ auditing bill. So the bottom line for accounting and auditing companies is more work, more money, more responsibility and more liability. It is true that we live in interesting times!

6 The Impact on Foreign Corporations and Governments

This page intentionally left blank

It didn’t take long for foreign governments and corporations to realize that the SOX Act was going to seriously affect the way they were going to have to conduct their businesses. While the Act applies to all foreign companies with a dual listing on a US Exchange, it also applies to those NOT listed, but having 300 or more US shareholders; regardless of where they purchased their shares. For example, shares can be purchased in the US OTC market that are not listed or registered in the USA. The first to feel the heat were, of course, those foreign corporations who were listed on US Exchanges. They immediately came under the provisions of the Act and had to take stock of their position and the desirability of continuing to be listed.

When the US IPO boom peaked in 1999, the NYSE and NASDAQ held 57 per cent of worldwide IPO proceeds, which was up from 39 per cent in 1990. By 2006 that share had dropped to 18 per cent. The



The New York Stock Exchange’s The Exchange (October 2005) stated: “Since the enactment of the Sarbanes–Oxley Act tightening corporate reporting and governance requirements, many non-U.S. companies have shied away from the United States capital markets.” Additionally, foreign companies currently listed in the United States could opt to delist voluntarily if they believe the costs of SOX compliance outweigh the benefits of cross-listing. At the margin, foreign companies can “retreat” to their home markets and avoid the compliance requirements of SOX, while their domestic counterparts’ only option is to become private.

The Sarbanes–Oxley Act

Some companies who either intended to obtain a listing or had one already, for cosmetic purposes, i.e., the prestige of having a US market listing, probably thought again. Those with a good reason for being listed in the United States had little choice, either bite the bullet and comply or delist. Of the 113 UK companies listed on the NYSE and NASDAQ, at least ten to twenty were considering delisting in November 2004 according to the UK publication, Accountancy Age. For those who chose to stay, it was estimated that the cost of compliance for a major company in Britain would be in the range of £10–20 million and take up to twenty employee years of internal time. Curiously, Asian companies apparently aren’t even considering delisting. Asian companies are generally indicating that they view SOX compliance as a useful and necessary tool to increase visibility and credibility.

47

world’s largest IPO, the $22 billion offering from the Industrial & Commercial Bank of China was listed in Hong Kong and Shanghai. Interestingly, in 1990 there were no IPOs in Hong Kong, but by 2006 they had 16 per cent of world IPOs.

The Sarbanes–Oxley Act

The Alternative Investment Market set up by the London Stock Exchange in the 1990s to cater to small companies with little operating history, reported an increase of foreign listings (not all IPOs) from thirty in 2000 to 306 in 2006, including some US ones. One of the companies who went public in 2006, Protonex Technology Corp of Southborough, Massachusetts, estimated it would have cost three times as much to list in the US according to its CEO, Scott Pearson.

 48

Since their peak in 2002, foreign listings on the NYSE have fallen 4 per cent by the end of 2006 while NASDAQ foreign listings have fallen 34 per cent. One might conjecture that the larger decrease in NASDAQ might be due to the NYSE catering more to the larger international firms who have a more established presence and a greater need to stay. It isn’t easy to delist from a US exchange. It takes at least eighteen months, and is virtually impossible for a company that made a public offering in the United States. As long as the company retains 300 or more US shareholders the SEC is going to consider it subject to US securities laws, including SOX, whether it is listed in the United States or not. In some cases SOX conflicted with local, foreign laws. For example, it is speculated that the SOX requirement that companies agree to provide information at any time in the future (Item 8.1 of the Sarbanes–Oxley registration Form) may well be in conflict with the UK Data Protection Act. In response to the conflict problems the SEC did bend and promise to make some exceptions. For example, although the SEC did not provide a broad exemption for non-US companies from the board independence requirements, it has indicated that the proposed rules will contain the following important accommodations: Shareholder Selection, Approval or Ratification of Auditors – Local law requirements that shareholders approve the selection of auditors would not conflict with the Act’s requirement that the audit committee be solely responsible for the selection of auditors. Employee Representation on Audit Committees – Where required by “co-determination” and other similar requirements of local law

or listing requirements, the proposed rule would allow employees to serve as audit committee members provided that the employee is not an executive officer of the issuer. Board Representation of Foreign Government Shareholders – To accommodate foreign issuers with controlling shareholders that are foreign governments, the proposed rule permits a foreign government representative to sit on the audit committee if that representative is not an executive officer of the issuer. Board Representation of Controlling Shareholders – A representative of a 50% or more shareholder of the issuer may serve on the audit committee provided he is not an executive officer of the issuer and maintains only observer, not voting (or chairman) status on the committee.

While the United States may have lost some competitive advantage since 2002, the rest of the world seems to be catching up on the regulatory bandwagon and it won’t be too long before the playing field levels again. Mixed metaphors notwithstanding, Hong Kong has introduced new rules which move it closer to the SEC and Canada has introduced rules that are very close, although Canada has eased the requirements for outside auditors to test a company’s Internal Control System and affirm its effectiveness. In the CSA’s words (Canadian Securities Administrators Notice 52–313), “The issuer will NOT be required to obtain from its auditor an internal control audit opinion concerning management’s assessment of the effectiveness of internal control over financial reporting.” This had been a major complaint since it added hugely to the already mounting audit costs. How do you spell “Relief”? “Rule 12h-6”!. In early 2007, the SEC promulgated a new rule affecting foreign corporations that will save millions in auditing costs. Essentially the new rule allows foreign



This rule proposal is an important step toward accommodating foreign issuers under the Sarbanes Oxley Act, but reinforces the SEC’s position that exemptions will be made only in cases of direct conflicts of law.

The Sarbanes–Oxley Act

Statutory Oversight of Auditors – The SEC acknowledged that in a number of jurisdictions, the oversight of outside auditors is the responsibility of a Board of Auditors or a group of Statutory Auditors rather than by an audit committee. The proposed rule would allow alternative structures provided in local law to perform the auditor oversight functions contemplated in Sarbanes Oxley.

49

The Sarbanes–Oxley Act

companies whose US trades over a 12-month period total less than 5 per cent of their total trades for the year to file for an exemption in compliance with SOX by exiting the SEC’s reporting system. A similar exemption is also available to companies with less than 300 worldwide or US shareholders.

 50

While Canadian and UK companies, for example, brought in their own versions of SOX, they did not require the onerous auditing requirements that the SEC demanded. Since many of these companies did have some US shareholders, they were obliged to comply with the SOX Act requirements. This added hundreds of thousands of dollars to their annual auditing costs. Rule 12h-6 will effectively remove this requirement if they did less than 5 per cent of their trades in US markets. A Form 15F is required to be filed and submitted to the SEC to certify that the company’s ADTV (Average Daily Trading Volume) over the previous 12-month period has been less than 5 per cent of its worldwide total. It is not clear (to the author anyway) as to whether the exemption will need to be renewed each year and will be denied if the trading volume goes above the 5 per cent, or whether this is a permanent exemption. Foreign companies wishing to take advantage of the exemption, and to clarify the legal aspects, would do well to employ the services of a US Securities Attorney. Here is the name of one firm that is familiar with this rule, and has successfully filed for exemption for foreign companies. Brad Wiggins Attorney at Law Theodora Oringher Miller & Richman PC 2029 Century Park East, Sixth Floor Los Angeles, CA 90067-2907 Direct: 661.297.1520 Main: 310.557.2009 Fax: 310.551.0283. This attorney has also developed the Securities Links website which contains a wide selection of information about US federal and state securities rules, legislation and procedures which may be useful. http://www.seclinks.com. The link to the SEC Rule 12h-6 is http://www.law.uc.edu/CCL/ 34ActRls/rule12h-6.html.

7 The Impact on the Public

This page intentionally left blank

These costs are not just one time hits either. While there is an initial spike in costs associated with installing and applying adequate internal controls, there are on-going costs associated with ensuring that the controls are effective, are followed and are constantly audited. So, most companies experienced an initial cost of hundreds of thousands of dollars – in the case of large corporations, millions – as they set up their internal controls and hired new personnel and consultants to get them compliant. It is safe to say that, following implementation, the maintenance costs are still in the hundreds of thousands of dollars per year for smaller and medium sized companies and millions for large corporations. Annual audit costs increased significantly because of the extra work required of the auditors. All these increased costs get passed on to the public in one way or another. In many cases the added costs of compliance resulted in lower per share earnings which directly impacted shareholders. If companies increased the price of their product(s) to compensate for the costs, sales might suffer which would again affect earnings.



These are all elements that defy quantitive measurement in dollar terms. However, company executives and industry analysts agree that costs are significant for companies required to be compliant.

The Sarbanes–Oxley Act

What effect has the passage and enforcement of SOX had, and is having, on consumers and the general public? That’s hard to measure accurately because the costs and benefits are diffused among the normal business activities of the companies affected. While some companies have managed to put a dollar figure on the costs of compliance, in most cases the numbers are vague and imprecise. In some cases, specific costs are measurable, such as the salaries and associated costs of hiring new personnel like internal auditors, compliance officers and documentation specialists. The additional costs associated with regular audits by outside firms can also be determined accurately. What cannot be determined easily are the costs incurred by changes in the company’s normal business operations, disruption of these activities through the increased work loads on employees necessitated by the need to track, document and safely store for retrieval their daily job details. Does the application of stricter internal controls such as definitive Policies and Procedures increase or reduce worker efficiency? Does it hamper innovation and creativity or does it smooth out the bumps and increase productivity?

53

In some cases, the application of an effective Internal Control System would actually improve the efficiency of the company, resulting in increased production or lower costs of production, not to mention reducing the amount of such hidden costs as theft, redundancy, duplication and incompetence.

The Sarbanes–Oxley Act

Ultimately, the public, as the consumers, pay for any increased costs which are not offset by increased efficiencies, since few companies will want to absorb these costs themselves. Their shareholders would be upset to say the least.

 54

If we include employees in general as the public, a significant element of SOX is the clearly stated protection it provides to whistleblowers who expose accounting and other financial misdeeds of their company’s executives. Section 806 of the SOX Act outlines the protection against retaliation provisions. Recently, the US senators who authored the whistleblower provision in SOX have urged the SEC to vigorously enforce the provision permitting criminal enforcement of SOX, in order to deter retaliation against corporate whistleblowers. In a letter to Chairman William Donaldson, Senators Charles Grassley (R-IA) and Patrick Leahy (D-VT) encouraged aggressive enforcement of section 806. Section 806 provides protection and a method of recourse to employees of public companies who allege that they were retaliated against for disclosing any conduct that the employee reasonably believes violates “any provision of Federal law relating to fraud against shareholders.” Any employee who makes such a disclosure to any supervisor or any other person working for the employer who has “authority to investigate, discover, or terminate misconduct” is protected. Also protected is disclosure of allegedly fraudulent conduct to a federal regulatory or law enforcement agency, a member of Congress, or any committee thereof. Thus, SOX’s whistleblower provisions provide extremely broad protection to employees of public companies for internal complaints of allegedly fraudulent conduct. The enforcement and disposition of complaints under Section 806 is the domain of the USDOL, who in turn passed the responsibility to

Occupational Safety and Health Administration (OSHA). The Final Rules promulgated by OSHA for handling Section 806 retaliation cases are detailed and explicit, (See Appendix C), but they can be summarized as: A person filing a complaint of discrimination or retaliation will be required to show that he or she engaged in protected activity, the employer knew about that activity, the employer subjected him or her to an adverse employment action, and the protected activity contributed to the adverse action. Adverse employment action is generally defined as a material change in the terms or conditions of employment. Depending upon the circumstances of the case, “discrimination” can include:

Under the regulations, the employee must first establish a prima facie case of retaliation. The employee must show that he or she engaged in a protected activity or conduct; that the employer knew “actually or constructively” that the conduct occurred; that the employee suffered an unfavourable personnel action; and that the circumstances “were sufficient to raise the inference that the protected activity was a contributing factor in the unfavorable action” (A “protected activity” is one that is “protected” under the provisions of SOX 806). However, when a SOX whistleblower claim proceeds to a formal hearing before an administrative law judge (“ALJ”), a complainant must demonstrate by a preponderance of the evidence that protected activity was a contributing factor in the unfavourable action alleged in the complaint. Thus, to shift the burden of proof to the defendant, something more than a “prima facie showing” is required. Once the employee meets that burden, the burden shifts to the employer – not merely to articulate a nondiscriminatory reason for



Firing or laying off Blacklisting Demoting Denying overtime or promotion Disciplining Denial of benefits Failure to hire or rehire Intimidation Reassignment affecting prospects for promotion Reducing pay or hours

The Sarbanes–Oxley Act

N N N N N N N N N N

55

its conduct, but to prove, “by clear and convincing evidence, that it would have taken the same unfavorable personnel action in the absence of the complainant’s protected behavior or conduct”.

The Sarbanes–Oxley Act

Although an aggrieved employee must first bring his complaint to OSHA, the employee may file a civil lawsuit in federal district court if OSHA does not complete its investigation within 180 days. So far, seven of the first 169 cases have reached federal court.

 56

While quite a few cases have been initiated, it appears that in the majority of cases OSHA has found for the employer. Between July 2002, when the Act was passed, and December 2003, OSHA recorded 169 charges alleging SOX whistleblower retaliation, OSHA found for the employer in seventy-seven of the seventy-nine cases in which it completed an investigation. Of those, forty-five were appealed to an administrative law judge (ALJ) (the next stop in the procedures defined by OSHA’s regulations), and OSHA’s determinations have been reversed by an ALJ only three times. Only four ALJ determinations have gone to the next step, an appeal to the Administrative Review Board. In each case, the Board affirmed the ALJ. No SOX whistleblower complaint has yet reached the final stage of appeal provided by the OSHA regulations, a federal circuit court of appeals review. Of fifity-two SOX whistleblower retaliation cases (through 15 July 2004) reported on the DOL’s website, the majority were dismissed or withdrawn without reaching the merits; fourteen cases were dismissed for reasons of untimeliness or a failure to follow proper procedures; thirteen were withdrawn to be refiled in federal (or state) court; eleven were withdrawn or dismissed for unstated reasons; six were settled; and eight were decided on the merits. Of the cases decided on the merits, three were decided in favour of the employee and five were decided in favour of the employer.5 Here are the docketed/disposed statistics for SOX whistleblower cases before the USDOL, Office of Administrative Law Judges as of as of 2:13 pm on 3 June 2007. These statistics only cover cases in which an ALJ hearing was requested. DOL do not maintain statistics on whether the complainant or the respondent was considered to have succeeded in the litigation, nor whether the disposition was based on a decision on the merits, a procedural dismissal, a settlement, a removal to federal district court or other reasons.

Docketed (OALJ) Calendar Calendar Calendar Calendar Calendar Calendar

year year year year year year

2002 2003 2004 2005 2006 2007

Total

001 050 078 134 109 015 (as of 2:13 pm 3 June 2007) 387

Disposed (OALJ) year year year year year year

2002 2003 2004 2005 2006 2007

000 026 061 093 130 017 (as of 2:13 pm 3 June 2007) 3 June 2007)

Total

327

Currently pending (OALJ)

060 (as of 2:13 pm 3 June 2007)

The Sarbanes–Oxley Act

Calendar Calendar Calendar Calendar Calendar Calendar

 57

From the employee’s standpoint, it is extremely important that the case be well presented and well documented. The credibility of the employee, the witnesses and the evidence is paramount. The evidence must be presented clearly, without undue emotion or anger, and with respect for the board or court. Proper procedure must be followed. As seen above, around 25% of cases presented were dismissed for procedural errors. For an employee to pursue an individual civil action for whistleblower retaliation, he must lodge a complaint with the USDOL within 90 days of the alleged retaliation. The DOL has sixty days to decide whether there is “reasonable cause” to believe the complaint. It must also complete its investigation within 180 days after the complaint is filed. If the DOL does not meet its 180-day deadline, the employee can proceed to sue in federal court. If the DOL meets its deadline, then within another thirty days, a hearing can be requested. The hearing is similar to a trial, except it is held before an ALJ. After the hearing, the Secretary of Labor has

The Sarbanes–Oxley Act

120 days to issue the DOL’s final ruling. That ruling can be appealed to a federal appeals court or it can be enforced in a federal trial court.

 58

Good documentation must be presented. Most companies keep files on their employees which record work habits, supervisor reports, behaviour, job performance and other aspects of the employee’s relationship with the company. In an appearance, the company will present this documentation in support of the disciplinary action being challenged, so the employee must have his or her own documentation to support the complaint. Take note of the time interval between the employee action and the disciplinary response by the company. A short interval implies the cause and effect that the employee is claiming. From the company’s standpoint, there must be some evidence that the company intended to take action against the employee before the whistleblowing incident, unless a long time period has passed and subsequent other actions warrant a disciplinary response. The onus will be on the company to demonstrate that this was not a whistleblower retaliation. For this reason, it is important for companies to maintain complete and accurate employee records and to very carefully consider and evaluate an employee’s complaint before taking any action. It is important to note that the validity of the employee’s whistleblowing action is not at issue in these cases. Whether or not the company actually committed the actions that precipitated the employee’s action, it is the disciplinary action that followed that is being challenged. Here are a couple of cases that have been before the courts involving SOX whistleblower legislation.

Welch v. Cardinal Bankshares Corp6 The first case analysing an individual’s whistleblower claim handled by an Administrative Law Judge (ALJ) was Welch v. Cardinal Bankshares Corp. It is available on the DOL’s website: www.oalj.dol. gov/public/wblower/decsn/03sox15c. The ALJ’s decision illustrates how these claims will be analysed.

David Welch worked for Cardinal Bankshares, a publicly traded company, as CFO. R. Leon Moore was the president, CEO and board chairman. In August 2002, Welch became concerned about Cardinal Bankshares’ financial practices. He took several actions, of which the ALJ identified three as protected. First, Welch wrote a memo to the company’s external auditor. Second, he advised Moore he would not certify financial statements for public disclosure (Form 10-QSB). Third, he wrote a memo to Moore detailing his concerns. Within weeks, he was suspended, and on 1 October 2002, he was terminated.

Instead, the employee need prove only three things: (1) The complainant reasonably believed respondent engaged in such conduct; (2) He disclosed that conduct to the federal government or his employer; and (3) As a result, he suffered an adverse employment action. On the first and second elements, the ALJ held Welch had proven that he reasonably believed he was opposing federal fraud, and that he took protected action to disclose it. Cardinal Bankshares argued it had not engaged in federal fraud. But the ALJ pointed out the issue was only whether Welch’s belief was reasonable. The ALJ held that Welch’s belief was reasonable. Welch testified he had objected that certain entries “were improper and could mislead potential investors.” As the CFO, he also felt he was not being given “access to the necessary information.” Welch testified he had been “excluded from [the company’s] communications loop almost entirely.”



The ALJ began his analysis by considering Welch’s burden of proof. The ALJ held that an employee does not have to prove the company “actually violated, or (even) intended to violate, any federal fraud statute.”

The Sarbanes–Oxley Act

Cardinal Bankshares explained “that Welch was suspended and later discharged solely because he refused to meet with [company representatives] without a personal attorney,” quoting the ALJ’s decision.

59

The ALJ found these concerns were sufficient to lead Welch to reasonably believe he was opposing federal fraud, irrespective of whether or not any such fraud had been committed. This left the third element, which required Welch to prove he had been terminated because of his protected conduct.

The Sarbanes–Oxley Act

The ALJ held that the evidence established the required connection, noting the “proximity in time” between Welch’s protected conduct and his later suspension and termination. Since it all occurred “within a relatively brief period of time – approximately six or seven weeks,” the ALJ ruled it appeared one had happened because of the other.

 60

The ALJ also held that Cardinal Bankshare’s explanation simply did “not ring true.” The ALJ considered in significant detail the company’s argument that it decided to fire Welch because he had insisted on having his personal attorney sit in on a meeting, and the ALJ rejected that explanation as not believable. By analysing Welch’s claim this way, the ALJ employed many of the techniques we use in other federal retaliation claims. For example, much of the ALJ’s decision parallels the way claims are analysed when employees allege they have been fired for opposing discrimination. One can expect that future ALJs will borrow from this wellestablished body of case law in deciding whistleblower claims. The Welch case explains much of the background, requirements and procedures for whistleblower claims under SOX. Publicly traded companies, their managerial employees, accountants and attorneys may find it a helpful primer on this new kind of federal claim. Two other cases – one in federal district court and the other before an administrative law judge – found that plaintiffs had presented sufficient evidence of unlawful activity to preclude the defendants’ motions for summary judgment.

Collins v. Beazer Homes Two recent SOX decisions, Collins v. Beazer Homes USA Inc. and Richards v. Lexmark International, Inc. show quite clearly the danger that these cases continue to pose for employers. In Collins, the plaintiff, a newly hired director of marketing, was terminated after complaining about various marketing and other decisions.

Typical of many of these cases, she also secretly tape-recorded various conversations. Specifically, almost immediately after being hired, Collins began having conflicts with her manager, the division president and her coworker, the director of sales. Collins felt that these individuals were inappropriately favouring a particular advertising agency. Within two months of her hiring, she signed a contract with a new agency.

Jones met with Marty Shaffer, a vice president, and discussed terminating Collins’s employment. Shaffer then met with Collins, who again tape-recorded their conversation. Collins made a number of complaints, but did not specifically say that illegal activity was taking place. Shaffer told Collins that he would have to let her go, since the two individuals about whom she was complaining had been with the company for some time, and since it did not appear that the conflict was going to end. Collins filed a SOX whistleblower complaint with OSHA. When OSHA failed to issue a final administrative decision within 180 days, she filed in federal court. Beazer moved for summary judgment. The court rejected Beazer’s arguments in favour of summary judgment. Beazer argued that Collins didn’t engage in protected activity, because she failed to show an actual violation of the law. But the court noted Collins “reasonably believed” that there was a violation of a law or regulation that was protected by SOX, and that the standard is one of a reasonable person, even if the employee is mistaken or misunderstands the requirements of law.



Collins secretly tape-recorded a meeting with the company’s vice president of human resources, Jennifer Jones. Collins also sent an e-mail letter to Beazer’s CEO, making further claims about the existence of a “cover-up/corruption.” She did not, however, indicate any specifics. In another e-mail, Collins said that she suspected kickbacks in the company’s business practices and that, in order to hide information, marketing costs were not being properly allocated.

The Sarbanes–Oxley Act

Collins complained to the vice president of sales and marketing that she was having problems implementing her marketing decisions. She objected to the division president’s management style. She objected to how the company was paying the prior advertising agency, and about how marketing costs were being categorized. She also generally complained about other alleged inappropriate allegations.

61

The court also rejected Beazer’s argument that because Collins never specifically alleged securities or accounting fraud, and because her complaints were “vague” and amounted only to “personality conflicts” and “differences in marketing strategies,” she did not state a claim. Given the “broad remedial purposes” behind SOX, the court found that genuine issues of fact precluded a finding as a matter of law that the plaintiff did not engage in protected activity.

The Sarbanes–Oxley Act

Beazer’s claims that Collins’s allegations were vague or not serious were contradicted, the court held, by the company’s investigation of the matter by various senior executives, and the seriousness with which it treated these allegations.

 62

The court rejected Beazer’s additional argument that, because Shaffer was not fully aware of the nature of Collins’s allegations, and since Shaffer was the “sole decision maker” in her discharge, the company was unaware of plaintiff’s protected activity as a matter of law. Accepting this argument, the court said, would permit an employer to avoid SOX liability simply by bringing in a manager unaware of the employee’s claims in order to fire her. Finally, the court held that the temporal proximity between the time of plaintiff’s complaints and her discharge was more than adequate to establish circumstances suggesting that the protected activity was a contributing factor to her termination. The court concluded that Beazer could not establish by clear and convincing evidence as a matter of law that they would have fired her even absent her protected activity.

Richards v. Lexmark International, Inc. In Richards, the employer had come close to a decision to terminate the plaintiff, who had been with the company for just over two years, after a long history of well-documented performance problems and difficulties getting along with his coworkers. The company had generated numerous memoranda indicating that it would likely fire him in January 2003, after the holiday season. However, in December 2002, Richards was given an assignment to assess the company’s inflated levels of inventory over the preceding

two years. He provided his preliminary analysis on 3 January 2003, asserting that the company’s methods would lead to erroneous inventory management reporting. The following business day, Richards was discharged. Lexmark argued that ample evidence proved that it would have fired Richards notwithstanding this report. However, construing the evidence in Richards’s favour, the ALJ held that the proximity in time between his protected activity and his discharge was more than sufficient to raise an inference of causation, and that Lexmark failed to show by clear and convincing evidence that it would have fired him even in the absence of this conduct.

These examples show the importance of good documentation and reliable presentations by both the company and the employee. What may seem obvious to either party will not be obvious to the judge unless it is backed up by solid evidence.

The accounting profession has seen an upsurge in demand for SOXaware accountants to manage their Internal Control Systems and ensure that their ICFR procedures are effective and working. Estimates of a 30 per cent increase in accounting, auditing and analyst jobs are not unusual, though they vary in different locales, and enrolment in the accounting programmes of Universities and Colleges has never been higher. Naturally, an increased demand produces an increase in wages, so this is a good time to be an accountant. Software developers and companies themselves need more and more competent IT professionals to help resolve the issues of SOX compliance, either by providing solutions or by implementing and maintaining them. Technical writers are in demand as companies work to amend or create their manuals. So a positive impact on the public has been the creation of jobs. The hand that giveth also taketh away! The public will bear the costs of compliance, some will get jobs out of it, and some, the shareholders, will hopefully get better, more honest management.



Other than the costs of SOX compliance being borne ultimately by the consumers and the whistleblower protection already discussed, perhaps the greatest impact has been on the number of jobs created.

The Sarbanes–Oxley Act

The exact date of the decision to terminate Richards was, the ALJ held, unclear and contradictory.

63

This page intentionally left blank

8 “SOXPACKED”

This page intentionally left blank

This made it much tougher to cheat.

It is also noteworthy that in July 2002, President Bush established the Corporate Fraud Task Force to coordinate and oversee all federal corporate fraud investigations. In its first two years, the Department of Justice charged more than 900 defendants in corporate fraud cases and obtained 500 convictions. While these were not necessarily SOX infractions, it does demonstrate that the government is very concerned about corporate fraud and little mercy is being shown to those who flout the laws. In September 2004, two former executives of Computer Associates International, Inc., Sanjay Kumar, CEO and Chairman of the Board and Stephen Richards, CA’s former Head of Worldwide Sales faced a ten-count indictment of corporate fraud activities. Stephen Woghin, former Senior Vice President and General Counsel, pleaded guilty to securities fraud conspiracy for his part in the accounting fraud scheme. The company agreed to cooperate with the government



Critics of SOX claim that existing legislation was enough to keep the public protected and the increased costs of SOX compliance are a burden on shareholders, and ultimately consumers, and are unnecessary. They point to the convictions of Richard Ebbers, former chairman of WorldCom, Kenneth Lay and Jeffery Skilling of Enron under existing legislation as evidence that SOX is unnecessary. What they fail to mention, of course, is how many cases of fraud have gone unnoticed or uncharged because existing legislation did not offer full protection for investors.

The Sarbanes–Oxley Act

It is important to remember that there already existed a large and comprehensive collection of laws against all manner of fraudulent and misleading activities by companies. The SEC and Department of Justice have long had in place legislation that theoretically protected the public from fraud and other misconduct by corporate executives. The difficulty was usually in compiling evidence since the alleged infractions were usually hidden in complex financial transactions, inadequate documentation and then lost because documents were shredded or altered. What SOX accomplished was to make CEOs and CFOs responsible for accurately reporting everything that materially affected the financial well-being of the company and for putting in place a control system that ensured that they knew exactly what was going on and could demonstrate its effectiveness and accuracy.

67

investigation, clean up its act and pay $225 million to victims of the fraud as part of a deferred prosecution agreement. The full text of the release can be found at www.usdoj.gov/opa/pr/ 2004/september/04_cm_642.htm

The Sarbanes–Oxley Act

The first executive to be charged under SOX was Richard Scrushy, the chief executive of HealthSouth. He was accused of falsifying financial reporting, conspiracy and money laundering. He went to trial in January 2005.

 68

Scrushy faced eighty-five counts regarding a $2.7 billion corporate fraud that involved cooking the company’s books. Even though five former CFOs testified that Scrushy was aware of the fraud and urged then to inflate the company’s earnings to meet Wall Street expectations, his lawyers convinced the jury that he knew nothing and he was acquitted. One of the first executives to be actually sentenced under SOX was Thomas Trauger, a CPA in California, who pled guilty to altering, falsifying and destroying accounting records with the intent to impede and obstruct a federal investigation. The investigation was in regard to audit work that he and his audit team did related to the annual audit of NextCard Inc. Trauger was sentenced to twelve months in Federal prison, a $5000 fine plus two years of supervised release. Further details on this case can be found at www.usdoj.gov/usao/can (type in “Trauger” in the Search box). The effects of SOX go beyond the corporations and executives. Lawyers are feeling the impact too. A case now before the courts involves a prominent attorney, Philip Russell, in Greenwich, Connecticut, who has been charged under SOX (probably Section 802 and possibly 1102) with destroying a computer that contained images of child pornography. The computer, belonging to the church’s music director, was discovered by a church employee to contain images of naked boys. Church officials seized the computer and wrapped and sealed it as evidence. Russell destroyed the computer after learning that it contained the images. While SOX 802 and 1102 were aimed at corporate employees and executives to prevent them, or make them liable to prosecution for, shredding incriminating documents or deleting emails, in this

case the law is being used to charge a lawyer not involved in a corporate case. While he would seem to be vulnerable under other Obstruction of Justice legislation, use of SOX broadens the government’s ability to prosecute, in part because it does not specifically mention corporate documents or files. SOX 1102 says: Whoever corruptly –

SOX 802 says:

Russell could be convicted on both these counts – which could make him liable to up to 40 years in prison. Russell admits that he destroyed the computer, but denies he broke the law. He says he didn’t do so to interfere with or compromise any government investigation! While to a layperson, destroying evidence on behalf of a client seems to be pushing the limits of an attorney’s obligations to his client, the legal profession is worried that a conviction in this case may have wide repercussions involving issues other than child pornography. Perhaps this is an indication that SOX is going to have an impact way beyond corporate financial matters. Time will tell.



“Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.”

The Sarbanes–Oxley Act

(1) alters, destroys, mutilates, or conceals a record, document, or other object, or attempts to do so, with the intent to impair the object’s integrity or availability for use in an official proceeding; or (2) otherwise obstructs, influences, or impedes any official proceeding, or attempts to do so, shall be fined under this title or imprisoned not more than 20 years, or both.

69

The accounting/auditing firm of Arthur Anderson, one of the United States’s major accounting firms was effectively destroyed by its conviction of destroying documents relevant to an SEC investigation of Enron. This was one of the factors which led to the creation of SOX and in particular Sections 802 and 1102 (the conviction preceded SOX). It was determined that the documents were destroyed before an SEC subpoena was issued but after some Anderson executives knew that it was likely.

The Sarbanes–Oxley Act

While the conviction was later overturned in Supreme Court, it was not because they were found not guilty of destroying the documents, but because “the jury instructions were flawed in important respects”.

 70

According to the legal explanations of the case, the document destruction did not cover up any wrongdoing by Anderson, just the shenanigans going on at Enron, so Anderson was never charged with any offence relating to its audits of Enron. Sometimes the legal nuances leave we laypeople a bit bemused! If you destroy documents related to an audit, how can the audit be clean? I guess that’s why we have lawyers. The first foreign executive charged under SOX was billionaire tycoon Ricardo Salinas Pliego who owns TV Azteca, Mexico’s second largest broadcaster. Mr. Pliego allegedly sold discounted debt owed by the cell phone unit of TV Azteca to another company called Codisco. The cell phone unit later paid back the money owed at full price to Codisco. The catch was that Codisco was owned by Mr Pliego. Mr. Pliego settled with the SEC without admitting any wrongdoing, and agreed to pay $7.5 million in penalties and compensation, while an executive, Mr. Pedro Padilla Longoria, agreed to pay $1 million. The Mexican government also got into the case and Mr. Pliego paid another $2.3 million in fines under Mexico’s new securities laws. Founder and Chairman of Cardinal Health, Robert D. Walter may face charges under SOX for alleged accounting and financial reporting violations. Cardinal did restate its earnings after its audit committee had a look at the way Cardinal had classified revenue from its pharmaceutical business. The SEC had filed a “Wells” notice which is an indication that the staff have made a preliminary recommendation to bring a civil action against the company and/or its executives. The company has been engaged in settlement discussions with the SEC

and apparently has reached an agreement (January 2007) on the basic terms of a settlement. The deal brings with it a $35 million penalty! The net spreads far beyond US borders. Any foreign public company listed on a US Exchange or having over 300 US shareholders is deemed by the SEC to come under their jurisdiction as far as all securities legislation is concerned. “SOXPACKED” is derived from an expression used in sports, such as volleyball, when a player gets hit hard, usually in the face, by a hard-hit ball. He/She is said to have been “Sixpacked”.

The Sarbanes–Oxley Act

 71

This page intentionally left blank

9 Conclusions

This page intentionally left blank

Whether SOX is a good thing or a bad thing will probably continue to be debated and discussed for many years to come. It seems that few people think that in itself the tightening of the rules was a bad thing. It was pretty evident that something had to be done to get the accounting and auditing practices of public companies back on track, if only to restore investor confidence and protect shareholders from the phony reports emanating from “creative” accounting practices.

They may be a bit too late – since most of the heavy damage has already been done, or too early, since other countries are bringing in their own versions of SOX which will eventually make everyone more or less equal again. The concept of “convergence”, bringing the rules together internationally, is on-going and gaining momentum, and it seems likely that they will eventually become pretty much the same all over the world. Consequently, the burden of compliance will be felt worldwide and the regulatory disadvantages of a US listing will be less significant. SOX and its international equivalents are here to stay and notwithstanding some ongoing minor adjustments, will probably retain its present form. Besides, any serious back-pedalling will once again undermine the newly restored investor confidence in the SEC’s ability to protect them from corporate malfeasance. The howls of anguish came when the costs of compliance with the new rules started to become apparent. The problem was not only with the actual costs of implementing a serious and effective Internal Control System which would govern the operations of the company and ensure that its reports were accurate and complete, it was also



In January 2007, the Governor of New York, Eliot Spitzer, Senator Charles Schumer (Dem. NY) and New York Mayor Michael Bloomberg called for SOX to be revised. They were concerned about the negative impact SOX is having on the market.

The Sarbanes–Oxley Act

Whether justified or not, it is evident that US capital markets have become somewhat uncompetitive. Foreign corporations are no longer listing on US exchanges, many are delisting if they can. Even US corporations are listing overseas to avoid compliance costs. The recent amendment to SOX which allows foreign corporations to opt out of compliance if their US trades are less than 5 per cent of their total world-wide may improve things for foreign corporation activities in the US. See Chapter 6 for more on this.

75

with the big jump in the auditing fees. The increased fees were necessitated by the added burden on external auditors to ensure that the company’s statements were true and to cover their legal exposure if they didn’t do the job completely and correctly.

The Sarbanes–Oxley Act

It was evident that better internal controls would probably have real benefits to the company in terms of efficiency of operations, reduced likelihood of theft and employee redundancies and incompetence. Things that would show up as the controls were monitored.

 76

CFOs shuddered at the realization that they were going to be carrying the ball when it came to their financial reporting since they had to sign off that the reports were true and based on a fully functioning and effective Internal Control System. It meant that they had to have a finger on everything that was going on in the company that even remotely materially affected its financial well-being, and sign off that the system was effective and being monitored as well. Since most CEOs aren’t accountants and many don’t even bother with the detailed day-to-day operation of their companies, they rely heavily on the information and reports provided by their CFOs on which to base their decisions and guide their actions. SOX doesn’t consider that practice as an excuse and requires the CEO also to sign off to the same statements regarding the effectiveness of the Internal Control System and the accuracy of the quarterly and annual reports. The CEO’s butt is more than ever in the hands of his CFO! The CFO of Bank America Corp quit after fifteen months as CFO, and seventeen years at the bank, saying that SOX had taken all the fun out of the job! Bob Merritt resigned as CFO of Outback Steakhouse Inc. because of the increased regulatory burdens. An interesting side effect of SOX was indicated by Apple Computers in 2007. Apparently the built in WAN card of a Core 2 Duo Macintosh has networking capability which can be unlocked using an update which is available if you purchase AirPort Extreme Base Station. You can also purchase the “unlock” for $4.99 from Apple. The question was asked, “Why not give this away free?” An Apple representative claimed that it was about accounting. Because of SOX, the company

believes that, if it sells a product, and then later adds a feature to that product, it can be held liable for improper accounting if it recognizes revenue from the product at the time of sale, given that it hasn’t finished delivering the product at that point. While this sounds like a bit of a stretch, it serves as an indication that not only are corporations taking SOX seriously on the major issues, they are making decisions about relatively obscure actions that could, maybe, conceivably, perhaps put them in a noncompliance situation. While such decisions may bode well for the shareholders, once again it’s the consumer who pays!

MANAGEMENT’S REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING AGENCY: Securities and Exchange Commission.

SUMMARY: We are proposing interpretive guidance for management regarding its evaluation of internal control over financial reporting. The interpretive guidance sets forth an approach by which management can conduct a top-down, risk-based evaluation of internal control over financial reporting. The proposed guidance is intended to assist companies of all sizes to complete their annual evaluation in an effective and efficient manner and it provides guidance on a number of areas commonly cited as concerns over the past two years. In addition, we are proposing an amendment to our rules requiring management’s annual evaluation of internal control over financial reporting to make it clear that an evaluation that complies with the interpretive guidance is one way to satisfy those rules. Further, we are proposing an amendment to our rules to revise the requirements regarding the auditor’s attestation report on the assessment of internal control over financial reporting.

When the rules are promulgated, we will see exactly how they are going to affect the compliance requirements, but it does seem as though the SEC is going to relax a couple of the more onerous and expensive aspects of SOX, namely the internal evaluation of the



ACTION: Proposed interpretation; Proposed rule.

The Sarbanes–Oxley Act

Recently, the SEC indicated that it was going to modify some of the requirements of SOX. The statement reads:

77

Internal Control System, and the need for, or depth of, the external auditors testing and evaluation of the system.

The Sarbanes–Oxley Act

For the full text of the proposed amendments, go to www.sec.gov/ rules/proposed/2006/33-8762.pdf

 78

In general, then, SOX has forced public corporations to clean up their act when it comes to financial reporting which seems to have boosted investor confidence and for sure has cost a lot of money. Some private companies have voluntarily followed suit to varying degrees, because they see that the SOX rules can also improve their operations through better governance and increased efficiency, as well as to position them better for IPOs and acquisitions. Some companies went private or delisted in the United States to avoid having to comply with the new rules. Auditing costs have risen by anywhere from 20 to 40 per cent and the job market for accountants and auditors has never looked rosier. All over the world other governments are looking at SOX and bringing in their own rules along the same lines. Convergence is the buzzword as they try to make the rules the same for everyone. The SEC seems to be backing off on some of the more controversial requirements, which should help with the convergence efforts and ease the on-going burden on US companies. The mood seems to be that overall SOX was needed and even overdue, but it was introduced a little hastily and needs tweaking to ease the pain. This is happening, and hopefully the changes won’t weaken the rules too much so that SOX becomes ineffective.

10 An Interview with a CFO

This page intentionally left blank

May 2007. Victoria, BC Canada. Mike, when I say, Sarbanes–Oxley, what is the first thing that comes to your mind?

In general, do you think SOX is a positive thing or not? Yes, it pressures all companies to review and document their internal control systems. If you weren’t forced to become compliant, do you think you would implement the Internal Control System and auditing requirements anyway? Yes, from an internal perspective, because it makes me considerably more confident that our financial statements are correct and complete. it’s just the external auditing requirements that are onerous. What would you estimate as how far along the path to compliance you were before the requirements became mandatory? 10–15%. We obviously had various procedures established and written down, but the documentation was haphazard and incomplete.



Pain and Suffering! Mostly the complexity and cost of compliance, particularly the need for quarterly external review of our financial statements which adds a lot of extra time and cost to the process. Once a year is enough.

The Sarbanes–Oxley Act

Mike B. is the CFO of a medium sized Canadian company manufacturing high end electronic components with a large US market. The company is listed on the Toronto Stock Exchange, employs over 800 people and has several subsidiaries. Because many of the company’s shareholders are US citizens, and because the company does a lot of business in the USA, SOX compliance is a necessity. Besides, the Canadian rules are so close to the SOX rules that for all practical purposes the same requirements must be met. While the auditing requirements in Canada have been relaxed somewhat, the same need for an effective and monitored Internal Control System exists. As “convergence” becomes ever more a reality, the experiences of Mike and his company reflect the reality of life for public companies all over the world. The author spoke to Mike about the impact of SOX compliance requirements on his company and himself.

81

Did you have a fairly complete Policies and Procedures Manual? No. Each department had its own, but nothing was really formalized. Our ISO compliance process covered most of the manufacturing procedures and offered a good measure of control, but the financial P&P was essentially that which was built into our accounting software. What do you estimate your costs to be to become fully compliant? Initial costs? $500,000 The Sarbanes–Oxley Act

On-going costs?

 82

$350,000 to $400,000 a year. Have you formed a project team to take you to compliance and then maintain it? More or less, it’s a bit unfocussed because it’s internal and everyone has their regular work to do as well. How many people are on the team? Oh, three. Did you, or are you going to, hire more people to handle SOX compliance and monitoring such as an internal auditor, compliance manager or documentation specialist? Yes, a specialized internal auditor/compliance manager and an IT documentation specialist. How many new people do you think you will need? Hopefully just the two, but they may need some help. Do you feel that there are benefits to SOX in terms of increased efficiency, reduced exposure to malfeasance, incompetence or inefficiencies? Definitely yes. Do the benefits outweigh the costs? The Internal Control System requirement benefits probably do, but not the auditing requirements.

As the CFO, do you feel that you are somewhat exposed if any mistakes are made or somebody screws up? Yes! Because of the potential that has opened up for officers of the company to be exposed to personal liability via frivolous class action lawsuits brought by the litigious lawyers in the USA, and to some degree in Canada too, on a contingency basis. And in a large company, particularly one with subsidiaries, a CFO and CEO cannot know for sure 100% of what is going on in their companies. Mistakes can occur. Company liability insurance offers some protection but the costs are rising there too. How much has SOX compliance added to your workload?

What do you think has been the biggest impact of SOX on business generally?

What do you consider the best features of SOX? The Internal Control System requirements. What are the worst? The external auditing review requirements. If you were in charge, what would you change? I would remove the potential for class action nuisance lawsuits which are just started to enrich the ambulance chaser lawyers through out-of-court settlements. I would reduce the external auditing requirements. Canada has already done so, but because we do a lot of business in the United States and have many US shareholders, we really need to be SOX compliant as well as “Soxnorth” compliant. I would rework SOX to make it more principles based rather than rules based. GAAP is principles based and provides a very



It’s made business people much more careful about how they handle their financial information. There is much more transparency and consistency which is tending to increase investor confidence generally. Even non-public companies are recognising the benefits of an effective internal control system and complete financial reporting. Also, the financial reporting and auditing requirements have greatly added to both the shortage of accountants and the cost of hiring them which directly impacts our internal costs.

The Sarbanes–Oxley Act

Probably between 20 and 30%.

83

comprehensive set of principles that work just fine. If something is acceptable by GAAP standards, it should also be acceptable by SOX standards. (The Apple LAN card problem mentioned in Chapter 10 is an example of this conflict. ed.)

The Sarbanes–Oxley Act

I would bring the documentation process up to scratch by accepting the much more convenient .pdf files instead of just html and .txt formats that EDGAR currently accepts .pdf files are much more flexible, easier to create and can be protected from external changes.

 84

Note: Since this interview took place, Mike B’s company has sucessfully opted out of the SOX requirement for compliance by foreign corporations as explained in Chapter 6. He calculates that this small investment (legal fees) will save his company at least several hundreds of thousands of dollars a year in auditing fees alone, as well as reducing the company’s reporting workload.

Appendices

This page intentionally left blank

A Appendix A The Sarbanes–Oxley Act of 2002 (abridged)

This page intentionally left blank

One Hundred Seventh Congress of the United States of America AT THE SECOND SESSION Begun and held at the City of Washington on Wednesday, the twenty-third day of January, two thousand and two

An Act To protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

Sec. 1 Short title; table of contents Sec. 2 Definitions Sec. 3 Commission rules and enforcement TITLE I—PUBLIC COMPANY ACCOUNTING OVERSIGHT BOARD Sec. 101 Sec. 102 Sec. 103 Sec. Sec. Sec. Sec. Sec. Sec.

104 105 106 107 108 109

Establishment; administrative provisions Registration with the Board Auditing, quality control, and independence standards and rules Inspections of registered public accounting firms Investigations and disciplinary proceedings Foreign public accounting firms Commission oversight of the Board Accounting standards Funding

TITLE II—AUDITOR INDEPENDENCE Sec. 201 Services outside the scope of practice of auditors Sec. 202 Pre-approval requirements



(a) SHORT TITLE—This Act may be cited as the “Sarbanes–Oxley Act of 2002” (b) TABLE OF CONTENTS—The table of contents for this Act is as follows:

The Sarbanes–Oxley Act

SECTION 1. SHORT TITLE; TABLE OF CONTENTS

89

Sec. Sec. Sec. Sec. Sec.

203 204 205 206 207

Audit partner rotation Auditor reports to audit committees Conforming amendments Conflicts of interest Study of mandatory rotation of registered public accounting firms Sec. 208 Commission authority Sec. 209 Considerations by appropriate State regulatory authorities

The Sarbanes–Oxley Act

TITLE III—CORPORATE RESPONSIBILITY

 90

Sec. Sec. Sec. Sec. Sec. Sec. Sec. Sec.

301 302 303 304 305 306 307 308

Public company audit committees Corporate responsibility for financial reports Improper influence on conduct of audits Forfeiture of certain bonuses and profits Officer and director bars and penalties Insider trades during pension fund blackout periods Rules of professional responsibility for attorneys Fair funds for investors

TITLE IV—ENHANCED FINANCIAL DISCLOSURES Sec. 401 Sec. 402 Sec. 403 Sec. Sec. Sec. Sec. Sec. Sec.

404 405 406 407 408 409

Disclosures in periodic reports Enhanced conflict of interest provisions Disclosures of transactions involving management and principal stockholders Management assessment of internal controls Exemption Code of ethics for senior financial officers Disclosure of audit committee financial expert Enhanced review of periodic disclosures by issuers Real time issuer disclosures

TITLE V—ANALYST CONFLICTS OF INTEREST Sec. 501

Treatment of securities analysts by registered securities associations and national securities exchanges

TITLE VI—COMMISSION RESOURCES AND AUTHORITY Sec. 601 Sec. 602

Authorization of appropriations Appearance and practice before the Commission

Sec. 603 Sec. 604

Federal court authority to impose penny stock bars Qualifications of associated persons of brokers and dealers

TITLE VII—STUDIES AND REPORTS Sec. 701 Sec. 702 Sec. 703 Sec. 704 Sec. 705

GAO study and report regarding consolidation of public accounting firms Commission study and report regarding credit rating agencies Study and report on violators and violations Study of enforcement actions Study of investment banks

Sec. 801 Sec. 802 Sec. 803

Sec. 806 Sec. 807

TITLE IX—WHITE-COLLAR CRIME PENALTY ENHANCEMENTS Sec. 901 Sec. 902 Sec. 903 Sec. 904 Sec. 905 Sec. 906

Short title Attempts and conspiracies to commit criminal fraud offenses Criminal penalties for mail and wire fraud Criminal penalties for violations of the Employee Retirement Income Security Act of 1974 Amendment to sentencing guidelines relating to certain white-collar offenses Corporate responsibility for financial reports



Sec. 804 Sec. 805

Short title Criminal penalties for altering documents Debts non-dischargeable if incurred in violation of securities fraud laws Statute of limitations for securities fraud Review of Federal Sentencing Guidelines for obstruction of justice and extensive criminal fraud Protection for employees of publicly traded companies who provide evidence of fraud Criminal penalties for defrauding shareholders of publicly traded companies

The Sarbanes–Oxley Act

TITLE VIII—CORPORATE AND CRIMINAL FRAUD ACCOUNTABILITY

91

TITLE X—CORPORATE TAX RETURNS Sec. 1001

Sense of the Senate regarding the signing of corporate tax returns by chief executive officers

TITLE XI—CORPORATE FRAUD AND ACCOUNTABILITY Sec. 1101 Sec. 1102

The Sarbanes–Oxley Act

Sec. 1103 Sec. 1104 Sec. 1105 Sec. 1106 Sec. 1107

Short title Tampering with a record or otherwise impeding an official proceeding Temporary freeze authority for the Securities and Exchange Commission Amendment to the Federal Sentencing Guidelines Authority of the Commission to prohibit persons from serving as officers or directors Increased criminal penalties under Securities Exchange Act of 1934 Retaliation against informants

SEC. 2. DEFINITIONS

 92

(a) IN GENERAL—In this Act, the following definitions shall apply: (1) APPROPRIATE STATE REGULATORY AUTHORITY—The term “appropriate State regulatory authority” means the State agency or other authority responsible for the licensure or other regulation of the practice of accounting in the State or States having jurisdiction over a registered public accounting firm or associated person thereof, with respect to the matter in question. (2) AUDIT—The term “audit” means an examination of the financial statements of any issuer by an independent public accounting firm in accordance with the rules of the Board or the Commission (or, for the period preceding the adoption of applicable rules of the Board under section 103, in accordance with then-applicable generally accepted auditing and related standards for such purposes), for the purpose of expressing an opinion on such statements. (3) AUDIT COMMITTEE—The term “audit committee” means— (A) a committee (or equivalent body) established by and amongst the board of directors of an issuer for the purpose

of overseeing the accounting and financial reporting processes of the issuer and audits of the financial statements of the issuer; and (B) if no such committee exists with respect to an issuer, the entire board of directors of the issuer.

(5) BOARD—The term “Board” means the Public Company Accounting Oversight Board established under section 101. (6) COMMISSION—The term “Commission” means the Securities and Exchange Commission.

Note: Following is the extract from Section 3 of the 1934 Act related to “Issuers” The term “issuer” means any person who issues or proposes to issue any security; except that with respect to certificates of deposit for securities, voting-trust certificates, or collateraltrust certificates, or with respect to certificates of interest or shares in an unincorporated investment trust not having a board of directors or of the fixed, restricted management, or unit type, the term “issuer” means the person or persons performing the acts and assuming the duties of depositor or manager pursuant to the provisions of the trust or other agreement or instrument under which such securities are



(7) ISSUER—The term “issuer” means an issuer (as defined in section 3 of the Securities Exchange Act of 1934 (15 U.S.C.78c), the securities of which are registered under section 12 of that Act (15 U.S.C. 78l), or that is required to file reports under section 15(d) (15 U.S.C. 78o(d)), or that files or has filed a registration statement that has not yet become effective under the Securities Act of 1933 (15 U.S.C. 77a et seq.), and that it has not withdrawn.

The Sarbanes–Oxley Act

(4) AUDIT REPORT—The term “audit report” means a document or other record (A) prepared following an audit performed for purposes of compliance by an issuer with the requirements of the securities laws; and (B) in which a public accounting firm either— (i) sets forth the opinion of that firm regarding a financial statement, report, or other document; or (ii) asserts that no such opinion can be expressed.

93

issued; and except that with respect to equipment-trust certificates or like securities, the term “issuer” means the person by whom the equipment or property is, or is to be, used.

The Sarbanes–Oxley Act

The term “person” means a natural person, company, government, or political subdivision, agency, or instrumentality of a government.

 94

The term “security” means any note, stock, treasury stock, security future, bond, debenture, certificate of interest or participation in any profit-sharing agreement or in any oil, gas, or other mineral royalty or lease, any collateral-trust certificate, pre-organization certificate or subscription, transferable share, investment contract, voting-trust certificate, certificate of deposit for a security, any put, call, straddle, option, or privilege on any security, certificate of deposit, or group or index of securities (including any interest therein or based on the value thereof), or any put, call, straddle, option, or privilege entered into on a national securities exchange relating to foreign currency, or in general, any instrument commonly known as a “security”; or any certificate of interest or participation in, temporary or interim certificate for, receipt for, or warrant or right to subscribe to or purchase, any of the foregoing; but shall not include currency or any note, draft, bill of exchange, or banker’s acceptance which has a maturity at the time of issuance of not exceeding nine months, exclusive of days of grace, or any renewal thereof the maturity of which is likewise limited. Also, for non-US companies, this rule applies Foreign private issuer The term foreign private issuer means any foreign issuer other than a foreign government except an issuer meeting the following conditions: (A) More than 50 per cent of the outstanding voting securities of such issuer are directly or indirectly owned of record by residents of the United States; and any of the following: (B) The majority of the executive officers or directors are United States citizens or residents;

(C) More than 50 per cent of the assets of the issuer are located in the United States; or (D) The business of the issuer is administered principally in the United States. (8) NON-AUDIT SERVICES—The term “non-audit services” means any professional services provided to an issuer by a registered public accounting firm, other than those provided to an issuer in connection with an audit or a review of the financial statements of an issuer.



(10) PROFESSIONAL STANDARDS—The term “professional standards” means— (A) accounting principles that are— (i) established by the standard setting body described in section 19(b) of the Securities Act of 1933, as amended by this Act, or prescribed by the Commission under section 19(a) of that Act (15 U.S.C. 17a(s)) or section 13(b) of the Securities Exchange Act of 1934 (15U.S.C. 78a(m)); and

The Sarbanes–Oxley Act

(9) PERSON ASSOCIATED WITH A PUBLIC ACCOUNTING FIRM— (A) IN GENERAL—The terms “person associated with a public accounting firm” (or with a “registered public accounting firm”) and “associated person of a public accounting firm” (or of a “registered public accounting firm”) mean any individual proprietor, partner, shareholder, principal, accountant, or other professional employee of a public accounting firm, or any other independent contractor or entity that, in connection with the preparation or issuance of any audit report— (i) shares in the profits of, or receives compensation in any other form from, that firm; or (ii) participates as agent or otherwise on behalf of such accounting firm in any activity of that firm. (B) EXEMPTION AUTHORITY—The Board may, by rule, exempt persons engaged only in ministerial tasks from the definition in subparagraph (A), to the extent that the Board determines that any such exemption is consistent with the purposes of this Act, the public interest, or the protection of investors.

95

The Sarbanes–Oxley Act

(ii) relevant to audit reports for particular issuers, or dealt with in the quality control system of a particular registered public accounting firm; and (B) auditing standards, standards for attestation engagements, quality control policies and procedures, ethical and competency standards, and independence standards (including rules implementing title II) that the Board or the Commission determines— (i) relate to the preparation or issuance of audit reports for issuers; and (ii) are established or adopted by the Board under section 103(a), or are promulgated as rules of the Commission.

 96

(11) PUBLIC ACCOUNTING FIRM—The term “public accounting firm” means— (A) a proprietorship, partnership, incorporated association, corporation, limited liability company, limited liability partnership, or other legal entity that is engaged in the practice of public accounting or preparing or issuing audit reports; and (B) to the extent so designated by the rules of the Board, any associated person of any entity described in subparagraph (A). (12) REGISTERED PUBLIC ACCOUNTING FIRM—The term “registered public accounting firm” means a public accounting firm registered with the Board in accordance with this Act. (13) RULES OF THE BOARD —The term “rules of the Board” means the bylaws and rules of the Board (as submitted to, and approved, modified, or amended by the Commission, in accordance with section 107), and those stated policies, practices, and interpretations of the Board that the Commission, by rule, may deem to be rules of the Board, as necessary or appropriate in the public interest or for the protection of investors. (14) SECURITY—The term “security” has the same meaning as in section 3(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)).

(15) SECURITIES LAWS—The term “securities laws” means the provisions of law referred to in section 3(a)(47) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(47)), as amended by this Act, and includes the rules, regulations, and orders issued by the Commission thereunder. (16) STATE—The term “State” means any State of the United States, the District of Columbia, Puerto Rico, the Virgin Islands, or any other territory or possession of the United States. (b) CONFORMING AMENDMENT—Section 3(a)(47) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(47)) is amended by inserting “the Sarbanes–Oxley Act of 2002,” before “the Public”.

(b) ENFORCEMENT— (1) IN GENERAL—A violation by any person of this Act, any rule or regulation of the Commission issued under this Act, or any rule of the Board shall be treated for all purposes in the same manner as a violation of the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.) or the rules and regulations issued thereunder, consistent with the provisions of this Act, and any such person shall be subject to the same penalties, and to the same extent, as for a violation of that Act or such rules or regulations. (2) INVESTIGATIONS, INJUNCTIONS, AND PROSECUTION OF OFFENSES— Section 21 of the Securities Exchange Act of 1934 (15 U.S.C. 78u) is amended— (A) in subsection (a)(1), by inserting “the rules of the Public Company Accounting Oversight Board, of which such person is a registered public accounting firm or a person associated with such a firm,” after “is a participant,” (B) in subsection (d)(1), by inserting “the rules of the Public Company Accounting Oversight Board, of which such



(a) REGULATORY ACTION—The Commission shall promulgate such rules and regulations, as may be necessary or appropriate in the public interest or for the protection of investors, and in furtherance of this Act.

The Sarbanes–Oxley Act

SEC. 3. COMMISSION RULES AND ENFORCEMENT

97

The Sarbanes–Oxley Act

person is a registered public accounting firm or a person associated with such a firm,” after “is a participant,”; (C) in subsection (e), by inserting “the rules of the Public Company Accounting Oversight Board, of which such person is a registered public accounting firm or a person associated with such a firm,” after “is a participant,”; and (D) in subsection (f), by inserting “or the Public Company Accounting Oversight Board” after “self-regulatory organization” each place that term appears.

 98

(3) CEASE-AND-DESIST PROCEEDINGS—Section 21C(c)(2) of the Securities Exchange Act of 1934 (15 U.S.C. 78u–3(c)(2)) is amended by inserting “registered public accounting firm (as defined in section 2 of the Sarbanes–Oxley Act of 2002),” after “government securities dealer,”. (4) ENFORCEMENT BY FEDERAL BANKING AGENCIES—Section 12(i) of the Securities Exchange Act of 1934 (15 U.S.C. 78l(i)) is amended by— (A) striking “sections 12,” each place it appears and inserting “sections 10A(m), 12,”; and (B) striking “and 16,” each place it appears and inserting “and 16 of this Act, and sections 302, 303, 304, 306, 401(b), 404, 406, and 407 of the Sarbanes–Oxley Act of 2002,”. (c) EFFECT ON COMMISSION AUTHORITY—Nothing in this Act or the rules of the Board shall be construed to impair or limit— (1) the authority of the Commission to regulate the accounting profession, accounting firms, or persons associated with such firms for purposes of enforcement of the securities laws; (2) the authority of the Commission to set standards for accounting or auditing practices or auditor independence, derived from other provisions of the securities laws or the rules or regulations thereunder, for purposes of the preparation and issuance of any audit report, or otherwise under applicable law; or (3) the ability of the Commission to take, on the initiative of the Commission, legal, administrative, or disciplinary action against any registered public accounting firm or any associated person thereof.

Title I—Public company accounting oversight board Sec. 101. Establishment; administrative provisions Summary This section provides administrative details for the Board. (Public Company Accounting Oversight Board) Action Required None

Summary

Action Required Obtain written confirmation that the company’s auditors are registered. Sec. 103. Auditing, quality control, and independence standards and rules Summary AUDITING,

QUALITY

CONTROL,

AND

ETHICS

STANDARDS—

(1) IN GENERAL—The Board shall, by rule, establish, including, to the extent it determines appropriate, through adoption of standards proposed by 1 or more professional groups of accountants designated pursuant to paragraph (3)(A) or advisory groups convened pursuant to paragraph (4), and amend or otherwise modify or alter, such auditing



MANDATORY REGISTRATION—Beginning 180 days after the date of the determination of the Commission under section 101(d), it shall be unlawful for any person that is not a registered public accounting firm to prepare or issue, or to participate in the preparation or issuance of, any audit report with respect to any issuer.

The Sarbanes–Oxley Act

Sec. 102. Registration with the Board

99

and related attestation standards, such quality control standards, and such ethics standards to be used by registered public accounting firms in the preparation and issuance of audit reports, as required by this Act or the rules of the Commission, or as may be necessary or appropriate in the public interest or for the protection of investors. Action Required Obtain written confirmation that the Company’s auditors comply with the quality control and ethics rules of the Board.

The Sarbanes–Oxley Act

Sec. 104. Inspections of registered public accounting firms Summary



IN GENERAL—The Board shall conduct a continuing program of inspections to assess the degree of compliance of each registered public accounting firm and associated persons of that firm with this Act, the rules of the Board, the rules of the Commission, or professional standards, in connection with its performance of audits, issuance of audit reports, and related matters involving issuers.

100

Action Required None. Sec. 105. Investigations and disciplinary proceedings Summary IN GENERAL—The Board shall establish, by rule, subject to the requirements of this section, fair procedures for the investigation and disciplining of registered public accounting firms and associated persons of such firms. Action Required None, but it might be advisable to ask the company’s auditors if they have ever been investigated by the Board and if so, what was the outcome.

Sec. 106. Foreign public accounting firms Summary

Action Required

Sec. 107. Commission oversight of the Board Summary GENERAL OVERSIGHT RESPONSIBILITY—The Commission shall have oversight and enforcement authority over the Board, as provided in this Act. The provisions of section 17(a)(1) of the Securities Exchange Act of 1934 (15 U.S.C. 78q(a)(1)), and of section 17(b)(1) of the Securities Exchange Act of 1934 (15 U.S.C. 78q(b)(1)) shall apply to the Board as fully as if the Board were a “registered securities association” for purposes of those sections 17(a)(1) and 17(b)(1). Action Required None (Commission is the SEC).



If the Company has a non-US accounting firm and is listed in the US, ensure by written confirmation that the auditing firm does and will conform to the requirements of the Act.

The Sarbanes–Oxley Act

APPLICABILITY TO CERTAIN FOREIGN FIRMS— IN GENERAL—Any foreign public accounting firm that prepares or furnishes an audit report with respect to any issuer, shall be subject to this Act and the rules of the Board and the Commission issued under this Act, in the same manner and to the same extent as a public accounting firm that is organized and operates under the laws of the United States or any State, except that registration pursuant to section 102 shall not by itself provide a basis for subjecting such a foreign public accounting firm to the jurisdiction of the Federal or State courts, other than with respect to controversies between such firms and the Board.

101

Sec. 108. Accounting standards Summary IN GENERAL—In carrying out its authority under subsection (a) and under section 13(b) of the Securities Exchange Act of 1934, the Commission may recognize, as ‘generally accepted’ for purposes of the securities laws, any accounting principles established by a standard setting body  

The Sarbanes–Oxley Act

Action Required Ensure that the accounting system used by the company is ‘generally accepted’. The company’s auditors can be requested to provide written confirmation that the system is acceptable. Sec. 109. Funding Summary



IN GENERAL—The Board, and the standard setting body designated pursuant to section 19(b) of the Securities Act of 1933, as amended by section 108, shall be funded as provided in this section.

102

Action Required None.

Title II—Auditor independence Sec. 201. Services outside the scope of practice of auditors Summary

(2) financial information systems design and implementation; (3) appraisal or valuation services, fairness opinions, or contribution-in-kind reports; (4) actuarial services; (5) internal audit outsourcing services; (6) management functions or human resources; (7) broker or dealer, investment adviser, or investment banking services; (8) legal services and expert services unrelated to the audit; and (9) any other service that the Board determines, by regulation, is impermissible. (h) PREAPPROVAL REQUIRED FOR NON-AUDIT SERVICES— A registered public accounting firm may engage in any non-audit service, including tax services, that is



(1) bookkeeping or other services related to the accounting records or financial statements of the audit client;

The Sarbanes–Oxley Act

PROHIBITED ACTIVITIES—Except as provided in subsection (h), it shall be unlawful for a registered public accounting firm (and any associated person of that firm, to the extent determined appropriate by the Commission) that performs for any issuer any audit required by this title or the rules of the Commission under this title or, beginning 180 days after the date of commencement of the operations of the Public Company Accounting Oversight Board established under section 101 of the Sarbanes–Oxley Act of 2002 (in this section referred to as the ‘Board’), the rules of the Board, to provide to that issuer, contemporaneously with the audit, any non-audit service, including—

103

The Sarbanes–Oxley Act

not described in any of paragraphs (1) through (9) of subsection (g) for an audit client, only if the activity is approved in advance by the audit committee of the issuer, in accordance with subsection (i).

 104

EXEMPTION AUTHORITY—The Board may, on a case by case basis, exempt any person, issuer, public accounting firm, or transaction from the prohibition on the provision of services under section 10A(g) of the Securities Exchange Act of 1934 (as added by this section), to the extent that such exemption is necessary or appropriate in the public interest and is consistent with the protection of investors, and subject to review by the Commission in the same manner as for rules of the Board under section 107. Action Required Ensure that any and all of the listed services are being provided by other than the auditors or any firm connected to the auditors. Include the prohibitions in the company’s Policies and Procedures Manual.

Sec. 202. Pre-approval requirements Summary AUDIT COMMITTEE ACTION—All auditing services (which may entail providing comfort letters in connection with securities underwritings or statutory audits required for insurance companies for purposes of State law,) and non-audit services other than as provided in subparagraph (B), provided to an issuer by the auditor of the issuer shall be preapproved by the audit committee of the issuer. Action Required Ensure that the audit committee is fully aware of the requirements of Section 201 and 202 in detail if such pre-approval of services is to be obtained.

Sec. 203. Audit partner rotation Summary AUDIT PARTNER ROTATION—It shall be unlawful for a registered public accounting firm to provide audit services to an issuer if the lead (or coordinating) audit partner (having primary responsibility for the audit), or the audit partner responsible for reviewing the audit, has performed audit services for that issuer in each of the 5 previous fiscal years of that issuer. (Template 2.2) Action Required

Sec. 204. Auditor reports to audit committees Summary

(1) all critical accounting policies and practices to be used; (2) all alternative treatments of financial information within generally accepted accounting principles that have been discussed with management officials of the issuer, ramifications of the use of such alternative disclosures and treatments, and the treatment preferred by the registered public accounting firm; and (3) other material written communications between the registered public accounting firm and the management of the issuer, such as any management letter or schedule of unadjusted differences. (Template 2.3 – binder cover page) Action Required Ensure all of the discussions and reports are in writing and are retained by the company.



REPORTS TO AUDIT COMMITTEES—Each registered public accounting firm that performs for any issuer any audit required by this title shall timely report to the audit committee of the issuer—

The Sarbanes–Oxley Act

Retain records on an annual basis of the participants in the audits for the Company and check that this requirement is observed.

105

Sec. 205. Conforming amendments Summary

The Sarbanes–Oxley Act

AUDIT COMMITTEE—The term ‘audit committee’ means— (A) a committee (or equivalent body) established by and amongst the board of directors of an issuer for the purpose of overseeing the accounting and financial reporting processes of the issuer and audits of the financial statements of the issuer; and (B) if no such committee exists with respect to an issuer, the entire board of directors of the issuer.

 106

Action Required Establish an Audit Committee if one does not exist. Note that in this section, the term “Independent Public Accountant” has been replaced throughout with “Registered Public Accountant” This means that the accounting firm conducting any audit functions must be registered with the Board.

Sec. 206. Conflicts of interest Summary CONFLICTS OF INTEREST—It shall be unlawful for a registered public accounting firm to perform for an issuer any audit service required by this title, if a chief executive officer, controller, chief financial officer, chief accounting officer, or any person serving in an equivalent position for the issuer, was employed by that registered independent public accounting firm and participated in any capacity in the audit of that issuer during the 1-year period preceding the date of the initiation of the audit. Action Required None, unless the conflict exists, in which case it is remedied by changing auditors or re-assigning officer.

Sec. 207. Study of mandatory rotation of registered public accounting firms Summary STUDY AND REVIEW REQUIRED—The Comptroller General of the United States shall conduct a study and review of the potential effects of requiring the mandatory rotation of registered public accounting firms. Action Required

Sec. 208. Commission authority

The Sarbanes–Oxley Act

The GAO performed a study and concluded that the Audit Committee of the company should make a judgement as to whether the auditors should be rotated. See www.gao.gov/highlights/ d04217high.pdf. Report GAO-04-217.

Summary

(b) AUDITOR INDEPENDENCE—It shall be unlawful for any registered public accounting firm (or an associated person thereof, as applicable) to prepare or issue any audit report with respect to any issuer, if the firm or associated person engages in any activity with respect to that issuer prohibited by any of subsections (g) through (l) of section 10A of the Securities Exchange Act of 1934, as added by this title, or any rule or regulation of the Commission or of the Board issued thereunder. Action Required Check http://sec.gov/rules/final.shtml for a listing of all the Final Rules issued by the SEC by year.



COMMISSION REGULATIONS—Not later than 180 days after the date of enactment of this Act, the Commission shall issue final regulations to carry out each of subsections (g) through (l) of section 10A of the Securities Exchange Act of 1934, as added by this title.

107

Sec. 209. Considerations by appropriate State regulatory authorities

The Sarbanes–Oxley Act

Summary

 108

In supervising non-registered public accounting firms and their associated persons, appropriate State regulatory authorities should make an independent determination of the proper standards applicable, particularly taking into consideration the size and nature of the business of the accounting firms they supervise and the size and nature of the business of the clients of those firms. The standards applied by the Board under this Act should not be presumed to be applicable for purposes of this section for small and medium sized non-registered public accounting firms. Action Required None.

Title III—Corporate responsibility Sec. 301. Public company audit committees Summary

(3) INDEPENDENCE— (A) IN GENERAL—Each member of the audit committee of the issuer shall be a member of the board of directors of the issuer, and shall otherwise be independent.



(2) RESPONSIBILITIES RELATING TO REGISTERED PUBLIC ACCOUNTING FIRMS—The audit committee of each issuer, in its capacity as a committee of the board of directors, shall be directly responsible for the appointment, compensation, and oversight of the work of any registered public accounting firm employed by that issuer (including resolution of disagreements between management and the auditor regarding financial reporting) for the purpose of preparing or issuing an audit report or related work, and each such registered public accounting firm shall report directly to the audit committee.

The Sarbanes–Oxley Act

(1) COMMISSION RULES (A) IN GENERAL—Effective not later than 270 days after the date of enactment of this subsection, the Commission shall, by rule, direct the national securities exchanges and national securities associations to prohibit the listing of any security of an issuer that is not in compliance with the requirements of any portion of paragraphs (2) through (6). (Section 10A SEC) (B) OPPORTUNITY TO CURE DEFECTS—The rules of the Commission under subparagraph (A) shall provide for appropriate procedures for an issuer to have an opportunity to cure any defects that would be the basis for a prohibition under subparagraph (A), before the imposition of such prohibition.

109

(B) CRITERIA—In order to be considered to be independent for purposes of this paragraph, a member of an audit committee of an issuer may not, other than in his or her capacity as a member of the audit committee, the board of directors, or any other board committee— accept any consulting, advisory, or other compensatory fee from the issuer; or

The Sarbanes–Oxley Act

(ii) be an affiliated person of the issuer or any subsidiary thereof.

 110

(C) EXEMPTION AUTHORITY—The Commission may exempt from the requirements of subparagraph (B) a particular relationship with respect to audit committee members, as the Commission determines appropriate in light of the circumstances. (4) COMPLAINTS—Each audit committee shall establish procedures for— (A) the receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters; and (B) the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters. (5) AUTHORITY TO ENGAGE ADVISORS—Each audit committee shall have the authority to engage independent counsel and other advisers, as it determines necessary to carry out its duties. (6) FUNDING—Each issuer shall provide for appropriate funding, as determined by the audit committee, in its capacity as a committee of the board of directors, for payment of compensation— (A) to the registered public accounting firm employed by the issuer for the purpose of rendering or issuing an audit report; and (B) to any advisers employed by the audit committee under paragraph (5).

Action Required Understand Section 10A and ensure compliance. Ensure that the Audit Committee fully understands the contents of this Section, and append a section to the Company’s Policies and Procedures Manual describing the responsibilities of the Audit Committee. Create procedures for complaints and anonymous concerns.

Sec. 302. Corporate responsibility for financial reports

(1) the signing officer has reviewed the report; (2) based on the officer’s knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which such statements were made, not misleading; (3) based on such officer’s knowledge, the financial statements, and other financial information included in the report, fairly present in all material respects the financial condition and results of operations of the issuer as of, and for, the periods presented in the report;



(a) REGULATIONS REQUIRED—The Commission shall, by rule, require, for each company filing periodic reports under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m, 78o(d)), that the principal executive officer or officers and the principal financial officer or officers, or persons performing similar functions, certify in each annual or quarterly report filed or submitted under either such section of such Act that—

The Sarbanes–Oxley Act

Summary

111

The Sarbanes–Oxley Act

 112

(4) the signing officers— (A) are responsible for establishing and maintaining internal controls; (B) have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared; (C) have evaluated the effectiveness of the issuer’s internal controls as of a date within 90 days prior to the report; and (D) have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date; (5) the signing officers have disclosed to the issuer’s auditors and the audit committee of the board of directors (or persons fulfilling the equivalent function)— (A) all significant deficiencies in the design or operation of internal controls which could adversely affect the issuer’s ability to record, process, summarize, and report financial data and have identified for the issuer’s auditors any material weaknesses in internal controls; and (B) any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer’s internal controls; and (6) the signing officers have indicated in the report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of their evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses.

(b) FOREIGN REINCORPORATIONS HAVE NO EFFECT— Nothing in this section 302 shall be interpreted or applied in any way to allow any issuer to lessen the legal force of the statement required under this section 302, by an issuer having reincorporated or having engaged in any other transaction that resulted in the transfer of the corporate domicile or offices of the issuer from inside the United States to outside of the United States.

Action Required

Sec. 303. Improper influence on conduct of audits Summary (a) RULES TO PROHIBIT—It shall be unlawful, in contravention of such rules or regulations as the Commission shall prescribe as necessary and appropriate in the public interest or for the protection of investors, for any officer or director of an issuer, or any other person acting under the direction thereof, to take any action to fraudulently influence, coerce, manipulate, or mislead any independent public or certified accountant engaged in the performance of an audit of the financial statements of that issuer for the purpose of rendering such financial statements materially misleading.



Include in the Policies and Procedures Manual sections outlining the officers’ responsibilities in this requirement and provide approved certification templates for the CEO, CFO and other responsible officers.

The Sarbanes–Oxley Act

The bomb in this section is part (4) stating that the officers are responsible for establishing and maintaining internal controls so that any material information is available to the officers and the auditors. It is the establishment of the internal control mechanism and system that is time consuming, expensive and detailed. Many companies have created or modified software applications to provide compliance with this requirement.

113

Action Required Avoid any actions that could be construed as applying such influence, keep minutes of all meetings with auditors and avoid one-onone meetings between auditor and company officers. Transparency and accountability are the watchwords. Sec. 304. Forfeiture of certain bonuses and profits Summary

The Sarbanes–Oxley Act

ADDITIONAL COMPENSATION PRIOR TO NONCOMPLIANCE WITH COMMISSION FINANCIAL REPORTING REQUIREMENTS—If an issuer is required to prepare an accounting restatement due to the material noncompliance of the issuer, as a result of misconduct, with any financial reporting requirement under the securities laws, the chief executive officer and chief financial officer of the issuer shall reimburse the issuer for—



(1) any bonus or other incentive-based or equitybased compensation received by that person from the issuer during the 12-month period following the first public issuance or filing with the Commission (whichever first occurs) of the financial document embodying such financial reporting requirement; and (2) any profits realized from the sale of securities of the issuer during that 12-month period.

114

Action Required The CFO must ensure that such reimbursements are clearly made and documented. Sec. 305. Officer and director bars and penalties Summary (1) SECURITIES EXCHANGE ACT OF 1934—Section 21(d)(2) of the Securities Exchange Act of 1934 (15 U.S.C. 78u(d)(2)) is amended by striking “substantial unfitness” and inserting “unfitness”.

(2) SECURITIES ACT OF 1933—Section 20(e) of the Securities Act of 1933 (15 U.S.C. 77t(e)) is amended by striking “substantial unfitness” and inserting “unfitness”. (b) EQUITABLE RELIEF—Section 21(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78u(d)) is amended by adding at the end the following: (5) EQUITABLE RELIEF—In any action or proceeding brought or instituted by the Commission under any provision of the securities laws, the Commission may seek, and any Federal court may grant, any equitable relief that may be appropriate or necessary for the benefit of investors.

None.

Sec. 306. Insider trades during pension fund blackout periods



Summary

The Sarbanes–Oxley Act

Action Required

115

IN GENERAL—Except to the extent otherwise provided by rule of the Commission pursuant to paragraph (3), it shall be unlawful for any director or executive officer of an issuer of any equity security (other than an exempted security), directly or indirectly, to purchase, sell, or otherwise acquire or transfer any equity security of the issuer (other than an exempted security) during any blackout period with respect to such equity security if such director or officer acquires such equity security in connection with his or her service or employment as a director or executive officer. (4) BLACKOUT PERIOD—For purposes of this subsection, the term “blackout period”, with respect to the equity securities of any issuer— (A) means any period of more than 3 consecutive business days during which the ability of not fewer than 50 percent of the participants or beneficiaries under all individual account plans maintained by

the issuer to purchase, sell, or otherwise acquire or transfer an interest in any equity of such issuer held in such an individual account plan is temporarily suspended by the issuer or by a fiduciary of the plan; Action Required Insert the appropriate prohibition in the Policies and Procedures Manual in the stock trading section. This is a complex section involving Pension Plans and the CFO must be fully cognizant of the content and implications of it.

The Sarbanes–Oxley Act

Sec. 307. Rules of professional responsibility for attorneys Summary



The Commission shall issue rules, in the public interest and for the protection of investors, setting forth minimum standards of professional conduct for attorneys appearing and practicing before the Commission in any way in the representation of issuers, including a rule—

116

(1) requiring an attorney to report evidence of a material violation of securities law or breach of fiduciary duty or similar violation by the company or any agent thereof, to the chief legal counsel or the chief executive officer of the company (or the equivalent thereof); and (2) if the counsel or officer does not appropriately respond to the evidence (adopting, as necessary, appropriate remedial measures or sanctions with respect to the violation), requiring the attorney to report the evidence to the audit committee of the board of directors of the issuer or to another committee of the board of directors comprised solely of directors not employed directly or indirectly by the issuer, or to the board of directors. Action Required None.

Sec. 308. Fair funds for investors Summary

None unless an action has been brought and completed.



Action Required

The Sarbanes–Oxley Act

CIVIL PENALTIES ADDED TO DISGORGEMENT FUNDS FOR THE RELIEF OF VICTIMS—If in any judicial or administrative action brought by the Commission under the securities laws (as such term is defined in section 3(a)(47) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(47)) the Commission obtains an order requiring disgorgement against any person for a violation of such laws or the rules or regulations thereunder, or such person agrees in settlement of any such action to such disgorgement, and the Commission also obtains pursuant to such laws a civil penalty against such person, the amount of such civil penalty shall, on the motion or at the direction of the Commission, be added to and become part of the disgorgement fund for the benefit of the victims of such violation.

117

Title IV—Enhanced financial disclosures Sec. 401. Disclosures in periodic reports

The Sarbanes–Oxley Act

Summary

 118

ACCURACY OF FINANCIAL REPORTS—Each financial report that contains financial statements, and that is required to be prepared in accordance with (or reconciled to) generally accepted accounting principles under this title and filed with the Commission shall reflect all material correcting adjustments that have been identified by a registered public accounting firm in accordance with generally accepted accounting principles and the rules and regulations of the Commission. Action Required Ensure that the CFO and company accounting division are fully aware of the provisions of this section and comply with all requirements. Details should be included in the Policies and Procedures Manual in the accounting and bookkeeping section(s).

Sec. 402. Enhanced conflict of interest provisions Summary IN GENERAL—It shall be unlawful for any issuer (as defined in section 2 of the Sarbanes–Oxley Act of 2002), directly or indirectly, including through any subsidiary, to extend or maintain credit, to arrange for the extension of credit, or to renew an extension of credit, in the form of a personal loan to or for any director or executive officer (or equivalent thereof) of that issuer. An extension of credit maintained by the issuer on the date of enactment of this subsection shall not be subject to the provisions of this subsection, provided that there is no material modification to any term of any such extension of credit or any renewal of any such extension of credit on or after that date of enactment.

Action Required Ensure that any loans or credit to or for an officer of the company meet the requirements of this section. There are some exceptions to the prohibition, but care must be taken that any transactions of this type are clearly disclosed and transparent. Sec. 403. Disclosures of transactions involving management and principal stockholders Summary

Ensure that shareholders owning more than 10% of the company stock, and the directors and officers, comply with the disclosure rules of Section 16 of the SEC and that said shareholder is made aware of the provisions of this section. Sec. 404. Management assessment of internal controls Summary RULES REQUIRED—The Commission shall prescribe rules requiring each annual report required by section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 78o(d)) to contain an internal control report, which shall— (1) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and



Action Required

The Sarbanes–Oxley Act

DIRECTORS, OFFICERS, AND PRINCIPAL STOCKHOLDERS REQUIRED TO FILE—Every person who is directly or indirectly the beneficial owner of more than 10 percent of any class of any equity security (other than an exempted security) which is registered pursuant to section 12, or who is a director or an officer of the issuer of such security, shall file the statements required by this subsection with the Commission (and, if such security is registered on a national securities exchange, also with the exchange).

119

(2) contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. Action Required

The Sarbanes–Oxley Act

Create an Internal Control System that covers every aspect of the company’s operations that affect its financial state and ensure that the system has adequate capability of issuing comprehensive and transparent reports.

 120

This is the tip of the iceberg. It is the section (along with 302) that requires the most effort on the part of the company. Fortunately, a variety of software solutions are available to ease the process, but compliance and detailed adherence to the application of the software used must be made the direct responsibility of a suitable officer, probably the CFO. Since the CEO is ultimately responsible, a process of reporting and assessment should be introduced to ensure that he/she is completely aware of the internal state of affairs of the company at all times.

Sec. 405. Exemption Summary Nothing in section 401, 402, or 404, the amendments made by those sections, or the rules of the Commission under those sections shall apply to any investment company registered under section 8 of the Investment Company Act of 1940 (1 U.S.C. 80a–8). Action Required None.

Sec. 406. Code of ethics for senior financial officers Summary CODE OF ETHICS DISCLOSURE—The Commission shall issue rules to require each issuer, together with periodic reports required pursuant to section 13(a) or

15(d) of the Securities Exchange Act of 1934, to disclose whether or not, and if not, the reason therefor, such issuer has adopted a code of ethics for senior financial officers, applicable to its principal financial officer and comptroller or principal accounting officer, or persons performing similar functions. Action Required Generate a suitable Code of Ethics and insert it in the Policies and Procedures Manual. Ensure that the CFO and other financial officers are aware of it, sign it, and agree to abide by it. (See Appendix D).

Summary

Action Required Ensure that at least one member of the Audit Committee meets the requirements.

Sec. 408. Enhanced review of periodic disclosures by issuers Summary The Commission shall review disclosures made by issuers reporting under section 13(a) of the Securities Exchange Act of 1934 (including reports filed on Form 10–K), and which have a class of securities listed on a national securities exchange or traded on an automated quotation facility of a national securities association, on a regular and systematic basis



The Commission shall issue rules, as necessary or appropriate in the public interest and consistent with the protection of investors, to require each issuer, together with periodic reports required pursuant to sections 13(a) and 15(d) of the Securities Exchange Act of 1934, to disclose whether or not, and if not, the reasons therefor, the audit committee of that issuer is comprised of at least 1 member who is a financial expert, as such term is defined by the Commission.

The Sarbanes–Oxley Act

Sec. 407. Disclosure of audit committee financial expert

121

for the protection of investors. Such review shall include a review of an issuer’s financial statement. Action Required None. Sec. 409. Real time issuer disclosures

The Sarbanes–Oxley Act

Summary Each issuer reporting under section 13(a) or 15(d) shall disclose to the public on a rapid and current basis such additional information concerning material changes in the financial condition or operations of the issuer, in plain English, which may include trend and qualitative information and graphic presentations, as the Commission determines, by rule, is necessary or useful for the protection of investors and in the public interest. Action Required

 122

In addition to the Annual Report, and/or Quarterly Reports, provide a medium for disseminating such relevant information to shareholders and the public, such as a Newsletter, Press Releases or on the company website. Appoint an officer to ensure that any such relevant information is promptly disseminated.

Title V—Analyst conflicts of interest Sec. 501. Treatment of securities analysts by registered securities associations and national securities exchanges Summary

Action Required



Essentially there should be no relationship between the broker and the company that may be perceived as a conflict of interest. No debts or financial interest other than the normal brokerage commissions.

The Sarbanes–Oxley Act

ANALYST PROTECTIONS—The Commission, or upon the authorization and direction of the Commission, a registered securities association or national securities exchange, shall have adopted, not later than 1 year after the date of enactment of this section, rules reasonably designed to address conflicts of interest that can arise when securities analysts recommend equity securities in research reports and public appearances, in order to improve the objectivity of research and provide investors with more useful and reliable information.

123

Title VI—Commission resources and authority Sec. 601. Authorization of appropriations Summary In addition to any other funds authorized to be appropriated to the Commission, there are authorized to be appropriated to carry out the functions, powers, and duties of the Commission, $776,000,000 for fiscal year 2003, Action Required

The Sarbanes–Oxley Act

None.

 124

Sec. 602. Appearance and practice before the Commission Summary AUTHORITY TO CENSURE—The Commission may censure any person, or deny, temporarily or permanently, to any person the privilege of appearing or practicing before the Commission in any way, if that person is found by the Commission, after notice and opportunity for hearing in the matter— (1) not to possess the requisite qualifications to represent others; (2) to be lacking in character or integrity, or to have engaged in unethical or improper professional conduct; or (3) to have willfully violated, or willfully aided and abetted the violation of, any provision of the securities laws or the rules and regulations issued thereunder. Action Required If there is a need to appear before the commission for any reason, ensure the person(s) appearing meet the criteria above.

Sec. 603. Federal court authority to impose penny stock bars Summary IN GENERAL—In any proceeding under paragraph (1) against any person participating in, or, at the time of the alleged misconduct who was participating in, an offering of penny stock, the court may prohibit that person from participating in an offering of penny stock, conditionally or unconditionally, and permanently or for such period of time as the court shall determine. Action Required

Sec. 604. Qualifications of associated persons of brokers and dealers Summary

(1) by striking subparagraph (F) and inserting the following: (F) is subject to any order of the Commission barring or suspending the right of the person to be associated with a broker or dealer; and (2) in subparagraph (G), by striking the period at the end and inserting the following: or (H) is subject to any final order of a State securities commission (or any agency or officer performing like functions), State authority that supervises or examines banks, savings associations, or credit unions, State insurance commission (or any agency or office performing like functions), an appropriate Federal banking agency (as defined in section 3 of the Federal Deposit Insurance Act (12 U.S.C. 1813(q))), or the National Credit Union Administration, that—



BROKERS AND DEALERS—Section 15(b)(4) of the Securities Exchange Act of 1934 (15 U.S.C. 78o) is amended—

The Sarbanes–Oxley Act

None unless the situation arises.

125

(i) bars such person from association with an entity regulated by such commission, authority, agency, or officer, or from engaging in the business of securities, insurance, banking, saving association activities, or credit union activities;

Action Required

The Sarbanes–Oxley Act

None by the company, but ensure associated brokers and dealers are in compliance.

 126

Title VII—Studies and reports Sec. 701. GAO study and report regarding consolidation of public accounting firms Summary (a) STUDY REQUIRED—The Comptroller General of the United States shall conduct a study—

(3) whether and to what extent Federal or State regulations impede competition among public accounting firms.



(2) of the problems, if any, faced by business organizations that have resulted from limited competition among public accounting firms, including— (A) higher costs; (B) lower quality of services; (C) impairment of auditor independence; or (D) lack of choice; and

The Sarbanes–Oxley Act

(1) to identify— (A) the factors that have led to the consolidation of public accounting firms since 1989 and the consequent reduction in the number of firms capable of providing audit services to large national and multinational business organizations that are subject to the securities laws; (B) the present and future impact of the condition described in subparagraph (A) on capital formation and securities markets, both domestic and international; and (C) solutions to any problems identified under subparagraph (B), including ways to increase competition and the number of firms capable of providing audit services to large national and multinational business organizations that are subject to the securities laws;

127

The Sarbanes–Oxley Act

(b) CONSULTATION—In planning and conducting the study under this section, the Comptroller General shall consult with— (1) the Commission; (2) the regulatory agencies that perform functions similar to the Commission within the other member countries of the Group of Seven Industrialized Nations; (3) the Department of Justice; and (4) any other public or private sector organization that the Comptroller General considers appropriate.

 128

Action Required None.

Sec. 702. Commission study and report regarding credit rating agencies Summary IN GENERAL—The Commission shall conduct a study of the role and function of credit rating agencies in the operation of the securities market. AREAS OF CONSIDERATION—The study required by this subsection shall examine— (A) the role of credit rating agencies in the evaluation of issuers of securities; (B) the importance of that role to investors and the functioning of the securities markets; (C) any impediments to the accurate appraisal by credit rating agencies of the financial resources and risks of issuers of securities; (D) any barriers to entry into the business of acting as a credit rating agency, and any measures needed to remove such barriers; (E) any measures which may be required to improve the dissemination of information concerning such resources and risks when credit rating agencies announce credit ratings; and

(F) any conflicts of interest in the operation of credit rating agencies and measures to prevent such conflicts or ameliorate the consequences of such conflicts. Action Required None. Sec. 703. Study and report on violators and violations Summary

(2) a description of the Federal securities laws violations committed by aiders and abettors and by primary violators, including— (A) the specific provision of the Federal securities laws violated; (B) the specific sanctions and penalties imposed upon such aiders and abettors and primary violators, including the amount of any



(1) the number of securities professionals, defined as public accountants, public accounting firms, investment bankers, investment advisers, brokers, dealers, attorneys, and other securities professionals practicing before the Commission— (A) who have been found to have aided and abetted a violation of the Federal securities laws, including rules or regulations promulgated thereunder (collectively referred to in this section as “Federal securities laws”), but who have not been sanctioned, disciplined, or otherwise penalized as a primary violator in an administrative action or civil proceeding, including in any settlement of such an action or proceeding (referred to in this section as “aiders and abettors”); and (B) who have been found to have been primary violators of the Federal securities laws;

The Sarbanes–Oxley Act

STUDY—The Commission shall conduct a study to determine, based upon information for the period from January 1, 1998, to December 31, 2001—

129

The Sarbanes–Oxley Act

 130

monetary penalties assessed upon and collected from such persons; (C) the occurrence of multiple violations by the same person or persons, either as an aider or abettor or as a primary violator; and (D) whether, as to each such violator, disciplinary sanctions have been imposed, including any censure, suspension, temporary bar, or permanent bar to practice before the Commission; and (3) the amount of disgorgement, restitution, or any other fines or payments that the Commission has assessed upon and collected from, aiders and abettors and from primary violators. Action Required None. Sec. 704. Study of enforcement actions Summary STUDY REQUIRED—The Commission shall review and analyze all enforcement actions by the Commission involving violations of reporting requirements imposed under the securities laws, and restatements of financial statements, over the 5-year period preceding the date of enactment of this Act, to identify areas of reporting that are most susceptible to fraud, inappropriate manipulation, or inappropriate earnings management, such as revenue recognition and the accounting treatment of off-balance sheet special purpose entities. Action Required None. Sec. 705. Study of investment banks Summary GAO STUDY—The Comptroller General of the United States shall conduct a study on whether investment

banks and financial advisers assisted public companies in manipulating their earnings and obfuscating their true financial condition. Action Required None. The GAO did conduct a study dated March 2003, the summary of which is included in this book. The full text of the study is available on the GAO website at www.gao.gov/new.items/d03511.pdf.

The Sarbanes–Oxley Act

 131

Title VIII—Corporate and criminal fraud accountability Sec. 801. Short title Summary This title may be cited as the “Corporate and Criminal Fraud Accountability Act of 2002”. Action Required

The Sarbanes–Oxley Act

None.

 132

Sec. 802. Criminal penalties for altering documents Summary IN GENERAL—Chapter

73 of title 18, United States Code, is amended by adding at the end the following: § 1519. Destruction, alteration, or falsification of records in Federal investigations and bankruptcy “Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.” Action Required Put in place a system for filing and locating any and all documentation and records of the company including memos and e-mails relating to company business or operations. Basically, anything affecting the company must be retained and accessible.

Sec. 803. Debts non-dischargeable if incurred in violation of securities fraud laws Summary Section 523(a) of title 11, United States Code, is amended—

Action Required None.



(B) results from— (i) any judgment, order, consent order, or decree entered in any Federal or State judicial or administrative proceeding; (ii) any settlement agreement entered into by the debtor; or (iii) any court or administrative order for any damages, fine, penalty, citation, restitutionary payment, disgorgement payment, attorney fee, cost, or other payment owed by the debtor.”

The Sarbanes–Oxley Act

(1) in paragraph (17), by striking “or” after the semicolon; (2) in paragraph (18), by striking the period at the end and inserting “; or”; and (3) by adding at the end, the following: “(19) that— (A) is for— (i) the violation of any of the Federal securities laws (as that term is defined in section 3(a)(47) of the Securities Exchange Act of 1934), any of the State securities laws, or any regulation or order issued under such Federal or State securities laws; or (ii) common law fraud, deceit, or manipulation in connection with the purchase or sale of any security; and

133

Sec. 804. Statute of limitations for securities fraud Summary IN GENERAL—Section 1658 of title 28, United States Code, is amended— (1) by inserting “(a)” before “Except”; and (2) by adding at the end the following:

The Sarbanes–Oxley Act

(b) Notwithstanding subsection (a), a private right of action that involves a claim of fraud, deceit, manipulation, or contrivance in contravention of a regulatory requirement concerning the securities laws, as defined in section 3(a)(47) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(47)), may be brought not later than the earlier of— (1) 2 years after the discovery of the facts constituting the violation; or (2) 5 years after such violation.



EFFECTIVE DATE—The limitations period provided by section 1658(b) of title 28, United States Code, as added by this section, shall apply to all proceedings addressed by this section that are commenced on or after the date of enactment of this Act.

134

(c) NO CREATION OF ACTIONS—Nothing in this section shall create a new, private right of action. Action Required None. Sec. 805. Review of Federal Sentencing Guidelines for obstruction of justice and extensive criminal fraud Summary ENHANCEMENT OF FRAUD AND OBSTRUCTION OF JUSTICE SENTENCES—Pursuant to section 994 of title 28, United States Code, and in accordance with this section, the United States Sentencing Commission shall review and amend, as appropriate, the

Federal Sentencing Guidelines and related policy statements to ensure that— (1) the base offense level and existing enhancements contained in United States Sentencing Guideline 2J1.2 relating to obstruction of justice are sufficient to deter and punish that activity; (2) the enhancements            Action Required None. Sec. 806. Protection for employees of publicly traded companies who provide evidence of fraud



WHISTLEBLOWER PROTECTION FOR EMPLOYEES OF PUBLICLY TRADED COMPANIES—No company with a class of securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l), or that is required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(d)), or any officer, employee, contractor, subcontractor, or agent of such company, may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee— (1) to provide information, cause information to be provided, or otherwise assist in an investigation regarding any conduct which the employee reasonably believes constitutes a violation of section 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders, when the information or assistance is provided to or the investigation is conducted by— (A) a Federal regulatory or law enforcement agency; (B) any Member of Congress or any committee of Congress; or

The Sarbanes–Oxley Act

Summary

135

The Sarbanes–Oxley Act

(C) a person with supervisory authority over the employee (or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct); or (2) to file, cause to be filed, testify, participate in, or otherwise assist in a proceeding filed or about to be filed (with any knowledge of the employer) relating to an alleged violation of section 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders.

 136

Action Required Create a system whereby an employee can report or provide information anonymously to the officers of the company, the Board and particularly the Audit Committee so that problems and violations can be remedied internally. Employees must believe they will not be punished or otherwise adversely affected by such disclosures to the company. (Template 3.1)

Sec. 807. Criminal penalties for defrauding shareholders of publicly traded companies Summary 1348. Securities fraud Whoever knowingly executes, or attempts to execute, a scheme or artifice— (1) to defraud any person in connection with any security of an issuer with a class of securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l) or that is required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(d)); or (2) to obtain, by means of false or fraudulent pretenses, representations, or promises, any money or property in connection with the purchase or sale of any security of an issuer with a class of

securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l) or that is required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(d)); shall be fined under this title, or imprisoned not more than 25 years, or both. Action Required None, other than obtaining legal counsel regarding the issuance of shares and the documentation pertaining to the issuance, such as the IPO etc.

The Sarbanes–Oxley Act

 137

Title IX—White-collar crime penalty enhancements Sec. 901. Short title Summary This title may be cited as the “White-Collar Crime Penalty Enhancement Act of 2002”. Action Required

The Sarbanes–Oxley Act

None. Sec. 902. Attempts and conspiracies to commit criminal fraud offenses Summary IN GENERAL—Chapter 63 of title 18, United States Code, is amended by inserting after section 1348 as added by this Act the following: § 1349. Attempt and conspiracy

 138

“Any person who attempts or conspires to commit any offense under this chapter shall be subject to the same penalties as those prescribed for the offense, the commission of which was the object of the attempt or conspiracy.” Action Required None. Sec. 903. Criminal penalties for mail and wire fraud Summary (a) MAIL FRAUD.—Section 1341 States Code, is amended by inserting “20”. (b) WIRE FRAUD.—Section 1343 States Code, is amended by inserting “20”. Action Required None.

of title 18, United striking “five” and of title 18, United striking “five” and

Sec. 904. Criminal penalties for violations of the Employee Retirement Income Security Act of 1974 Summary Section 501 of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1131) is amended— (1) by striking “$5,000” and inserting “$100,000”; (2) by striking “one year” and inserting “10 years”; and (3) by striking “$100,000” and inserting “$500,000”. Action Required None.

Summary

Action Required None. Sec. 906. Corporate responsibility for financial reports Summary 1350. Failure of corporate officers to certify financial reports (a) CERTIFICATION OF PERIODIC FINANCIAL REPORTS—Each periodic report containing financial statements filed by an issuer with the Securities Exchange Commission pursuant to section 13(a) or 15(d) of the Securities Exchange



DIRECTIVE TO THE UNITED STATES SENTENCING COMMISSION—Pursuant to its authority under section 994(p) of title 18, United States Code, and in accordance with this section, the United States Sentencing Commission shall review and, as appropriate, amend the Federal Sentencing Guidelines and related policy statements to implement the provisions of this Act.

The Sarbanes–Oxley Act

Sec. 905. Amendment to sentencing guidelines relating to certain white-collar offenses

139

The Sarbanes–Oxley Act

Act of 1934 (15 U.S.C. 78m(a) or 78o(d)) shall be accompanied by a written statement by the chief executive officer and chief financial officer (or equivalent thereof) of the issuer. (b) CONTENT—The statement required under subsection (a) shall certify that the periodic report containing the financial statements fully complies with the requirements of section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 78o(d)) and that information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of the issuer.

 140

Action Required Produce report templates to cover the requirements of this section for the CFO and CEO. The fact that both the CFO and CEO will be held liable for any errors or omissions in the financial reports which could result in heavy fines ($1,000,000 or $5,000,000 if willful) and possibly jail sentences (10 to 20 years) suggests that a process be initiated in the company such that the CEO and the CFO (who should be fully cognizant anyway) are able to review the pertinent reports against the financial and other records of the company in an easily understood manner. In a small company this should not be difficult but in a large one, the CEO will be taking a risk if he/she simply relies on others to validate the reports and then signs them off. Ensure that the certifications comply with the SEA items mentioned.

Title X—Corporate tax returns Sec. 1001. Sense of the Senate regarding the signing of corporate tax returns by chief executive officers Summary It is the sense of the Senate that the Federal income tax return of a corporation should be signed by the chief executive officer of such corporation. Action Required

The Sarbanes–Oxley Act

Since the CEO will sign the return it follows that he/she must be fully cognizant of its content and accuracy. Since these returns are often complex, a CEO is going to have to have a lot of confidence and trust in his/her CFO. Otherwise, it may be desirable to have a third party evaluate the return on behalf of the CEO before he/she signs it.

 141

Title XI—Corporate fraud and accountability Sec. 1101. Short title Summary This title may be cited as the “Corporate Fraud Accountability Act of 2002”. Action Required None.

The Sarbanes–Oxley Act

Sec. 1102. Tampering with a record or otherwise impeding an official proceeding. Summary



Whoever corruptly— (1) alters, destroys, mutilates, or conceals a record, document, or other object, or attempts to do so, with the intent to impair the object’s integrity or availability for use in an official proceeding; or (2) otherwise obstructs, influences, or impedes any official proceeding, or attempts to do so, shall be fined under this title or imprisoned not more than 20 years, or both.

142

Action Required See Section 802 and then also enter a section in the company Policies and Procedures Manual concerning maintaining the integrity of documents and reports as they pass through various hands in the company, in particular by initialing and dating handling of significant documents that may be required in an investigation. Sec. 1103. Temporary freeze authority for the Securities and Exchange Commission Summary IN GENERAL— (i) ISSUANCE OF TEMPORARY ORDER—Whenever, during the course of a lawful investigation involving possible violations of the Federal securities laws by an issuer of publicly traded

securities or any of its directors, officers, partners, controlling persons, agents, or employees, it shall appear to the Commission that it is likely that the issuer will make extraordinary payments (whether compensation or otherwise) to any of the foregoing persons, the Commission may petition a Federal district court for a temporary order requiring the issuer to escrow, subject to court supervision, those payments in an interestbearing account for 45 days. Action Required None.

Summary

Action Required None.



REQUEST FOR IMMEDIATE CONSIDERATION BY THE UNITED STATES SENTENCING COMMISSION—Pursuant to its authority under section 994(p) of title 28, United States Code, and in accordance with this section, the United States Sentencing Commission is requested to— (1) promptly review the sentencing guidelines applicable to securities and accounting fraud and related offenses; (2) expeditiously consider the promulgation of new sentencing guidelines or amendments to existing sentencing guidelines to provide an enhancement for officers or directors of publicly traded corporations who commit fraud and related offenses; and (3) submit to Congress an explanation of actions taken by the Sentencing Commission pursuant to paragraph (2) and any additional policy recommendations the Sentencing Commission may have for combating offenses described in paragraph (1).

The Sarbanes–Oxley Act

Sec. 1104. Amendment to the Federal Sentencing Guidelines

143

Sec. 1105. Authority of the Commission to prohibit persons from serving as officers or directors Summary

The Sarbanes–Oxley Act

AUTHORITY OF THE COMMISSION TO PROHIBIT PERSONS FROM SERVING AS OFFICERS OR DIRECTORS—In any cease-and-desist proceeding under subsection (a), the Commission may issue an order to prohibit, conditionally or unconditionally, and permanently or for such period of time as it shall determine, any person who has violated section 10(b) or the rules or regulations thereunder, from acting as an officer or director of any issuer that has a class of securities registered pursuant to section 12, or that is required to file reports pursuant to section 15(d), if the conduct of that person demonstrates unfitness to serve as an officer or director of any such issuer. Action Required

 144

None. Sec. 1106. Increased criminal penalties under Securities Exchange Act of 1934 Summary Section 32(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78ff(a)) is amended— (1) by striking “$1,000,000, or imprisoned not more than 10 years” and inserting “$5,000,000, or imprisoned not more than 20 years”; and (2) by striking “$2,500,000” and inserting “$25,000,000”. Action Required None. Sec. 1107. Retaliation against informants Summary IN GENERAL—Section 1513 of title 18, United States Code, is amended by adding at the end the following:

“(e) Whoever knowingly, with the intent to retaliate, takes any action harmful to any person, including interference with the lawful employment or livelihood of any person, for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any Federal offense, shall be fined under this title or imprisoned not more than 10 years, or both.” Action Required Ensure that all supervisors and managers are aware of this provision, and enter it in the Policies and Procedures Manual. The Sarbanes–Oxley Act

 145

This page intentionally left blank

B Appendix B – Securities Exchange Act of 1934

This page intentionally left blank

Section 10A—Audit requirements In general Each audit required pursuant to this title of the financial statements of an issuer by a registered public accounting firm shall include, in accordance with generally accepted auditing standards, as may be modified or supplemented from time to time by the Commission—



Investigation and report to management

The Sarbanes–Oxley Act

(a) procedures designed to provide reasonable assurance of detecting illegal acts that would have a direct and material effect on the determination of financial statement amounts; (b) procedures designed to identify related party transactions that are material to the financial statements or otherwise require disclosure therein; and (c) an evaluation of whether there is substantial doubt about the ability of the issuer to continue as a going concern during the ensuing fiscal year. (d) Required response to audit discoveries

149

If, in the course of conducting an audit pursuant to this title to which subsection (a) of this section applies, the registered public accounting firm detects or otherwise becomes aware of information indicating that an illegal act (whether or not perceived to have a material effect on the financial statements of the issuer) has or may have occurred, the firm shall, in accordance with generally accepted auditing standards, as may be modified or supplemented from time to time by the Commission— (a) determine whether it is likely that an illegal act has occurred; and (b) if so, determine and consider the possible effect of the illegal act on the financial statements of the issuer, including any contingent monetary effects, such as fines, penalties, and damages; and as soon as practicable, inform the appropriate level of the management of the issuer and assure that the audit committee of the issuer, or the board of directors of the issuer in the absence of such a committee, is adequately informed with respect to illegal acts that have been detected or have otherwise come to the attention of such firm in the course of the audit, unless the illegal act is clearly inconsequential.

Response to failure to take remedial action

The Sarbanes–Oxley Act

If, after determining that the audit committee of the board of directors of the issuer, or the board of directors of the issuer in the absence of an audit committee, is adequately informed with respect to illegal acts that have been detected or have otherwise come to the attention of the firm in the course of the audit of such firm, the registered public accounting firm concludes that—

 150

(a) the illegal act has a material effect on the financial statements of the issuer; (b) the senior management has not taken, and the board of directors has not caused senior management to take, timely and appropriate remedial actions with respect to the illegal act; and (c) the failure to take remedial action is reasonably expected to warrant departure from a standard report of the auditor, when made, or warrant resignation from the audit engagement; the registered public accounting firm shall, as soon as practicable, directly report its conclusions to the board of directors. Notice to Commission; response to failure to notify An issuer whose board of directors receives a report under paragraph (2) shall inform the Commission by notice not later than 1 business day after the receipt of such report and shall furnish the registered public accounting firm making such report with a copy of the notice furnished to the Commission. If the registered public accounting firm fails to receive a copy of the notice before the expiration of the required 1-business-day period, the registered public accounting firm shall— (a) resign from the engagement; or (b) furnish to the Commission a copy of its report (or the documentation of any oral report given) not later than 1 business day following such failure to receive notice. Report after resignation If a registered public accounting firm resigns from an engagement under paragraph (3)(A), the firm shall, not later than 1 business day following the failure by the issuer to notify the Commission under paragraph (3), furnish to the Commission a copy of the report of the firm (or the documentation of any oral report given).

Auditor liability limitation No registered public accounting firm shall be liable in a private action for any finding, conclusion, or statement expressed in a report made pursuant to paragraph (3) or (4) of subsection (b) of this section, including any rule promulgated pursuant thereto. Civil penalties in cease-and-desist proceedings



Preservation of existing authority

The Sarbanes–Oxley Act

If the Commission finds, after notice and opportunity for hearing in a proceeding instituted pursuant to section 21C, that a registered public accounting firm has willfully violated paragraph (3) or (4) of subsection (b) of this section, the Commission may, in addition to entering an order under section 21C, impose a civil penalty against the registered public accounting firm and any other person that the Commission finds was a cause of such violation. The determination to impose a civil penalty and the amount of the penalty shall be governed by the standards set forth in section 21B.

151

Except as provided in subsection (d) of this section, nothing in this section shall be held to limit or otherwise affect the authority of the Commission under this title. Definitions As used in this section, the term “illegal act” means an act or omission that violates any law, or any rule or regulation having the force of law. As used in this section, the term ‘issuer’ means an issuer (as defined in section 3), the securities of which are registered under section 12, or that is required to file reports pursuant to section 15(d), or that files or has filed a registration statement that has not yet become effective under the Securities Act of 1933, and that it has not withdrawn. Prohibited activities Except as registered that firm, sion) that

provided in subsection (h), it shall be unlawful for a public accounting firm (and any associated person of to the extent determined appropriate by the Commisperforms for any issuer any audit required by this title

The Sarbanes–Oxley Act

or the rules of the Commission under this title or, beginning 180 days after the date of commencement of the operations of the Public Company Accounting Oversight Board established under section 101 of the Sarbanes–Oxley Act of 2002 (in this section referred to as the ‘Board’), the rules of the Board, to provide to that issuer, contemporaneously with the audit, any non-audit service, including—

 152

(a) bookkeeping or other services related to the accounting records or financial statements of the audit client; (b) financial information systems design and implementation; (c) appraisal or valuation services, fairness opinions, or contributionin-kind reports; (d) actuarial services; (e) internal audit outsourcing services; (f) management functions or human resources; (g) broker or dealer, investment adviser, or investment banking services; (h) legal services and expert services unrelated to the audit; and (i) any other service that the Board determines, by regulation, is impermissible. Pre-approval required for non-audit services A registered public accounting firm may engage in any non-audit service, including tax services, that is not described in any of paragraphs (1) through (9) of subsection (g) for an audit client, only if the activity is approved in advance by the audit committee of the issuer, in accordance with subsection (i). Pre-approval requirements In General Audit committee action All auditing services (which may entail providing comfort letters in connection with securities underwritings or statutory audits required for insurance companies for purposes of State law) and non-audit services, other than as provided in subparagraph (B), provided to an issuer by the auditor of the issuer shall be pre-approved by the audit committee of the issuer.

De minimus exception The pre-approval requirement under subparagraph (A) is waived with respect to the provision of non-audit services for an issuer, if—

Disclosure to investors

Delegation authority The audit committee of an issuer may delegate to 1 or more designated members of the audit committee who are independent directors of the board of directors, the authority to grant pre-approvals required by this subsection. The decisions of any member to whom authority is delegated under this paragraph to pre-approve an activity under this subsection shall be presented to the full audit committee at each of its scheduled meetings.

Approval of audit services for other purposes In carrying out its duties under subsection (m)(2), if the audit committee of an issuer approves an audit service within the scope of the engagement of the auditor, such audit service shall be deemed to have been pre-approved for purposes of this subsection.



Approval by an audit committee of an issuer under this subsection of a non-audit service to be performed by the auditor of the issuer shall be disclosed to investors in periodic reports required by section 13(a).

The Sarbanes–Oxley Act

(a) the aggregate amount of all such non-audit services provided to the issuer constitutes not more than 5 percent of the total amount of revenues paid by the issuer to its auditor during the fiscal year in which the non-audit services are provided; (b) such services were not recognized by the issuer at the time of the engagement to be non-audit services; and: (c) such services are promptly brought to the attention of the audit committee of the issuer and approved prior to the completion of the audit by the audit committee or by 1 or more members of the audit committee who are members of the board of directors to whom authority to grant such approvals has been delegated by the audit committee.

153

Audit partner rotation It shall be unlawful for a registered public accounting firm to provide audit services to an issuer if the lead (or coordinating) audit partner (having primary responsibility for the audit), or the audit partner responsible for reviewing the audit, has performed audit services for that issuer in each of the 5 previous fiscal years of that issuer. Reports to audit committees

The Sarbanes–Oxley Act

Each registered public accounting firm that performs for any issuer any audit required by this title shall timely report to the audit committee of the issuer—

 154

(a) all critical accounting policies and practices to be used; (b) all alternative treatments of financial information within generally accepted accounting principles that have been discussed with management officials of the issuer, ramifications of the use of such alternative disclosures and treatments, and the treatment preferred by the registered public accounting firm; and (c) other material written communications between the registered public accounting firm and the management of the issuer, such as any management letter or schedule of unadjusted differences.

Conflicts of interest It shall be unlawful for a registered public accounting firm to perform for an issuer any audit service required by this title, if a chief executive officer, controller, chief financial officer, chief accounting officer, or any person serving in an equivalent position for the issuer, was employed by that registered independent public accounting firm and participated in any capacity in the audit of that issuer during the 1-year period preceding the date of the initiation of the audit. Standards relating to audit committees Commission rules In general Effective not later than 270 days after the date of enactment of this subsection, the Commission shall, by rule, direct the national securities exchanges and national securities associations to prohibit the

listing of any security of an issuer that is not in compliance with the requirements of any portion of paragraphs (2) through (6). Opportunity to cure defects The rules of the Commission under subparagraph (A) shall provide for appropriate procedures for an issuer to have an opportunity to cure any defects that would be the basis for a prohibition under subparagraph (A), before the imposition of such prohibition. Responsibilities relating to registered public accounting firms

The Sarbanes–Oxley Act

The audit committee of each issuer, in its capacity as a committee of the board of directors, shall be directly responsible for the appointment, compensation, and oversight of the work of any registered public accounting firm employed by that issuer (including resolution of disagreements between management and the auditor regarding financial reporting) for the purpose of preparing or issuing an audit report or related work, and each such registered public accounting firm shall report directly to the audit committee.

 155

Independence In general Each member of the audit committee of the issuer shall be a member of the board of directors of the issuer, and shall otherwise be independent. Criteria In order to be considered to be independent for purposes of this paragraph, a member of an audit committee of an issuer may not, other than in his or her capacity as a member of the audit committee, the board of directors, or any other board committee— (a) accept any consulting, advisory, or other compensatory fee from the issuer; or (b) be an affiliated person of the issuer or any subsidiary thereof. Exemption authority The Commission may exempt from the requirements of subparagraph (B) a particular relationship with respect to audit committee

members, as the Commission determines appropriate in light of the circumstances. Complaints Each audit committee shall establish procedures for—

The Sarbanes–Oxley Act

(a) the receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters; and (b) the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters.

 156

Authority to engage advisers Each audit committee shall have the authority to engage independent counsel and other advisers, as it determines necessary to carry out its duties. Funding Each issuer shall provide for appropriate funding, as determined by the audit committee, in its capacity as a committee of the board of directors, for payment of compensation— (a) to the registered public accounting firm employed by the issuer for the purpose of rendering or issuing an audit report; and (b) to any advisers employed by the audit committee under paragraph (5).

C Appendix C – OSHA Whistleblower Complaint Procedures – Final Rules

This page intentionally left blank

DEPARTMENT OF LABOR Occupational Safety and Health Administration 29 CFR Part 1980 RIN 1218 AC10 Procedures for the Handling of Discrimination Complaints Under Section 806 of the Corporate and Criminal Fraud Accountability Act of 2002, Title VIII of the Sarbanes–Oxley Act of 2002 AGENCY: Occupational Safety and Health Administration, Labor. ACTION: Final rule.

FOR FURTHER INFORMATION CONTACT: Thomas Marple, Director, Office of Investigative Assistance, Occupational Safety and Health Administration, U.S. Department of Labor, Room N-3603, 200 Constitution Avenue, NW., Washington, DC 20210; telephone (202) 693–2199.



DATES: This final rule is effective on 24 August 2004.

The Sarbanes–Oxley Act

SUMMARY: This document provides the final text of regulations governing the employee protection (“whistleblower”) provisions of section 806 of the Corporate and Criminal Fraud Accountability Act of 2002, Title VIII of the Sarbanes–Oxley Act of 2002 (“Sarbanes– Oxley” or “Act”), enacted on July 30, 2002. The Act generally was designed to protect investors by ensuring corporate responsibility, enhancing public disclosure, and improving the quality and transparency of financial reporting and auditing. The whistleblower provisions were intended to protect employees who report fraudulent activity that can mislead innocent investors in publicly traded companies. This rule establishes procedures and time frames for the handling of discrimination complaints under Title VIII of Sarbanes–Oxley, including procedures and time frames for employee complaints to the Occupational Safety and Health Administration (“OSHA”), investigations by OSHA, appeals of OSHA determinations to an administrative law judge (“ALJ”) for a hearing de novo, hearings by ALJs, review of ALJ decisions by the Administrative Review Board (acting on behalf of the Secretary) and judicial review of the Secretary’s final decisions.

159

SUPPLEMENTARY INFORMATION:

The Sarbanes–Oxley Act

I. Background

 160

The Sarbanes–Oxley Act of 2002 (“Sarbanes–Oxley”), Public Law 107–204, was enacted on July 30, 2002. Title VIII of Sarbanes–Oxley is designated as the Corporate and Criminal Fraud Accountability Act of 2002. Section 806, codified at 18 U.S.C. 1514A, provides protection to employees against retaliation by companies with a class of securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l) and companies required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 780(d)), or any officer, employee, contractor, subcontractor, or agent of such companies, because the employee provided information to the employer or a Federal agency or Congress relating to alleged violations of 18 U.S.C. 1341, 1343, 1344, or 1348, or any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders. In addition, employees are protected against discrimination when they have filed, testified in, participated in, or otherwise assisted in a proceeding filed or about to be filed relating to any such violation or alleged violation. These rules establish procedures for the handling of discrimination complaints under Title VIII of Sarbanes–Oxley. II. Summary of Statutory Procedures The Sarbanes–Oxley whistleblower provisions provide that a covered employee may file, within 90 days of the alleged discrimination, a complaint with the Secretary of Labor (“the Secretary”).1 The statute requires the Secretary to notify the person named in the complaint and the employer of the filing of the complaint. The statute further provides that proceedings under Sarbanes–Oxley will be governed by the rules and procedures and burdens of proof of the Wendell H. Ford Aviation Investment and Reform Act for the

1

Responsibility for receiving and investigating these complaints has been delegated to the Assistant Secretary for OSHA. Secretary’s Order 5-2002, 67 FR 65008 (Oct. 22, 2002). Hearings on determinations by the Assistant Secretary are conducted by the Office of Administrative Law Judges, and appeals from decisions by administrative law judges are decided by the Administrative Review Board. Secretary’s Order 1-2002, 67 FR 64272 (Oct. 17, 2002).

21st Century (“AIR21”), 49 U.S.C. 42121(b). These rules and procedures are described below in Section III.

III. Summary of Regulations and Rulemaking Proceedings

In response, seven organizations and one individual filed comments with the agency within the public comment period. Comments were received from Siemens Aktiengesellschaft (“Siemens”); Plains All American Pipeline, LP (“Plains AAP”); the American Society of Safety Engineers (“ASSE”); the Society for Human Resource Management (“SHRM”); the Human Resource Policy Association (“HRPA”); the U.S. Chamber of Commerce (“the Chamber”); the Government Accountability Project (“GAP”); and Mr. Bill Bremer, Director, Risk Manager for TMP Resource Solutions. Three organizations – Cleary, Gottlieb, Steen & Hamilton; DaimlerChrysler; and the Edison Electric Institute – filed comments that were received outside the public comment period. OSHA has reviewed and considered the timely comments. The following discussion addresses the comments and OSHA’s responses in the order of the provisions of the rule.



On May 28, 2003, the Occupational Safety and Health Administration published in the Federal Register an interim final rule promulgating rules that implemented section 806 of the Sarbanes–Oxley Act of 2002 (“Sarbanes–Oxley”), Public Law No. 107–204, 68 FR 31860–31868. In addition to promulgating the interim final rule, OSHA’s notice included a request for public comment on the interim rules by July 28, 2003.

The Sarbanes–Oxley Act

Sarbanes–Oxley authorizes an award to a prevailing employee of make-whole relief, including reinstatement with the same seniority status that the employee would have had but for the discrimination, back pay with interest, and compensation for any special damages sustained, including litigation costs, expert witness fees and reasonable attorney’s fees. See 18 U.S.C. 1514A(c)(2). If the Secretary has not issued a final decision within 180 days of the filing of the complaint and there is no showing that there has been delay due to the bad faith of the claimant, the claimant may bring an action at law or equity for de novo review in the appropriate district court of the United States, which will have jurisdiction over such action without regard to the amount in controversy.

161

The Sarbanes–Oxley Act

General Comments

 162

SHRM and the Chamber both commented generally that Sarbanes– Oxley is different from other whistleblower laws administered by OSHA, because it involves complex matters of corporate securities laws and other financial and accountancy laws and practices. As a result, these organizations are concerned about OSHA’s preparedness to undertake Sarbanes–Oxley investigations. OSHA believes that the whistleblower provisions of Sarbanes–Oxley are similar to the other 13 whistleblower statutes that it administers in that it protects employees from adverse personnel actions taken in retaliation for their having engaged in protected activity. OSHA consequently believes that its investigators have ample experience and are well able to investigate the type of employment-related disputes that typically arise under Sarbanes–Oxley. Both SHRM and the Chamber further commented generally that the regulatory time frames are unrealistic. The Sarbanes–Oxley regulatory time frames are either mandated by the statute or are designed to effectuate Congress’s desire for an expedited administrative complaint process. OSHA believes that the time frames reasonably balance the needs of both employees and employers for timely and fair resolution of whistleblower complaints. SHRM expressed a general concern about the broad nature of activity protected under the whistleblower provision of Sarbanes–Oxley, indicating that it might generate complaints based on actions taken in the normal course of business. For example, SHRM suggested that an employee may mistakenly view an employer’s decision to dispose of certain documents in the normal course of business to be a violation of section 802 of Sarbanes–Oxley, which makes it a felony for a person to destroy evidence with the intent to obstruct justice or to fail to preserve certain audit papers of companies that issue securities. Related to this comment is SHRM’s concern that section 806 of Sarbanes–Oxley requires the employer to meet a higher burden of proof than other discrimination laws, in that it requires an employer to establish by clear and convincing evidence that it would have taken the unfavorable personnel action even absent the protected activity. These rules are procedural in nature and are not intended to provide interpretations of the Act. Under section 806, Congress chose to protect a broad range of disclosures about corporate practices that may adversely affect stockholders. Similarly, Congress

Mr. Bremer commented generally that the regulations should be used as an opportunity to bridge a gap between industry and OSHA. OSHA always is interested in reaching out to industry and employees to ensure effective enforcement of the laws that it administers. GAP commented generally that several of the rules evince a bias against employees. In this regard, GAP commented that the whistleblower provisions of Sarbanes–Oxley are remedial in nature and should be broadly construed and that therefore the regulations should not operate to deny a complainant the ability to fully and fairly litigate his or her complaint. As described more fully below, OSHA believes that these regulations appropriately balance a complainant’s right to fully and fairly litigate his or her complaint before the agency with both the due process rights of named persons and Congress’s desire for an expedited administrative complaint process.



The American Society of Safety Engineers commented generally that it has no specific concerns with the interim final regulations, but that it hopes that OSHA will monitor their effect in encouraging corporations to be more accountable and will be flexible and willing to make changes should the regulations prove to be inadequate. OSHA intends to monitor the effectiveness of these regulations and will make any regulatory changes in the future deemed necessary.

The Sarbanes–Oxley Act

chose to apply the “clear and convincing” burden of proof standard, which also applies under the whistleblower protection provisions of the Energy Reorganization Act (“ERA”), 42 U.S.C. 5851(b)(3)(D); AIR21, 49 U.S.C. 42121(b)(2)(B)(iv); and the Pipeline Safety Improvement Act of 2002 (“PSIA”), 49 U.S.C. 60129(b)(2)(B)(iv). OSHA also notes that SHRM’s concern that innocent business behavior will become the subject of a Sarbanes–Oxley complaint is addressed by the statutory requirement that an employee “reasonably believe” that his or her disclosure is related to fraud or a violation of a Securities and Exchange Commission rule or regulation. See 18 U.S.C. 1514A(a)(1). The legislative history of section 806 indicates that Congress intended to apply to 18 U.S.C. 1514A(a)(1) the normal “reasonable person” standard used and interpreted in a wide variety of legal contexts. See 148 Cong. Rec. S7420 (daily ed. July 26, 2002) (statement of Senator Leahy). If the named person establishes that the disclosures at issue in a complaint involve activities that occur in the normal course of business, an employee’s belief might not be reasonable under that standard.

163

IV. Summary and Discussion of Regulatory Provisions Section 1980.100 Purpose and Scope This section describes the purpose of the regulations implementing Sarbanes–Oxley and provides an overview of the procedures covered by these new regulations. No comments were received on this section.

The Sarbanes–Oxley Act

Section 1980.101 Definitions

 164

In addition to the general definitions, the regulations define “company” and “company representative” to together include all entities and individuals covered by Sarbanes–Oxley. The definition of “named person” includes the employer as well as the company and company representative who the complainant alleges in the complaint to have violated the Act. Thus, the definition of “named person” will implement Sarbanes–Oxley’s unique statutory provisions that identify individuals as well as the employer as potentially liable for discriminatory action. We anticipate, however, that in most cases the named person likely will be the employer. Three comments were received regarding the definitions contained in § 1980.101. Siemens commented that the regulatory definition of “company” should exclude foreign issuers to the extent that it relates to foreign national employees who do not work in United States facilities of the foreign issuers. In support, Siemens noted that many foreign industrialized nations already have laws that protect whistleblowers, that United States labor laws already apply to Siemens’s affiliated United States companies, and that labor law forms part of the national sovereignty of a foreign country. Similarly, HRPA commented that the rule should be revised so as not to apply to employees employed outside of the United States by United States corporations or their subsidiaries; nor should it apply to foreign corporations that have no United States employees. HRPA suggested that applying the rule in these situations would divert the Department’s resources and therefore undermine its fundamental mission. The purpose of this rule is to provide procedures for the handling of Sarbanes–Oxley discrimination complaints; this rule is not intended to provide statutory interpretations. Because the regulatory definition of “company” simply applies the language used in the statute, OSHA does not believe any changes to the definition are necessary.

This section describes the whistleblower activity which is protected under the Act and the type of conduct which is prohibited in response to any protected activity. Complaints to an individual member of Congress are protected, even if such member is not conducting an ongoing Committee investigation within the jurisdiction of a particular Congressional committee, provided that the complaint relates to conduct that the employee reasonably believes to be a violation of one of the enumerated laws or regulations. Although no comments were received with regard to this section’s description of adverse action under Sarbanes–Oxley, OSHA has modified § 1980.102(b) to eliminate language deemed redundant with that in § 1980.102(a). In this regard, unlike other whistleblower statutes administered by OSHA, Sarbanes–Oxley specifically describes the types of adverse actions prohibited under the Act. Because this statutory description appears in § 1980.102(a), § 1980.102(b) no longer lists actions deemed actionable under the Act. HRPA commented that this section should be clarified to ensure that the description of protected activity covers only disclosures of



Section 1980.102 Obligations and Prohibited Acts

The Sarbanes–Oxley Act

Plains AAP commented that the regulatory definitions of “employee” and “company representative” work together to broaden the statutory definition of protected employees. Specifically, Plains AAP commented that section 806(a) of the Sarbanes–Oxley Act is captioned “Whistleblower protection for employees of publicly traded companies,” yet the definitions of “employee” and “company representative” in the regulations provide protection to employees of contractors and subcontractors of publicly traded companies. OSHA believes that the definitions in this section accurately reflect the statutory language. Notwithstanding its caption, section 806(a) expressly provides that no publicly traded company, “or any officer, employee, contractor, subcontractor, or agent of such company, may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee.∗∗∗ ” The statute thus protects the employees of publicly traded companies as well as the employees of contractors, subcontractors, and agents of those publicly traded companies. Accordingly, OSHA does not believe that its regulatory definitions broaden the class of employees that are protected under the plain language of Sarbanes–Oxley.

165

The Sarbanes–Oxley Act

fraud that harm shareholders or that relate to securities law. HRPA expressed concern that under this section’s description of protected activity, employees might be able to bring claims based on ordinary business and employment disputes that the statute was not intended to address. HRPA suggested, therefore, that this section provide that to be protected, a reported violation must affect as much as 3% of a company’s revenue before it is considered an issue that would implicate the securities laws. Finally, HRPA also suggested that this section delineate between the protected activity covered by Sarbanes–Oxley and that covered under some of the more expansive state whistleblower protection statutes.

 166

The description of protected activity in this section comes from the statute. As stated above, the purpose of these regulations is to provide procedural rules for the handling of whistleblower complaints and not to interpret the statute. Furthermore, determinations as to whether employee disclosures concerning alleged corporate fraud are protected under Sarbanes–Oxley will depend on the specific facts of each case. It is not appropriate therefore for these regulations to specify a percentage or formula for use in defining protected activity. With regard to HRPA’s final comment on this section, because these rules are procedural in nature and the description of protected activity comes from the statute, a delineation between what is protected under Sarbanes–Oxley and what is protected under other laws not administered by OSHA is neither necessary nor appropriate.

Section 1980.103 Filing of Discrimination Complaint This section explains the requirements for filing a discrimination complaint under Sarbanes–Oxley. To be timely, a complaint must be filed within 90 days of when the alleged violation occurs. Under Delaware State College v. Ricks, 449 U.S. 250, 258 (1980), this is considered to be when the discriminatory decision has been both made and communicated to the complainant. In other words, the limitations period commences once the employee is aware or reasonably should be aware of the employer’s decision. See Equal Employment Opportunity Commission v. United Parcel Service, 249 F.3d 557, 561–62 (6th Cir. 2001). Complaints filed under the Act must be made in writing, but do not need to be made in any particular form. With the consent of the employee, complaints may be made by any person on the employee’s behalf.

Sarbanes–Oxley follows the AIR21 requirement that a complaint will be dismissed if it fails to make a prima facie showing that protected behavior or conduct was a contributing factor in the unfavorable personnel action alleged in the complaint. Also included in this section is the AIR21 requirement that an investigation of the complaint will



Section 1980.104 Investigation

The Sarbanes–Oxley Act

Both SHRM and HRPA commented that this section should require complaints to allege wrongdoing under Sarbanes–Oxley with greater specificity. To ensure that an employee’s belief that a reported violation is reasonable, HRPA also suggested that this section require that complaints contain detailed analyses of the securities laws at issue and of how they were violated, and added that OSHA should not conduct investigations if the employer demonstrates by clear and convincing evidence that the employee’s belief was not reasonable. It is OSHA’s view that these concerns are adequately dealt with in § 1980.104 herein, the section covering investigations. As set forth at § 1980.104(b)(2), and as directed by statute, OSHA will not investigate where a complainant has failed to make a prima facie showing that the protected behavior was a contributing factor in the unfavorable personnel action alleged. To make a prima facie showing, the complainant must allege that he or she engaged in protected activity. See § 1980.104(b)(1)(i). Activity under Sarbanes–Oxley is only protected if the employee provides information that he or she “reasonably believes” constitutes a violation of 18 U.S.C. 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders. OSHA believes that it would be overly restrictive to require a complaint to include detailed analyses when the purpose of the complaint is to trigger an investigation to determine whether evidence of discrimination exists. To the extent that SHRM and HRPA are suggesting that a complaint on its face must make a prima facie showing to avoid dismissal, OSHA has consistently believed that supplementation of the complaint by interviews with the complainant may be necessary and is appropriate. Although the Sarbanes– Oxley complainant often is highly educated, not all employees have the sophistication or legal expertise to specifically aver the elements of a prima facie case and/or supply evidence in support thereof. The regulations thus recognize that supplemental interviews may become part of a complaint. See § § 1980.104(b)(1) and (2).

167

The Sarbanes–Oxley Act

not be conducted if the named person demonstrates by clear and convincing evidence that it would have taken the same unfavorable personnel action in the absence of the complainant’s protected behavior or conduct, notwithstanding the prima facie showing of the complainant. Upon receipt of a complaint in the investigating office, the Assistant Secretary notifies the named person of these requirements and the right of each named person to seek attorney’s fees from an ALJ or the Board if the named person alleges that the complaint was frivolous or brought in bad faith.

 168

Under this section, the named person has the opportunity within 20 days of receipt of the complaint to meet with representatives of OSHA and present evidence in support of its position. If, upon investigation, OSHA has reasonable cause to believe that the named person has violated the Act and therefore that preliminary relief for the complainant is warranted, OSHA again contacts the named person with notice of this determination and provides the substance of the relevant evidence upon which that determination is based, consistent with the requirements of confidentiality of informants. The named person is afforded the opportunity, within 10 business days, to provide written evidence in response to the allegation of the violation, meet with the investigators, and present legal and factual arguments why preliminary relief is not warranted. This section provides due process procedures in accordance with the Supreme Court decision under STAA in Brock v. Roadway Express, Inc., 481 U.S. 252 (1987). Both SHRM and the Chamber commented that OSHA’s pressure to complete its investigation within 60 days (see § 1980.105(a)) will frustrate early settlement attempts. Accordingly, they suggested that this rule provide that settlement negotiations between the complainant and the named person temporarily curtail the running of the 180-day period in which a complainant may elect to go to Federal court under 18 U.S.C. 1514A(b)(1)(B). OSHA does not believe that the statute authorizes such a rule. Moreover, it is OSHA’s view that early settlements are facilitated by the provision that permits a complainant to file a de novo action in Federal court 180 days after the filing of his or her administrative complaint, because it provides an incentive for the employer to resolve quickly meritorious allegations. Of course, there is nothing to prevent the complainant from agreeing to delay a filing in Federal court pending the outcome of settlement negotiations.



GAP commented that the regulations are biased in favor of the “named party” because they provide that the “named party” may meet with OSHA and challenge its findings, but do not have similar provisions for the complainant. Specifically, GAP commented that the only opportunity for the complainant to meet with OSHA lies in the discretion of the OSHA investigators. GAP suggested that in

The Sarbanes–Oxley Act

Plains AAP commented that because the regulations protect employees of contractors and subcontractors of a publicly traded company, and because under § 1980.104(b), a complainant can make a prima facie showing of a violation without alleging that the named person was involved in the adverse action, public companies will become involved in whistleblower disputes stemming from the employment decisions of contractors over which the company had no control. To avoid this perceived problem, Plains AAP suggested that § 1980.104(b)(iii) be revised to read: “The employee suffered an unfavorable personnel action for which the named person was responsible or in which the named person participated.” Plains AAP commented that this revision would provide OSHA with clear grounds to dismiss a case against a person who is only being named for its nuisance value. OSHA does not believe that the suggested revision is necessary or warranted. Sarbanes–Oxley’s whistleblower provision is similar to other whistleblower provisions administered by the Secretary. Under those provisions, the ARB has held that a respondent may be liable for its contractor’s or subcontractor’s adverse action against an employee in situations where the respondent acted as an employer with regard to the employee of the contractor or subcontractor, whether by exercising control of the work product or by establishing, modifying, or interfering with the terms, conditions, or privileges of employment. See, e.g., Stephenson v. NASA, ARB No. 96-080, 1997 WL 166055 ∗ 2 (DOL Adm. Rev. Bd. Apr. 7, 1997). Conversely, a respondent will not be liable for the adverse action taken against an employee of its contractor or subcontractor where the respondent did not act as an employer with regard to the employee. Furthermore, the statute and this rule provide safeguards to prevent a complainant’s bringing a complaint against a named person simply for its nuisance value. Specifically, a named person may seek from the ALJ or the Board an award of reasonable attorney’s fees up to $1,000 for a complaint determined to be frivolous or brought in bad faith. See 18 U.S.C. 1514A(b)(2)(A); 29 CFR 1980.109(b); 1980.110(e).

169

The Sarbanes–Oxley Act

every instance that this section provides that the named party may meet with OSHA, it should also provide that the complainant may meet with OSHA. OSHA believes that such a revision is unnecessary. The regulations are drafted to provide named persons with the due process rights to which they are entitled under the Supreme Court’s decision in Brock v. Roadway Express, Inc. Moreover, the language of Sarbanes–Oxley, which is similar to that of other whistleblower laws administered by OSHA, makes clear that OSHA’s initial investigation is to be conducted independently for the purposes of establishing the facts and facilitating an early resolution of the claim. In the conduct of such an independent investigation, complainants are given ample opportunity to meet with OSHA concerning the merits of their complaints.

 170

GAP also commented that § 1980.104(b)(2) should include specific language explaining the burden under the “contributing factor” test. Specifically, GAP suggested that, based on the definition of “contributing factor” in the legislative history of the Whistleblower Procedure Act, 5 U.S.C. 2302(b), the first and second sentences of § 1980.104(b)(2) be revised to begin with the following language: “Contributing factor means ‘any factor, which alone or in connection with other factors, tends to affect in any way the outcome of the decision.’ ” OSHA does not believe that this revision is necessary. The “contributing factor” language used in this section is identical to that used in the employee protection provisions of the ERA and AIR21, under which there is sufficient case law interpreting the phrase. For example, in Kester v. Carolina Power & Light Co., No. 02-007, 2003 WL 22312696, ∗ 8 (Adm. Rev. Bd. Sept. 30, 2003), the ARB noted: [P]rior to the 1992 amendments, the ERA complainant was required to prove that protected activity was a “motivating factor” in the employer’s decision. Congress adopted the less onerous “contributing factor” standard “in order to facilitate relief for employees who have been retaliated against for exercising their [whistleblower rights].” 138 Cong. Rec. No. 142 (Oct. 5, 1992). Congress may have been recalling that in 1989 it enacted the Whistleblower Protection Act, Public Law 101–12, section 3(a)(13), 103 Stat. 29. The WPA requires a complainant to prove that a protected disclosure was a “contributing factor in the personnel action ∗ ∗ ∗ ” 5 U.S.C. 1221(e)(1) (West 1996). See also Stone & Webster Eng’g Corp. v. Herman, 115 F.3d 1568, 1573 (1997) (construing the “contributing factor” provision in the ERA).

GAP also commented that § 1980.104(b)(2) should explicitly reaffirm that the “contributing factor” standard is met when an alleged adverse action is taken after protected activity, but before a new performance appraisal is made. It is OSHA’s view that what must be pled and proven to establish discrimination or retaliation under section 806 of Sarbanes–Oxley will depend upon the facts and circumstances of each individual case. Accordingly, it would not be appropriate to specify in a regulation those facts that will automatically establish a prima facie case of discrimination.

SHRM commented that under § 1980.104(c), the named person is given too short a period, i.e., 20 days, in which to respond to OSHA after receiving notice of the complaint. According to SHRM, the 20-day period does not allow sufficient time for the named person to conduct an internal investigation and to request and prepare for a meeting with OSHA. The statute provides only 60 days for OSHA to complete the entire investigation and issue findings. Accordingly, OSHA believes that 20 days provides sufficient time



GAP also commented that to foster an appearance of fairness, § 1980.104(c), in addition to stating that the named person has a right to seek attorney’s fees for a frivolous complaint, should refer to the complainant’s right to obtain attorney’s fees should he or she prevail before OSHA. The complainant’s right to obtain make-whole relief, including the right to recover attorney’s fees, is fully described in other parts of this rule; therefore, no revision is necessary.

The Sarbanes–Oxley Act

GAP further commented that to ensure that OSHA investigators only consider the valid reasons proffered by named persons in defense of their adverse employment actions, § 1980.104(c) should be revised to include the word “legitimately,” with an explanation in the preamble as to what defenses will be considered legitimate and what defenses will not be so considered. Again, OSHA does not believe that such a revision is warranted. Its investigators have vast experience conducting fair and impartial investigations of whistleblower complaints. In evaluating the merits of a complaint, investigators only consider explanations for any adverse action taken by a named person that they consider to be non-discriminatory and credible. Moreover, for the same reasons that it is inappropriate to specify facts that will or will not constitute protected activity for purposes of a complainant’s prima facie showing, it is inappropriate to specify facts that will or will not constitute a defense for adverse action.

171

The Sarbanes–Oxley Act

for the named person to research and prepare a response, without impeding the agency’s ability to complete the investigation in a timely manner. Moreover, the 20-day period is consistent with that provided under OSHA’s regulations for the handling of complaints under the Surface Transportation Assistance Act (“STAA”) and AIR21, the other whistleblower statutes administered by OSHA that have 60-day investigation time frames. See 29 CFR 1978.103(b); 29 CFR 1979.104(c).

 172

Regarding § 1980.104(e), GAP objected to allowing the named person 10 business days in which to respond to the due process letter because it delays OSHA’s ordering temporary relief to the complainant. GAP also believed that to be fair, the complainant should be given another opportunity to rebut the named person’s response to the letter. In contrast, SHRM commented that 10 business days is too short a time in which to expect a named person to prepare an adequate legal response to OSHA’s reasonable cause determination and that the regulation should allow for great flexibility. As noted above, OSHA’s investigations are conducted independently and under tight time frames, prior to the administrative hearing phase of the process, in which all parties participate fully. The purpose of § 1980.104(e) is to ensure compliance with the Supreme Court’s ruling in Brock v. Roadway Express, Inc., in which the Court, on a constitutional challenge to the temporary reinstatement provision in the employee protection provisions of STAA, upheld the facial constitutionality of the statute and the procedures adopted by OSHA under the Due Process Clause of the Fifth Amendment, but ruled that the record failed to show that OSHA investigators had informed Roadway of the substance of the evidence to support reinstatement of the discharged employee. OSHA believes that this purpose is met by § 1980.104(e) as currently written and that no changes are necessary. Section 1980.105 Issuance of Findings and Preliminary Orders This section provides that, on the basis of information obtained in the investigation, the Assistant Secretary will issue, within 60 days of the filing of a complaint, a finding regarding whether or not there is reasonable cause to believe that the complaint has merit. If the finding is that there is reasonable cause to believe that the complaint has merit, the Assistant Secretary will order appropriate preliminary relief. The letter accompanying the findings and order advises the parties of their right to file objections to the findings of the Assistant

Secretary and to request a hearing, and of the right of the named person to request attorney’s fees from the ALJ, regardless of whether the named person has filed objections, if the named person alleges that the complaint was frivolous or brought in bad faith. If no objections are filed within 30 days of receipt of the findings, the findings and any preliminary order of the Assistant Secretary become the final findings and order of the Secretary. If objections are timely filed, any order of preliminary reinstatement will take effect, but the remaining provisions of the order will not take effect until administrative proceedings are completed.



Comments on this section were received from SHRM, the Chamber, and GAP. Both SHRM and the Chamber commented that the regulatory exceptions to preliminary reinstatement should be broadened. They further commented that preliminary reinstatement should become effective only after the administrative adjudication has been completed, to which SHRM added that preliminary reinstatement is unnecessary because Sarbanes–Oxley’s make-whole remedies are sufficient to protect whistleblowers. The statute, however, explicitly provides that a preliminary order of reinstatement shall be issued

The Sarbanes–Oxley Act

Where the named person establishes that the complainant would have been discharged even absent the protected activity, there would be no reasonable cause to believe that a violation has occurred. Therefore, a preliminary reinstatement order would not be issued. Furthermore, as under AIR21, a preliminary order of reinstatement would not be an appropriate remedy where, for example, the named person establishes that the complainant is, or has become, a security risk based upon information obtained after the complainant’s discharge in violation of Sarbanes–Oxley. See McKennon v. Nashville Banner Publishing Co., 513 U.S. 352, 360–62 (1995) (reinstatement would not be an appropriate remedy for discrimination under the Age Discrimination in Employment Act where, based upon after-acquired evidence, the employer would have terminated the employee upon lawful grounds). Finally, in appropriate circumstances, in lieu of preliminary reinstatement, OSHA may order that the complainant receive the same pay and benefits that he received prior to his termination, but not actually return to work. Such “economic reinstatement” frequently is employed in cases arising under section 105(c) of the Federal Mine Safety and Health Act of 1977. See, e.g., Secretary of Labor on behalf of York v. BR&D Enters., Inc., 23 FMSHRC 697, 2001 WL 1806020 ∗ ∗ 1 (June 26, 2001).

173

The Sarbanes–Oxley Act

upon the conclusion of an investigation that determines that there is reasonable cause to believe that a violation has occurred. See 18 U.S.C. 1514A(b), adopting 49 U.S.C. 42121(b)(2). Moreover, the purpose of interim relief, to provide a meritorious complainant with a speedy remedy and avoid a chill on whistleblowing activity, would be frustrated if reinstatement did not become effective until after the administrative adjudication was completed. The named person’s due process rights will have been fully satisfied under § 1980.104(e). That section provides that the named person will be notified of the substance of the evidence OSHA has gathered against it establishing reasonable cause to believe that a violation has occurred and gives the named person an opportunity to respond.

 174

The Chamber objected to the use of the “security risk” language in the regulations because it is not defined. In this regard, the Chamber noted that a security risk could mean security of trade secrets or security of persons or property. Thus, the Chamber suggested that the regulations should define more explicitly what constitutes a security risk or should allow the employer to determine whether an employee presents a security risk. The Chamber also commented that preliminary reinstatement should be limited to those situations where company disruption would be minimal and the evidence of violation is overwhelming. GAP also objected to this section’s “security risk” exception to preliminary reinstatement on several grounds. Specifically, GAP commented that there is no foundation for the exception in the statute or the APA, that the standard for what constitutes a “security risk” is vague, that the regulation gives OSHA unlimited discretion to cancel interim relief, and that it has a chilling effect by permitting after-thefact investigations and the potential to create additional retaliation. GAP added that the “security risk” exception is unnecessary because if an employee were a genuine security risk, the employer would have had grounds for the action that it took in the first instance. The “security risk” exception was first introduced in OSHA’s final rule for the handling of whistleblower complaints under AIR21. The provision, which was adopted in response to the events of September 11, 2001, was designed to address situations where after-acquired evidence establishes that an employee’s reinstatement might pose a significant safety risk to the public, notwithstanding the fact that the employee’s discharge was retaliatory in violation of the Act. We have

chosen to keep the “security risk” exception here in large part to make these procedural rules consistent with AIR21’s procedural rules. The exception is not intended to be broadly construed. Rather, it would apply only in situations where the named person clearly establishes to the Department that the reinstatement of an employee might result in physical violence against persons or property. Accordingly, the “security risk” language in this section should not have a chilling effect on potential whistleblowers or encourage further retaliation.

Section 1980.106 Objections To the Findings and the Preliminary Order To be effective, objections to the findings of the Assistant Secretary must be in writing and must be filed with the Chief Administrative



Congress intended that employees be temporarily reinstated to their positions if OSHA finds reasonable cause that they were discharged in violation of Sarbanes–Oxley. When a violation is found, the norm is for OSHA to order immediate reinstatement. An employer does not have a statutory right to choose economic reinstatement. Rather, economic reinstatement is designed to accommodate an employer that establishes to OSHA’s satisfaction that reinstatement is inadvisable for some reason, notwithstanding the employer’s retaliatory discharge of the employee. If the employer can make such a showing, actual reinstatement might be delayed until after the administrative adjudication is completed as long as the employee continues to receive his or her pay and benefits and is not otherwise disadvantaged by a delay in reinstatement. The employer, of course, need not request the option of economic reinstatement in lieu of actual reinstatement, but if it does, there is no statutory basis for allowing the employer to recover the costs of economically reinstating an employee should the employer ultimately prevail in the whistleblower adjudication.

The Sarbanes–Oxley Act

Both SHRM and the Chamber commented that permitting “economic reinstatement” in lieu of actual reinstatement would require an employer to pay twice for the same position and would work an economic hardship on small businesses. They commented that the regulations should provide for the reimbursement of the costs of the “economic reinstatement” should the named person ultimately prevail in the litigation. Finally, the Chamber questioned whether the concept of “economic reinstatement” belongs in the context of a Sarbanes–Oxley case.

175

The Sarbanes–Oxley Act

Law Judge, U.S. Department of Labor, Washington, DC, within 30 days of receipt of the findings. The date of the postmark, facsimile transmittal or e-mail communication is considered the date of the filing; if the filing of objections is made in person, by hand-delivery or other means, the date of receipt is considered the date of the filing. The filing of objections is also considered a request for a hearing before an ALJ. No comments were received on this section.

 176

Section 1980.106(b)(1) of this rule has been clarified to provide that although the portion of the preliminary order requiring reinstatement will be effective immediately upon the named person’s receipt of the findings and preliminary order, regardless of any objections to the order, the named person may file a motion with the Office of Administrative Law Judges for a stay of the Assistant Secretary’s preliminary order. In making this change, OSHA conforms this rule to the recently promulgated interim final rule for the handling of whistleblower complaints under the Pipeline Safety Improvement Act of 2002 (“PSIA”). See 29 CFR 1981.106(b)(1). PSIA’s legislative history indicates that Congress intended to assure that the mere filing of an objection would not automatically stay the preliminary order, but that an employer could file a motion for a stay. See 148 Cong. Rec. S11068 (Nov. 14, 2002) (section-by-section analysis). OSHA believes it would be useful for this rule to contain a similar provision. OSHA believes, however, that a stay of a preliminary reinstatement order would be appropriate only in the exceptional case. In other words, a stay only would be granted where the named person can establish the necessary criteria for equitable injunctive relief, i.e., irreparable injury, likelihood of success on the merits, and a balancing of possible harms to the parties and the public. Section 1980.107 Hearings This section adopts the rules of practice of the Office of Administrative Law Judges at 29 CFR part 18, subpart A. In order to assist in obtaining full development of the facts in whistleblower proceedings, formal rules of evidence do not apply. The section specifically provides for consolidation of hearings if both the complainant and the named person object to the findings and/or order of the Assistant Secretary. In order for hearings to be conducted as expeditiously as possible, and particularly in light of the unique provision in Sarbanes–Oxley allowing complainants to seek a de novo hearing in Federal court if the Secretary has not issued a final decision within

180 days of the filing of the complaint, this section provides that the ALJ has broad authority to limit discovery. For example, an ALJ may limit the number of interrogatories, requests for production of documents, or depositions allowed. An ALJ also may exercise discretion to limit discovery unless the complainant agrees to delay filing a complaint in Federal court for some definite period of time beyond the 180-day point. If a complainant seeks excessive or burdensome discovery or fails to adhere to an agreement to delay filing a complaint in federal court, a district court considering a request for de novo review might conclude that such conduct resulted in delay due to the claimant’s bad faith.

An ALJ also may exercise discretion to limit discovery unless the complainant agrees to delay filing a complaint in federal court for some definite period of time beyond the 180-day point. If a complainant seeks excessive or burdensome discovery or fails to adhere to an agreement to delay filing a complaint in federal court, a district court considering a request for de novo review might conclude that such conduct resulted in delay due to the claimant’s bad faith. GAP commented that OSHA has no legitimate interest in attempting to preclude complainants from exercising their right to go to district court and that exercising such a right cannot be considered “bad faith.”



In the same vein, GAP objected to the following statement in the preamble of the interim final rule:

The Sarbanes–Oxley Act

GAP commented that the last sentence of § 1980.107(b), which provides ALJs with broad discretion to limit discovery to expedite hearings, should be deleted because a full and fair representation by the parties is crucial to protecting employees, discovery is a basic due process requirement, and OSHA has no justifiable interest in expediting whistleblower litigation at the expense of full and fair discovery. In this regard, GAP commented that a lack of discovery injures the complainant and not the employer, which maintains the documents and controls the access to company witnesses. GAP further commented that this section is redundant, because the ALJs already possess sufficient authority to limit discovery under 29 CFR 18.15 and the Federal Rules of Civil Procedure. Thus, GAP stated that OSHA instead should consider a regulation that formalizes Federal Rules of Civil Procedures 26(a)(1), setting forth pre-discovery disclosure requirements.

177

The Sarbanes–Oxley Act

 178

OSHA does not believe any changes to this section are necessary. The provisions and statements to which GAP objects are merely intended by OSHA to implement Congress’s command that administrative whistleblower hearings under Sarbanes–Oxley “shall be conducted expeditiously.” See 18 U.S.C. 1514A(b)(2), incorporating 49 U.S.C. 42121(b)(2)(A). Indeed, as GAP’s comments recognize, ALJs already have authority under their procedural rules at 29 CFR part 18 to limit discovery in appropriate circumstances. It is not OSHA’s intent to prevent complainants from exercising their right to go to Federal court or to equate the desire to conduct reasonable discovery with bad faith. To the contrary, OSHA acknowledges that Congress essentially has adopted an alternate – administrative or Federal district court – hearing scheme. Thus, in these regulations, OSHA is attempting to modulate the wasteful consequences of potential duplicative whistleblower litigation, while implementing Congress’s command for an expedited administrative whistleblower process.

Section 1980.108 Role of Federal Agencies The ERA and STAA regulations provide two different models for agency participation in administrative proceedings. Under STAA, OSHA ordinarily prosecutes cases where a complaint has been found to be meritorious. Under ERA and the other environmental whistleblower statutes, on the other hand, OSHA does not ordinarily appear as a party in the proceeding. The Department has found that in most environmental whistleblower cases, parties have been ably represented and the public interest has not required OSHA’s participation. The Department believes this is even more likely to be the situation in cases involving allegations of corporate fraud. Therefore, as in the AIR21 regulations, this provision utilizes the approach of the ERA regulation at 29 CFR 24.6(f)(1). The Assistant Secretary, at his or her discretion, may participate as a party or amicus curiae at any time in the administrative proceedings. For example, the Assistant Secretary may exercise his or her discretion to prosecute the case in the administrative proceeding before an administrative law judge; petition for review of a decision of an administrative law judge, including a decision based on a settlement agreement between complainant and the named person, regardless of whether the Assistant Secretary participated before the ALJ; or participate as amicus curiae before the ALJ or in the Administrative Review Board proceeding. Although we anticipate that ordinarily the Assistant Secretary will not participate

in Sarbanes–Oxley proceedings, the Assistant Secretary may choose to do so in appropriate cases, such as cases involving important or novel legal issues, large numbers of employees, alleged violations which appear egregious, or where the interests of justice might require participation by the Assistant Secretary. The Securities and Exchange Commission, at that agency’s discretion, also may participate as amicus curiae at any time in the proceedings. OSHA does not believe that its decision ordinarily not to prosecute meritorious Sarbanes–Oxley cases will discourage employees from making complaints about corporate fraud.

This section sets forth the content of the decision and order of the administrative law judge, and includes the statutory standard for finding a violation. The section further provides that the Assistant Secretary’s determination as to whether to dismiss the complaint without an investigation or conduct an investigation pursuant to § 1980.104 is not subject to review by the ALJ, who hears the case on the merits. Only one comment was received on this section. GAP commented that the word “legitimately” should be added to § 1980.109(a) to ensure that ALJs only consider legitimate proffers from named persons in defense of their adverse action. As iterated in the discussion



Section 1980.109 Decision of the Administrative Law Judge

The Sarbanes–Oxley Act

Three comments were received regarding § 1980.108(a)(1). Both SHRM and the Chamber commented that the Assistant Secretary should not ordinarily participate in any Sarbanes–Oxley whistleblower case even as amicus and that the Department should have no role other than to investigate, adjudicate, and enforce the orders that are issued. GAP agreed with OSHA that it should not adopt the STAA model, but rather should adopt the ERA and AIR21 approach under which OSHA participates only in appropriate cases as noted above. As the agency responsible for administering Sarbanes–Oxley whistleblower cases, OSHA believes that the Assistant Secretary must maintain and exercise his authority to participate in appropriate cases either as a party or as amicus curiae at any time and at any stage in the administrative proceeding. By the same token, experience under Sarbanes–Oxley and the environmental whistleblower laws does not suggest that OSHA’s participation, as a routine matter, is necessary. Accordingly, in consideration of all of the comments received, OSHA has determined to leave the language of this rule as written.

179

to GAP’s similar comment regarding § 1980.104(c), OSHA does not believe that the word “legitimately” adds anything to the rule. The Department’s ALJs are experienced whistleblower adjudicators; as such they only entertain credible proffers from named persons.

The Sarbanes–Oxley Act

Section 1980.110 Decision of the Administrative Review Board

 180

The decision of the ALJ is the final decision of the Secretary unless a timely petition for review is filed with the Administrative Review Board. Appeals to the Board are not a matter of right, but rather petitions for review are accepted at the discretion of the Board. Upon the issuance of the ALJ’s decision, the parties have 10 business days within which to petition the Board for review of that decision. The parties must specifically identify the findings and conclusions to which they take exception, or the exceptions are deemed waived by the parties. The Board has 30 days to decide whether to grant the petition for review. If the Board does not grant the petition, the decision of the ALJ becomes the final decision of the Secretary. If the Board grants the petition, the Act requires the Board to issue a decision not later than 120 days after the date of the conclusion of the hearing before the ALJ. The conclusion of the hearing is deemed to be the conclusion of all proceedings before the administrative law judge – i.e., 10 days after the date of the decision of the administrative law judge unless a motion for reconsideration has been filed in the interim. If a timely petition for review is filed with the Board, any relief ordered by the ALJ, except for a preliminary order of reinstatement, is inoperative while the matter is pending before the Board. This section further provides that, when the Board accepts a petition for review, its review of factual determinations will be conducted under the substantial evidence standard. This standard also is applied to Board review of ALJ decisions under the whistleblower provisions of STAA and AIR21. See 29 CFR 1978.109(b)(3) and 29 CFR 1979.110(b). As with § 1980.106(b)(1), § 1980.110(b) of this rule has been changed to provide that in the exceptional case, the Board may grant a motion to stay a preliminary order of reinstatement that otherwise will be effective while review is conducted by the Board. As explained above, however, OSHA believes that a stay of a preliminary reinstatement order would only be appropriate where the named person can establish the necessary criteria for equitable injunctive relief, i.e., irreparable injury, likelihood of success on the merits, and a balancing of possible harms to the parties and the public.

OSHA received only one comment on this section. GAP commented that the time frame for submitting a petition for review to the Board is unreasonably short and that it should be changed to allow a party 20 business days in which to file a petition. OSHA believes that 10 business days, which also is the time frame under AIR21 (see 29 CFR 1979.110(a)), is sufficient time to petition for review of an ALJ decision, particularly in light of the fact that the rule uses the date of filing to determine timeliness rather than the date of the Board’s receipt of the petition. Section 1980.111 Withdrawal of Complaints, Objections, and Findings; Settlement

This section describes the statutory provisions for judicial review of decisions of the Secretary and requires, in cases where judicial review is sought, the Administrative Review Board to submit the record of proceedings to the appropriate court pursuant to the rules of such court. No comments were received on this section. Section 1980.113 Judicial Enforcement This section describes the Secretary’s power under the statute to obtain judicial enforcement of orders and the terms of a settlement agreement. It also provides for enforcement of orders of the Secretary by the person on whose behalf the order was issued. No comments were received on this section. Section 1980.114 District Court Jurisdiction of Discrimination Complaints This section sets forth the Sarbanes–Oxley provision allowing complainants to bring an action in district court for de novo review if there has been no final decision of the Secretary within 180 days of the filing of the complaint and there is no delay due to the



Section 1980.112 Judicial Review

The Sarbanes–Oxley Act

This section provides for the procedures and time periods for withdrawal of complaints, the withdrawal of findings by the Assistant Secretary, and the withdrawal of objections to findings. It also provides for approval of settlements at the investigative and adjudicative stages of the case. No comments were received on this section.

181

The Sarbanes–Oxley Act

 182

complainant’s bad faith. It provides that complainants will provide notice 15 days in advance of their intent to file a Federal court complaint. This provision authorizing a Federal court complaint is unique among the whistleblower statutes administered by the Secretary. This statutory structure creates the possibility that a complainant will have litigated a claim before the agency, will receive a decision from an administrative law judge, and will then file a complaint in Federal court while the case is pending on review by the Board. The Act might even be interpreted to allow a complainant to bring an action in Federal court after receiving a final decision from the Board, if that decision was issued more than 180 days after the filing of the complaint. The Secretary believes that it would be a waste of the resources of the parties, the Department, and the courts for complainants to pursue duplicative litigation. The Secretary notes that the courts have recognized that, when a party has had a full and fair opportunity to litigate a claim, an adversary should be protected from the expense and vexation of multiple lawsuits and that the public interest is served by preserving judicial resources by prohibiting subsequent suits involving the same parties making the same claims. See Montana v. United States, 440 U.S. 147, 153 (1979). When an administrative agency acts in a judicial capacity and resolves disputed issues of fact properly before it that the parties have had an adequate opportunity to litigate, the courts have not hesitated to apply the principles of issue preclusion (collateral estoppel) or claim preclusion (res judicata) on the basis of that administrative decision. See University of Tennessee v. Elliott, 478 U.S. 788, 799 (1986) (citing United States v. Utah Construction and Mining Co., 384 U.S. 394, 422 (1966)). Therefore, the Secretary anticipates that Federal courts will apply such principles if a complainant brings a new action in Federal court following extensive litigation before the Department that has resulted in a decision by an administrative law judge or the Secretary. Where an administrative hearing has been completed and a matter is pending before an administrative law judge or the Board for a decision, a Federal court also might treat a complaint as a petition for mandamus and order the Department to issue a decision under appropriate time frames. Both SHRM and the Chamber submitted comments on this section. SHRM commented that because Sarbanes–Oxley permits a complainant to bring a de novo action in district court if the Secretary

has not issued a final decision within 180 days after the filing of the complaint, the regulations should specifically incorporate preclusion principles to protect employers from having to defend multiple law suits. Both SHRM and the Chamber commented that the regulations should provide that once a complainant elects to go to district court, the Department’s administrative procedure should cease and further commented that a complainant’s decision to end his or her administrative adjudication should be a prerequisite to going to Federal court. Finally, they commented that the regulations should provide that a decision by a complainant to go to district court after having sought either an ALJ hearing or ARB review of an ALJ decision should constitute a presumption of bad faith.

This section provides that in circumstances not contemplated by these rules or for good cause the Secretary may, upon application and notice to the parties, waive any rule as justice or the administration of the Act requires. GAP commented that this section should be omitted because it is ambiguous and contains no standards for application. GAP also



Section 1980.115 Special Circumstances; Waiver of Rules

The Sarbanes–Oxley Act

There is no statutory basis for including preclusion principles in these regulations, nor does the statute delegate authority to the Secretary to regulate litigation in the Federal district courts. See Adams Fruit Co., Inc. v. Barrett, 494 U.S. 638, 649–50 (1990). Similarly, no legislative history suggests that Congress intended to require that complainants end their administrative proceedings prior to seeking relief in Federal court. In any event, our experience to date under Sarbanes–Oxley is that complainants who choose to file in district court generally do so before the ALJ conducts the administrative hearing. Our experience also is that after the complainant files in district court, the ALJs dismiss any pending administrative hearing requests by such complainants, often in response to a complainant’s motion to withdraw. Certainly, nothing in the statute or legislative history suggests that a complainant’s decision to seek de novo relief in Federal court after requesting either an ALJ hearing on OSHA’s findings or ARB review of an ALJ’s decision should constitute a presumption of bad faith delay. Accordingly, OSHA does not believe that changes to this section are appropriate.

183

The Sarbanes–Oxley Act

 184

commented that the section is redundant because 29 CFR 18.29 already provides ALJs with the necessary powers to conduct fair and impartial hearings. OSHA believes that because these procedural rules cannot cover every conceivable contingency, there may be occasions when certain exceptions to the rules are necessary. Furthermore, this section is not redundant by virtue of 29 CFR 18.29, because that regulatory provision applies only to the ALJs. Also, unlike 29 CFR 18.29, this section requires that the parties be notified at least three days before the ALJ or the Board waives any rule or issues any special order. Indeed, OSHA notes that a similar section appears in the regulations for handling complaints filed under the whistleblower provisions of STAA and AIR21 and that both the ALJs and the Board have relied upon the rule on occasion. See, e.g., Caimano v. Brink’s, Inc., No. 97-041, 1997 WL 24368 ∗ 2 (Adm. Rev. Bd. Jan. 22, 1997). V. Paperwork Reduction Act This rule contains a reporting requirement (§ 1980.103) which was previously reviewed and approved for use by the Office of Management and Budget (“OMB”) under 29 CFR 24.3 and assigned OMB control number 1218-0236 under the provisions of the Paperwork Reduction Act of 1995 (Pub. L. 104–13). VI. Administrative Procedure Act This is a rule of agency procedure and practice within the meaning of section 553 of the Administrative Procedure Act (“APA”), 5 U.S.C. 553(b)(A). Therefore, publication in the Federal Register of a notice of proposed rulemaking and request for comments was not required for these regulations, which provide procedures for the handling of discrimination complaints. The Assistant Secretary, however, sought and considered comments to enable the agency to improve the rules by taking into account the concerns of interested persons. Furthermore, because this rule is procedural rather than substantive, the normal requirement of 5 U.S.C. 553(d) that a rule be effective 30 days after publication in the Federal Register is inapplicable. The Assistant Secretary also finds good cause to provide an immediate effective date for this rule. It is in the public interest that the rule be effective immediately so that parties may know what procedures are applicable to pending cases.

VII. Executive Order 12866; Unfunded Mandates Reform Act of 1995; Small Business Regulatory Enforcement Fairness Act of 1996; Executive Order 13132

The Department has determined that the regulation will not have a significant economic impact on a substantial number of small entities. The regulation simply implements procedures necessitated by enactment of Sarbanes–Oxley, in order to allow resolution of whistleblower complaints. Furthermore, no certification to this effect is required and no regulatory flexibility analysis is required because no proposed rule has been issued. Document Preparation: This document was prepared under the direction and control of the Assistant Secretary, Occupational Safety and Health Administration, U.S. Department of Labor.



VIII. Regulatory Flexibility Analysis

The Sarbanes–Oxley Act

The Department has concluded that this rule should be treated as a “significant regulatory action” within the meaning of section 3(f)(4) of Executive Order 12866 because Sarbanes–Oxley is a new program and because of the importance to investors that “whistleblowers” be protected from retaliation. E.O. 12866 requires a full economic impact analysis only for “economically significant” rules, which are defined in section 3(f)(1) as rules that may “have an annual effect on the economy of $100 million or more, or adversely affect in a material way the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities.” Because the rule is procedural in nature, it is not expected to have a significant economic impact; therefore no economic impact analysis has been prepared. For the same reason, the rule does not require a section 202 statement under the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1531 et seq.). Furthermore, because this is a rule of agency procedure or practice, it is not a “rule” within the meaning of the Small Business Regulatory Enforcement Fairness Act of 1996 (5 U.S.C. 801 et seq.), and does not require Congressional review. Finally, this rule does not have “federalism implications.” The rule does not have “substantial direct effects on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government” and therefore is not subject to Executive Order 13132 (Federalism).

185

List of Subjects in 29 CFR Part 1980 Administrative practice and procedure, Corporate fraud, Employment, Investigations, Reporting and Recordkeeping requirements, Whistleblowing. Signed in Washington, DC, this 17th day of August, 2004. John L. Henshaw,

The Sarbanes–Oxley Act

Assistant Secretary for Occupational Safety and Health.

 186

 Accordingly, for the reasons set out in the preamble part 1980 of title 29 of the Code of Federal Regulations is revised to read as follows:

PART 1980—PROCEDURES FOR THE HANDLING OF DISCRIMINATION COMPLAINTS UNDER SECTION 806 OF THE CORPORATE AND CRIMINAL FRAUD ACCOUNTABILITY ACT OF 2002, TITLE VIII OF THE SARBANES–OXLEY ACT OF 2002 Subpart A—Complaints, Investigations, Findings and Preliminary Orders Sec. 1980.100 1980.101 1980.102 1980.103 1980.104 1980.105

Purpose and scope Definitions Obligations and prohibited acts Filing of discrimination complaint Investigation Issuance of findings and preliminary orders

Subpart B—Litigation 1980.106 Objections to the findings and the preliminary order and request for a hearing. 1980.107 Hearings. 1980.108 Role of Federal agencies. 1980.109 Decision and orders of the administrative law judge. 1980.110 Decision and orders of the Administrative Review Board.

Subpart C—Miscellaneous Provisions 1980.111 Withdrawal of complaints, objections, and findings; settlement. 1980.112 Judicial review. 1980.113 Judicial enforcement. 1980.114 District Court jurisdiction of discrimination complaints. 1980.115 Special circumstances; waiver of rules. Authority: 18 U.S.C. 1514A; Secretary of Labor’s Order No. 5-2002, 67 FR 65008 (October 22, 2002).

§ 1980.100 Purpose and scope

§ 1980.101 Definitions Act means section 806 of the Corporate and Criminal Fraud Accountability Act of 2002, Title VIII of the Sarbanes–Oxley Act of 2002, Public Law No.107–204, July 30, 2002, codified at 18 U.S.C. 1514A.



(a) This part implements procedures under section 806 of the Corporate and Criminal Fraud Accountability Act of 2002, Title VIII of the Sarbanes–Oxley Act of 2002 (“Sarbanes–Oxley” or “Act”), enacted into law July 30, 2002. Sarbanes–Oxley provides for employee protection from discrimination by companies and representatives of companies because the employee has engaged in protected activity pertaining to a violation or alleged violation of 18 U.S.C. 1341, 1343, 1344, or 1348, or any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders. (b) This part establishes procedures pursuant to Sarbanes–Oxley for the expeditious handling of discrimination complaints made by employees, or by persons acting on their behalf. These rules, together with those rules codified at 29 CFR part 18, set forth the procedures for submission of complaints under Sarbanes–Oxley, investigations, issuance of findings and preliminary orders, objections to findings and orders, litigation before administrative law judges, post-hearing administrative review, and withdrawals and settlements.

The Sarbanes–Oxley Act

Subpart A—Complaints, Investigations, Findings and Preliminary Orders

187

Assistant Secretary means the Assistant Secretary of Labor for Occupational Safety and Health or the person or persons to whom he or she delegates authority under the Act. Company means any company with a class of securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l) and any company required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(d)). Company representative means any officer, employee, contractor, subcontractor, or agent of a company.

The Sarbanes–Oxley Act

Complainant means the employee who filed a complaint under the Act or on whose behalf a complaint was filed.

 188

Employee means an individual presently or formerly working for a company or company representative, an individual applying to work for a company or company representative, or an individual whose employment could be affected by a company or company representative. Named person means the employer and/or the company or company representative named in the complaint who is alleged to have violated the Act. OSHA means the Occupational Safety and Health Administration of the United States Department of Labor. Person means one or more individuals, partnerships, associations, corporations, business trusts, legal representatives or any group of persons. Secretary means the Secretary of Labor or persons to whom authority under the Act has been delegated.

§ 1980.102 Obligations and prohibited acts (a) No company or company representative may discharge, demote, suspend, threaten, harass or in any other manner discriminate against any employee with respect to the employee’s compensation, terms, conditions, or privileges of employment because the employee, or any person acting pursuant to the employee’s request, has engaged in any of the activities specified in paragraphs (b)(1) and (2) of this section.

(b) An employee is protected against discrimination (as described in paragraph (a) of this section) by a company or company representative for any lawful act: (1) To provide information, cause information to be provided, or otherwise assist in an investigation regarding any conduct which the employee reasonably believes constitutes a violation of 18 U.S.C. 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders, when the information or assistance is provided to or the investigation is conducted by –

§ 1980.103 Filing of discrimination complaint (a) Who may file. An employee who believes that he or she has been discriminated against by a company or company representative in violation of the Act may file, or have filed by any person on the employee’s behalf, a complaint alleging such discrimination. (b) Nature of filing. No particular form of complaint is required, except that a complaint must be in writing and should include a full statement of the acts and omissions, with pertinent dates, which are believed to constitute the violations. (c) Place of filing. The complaint should be filed with the OSHA Area Director responsible for enforcement activities in the geographical area where the employee resides or was employed, but may be filed with any OSHA officer or employee. Addresses and telephone numbers for these officials are set forth in local directories and at the following Internet address: http://www.osha.gov.



(2) To file, cause to be filed, testify, participate in, or otherwise assist in a proceeding filed or about to be filed (with any knowledge of the employer) relating to an alleged violation of 18 U.S.C. 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders.

The Sarbanes–Oxley Act

(i) A Federal regulatory or law enforcement agency; (ii) Any Member of Congress or any committee of Congress; or (iii) aA person with supervisory authority over the employee (or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct); or

189

(d) Time for filing. Within 90 days after an alleged violation of the Act occurs (i.e., when the discriminatory decision has been both made and communicated to the complainant), an employee who believes that he or she has been discriminated against in violation of the Act may file, or have filed by any person on the employee’s behalf, a complaint alleging such discrimination. The date of the postmark, facsimile transmittal, or e-mail communication will be considered to be the date of filing; if the complaint is filed in person, by hand-delivery or other means, the complaint is filed upon receipt.

The Sarbanes–Oxley Act

§ 1980.104 Investigation

 190

(a) Upon receipt of a complaint in the investigating office, the Assistant Secretary will notify the named person (or named persons) of the filing of the complaint, of the allegations contained in the complaint, and of the substance of the evidence supporting the complaint (redacted to protect the identity of any confidential informants). The Assistant Secretary also will notify the named person of its right under paragraphs (b) and (c) of this section and paragraph (e) of § 1980.110. A copy of the notice to the named person will also be provided to the Securities and Exchange Commission. (b) A complaint of alleged violation shall be dismissed unless the complainant has made a prima facie showing that protected behavior or conduct was a contributing factor in the unfavorable personnel action alleged in the complaint. (1) The complaint, supplemented as appropriate by interviews of the complainant, must allege the existence of facts and evidence to make a prima facie showing as follows: (i) The employee engaged in a protected activity or conduct; (ii) The named person knew or suspected, actually or constructively, that the employee engaged in the protected activity; (iii) The employee suffered an unfavorable personnel action; and (iv) The circumstances were sufficient to raise the inference that the protected activity was a contributing factor in the unfavorable action.



(c) Notwithstanding a finding that a complainant has made a prima facie showing, as required by this section, an investigation of the complaint shall not be conducted if the named person, pursuant to the procedures provided in this paragraph, demonstrates by clear and convincing evidence that it would have taken the same unfavorable personnel action in the absence of the complainant’s protected behavior or conduct. Within 20 days of receipt of the notice of the filing of the complaint, the named person may submit to the Assistant Secretary a written statement and any affidavits or documents substantiating its position. Within the same 20 days, the named person may request a meeting with the Assistant Secretary to present its position. (d) If the named person fails to demonstrate by clear and convincing evidence that it would have taken the same unfavorable personnel action in the absence of the behavior protected by the Act, the Assistant Secretary will conduct an investigation. Investigations will be conducted in a manner that protects the confidentiality of any person who provides information on a confidential basis, other than the complainant, in accordance with part 70 of this title. (e) Prior to the issuance of findings and a preliminary order as provided for in § 1980.105, if the Assistant Secretary has reasonable cause, on the basis of information gathered under the procedures of this part, to believe that the named person has violated the Act and that preliminary reinstatement is warranted, the Assistant Secretary will again contact the named person to

The Sarbanes–Oxley Act

(2) For purposes of determining whether to investigate, the complainant will be considered to have met the required burden if the complaint on its face, supplemented as appropriate through interviews of the complainant, alleges the existence of facts and either direct or circumstantial evidence to meet the required showing, i.e., to give rise to an inference that the named person knew or suspected that the employee engaged in protected activity and that the protected activity was a contributing factor in the unfavorable personnel action. Normally the burden is satisfied, for example, if the complaint shows that the adverse personnel action took place shortly after the protected activity, giving rise to the inference that it was a factor in the adverse action. If the required showing has not been made, the complainant will be so advised and the investigation will not commence.

191

The Sarbanes–Oxley Act

 192

give notice of the substance of the relevant evidence supporting the complainant’s allegations as developed during the course of the investigation. This evidence includes any witness statements, which will be redacted to protect the identity of confidential informants where statements were given in confidence; if the statements cannot be redacted without revealing the identity of confidential informants, summaries of their contents will be provided. The named person will be given the opportunity to submit a written response, to meet with the investigators to present statements from witnesses in support of its position, and to present legal and factual arguments. The named person will present this evidence within 10 business days of the Assistant Secretary’s notification pursuant to this paragraph, or as soon afterwards as the Assistant Secretary and the named person can agree, if the interests of justice so require. § 1980.105 Issuance of findings and preliminary orders (a) After considering all the relevant information collected during the investigation, the Assistant Secretary shall issue, within 60 days of filing of the complaint, written findings as to whether or not there is reasonable cause to believe that the named person has discriminated against the complainant in violation of the Act. (1) If the Assistant Secretary concludes that there is reasonable cause to believe that a violation has occurred, he or she shall accompany the findings with a preliminary order providing relief to the complainant. The preliminary order shall include all relief necessary to make the employee whole, including, where appropriate: reinstatement with the same seniority status that the employee would have had but for the discrimination; back pay with interest; and compensation for any special damages sustained as a result of the discrimination, including litigation costs, expert witness fees, and reasonable attorney’s fees. Where the named person establishes that the complainant is a security risk (whether or not the information is obtained after the complainant’s discharge), a preliminary order of reinstatement would not be appropriate. (2) If the Assistant Secretary concludes that a violation has not occurred, the Assistant Secretary will notify the parties of that finding.

§ 1980.106 Objections to the findings and the preliminary order and request for a hearing (a) Any party who desires review, including judicial review, of the findings and preliminary order, or a named person alleging that the complaint was frivolous or brought in bad faith who seeks an award of attorney’s fees, must file any objections and/or a request for a hearing on the record within 30 days of receipt of the findings and preliminary order pursuant to paragraph (b) of § 1980.105. The objection or request for attorney’s fees and request for a hearing must be in writing and state whether the objection is to the findings, the preliminary order, and/or whether there should be an award of attorney’s fees. The date of the postmark, facsimile transmittal, or e-mail communication will be considered to be the date of filing; if the objection is filed in person, by hand-delivery or other means, the objection is filed upon receipt. Objections must be filed with the Chief Administrative Law Judge, U.S. Department of Labor, Washington, DC 20001, and copies of the objections must be mailed at the same time to the other parties of record, the OSHA official who issued



Subpart B—Litigation

The Sarbanes–Oxley Act

(b) The findings and the preliminary order will be sent by certified mail, return receipt requested, to all parties of record. The letter accompanying the findings and order will inform the parties of their right to file objections and to request a hearing, and of the right of the named person to request attorney’s fees from the ALJ, regardless of whether the named person has filed objections, if the named person alleges that the complaint was frivolous or brought in bad faith. The letter also will give the address of the Chief Administrative Law Judge. At the same time, the Assistant Secretary will file with the Chief Administrative Law Judge, U.S. Department of Labor, a copy of the original complaint and a copy of the findings and order. (c) The findings and preliminary order will be effective 30 days after receipt by the named person pursuant to paragraph (b) of this section, unless an objection and a request for a hearing has been filed as provided at § 1980.106. However, the portion of any preliminary order requiring reinstatement will be effective immediately upon receipt of the findings and preliminary order.

193

The Sarbanes–Oxley Act

 194

the findings and order, and the Associate Solicitor, Division of Fair Labor Standards, U.S. Department of Labor, Washington, DC 20210. (b) (1) If a timely objection is filed, all provisions of the preliminary order will be stayed, except for the portion requiring preliminary reinstatement, which shall not be automatically stayed. The portion of the preliminary order requiring reinstatement will be effective immediately upon the named person’s receipt of the findings and preliminary order, regardless of any objections to the order. The named person may file a motion with the Office of Administrative Law Judges for a stay of the Assistant Secretary’s preliminary order of reinstatement. (2) If no timely objection is filed with respect to either the findings or the preliminary order, the findings or preliminary order, as the case may be, shall become the final decision of the Secretary, not subject to judicial review.

§ 1980.107 Hearings (a) Except as provided in this part, proceedings will be conducted in accordance with the rules of practice and procedure for administrative hearings before the Office of Administrative Law Judges, codified at subpart A, part 18 of title 29 of the Code of Federal Regulations. (b) Upon receipt of an objection and request for hearing, the Chief Administrative Law Judge will promptly assign the case to a judge who will notify the parties, by certified mail, of the day, time, and place of hearing. The hearing is to commence expeditiously, except upon a showing of good cause or unless otherwise agreed to by the parties. Hearings will be conducted de novo, on the record. Administrative law judges have broad discretion to limit discovery in order to expedite the hearing. (c) If both the complainant and the named person object to the findings and/or order, the objections will be consolidated and a single hearing will be conducted. (d) Formal rules of evidence will not apply, but rules or principles designed to assure production of the most probative evidence will be applied. The administrative law judge may exclude evidence that is immaterial, irrelevant, or unduly repetitious.

§ 1980.108 Role of Federal agencies

(a) The decision of the administrative law judge will contain appropriate findings, conclusions, and an order pertaining to the remedies provided in paragraph (b) of this section, as appropriate. A determination that a violation has occurred may only be made if the complainant has demonstrated that protected behavior or conduct was a contributing factor in the unfavorable personnel action alleged in the complaint. Relief may not be ordered if the named person demonstrates by clear and convincing evidence that it would have taken the same unfavorable personnel action in the absence of any protected behavior. Neither the Assistant Secretary’s determination to dismiss a complaint without completing an investigation pursuant to § 1980.104(b) nor the Assistant Secretary’s determination to proceed with an investigation is subject to review by the administrative law judge, and a complaint may not be remanded for the completion of an



§ 1980.109 Decision and orders of the administrative law judge

The Sarbanes–Oxley Act

(a) (1) The complainant and the named person will be parties in every proceeding. At the Assistant Secretary’s discretion, the Assistant Secretary may participate as a party or as amicus curiae at any time at any stage of the proceedings. This right to participate includes, but is not limited to, the right to petition for review of a decision of an administrative law judge, including a decision approving or rejecting a settlement agreement between the complainant and the named person. (2) Copies of pleadings in all cases, whether or not the Assistant Secretary is participating in the proceeding, must be sent to the Assistant Secretary, Occupational Safety and Health Administration, and to the Associate Solicitor, Division of Fair Labor Standards, U.S. Department of Labor, Washington, DC 20210. (b) The Securities and Exchange Commission may participate as amicus curiae at any time in the proceedings, at the Commission’s discretion. At the request of the Securities and Exchange Commission, copies of all pleadings in a case must be sent to the Commission, whether or not the Commission is participating in the proceeding.

195

The Sarbanes–Oxley Act

 196

investigation or for additional findings on the basis that a determination to dismiss was made in error. Rather, if there otherwise is jurisdiction, the administrative law judge will hear the case on the merits. (b) If the administrative law judge concludes that the party charged has violated the law, the order will provide all relief necessary to make the employee whole, including reinstatement of the complainant to that person’s former position with the seniority status that the complainant would have had but for the discrimination, back pay with interest, and compensation for any special damages sustained as a result of the discrimination, including litigationcosts, expert witness fees, and reasonable attorney’s fees. If, upon the request of the named person, the administrative law judge determines that a complaint was frivolous or was brought in bad faith, the judge may award to the named person a reasonable attorney’s fee, not exceeding $1,000. (c) The decision will be served upon all parties to the proceeding. Any administrative law judge’s decision requiring reinstatement or lifting an order of reinstatement by the Assistant Secretary will be effective immediately upon receipt of the decision by the named person, and will not be stayed. All other portions of the judge’s order will be effective 10 business days after the date of the decision unless a timely petition for review has been filed with the Administrative Review Board.

§ 1980.110 Decision and orders of the Administrative Review Board (a) Any party desiring to seek review, including judicial review, of a decision of the administrative law judge, or a named person alleging that the complaint was frivolous or brought in bad faith who seeks an award of attorney’s fees, must file a written petition for review with the Administrative Review Board (“the Board”), which has been delegated the authority to act for the Secretary and issue final decisions under this part. The decision of the administrative law judge will become the final order of the Secretary unless, pursuant to this section, a petition for review is timely filed with the Board. The petition for review must specifically identify the findings, conclusions or orders to which exception is taken. Any exception not specifically urged ordinarily will be deemed to have been waived by the parties.

The Sarbanes–Oxley Act



To be effective, a petition must be filed within 10 business days of the date of the decision of the administrative law judge. The date of the postmark, facsimile transmittal, or e-mail communication will be considered to be the date of filing; if the petition is filed in person, by hand-delivery or other means, the petition is considered filed upon receipt. The petition must be served on all parties and on the Chief Administrative Law Judge at the time it is filed with the Board. Copies of the petition for review and all briefs must be served on the Assistant Secretary, Occupational Safety and Health Administration, and on the Associate Solicitor, Division of Fair Labor Standards, U.S. Department of Labor, Washington, DC 20210. (b) If a timely petition for review is filed pursuant to paragraph (a) of this section, the decision of the administrative law judge will become the final order of the Secretary unless the Board, within 30 days of the filing of the petition, issues an order notifying the parties that the case has been accepted for review. If a case is accepted for review, the decision of the administrative law judge will be inoperative unless and until the Board issues an order adopting the decision, except that a preliminary order of reinstatement will be effective while review is conducted by the Board, unless the Board grants a motion to stay the order. The Board will specify the terms under which any briefs are to be filed. The Board will review the factual determinations of the administrative law judge under the substantial evidence standard. (c) The final decision of the Board shall be issued within 120 days of the conclusion of the hearing, which will be deemed to be the conclusion of all proceedings before the administrative law judge – i.e., 10 business days after the date of the decision of the administrative law judge unless a motion for reconsideration has been filed with the administrative law judge in the interim. The decision will be served upon all parties and the Chief Administrative Law Judge by mail to the last known address. The final decision will also be served on the Assistant Secretary, Occupational Safety and Health Administration, and on the Associate Solicitor, Division of Fair Labor Standards, U.S. Department of Labor, Washington, DC 20210, even if the Assistant Secretary is not a party. (d) If the Board concludes that the party charged has violated the law, the final order will order the party charged to provide all

197

The Sarbanes–Oxley Act

relief necessary to make the employee whole, including reinstatement of the complainant to that person’s former position with the seniority status that the complainant would have had but for the discrimination, back pay with interest, and compensation for any special damages sustained as a result of the discrimination, including litigation costs, expert witness fees, and reasonable attorney’s fees. (e) If the Board determines that the named person has not violated the law, an order will be issued denying the complaint. If, upon the request of the named person, the Board determines that a complaint was frivolous or was brought in bad faith, the Board may award to the named person a reasonable attorney’s fee, not exceeding $1,000.

 198

Subpart C—Miscellaneous Provisions § 1980.111 Withdrawal of complaints, objections, and findings; settlement (a) At any time prior to the filing of objections to the findings or preliminary order, a complainant may withdraw his or her complaint under the Act by filing a written withdrawal with the Assistant Secretary. The Assistant Secretary will then determine whether to approve the withdrawal. The Assistant Secretary will notify the named person of the approval of any withdrawal. If the complaint is withdrawn because of settlement, the settlement will be approved in accordance with paragraph (d) of this section. (b) The Assistant Secretary may withdraw his or her findings or a preliminary order at any time before the expiration of the 30-day objection period described in § 1980.106, provided that no objection has yet been filed, and substitute new findings or preliminary order. The date of the receipt of the substituted findings or order will begin a new 30-day objection period. (c) At any time before the findings or order become final, a party may withdraw his or her objections to the findings or order by filing a written withdrawal with the administrative law judge or, if the case is on review, with the Board. The judge or the Board, as the case may be, will determine whether to approve the withdrawal. If the objections are withdrawn because of settlement, the settlement will be approved in accordance with paragraph (d) of this section.

§ 1980.112 Judicial review

§ 1980.113 Judicial enforcement Whenever any person has failed to comply with a preliminary order of reinstatement or a final order or the terms of a settlement agreement, the Secretary or a person on whose behalf the order was issued may file a civil action seeking enforcement of the order in the United States district court for the district in which the violation was found to have occurred.



(a) Within 60 days after the issuance of a final order by the Board (Secretary) under § 1980.110, any person adversely affected or aggrieved by the order may file a petition for review of the order in the United States Court of Appeals for the circuit in which the violation allegedly occurred or the circuit in which the complainant resided on the date of the violation. A final order of the Board is not subject to judicial review in any criminal or other civil proceeding. (b) If a timely petition for review is filed, the record of a case, including the record of proceedings before the administrative law judge, will be transmitted by the Board to the appropriate court pursuant to the rules of the court.

The Sarbanes–Oxley Act

(d) (1) Investigative settlements. At any time after the filing of a complaint, and before the findings and/or order are objected to or become a final order by operation of law, the case may be settled if the Assistant Secretary, the complainant and the named person agree to a settlement. (2) Adjudicatory settlements. At any time after the filing of objections to the Assistant Secretary’s findings and/or order, the case may be settled if the participating parties agree to a settlement and the settlement is approved by the administrative law judge if the case is before the judge, or by the Board if a timely petition for review has been filed with the Board. A copy of the settlement will be filed with the administrative law judge or the Board, as the case may be. (e) Any settlement approved by the Assistant Secretary, the administrative law judge, or the Board, will constitute the final order of the Secretary and may be enforced pursuant to § 1980.113.

199

The Sarbanes–Oxley Act

§ 1980.114 District Court jurisdiction of discrimination complaints (a) If the Board has not issued a final decision within 180 days of the filing of the complaint, and there is no showing that there has been delay due to the bad faith of the complainant, the complainant may bring an action at law or equity for de novo review in the appropriate district court of the United States, which will have jurisdiction over such an action without regard to the amount in controversy. (b) Fifteen days in advance of filing a complaint in federal court, a complainant must file with the administrative law judge or the Board, depending upon where the proceeding is pending, a notice of his or her intention to file such a complaint. The notice must be served upon all parties to the proceeding. If the Assistant Secretary is not a party, a copy of the notice must be served on the Assistant Secretary, Occupational Safety and Health Administration, and on the Associate Solicitor, Division of Fair Labor Standards, U.S. Department of Labor, Washington, DC 20210.

 200

§ 1980.115 Special circumstances; waiver of rules In special circumstances not contemplated by the provisions of this part, or for good cause shown, the administrative law judge or the Board on review may, upon application, after three days notice to all parties and interveners, waive any rule or issue any orders that justice or the administration of the Act requires.

D Appendix D – A Typical Code of Ethics

This page intentionally left blank

Code of Ethics I;

(name)

(position) will:

Embody and enforce this Code of Ethics. Ensure that this Code of Ethics is communicated at least annually throughout all financial departments. Formally and promptly communicate any breach of this Code of Ethics to the Senior Vice President and General Counsel. Act at all times with honesty, integrity and independence, avoiding actual or apparent conflicts of interest in personal and professional relationships.

Comply with all applicable rules and regulations of federal, state, provincial and local governments, the Securities and Exchange Commission, the New York Stock Exchange and other exchanges on which the Company’s stock is listed, and other appropriate private and public regulatory agencies. Comply with the Company’s policies and procedures. Act in good faith, responsibly, with due care, competence, diligence, and without knowingly misrepresenting material facts or allowing my better judgment to be subordinated. Protect and respect the confidentiality of information acquired in the course of my work except when authorized or otherwise legally obligated to disclose. Confidential information acquired in the course of my work will not be used for personal advantage. Be recognized as a responsible partner among my peers.



Provide full, fair, accurate, complete, objective, timely and understandable financial disclosures in internal reports as well as documents filed or submitted to the Securities and Exchange Commission, any other government agency or self-regulatory organization, or used in public communications.

The Sarbanes–Oxley Act

Discuss with the appropriate Senior Management level, or, in the case of the Chief Executive Officer, with the Senior Vice President and General Counsel, in advance any transaction that reasonably could be expected to give rise to a conflict of interest.

203

Responsibly use and control assets and other resources employed or entrusted to my supervision. Signature:

The Sarbanes–Oxley Act

Date:

 204

Notes

This page intentionally left blank

1 The White House, Press Release 30 July 2002. 2 Committee of Sponsoring Organizations of the Treadway Commission (COSO). Internal Control—Integrated Framework Evaluation Tools September 1992. 3 The Sarbanes–Oxley Act, Overview and Implementation Procedures by Michael F. Holt ISBN 0 7506 6823 7, publisher CIMA Publications, an imprint of Elsevier Press. 4 http://www.foley.com/files/tbl_s31Publications/FileUpload 137/3511/ndi%202006%20private%20study.pdf 5 Covington & Burling Attorneys, Newsletter, 3 August 2004. 6 www.oalj.dol.gov/public/wblower/decsn/03sox15c

The Sarbanes–Oxley Act

 207

This page intentionally left blank

Index

This page intentionally left blank

Abridged SOX Act section 1, 89–92 section 2, 92–7 section 3, 97–8 title I, 99–102 title II, 103–108 title III, 109–117 title IV, 118–122 title IX, 138–40 title V, 123 title VI, 124–6 title VII, 127–31 title VIII, 132–7 title X, 141 title XI, 142–5 Accountants/auditors and SOX Act framework for Internal Control Systems, 43 liability caps, 44 Administrative Procedure Act, 184 Alternative Investment Market, 48 American Corporations, 3 American Institute of Chartered Public Accountants (AICPA), 43 Arthur Anderson, 44, 70 Audit Tools, of Global Relay, 18–19

Collins v. Beazer Homes USA Inc., 60–2 Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, 7 Compliance Reviewer, Global Relay’s monitoring system, 17–18 Control activities, of a company, 8 Control environment, of a company, 7 Corporate scandals, 4 Credit Rating Agency Reform Act of 2006, 33–9

Board independence requirements, for non-US companies board representation of controlling shareholders, 49 board representation of foreign government shareholders, 49 employee representation on audit committees, 48–9 shareholder selection, approval or ratification of auditors, 48 statutory oversight of auditors, 49 Business-judgment rule, 29

Global Crossing, 4, 33, 36–8 Global Relay’s solutions, for SOX Act audits, 18–21 internal controls and supervision, 17–18 recordkeeping, 16–17 Grassley, Charles, 54

Canadian Securities Administrators Notice 52–313, 49 Code of ethics, 203–204

Illinois Supreme Court, 3 Incentive compensation plans, 4 Internal Control over Financial Reporting (ICFR), 43

Donaldson, William, 54

Higher Education Act of 1965, 36 Housing and Community Development Act of 1992, 36 H.R. 1257, 6



15th Amendment of the Constitution, 3 Financial community and SOX Act, 33–9 Foreign governments/companies and SOX Act, 48–9

Index

Enron, 4, 33, 36–8, 67, 70 Executive pay, legislation on, 6

211

Internal Control System broad terms, 7–8 monitoring system, 8 Interview with Mike B., on SOX compliance about Internal Control System and auditing requirements, 81–2 GAAP, 83–4 general comments, 81, 83 ISO compliance process, 82–3 Investment Advisers Act of 1940, 36 Investment Company Act of 1940, 36

reporting to bank, 25 requirement of external auditing, 25 role of SOX rules, 26 Protonex Technology Corp, of Southborough, 48 Public and SOX Act Collins v. Beazer Homes USA Inc., 60–2 cost issues, 53–4 protection against retaliation provisions, 54–8 Richards v. Lexmark International, Inc., 62–3 Welch v. Cardinal Bankshares Corp., 58–60

Jensen, Stephanie, 14

Index

Kobi Alexander, Jacob, 14 Kumar, Sanjay, 67



Leahy, Patrick, 54 Longoria, Pedro Padilla, 70

212

Message Archiver, of Global Relay messenger, 16–17 Nationally recognized statistical rating organizations (NRSROs), 33–5 Occupational Safety and Health Administration (OSHA), 55 whistle blower compliant rules, 159–200 Olesnyckyj, Myron F., 14 Oxley, Mike, 4 Paperwork Reduction Act, 184 Performance-based systems, 4 Pliego, Ricardo Salinas, 70 Private/small businesses and SOX Act compliances, 27–9 internal control system and governance structure of the company, 27

Qualified institutional buyers (QIBs), 34 Reyes, Gregory, 14 Richards, Stephen, 67 Richards v. Lexmark International, Inc., 62–3 Risk assessment, of a company, 7–8 Russell, Philip, 68–9 Santa Clara County vs. Southern Pacific Railroad, 3 Sarbanes, Paul, 4 Sarbanes–Oxley (SOX) Act of 2002 abridged form, 89–145 comments by Presidents, 5 costs of compliance, 13 Global Relay’s solutions for, 15–16, 16–21 impacts in markets, 75–8 internal control framework, 13–15 sections of the Act, 6–7, 54–8 Sections, of SOX Act, 6–7, 54–8 section 802, 68–9 section 806, 54–8 section 1102, 69

Securities Exchange Act of 1934, 33 section 10A-audit requirements, 149–56 Stock option “backdating” scandals, 4, 14–15 UK Data Protection Act, 48 US Government Department of Labor (USDOL), 43 US securities laws, 48 Walter, Robert D., 70 Welch v. Cardinal Bankshares Corp., 58–60 Whistleblowers, 28, 54–8

Whistleblowers compliant rules Administrative Procedure Act, 184 Executive Order 12866/13132, 185 Paperwork Reduction Act, 184 part 1980-procedures for handling of discrimination complaints, 186–200 regulations and rulemaking proceedings, 161–3 regulatory flexibility analysis, 185–6 regulatory provisions, 164–84 statutory procedures, 160–1 Woghin, Stephen, 67 WorldCom, 4, 33, 67

Index

 213

This page intentionally left blank