The Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley) was enacted at a time of remarkable turmoil for corporate America. Following the collapse of Enron Corp. in late 2001, the administration of President George W. Bush, members of the U.S. Congress, the SEC and the stock exchanges, among many others, proposed expansive regulation to address what were generally seen as systemic failures in the governance, internal controls and disclosure practices of public companies and the existing regulation of these companies and the financial markets.

In early 2002, the SEC reviewed the annual reports of the Fortune 500 (for the first time in years for many of these companies), made specific proposals for changes to certain of its corporate disclosure rules and began formulating further reform proposals covering financial reporting and disclosure requirements, accounting standard setting, regulation of the auditing process and profession, and corporate governance. The then Chairman of the SEC, Harvey Pitt, instructed the major stock exchanges to overhaul their corporate governance listing standards to ensure greater independence of directors and accountability. The Bush administration stepped in with a 10-point plan to "improve corporate responsibility and protect America’s shareholders."

In seeking to determine whether or not fraud was widespread in major public companies, in June 2002 the SEC ordered the CEOs and CFOs of the 945 largest publicly-traded companies to file sworn statements attesting to the integrity of the financial and other information contained in their SEC filings for that year. Meanwhile, numerous pieces of reform legislation worked their way through both houses of Congress, going widely unnoticed until the landmark disclosure of a multi-billion dollar accounting scandal at WorldCom, Inc., one of "history’s largest frauds" in the words of the court-appointed monitor for the bankrupt company.

The wave of corporate scandals culminating in WorldCom propelled Congress and the White House to action. Sarbanes-Oxley was signed into law by President Bush on July 30, 2002, just 35 days after WorldCom’s announcement that it had overstated its revenues by at least $3.8 billion (later considered to have been at least $9 billion since 1999 alone according to an SEC statement) and effected sweeping changes in securities, criminal and other federal laws affecting public companies, public accounting firms, investment banks, lawyers and public company directors and executive officers.

Sarbanes-Oxley is recognized to be the most significant U.S. federal disclosure and corporate governance legislation since the Securities Act of 1933 (Securities Act) and the Securities Exchange Act of 1934 (Exchange Act). It is best understood, however, not as a monolithic piece of new legislation centered on a new concept of regulation, but as an ordering process which mandated that many major reforms proposed by various participants in the reform debate be implemented with all deliberate speed (in some cases, within 30 days) on the precise schedule specified by Congress. In that sense, the WorldCom debacle provided the impetus of public outrage that forced into effect some of the most readily available reform proposals of the moment, many of which had languished for years without sufficient political imperative to be enacted.

Principal provisions of Sarbanes-Oxley include the following:

  • increased regulation and oversight of the accounting profession;
  • more stringent auditor and audit committee independence requirements;
  • greater corporate responsibility and accountability;
  • increased issuer disclosure;
  • increased regulation of securities analysts;
  • increased criminal penalties; and
  • new professional responsibility standards for attorneys.

With the approval by the SEC in June 2004 of a new standard adopted by the new Public Company Accounting Oversight Board (PCAOB) for outside audits of a public company’s internal controls over financial reporting, substantially all of the new regulation mandated by Sarbanes-Oxley is now in place. This memorandum outlines the principal provisions of Sarbanes-Oxley, its implementation by the SEC and the implications for public companies going forward from here.

1. Oversight of Accounting Profession

Sarbanes-Oxley required the establishment of the five-member PCAOB to register, oversee, regulate, inspect and discipline public accounting firms, including foreign audit firms whose audit reports are included in SEC filings, and persons associated with such firms. The PCAOB is charged with establishing and enforcing auditing, quality control, ethics and independence standards and rules for public company accountants. The SEC will not accept an audit report from an accounting firm that is not registered with the PCAOB. Thus, SEC reporting companies must engage the services of a registered public accounting firm.

Sarbanes-Oxley marked the end of self regulation of audit firms with regard to the auditing of public companies in the United States and the PCAOB has begun inspections of registered audit firms. An investigation of an auditing firm by the PCAOB increases the potential exposure of public companies whose audit records are the subject of an investigation.

The PCAOB has signaled by its early rulemaking, published briefing papers and public comments of its members that it intends to be a significant new regulatory force. It has the power to conduct regular and special investigations of registered auditing firms and to impose sanctions. Public companies can expect that intense new oversight of auditors will in turn cause auditors to be more demanding of their audit clients, driving up costs. In particular, the new standard created by the PCAOB by which outside auditors will attest to the validity of a companion new requirement that management evaluate the effectiveness of the company’s internal controls over financial reporting, probably the single most significant provision of Sarbanes-Oxley, not only increases costs for publicly-held companies but also squarely places more responsibility and risk on audit committees and executive management with regard to the effectiveness of the company’s internal controls.

The SEC appoints the members of the PCAOB and has oversight and enforcement authority over it. The PCAOB is funded by new fees imposed on publicly-traded companies based on their market capitalization—the fees range from as little as $100 for the very smallest companies to more than $1 million for a handful of the largest companies.

2. Auditor Independence

Sarbanes-Oxley amended the Exchange Act to prohibit registered public accounting firms from performing for a public company audit client any of the following services (most of which had previously been prohibited to some degree by pre-existing but generally more lenient SEC rules):

  • bookkeeping and similar services;
  • financial information systems design and implementation;
  • appraisal or valuation services, fairness opinions or contribution-in-kind reports;
  • actuarial services;
  • internal audit outsourcing services;
  • management functions or human resources;
  • broker or dealer, investment advisor or investment banking services;
  • legal services and expert services unrelated to audit; and
  • any other services proscribed by the PCAOB.

The SEC adopted amendments to its rules on auditor independence consistent with the Sarbanes- Oxley prohibitions. The new auditor independence rules are based on three general principles that the SEC determined were embodied in the Sarbanes-Oxley prohibitions: (a) an auditor cannot audit its own work, (b) an auditor cannot function in the role of management, and (c) an auditor cannot serve in an advocacy role for its client.

In addition, pursuant to Sarbanes-Oxley, and detailed rules subsequently adopted by the SEC, the provision of other non-audit services by outside auditors (such as permitted tax and other non-audit services) requires pre-approval by the company’s audit committee and disclosure of the issuer’s preapproval policies in proxy statements and annual reports filed with the SEC.

In evaluating whether an auditor is independent of its audit client, companies and their potential auditors must consider, in addition to the detailed rules under Sarbanes-Oxley referred to above, the general standards of auditor independence set forth in SEC rules. Under these standards, an accountant will not qualify as "independent" if a reasonable investor, with knowledge of all relevant facts and circumstances, would conclude that the auditor is not capable of exercising objective and impartial judgment on all issues encompassed within the auditor’s engagement. Shareholder groups have for some time put forth shareholder proxy statement proposals to limit non-audit services provided by a company’s auditors. In 2002, the SEC staff took the position that such a proposal could not be omitted from the Walt Disney Company’s proxy statement "in view of the widespread public debate concerning the impact of non-audit services on auditor independence and the increasing recognition that the issue raises significant policy issues."

Under Sarbanes-Oxley and SEC rules, the lead and concurring audit partners with responsibility for an issuer’s audit must be rotated at least once every five years. The new rules also preclude an audit firm from serving as outside auditor to an issuer where certain former employees of the audit firm work in any of certain specified financial or accounting positions at the company (in certain cases limited to the year following an individual’s participation in the audit firm’s audit of the client).

3. Corporate Responsibility

a. Audit Committee Independence

Sarbanes-Oxley directed the SEC to adopt rules that now require that the listing standards of the national stock exchanges and Nasdaq mandate that audit committees be comprised solely of "independent" members. Independence for these purposes means only those directors who do not receive any compensation from the issuer other than directors’ fees and who are not "affiliated persons" (a term now defined in SEC rules for this purpose) of the issuer or its subsidiaries. The required listing standards were approved by the SEC in November 2003 and became effective in 2004.

Sarbanes-Oxley also amended the Exchange Act to mandate that audit committees:

  • have direct responsibility for hiring and overseeing the work of the auditors;
  • establish procedures for the receipt, retention and treatment of complaints regarding accounting, internal controls or auditing matters, including procedures for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters; and
  • receive reports from the auditors regarding the company’s critical accounting policies and material communications between the auditors and company management.

b. CEO and CFO Certifications

SEC rules adopted under Sarbanes-Oxley require that CEOs and CFOs of all issuers certify, to the best of their knowledge, the accuracy and completeness of each quarterly and annual report, that the financial statements in the report "fairly present" the company’s financial condition, cash flows and results of operations, and that they have evaluated the adequacy of the issuer’s internal controls over financial reporting.

Sarbanes-Oxley also added another certification provision to federal criminal law under which the CEO and CFO are required to certify that quarterly and annual reports comply with securities laws and the information in such reports fairly presents the issuer’s financial condition and results of operations. This provision specifies that a CEO or CFO who knowingly files a false certification may be fined up to $1 million and/or imprisoned for up to 10 years. A willful violation is punishable by a fine of up to $5 million and/or imprisonment of up to 20 years.

Both certifications are now required to be included as exhibits to annual and quarterly reports filed with the SEC.

c. Disgorgement of Compensation and Stock Sale Profits by CEOs and CFOs upon Restatements Due to Misconduct

Sarbanes-Oxley requires forfeiture of certain bonuses and profits realized by the CEO and CFO of a company that is required to prepare an accounting restatement due to the issuer’s "material noncompliance, as a result of misconduct, with any financial reporting requirement under the securities laws." Specifically, the CEO and CFO must reimburse to the issuer any bonus or other incentive or equity-based compensation received, and any profit realized from the sale of the issuer’s stock sold, during a specified recapture period. Reimbursement is required whether or not the CEO or CFO engaged in or knew of the misconduct. The "recapture period" is the 12-month period following "the first public issuance or filing with the SEC (whichever first occurs) of the financial document embodying such financial reporting requirement."

d. Prohibition of Personal Loans to Executive Officers and Directors

Sarbanes-Oxley prohibits "personal loans" to executive officers and directors subject to certain narrow exceptions. The SEC has declined to issue any guidance on this provision (other than to provide an exemption for certain loans made by non-U.S. banks similar to that provided in Sarbanes-Oxley for U.S. banks), so it remains uncertain how this prohibition applies to cashless stock option exercises, equity "split-dollar" life insurance arrangements and other previously standard executive compensation practices at public companies. This prohibition applies to companies from the moment they first file a registration statement with the SEC, i.e., before it becomes effective. Loans outstanding on July 30, 2002 are not subject to this prohibition provided the loans have not, thereafter, been renewed or materially modified.

e. Retirement Fund Blackout Periods

Sarbanes-Oxley and newly adopted SEC rules (Regulation BTR) prohibit directors and executive officers from purchasing or selling the issuer’s equity securities during certain "blackout periods" imposed on tax-qualified defined contribution plans, such as Section 401(k) plans. In general, a "blackout period" is defined under Sarbanes-Oxley as a temporary suspension of trading in company stock for more than three days applicable to 50% or more of the participants in a plan. The prohibition on purchases or sales is "with respect to such equity security if such director or officer acquires such equity security in connection with his or her service or employment as a director or executive officer." SEC and U.S. Labor Department rules have been adopted to clarify and implement this provision and provide for recapture of deemed profits from any trading that may occur in violation of this provision similar to that provided for violation of short-swing profit rules of Section 16 of the Exchange Act that have been applicable to executive officers and directors since the 1930s and which were also amended by Sarbanes-Oxley, as discussed below.

4. Enhanced Disclosure

a. Off-Balance Sheet Transactions, Contractual Obligations and Non-GAAP Financial Information

Sarbanes-Oxley required the adoption by the SEC of rules regarding enhanced financial information disclosures in periodic reports filed with the SEC, including information on off-balance sheet transactions, aggregated and tabular information about contractual obligations and reconciliation of any "non-GAAP financial measures" (so-called "pro forma" or other measures that are calculated by adding or subtracting amounts, such as extraordinary "one- time" charges, to or from measures required under generally accepted accounting principles (GAAP)) to the most directly comparable GAAP measures. The SEC rules also apply to any public disclosures containing material information that use non-GAAP financial measures, such as press releases.

Sarbanes-Oxley also requires that each periodic report containing financial statements filed with the SEC must reflect all material correcting adjustments identified by the auditor.

b. "Real-Time" Disclosure

Sarbanes-Oxley requires issuers to disclose "on a rapid and current basis such additional information concerning material changes in the financial condition or operations of the issuer" as the SEC determines is necessary or useful. Since passage of Sarbanes-Oxley, the SEC has revised the current reporting form, Form 8-K, to include many new reportable events and, effective on August 23, 2004, accelerated the filing deadline to four business days for most reportable events. The new reportable events added to Form 8-K since Sarbanes-Oxley include:

  • earnings releases and any other published material relating to a completed fiscal period (effective now);
  • amendments to or waivers of a company’s code of ethics for executive officers (effective now);
  • a determination by the company or its auditor that security holders should no longer rely upon the company’s financial statements (effective on August 23, 2004);
  • the entry into, material amendments to, and termination of "material definitive agreements" (effective on August 23, 2004); · a decision to record a material write-off, restructuring charge or impairment charge (effective on August 23, 2004);
  • any new material direct financial obligations or any off-balance sheet arrangement and the triggering of any provision included in such obligation or arrangement that would accelerate or increase the company’s liability thereunder (effective on August 23, 2004);
  • any event which might lead to a delisting of the company’s equity securities (effective on August 23, 2004);
  • amendments to a company’s charter or bylaws (effective on August 23, 2004);
  • unregistered issuances of the company’s equity securities above a certain threshold (effective on August 23, 2004);
  • material modifications to the rights of security holders (effective on August 23, 2004); and
  • the appointment or departure of any director or principal officer (effective on August 23, 2004).

c. Accelerated Insider Transaction Reporting under Section 16 of the Exchange Act

Under Sarbanes-Oxley and related SEC rules, officers, directors and greater than 10% stockholders of public companies who are subject to the short-swing reporting and profit recapture provisions of Section 16 of the Exchange Act are now required to report nearly all their transactions in company stock and related derivative securities electronically within two business days of any such transaction.

d. Audit Committee Financial Expert

Listed companies must disclose in their annual report whether—and if not, why not—they have at least one "audit committee financial expert," as such term is defined by SEC rules adopted pursuant to specified guidelines set forth in Sarbanes-Oxley. If a company has an "audit committee financial expert," such individual must be named in the company’s annual report.

e. Code of Ethics for CEO and Senior Financial Officers

Under SEC rules adopted pursuant to Sarbanes-Oxley, listed companies must disclose whether— and if not, why not—they have a code of ethics for the CEO and senior financial officers. Additionally, as mentioned above, U.S. companies must promptly disclose any subsequent waivers or changes to this code on a Form 8-K or, if they have indicated an intent to do so in their periodic reports, on their website. Many companies blend such codes into lengthier codes of ethics and standards of business conduct such as those now required for New York Stock Exchange-listed companies.

f. SEC Reviews of Periodic Filings

Sarbanes-Oxley requires the SEC to review the periodic reports of each issuer at least once every three years and provides criteria for the SEC to consider in prioritizing reviews, including, among others, the occurrence of a restatement, volatility in an issuer’s stock price, size of market capitalization and emerging companies with disparities in price to earnings ratios. Sarbanes-Oxley also provides for a significant increase in SEC funding, much of which is being used to hire additional accountants and lawyers. Just recently, according to a senior SEC official, the number of accountants on the SEC staff has exceeded the number of lawyers, indicating the not surprising post-Enron/WorldCom priorities of the agency.

5. Analyst Conflicts of Interest

As required under Sarbanes-Oxley, the SEC adopted rules designed to enhance protections against conflicts arising between the provision of securities research and investment banking. SEC Regulation Analyst Certification (Regulation AC) requires that brokers, dealers and associated persons that produce research reports include in those reports a statement certifying that the views expressed in the report accurately reflect the analyst’s personal views about the subject securities and a certification as to whether any part of the analyst’s compensation was, is, or will be directly or indirectly related to the specific recommendations or views contained in the research report.

6. Expanded Criminal Penalties; Non-Discharge of Securities Claim Liabilities in Bankruptcy and Whistleblower Provisions

Sarbanes-Oxley provides for enhanced criminal penalties for a broad array of white-collar crimes and a lengthening in the statute of limitations for securities fraud claims.

Sarbanes-Oxley makes it a crime for an officer or director of an issuer to fraudulently influence, coerce, manipulate or mislead an independent auditor in its performance of an audit. Sarbanes-Oxley also imposes criminal penalties for the destruction, alteration or falsification of documents in federal investigations and bankruptcy proceedings, extends the maximum prison term to 25 years for securities fraud, enhances white-collar crime penalties and imposes corporate fraud accountability.

Under Sarbanes-Oxley, debts arising from claims that result from violations of securities law cannot be discharged in bankruptcy.

In addition, Sarbanes-Oxley provides for a temporary freeze on extraordinary payments to directors, officers and employees of companies under investigation by the SEC and makes it a crime to retaliate against corporate whistleblowers.

Finally, the statute of limitations for private rights of action with respect to securities fraud was extended to the earlier of two years after the discovery of facts constituting the violation or five years after the occurrence of the violation.

7. Professional Responsibility Standards for Attorneys

Sarbanes-Oxley required the SEC to establish minimum standards of professional conduct for attorneys appearing and practicing before the SEC in any way in the representation of issuers. The rule adopted by the SEC requires attorneys:

  • to report evidence of a material violation of securities laws or a material breach of fiduciary duty or a similar violation by the company or any agent thereof, to the chief legal officer (CLO) or to both the CLO and the CEO of the company (or the equivalents thereof); and
  • if the counsel or officer does not appropriately respond to the evidence (adopting, as necessary, appropriate remedial measures or sanctions with respect to the violation), to report the evidence to the audit committee of the board of directors of the issuer or to another committee of the board of directors comprised solely of directors not employed directly or indirectly by the issuer, or to the full board of directors.

The adopted rule permits (but does not require) an attorney to reveal to the SEC the information reported to the company, without the company’s consent, to the extent the attorney reasonably believes that it is necessary (i) to prevent substantial injury to the financial or property interests of the company or its investors, (ii) to prevent the company from committing perjury or perpetrating fraud on the SEC, or (iii) to rectify the consequences of a material violation that caused, or may cause, substantial injury to the financial or property interests of the company or its investors. The SEC takes the position that its rule preempts contrary state laws of professional responsibility, and the SEC is still considering an amendment to this rule to require attorneys to withdraw from the representation and to notify the SEC under certain of these circumstances.

8. Application to Non-U.S. Companies

Sarbanes-Oxley applies to any issuer "the securities of which are registered under section 12 of that Act ... or that is required to file reports under section 15(d)." In practical terms, this includes any company that is required by the securities laws to file periodic reports with the SEC. Sarbanes-Oxley makes no distinction in this regard between U.S. and non-U.S. companies. Therefore, except to the extent that the SEC specifically exempts or accommodates foreign private issuers, the provisions of Sarbanes-Oxley, including, for example, the prohibition on loans to executive officers and directors, apply to these companies. To date, the SEC has generally provided only modest accommodations to foreign private issuers with respect to their rules adopted pursuant to Sarbanes-Oxley.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.