Three Things US Audit Committee Members Should Consider Now - Compliance

Keywords: auditor independence, cybersecurity, FCPA / bribery risks

Audit Committees have seen their responsibilities increase dramatically in 2014. Additionally, they have also faced increased regulatory scrutiny, potential liabilities and proxy and shareholder activist opposition to the re-election of Audit Committee members to the board of directors of the company.

This Legal Update focuses on Auditor Independence, Cybersecurity and FCPA/Bribery risks that should be considered by Audit Committees of public companies in 2014 and beyond. Companies that may not initially consider "public company"-type corporate governance requirements, including US private companies considering an initial public offering ("IPO") or a "junk bond" financing or foreign private issuers considering accessing the US capital markets, also need to be mindful of these considerations for Audit Committees.

Auditor Independence and Risks for the Company if the Auditors Are Not Independent

Audit Committees must be vigilant about ensuring the independence of their companies' auditors to confirm objectivity and impartiality in relation to the audit. As audit firms continue to expand their offerings of non-audit services, and companies continue to expand internationally into markets using distant service providers that are, or may become, associated with an audit firm, the risks of a company unknowingly utilizing non-audit services of an auditor or one of its affiliates can increase. An Audit Committee's good faith lack of knowledge of auditor conflicts, even after rigorous investigation, may not deter enforcement actions or other risks and consequences for the company.

Company and Audit Committee Member Risks. For a company, auditor conflicts threaten the validity of the annual financial statements audited by the conflicted accounting firm, as well as any interim financial statements reviewed by such firm. Practically, these auditor conflicts can lead to withdrawal by the company of the audited and reviewed financial statements as well as the company being required to publicly announce that investors should not rely upon the withdrawn financial statements. To replace the withdrawn financial statements, the company would have to undertake a costly and burdensome re-audit and review of the previously audited and reviewed financial statements by new accountants.

A company's withdrawal of its financial statements could lead to a number of adverse results, including shareholder claims against the company, derivative lawsuits against members of the Audit Committee for being negligent in their oversight responsibilities of the company's auditors, breaches of covenants under the company's debt agreements and limited access for the company to securities and financial markets. For members of the Audit Committee, these issues might then snowball into possible opposition by Institutional Shareholder Services ("ISS"), Glass Lewis and other proxy advisory firms to the re-election of the members of the Audit Committee to the board of directors of the company.

Increased SEC Enforcement in 2014. The Securities and Exchange Commission (the "SEC") warned public companies at the beginning of 2014 that it was expanding its focus on Audit Committee's monitoring of auditor independence.¹ The SEC is currently pursuing administrative and enforcement actions critical of auditor independence, and has settled two major actions in 2014 against auditors for independence violations.

On January 24, 2014, the SEC settled proceedings against KPMG, LLP ("KPMG") for violating auditor independence rules in its relationships with affiliates of three of its SEC registered audit clients.² The SEC found that KPMG provided prohibited non-audit services to affiliates of its audit clients; KPMG improperly hired a former employee of an affiliate of one of KPMG's audit clients and subsequently loaned him back to the affiliate to do the same work he had done as an employee of the affiliate; certain KPMG employees owned stock in KPMG's audit clients or affiliates of its audit clients; and KPMG repeatedly represented in its audit reports that it was "independent," when, in the view of the SEC, they were found not to be sufficiently independent. KPMG was reminded that an auditor may not provide otherwise permissible non-audit services (such as permissible tax services) to an audit client in a manner that is inconsistent with other provisions of the independence rules (such as the prohibition against acting as an employee of the audit client). KPMG's audit clients, the affected companies, were cautioned that their previously audited financials might be viewed as violating the requirements of the Securities Exchange Act of 1934 (the "Exchange Act") for financial statements. As the SEC explained in relation to KPMG:

The legal consequence of an auditor lacking independence is that it violates, and causes its audit clients to violate, various provisions of the federal securities laws. For example, Rule 2-02(b) of Regulation S-X requires that each accountant's report state "whether the audit was made in accordance with generally accepted auditing standards ["GAAS"]." GAAS, in turn, requires auditors to maintain strict independence from their audit clients. Consequently, issuing an audit report falsely stating that the audit was performed in accordance with GAAS violates Rule 2-02(b). Likewise, Exchange Act Rule 10A-2 separately provides that it shall be unlawful for an auditor not to be independent under Rule 2-01(c)(4). In addition, any time that non-independent audit reports are filed with an SEC audit client's annual reports, this causes the audit client not to comply with Section 13(a) of the Exchange Act and Rule 13a-1 thereunder (requiring that financial statements included in annual reports filed with the Commission be audited by an independent accountant).³

On July 14, 2014, the SEC settled proceedings against Ernst & Young LLP ("E&Y") for violating auditor independence rules.⁴ The SEC specifically found that a subsidiary of E&Y, Washington Council EY, performed various legislative advisory services on behalf of two SEC-registered audit clients of E&Y, impermissibly placing E&Y in a position of providing non-audit advocacy services for its audit clients. These improper services included sending a letter from a senior executive of an audit client to congressional staff; encouraging the passage of certain legislation; sending a letter signed by an audit client to Congress's leadership; urging the passage of certain legislation; asking a congressional staff member to include in a pending bill a specific provision requested by an audit client; meeting with congressional staff members in an attempt to persuade them to withdraw support for a legislative proposal detrimental to an audit client's business interests; and urging third parties to contact a US Senator to request an amendment sought by an audit client to a legislative proposal and providing these third parties with alternative draft amendments to submit to the Senator.

Audit Committee Responses to Auditor Independence Scrutiny. These enforcement actions, and the potential adverse impact on companies, underscore the increased importance of carefully investigating and confirming the independence of auditors.While not a complete defense to adverse consequences, an Audit Committee's good faith lack of any knowledge of auditor conflicts after demonstrating a rigorous investigation and vetting process, as well as self-reporting to the SEC, may mitigate the damages a company and the members of the Audit Committee may sustain upon a finding that a company's auditor is not independent. Beyond checklist approvals of independence, Audit Committees might now:

Heighten their vigilance in overseeing otherwise permissible non-audit services (such as tax services) so that these services are not implemented in a manner (or do not expand in a manner) that is inconsistent with independence rules;
Enhance screening of service providers, especially in the emerging or frontier markets, for firms and persons that are or have been affiliated or associated with their auditors (a broader inquiry than simply looking for subsidiaries of the auditors);
Request auditors to accelerate their enhanced reporting regarding independence to the Audit Committee, as proposed by regulatory standards that are likely effective for auditors next year;
Continue to monitor auditor independence during the period of auditor services and consider the changing nature of transactions and relationships between the company and an auditor, which may render a previously independent auditor not independent in the future; and
Consider carefully whether acquisitions or joint ventures by the company, especially of businesses in off-shore or emerging markets, may result in the company effectively acquiring a conflicting relationship with its auditors.

Cybersecurity Threats and Audit Committee Oversight Responsibilities

Cybersecurity risks to companies are becoming a high-priority oversight responsibility for Audit Committees. "This is in part because of the mounting evidence that the constant threat of cyber-attack is real, lasting, and cannot be ignored."⁵ Troubling, perhaps, for Audit Committees is the recent observation on June 17, 2014 from SEC Commissioner Louis Gallagher, that Audit Committees are not, in his view, acting with sufficient alarm in addressing cybersecurity threats to their companies:

In addition to the threat of significant business disruptions, substantial response costs, negative publicity, and lasting reputational harm, there is also the threat of litigation and potential liability for failing to implement adequate steps to protect the company from cyber-threats. Perhaps unsurprisingly, there has recently been a series of derivative lawsuits brought against companies and their officers and directors relating to data breaches resulting from cyberattacks. Thus, boards that choose to ignore, or minimize, the importance of cybersecurity oversight responsibility, do so at their own peril.

Given the known risks posed by cyber-attacks, one would expect that corporate boards and senior management universally would be proactively taking steps to confront these cyber- risks. Yet, evidence suggests that there may be a gap that exists between the magnitude of the exposure presented by cyber-risks and the steps, or lack thereof, that many corporate boards have taken to address these risks. Some have noted that boards are not spending enough time or devoting sufficient corporate resources to addressing cybersecurity issues. According to one survey, boards were not undertaking key oversight activities related to cyber-risks, such as reviewing annual budgets for privacy and IT security programs, assigning roles and responsibilities for privacy and security, and receiving regular reports on breaches and IT risks. Even when boards do pay attention to these risks, some have questioned the extent to which boards rely too much on the very personnel who implement those measures. In light of these observations, directors should be asking themselves what they can, and should, be doing to effectively oversee cyber-risk management.⁶

To be fair to Audit Committee members, this relatively new focus on cybersecurity comes at a time of very rapid IT, data and information system development, especially as companies push into mobile and social media technology platforms and further utilize "big data." The rapid pace of technology and data growth, and the attendant risks, highlighted by the recent security breaches, demonstrate the increasing importance of understanding cybersecurity as a substantive, enterprise-wide business risk and not just an isolated IT issue.

Cybersecurity Problems Can Lead to Audit Committee Director Removal. ISS now includes specific references to risk oversight as a criteria for choosing whether to recommend or oppose director election. In 2014, ISS opposed the election of all of the Audit Committee members of Target Corporation ("Target"), and seven of its 10 directors, at Target's 2014 annual shareholder meeting because, in ISS' view, the Audit Committee members were responsible for risk assessment, but were not sufficiently proactive in considering and addressing cybersecurity risks to Target's customer credit cards and on-line retailing. In the view of ISS, Target's Audit Committee failed to appropriately implement a risk assessment structure that could have better prepared Target for a data breach, and possibly prevented its occurrence in the first place. In making its recommendation, ISS was unmoved by Target's extensive internal investigations and reviews or by the company's investing of hundreds of millions of dollars in network security resources, dedicating more than 300 employees to information security and requiring annual data security training for all of its 350,000 employees. ISS saw such actions taken by Target's Audit Committee as merely reactionary and not sufficiently proactive and adequate to fulfill the Audit Committee's duty of risk oversight.

Cybersecurity Problems Can Lead to Audit Committee Directors Being Sued. Audit Committees have oversight responsibilities for cybersecurity risks by virtue of their general fiduciary duties of oversight. In addition, the Sarbanes-Oxley Act, New York Stock Exchange ("NYSE") and NASDAQ Stock Market ("NASDAQ") (as well as ISS) have expectations that Audit Committees will oversee compliance, risk management and internal controls for financial reporting of the company. Based on alleged breaches of these duties, the plaintiffs securities class action bar has recently filed shareholder derivative actions against the boards of directors of both Target and Wyndham Worldwide Corporation as a result of their companies' publicly reported cyber breaches.

In these complaints, the plaintiffs alleged, among other things, that the Audit Committee and directors failed to take reasonable steps in their oversight role to maintain their customers' personal and financial information in a secure manner. These class actions follow up on publicized Federal Trade Commission ("FTC") and SEC investigations of these companies, showing how cybersecurity issues can mushroom into shareholder class action lawsuits and provide potential liability for Audit Committee board members.

Cybersecurity Is a Top Priority of the SEC in 2014. The SEC emphasized its focus on cybersecurity at the SEC Cybersecurity Roundtable on March 26, 2014 (the "Roundtable"). At the Roundtable, the SEC warned that cyber risk may give rise to disclosure obligations with regard to investment risk factors, management's discussion and analysis of results of operations, descriptions of legal proceedings, financial statement disclosures and disclosure controls and procedures. As part of its review of disclosures relating to cybersecurity risks, the SEC has issued comment letters to approximately 50 companies concerning compliance with SEC cybersecurity disclosure guidance in 2011, which suggests that cybersecurity preparedness has been and will be subject to significant scrutiny. The SEC has opened investigations of multiple companies in recent months examining whether those companies properly handled and disclosed a growing number of cyber attacks and adequately guarded data and informed investors about the impact of breaches.⁷

At the Roundtable, SEC Chair Mary Jo White framed the importance in 2014 of cybersecurity risks by noting, "Cyber threats are of extraordinary and long-term seriousness. They are first on the Division of Intelligence's list of global threats, even surpassing terrorism. And Jim Comey, director of the FBI, has testified that resources devoted to cyber-based threats are expected 'to eclipse' resources devoted to terrorism."⁸

In 2014, the SEC began conducting examinations of more than 50 registered brokerdealers and registered investment advisors under SEC supervision to gauge their cybersecurity preparedness. These examinations are ostensibly designed to help the SEC identify the areas in which SEC-registered entities are already addressing cybersecurity threats and, of course, those areas where cybersecurity measures could be improved. For these examinations, the SEC provided a sample list of questions that comprise 28 information requests with multiple sub-parts. Though limited only to SEC-regulated brokers and advisors, other companies might consider these information requests as an indication of the direction and depth of cybersecurity scrutiny expected by regulators in the future.

Cybersecurity Is Also Becoming a Focus of Other Key Regulators. The SEC is not the only regulator focusing its regulatory and enforcement scrutiny on cybersecurity risks for companies—and so implicating the Audit Committee's role in overseeing company risks. The FTC has initiated investigations into privacy and data breaches; the Federal Communications Commission is evaluating cybersecurity risks for the telecommunications industry; the Food and Drug Administration is evaluating cybersecurity issues for medical devices; and the New York Department of Financial Services is reviewing insurance company cybersecurity protections.

Cybersecurity Questions for Audit Committees. Cybersecurity is a relatively new topic for Audit Committee members, and to be fair, cybersecurity threats have defeated many experienced IT experts. SEC Commissioner Aguilar recommended that companies consider the National Institute of Standards and Technology's February 2014 Framework for Improving Critical Infrastructure Cybersecurity⁹ (the "Framework"), which is intended to provide companies with a set of industry standards and best practices for managing their cybersecurity risks. Given that some have suggested the Framework will become a baseline for best practices by companies, Commissioner Aguilar expressed his view that boards should work with management to assess their policies against the guidelines in the Framework.

To address the recent focus on cybersecurity risks as part of their oversight of company risk generally, Audit Committee members might address their oversight of cybersecurity threats from several perspectives:

Is the Audit Committee principally responsible for cybersecurity risk oversight? Though the Sarbanes-Oxley Act, NYSE and NASDAQ oversight responsibilities emphasize Audit Committee responsibility for risk oversight, this allocation of responsibility is still being considered by many boards, and might be formalized if in doubt.
Should the Audit committee and the board consider a specialized cybersecurity committee or subcommittee to evaluate cybersecurity risks for the company? Can the Audit Committee (or that committee) evaluate the company's cybersecurity risks, either on the basis of their own expertise, through further education or utilizing outside advisors?
How do we know what data is leaving the company, and what associated security monitoring activities are in place?
Where is the company's data stored, and which jurisdictions have regulatory and legal authority for that data protection?
How do the company's practices measure against the standards in the Framework?
Are there particular regulatory, industry or jurisdictional cybersecurity risks that are particularly relevant for the company?
How are cybersecurity breaches identified or reported within the company and, if necessary, to the Audit Committee?
Looking at recent, well-publicized incidents of cybersecurity breaches, what is the company's exposure to similar threats? How would the company manage recovery from these threats?
Looking at the direction of the company's technology infrastructure, where might future cybersecurity risks to the company arise?
What are the company's key assets, systems, properties and interests that are sensitive to cybersecurity risks, and how are they currently protected? How do other similar industry participants protect against cybersecurity risks? How can the company protect its assets better than these similar industry participants?
Cybersecurity, as is becoming apparent to regulators, also raises privacy law issues, which vary by jurisdiction. Privacy breaches, in turn, can expose the company to regulatory and litigation risk. How does the company address privacy risks?
How would the company respond to a major cybersecurity incident (including with customers and regulators)? SEC Commissioner Gallagher explains "while there is no 'one-size-fits-all' way to properly prepare for the various ways a cyber-attack can unfold, and what responses may be appropriate, it can be just as damaging to have a poorly-implemented response to a cyber-event." As others have observed, an ill-thought-out response can be far more damaging than the attack itself. "Accordingly, Audit Committees should put time and resources into making sure that management has developed a well-constructed and deliberate response plan that is consistent with best practices for a company in the same industry. These plans should include, among other things, whether, and how, the cyber-attack will need to be disclosed internally and externally (both to customers and to investors)."¹⁰
Are the company's overseas businesses and joint ventures subject to the company's cybersecurity protections?
Will acquisitions or joint ventures by the company, especially of businesses in off-shore or frontier markets where cybersecurity protections may not be as developed, represent acquired cybersecurity risks for the company?
Are company controls or internal reporting systems in place and tested to detect, report and respond to a cybersecurity breach? Are those controls and reporting systems periodically tested?
Within the company, which department or group is responsible for cybersecurity?
In 2014, Audit Committees might monitor the SEC's on-going review of cybersecurity risks, from the perspectives of disclosure and internal monitoring systems, and reconsider whether enhanced disclosures and systems might be considered by the company.

Anti-Bribery Oversight Issues For Audit Committees

Increased SEC Enforcement in 2014. Audit Committees must be aware and prepared for an increased focus on their companies's compliance with the Foreign Corrupt Practices Act ("FCPA"), as well as anti-bribery regulations arising in the United Kingdom, European Union, China and other jurisdictions. In 2014 alone, the SEC's specialized FCPA enforcement unit has brought charges against three major companies, which resulted in settlements totaling almost $500 million, the most recent having been brought on July 28, 2014.

The SEC has made it clear in recent years that its focus on seeking out and punishing FCPA violations will only increase, and the cases have sent out a message saying "obey the FCPA, and ensure that your employees are sensitive to FCPA issues, or face stiff penalties and other consequences."¹¹ In looking at FCPA enforcement, the SEC will "focus on individual FCPA misconduct" as well as "fostering cooperation with our investigations from companies and individuals."¹² An increase in focus on the specific compliance of individuals, especially Audit Committee members with their oversight responsibilities in relation to company compliance, means that Audit Committees should be particularly aware of what is expected of them.

FCPA Noncompliance May Lead to Audit Committee Director Removal. In both 2013 and 2014, ISS called for a "no" vote by shareholders for several of the directors of Wal- Mart Stores, Inc. ("Wal-mart"), including in 2013, the Chairman of the Audit Committee, for their actions relating to the company's alleged FCPA violations, stating that "the board failed to make progress in providing meaningful information to shareholders about any specific findings on the FCPA-related investigations and whether executives will be held accountable for related compliance failures."¹³ One of ISS's primary concerns was the fact that Wal-Mart had spent approximately $450 million investigating the FCPA violations and putting in place a more comprehensive compliance program, and more costs are expected to be incurred. ISS argued for the removal of the board members for failing to properly stay informed and for allowing the FCPA violations to occur to a level that required such an expensive investigation and creation of an extensive compliance program.

FCPA Noncompliance May Lead to Lawsuits against Audit Committee Members. In addition to financial reporting matters, Audit Committees are responsible for overseeing a company's compliance program with respect to FCPA and other anti-bribery laws. This responsibility is brought about by virtue of their general fiduciary duties of oversight as well as Sarbanes-Oxley Act, NYSE and NASDAQ requirements/mandates that Audit Committees oversee compliance, risk management and internal controls over financial reporting of the company. As a result, an FCPA violation by a company can lead to lawsuits against the Audit Committee alleging a failure by its members to properly perform their oversight duties in this regard.

Audit Committee Actions With Regard to FCPA Scrutiny. In 2012, the SEC released a comprehensive "Resource Guide to the US Foreign Corrupt Practices Act" ("Resource Guide"), designed to clarify the responsibilities of the company and the Audit Committee for compliance efforts of a company in order to avoid potential FCPA violations and SEC action against the company.¹⁴ The Resource Guide sets out 10 factors that the SEC considers to be strong signals of an effective compliance program. The Resource Guide only sets out requirements for companies, not Audit Committees specifically. However, due to the Audit Committee's oversight duties over compliance, risk management and internal control over financial reporting, Audit Committees should evaluate their company's FCPA and anti-bribery compliance efforts after considering the observations set forth in the Resource Guide.

To address FCPA and anti-bribery risks as part of their oversight of company risk generally, Audit Committees might consider the following inquiries:

Is the Audit Committee principally responsible for anti-bribery risk oversight? Though the Sarbanes-Oxley Act, NYSE and NASDAQ oversight responsibilities emphasize Audit Committee responsibility for risk oversight, this allocation of responsibility is still being considered by many boards, and might be formalized if in doubt.
How does the company's approach to FCPA and anti-bribery matters measure-up against the standards in the Resource Guide and other guidance?
Are there particular regulatory, industry or jurisdictional anti-bribery risks that are relevant for the company? Does the company interact with state-owned enterprises, especially in emerging or frontier markets where these risks may be especially sensitive?
Looking at recent, well-publicized incidents of FCPA and anti-bribery proceedings, do any raise questions for the company as arising in jurisdictions or circumstances applicable to the company?
Will acquisitions or joint ventures by the company, especially of businesses in off-shore or frontier markets where anti-bribery protections may not be as well developed, represent acquired anti-bribery risks for the company?
Has the Audit Committee reviewed a clear code of conduct and outlined "responsibilities for compliance" for all the company's employees?
Is the program specialized to the extent that it focuses on areas of highest risk of corruption for the company?
Is there a periodically updated, mandatory training program for all employees?
Has the company put in place a system through which a violation may be reported, including to the Audit Committee, and procedures for investigating those violations?

Private US Companies Considering an IPO or Junk Bond Financing or Foreign Private Issuers Accessing the US Capital Markets

Companies that may not initially consider "public company" corporate governance requirements, including US private companies considering an IPO or a "junk bond" financing or foreign private issuers considering accessing the US capital markets, also need to be mindful of these considerations for Audit Committees.

Private Companies Going Public. Private companies that eventually plan to engage in an IPO also need to consider auditor independence, cybersecurity and anti-bribery concerns even before going public. The rules governing auditor independence as prescribed by the SEC and the Public Company Accounting Oversight Board ("PCAOB") do not necessarily apply to private companies; however, such rules will apply at the time a company files its registration statement with the SEC.¹⁵ Additionally, if the audit firm that the company has historically been using fails to meet such independence standards at such time, then the company will have to incur the additional expense, time and effort to have its financial statements re-audited by an audit firm that does meet such standards. Private companies should be aware that audit firms that are independent under the standards of the American Institute of Certificated Public Accountants may not be independent under the more exacting standards of the SEC and PCAOB.

Junk Bond Issuers. Private companies that intend to access the capital markets through the issuance of securities (including non-investment grade debt securities, or junk bonds) in unregistered offerings must often grant investors registration rights whereby the company agrees to file a registration statement with the SEC and undertake an "A/B exchange offer" pursuant to which it offers to exchange the outstanding restricted securities for identical, freely tradable registered securities. Like a company contemplating an IPO, private companies under such circumstances need to similarly plan ahead since the filing of the exchange offer registration statement will cause the company to become subject to the SEC's and PCAOB's auditor independence rules.

Foreign Private Issuers. Foreign private issuers that plan to eventually access the US public markets through an SEC-registered IPO, or that desire to access the US capital markets through the issuance of restricted securities in exempt offerings with registration rights, need to be mindful of auditor independence requirements well in advance of any proposed US capital markets transaction. In many countries, auditors, including the international affiliates of the "Big Four" accounting firms, provide non-audit services to their audit clients.

The SEC applies very strict rules with respect to these services and Audit Committees must be vigilant in ensuring that any service outside the audit, no matter how minor, is separated from the audit firm and its affiliates. It is simply not enough to take the auditors affirmation of independence at face value without independent inquiry on the part of the Audit Committee.

There are no de minimis exceptions and companies can face significant delays in their ability to access the US capital markets unless their Audit Committees are vigilant in regularly monitoring auditor independence.

Footnotes

1 See Presentation by Paul Beswick, Chief Accountant, Office of the Chief Accountant, Regarding Audit Committees at "The SEC Speaks" in 2014 sponsored by the Practising Law Institute.

2 See In the Matter of KPMG LLP, Release No. 71389, File No. 3-15687 (Jan. 24, 2014).

3 See SEC Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: KPMG, LLP.

4 See In the Matter of Ernst & Young LLP, Release No. 72602, File No. 3-15970 (July 14, 2014).

5 "The Commission's Role in Addressing the Growing Cybersecurity Threat," statement by SEC Commissioner Luis A. Aguilar (March 26, 2014).

6 "Boards of Directors, Corporate Governance and Cyber-Risks: Sharpening the Focus" speech by SEC Commissioner Louis A. Aguilar (June 17, 2014).

7 "Hacked Companies Face SEC Scrutiny Over Disclosure," Bloomberg News (July 7, 2014).

8 "Homeland Threats and Agency Responses," the Honorable James B. Comey, Jr., statement of the Federal Bureau of Investigation Before the Committee on Homeland Security and Governmental Affairs, United States Senate (November 14, 2013).

9 http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214-final.pdf

10 "Boards of Directors, Corporate Governance and Cyber-Risks: Sharpening the Focus" speech by SEC Commissioner Louis A. Aguilar (June 10, 2014).

11 "Keynote Address at the International Conference on the Foreign Corrupt Practices Act," statement by SEC Co-Director of the Division of Enforcement Andrew Ceresney (Nov. 19, 2013).

12 Id.

13 Matt Levine, "Wal-Mart ShareholdersWant to Hear More About This Bribery Problem," Bloomberg View (May 27, 2014).

14 "A Resource Guide to the U.S. Foreign Corrupt Practices Act," Criminal Division of the US DOJ and Enforcement Division of the US SEC (2012), available at http://www.justice.gov/criminal/fraud/fcpa/guide.pdf.

15 See Section 2(a)(7)of the Sarbanes Oxley Act, PCAOB Rule 1001, Rule 2-01 of Regulation S-X and Section 4100 of the SEC's Division of Corporation Finance Financial Reporting Manual.

Originally published 11 September 2014

Visit us at mayerbrown.com

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.