'DYLV3RON :DUGZHOO /H[LQJWRQ$YHQXH 1HZ<RUN1< Re: The Sarbanes-Oxley Act CEO and CFO Certification Requirements

Transcription

1 'DYLV3RON :DUGZHOO /H[LQJWRQ$YHQXH 1HZ<RUN1< Ã Memorandum for: Interested Persons July 26, 2002 Re: The Sarbanes-Oxley Act CEO and CFO Certification Requirements On July 25, 2002, the House and Senate approved the Sarbanes-Oxley Act of 2002 (the Act ). President Bush is expected to sign the Act into law shortly. The Act would require the CEOs and CFOs of companies with securities registered in the U.S. to make on an ongoing basis two separate certifications concerning periodic reports filed with the SEC. The first certification requirement becomes effective immediately and imposes criminal penalties (the Criminal Certification ). The second requirement becomes effective upon rulemaking by the SEC which is required within 30 days after enactment, and is subject to civil enforcement by the SEC (the Civil Certification ). These two certifications differ from, and are required in addition to, the recently issued SEC order requiring CEOs and CFOs of over 900 U.S. public companies to file sworn certifications as to recently filed reports (the SEC Order ). Companies currently subject to the SEC Order would be subject to both the SEC Order and the Criminal Certification with respect to their upcoming SEC filings, including the next quarterly report on Form 10-Q, which is due on August 14 th for calendar year-end companies. This would involve making two separate and different certifications. Companies currently not subject to the SEC Order would also be immediately subject to the Criminal Certification. We have attached as Annex A a suggested guideline of procedures to consider in order to provide the certifying officers with the level of diligence to support the Criminal Certification. We intend to distribute another memorandum shortly addressing other provisions of interest in this Act. Criminal Certification The Criminal Certification provisions would require that each filed periodic report containing financial statements be accompanied by a written statement from the CEO and CFO that the report fully complies with the requirements of the Securities Exchange Act of 1934 and fairly presents, in all This memorandum is a summary for general information only. It is not a full analysis of the matters presented and may not be relied upon as legal advice.

2 material respects, the financial condition and results of operations of the company. We note in particular that: This requirement would take effect immediately upon the Act becoming law. The criminal statute refers to periodic reports that contain financial statements, which at a minimum includes annual reports on Form 10-K and quarterly reports on Form 10-Q. While we expect that reports on Form 8-K that contain financial statements, except for material furnished (not filed) pursuant to Item 9 in accordance with Regulation FD, are also included, we are currently seeking guidance on this point. Unlike the SEC Order and the Civil Certification, the Criminal Certification does not qualify the statements as to the knowledge of the officers involved. In order to be criminally liable, however, the officer must have signed the certification knowing that the periodic report does not comply with the certification requirements. The certification requirement applies only to the CEO and the CFO, and not a non-executive Chairman of the Board, as had been initially proposed. While it is unclear how companies would accompany a certification with a filed report, we except that it will likely be provided to the SEC via the EDGAR system as correspondence. We suggest that this correspondence state that it is being furnished solely pursuant to the criminal statute and is not being filed as part of the periodic report or as a separate disclosure document. Civil Certification The Civil Certification provisions would, subject to definitive SEC rulemaking, require the CEO and CFO of a company to make a certification in and as part of each annual and quarterly report filed with the SEC that, among other things: based on the officer s knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which they were made, not misleading; based on such officer s knowledge, the financial statements, and other financial information included in the report, fairly present in all material respects the financial condition and results of This memorandum is a summary for general information only. It is not a full analysis of the matters presented and may not be relied upon as legal advice. 2

3 operations of the issuer as of, and for, the periods presented in the report; and the signing officers are responsible for the company s internal controls, have evaluated the effectiveness of the internal controls in the last 90 days, and have disclosed to the company s auditors and its audit committee all significant deficiencies or material weaknesses in the internal controls and any fraud committed by any person with a significant role in the internal control process. The certification requirement noted in the second bullet above, which relates to financial statements, highlights the SEC s stated position that financial statements can technically comply with GAAP and still be misleading. Audit Committees The Criminal Certification and the Civil Certification do not require that the certifying officers discuss the content of their certifications with the audit committee, although the Civil Certification requires that the certifying officers disclose to the audit committee certain matters relating to internal controls. As noted in the attached Annex, we recommend that the certifying officers consider discussing with the audit committee all of the certification requirements and any procedures adopted. If you should have any questions, please call your Davis Polk contact. Davis Polk & Wardwell copyright 2002 Davis Polk & Wardwell This memorandum is a summary for general information only. It is not a full analysis of the matters presented and may not be relied upon as legal advice. 3

4 Guidelines for Procedures in Connection with the Criminal Certification Requirement Annex A Identify Other Responsible Officers. The CEO and CFO (the Principal Officers ) should identify certain senior managers to participate in the review of the report being certified to and assist the Principal Officers in making their certifications. Principal Officers may consider including in this process: those senior managers (the Senior Managers ) who have decision-making authority over the company s business units or over other executive staff functions with the potential to have a significant impact on the company s financial performance or the accuracy of its reporting (e.g., chief internal auditing, investor relations, law, tax, benefits, executive compensation, environmental, risk management); and the company s lead audit partner. This list is consistent with a prescription in the SEC s release of June 17, 2002 that, in order to comply with proposed rules regarding certification of future periodic reports, companies should consider forming a committee, consisting of many of the executives noted above, with oversight responsibility over company disclosure. Meetings or Communications with the Senior Managers. The Principal Officers should meet or otherwise communicate with the Senior Managers and the company s lead audit partner after giving them an opportunity to read the report. These meetings or communications could take the form of active discussions with, or in certain cases presentations by, the Senior Managers regarding the process for preparing, and the sufficiency of the disclosures in, the report as concerns each Senior Manager s area of managerial control. Any such review might involve probing discussions and analyses of any difficult choices that may bear on the information contained in the report. In order to assist in maintaining a consistent standard of materiality in these discussions, the Principal Officers may wish to have inside or outside counsel participate in these meetings or discussions, or have them available for consultation. Principal Officers should consider whether meetings with Senior Managers should take place in person, where practical, and whether it is important to have an opportunity to question any Senior Managers personally outside the presence of his or her peers. Further, CEOs may wish to assess the advisability of meeting with the company s head internal auditor and its lead audit partner outside the presence of the CFO. A-1

5 Recommended Areas of Focus for Review. In addition to issues that may be specific to your company, particular attention should be paid to the following items in the review process: the use of off-balance sheet financing or special purpose vehicles; the impact on the company s financial condition or performance of affiliated or associated entities; the management discussion and analysis (i.e., md&a) section of the report, if any, with particular attention to (a) critical accounting policies and trends which would, if altered, have a significant impact on the reported financial condition or performance (especially, in many cases, revenue recognition policies and accounting reserves), and (b) liquidity and capital resources; the propriety of any characterization of costs as a capital expense; loans to or other transactions with directors, officers or significant shareholders; internal controls; derivative transactions; tax reduction strategies; goodwill and other intangible asset impairments; and exposure to the financial difficulties of any material customers or other third parties. Certification by the Senior Managers. We also suggest that the Principal Officers consider requiring the Senior Managers to make a certification that is substantially similar to the certifications that the Principal Officers must make. Since materiality standards relating to disclosure requirements are generally tested based upon the total mix of information, it may be advisable for Senior Managers (particularly those with oversight over company-wide, as opposed to individual business unit, functions) to certify as to the accuracy and completeness of the disclosure in the report as a whole. However, consideration may be given in certain circumstances to tailoring the proposed certification more specifically to the responsibilities of a given Senior Manager. Meeting with Audit Committee. The Principal Officers, the company s lead audit partner and the senior internal auditor should meet with the audit committee, if possible, to review the following: A-2

6 the internal controls that the company has and whether any material deficiencies exist, the process as conducted and the significant matters that were discussed; and any questions, concerns or comments that the committee may have regarding the review process and the disclosure in the report. Documentation of the Review Process. We recommend that the general counsel, company secretary or another appropriate legal officer of the company keep (or assist the Principal Officers in maintaining) a written record of the review process. This record should include a description of the dates and times of and participants in the meetings and any other steps that were part of the process, as well as in certain cases, a general description osf the topics covered in each part of the review process. A-3