Legal Alert: Sarbanes-Oxley Act Certification Requirements and Best Practices September 12, I. Introduction

Transcription

1 Legal Alert: Sarbanes-Oxley Act Certification Requirements and Best Practices September 12, 2002 I. Introduction Since the Sarbanes-Oxley Act of 2002 (the Act ) became law on July 30, 2002, much attention has been given to the CEO/CFO certification requirements of Sections 302 and 906 of the Act. Following the enactment of the Act, there was some debate as to whether or not Section 906 was intended to take effect immediately and impose its own certification requirement, or rather if it was to serve as the criminal complement to the civil certification requirement of Section 302, enabling the U.S. Department of Justice to seek criminal penalties against officers who knowingly give false Section 302 certifications. Because Section 906 did not have a delayed effective date, and because the certification requirements of Section 906 are different from those of Section 302, and in the absence of government clarification otherwise, securities law practitioners have concurred that Section 906 imposed an immediate certification requirement for all Forms 10-K, 10-KSB, 10-Q and 10-QSB, and in the case of foreign issuers, Forms 20-F and 40-F (such forms being sometimes collectively referred to herein as periodic reports ) filed following the President s signing of the Act into law on the morning of July 30, Then, on August 27, 2002, the SEC adopted a final rule to implement the CEO/CFO certification requirements of Section 302 of the Act. As a result, CEOs and CFOs are now required to sign two separate certifications. The first is the already applicable Section 906 certification and the second is the recently adopted Section 302 certification. Although these certifications may in the future become a single combined certification, the SEC has made clear that CEOs and CFOs are required to sign two separate certifications until the U.S. Department of Justice construes Section 906 to permit a single combined certification. The SEC s reluctance to interpret Section 906 to permit a single combined certification stems from the fact that Section 906 amends the federal criminal code and, as a result, it is not clear that the SEC possess the authority to clarify or otherwise administer it. This Legal Alert addresses these two different certification requirements and provides practical advice on how to prepare for them.

2 II. Section 302 Certifications A. General Section 302 of the Act directed the SEC to promulgate rules by August 29, 2002 requiring CEOs and CFOs of all public companies to certify for each annual and quarterly report under Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (the Exchange Act ) filed with the SEC that, to their knowledge, such report does not contain any untrue statement or omission of a material fact, and fairly presents in all material respects the company s financial condition and results of operations. Section 302 of the Act also required CEOs and CFOs to certify as to the effectiveness of the company s internal controls in ensuring that material information about the company is made known to the certifying officers. On August 27, 2002, the SEC adopted rules to implement the CEO/CFO certification requirements of Section 302 of the Act. The SEC rules require each CEO and CFO, individually, to certify in each quarterly and annual report, including transition reports, filed or submitted by the company under Section 13(a) or 15(d) of the Exchange Act, that: 1. he or she has reviewed the periodic report; 2. based on his or her knowledge, the periodic report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by the periodic report; 3. based on his or her knowledge, the financial statements, and other financial information included in the periodic report, fairly present in all material respects the financial condition, results of operations and cash flows of the company as of, and for, the periods presented in the periodic report; 4. he or she and the other certifying officer(s): are responsible for establishing and maintaining disclosure controls and procedures (a newly-defined term reflecting the concept of controls and procedures related to disclosure in SEC filed reports) for the company; have designed such disclosure controls and procedures to ensure that material information is made known to them, particularly during the period in which the periodic report is being prepared; Sutherland Asbill & Brennan LLP 2

3 have evaluated the effectiveness of the company's disclosure controls and procedures as of a date within 90 days prior to the filing date of the periodic report; and have presented in the periodic report their conclusions about the effectiveness of the disclosure controls and procedures based on the required evaluation as of that date; 5. he or she and the other certifying officer(s) have disclosed to the company's auditor and to the audit committee of the board of directors: all significant deficiencies in the design or operation of internal controls (a pre-existing term relating to internal controls regarding financial reporting) which could adversely affect the company's ability to record, process, summarize and report financial data and have identified for the company s auditors any material weaknesses in internal controls; and any fraud, whether or not material, that involves management or other employees who have a significant role in the company s internal controls; and 6. he or she and the other certifying officer(s) have indicated in the periodic report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of their evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses. As a corollary to this certification requirement, new Exchange Act Rules 13a-15 and 15d- 15 require a company to maintain disclosure controls and procedures to ensure that material information about it is disclosed in its Exchange Act reports. This requirement extends beyond periodic reports in an effort to ensure timely collection and evaluation of information potentially subject to disclosure under all Exchange Act reports, including not only periodic reports (Forms 10-K, 10-KSB, 10-Q, 10-QSB, 20-F and 40-F), but also current reports (Forms 8-K and 6-K), definitive proxy materials (Schedule 14A) and definitive information statements (Schedule 14C) filed with the SEC. The new rules also require disclosure in periodic reports of the CEO s and CFO s evaluation of the company s disclosure controls and procedures and changes in internal controls. B. Compliance Dates Paragraphs 1, 2 and 3 of the certification apply to any quarterly or annual report, including transition reports, filed after August 29, Paragraphs 4, 5 and 6 of the certification apply to any quarterly or annual report, including transition reports, filed for periods Sutherland Asbill & Brennan LLP 3

4 ending after August 29, The rules requiring companies to maintain disclosure controls and procedures to ensure that material information about them are disclosed in their Exchange Act reports became effective on August 29, The rules requiring an evaluation of the effectiveness of the company s disclosure controls and procedures within 90 days prior to the filing of a periodic report, and disclosure in the report as to the conclusions resulting from such evaluation, are applicable to quarterly and annual reports, including transition reports, for periods ending after August 29, C. Content of Certification Material Accuracy and Completeness The certification statement concerning the material accuracy and completeness of the periodic report mirrors the existing statutory disclosure standards for material accuracy and completeness of information contained in such reports. Information will be considered material if the reasonable shareholder would consider the information in deciding whether to purchase or sell securities 1 or there is a substantial likelihood that the fact would have been viewed by a reasonable investor as having significantly altered the total mix of information made available. 2 Fair Presentation of Financial Statements and Other Financial Information The certification statement regarding fair presentation of financial statements and other financial information is not limited to a representation that the financial statements and other financial information have been presented in accordance with generally accepted accounting principles and is not otherwise limited by reference to generally accepted accounting principles. The certification provides that the overall financial disclosure fairly presents, in all material respects, the company's financial condition, results of operations and cash flows. This certification is intended to provide assurances that the financial information disclosed in the periodic report, viewed in its entirety, meets a standard of overall material accuracy and completeness that is broader than financial reporting requirements under generally accepted accounting principles. According to the SEC, a fair presentation of a company s financial condition, results of operations and cash flows encompasses: the selection of appropriate accounting policies; 1 See Basic Inc. v. Levinson, 485 U.S. 224 (1988). 2 See TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976). Sutherland Asbill & Brennan LLP 4

5 the proper application of appropriate accounting policies; the disclosure of financial information that is informative and reasonably reflects the underlying transactions and events; and the inclusion of any additional disclosure necessary to provide investors with a materially accurate and complete picture of a company s financial condition, results of operations and cash flows. It should be noted that the financial disclosure covered by this certification includes financial statements (including footnote disclosure), selected financial data, MD&A and other financial information in the periodic report. Maintenance of Disclosure Controls and Procedures For purposes of the new rules, the term disclosure controls and procedures means controls and other procedures of a company that are designed to ensure that information required to be disclosed by the company in the reports filed by it under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in its Exchange Act reports is accumulated and communicated to the company s management, including its principal executive and financial officers, as appropriate to allow timely decisions regarding required disclosure. The SEC included this new definition to differentiate this concept of disclosure controls and procedures from the pre-existing concept of internal controls that pertains to a company s financial reporting and control of its assets, as currently embodied in Section 13(b) of the Exchange Act. D. Company Obligation to Maintain Disclosure Controls and Procedures The SEC s new rules require each company filing Exchange Act reports to maintain disclosure controls and procedures that provide reasonable assurances that the company is able to collect, process and disclose information required in these reports. These new rules complement existing requirements for companies to establish and maintain systems of internal controls with respect to their financial information. It is important to note that although the Section 302 certification is only filed with periodic reports (Forms 10-K, 10-KSB, 10-Q, 10-QSB, 20-F and 40-F), the requirement as to maintenance of disclosure controls and procedures is intended to facilitate the proper and timely collection and reporting of information under these and other Exchange Act reports (which includes Forms 10-K and 10-Q as well as Forms 8-K, 6-K and proxy statements). Sutherland Asbill & Brennan LLP 5

6 Disclosure controls and procedures are intended to cover a broader range of information than is covered by a company s internal controls related to financial reporting. For example, the procedures should ensure timely collection and evaluation of information that is relevant to an assessment of the need to disclose developments and risks that pertain to the company s business that do not necessarily implicate financial reporting requirements. The SEC s new rules also require the company, under the supervision of the CEO and CFO, to conduct an evaluation of the effectiveness of the design and operation of the company s disclosure controls and procedures within 90 days of the filing date of any periodic report with the SEC. Although the new rules do not provide detailed procedures for such an evaluation, the evaluation must, at a minimum, address the matters specified by the rules. We note that a company that fails to maintain adequate disclosure controls and procedures, review them and otherwise comply with the new rules could be subject to SEC action for violating the new rules even where the failure did not lead to flawed disclosure. E. Form of Certification The Section 302 certification must be in the exact form required by the SEC, as reflected in the amendment to the applicable form. The wording of the required certification may not be changed in any respect (even if the change would appear to be inconsequential in nature). A separate certification must be provided for the CEO and CFO of the company. We have attached as Appendix I the form of the certification required to be signed in connection with a Form 10-K filing. F. Location of Certification Section 302 of the Act states that the required certification is to be included in each quarterly or annual report filed with the SEC under either Section 13(a) or 15(d) of the Exchange Act. To implement this directive, the SEC has amended Forms 10-K, 10-KSB, 10-Q, 10-QSB, 20-F and 40-F to require that the certifications follow immediately after the signature section of these periodic reports. III. Section 906 Certifications A. General Section 906 of the Act imposes a criminal penalty for knowingly false certifications based upon a certification requirement that is similar to, but in some respects broader than, the certification requirement of Section 302. The Section 906 certification represents that the periodic report which it accompanies fully complies with the requirements of Section 13(a) or Sutherland Asbill & Brennan LLP 6

7 15(d) of the Exchange Act and that the information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of the company. The date of greatest significance in this regard was August 14, 2002, the deadline for filing the next Form 10-Q for calendar year companies after the enactment of the Act. Because rules or interpretations with respect to the requirements of Section 906 were not promulgated before August 14, much was left for securities law practitioners to interpret under Section 906. For instance, Section 906 requires that each filed periodic report containing financial statements be accompanied by the requisite certification. While there was little debate as to whether 10-Qs that were due on August 14 met the requirement of being periodic reports containing financial statements, questions as to the form that the Section 906 certification should take, and how it should be provided, remained. The issue was not merely one of style but of substance since, if the criminal certification of Section 906 were included as a part of the Form 10-Q (as an exhibit or as part of the body of the Form 10-Q), the result could be civil liability for an incorrect certification that by its statutory terms gave rise only to criminal liability. Companies, with the assistance of counsel, have attempted to reason their way through the requirements of Section 906 to arrive at sound approaches for complying with its certification requirement while not exposing the company to unnecessary additional risks. B. The Approaches Before August 14, two primary approaches had been recommended by securities law practitioners to respond to the form, and location, of the Section 906 certification requirement. First, some advocated giving the certification outside of the document being certified, for instance in correspondence delivered to the SEC contemporaneously with the filing of a Form 10-Q. The certification may in this situation be publicized under Item 9 of Form 8-K, or mention of the certification (without inclusion of the certification itself) may be made in the Form 10-Q, in either case purely for informational purposes. This approach enables the Section 906 certification to accompany the Form 10-Q without actually being part of the Form 10-Q. Excluding the Section 906 certification from the Form 10-Q itself is also intended to keep the certification from being incorporated by reference into a registration statement under the Securities Act of 1933 (the Securities Act ) (such as a Form S-3 registration statement), and thereby to avoid civil liability under Sections 11 and 12(a)(2) of the Securities Act should the Section 906 certification prove to be inaccurate. Second, and alternatively, some have advocated the inclusion of the Section 906 certification in the document with respect to which the certification is being given (e.g., a Form 10-Q or 10-K), either in the body of the filing or as an exhibit to the filing. This approach is based upon a reading of the statutory requirement that the periodic report be accompanied by the Section 906 certification as requiring that the certification be part of the document being Sutherland Asbill & Brennan LLP 7

8 certified. Also, and regardless of the statutory interpretation accepted by a company, there has been a perceived public relations benefit to the open inclusion of the certification as part of the document being certified rather than hiding it in correspondence to the SEC, notwithstanding the potential civil liability exposure that this approach may create. In addition to the questions regarding the form and location of the Section 906 certification, the Act is not clear whether it is appropriate for CEOs and CFOs to qualify their certifications to their best knowledge. We believe that it is advisable and appropriate for CEOs and CFOs to qualify their certifications to their best knowledge. This qualification is in conformity with the standard set forth in the criminal penalties portion of Section 906, which applies to whoever certifies any statement... knowing (emphasis added) that the periodic report accompanying the statement does not comport with [Section 906] and willfully certifies any statement... knowing (emphasis added) that the statement regarding the periodic report accompanying the statement does not comport with [Section 906]. The final interpretative question under Section 906 centers around whether Forms 8-K and 6-K are covered by the Section 906 certification when these forms include financial statements. The controversy arose because Section 906 states that CEOs and CFOs shall certify each periodic report containing financial statements filed under the Exchange Act. Some securities law practitioners believe that a Section 906 certification is required when a company files a Form 8-K or a Form 6-K that contains financial statements. However, because the SEC has historically recognized that Forms 8-K and 6-K are current reports and not periodic reports, we do not believe that a Section 906 certification is required in connection with the filing of a Form 8-K or 6-K, even if it includes financial statements. As support for this position, the SEC recently stated in the Section 302 certification release that reports that are current reports, such as reports on Forms 6-K and 8-K, rather than [quarterly and annual reports] are not covered by the [Section 302] certification requirement. C. What Happened Although many lawyers argued in favor of giving the Section 906 certification in correspondence to the SEC rather than as part of the Form 10-Q for the period ending June 30, 2002, it appears that a majority of companies may have elected to do the opposite. Our survey indicates that: Among Fortune 100 companies that filed Form 10-Qs in August 2002, approximately 85% filed the Section 906 certification as part of the Form 10-Q itself, generally as an exhibit (rather than in separate correspondence to the SEC or another method to avoid inclusion of the 906 certification in the Form 10-Q). Sutherland Asbill & Brennan LLP 8

9 Based on data provided to us by financial printers with respect to Forms 10-Q filed in August 2002 by approximately 350 companies, approximately 65% of those companies submitted the Section 906 certification as part of the Form 10-Q itself, again, generally as an exhibit. Based on an independent survey of 1,700 Forms 10-Q filed from July 30, 2002 through August 12, 2002, 56% included the certifications within, or filed as an exhibit to, the Form 10-Q. Thus, and assuming that these samplings are reflective of the overall filing choices by public companies, it appears to be the case that the majority of public companies have elected to include the Section 906 certification as part of the document being certified. Whether this evolves into the dominant approach to delivering the Section 906 certification will depend to a large extent on whether the U.S. Department of Justice provides further guidance as to the form and method of providing the Section 906 certification. With respect to the use of a knowledge qualifier in the Section 906 certification, the independent survey of 1,700 Forms 10-Q filed from July 30, 2002 through August 12, 2002 referenced above found that 30% (284 of the 951 Forms 10-Q containing Section 906 certifications) contained certifications that were qualified to the CEO s and CFO s knowledge or best knowledge. IV. Preparing for CEO and CFO Certifications The requirements of CEO and CFO certifications under Sections 302 and 906 of the Act, while at least in theory not imposing new substantive requirements over what should have been occurring prior to July 30, 2002, have ushered in a new era of care and scrutiny in the preparation of periodic reports. The increased public and governmental scrutiny, and the requirement that the CEO and CFO sign on the dotted line, have made establishing solid review and approval processes, and the documentation of the processes undertaken, more important than ever. Each group involved in the preparation of the filing must work to complete these processes on a common timeline; time must be allotted for management, and the CEO and CFO in particular, to be engaged in these processes and to provide meaningful oversight and input; management must read the periodic report, receive regular reports from those most closely involved in preparing it and have the opportunity to ask questions of these individuals, consult with legal counsel, outside auditors and other professionals, and have the ability and opportunity to make revisions to the periodic report as appropriate; and as the periodic report filing date approaches, the various constituencies must be prepared to give the ready for launch order so that the CEO and CFO can give the required certification. Sutherland Asbill & Brennan LLP 9

10 The following is a summary of what we believe to be best practices, or at least considerations, for public companies when establishing procedures for submitting periodic reports to the SEC and developing timelines and responsibilities so that these periodic reports can be prepared in a careful and thorough manner. These procedures and practices should be tailored to a company s particular facts and circumstances. Establish a timeline with an allocation of responsibilities. Work backward from the target filing date and determine which actions will need to be taken, by when and by whom. Build upon current best practices. Companies should not go back to the drawing board, but rather should augment procedures that have proven effective, or work them into a new process. Budget for one or more cross-checks or double-checks. Companies cannot assume that nothing will go wrong in the course of preparing and filing the periodic report. There are more eyes on the periodic report, and everyone with a hand in the process should have the ability to postpone the process if they see a problem. Companies should allow for sufficient time to perform tasks that may not have been completed earlier, or simply to do cross-checks and double-checks to ensure accuracy and completeness of the periodic report. Provide for a regular flow of information to the CEO and CFO. CEOs and CFOs should be given sufficient time to review and comment on periodic reports. They must be engaged in the process of preparing these periodic reports and understand the key judgments that are being made in the process. Regular meetings should be scheduled with lower-level officers to verify that disclosure (including financial statements) is complete, accurate and has been properly prepared. Engage the Audit Committee and the Board. Just as the CEO and the CFO need to be involved in the process of preparing the periodic report, so should the audit committee. The audit committee should be involved in designing the pre-filing process and in key decisions regarding the periodic report. Before the periodic report is submitted, the audit committee must have an opportunity to review the periodic report, and the CEO and CFO must meet with the audit committee to review the contents of the periodic report. The audit committee should review and work with the CEO and CFO to analyze the effectiveness of internal controls and confirm that they are adequate. Confirm effectiveness of disclosure controls and procedures. Policies and procedures should be implemented by the board of directors to make clear that the Sutherland Asbill & Brennan LLP 10

11 CEO and CFO are responsible for establishing and maintaining the company s disclosure controls and procedures. The CEO and CFO must confirm that adequate controls and procedures exist internally to ensure that the company will be able to timely disclose required information. We note that the SEC did not specify particular disclosure controls and procedures that a company must adopt because of the recognition that such controls and procedures will vary depending on the particular company. Consider creating an informal or formal review committee. As recommended by the SEC, companies should consider creating an informal or formal committee (or expanding the role of a standing committee) with responsibility for considering the materiality of information and determining disclosure obligations on a timely basis. Such a committee would report to senior management, including the CEO and the CFO, who bear express responsibility for designing, establishing, maintaining, reviewing and evaluating the company s disclosure controls and procedures. If there is a problem, elevate it quickly. If a problem is discovered in the course of preparing the periodic report, it should be elevated quickly to the CEO and CFO, and in all likelihood to the audit committee as well. The most significant issues should be elevated to the board of directors. Make outside advisors a part of the team. Factor adequate review time of legal counsel and auditors into the process and obtain their input before documents are submitted to the CEO, CFO or audit committee as often as possible. Remember the big picture. Sections 302 and 906 require the CEO and CFO to certify that the periodic report fairly presents, in all material respects, the financial condition and results of operation (and, in the case of Section 302 certifications, the cash flows) of the company. It does not limit fair presentation to a determination in accordance with generally accepted accounting principles. CEOs and CFOs should ensure that material items known to them are adequately disclosed, regardless of the accounting treatment. Consider obtaining supplemental certifications. Consideration should be given to receiving supplemental certifications from all levels of management or outside advisors to ensure that appropriate deliberation of the process has been given. Document the process. A careful and thorough process, once established and followed, should be documented for the record. Sutherland Asbill & Brennan LLP 11

12 V. More Certifications on the Horizon This Legal Alert may not be the last time you will hear about certifications. The SEC is still considering whether it should extend a certification requirement to other documents filed under the Exchange Act, such as registration statements on Form 10 and definitive proxy and information statements. VI. Further Information This publication has been prepared solely for informational purposes and is not intended as legal advice. For more information about the matters discussed in this Legal Alert, please contact the Sutherland Asbill & Brennan LLP attorney with whom you work, or any of the attorneys listed below. ATLANTA WASHINGTON, D.C. Robert J. Pile Cynthia M. Krus Jeffrey M. Taylor Harry S. Pangas Sutherland Asbill & Brennan LLP 12

13 Appendix I FORM OF CERTIFICATIONS* I, [identify the certifying individual], certify that: 1. I have reviewed this annual report on Form 10-K of [identify registrant]; 2. Based on my knowledge, this annual report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this annual report; 3. Based on my knowledge, the financial statements, and other financial information included in this annual report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this annual report; 4. The registrant's other certifying officers and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-14 and 15d-14) for the registrant and have: a) designed such disclosure controls and procedures to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this annual report is being prepared; b) evaluated the effectiveness of the registrant's disclosure controls and procedures as of a date within 90 days prior to the filing date of this annual report (the "Evaluation Date"); and c) presented in this annual report our conclusions about the effectiveness of the disclosure controls and procedures based on our evaluation as of the Evaluation Date; 5. The registrant's other certifying officers and I have disclosed, based on our most recent evaluation, to the registrant's auditors and the audit committee of registrant's board of directors (or persons performing the equivalent functions): a) all significant deficiencies in the design or operation of internal controls which could adversely affect the registrant's ability to record, process, summarize and report financial data and have identified for the registrant's auditors any material weaknesses in internal controls; and Sutherland Asbill & Brennan LLP 13

14 b) any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant's internal controls; and 6. The registrant's other certifying officers and I have indicated in this annual report whether there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of our most recent evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses. Date:... [Signature] [Title] * Provide a separate certification for each principal executive officer and principal financial officer of the registrant. The required certification must be in the exact form set forth above. *Sutherland Legal Alerts are intended to provide clients with information on recent legal developments, not to render legal advice. Sutherland Asbill & Brennan LLP 14