Proposed SEC Regulations Require In-House and Outside Counsel to Report Securities Violations

On November 21, 2002, the Securities and Exchange Commission (the "SEC" or "Commission") issued proposed regulations to implement provisions of the Sarbanes-Oxley Act of 2002 (H.R. 3763) (the "Act"), requiring "up the ladder" reporting by in-house and outside lawyers of suspected corporate wrongdoing. The proposed regulations will cover past, present and future material violations of the securities laws and breaches of fiduciary duty. The text of the proposed regulations can be found at http://www.sec.gov/rules/proposed/ 33-8150.htm. Comments are due by December 18, 2002.

Perhaps the most controversial provision of the proposed regulations is the requirement that outside and inhouse counsel alike report out material violations of the securities laws directly to the SEC and disavow related SEC filings that counsel believes are inaccurate if the corporation fails to appropriately respond¹ when counsel informs it of those violations. Outside counsel are additionally required to withdraw from representing the company and provide the SEC with notice of his or her withdrawal for "professional considerations." Requiring attorneys to report violations by their clients raises important, troubling issues relating to the attorney-client privilege between the company and its lawyers. Consequently, this requirement is certain to instigate significant opposition to the proposed regulations.

These regulations, like those requiring greater corporate disclosures, certifications by CEOs and CFOs, and those directly regulating accountants that audit public companies, are part of Congress’ and the SEC’s recent efforts to dramatically increase the responsibility of directors, officers and others who oversee or participate in the preparation of public company financial statements and other disclosure. A final version of the "Standards of Professional Conduct for Attorneys Appearing and Practicing Before the Commission in the Representation of Issuers" rules will be issued by January 26, 2003, and will be new Part 205 to Title 17 of the Code of Federal Regulations.

These far-reaching regulations provide that:

• Awareness of information that would lead a reasonable attorney to believe that a material violation of the securities laws or a breach of a fiduciary duty has occurred, is occurring, or is about to occur triggers the reporting obligation.
• In-house, outside and foreign attorneys are covered by the regulations, including those with only a passing or attenuated involvement with an SEC matter or filing. Supervisory attorneys are covered if their subordinates are covered.
• The reporting obligation can be satisfied by informing a single source – the company’s Qualified Legal Compliance Committee ("QLCC"), comprised of at least one member of the audit committee and two or more independent directors.
• If the company does not have a QLCC, then the information must be reported up the ladder until the reporting attorney receives an appropriate response: first to the Chief Legal Officer, then to the audit committee, another committee that is comprised solely of independent directors, or the board of directors.
• Both in-house and outside counsel are required to report to the SEC ongoing or future violations that are likely to result in substantial injury to the company or investors if appropriate responses are not received from within the company. In addition, absent an appropriate company response, counsel must disavow all submissions with which he or she was involved that are inaccurate.
• Counsel is not required to report past violations to the SEC.
• Outside counsel is required to withdraw from representing a company if he or she reports material violations to the SEC, and inform the SEC of the withdrawal.

The proposed regulations implement § 307 of the Act, which provides:

Not later than 180 days after the date of enactment of this Act, the Commission shall issue rules, in the public interest and for the protection of investors, setting forth minimum standards of professional conduct for attorneys appearing and practicing before the Commission in any way in the representation of issuers, including a rule –

1. Requiring an attorney to report evidence of a material violation of securities law or breach of fiduciary duty or similar violation by the company or any agent thereof, to the chief legal counsel or the chief executive officer of the company (or the equivalent thereof); and
2. If the counsel or officer does not appropriately respond to the evidence (adopting, as necessary, appropriate remedial measures or sanctions with respect to the violation), requiring the attorney to report the evidence to the audit committee of the board of directors of the issuer or to another committee of the board of directors comprised solely of directors not employed directly or indirectly by the issuer, or to the board of directors.

Recognizing that the 10 pages of proposed regulations would be the subject of controversy and extended debate, the SEC issued 83 pages of explanatory text containing 93 footnotes. Although arguably most of the proposed provisions are within the mandate of Section 307 of the Sarbanes-Oxley Act, the requirement that in-house and outside counsel report violations directly to the SEC in certain situations appears to go well beyond what is required by the Act.

The SEC acknowledges that the proposed regulations take "an expansive view" of who is covered by the regulations. On their face, the regulations apply to attorneys "appearing and practicing before" the SEC, conveying the impression that only those lawyers who represent a party before an SEC administrative proceeding, represent an issuer in drafting and filing a registration statement or periodic report, or represent a company in conjunction with an SEC investigation, inquiry or subpoena are covered. Yet the definition of covered attorneys is far broader, and reaches those with only tangential involvement with the SEC or its staff or a company’s filings with the SEC.

Section 205.2(a)(4) includes lawyers "preparing, or participating in the process of preparing, any statement, opinion, or other writing which the attorney has reason to believe will be filed with or incorporated into any" filing or submission submitted to the SEC. Thus, arguably any outside or in-house counsel who simply reviews a single section of a single draft of a single filing is covered by the regulations. The regulations also expressly cover outside counsel hired to conduct an internal investigation concerning a material violation that has been reported. § 205.3(b)(6).

In keeping with the broad coverage of the regulations, attorneys "supervising, directing, or having supervisory authority over" those who "appear and practice before" the SEC are covered, and are required to make "reasonable efforts to ensure" that subordinate lawyers comply with the regulations. § 205.4(b). The supervising lawyer is required to report material violations "up the ladder" even if the supervising lawyer’s knowledge is based upon the information provided by the subordinate lawyer. § 205.4(c).

Concomitantly, a subordinate lawyer has a duty to report violations to the supervising attorney despite the fact that he or she acted at the direction of another. § 205.5(b).

The regulations also apply to foreign lawyers, who, according to the commission play "an ever greater role" in companies that file with the Commission. Thus, lawyers who are members of another country’s bar and are located abroad that prepare SEC submissions, or portions thereof, for foreign issuers are covered, regardless of whether the submissions they prepare are considered filings under the securities laws.

Covered attorneys are required to report evidence of a past, present or future material violation up the ladder. Material violations include violations of securities laws and breaches of fiduciary duty, or a similar violation. An objective, reasonable person standard is used to determine whether conduct rises to the level of evidence of a material violation.

Once the attorney concludes that there has been or will be a material violation, he or she has two options for discharging his or her reporting obligations. As discussed, the first option requires that reports be made to up to three different persons or bodies, and that the response of the first two be monitored and assessed by the reporting attorney. The second option requires a single report to a single body, with no continuing obligation for the reporting attorney to monitor the response of that body.

Under the first reporting option, the attorney reports the violation to the chief legal officer ("CLO") (and, at the attorney’s option, to the chief executive officer as well). Under this reporting option, the attorney is responsible for assessing the adequacy of the CLO’s response. If the attorney reasonably believes that the response is adequate, and he or she has documented the report and the response, no further action is required.

As discussed below, if the CLO does not provide an "appropriate response" to the reported violation, the attorney is required to report the violation "up the ladder" to either (1) the company’s audit committee; (2) another committee of the board comprised solely of independent directors; or (3) if there is no committee comprised solely of independent directors, the board of directors.²

If the reporting attorney does not believe that the board of directors or independent committee of the board has responded appropriately to the reported evidence, and that "a material violation is ongoing or about to occur and is likely to result in substantial injury"³ to investors or the company, the attorney must withdraw "forthwith" from representing the issuer. Within one business day of withdrawing he or she must notify the SEC in writing that the attorney intends to disaffirm documents or filings with the SEC that the attorney prepared or assisted in preparing that are or may be materially false or misleading. The attorney must then promptly provide a written disavowance to the SEC of such documents or filings. Outside counsel must additionally announce to the SEC that counsel is withdrawing from the representation of the company, indicating that the withdrawal is based on "professional considerations." In the case of past violations, the reporting attorney is not required to report the conduct to the SEC, but may do so voluntarily, if the attorney believes the past violation is likely to have resulted in substantial injury to company or investors.

Once the CLO receives a report of a material violation, he or she must conduct an inquiry to determine whether the reported violation occurred, is occurring or is about to occur, unless he or she reports the matter directly to the QLCC, in which case no further action is required. If the CLO determines that violations have occurred, are occurring or will occur, he or she "shall take any necessary steps to ensure that the issuer adopts appropriate remedial measures, including appropriate disclosures, and/or imposes appropriate sanctions to stop any material violation that is occurring, prevent any material violation that is about to occur, and/or to rectify any material violation that has already occurred." 205.3(b)(3). The CLO must report the remedial measures (including appropriate disclosures) and sanctions taken or imposed to the CEO, the audit committee or the board of directors, and to the reporting attorney.⁴ Once the reporting attorney receives a report from the CLO he must then determine whether the CLO’s conclusion constitutes an appropriate response. If not, the reporting attorney must report the material violation to one of the board level bodies identified above.⁵

At each step of the process, the reporting attorney must document the material violation he reports and the response of each person or body to which he reported the violation, and retain the documentation for "a reasonable time." Similarly, the CLO must document the inquiry he conducts or oversees.

At each step of the first reporting path option, the reporting attorney is required to assess the adequacy of the company’s response, and where the response is inadequate the attorney must go to a higher level within – and then outside – the company.⁶ Yet the proposed regulations offer an alternative reporting procedure that requires just a single step. By reporting a material violation to a Qualified Legal Compliance Committee ("QLCC"), the reporting attorney can satisfy all obligations under the regulations. The reporting attorney "is not required to assess the issuer’s response to the reported evidence of a material violation, and is not required" to notify the SEC, withdraw from the representation and disavow filings and documents in cases of inadequate response. The CLO may refer a report of evidence of a material violation to the QLCC, but if the company fails to take appropriate remedial measures the CLO is required to notify the SEC that a material violation is occurring or will occur and must disaffirm in writing documents that are tainted by the violation.

Although the regulations state that companies are not required to create a QLCC, the regulations encourage their creation by greatly eliminating the burden on a reporting attorney to monitor the company’s response, and to go further "up the ladder" when the corporate response is inadequate.

The SEC proposes that a QLCC consist of at least one member of the board’s audit committee, and two or more board members who are independent and not employed by the company. In order for the QLCC to qualify to serve as the body to investigate and respond to reports of material violations, the board must have empowered the QLCC to investigate reports, and required it to (1) inform the CLO and CEO of the report; (2) determine whether an investigation of the report is necessary; and (3) if appropriate, direct remedial measures, including making disclosures and imposing sanctions to stop the violations and prevent them in the future. The QLCC must have written procedures for receiving and addressing such reports.

If the company fails to take any of the remedial measures directed by the QLCC, the CLO is required to notify the SEC that a material violation has occurred, is occurring or will occur, and disaffirm any filing or document tainted by the violation. § 205.3(b)(3).

A violation of these regulations is treated as a violation of the Securities Exchange Act of 1934. § 205.6. Therefore, the attorney may be subject to injunctions, cease and desist orders, or disciplinary proceedings that could include a suspension or may be banned from practicing before the SEC.

1.The Regulations May Conflict with State Ethical Rules: The explanatory text issued by the SEC states that the proposed rule "permitting disclosure would appear to preempt a state’s rule forbidding disclosure. Accordingly, an attorney . . . admitted in a jurisdiction that forbids disclosure of confidential information under circumstances where the proposed rule would permit disclosure, may disclose the information to the Commission, notwithstanding the contrary state rule." Of course, state bars may have a different view of such disclosures. In such a situation, the lawyer is placed in the middle of two conflicting ethical responsibilities.

Just as remarkably, the proposed regulations state that a company does not waive any applicable privilege when information is provided to the SEC pursuant to the regulation, despite the fact that it is typically the case that disclosure of privileged communications to third parties (here the SEC) vitiates the privilege. The proposed regulations provide that "such sharing of information shall not constitute a waiver of any applicable privilege or protection as to other persons." § 205.3(e)(3). There is no doubt that this issue will be litigated, perhaps by plaintiffs in a shareholder action suing the company for the conduct underlying the disclosure to the SEC.

The regulations also purport to permit an attorney faced with any investigation, proceeding or litigation concerning that attorney’s compliance with his or her reporting obligations to use (presumably in his or her defense) privileged and confidential material – such as the written report of the violation and efforts undertaken in compliance with the regulations. § 205.3(e)(1). The regulations also state that an attorney appearing and practicing before the SEC in the representation of an issuer may reveal to the SEC, without the issuer’s consent, confidential information related to the representation to the extent he or she reasonably believes necessary:

1. to prevent the issuer from committing an illegal act that the attorney believes is likely to result in substantial injury to the financial interest or property of the issuer or investors;
2. to prevent the issuer from committing an illegal act he reasonably believes is likely to perpetuate a fraud on the SEC; or
3. to rectify the consequences of the issuer’s illegal act in furtherance of which his services had been used.

This provision not only raises concerns regarding the disclosure of client confidences, but a lawyer’s duty of loyalty to his client. For example, California and several other states prohibit disclosure of client confidences except to prevent death or serious bodily injury.

2. Written Documentation: The reporting attorney, the CLO and the QLCC are required to create and maintain written records regarding their role in the reporting process and their assessment of allegations of material violations. Such documents may relate to the attorney work product doctrine, and perhaps the attorney-client relationship. Requiring the creation of such documents under regulatory mandate intrudes into the attorney-client relationship, requiring the attorney to serve his personal interest (preparing adequate documentation) while he is professionally obligated to serve the interests of his client.

3. Should a Company Create a QLCC? Although the regulations do not require the creation of a QLCC, the greatly streamlined reporting structure available to those companies that have a QLCC establishes a strong incentive to create one. The regulations do not prohibit a company from utilizing its audit committee as the QLCC, so long as its members are independent.

4. Foreign Lawyers: The proposed regulations apply to foreign lawyers who are members of the bar of a foreign country. Not only does this raise jurisdictional questions, but it may also require such lawyers to engage in conduct to comply with the regulations that is inconsistent with the rules applicable to the foreign jurisdiction where the lawyer is practicing.