Audit Committee Responsibilities in SEC Investigations.

The SEC’s Division of Enforcement investigates potential securities law violations, and its teams typically include attorneys and staff accountants. Along with the Securities Exchange Act of 1934’s provisions, the SEC’s rules require that the SEC’s enforcement staff “conduct themselves in a manner that is impartial and avoids any appearance of impropriety”, but it does not define “impartiality.”

While audit committees should generally oversee investigations involving allegations of financial reporting fraud, their responsibilities in an SEC investigation will depend on whether they need to oversee independent counsel’s work or whether they can rely on internal investigations. If the need for independent counsel is clearly established, the SEC’s Division of Enforcement has the authority to request that company’s board of directors retain independent counsel, and an audit committee of the board will typically provide oversight.

What triggers an SEC inquiry?

The SEC’s Division of Enforcement handles civil and administrative enforcement actions, and refers matters warranting criminal prosecution to the U.S. Department of Justice. It has regional offices throughout the United States, and these regional offices have authority to conduct investigations both nationwide and in the district.

Staff at the SEC need only official curiosity to open an investigative inquiry. They can also rely on Tips, the company’s filings, referrals, complaints, surveillance, and information from external auditors.

How does the SEC gather information?

Once the SEC opens an inquiry, it will typically conduct a preliminary review of the company’s public filings. If this review raises additional questions, the SEC will contact the company and ask for voluntary responses to its questions. During the course of an investigation, the SEC will continue to rely on the information it has gathered from public filings, and the company’s responses to inquiries. However, if this process does not yield the information the SEC is looking for, the SEC, after obtaining a formal order of investigation, can compel the production of information by the company or individuals.

What Duties Apply Before Any SEC Investigation Begins?

Before an SEC investigation exists, Section 10A(m)(2) of the Exchange Act imposes substantive and procedural audit committee duties related to the company’s engagement of an external auditor. Among other duties, the company’s audit committee is responsible for:

• (i) the appointment, compensation, and oversight of the company’s external auditor;
• (ii) resolving disagreements between management and the external auditor concerning financial reporting; and
• (iii) ensuring that the external auditor has direct access to the audit committee.

What Are the External Auditor’s Duties?

Along with audit committees’ duties, Section 10A(b) of the Exchange Act imposes substantive and procedural duties on external auditors. Among others, the external auditor’s duties under this section include:

• (i) communicating and reporting directly to the audit committee;
• (ii) reporting materially inappropriate accounting practices to the company’s management (and then directly to the audit committee if the company’s management does not promptly and adequately address the matter);
• (iii) reporting “any other improper conduct” to the audit committee that has a substantial likelihood of material effect on the company’s financial statements or reportable information; and,
• (iv) notifying the SEC if the audit committee fails to adequately address materially inappropriate accounting practices or other improper conduct.

What Other Duties Does Section 10A(m) Impose?

In addition to the duties imposed by Section 10A(m)(2) and its corresponding duty on external auditors, Section 10A(m)(4) also imposes duties relating to audit committee procedures. Among others, this section requires companies to:

• (i) establish procedures for the receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters;
• (ii) establish procedures that allow employees to report accounting, internal accounting controls, or auditing matters confidentially and anonymously to the audit committee; and,
• (iii) a protection against retaliation for employees who report such matters, imposed by Section 806 of the Sarbanes-Oxley Act, 18 U.S.C. § 1514A, rather than by Section 10A(m)(4).

As the commentary to Section 10A(m) explains, the audit committee’s statutory duties “do not, by themselves, require an audit committee to initiate an internal investigation.” Of course, the SEC notes, “these duties are subject to further requirements in the Exchange Act and Sarbanes-Oxley,” and other circumstances can also necessitate internal investigations. Ultimately, all of Section 10A(m)’s statutory duties apply regardless of whether an SEC investigation is underway.

Who Can Serve on a Public Company Audit Committee?

An audit committee is a board committee composed of a company’s directors. Like other board committees, the company’s audit committee is subject to the applicable independence requirements, the SEC says.

One important aspect of an audit committee’s composition relates to the audit committee members’ financial-literacy and financial-expertise requirements. Along with these requirements, though, audit committee members must also meet any applicable financial-independence requirements.

What are the Audit Committee Independence Requirements?

The federal audit committee independence requirements are set forth in the Exchange Act under Rule 10A-3. However, as Exchange Act Rule 10A-3 explains, Rule 10A-3 is a “federal listing requirement.” It is one of a handful of such requirements, and the securities exchanges must implement each of these requirements within their own rules. Accordingly, the audit committee independence requirements implemented by each securities exchange will be a reflection of the audit committee independence requirements established by the SEC.

Along with Rule 10A-3’s federal listing requirements, however, securities exchanges impose governance standards for audit committees (and other board committees) as well. The NYSE, for example, requires under Section 303A.07(a) that the audit committee have a minimum of three members and that all audit committee members satisfy the independence requirements set forth in Section 303A.02 and Rule 10A-3(b)(1). Section 303A.07 incorporates, rather than displaces, the independence requirements set forth in Section 303A.02, so a director must satisfy both that general independence standard and Rule 10A-3(b)(1) to serve on the audit committee of an NYSE-listed company.

What are the Audit Committee Financial-Literacy and Financial-Expertise Requirements?

The audit committee financial-literacy and financial-expertise requirements are also established under the securities exchanges’ listing rules. The NYSE, for example, states that an audit committee must include:

• (i) members who are each “financially literate,” and,
• (ii) at least one member who has “accounting or related financial management expertise.”

The SEC establishes additional requirements for audit committee financial experts through Regulation S-K Item 407. Under Item 407, public companies must “describe whether the registrant has an audit committee financial expert.” If the company does not have an audit committee financial expert, the company must explain why. However, Item 407 does not require public companies to appoint an audit committee financial expert.

Who Controls the Company’s Internal SEC Investigation?

Who Conducts an Audit Committee’s Internal SEC Investigation?

Audit committees generally conduct internal investigations triggered by whistleblower allegations. In most cases, the internal investigation will be conducted by independent counsel; however, the scope and nature of the internal investigation could justify audit committee involvement. If there are reasonable grounds to suspect that current or former management personnel are involved in the alleged misconduct, this could justify the audit committee engaging independent counsel that is independent not only of the company, but also from any counsel that serves on a regular basis for the company.

While management personnel will almost never be permitted to control an audit committee’s internal investigation, the possibility of their involvement being revealed in the course of the investigation must be considered. If evidence reveals that current or former management personnel were involved in the misconduct (or if evidence reveals that the alleged misconduct is substantial in scope), then evidence suggests it may be appropriate to have separate legal representation in place in either case.

What Authority Does Section 10A(m) Grant Audit Committees?

Section 10A(m)(5) establishes that, in addition to the authority granted to them by other laws and rules (including the company’s bylaws), audit committees also have the authority “to engage independent counsel and other necessary advisers... as necessary to carry out any of its duties under this section.” Section 10A(m)(6) provides the procedural requirements for audit committees’ use of their authority to engage independent counsel and other advisers. Specifically, Section 10A(m)(6) requires each issuer to provide appropriate funding, as determined by the audit committee, for payment of compensation:

• (i) The issuer shall pay compensation to the registered public accounting firm employed by the issuer for the purpose of rendering or issuing an audit report; and
• (ii) The issuer shall pay compensation to any advisers employed by the audit committee under paragraph (5).

How Does This Authority Affect Control?

While Section 10A(m) addresses the external counsel and other advisers retained by audit committees during internal investigations, it does not address which individual or group controls the internal investigation. As usually occurs in the corporate context, control typically follows board delegation, committee charters, and the applicable state corporate laws governing the company’s structure.

Who Else Might Assist with an Internal Investigation?

Depending on the subject matter of the internal investigation, external counsel’s assistance may be needed from forensic accountants and information-technology specialists. In some cases, forensic accountants and IT specialists will already have information about the internal investigation, and in this case they may be able to support the internal investigation. However, if the information revealed in the course of the internal investigation raises questions about the adequacy of the company’s accounting controls or computer systems, then the audit committee should have the opportunity to select and retain the appropriate forensic accounting or IT specialists.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

How Should the Audit Committee Preserve Evidence and Privilege?

When internal investigations are necessary, the audit committee needs to be aware of the preservation of relevant information and the preservation of the attorney-client privilege.

The first step for evidence preservation is to stop any automated document-destruction programs if there is any reason to believe potentially relevant evidence exists. The second step is to provide written instructions to relevant employees that clearly set forth their preservation responsibilities regarding documents, electronic information, and other data.

What Does Fact-Finding Entail?

Internal fact-finding during an audit committee’s investigation into allegations of financial fraud may involve a variety of actions. Depending on the nature of the allegations, fact-finding efforts could include conducting interviews, mining email communications, and performing other internal data analysis. In addition to the foregoing, the scope of fact-finding efforts could involve conducting transaction-level analysis, and it may require obtaining information from the company’s business partners, vendors, and auditors.

How Does Attorney-Client Privilege Apply?

The third consideration for an audit committee is the preservation of the attorney-client privilege. As the attorney-client privilege allows clients to maintain confidentiality with their attorneys (even if the documents are not otherwise privileged), protecting this privilege is highly important during an internal investigation. Because the corporation is the client, and not the individual officers or employees involved in the internal investigation, the corporation owns the attorney-client privilege.

What Are the Risks of Disclosing Information to the SEC?

One of the most challenging aspects of an audit committee’s internal investigation is determining when and how to disclose relevant information to the SEC. Along with risking waiver of the attorney-client privilege in subsequent litigation, voluntary disclosure of internal investigation results presents additional risks. For example, if the internal investigation reveals conduct that warrants a violation of federal securities laws, the company’s voluntary disclosure may open up further government investigations. It may also open up the company’s potential liability for additional violations, and it may also have adverse effects on the company’s public disclosures and investor relations.

What is SEC “Cooperation Credit”?

The SEC presents an opportunity to obtain “cooperation credit” when conducting an internal investigation. This is an incentive that encourages companies to disclose any relevant information, even if doing so involves waiving the attorney-client privilege and/or the attorney work-product privilege. However, the SEC notes that obtaining cooperation credit does not require waiver of the attorney-client privilege or the attorney work-product privilege. The SEC also explicitly notes that there is a legal distinction between disclosing the underlying facts and disclosing the underlying attorney notes, summaries, and other privileged attorney communications.

What Happens to Conversations and Materials Not Protected by the Attorney-Client Privilege?

Although much of a company’s internal investigation will be protected by the attorney-client privilege, this does not cover everything. Communications that occurred before the engagement of external counsel or communications that took place outside external counsel’s presence, such as internal investigations’ interviews of employees, are generally not protected. Similarly, communications of an attorney’s factual notes and other materials that do not constitute attorney-client communications or attorney work-product will not fall under the attorney-client privilege.

When Must the Company Notify Auditors or Investors?

When conducting an internal investigation involving allegations of financial fraud, the company must determine if (i) the allegations, (ii) the information revealed during the internal investigation, or (iii) the internal investigation’s results trigger the duty to notify the company’s external auditor.

In fact, the SEC recognized in Staff Accounting Bulletin 99 that materiality determinations in accounting matters “require a qualitative assessment in addition to a quantitative assessment.” This recognizes that a qualitatively material accounting misstatement can be materially misleading even if the dollar amount involved is insignificant.

Regarding notice to investors, no item on Form 8-K requires public companies to file the form solely because the SEC has opened an investigation. However, Form 8-K Item 4.02 imposes a filing obligation on public companies that reach a conclusion of nonreliance after analyzing financial statement information. Specifically, Item 4.02 requires public companies that reach conclusions of nonreliance to file Form 8-K within four business days after such a conclusion.

When Does Section 10A Require Notice to the SEC?

Section 10A of the Exchange Act imposes substantive and procedural duties on external auditors when dealing with suspected illegal acts. Among others, Section 10A requires that (i) the auditor notify management and the audit committee upon detecting “information that would identify a likely consequential illegal act”, (ii) the auditor obtain “adequate” responses from management, and, (iii) the auditor, if required, determine whether the conclusions reached result in a “reasonable belief” that the illegal act has not occurred, was not material, or has been remediated.

Along with reporting to the company, the auditor has duties under Section 10A(b)(1) relating to the auditor’s notice to the SEC. Specifically, Section 10A(b)(1) requires the auditor to notify the SEC in two situations:

• (i) If, within one business day after learning of the alleged illegal act, management does not report the matter to the audit committee, or;
• (ii) If the auditor receives a report from the issuer that the audit committee rejected the auditor’s report of a “reasonably probable” illegal act.

As a result of these duties, an audit committee must determine whether an issuer’s notification deadline under Section 10A(b)(1) requires it to notify the SEC within one business day of receiving a Section 10A(b)(1) report from its auditor.

If the issuer misses its deadline, the auditor has a duty under Section 10A(b)(2) to “notify the Commission, which shall promptly investigate the matter.” The timing of an auditor’s duty under Section 10A(b)(2) is a provision of the “safe harbor” rule under Section 10A(d). This safe harbor provision prohibits auditors from being held liable in civil litigation for their notification of an alleged illegal act to the SEC. Thissafe harbor provision, however, only protects auditors from liability in civil litigation, not in enforcement actions brought by the SEC or other regulatory agencies.

Can Audit Committee Members Face Personal Liability?

What Does Remediation Entail?

The audit committee’s role in remediation involves overseeing proposed remedial measures, assessing whether the proposed remedial measures address the root causes of the conduct that warranted an audit committee’s investigation, and determining whether the company needs to disclose the remedial measures.

Depending on the nature of the conduct that warranted an audit committee’s investigation, the remediation efforts could involve disciplining current employees, implementing new procedures to combat future violations of federal securities laws, enhancing securities-related disclosures, and other actions.

What Is the Difference Between an SEC Enforcement Action and a Criminal Prosecution?

The SEC brings civil enforcement actions, which are different from criminal prosecutions. For example, the SEC has the authority to seek civil injunctions, monetary penalties, and disgorgement, but it does not have the authority to impose jail sentences. Rather, the Justice Department prosecutes criminal securities law violations, and the Justice Department has the authority to seek all available civil and criminal penalties, including fines and jail sentences.

The SEC and Justice Department can (and frequently do) conduct their investigations in parallel with one another. Because of this, it may be important for the company’s (and audit committee members’ or other individual’s) response to the SEC’s investigation to take any parallel investigations (and potential civil and criminal liability) into account.

When Can Audit Committee Members be Subject to Personal Liability?

In Delaware, audit committee members (and other corporate directors) can be subject to personal liability for oversighting failures. According to the Delaware Supreme Court, auditors must show that directors acted in “bad faith” to trigger Caremark liability, and directors’ oversight failures must go “beyond merely negligent.” The Delaware Supreme Court also explains that audit committee membership alone is not sufficient evidence to satisfy the scienter requirement under Section 10(b) of the Exchange Act.

In certain cases, though, the information contained in the company’s public filings and the information available to the company’s auditors and audit committee will be sufficient to show that directors had “actual knowledge” of known compliance red flags. If these documents, however, only establish directors’ knowledge of red flags but not “the reason why they did not address them,” then Delaware courts require plaintiffs to show that directors “consciously ignored known red flags” in order to satisfy Caremark liability.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.