"Navigating the Minefield of the SEC’s Ethics Reform Measures"

Originally published in Wall Street Lawyer, Vol. 6, No. 6, November 2002--Reprinted with permission.

When enacting the Sarbanes-Oxley Act of 2002, Congress sought to enhance the quality of corporate governance and the credibility of financial disclosures by imposing heightened responsibility and sanctions on virtually everyone involved in governance and disclosure matters, including the CEO, CFO, audit committee, outside directors, and outside auditors. Not surprisingly, outside counsel were also swept into the Act with little fanfare or clarity

Section 307 of the Sarbanes-Oxley Act required the Commission to adopt rules obligating lawyers “appearing and practicing before the Commission” to report evidence of a “material violation of securities law or breach of fiduciary duty” to a public company client’s chief legal officer, CEO or, if necessary, the audit committee or the full board. This concept is certainly not revolutionary. Legal authority and ethical rules have long required a lawyer who represents a company to report wrongdoing to appropriate persons within that entity. However, the rules the Commission outlined in a November 6 press release go much further and would create new and potentially dangerous ethical standards for lawyers.[i]

The most alarming aspect of the Commission’s proposed rules is a whistleblower provision requiring attorneys, in certain circumstances, to disaffirm an Exchange Act report or other submission filed with the Commission.[ii] The Commission stated in its press release that this “noisy withdrawal” is important in those instances where an issuer does not respond appropriately to an attorney’s concerns over material violations of the federal securities laws. While attorneys are generally prohibited from assisting a client’s fraudulent conduct, current ethical rules rarely require or even permit a lawyer to disclose a client’s past or present conduct to a third party, let alone a federal enforcement agency. This principle derives from and is firmly embedded within the attorney/client privilege and the important justifications for that privilege.

The Commission’s proposed rules will change standard practice for securities lawyers in a number of ways and raise potential Constitutional issues since the legislative and executive branches of government are arguably seeking to regulate matters heretofore reserved for the judicial branch. At the time this article went to print, the SEC had yet to publish the text of the proposed rules; once published, the rules remain subject to notice, comment, and potential revision. This article is based on the summary of the proposed rules set forth in the Commission’s November 6 press release. Each reference to the “proposed rules” assumes that the actual text of the rules will be substantially similar to the description found in the press release. Based on these assumptions, the following discussion addresses several of the issues the proposed rules would raise if adopted as currently described.

Am I subject to the new rules?

The language of Section 307 of the Sarbanes-Oxley Act specified these rules should govern the conduct of attorneys “appearing and practicing before the Commission in any way in the representation of issuers.” Without more guidance from the Commission, we believe the standards would apply only to attorneys who assist issuers before the Commission regarding the registration process, Exchange Act reporting, investigative matters, or other regulatory compliance issues. However, the proposed rules appear quite expansive and may impose these new ethical requirements on any legal professional whose services contribute to the Securities Act or Exchange Act reports of a public company—whether as outside counsel, in-house counsel, or in any other capacity. Every such attorney thus is essentially a “watch-dog” or “spy” with respect to questionable behavior. This could potentially place counsel and client in an adversarial position—a situation most ethics codes attempt to avoid. Will a client disclose to the lawyer all relevant information when seeking legal advice if concerned about what counsel may do with that information?

What kinds of misconduct must I report?

First, an attorney must be aware of evidence of a “material violation” of federal securities law or a breach of fiduciary duty that “has occurred, is occurring, or is about to occur.” The process of identifying securities law violations and breaches of fiduciary duty and determining materiality is anything but black-letter law. This identification and determination, however, is critical in deciding whether there is a duty to report.

Then, in order to have a reportable violation, the attorney must determine that disclosure of the violation will serve to protect the investing public. Where a violation is ongoing or prospective, however, the harm to investors is presumed and there is an affirmative obligation to report without such a separate determination.

Law firms representing public companies should develop educational programs and internal procedures to assist all of their attorneys in detecting and evaluating possible reportable violations. For example, firms should consider instituting a standing committee of securities practitioners to oversee this on-going process and to serve as a review board when issues arise.

How certain do I have to be that misconduct exists?

Actual knowledge of misconduct is not required. A reasonable belief is sufficient for the duty to arise. Consistent with other disclosure pronouncements made recently by the Commission, this will probably be defined to mean something lower than “more likely than not.”[iii] Taken as a whole, therefore, a “pretty good hunch” may be sufficient to trigger the duty.

There are other interpretive questions. For example, does the duty to report give rise to a corresponding duty to investigate? Imagine, for instance, a lawyer in possession of only minimal facts or facts not completely developed. In addition, will the knowledge standard be objectively or subjectively measured? In other words, will liability attach if another securities lawyer would have concluded that a violation was ongoing but this particular lawyer did not perceive a problem? Further guidance from the Commission will be necessary in each of these cases.

To whom do I first report a violation?

The proposed rules are fairly specific about reporting protocol. The first level of internal reporting is to the company’s chief legal officer or to both the chief legal officer and the chief executive officer.[iv] The issuer’s chief legal officer would then be obligated to communicate to the reporting attorney either the conclusion that no material violation exists or the remedial steps taken, which may include public disclosure of the possible violation.

A second level of internal reporting is required only when the reporting attorney does not receive an appropriate response within a reasonable time or when the reporting attorney determines a first round of reporting would not be effective. When deciding if a second level of reporting is required, an attorney faces a difficult dilemma. The reporting attorney must determine whether the chief legal officer’s legal analysis and factual knowledge are sufficient to support the conclusion that no reportable violation occurred, or whether the remedial steps taken are appropriate. In other words, the attorney must second-guess the client. While the investing public might consider it a benefit to have attorneys, both inside and outside, monitor the affairs of public companies, the reality is that it may well place lawyers and their clients in an adversarial relationship even with respect to highly subjective issues. Conversely, the chief legal officer may feel compelled to follow the reporting attorney’s conclusions in order to avoid internal turmoil, even if the chief legal officer disagrees with those conclusions.

To whom do I report if I am dissatisfied with the initial response?

A reporting attorney has several options if a second level of reporting is required, including disclosure to the issuer’s audit committee or other committee of independent directors or even to the board itself. If the attorney receives inadequate responses, then he or she may be required to continue reporting the problem “up the ladder” until all avenues within the company have been exhausted.

Do reports of material violations need to be in any specific form?

No particular form is required, but attorneys will be required to take reasonably appropriate steps to document not only each such report but also the responses received. This kind of documentation would be prudent even if not required by the proposed rules. Contemporaneous documentation of events would be helpful evidence if the Commission, the company, directors, or shareholders later challenged an attorney’s compliance with the proposed rules.

Law firms should consider developing consistent procedures for documenting all identified or potential reportable violations and how each was handled. This procedure should explain how potential violations are evaluated and by whom, and should identify to whom and when the report was sent, when a response was received, and what it was. Any attorney within the firm who provides notice of a reportable violation should forward a copy to a central repository within the firm to be retained in the event there is a future dispute over the notice.

When must I disclose information regarding a material violation to the Commission?

In general, an outside attorney must disaffirm any report or submission to the Commission whenever the attorney has reason to believe the submission has been “tainted by a material violation.” The Commission has exempted inside lawyers from this portion of the proposed rules on the theory that in-house attorneys face greater potential obstacles to, and potentially higher personal cost of, compliance. In addition to this mandatory disclosure to the Commission, the rules may describe other circumstances in which an attorney can choose to notify the Commission that he or she is disaffirming a report.

Is there any way to avoid disaffirming a client’s filing with the Commission?

Yes, but only if the client has a Qualified Legal Compliance Committee. If so, then the two-tiered reporting approach does not apply and the attorney needs to report only to the QLCC. The advantage to the reporting attorney is that if such a committee has been set up, the reporting attorney’s disclosure obligations end there and never rise to the level of notifying the Commission. That duty is, in effect, transferred from the reporting attorney to each member of the QLCC.

If appropriate remedial measures are not taken or disclosures are not made after a QLCC has taken up the matter with the company, then it is up to the members of the QLCC to notify the Commission of the material violation. If a company elects to have a QLCC, it must include no fewer than three independent directors and at least one of them must also serve on the audit committee.

What happened to the attorney/client privilege?

The proposed rules attempt to create exceptions to the attorney/client privilege and obligations of confidentiality in two respects. First, the proposed rules require attorneys to make certain disclosures that on their face breach the attorney’s duty of client confidentiality, and then purport to create a federal exception to allow for such a breach.[v] Second, the proposed rules create situations where an attorney is permitted, but not required, to make disclosures that would otherwise breach standards of confidentiality and attorney/client privilege.[vi] Reporting attorneys would be permitted to use contemporaneous records of communications and disclosures in defending charges of attorney misconduct. They would also be permitted to reveal information that would otherwise be confidential to the Commission to prevent the commission of an illegal act, the perpetration of a fraudulent act, or to rectify a prior illegal action.

A related issue that will likely be hotly debated is whether an attorney’s report of a possible violation is discoverable by plaintiffs in litigation or is a privileged communication. Typically, the privilege attaches only to communications in connection with rendering legal advice in an attorney-client relationship. Arguably, those criteria do not apply to reports mandated by the proposed rules. This risk could further exacerbate the conflict between the company and counsel.

What kind of liability might I face for non-compliance with the proposed rules?

The proposed rules create several areas of potential exposure for attorneys who represent public companies, including sanctions for non-compliance, malpractice claims, Section 10(b) claims, claims based on conflicts of interest, and claims brought by non-client third parties.

Sanctions under the Exchange Act. As described in the November 6 press release, the Commission believes a violation of the proposed rules is a violation of the Exchange Act. Attorneys who fail to comply with the proposed rules thus would face any sanction or remedy applicable to violations of other Exchange Act rules, including injunctions, cease and desist orders, and officer and director bars for attorneys who are officers and directors.

Malpractice claims. The proposed rules may form a baseline standard of conduct for any attorney representing a public company. In that event, failure to comply with these standards may result in claims of malpractice by plaintiffs arguing that such noncompliance constitutes de facto proof of negligence. Such a malpractice claim could be brought by the company directly or could be brought derivatively on behalf of the company by its shareholders. Such claims could allege that the attorney did not notify management of evidence of a material violation or adequately monitor responses to a report as specifically outlined in the proposed rules. The argument would follow that corrective actions would have been taken and any resulting harm could have been avoided if only the attorney had provided the appropriate notice or followed up more diligently. Objective good faith, such as an honest misunderstanding of the applicable facts or failure to bring the reportable violation to the attention of management as required, may not be a defense in such a claim.

Section 10(b) claims. Perhaps more alarming is the prospect that the proposed rules could serve as a basis for shareholders to allege the non-conforming attorney was reckless and thus liable as a direct violator of Section 10(b) of the Securities Exchange Act when the company disseminates false or misleading information. In other words, the securities plaintiffs’ bar may well attempt to use the new rules to effectively circumvent the U.S. Supreme Court’s ruling in Central Bank v. First Interstate Bank, in which the Court eliminated aiding and abetting liability under Section 10(b) of the Exchange Act.[vii]

Claims based on conflicts of interest. Lawyers owe their clients a duty of undivided loyalty. Conflict of interest claims are routinely couched as a breach of that duty. Most commonly, a conflict exists when the lawyer undertakes to represent both a corporation and its individual directors and officers without realizing that the interests of the parties are distinct. The proposed rules affirmatively reinforce the concept that “an attorney representing an issuer represents the issuer as an entity rather than the officers or others with whom the attorney interacts in the course of the representation.”

Several provisions of the Sarbanes-Oxley Act and the proposed rules create potential conflicts between the company and its management, thereby necessitating separate representation. Examples of such conflicts include:

• when a CEO or CFO is unable or unwilling to provide required financial statement certification;
  
• when an officer faces the forfeiture of his or her bonus or equity-based compensation because of a restatement;
  
• when an officer or director is contemplating a stock trade during a pension fund blackout period;
  
• when an officer or director is dealing with the issuer concerning a loan or extension of credit;
  
• issues involving the CFO’s Code of Ethics; and
  
• issues where the attorney has a duty to report and possibly investigate the actions of management.

Law firms representing public companies are well advised to have clearly articulated policies concerning a lawyer’s ability to represent a corporation as well as its directors and executive officers. Firms should also specifically remind their attorneys of such policies and inform corporate clients of the potential for such divergent interests. Directors and officers should be told that they can and should retain separate counsel under certain circumstances.

Claims by non-client third parties. As a general principle, lawyers do not owe a duty of care to non-client third parties. Nevertheless, some courts have found lawyers liable to third parties in situations where the lawyer knew, or reasonably should have known, that the third party would rely on the lawyer’s advice or work.[viii] One potential result of the “whistleblower” provisions in the proposed rules is that shareholder groups may bring additional actions against lawyers. Such actions will likely allege that it was reasonably foreseeable that the shareholders would rely on the lawyer’s required vigilance against fraud or other misconduct. Although there remains a significant amount of disagreement among the courts in this area, many claims of this type should be dismissed based on lack of standing by the third-party plaintiff. Alternatively, shareholders may allege that the lawyer’s failure to fulfill his or her watchdog function constituted a direct violation of the securities laws for which the shareholders may recover if such failure was reckless and contributed to a misrepresentation or omission of material facts by the company.

Lawyers and law firms representing clients in jurisdictions that have historically shown a tendency toward finding liability in non-client, third-party situations (California for example[ix]) should recognize the increased possibility of shareholder claims under this theory. In these cases, lawyers and law firms should review their form engagement letter to ensure that it contains an explicit provision indicating that the law firm has not assumed representation of any constituent group beyond that of the entity itself. Such a disclaimer is appropriate in any situation where benefits could be viewed as running to third parties, and is contemporary evidence that the contracting parties did not contemplate any third party beneficiaries.

Will reporting a possible violation affect my ability to defend the company in litigation arising from the same facts?

The proposed rules do not expressly affect a law firm’s subsequent representation of the company or its directors and officers as defense counsel. However, if issues arise in the litigation relating to an attorney’s report, the law firm may be disqualified to serve as defense counsel. A reporting attorney should consider describing this risk to the client at the beginning of the litigation representation.

Conclusion

Sarbanes-Oxley’s mandate for new minimum standards of conduct for attorneys practicing before the Commission will have a significant impact on securities lawyers. Lawyers who do not heed these new responsibilities and adopt new “best practices” to meet such obligations will be at an increased risk for any number of claims. Only time will tell whether lawyers who do heed their new responsibilities suffer a different kind of unintended consequences in their client relationships.

[i] SEC Press Release, “SEC Proposed Rules to Implement Sarbanes-Oxley Act Provisions Concerning Standards of Professional Conduct for Attorneys” (Nov. 6, 2002).

[ii] To be found in Section 205.3(d) of the proposed rules.

[iii] See Securities Act Release No. 8056, Commission Statement about Management’s Discussion and Analysis of Financial Condition and Results of Operations (Jan. 22, 2002).

[iv] With only the press release to study, it is unclear whether the chief executive officer alone can function as the recipient of the first level report in cases where the client does not maintain an in-house lawyer.

[v] See Section 205.3(d)(1)(iii) and 205.3(d)(2)(ii) of the proposed rules. We raise the questions, without further analysis, whether the Commission has the authority to grant a federal exception to a duty of confidentiality created and governed by the individual states.

[vi] See Section 205.3(e) of the proposed rules.

[vii] Central Bank of Denver v. First Interstate Bank of Denver, 511 U.S. 164, 114 S. Ct. 1439 (1994).

[viii] See Molecular Technology Corp. v. Valentine, 925 F.2d 910 (6th Cir. 1991) (an attorney who prepared offering materials owed a duty of care to third parties who the attorney knew or reasonably should have known would rely on the information). Compare Schatz v. Rosenberg, 943 F.2d 485 (4th Cir. 1991), cert. denied, 112 S. Ct. 1475 (1992) (an attorney cannot be held liable to third parties absent a fiduciary or other confidential relationship).

[ix] See Biakanja v. Irving, 49 Cal.2d 647, 320 P.2d 16 (1958).