The Message from Congress: Boards Should Retake the Reins
John P. Beavers
September 2002
First, Enron captured the headlines. Then, the U.S. House of Representatives
passed a bill directing the SEC to determine how to increase accountability. And
before the U.S. Senate could consider the Houses version of the bill,
Adelphia, Dynegy, ImClone, Qwest, Tyco, and WorldCom captured the headlines. The
Senate and eventually all of Congress responded beginning with the
Sarbanes-Oxley Act of 2002. The Congressional message is clear: American
businesses need to do a better job of governing themselves.
The American Corporate Model
Until Enron, the American corporate model was the envy of the world.
Stockholders as owners do not directly manage, but elect governing boards to
direct management. A governing board's function is to give direction by
decision-making, oversight, and mentoring.
Boards function by delegating. They delegate to management the authority and
responsibility for executing and managing the corporation's everyday affairs. In
the American corporate model, management is headed by a CEO, who typically has
the power to hire, fire, and compensate every other member of management.
With Sarbanes-Oxley, Congress is regulating the delegation of authority and
responsibility by the board. Congress believes that too much authority has been
given to, or usurped by, management without sufficient accountability to the
board and stockholders. Sarbanes-Oxley is Congress' first step to restore
authority to the board and increase the accountability of management.
Restoring the Boards Authority
The Congressional view of board authority is clearly evident in
Sarbanes-Oxleys audit committee provisions. Congress is forcing management to
return control of the audit process to the board.
In the Congressional view, the audit process is, itself, an oversight
function that is to be directed by the board. It defines audit in
oversight language as an examination of the financial statements... for the
purpose of expressing an opinion on such statements as to their compliance
with generally accepted accounting principles and federal securities laws.[1]
Accordingly, Congress requires that independent board members and not management
are to:
Hire, fire, and compensate the auditors, subject to shareholder approval;
Oversee the auditors work and resolve any disagreements between
management and the auditor;
Establish procedure for and receive complaints, including anonymous
submissions by employees;
Engage independent counsel and other advisers, the fees for which must be
provided by the issuer;
Determine the scope of the auditor's engagement, subject to disclosure to
investors;
Receive reports from the auditor on policies used and alternative
treatments discussed with management, as well as those considered preferred;
and
Receive and determine remedial action to take regarding any illegal act
brought to its attention by the auditor.[2]
Although much of what Congress has done is consistent with the
recommendations in the 1999 Report of the Blue Ribbon Committee on Improving
the Effectiveness of Audit Committees, Congress has gone beyond the Blue
Ribbon Committees recommendations. The importance to Congress of returning
authority from management to independent directors is evident by the mandate
summarized above that (i) at least the audit committee must have the authority
to engage legal counsel and other advisers independent of legal counsel and
advisers to the business, as the committee determines necessary to carry out its
duties, and (ii) the business must provide for appropriate funding, as
determined by the audit committee, for payment of the fees of such counsel or
advisers.[3]
Congress has even gone a step farther by directing the SEC to prescribe rules
making it unlawful for any officer to fraudulently influence the performance of
an audit and by changing the criminal code to make it a crime not to retain
audit workpapers and other documents that form the basis of an audit.[4]
In addition, Congress made the audit committee, or otherwise independent
directors, the designated recipients of any illegal conduct coming to the
attention of outside auditors in the course of an audit; any significant
deficiencies in internal accounting controls and any fraud, whether or not
material, involving management having roles with internal accounting controls
coming to the attention of the CEO or CFO; and any evidence of material
violations of securities laws or breaches of fiduciary duty coming to the
attention of legal counsel that are not appropriately responded to by the CEO or
chief legal officer.
Increasing Managements Accountability
An under-emphasized part of Sarbanes-Oxley is the requirement for businesses
to disclose whether they have adopted a code of ethics for their senior
financial officers.[5] Congress is apparently frustrated by the fact that senior
financial officers who are not subject to professional codes of ethics are not
as accountable as general counsel who are subject to a Code or Model Rules of
Professional Responsibility. There is little doubt that the shareholders could
bring a derivative action on behalf of the business to hold general counsel
responsible for breach of duties of competency and loyalty. Until a code of
ethics is imposed contractually by a business, financial officers are not
subject to similar fiduciary duties as those imposed on lawyers by their Codes
or Model Rules.
Congress has gone even farther in increasing the accountability of CEOs and
CFOs by requiring them to certify that:
Subject to criminal penalties, the financial statement filed with any Form
10-K, 10-Q, or 8-K report with the SEC complies with SEC requirements and
fairly presents, in all material respects, the financial condition and
results of operations;
They have read each annual and quarterly report filed with or submitted to
the SEC and, based upon the officers knowledge, the report does not
contain any material misstatement or omission and fairly presents in all
material respects the financial condition and results of operations;
They are responsible for establishing and maintaining internal controls;
they have designed internal controls to ensure that material information
relating to the issuer and its consolidated subsidiaries is made known to
such officers; they have evaluated the effectiveness of those internal
controls at least 90 days prior to the report; and they have presented in
the report their conclusions about the effectiveness of their internal
controls; and
They have disclosed to the auditor and the audit committee all significant
deficiencies in the design or operation of internal controls and any fraud,
whether or not material, that involves management or other employees who
have a significant role in the issuer's internal controls.[6]
As a means of self-enforcement of these provisions, Congress is requiring
each business to force CEOs and CFOs to reimburse the business for all
incentive-based or equity based compensation and for profits realized from the
sale of the business securities during the 12-month period after the issuance
or filing with the SEC of any financial statement that is required to be
restated due to failure to abide by any of the forgoing certifications or other
misconduct.[7]
What Congress Did Not Do
Although Congress is restoring authority for oversight to the board, it did
not increase the accountability of boards as it did the accountability of CEOs
and CFOs. Congress was apparently cognizant of fear that increasing board
accountability will make it more difficult to attract independent and competent
board members. It did not require boards to review, certify, or become
signatories to Form 8-K, Form 10-Q, or Form 10-K reports filed with the SEC or
proxy or other materials furnished to security holders. It did not require
boards to assume responsibility for implementing or supervising internal
accounting controls. It did not require boards to forfeit compensation if
financial statements need to be restated for reasons of noncompliance. Although
Congress required the board and its audit committee to be recipients of reports
from the outside auditor, Congress did not require boards to have dialog with
the outside or internal auditors.
Is There a Change in Standard of Conduct for Boards?
Although Congress may not have intended to increase the accountability of
boards, by expressly making the board the authority for oversight of the audit
process, Congress has likely raised the bar on the standard of conduct for
boards.
Under most corporate statutes, a corporations board is responsible for the
direction of the corporation's management.[8] Congress has now added to that
direction express responsibility for hiring, firing, compensating, and
overseeing the work of the auditors and the other matters described under Restoring
the Boards Authority.
Under most corporate statutes, a board typically performs its
responsibilities by delegating to others, including management, board
committees, and professionals such as accountants and legal counsel.[9] Although
Congress has allowed the independent members of a board to rely upon an audit
committee that is composed of independent members, it can be argued that the
board must assume, or assure itself that its audit committee assumes,[10]
responsibility for hiring, firing, compensating, and overseeing the work of the
auditors and the other matters described under Restoring the Boards
Authority.
Footnotes
1 Section 2(a)(2) and (4) of Sarbanes-Oxley.
2 See Sections 10A(m)(2); 10A(m)(4); 10A(m)(5) and (6); 10A(g), (h) and (i); 10A(k); and 10A(b), respectively, added to the Securities Exchange Act of 1934 by Sarbanes-Oxley.
3 See Section 10A(m) added to the Securities Exchange Act of 1934 by Sarbanes-Oxley.
4 See Section 303 of Sarbanes-Oxley and Section 1520 added to 18 USC by Sarbanes-Oxley.
5 See Section 406 of Sarbanes-Oxley.
6 See Section 1350 added to 18 USC by Sarbanes-Oxley and Section 302 of Sarbanes-Oxley.
7 See Section 304 of Sarbanes-Oxley.
8 See Section 141(a) of Delaware General Corporation Law and Section 1701.59(A) of Ohio General Corporation Law.
9 See Section 141(e) of Delaware General Corporation Law and Section 1701.59(B) of Ohio General Corporation Law.
10 Sarbanes-Oxley defines audit committee as a committee established by the board for the purpose of overseeing the issuer's accounting and financial reporting processes and audits of the financial statements. If no such committee exists, then the entire board is responsible for this oversight.