Suggested Disclosure Controls and Procedures

Effective August 29, 2002, the Securities and Exchange Commission adopted new Rules 13a-15 and 15d-15 requiring companies to maintain and regularly evaluate the effectiveness of disclosure controls and procedures designed to ensure that the information required in reports filed or submitted under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported on a timely basis (Release No. 34-46427, August 29, 2002). These new rules apply to any domestic or foreign company that has registered securities under Section 12 of the Securities Exchange Act of 1934 or that is required to file periodic reports with the SEC pursuant to Section 15(d) of the Exchange Act, other than asset-backed issuers.

The SEC also adopted new Rules 13a-14 and 15d-14, providing for enhanced certifications to be filed with each periodic report that make chief executive officers and chief financial officers responsible for designing these controls, for assessing them within 90 days prior to the filing of each periodic report and for publicly disclosing the results of their assessment.

For purposes of the new rules and the CEO/CFO certifications, the SEC draws a distinction between "internal controls," which pertain to a company's financial reporting and control of its assets, and the newly required "disclosure controls and procedures," which pertain to the quality and timeliness of disclosure of all of the information required in periodic reports. As discussed in the SEC's adopting release, the newly required disclosure controls and procedures include, but also go beyond the information that is covered by, a company's internal controls related to financial reporting. For example, the procedures should ensure timely collection and evaluation of information regarding the company's insider and affiliate transactions, business, litigation and regulatory developments, not just financial information. It is important to note that the disclosure controls and procedures apply to disclosures required in Forms 8-K and 6-K and proxy statements, even though these reports are not themselves required to include a CEO and CFO certification.

A company's response to these new requirements can affect its and its officers' potential liability. Even if a company's disclosures are appropriate, a company's failure to maintain adequate disclosure controls and procedures could expose the CEO and CFO to liability for making a false certification and could subject the company to SEC sanctions for failure to observe the company's obligations under the reporting requirements of the Exchange Act. The importance of a company's disclosure controls and procedures is heightened further by the accelerated deadlines for filing Forms 10-K and 10-Q recently adopted by the SEC and the SEC's proposals regarding accelerated and broadened disclosure on Form 8-K. In addition, a company's disclosure controls and procedures - if implemented correctly and followed consistently - should bolster company, director and officer defenses against claims challenging the accuracy of the company's periodic reports or its efforts to monitor and disclose corporate developments. These include Federal and state securities fraud claims and state corporate law duty of care claims, including so-called "Caremark" claims based on the responsibilities of directors to oversee the establishment and monitoring of proper reporting procedures.

Neither the new rules nor the SEC's adopting release provides specific guidance as to what disclosure controls or procedures will be sufficient to satisfy the new requirements. We provide below some suggested controls and procedures which we believe can form the basis of a company's specific disclosure controls and procedures. The actual controls and procedures developed and adopted by each company, however, should be tailored to fit the particular needs and circumstances of that company, and therefore will differ from company to company. Companies should also regularly review the adequacy of their disclosure controls and procedures and modify them as necessary or appropriate in light of changes in their business and the evolution of SEC, stock exchange and other corporate governance initiatives.

Companies should not wait until after the end of a fiscal period or the closing of their books to start gathering and analyzing information and reviewing their internal procedures. While drafts of the financial statements and Management's Discussion and Analysis of Financial Condition and Results of Operations cannot be completed until the final results of the fiscal period are known, the drafting of narrative descriptions to be included in an annual report can certainly begin ahead of time. Also, certain sections of the MD&A, including those discussing the status of contingencies, litigation, credit arrangements or capital commitments can be drafted before the final financial results are known. Requests for information and analysis of sensitive contingencies, risks and trends and their ramifications can also be started early. In light of the SEC's recent rule changes shortening the time period in which most companies must file Reports on Form 10-K and 10-Q, it will be even more important to start early.

When beginning work on any periodic report, each person responsible for drafting or reviewing a portion of that periodic report should be provided with and read the requirements of the applicable form, the referenced sections of Regulations S-K or S-X and any applicable SEC interpretive guidance to familiarize himself or herself with the requirements of the form and any changes that may have been adopted since the preparation of the last periodic report. For example, persons responsible for drafting the company's MD&A should be provided with and be familiar with the SEC's various releases on MD&A disclosure. Persons drafting the company's financial statements should be thoroughly familiar with GAAP, the SEC's Regulation S-X and SEC staff guidance for specific industries and types of transactions and other authoritative accounting literature. When people are first given responsibility for drafting a periodic report (or portion thereof), companies should be sure they receive adequate instruction, either internally or from a third party. Everyone involved in the disclosure process should bear in mind the requirement that the periodic report must contain, in addition to the information expressly required by the applicable form, all such material information as may be necessary to make the required statements, in the light of the circumstances under which they are made, not misleading.

Because of the expanded number of people likely to play a role in connection with a company's public disclosures, it is important that each person with responsibility for providing information, drafting portions of the SEC reports, reviewing drafts or evaluating internal controls or other disclosure procedures know what is expected of him or her, who will be reviewing the work and what the time schedule is. For example, the recently enacted Sarbanes-Oxley Act of 2002 and corporate reform initiatives proposed by the New York Stock Exchange and NASDAQ are enhancing the audit committee's required role and responsibility for reviewing public disclosures. Companies should consider preparing and then adhering to a reasonably detailed timetable of the tasks required in connection with the preparation and filing of their periodic reports. Companies should provide for the circulation of drafts well in advance of filing deadlines and allow a reasonable period of time for review, comment, and redrafting, taking into account all of the people who should be involved. Finally, companies should also make time before the filing of the periodic report to evaluate the effectiveness of the disclosure controls and procedures as a basis for the required CEO and CFO certifications.

A company should appoint a coordinator or point person who will have overall responsibility for preparing a timetable, following up with others to make sure that assigned tasks have been completed on a timely basis and making sure that the report is filed on a timely basis. This person need not be responsible for making judgments regarding disclosure matters but should be senior enough within the company's organization to be able to enforce deadlines.

The SEC has recommended that companies establish a "disclosure committee" to consider the materiality of information and determine disclosure obligations on a timely basis. The SEC recommended that this committee should be made up of the principal accounting officer or controller, the general counsel or other legal official with responsibility for disclosure matters, the principal risk management officer, the chief investor relations officer and other officers or employees as appropriate. Companies may want to consider including the heads of significant business units or subsidiaries on the disclosure committee. If the committee does not include the CEO and the CFO, the committee or an appointed representative of the committee should meet with the CEO and CFO to discuss the committee's deliberations and recommendations sufficiently prior to the filing for the CEO and CFO to satisfy themselves as to the adequacy of the process and to provide their own input on disclosure.

The disclosure committee could be used to collect and process information that may be relevant to preparing the disclosures to be included in an SEC filing and to review internal procedures for recording and generating this information. Certain members of the committee could be responsible for specific disclosure areas, such as a member of the company's legal department being responsible for litigation and regulatory disclosures. Each member would be responsible for actively seeking out information from appropriate people within his or her assigned disclosure areas and for preparing, or supervising the preparation of, relevant disclosure on a timely basis.

Once a draft of the SEC report has been prepared, all members of the committee should read the entire report, and focus specifically on areas within their expertise or under their supervision or management. They should ask questions of the appropriate persons if they have any issues with the disclosures or matters omitted from the disclosures.

While the primary purpose of the new disclosure controls and procedures is to ensure adequate and timely disclosure in periodic reports, companies' quarterly earnings releases typically have a more immediate effect on their stock price than the later filed and more detailed SEC report. In order to ensure that their quarterly earnings releases are accurate and complete, companies should consider having the disclosure committee also meet prior to, and review and comment on, the quarterly earnings release, or having both prepared at the same time.

Companies should clearly identify which people within their organizations will be responsible for preparing and reviewing each SEC report or specific portions thereof and for evaluating internal controls and other disclosure procedures. If the company has formed a disclosure committee, some or all of the designated people may be members of that committee. For example, business unit leaders could be responsible for reviewing the business description of their operations in the Form 10-K as well as the portion of each MD&A that describes the financial results of their business unit. Each person with designated responsibilities, in turn, should make sure that people on whom they are relying understand what will be required of them. The names and responsibilities should be made known throughout senior and even middle management so that information and disclosure issues can be brought to the attention of the appropriate persons.

Companies should consider preparing written disclosure guidelines for each SEC periodic report that focus on the requirements of that report and the specific business and industry conditions applicable to the company. These guidelines could include a checklist or questionnaire - with the goal being to highlight overall SEC disclosure items as well as areas of particular interest or concern to the company. The guidelines could also include other matters relevant to a company's disclosure process, such as the list of those people with responsibility for SEC reporting and the timeline for the particular report. The guidelines should be reviewed by the issuer's disclosure committee, audit committee, independent auditors and legal counsel, as appropriate, and updated as circumstances warrant. The guidelines should be disseminated periodically to those with front-line responsibility for SEC reporting, as well as those on whom they rely for information, as a tool to facilitate understanding throughout the company of the nature of required public disclosures and to enhance the disclosure process.

In designing disclosure controls and procedures, companies should pay particular attention to disclosures in several areas, including insider and affiliate transactions, risk factors, MD&A and earnings guidance. These areas of disclosure often attract litigation. Careful consideration of these disclosures should be made by senior management, to obtain the company's best insights and to describe properly the key contingencies, assumptions and specific risks for purposes of satisfying the requirements for litigation protection safe harbors for forward-looking statements. The company should also confirm that there are no open issues resulting from any SEC comment process and that any prior commitments made to the SEC during any SEC comment process have been addressed.

A company's disclosure controls and procedures must also be designed to ensure accurate and timely reporting of events required to be disclosed on an interim basis on a Form 8-K. An up-to-date list of those events requiring current disclosure should be made available to, and regularly reviewed by, senior management.

A company may consider requiring some or all of the members of the disclosure committee or senior management to provide a written certification as to their areas of responsibility. This certification could address both the proper functioning of the disclosure controls and procedures and the completeness and accuracy of the disclosure for which they are responsible. While such an internal certification should not be relied upon alone to satisfy a CEO's or CFO's due diligence obligations, it may be useful for focusing a person's attention on the proposed disclosure and its importance.

As part of their disclosure controls, companies should review and analyze their document management procedures and systems. Key contracts and other documents should be centrally gathered to allow for consideration of their contents in light of SEC disclosure obligations and for timely filing of any material contracts as exhibits to the appropriate SEC filing.

A company's senior management or its disclosure committee should discuss significant matters affecting the company's periodic reports with the company's independent auditors, including, among other things, off-balance sheet arrangements, critical accounting policies, the effect of new accounting pronouncements and quantitative and qualitative disclosures regarding market risk. Other issues that should be considered for discussion include significant accounting estimates (particularly those requiring management to make assumptions or judgments), income recognition and expense issues, derivative transactions and any unresolved matters raised in management letters received from the company's independent auditors. The accounting for particularly significant transactions during the reported period and accounting policies of the company that may differ from industry standards or which have been the subject of public controversy may also be appropriate topics for discussion with the company's independent auditors.

While annual financial statements are audited and quarterly or interim financial statements are reviewed pursuant to the standards set forth in Statement on Auditing Standards No. 71, no formal auditing or review procedures are generally performed on the other portions of a company's periodic reports. Companies may want to consider discussing with their independent auditors the possibility, cost and added benefits of other procedures with respect to, among other things, the MD&A.

There are other areas in which outside counsel can provide useful assistance in connection with a company's periodic reports. Before preparation of the first draft of the report, outside counsel can be helpful in identifying new disclosure requirements or areas of particular focus at the SEC or in the marketplace generally. With regard to significant litigation, or regulatory or contractual matters, it is often useful to have the outside counsel representing the company on the matter draft or review the proposed disclosure.

The Sarbanes-Oxley Act, as well as the pending New York Stock Exchange and NASDAQ corporate governance proposals, will require substantial review and focus by audit committees in connection with a company's periodic reports and the processes utilized in preparing those reports. While the certifications required by new Rules 13a-14 and 15d-14 do not expressly require that the certifications be reviewed with the audit committee (unlike the certifications recently required of most large companies by the SEC's June 27^th Order of Investigation), the audit committee should continue to be informed about the company's certification process. In particular, the new rules require that the CEO and CFO state that they have disclosed to the audit committee, based on their most recent evaluation of the company's disclosure controls and procedures, all significant deficiencies in the design or operation of the company's internal controls which could adversely affect its ability to record, process, summarize and report financial data and that they have advised the company's independent auditors of any such material weaknesses and of any fraud (whether or not material) that involves managements or other employees with a significant role in the internal controls. Consequently, the company's development of its disclosure controls and procedures, and any substantive issues identified by them, should be discussed in detail with the company's audit committee.

In preparing drafts of SEC reports, it is helpful to begin by reviewing the company's prior SEC reports and other disclosures. It is obviously important to ensure that the proposed SEC report is consistent with the company's prior disclosures. However, the company's efforts to comply with its disclosure requirements should go beyond an uncritical "mark-up" of prior reports. Past disclosure should not stand in the way of improved disclosure, even in the absence of significant changes in the company's business. It is also useful to review other precedents, including competitors' SEC reports, analyst reports, rating agency press releases and industry publications. These sources may provide useful insights as to how companies in the same industry or circumstances handle their disclosures, and as to risks and concerns about the company and its industry voiced by knowledgeable third parties.

When the disclosure committee, the audit committee or some other committee has a meeting, a record of the meeting should be kept consistent with the company's practices. For example, the record should reflect the date meetings were held, those present and the major topics covered. A record should also be maintained of other procedures followed, such as a review of documents or meetings with officers, employees, outside auditors or counsel.

The company should set the proper tone with all of its employees about the importance of accurate and timely disclosure in the company's SEC reports. Each employee involved in the process should understand that he or she is an integral part in making sure the company's disclosure goals and requirements are met. We suggest adding a statement to the company's code of conduct to the effect that employees may be called upon to provide information necessary to assure that the company's public reports are complete, fair and understandable and that the company expects all employees to take this responsibility very seriously and to provide prompt and accurate answers to inquiries related to the company's public disclosure requirements. Even more important, efforts should be made to ensure that each employee feels comfortable bringing disclosure issues or concerns to the attention of designated executives, so that disclosure issues can be addressed and resolved.

New Rules 13a-15 and 15d-15 require companies "under the supervision of the principal executive and financial officers" to conduct an evaluation of the effectiveness of the design and operation of their disclosure controls and procedures within 90 days prior to the filing of each quarterly or annual report with the SEC. The new rules do not provide detailed procedures for these evaluations and the SEC's adopting release states only (i) that the evaluation must, at a minimum, address the matters specified by the rules, and (ii) that the SEC expects this evaluation will be carried out in a manner that would form the basis for the certifications required to be made by the CEO and CFO.

The appropriate scope and design of this evaluation will vary from company to company, but in most cases should normally include at least the following:

• confirming that the agreed upon steps for preparing the most recently filed periodic report were completed in a timely manner consistent with the disclosure procedures that the company has developed;
• confirming that all of the participants in the disclosure preparation process performed their responsibilities in a thorough manner (for example, that officers in charge of principal business units actively participated in the process and read and commented on drafts of the disclosure documents);
• confirming that nothing came to light after the last periodic report was filed that should have been discussed in the most recent periodic report, or should have been included as an exhibit to that report, and was not;
• consulting with outside advisors involved in the process, such as outside counsel and the company's independent auditors, as to whether they have any concerns or suggestions regarding the disclosure process;
• making similar inquiry of the internal persons responsible for coordinating the processing (including, for example, as to whether they encountered any resistance from participants in the process); and
• confirming that work papers supporting the tabular information and other financial data included in the reports were prepared and checked against the final report.

A company's internal audit staff could be particularly useful in assisting the CEO and CFO in evaluating the effectiveness of the company's disclosure controls and procedures.

While the review and evaluation of the company's disclosure controls and procedures should be an ongoing process, the record should reflect the evaluation by the CEO and CFO as of a specific date within 90 days prior to the filing of each periodic report is order to comply with the applicable certification requirement.

Copyright © 2007, Mayer, Brown, Rowe & Maw LLP. and/or Mayer Brown International LLP. This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.

Mayer Brown is a combination of two limited liability partnerships: one named Mayer Brown LLP, established in Illinois, USA; and one named Mayer Brown International LLP, incorporated in England.