Speech by SEC Staff:
Remarks before the American Bar Association's 2003 Conference for Corporate Counsel

by

Alan L. Beller

Director, Division of Corporation Finance
U.S. Securities and Exchange Commission

Washington, D.C.
June 12, 2003

Thank you. It is a pleasure to be here today addressing this group under the auspices of the American Bar Association. June traditionally brings the beginning of the hot humid summer weather to Washington. The sun and the heat may actually be welcome this year, given that we almost drowned in the month-long deluge of May.

June this year brought another event — the end of the blizzard of rule-making for which the Division of Corporation Finance is responsible at the Commission under the Sarbanes-Oxley Act of 2002. The last set of our rules, final rules regarding internal control over financial reporting was adopted by the Commission on May 27 and posted on the Commission website on June 6. (I know some of you are thinking that there is still a proposal, and an alternative proposal, outstanding under the attorney conduct rules, but I am taking the position that at the staff level those rules are the responsibility of our Office of General Counsel.) From Corp Fin's point of view, this is probably a good time to take stock of where issuers find themselves under the Act and the rules. I can think of no group with whom I would rather engage in this exercise than an audience of general counsel.

Before we go further I should add the customary required Commission disclaimer- as a matter of Commission policy the views I express here today are my own and not necessarily those of the Commission or any other member of the staff.

I would start by suggesting that general counsel stand today at the focal point of all of the rays of change that have struck corporations in the last year — Sarbanes Oxley and the Commission's rules thereunder, the pending strengthened listing standards at the New York Stock Exchange and the Nasdaq, the heightened standards that may exist at the Commission, in courts of law and in courts of public opinion. In this position general counsel have unique challenges and unique opportunities in bringing corporate America to where we all want it to be.

I'm referring to a place where honest and ethical behavior is both the norm and the perceived norm. It is a place where honest business is free to operate. That includes freedom to take honest business risks. Some have complained that the atmosphere that prevails in corporations after Sarbanes-Oxley precludes taking such risks. I believe this certainly need not be the case, but I would also note that the skepticism about honest business risks in some quarters stems from the suspicion that the risks are not honest and are not what they seem. There is suspicion either that some risks for which rewards are sought are not risks at all but part of a rigged game, where accounting gimmicks will guarantee results, or that the risks are not honest business risks but involve improper use of corporate assets, inappropriate conflicts of interest or self-dealing or fraud.

We must get past this point, and you have a major role to play. I said a minute ago that I thought both the challenges and opportunities for general counsel to make a difference are unique. Here's why. An appropriately positioned and recognized general counsel has:

• A close relationship with the CEO and other top management that gives him or her an opportunity to assure good behavior;
   
• Access to the board, as the chief legal adviser to the company, to assure good behavior;
   
• Relationships with outside counsel, a key set of advisers on navigating the issues which are raised in the new environment; and
   
• A place at the table at every significant discussion about how your company should act with respect to every important issue raised by Sarbanes-Oxley, our rules or other aspects of the new environment.

What I thought I would do with the remaining time is talk about some specific aspects of my perception of the role and opportunities of general counsel. You have all already heard a lot, including this morning, about the new rules and what they mean and what they require. I would like to take a different tack and share some of my thoughts about how to approach what I have been calling the new environment

Assure yourself that you have the access and relationships described above. This one is pretty simple. There are a variety of organizational structures and reporting lines available to companies and to general counsel. I don't think it's appropriate for me to suggest I favor any particular one or ones. However, if you have the responsibilities of a general counsel, the chief legal officer of the company, you ought in some fashion have the access and relationships, including with top management and the board, as well as a seat at the table on the important issues that I mention above.

Step back and think about what is most important and most difficult about the new environment for your company. Sarbanes-Oxley. New Commission rules. New listing standards. Maybe other new concerns and requirements. By now you've all received more advice, free and paid, than you could imagine. Not all companies have the same concerns and the same needs about all of the new requirements. Some of our new rules have become overblown in all of the attention they've received — I'm thinking in particular about the disclosure rules regarding codes of ethics and audit committee financial experts. On the other hand, some of our new rules have received too little attention — I'm thinking in particular about the rules regarding internal control over financial reporting. These three sets of these rules were all proposed together, in October as I recall. We received 200 or so comment letters addressing the audit committee financial expert proposal, and only around 60 addressing the internal control proposal. How do you figure that?

In any event, now is your opportunity to step back and think about where to concentrate your attention, and those of your staff and outside advisers? You certainly can't overlook any requirements, but some of them will take more attention and more effort or will be more difficult to comply with. Much will depend on your company. How complicated are its operations and reporting lines? How global is it? What is the board's make-up and sophistication? Should consideration be given to changing the board? What's the situation with board charters? Board responsibilities? What do you think of the company's disclosure controls and procedures? What is the role of the various actors in the company regarding financial reporting and other disclosure? What is the assessment of internal control today? What will be the role of the various actors within the company in accomplishing the necessary design, strengthening, testing and other steps relating to internal control? There is also no doubt that your focus will and should change over time, but it is important to determine what are the most important things you have to do within your company.

Adopt a "best practices" rather than a compliance mentality to operating in the new environment. How should general counsel go about assuring that their companies and their own behavior meets the new requirements of Sarbanes-Oxley and our rules, the strengthened corporate governance standards, the other increased expectations of the new environment? I would not start by asking, "How do we comply with the new rules?" Rather, I would suggest you ask "What is the right thing for the company and me to do? What are the best practices we should be striving to embrace?" Following the letter of the rules is necessary but not sufficient. And focusing on following the letter of the rules detracts attention from more important objectives. Good corporate behavior and restoring investor confidence are not primarily about complying with rules. It is about inculcating in a company, and all of its directors, officers and employees, a mindset to do the right thing.

Let me give you what I think is a clear example of what I mean, taken from the "up-the-ladder" attorney conduct rules that the Commission adopted in January. Those rules require that "[i]f an attorney, appearing and practicing before the Commission in the representation of an issuer, becomes aware of evidence of a material violation", that attorney has obligations to report "up the ladder" within the issuer. I expect your valued advisers have felled many trees and spilled barrels of ink describing the meaning and consequences of the terms "appearing and practicing before the Commission" and "evidence of a material violation", among others. They should do that; you should know what the rules mean. And it is very important for the Commission in doing its job to have rules that are appropriately clear.

But I would submit to you that in deciding how you want your internal legal staff and your outside lawyers to behave, you shouldn't much care what those terms mean. You should want every lawyer, whether or not and before whomsoever they are appearing or practicing, to understand and embrace the notion that they represent your company and that they will bring issues up-the-ladder and as appropriate to you. And you should want them to bring to their supervisor and to you as appropriate every legal, business, professional or ethical concern that they have about what is going on in the company. The "Does it smell bad?" test or the "Does it make me uncomfortable?" test captures the best practice that I believe you want, rather than the test of whether something is evidence of a material violation.

Obviously, your rules and practices have to comply with Sarbanes-Oxley and our rules, but if you take a best practices approach, you will in many respects and in a lot of areas be well within the requirements of Sarbanes-Oxley without having to spend a lot of time on check-the-box compliance.

Processes matter, and you should pay attention to them. Some have decried the focus of Sarbanes-Oxley on processes, saying that it will require officers, directors and employees and, especially general counsel, to become nothing more than box checkers. I have a different view. I believe that good processes and procedures matter. They make it easier for companies to comply with complex requirements and to produce good numbers and make good disclosure. Of all the recent reforms, the requirement for CEO and CFO certifications and the processes that have been developed by management and companies to support those certifications have had the largest impact to date in improving financial reporting and other disclosure.

No steps will eliminate wrongdoing or ensure its detection. But good processes do make wrongdoing more difficult because they increase the chances that it will be uncovered. They also therefore provide some deterrent against wrongdoing. Finally, attention to good processes will result in a check-the-box approach only if a company and its directors and officers embrace a check-the-box mentality.

The securities laws require internal controls and disclosure controls and procedures. Your company probably has other important processes as well. You should be considering those processes from both a strategic and legal point of view. Do they serve the company well? Do they accomplish their objectives? How could they work better? Of course, do they comply with applicable requirements? Are they being monitored appropriately and deficiencies corrected and disclosed as necessary? Many processes operate partly or even wholly outside the legal department, and so this is necessarily a cooperative task among many areas of most companies.

Position yourself and your internal and external resources so that they cover all the necessary points. Companies have different types of structures and processes, which can be effective, and different general counsel bring different skills and experiences to the job. Some general counsel are securities lawyers; some are litigators; some have significant regulatory backgrounds in areas key to the company. Many general counsel do not help write the disclosure in a company's SEC filings. Many general counsel are not involved in detail in financial reporting decisions. But the general counsel is the chief legal officer, and thus has the responsibility for getting the legal requirements right. You should have appropriate people and resources and a structure in place that are intended to ascertain what the requirements are, to design best practices or other procedures to meet them and to ensure that they operate and are effective. And you should have that seat at the table on important issues that I mentioned earlier. You don't need to be the person who makes the final sign-off on the MD&A, and in most cases you probably shouldn't be, but you should be involved in making sure that your company's practices are designed to get all of necessary information into the MD&A and to get it right, and that the appropriate person or group of people is giving the final sign-off.

Don't check your common sense and your instincts at the door. You are all highly trained and technically expert. But don't let technical or highly refined considerations or arguments cause you to ignore your instincts or your common sense. This works in both directions. We have heard anecdotally that some companies are being advised that the only prudent course of action in complying with our rules is to cut off all one-on-one contact between a company and its major investors. If you receive that advice, apply some common sense to it. Does it make any sense for a company to behave that way? Why would a company have to behave that way? What SEC rule dictates that result? I do not believe that under our rules prudence requires that a company have a policy not to speak to its major investors. But my point is not only to tell you what I believe, though I hope that is helpful, but also to suggest that when you are urged to follow a course of action that is contrary to your instincts or common sense, you should test and probe its correctness.

As I said, this goes both ways. So you should also probe and test advice or conclusions that are favorable but run contrary to your instinct or common sense. For example, a conclusion that a transaction can be treated in a certain way that runs contrary to your instincts should be carefully examined until you are comfortable with it.

Pay attention to our new internal control rules. I've been saying this for two weeks, and I expect you will hear it more than once during this conference, but I'll say it one more time. You and your company should have already started to devote attention and resources to implementation of the Commission's most recent rules under Sarbanes-Oxley, which address internal control over financial reporting. If you haven't yet, you should start immediately. The new rules require a management assessment of the effectiveness of internal control over financial reporting and the attestation of external auditors as to that assessment. The rules were adopted on May 27 and were posted on our web site at the end of last week.

As I noted above, many of the Commission's other rules under Sarbanes-Oxley have provoked more comment and gotten more attention. I would submit that no rules are more deserving of attention than these most recent rules. They will require a significantly greater commitment of time and resources, including money, than the other Sarbanes-Oxley rules. They will require most companies to evaluate their internal control structures in a more thorough-going manner than has previously been the case. And they will require new interactions between a company and its external auditors.

The Commission determined that the implementation of these rules was a sufficiently complex and time-consuming matter that an extension of time before compliance is required is appropriate. As a result, U.S. companies that have filed one annual report with Commission and have more than $75 million of market capitalization must comply for fiscal years ending after June 15, 2004. Compliance is required for other companies for fiscal years ending after April 15, 2005. This will give companies and auditors more time to establish the processes necessary, to design and test systems, and to provide the necessary training. It will also give the new Public Company Accounting Oversight Board time to consider and implement new attestation standards.

Even though the Commission has given necessary extra time, you should already be working to prepare to meet these new requirements. Based on what we have seen and heard, companies will need the extra time and should already be committing the resources that compliance will require.

I will stop there. I would like to thank you again for the opportunity to be with you today. I'd be pleased to take questions as time permits.

http://www.sec.gov/news/speech/spch061203alb.htm