Gregory P. Joseph*

The corporate fraud legislation signed into law on July 30, 2002, is largely focused not on civil litigation but on corporate governance, disclosure and criminal law matters. The Sarbanes-Oxley Act of 2002 is, however, a telling example of the law ofunintended consequences. It will have wide-ranging effects on securities, derivative and other shareholder lawsuits. This article outlines some of the more important civil litigation implications ofthe Act.

Statute ofLimitations. The Act includes three explicit applications to civil litigation. First, § 804 extends the statute of limitations for securities fraud actions to the earlier of two years following discovery of the facts constituting the violation, or five years after the violation. The new 2-and-5 year limitations periods replace the prior 1-and-3 year periods, and apply to all proceedings commenced on or after July 30, 2002. This change will doubtless trigger a spate of lawsuits questioning the validity of applying the new periods to actions which, but for the Act, were time barred as of July 29, 2002.

Insider Trading. In response to the public outcry arising out of Enron's demise, § 306 creates a new derivative action against officers and directors who trade in their company's stock during a blackout period (i.e., when participants in the company's benefits plans may not trade). This derivative action has a uniquely meaningless demand requirement. While a request must be made 60 days before suit may be filed, the company cannot preclude the action by conscientiously (or otherwise) deciding not to file suit. The derivative plaintiff may proceed unless the company has filed suit within 60 days (and may proceed later if the company commences the action but does not "diligently" prosecute it). This raises the prospect that a plaintiff may file a request under this statute but simultaneously wish to allege futility as to other, state law derivative claims. The wording of the demand letter will be critical.

Whistleblowers. Section 806 creates a civil remedy for whistleblowers who sufferretaliation. The whistleblower protection is very broad, extending not only to employees who notify the authorities but also to those who "assist in a proceeding.. relating to an alleged violation of' the securities laws. This thus applies to "assist[ing]" any securities fraud action brought against the company. Putting aside the ethical issue as to whether or when plaintiffs' counsel may contact employees during their pre-filing (or pre-amendment) investigation, this provision raises potential issues under standard-form Directors & Officers insurance policies (which often furnish an important source of funds for injured investors). The insured-vs.-insured exception in some D&O policies purports to preclude coverage if any past or present employee "assists" the plaintiff. Some carriers strain to read this exclusion very broadly, as covering mere responses by employees to telephone calls placed by plaintiffs' counsel or investigators. While companies are often loath to bar communications between employees and others (to avoid any appearance of obstruction), the Act appears to evince a public policy of fostering such communications. Will this public policy trump strained insurer attempts to limit coverage on the basis of often brief and innocuous factual conversations between employees (present or past) and those investigating possible wrongdoing?

Audit Committee Members as Target Defendants. Since enactment of the Private Securities Litigation Reform Act (PSLRA) in 1995, securities fraud plaintiffs have frequently aimed their lawsuits solely at the corporation and its most senior (and allegedly most involved) officers, commonly the CEO and the CFO. Outside directors have often not been sued, in light ofthe PSLRA's stringent pleading requirements. This practice will change. Both in securities and derivative litigation, Audit Committee members will become target defendants because of everything that the Act requires them to do. Under § 301 of the Act, for example, the Audit Committee is "directly responsible for the... oversight of the work of [the outside auditor]... for the purpose of preparing or issuing an audit report" (amending 15 U.S.C. § 78f(m)(2)). The Audit Committee will also receive - and must address-signed reports from the CEO and CFO detailing "all significant deficiencies in the design or operation of internal controls" and "any fraud, whether or not material, that involves... employees who have a significant role in the issuer's internal controls" (§ 302(a)(5)). This latter provision may have the counterintuitive impact ofrendering material what might otherwise be deemed immaterial, simply by virtue of its having been reported to the Audit Committee under so ambiguous a provision.

As if to enhance any scienter or gross negligence allegations that a securities or derivative plaintiff must make, each Audit Committee must have "at least 1 member who is a financial expert," whose identity will be a matter ofpublic disclosure under SEC rules to be promulgated within 180 days (§ 407(a)). The expertise required of this financial expert includes both "an understanding of generally accepted accounting principles" and experience in preparing or auditing financial statements (§ 407(b)(1)-(2)). Who better to (allegedly) know of, or recklessly disregard, accounting chicanery? Note a continuing theme of this legislation-the federalization of corporate governance matters historically determined by state law.

Attorneys as Defendants? Section 307 of the Act requires that, within 180 days, the SEC promulgate rules governing attorney conduct that may expose counsel, both in-house and outside, to third-party liability. There are several important aspects to these rules. First, they will relate to "a material violation of securities laws or breach of fiduciary duty or similar violation by the company or any agent thereof." Materiality judgments are among those most easily second-guessed, particularly in light of SEC pronouncements obscuring any objective measures. Judgments, moreover, will be judged ex post, after a bad outcome -an outcome that is by definition not be known at the time any advice is rendered. This will counsel caution and extensive (or over-) reporting. Further, while the subject matter of securities and fiduciary violations is objectively ascertainable, just what is "a similar violation"?

Second, the SEC rules must mandate that a lawyer report any such "material violation," in the first instance, to the general counsel or CEO of the company. A potential pitfall here will be failing to report to the chief legal counsel of the company, as opposed to other in-house counsel. (Client sensibilities are not determinative when personal liability of counsel is on the line.)

Third, "if the [general] counsel or [CEO] does not appropriately respond to the evidence" presented by the lawyer, the lawyer must report the evidence to the Audit Committee or another committee of independent directors, or to the board as a whole. Failure to follow theserequirements may be deemed to give rise to an inference of scienter on the part of counsel, or may later be held to constitute aiding and abetting a breach of fiduciary duty (or "a similar violation"). Companies would be well-advised to set up a mechanism to process and receive these reports.

A corollary of extensive (or over-) reporting is extensive knowledge on the part of the recipients of the reports. This may expose to liability-or, at least, litigation - those independent directors who receive reports concerning matters that ultimately materialize in disaster.

Intentional, Knowing & Reckless. The Supreme Court has never decided whether recklessness is sufficient to sustain liability under § 10(b) of the Securities Exchange Act or SEC Rule l Ob-5, although every Circuit holds that it is. The Act does not purport to address this issue directly, but there some passages that are potentially pertinent namely, § 105(c) (dealing with sanctions to be visited on errant accountants by the new Public Company Accounting Oversight Board) and § 602 (which defines "improper professional conduct" before the SEC). Both of these provisions use the phrase, "intentional or knowing conduct, including reckless conduct" to describe sanctionable behavior. The appositional inclusion of "reckless" appears to be descriptive of the phrase "intentional or knowing," and not an expansion of. At least, the use of the word "including" would certainly suggest that.

Scienter & Malpractice. Much of the Act is devoted to the formation and operation of the new Public Company Accounting Oversight Board and creation ofnew corporate governance and reporting obligations. A number of these will translate into benchmarks against which scienter and neglect of duty can be measured or alleged. For example, under § 101(c), the Board will "establish or adopt... auditing, quality control, ethics, independence, and other standards."Under §§ 104 and 105, the Board will also conduct both inspections of accounting firms and investigations into misconduct. Further, under § 406, the SEC will issue rules requiring disclosure of each issuer's "code of ethics for senior financial officers," with "ethics" being defined to include "full, fair, accurate, timely, and understandable disclosure...."

"Real-Time " Disclosure Duty. In SAB 99 (Aug. 13, 1999), the SEC broadly defined the notion of materiality. The Act adds a timing component to this notion. Section 409 of the Act amends 15 U.S.C. § 78m(l) to require "disclos[ure] to the public on a rapid and current basis" of "material changes in the financial condition or operations of the issuer, in plain English...." This is clearly intended to accelerate reporting obligations. It is unclear how much faster "real-time" disclosure need be, but the courts and the SEC will doubtless fill in the blanks.

Discovery. The Act mandates that accounting firms maintain for seven years "audit work papers, and other information... in sufficient detail to support the conclusions reached" (§ 103(a)(2)). This obligation applies to foreign accounting firms (usually Big Four affiliates) that issue audit opinions for U.S. issuers and, if the Board so determines, will also apply to those foreign entities that are significantly involved in the audit, even if they do not sign the audit opinion (§ 106). For the first five years of this seven-year period, not just "sufficient" but "all audit or review papers" must be maintained, to avoid commission of a felony (§ 802).

What the Act Did Not Do. As important as the changes wrought by the Act are those that one might have anticipated but were not made. Among the things that Congress did not change: The PSLRA bar against pleading securities fraud as a RICO predicate act remains intact (18 U.S.C. § 1964(c)). The Supreme Court's abolition of alder-and-abetter liability for securities fraud was not touched (Central Bank ofDenver, N.A. v. First Interstate Bank of Denver, N.A., 511 U.S. 164 (1994)). And the PSLRA's introduction ofproportionate liability for miscreants adjudged only reckless a gift to the accounting industry-was not modified.