New COSO ERM Framework – Enterprise Risk Management – Integrating with Strategy and Performance; COSO 2013 Internal Control Framework; the Business Judgment Rule

You may have heard or seen that the new COSO ERM Framework is out as of a day or two ago – Enterprise Risk Management – Integrating with Strategy and Performance. This is a project that COSO announced on October 21, 2014, so it is a longtime in the works. The original (first) framework was issued in 2004. Below I have provided the bare bones outline for the new ERM Framework, in addition to the bare bones outline for the COSO 2013 Internal Control Framework, and a summary of the business judgment rule. Why did I provide all three? Because for boards and audit committees, and for business entities and their executive officers, and sometimes for the employees also, all three are, or should be, tied together.

I will be commenting about and outlining the ERM Framework in detail in later posts (after I have had time to evaluate the detailed materials, and discuss them with colleagues). For now, all I can give you is the outline below. I do note – and I’m not being negative about this – that I have some concern that the five concepts and twenty principles, with the detail added, might be a lot for some small and mid-sized business entities, nonprofits and governmental entities to handle. But it is what it is. And as you may know, although it is now recognized that boards are responsible for oversight of risk management, many audit committees are responsible for risk management oversight pursuant to statute, regulation, or exchange requirements, and a typical audit committee charter lists oversight of risk management as an area of responsibility, generally there is no legally required or mandated risk management framework or process, although some industries (such as banks, for example) are heavily regulated for risk management purposes. It is possible that the new COSO ERM Framework will become the accepted framework to follow, although other frameworks do exist.

COSO (the Committee of Sponsoring Organizations of the Treadway Commission) is a private sector initiative, jointly sponsored and funded by the American Accounting Association, American Institute of Certified Public Accountants, Financial Executives International, Institute of Management Accountants, and The Institute of Internal Auditors.

The new COSO ERM Framework is organized into five interrelated primary or core components, which are supported by a set of twenty principles. The following is a broad outline of the five components and twenty principles. And as I stated above, in later posts I will be adding considerable detail. Below I have also provided an outline for the COSO 2013 Internal Control Framework, and a discussion about the business judgment rule.

Thanks for reading. David Tate, Esq., Royse Law Firm, Menlo Park office, with offices in the San Francisco Bay Area and Los Angeles

 

COSO ERM Framework – Enterprise Risk Management – Integrating with Strategy and Performance (five components, and twenty principles)

I.  Governance and Culture Component:

Supporting Principles:

  1. Exercises Board Risk Oversight
  2. Establishes Operating Structures
  3. Defines Desired Culture
  4. Demonstrates Commitment to Core Values
  5. Attracts, Develops, and Retains Capable Individuals

II.  Strategy and Objective-Setting Component:

  1. Analyzes Business Context
  2. Defines Risk Appetite
  3. Evaluates Alternative Strategies
  4. Formulates Business Objectives

III.  Performance Component:

  1. Identifies Risk
  2. Assesses Severity of Risk
  3. Prioritizes Risks
  4. Implements Risk Responses
  5. Develops Portfolio View

IV.  Review and Revision Component:

  1. Assesses Substantial Change
  2. Reviews Risk and Performance
  3. Pursues Improvement in Enterprise Risk Management

V.  Information, Communication, and Reporting Component:

  1. Leverages Information and Technology
  2. Communicates Risk Information
  3. Reports on Risk, Culture, and Performance

 

Enterprise Risk Management (ERM) and internal controls work together and should complement each other. The following is the broad outline of the COSO 2013 Internal Control Framework.

Sarbanes-Oxley section 404 requires public company management and its external auditors to attest to the design and operating effectiveness of a company’s internal control over external financial reporting. Internal controls should also be designed and implemented for private company, nonprofit and governmental entities.

COSO 2013 Internal Control Framework – 5 Components, and 17 Principles

1.  Control Environment Component:

Mandatory Principles

  1. Demonstrate commitment to integrity and ethical values.
  2. Board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
  3. Management establishes, with board oversight, structures and reporting lines and appropriate authorities and responsibilities in the pursuit of objectives.
  4. Demonstrate commitment to attract, develop and retain competent individuals in alignment with objectives.
  5. Hold individuals accountable for their internal control responsibilities in the pursuit of objectives.

2.  Risk Assessment Component:

Mandatory Principles

  1. Specify objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
  2. Identify risks to the achievement of its objectives across the entity and analyze risks as a basis for determining how the risks should be managed.
  3. Consider the potential for fraud in assessing risks to the achievement of objectives.
  4. Identify and assess changes that could significantly impact the system of internal control.

3.  Control Activities Component:

Mandatory Principles

  1. Select and develop control activities that contribute to the mitigation of risks to the achievement of objectives and acceptable levels.
  2. Select and develop general control activities over technology to support the achievement of objectives.
  3. Deploy control activities through policies that establish what is expected and procedures that put policies into action.

4.  Information & Communication Component:

Mandatory Principles

  1. Obtain or generate and use relevant, quality information to support the functioning of internal control.
  2. Internally communicate information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
  3. Communicate with external parties regarding matters affecting the functioning of internal control.

5.  Monitoring Activities Component:

Mandatory Principles

  1. Select, develop and perform ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
  2. Evaluate and communicate internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

 

The Business Judgment Rule

The business judgment rule also is relevant on these topics (from Tate’s Excellent Audit Committee Guide). The business judgment rule provides a director with a defense to personal liability, holding that as a general principle of law, a director, including a director who serves as a member of a board committee, who satisfies the business judgment rule has satisfied his or her duties. Thus, the business judgment rule provides one standard of care, although other standards may very well also apply to specific tasks and responsibilities. The business judgment rule provides a very good overall approach for directors and audit committee members to follow, although the rule itself is lacking in specific detail. In some states the business judgment rule is codified by statute while in other states the rule is established by case law (see, i.e., Cal. Corp. Code §309 for California corporations, Del. Gen. Corp. Law §141 for Delaware corporations, in addition to relevant case law). The rule also applies to directors as board committee members.

The Business Judgment Rule

In summary, as a general principle the business judgment rule provides that a director should undertake his or her duties:

-In good faith, with honesty and without self-dealing, conflict or improper personal benefit;

-In a manner that the director reasonably believes to be in the best interests of the corporation and its shareholders; and

-With the care, including reasonable inquiry, that an ordinarily prudent person in a like position with like expertise would use under similar circumstances. The rule itself doesn’t require a particular level of expertise, knowledge or understanding; however, as you might be aware, public company audit committee members do have such a requirement, and you can at least argue that, depending on the facts and circumstances, a board or committee member should have or should obtain a certain unspecified level of knowledge or understanding to be sufficiently prepared to ask questions, evaluate information provided, and make decisions.

Reliance Upon Other People Under the Business Judgment Rule

In the course and scope of performing his or her duties, a director must necessarily obtain information from and rely upon other people. An independent director is not involved in the day-to-day operations of the business. The director provides an oversight function. Pursuant to the business judgment rule, a director is entitled to rely on information, opinions, reports or statements, including financial statements and other financial data, prepared or presented by any of the following:

-Officers or employees of the corporation whom the director reasonably believes to be reliable and competent in the relevant matters;

-Legal counsel, independent accountants or other persons as to matters that the director reasonably believes are within the person’s professional or expert competence; or

-A committee of the board on which the director does not serve, as to matters within that committee’s designated authority, so long as the director acts in good faith, after reasonable inquiry as warranted by the circumstances, and without knowledge that would cause reliance to be unwarranted.

That’s it for now. Thanks for reading. Much, much more to come on these topics. David Tate, Esq., Royse Law Firm, Menlo Park office, with offices in the San Francisco Bay Area and Los Angeles

* * * * *

Updated Mediation and Dispute Resolution Questionnaire Attached

Greetings all. I have updated my mediation and dispute resolution questionnaire, which is a document that I wrote and use to obtain information that is helpful to facilitate dispute and case settlement. Click on the following link for the pdf, and go ahead and use the questionnaire and pass it to other people as you wish. Thank you. David Tate

Here is the link for the questionnaire: Mediation and Dispute Resolution Questionnaire, David Tate, Esq. 07302017

Here is a link to the Royse Law Firm, PC http://rroyselaw.com/

Comments re post by Norman Marks – internal audit and ERM accused of failing to hit the mark – discussion about management, boards and audit committees – David Tate, Esq., Royse Law Firm

I have provided below a link to a post by Norman Marks, in which Norman discusses and in part compares or contrasts internal audit and ERM. Norman’s post is a good, worthwhile read.

There are many good writers on these topics – you will also note that there are disagreements between knowledgeable professionals. Just for example, as Norman notes, ERM or enterprise risk management is a management function (I would say a management, board and audit committee function) whereas internal audit is independent; however, there has been for sometime considerable discussion about the role of internal audit and whether it can be or should be or has been expanded in ways that could make it less independent or less of an audit function and more of an advisory function in some circumstances – internal audit endeavors to make itself more valuable and needed as a function and department.

I don’t get into the discussions about whether internal audit should or should not be less independent or more advisory – instead, if internal audit is not being sufficiently utilized I primarily attribute that to one or both of two reasons which can be interrelated: (1) either internal audit needs to do a better job selling to management, the board and the audit committee how internal audit can help, or (2) particularly the board and the audit committee need to be more educated or convinced about how internal audit can help them to satisfy their oversight duties and responsibilities (I can help you with reason (2)).

If you are interested in risk management and enterprise risk management you are aware that COSO is still updating its ERM framework. If you aren’t interested in risk management or ERM but you are a board and/or audit committee member you definitely should be interested as it or parts of it are part of your oversight duties and responsibilities.

COSO has said that its updated ERM function should be out mid-2017, in other words, soon. This is a big deal. Whereas risk management professionals will extensively evaluate and comment about the new framework from an ERM perspective, and although I am also a CPA, I will primarily evaluate the framework from a legal perspective and what the new framework will or may require of management, the board and the audit committee in satisfaction of their duties and responsibilities. Add to this the COSO 2013 updated internal control framework, and the changes that are being made to audit procedures and the audit report, in addition to increasing disclosures about events, practices and procedures not just numbers, and you have a significantly changing environment in terms of management, board and audit committee duties and responsibilities.

That’s all for now. Below is the link to Norman Marks’ new blog post – read his post – it covers more about internal audit and ERM than the title indicates. David Tate, Esq., Royse Law Firm (see below for firm practice areas), Menlo Park, California office, with offices in northern and southern California. The following is a link to my other blog, about trust, estate, and elder, etc., disputes, litigation and difficult or contentious administrations: http://californiaestatetrust.com.

Here is the link to Norman’s post:  https://normanmarks.wordpress.com/2017/07/15/internal-audit-and-erm-accused-of-failing-to-hit-the-mark/

David Tate, Esq. (and CPA, California inactive). Royse Law Firm, Menlo Park Office, California (with offices in both northern and southern California).

Royse Law Firm – Practice Area Overview – San Francisco Bay Area and Los Angeles Basin, http://rroyselaw.com/

  • Corporate and Securities, Financing and Formation
  • Corporate Governance, D&O, Boards and Committees, Audit Committees, Etc.
  • Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  • International
  • Immigration
  • Mergers & Acquisitions
  • Labor and Employment
  • Disputes and Litigation (I broke out these areas because they are my primary areas of practice)
  •             Business
  •             Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  •             Trade Secrets, NDA, Financial & Accounting Issues, Fraud, Lost Income, Royalties, Etc.
  •             Privacy, Internet, Hacking, Speech, Etc.
  •             Labor and Employment
  •             Mergers & Acquisitions
  •             Real Estate
  •             Owner, Founder, Investor, Board & Committee, Shareholder, D&O, Lender/Debtor, Etc.
  •             Insurance Coverage and Bad Faith
  •             Investigations
  •             Trust, Estate, Conservatorship, Elder Abuse, Etc., and Contentious Administrations
  •             Dispute Resolution and Mediation
  • Real Estate
  • Tax (US and International) and Tax Litigation
  • Technology Companies and Transactions Including AgTech, HealthTech, etc.
  • Wealth and Estate Planning, Trust and Estate Administration, and Disputes and Litigation

Criminal negligence by corporate officers – a good read from Woodruff Sawyer

Passing this along (click the link below) – a good discussion by Woodruff Sawyer about corporate officer liability for criminal negligence (and in a subsequent post I’ll attach an article that I have written which in part discusses this issue). Although corporate officers and board members are not usually prosecuted for criminal wrongdoing, this is an area in which officers and directors can have liability exposure, particularly, for example, in some situations such as environmental contamination, personal consumer or community safety and injury, and with respect to select statutes. Prudent risk and safety management can go a long way to protect officers and directors from liability. Click on the link below to read the Woodruff Sawyer article.

David Tate, Esq. (and CPA, California inactive), litigation, Royse Law Firm, Menlo Park, California office, with offices in northern and southern California).

Here is the Woodruff Sawyer article link:  https://wsandco.com/do-notebook/criminal-negligence-corporate-officer-doctrine/

Court holds that a whistleblower need only have a reasonable belief that the defendant’s conduct was unlawful

The United States District Court, S.D. New York, on a FRCP 56 motion for summary judgment, recently held in Murray v. UBS Securities, LLC that a whistleblower under section 806 need only show reasonable belief that the defendant’s conduct violated federal law. In relevant part see the summary snapshot below. This is important for potential defendants and their decision makers to know when evaluating potential whistleblower situations and how to proceed.

David Tate, Esq. (and CPA, California inactive), Royse Law Firm (Menlo Park office, California, San Francisco Bay Area and the Los Angeles Basin)

PCAOB Adopts New Audit Report-Should Be Interesting-Still Has To Be Adopted By The SEC

The following is a link to the PCAOB website page discussing the PCAOB’s June 2017 adoption of a new audit report which in part requires the disclosure of critical audit matters (CAM) for certain audits conducted under PCAOB standards. Here’s the link to the PCAOB page CLICK HERE

The new report standard still must be adopted by the SEC. If adopted, some of the new report standards will first apply to annual audits for years ending on or after December 15, 2017; however, the critical audit matter reporting would not apply until 2019 at the earliest for certain entities.

As the PCAOB notes, there is a need to make the audit report more relevant. In fact, there is a need to make both external and internal audit and auditors more relevant.

More will follow on this; however, I usually don’t spend signification time on new laws, statutes, regulations, rules and standards until (1) they are in fact enacted or adopted, and (2) it is near the time of actual use or requirement.

I do note, however, that this new report and the CAM provision is an interesting development, which perhaps should have occurred years ago. If you click on the above link, and then on the actual standard itself, you will also see that the standard contains worthwhile discussions about critical audit matters, materiality and other topics that are relevant to the standard.

Best, David Tate, Esq. (and CPA, California inactive). Royse Law Firm, Menlo Park Office, California.

Royse Law Firm – Practice Area Overview – San Francisco Bay Area and Los Angeles Basin

  • Corporate and Securities, Financing and Formation
  • Corporate Governance, D&O, Boards and Committees, Audit Committees, Etc.
  • Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  • International
  • Immigration
  • Mergers & Acquisitions
  • Labor and Employment
  • Litigation (I broke out the litigation because this is my primary area of practice)
  •             Business
  •             Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  •             Trade Secrets, NDA, Financial & Accounting Issues, Fraud, Lost Income, Royalties, Etc.
  •             Privacy, Internet, Hacking, Speech, Etc.
  •             Labor and Employment
  •             Mergers & Acquisitions
  •             Real Estate
  •             Owner, Founder, Investor, Board & Committee, Shareholder, D&O, Lender/Debtor, Etc.
  •             Insurance Coverage and Bad Faith
  •             Investigations
  •             Trust, Estate, Conservatorship, Elder Abuse, Etc., and Contentious Administrations
  • Real Estate
  • Tax (US and International) and Tax Litigation
  • Technology Companies and Transactions Including AgTech, HealthTech, etc.
  • Wealth and Estate Planning, Trust and Estate Administration, and Disputes and Litigation

 

May 15, 2017, Preliminary Injunction Order Against Uber – A Lot Of People Should Take Personal Note – Officers, Directors, Employees, Agents, Suppliers And Consultants

You may have heard, this week on May 15, 2017, Judge William Alsup in the Waymo LLC v. Uber Technologies, Inc. case (U.S. District Court, No. District of California) issued his Order Granting In Part and Denying In Part Plaintiff’s Motion For Provisional Relief, i.e., for a preliminary injunction. The Order is 26 pages. Plaintiff has brought multiple claims in the case including for trade secret misappropriation, patent infringement and unfair competition, but the Order is for preliminary injunction only on the trade secret misappropriation claim. The trade secret claim is brought under both the California Uniform Trade Secrets Act and the federal Defend Trade Secrets Act.

I’m not going to go through the evidence in this post – as indicated above, the Order is 26 pages in length. The Order states that it is narrowly-tailored to balance the interests of the parties and the public. In summary, the decision whether or not to grant a preliminary injunction is based on the evidence now available, the legal claims alleged, the now perceived likelihood of the plaintiff prevailing at trial on the relevant claim or claims, and the interests of the parties and the public. Preliminary injunction motions are significantly based on the strength of the evidence now available and presented and the Judge’s view of that evidence. In this instance, in my view based on the Court’s Order, there was strong evidence that trade secret information possibly was misappropriated, but either no evidence or not particularly strong evidence that Uber had involvement in that possible misappropriation or that Uber had access to or used that information.

Here’s where the Court’s Order gets interesting – in the scope of relief granted. I have pasted below the wording from the Scope of Relief Granted part of the Order. In short aside from the provisions pertaining to Mr. Levandowski, and certain expedited discovery granted, the Order essentially requires Uber to conduct an extensive investigation and to file and disclose a detailed report and account by June 23, 2017, which is a very, very short time to conduct the investigation. In my view it is questionable whether the extent of the investigation can be completed and written-up to be filed in that short of time. And, as you will note, the investigation also includes, or example, all communications with any officer, director, employee, agent, supplier, or consultant of defendants on the relevant topics. Thus, Uber is required to conduct discovery upon itself in the form of the report and account to be filed, and depending on the documents and information obtained the report and account could well bring individual officers, directors, employees, agents, suppliers and consultants personally into focus in the case – if they haven’t done so already, all of those people should be expansively reviewing their possible involvement, if any, in the issues that are involved in the case and consulting with legal counsel about their possible exposure to legal action and personal liability, and how they should proceed.

For your further reading, below is the Scope of Relief Granted provision from the Order.

Best to you. David Tate, Esq.

  1. SCOPE OF RELIEF GRANTED.

Having considered the foregoing, the Court ORDERS as follows:

  1. The term “downloaded materials,” as used in this provisional order, means any and all materials that Anthony Levandowski downloaded from Waymo and kept upon leaving Waymo’s employment, regardless of how long he kept them for and whether or not any such materials qualify as trade secrets or proprietary or confidential information.
  2. Defendants must immediately and in writing exercise the full extent of their corporate, employment, contractual, and other authority to (a) prevent Anthony Levandowski and all other officers, directors, employees, and agents of defendants from consulting, copying, or otherwise using the downloaded materials; and (b) cause them to return the downloaded materials and all copies, excerpts, and summaries thereof to Waymo (or the Court) by MAY 31 AT NOON. Copies essential for counsel of record and their litigation experts to use in defending this civil action are exempted from the foregoing requirement.9
  3. With respect to Anthony Levandowski, defendants shall immediately (a) remove him from any role or responsibility pertaining to LiDAR; (b) take all steps in their power to prevent him from having any communication on the subject of LiDAR with any officer, director, employee, agent, supplier, consultant, or customer of defendants; and (c) prohibit him from consulting, copying, or otherwise using the downloaded materials in any way. Defendants shall instruct all their officers, directors, employees, agents, suppliers, consultants, and customers in writing of this prohibition, and further instruct them in writing to immediately report any suspected breaches thereof to the special master (or to the Court).
  4. With respect to all other persons, including those with Stroz Friedberg, defendants shall conduct a thorough investigation and provide a detailed accounting under oath setting forth every person who has seen or heard any part of any downloaded materials, what they saw or heard, when they saw or heard it, and for what purpose. In their investigation, defendants must do more than query servers with term searches. For example, they must interview personnel with particular focus on anyone who has communicated with Anthony Levandowski on the subject of LiDAR. Defendants’ accounting shall not be limited to Uber but shall include all persons who fit the foregoing description, including Levandowski and his separate counsel. The accounting may exclude, for only the time period after the commencement of this civil action, the attorneys of record and their staff and experts employed for this litigation. The accounting shall not be limited to downloaded materials that happened to make their way into some due diligence report but shall cover any and all downloaded materials. The accounting shall also identify the complete chains of custodians for every copy of any downloaded materials or due diligence report referencing downloaded materials. Defendants must also use the full extent of their authority and influence to obtain cooperation with the foregoing procedure from all involved. For example, if a potential custodian refuses to cooperate, then defendants’ accounting shall set forth the particulars, including all efforts made to obtain cooperation. The accounting must be filed and served by JUNE 23 AT NOON. The accounting may be filed under seal only to the extent that it quotes or appends downloaded materials.
  5. Also by JUNE 23 AT NOON, defendants shall provide Waymo’s counsel and the Court with a complete and chronologically organized log of all oral and written communications — including, without limitation, conferences, meetings, phone calls, one-on-one conversations, texts, emails, letters, memos, and voicemails — wherein Anthony Levandowski mentioned LiDAR to any officer, director, employee, agent, supplier, or consultant of defendants. The log shall identify for each such communication the time, place (if applicable), mode, all persons involved, and subjects discussed, as well as any and all notes or records referencing the communication.
  6. Waymo is hereby granted further expedited discovery in aid of possible further provisional relief. Subject to the protective order, and upon reasonable notice, Waymo’s counsel and one expert may inspect any and all aspects of defendants’ ongoing work involving LiDAR — including, without limitation, schematics, work orders, source code, notes, and emails — whether or not said work resulted in any prototype or device. With respect to its trade secret misappropriation claims only, Waymo may take seven further depositions on seven calendar days notice, may propound 28 reasonably narrow document requests for which the response time is reduced to 14 calendar days, and may propound 28 reasonably narrow interrogatories for which the response time is also reduced to 14 calendar days. If Waymo moves for further provisional relief before trial, then all its declarants in support of such motion must sit for depositions on an expedited basis. Otherwise, defendants may take only normal, unexpedited discovery. After Waymo has exhausted its expedited discovery, it may continue with normal discovery.
  7. Defendants shall keep complete and accurate records of their compliance with all of the foregoing requirements, including directives given to Anthony Levandowski and others. The special master shall monitor and verify said compliance. To that end, the special master shall promptly develop proposed monitoring and verification protocols with the parties’ input and then submit the proposed protocols to the Court for approval. The protocols shall provide for the special master to visit defendants’ facilities and monitor communications as necessary to ensure that Anthony Levandowski remains sealed off from LiDAR activities.

The foregoing provisional relief shall become effective upon the posting by Waymo of a bond or other security in the amount of FIVE MILLION DOLLARS.

* * * * *