New COSO Updated ERM Framework – Coming Soon – End of June, Perhaps – Could Be Very Important

Just a heads up, a source has suggested that the new long-anticipated COSO (Committee of Sponsoring Organizations of the Treadway Commission) ERM update might finally be out at the end of June. COSO is spending a very long time (since October 2014) preparing and vetting this “update” of the 2004 Enterprise Risk Management — Integrated Framework. COSO’s sponsoring organizations are the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), The Institute of Internal Auditors (IIA), and the National Association of Accountants (now the Institute of Management Accountants [IMA]), and the Commission includes representatives from industry, public accounting, investment firms, and SROs (exchanges).

We’ll have to wait and see what we get with this “update,” which will either simply be a relatively unimpressive or vague tweak, or a useful, modernized, sufficiently detailed guide which might become the standard to achieve, or somewhere in between. I’m hopeful for the useful version – ERM needs a big boost – this “update” is important. I find that there really are only three ways to provide this type of boost: sponsorship and push by large or influential organizations and people, mandatory (i.e., by law, regulation or rule) adoption, or, sometimes, push and expectancy by the public.

Here is the link to the COSO website https://www.coso.org/Pages/default.aspx

Best to you, David Tate, Esq., Litigation, D&O, audit committees, etc., Royse Law Firm http://rroyselaw.com/

Evaluating Director Independence – Zynga Shareholder Derivative Suit

Thomas Sandys Derivatively on Behalf of Zynga, Inc. v. Pincus, et al., Delaware Supreme Court, Case No. 157,2016, December 5, 2016, highlights the sometimes difficulty, and the importance of evaluating director independence in the circumstance of a shareholder derivative suit.

In Zynga the plaintiff filed his shareholder derivative suit without first making a demand upon the board that the Company sue Company insiders that were alleged to have improperly sold Company stock. Instead of first making the demand upon the board, plaintiff argued that such a demand would have been futile because a majority of the nine person board members lacked independence.

In summary, the plaintiff alleged two derivative claims based on allegations that certain top managers and directors at Zynga were given an exemption to the Company’s standing rule preventing sales of stock by insiders until three days after an earnings announcement, and that the insiders who participated in the sale breached their fiduciary duties by misusing confidential information when they sold their shares while in possession of adverse, material non-public information. And plaintiff also asserted a duty of loyalty claim against the directors who approved the sale.

The holding in Zynga is that at the pleading stage there was sufficient evidence to suggest that a majority of the board did lack independence so as to excuse not making the demand upon the board. The holding is primarily interesting for the Court’s discussion about three particular board members, and the reasons why the Court determined that there was evidence to sufficiently suggest that those three directors did in fact lack independence to impartially consider a demand that the Company bring suit against the selling insiders, which resulted in a majority of the board also lacking independence, so as to excuse making the pre-suit demand upon the board.

To plead demand excusal the plaintiff must plead particularized factual allegations that create a reasonable doubt that, as of the time the complaint was filed, the board of directors could have properly exercised its independent and disinterested business judgment in responding to a demand. At the pleading stage, a lack of independence turns on whether the plaintiff has pleaded facts from which the director‘s ability to act impartially on a matter important to the interested party can be doubted because that director may feel subject to the interested party‘s dominion or beholden to that interested party.
With respect to one of the directors in question, the Court found troubling for the purpose of independence or lack thereof that the particular board member and her husband co-owned an unusual asset, an airplane, with Zynga’s former CEO and controlling stockholder, which the Court found was suggestive of an “extremely intimate personal friendship between their families.”

And with respect to the other two directors, the Court found troubling for the purpose of independence or lack thereof that the directors are partners at a prominent venture capital firm and that they and their firm not only controlled 9.2% of Zynga‘s equity as a result of being early-stage investors, but have other interlocking relationships with the controller and another selling stockholder outside of Zynga. More specifically the Court stated “Although it is true that entrepreneurs like the controller need access to venture capital, it is also true that venture capitalists compete to fund the best entrepreneurs and that these relationships can generate ongoing economic opportunities. There is nothing wrong with that, as that is how commerce often proceeds, but these relationships can give rise to human motivations compromising the participants’ ability to act impartially toward each other on a matter of material importance. Perhaps for that reason, the Zynga board itself determined that these two directors did not qualify as independent under the NASDAQ rules, which have a bottom line standard that a director is not independent if she has ―a relationship which, in the opinion of the Company‘s board of directors, would interfere with the exercise of independent judgment . . . .[Footnote #1: NASDAQ Marketplace Rule 5605(a)(2)] Although the plaintiff’s lack of diligence made the determination as to these directors perhaps closer than necessary, in our view, the combination of these facts creates a pleading stage reasonable doubt as to the ability of these directors to act independently on a demand adverse to the controller‘s interests. When these three directors are considered incapable of impartially considering a demand, a majority of the nine member Zynga board is compromised for Rule 23.1 purposes and demand is excused. Thus, the dismissal of the complaint is reversed.”

As you might correctly assume, board member independence can arise as an issue in several different corporate and governance related circumstances.

* * * * *

NEW NINTH CIRCUIT CASE – PLAINTIFF CANNOT BRING A SECURITIES CASE FOR BREACH OF THE CORPORATE CODE OF ETHICS . . . WELL, NOT SO FAST . . . .

On January 19, 2017, the Ninth Circuit dismissed a securities fraud case holding that the claim could not legally be brought where shareholders of Hewlett-Packard Company (“HP”) alleged that the Company CEO and Chairman violated Hewlett-Packard’s Corporate Code of Ethics after publicly touting the Company’s high standards for ethics and compliance while at the same time himself violating the provisions in the Code of Ethics. The case is Retail Wholesale & Department Store Union Local 338 Retirement Fund v. Hewlett-Packard Co. and Mark A. Hurd, Ninth Circuit Case No. 14-16433 and District Court Case No. 3:12-cv-04115-JST (Northern District of California) and you can view the case at http://cdn.ca9.uscourts.gov/datastore/opinions/2017/01/19/14-16433.pdf.

Plaintiffs’ claim was brought under §10 and Rule 10–b of the Securities Exchange Act of 1934. The Court’s decision is helpful from a defense viewpoint, but the decision shouldn’t be viewed too broadly. In summary, the Court held as follows (note: the below quotes from the case are not necessarily in the exact order in which they appeared in the Court’s decision):

“Retail Wholesale argues that the SBC [HP’s Standards of Business Conduct], bolstered by Defendants’ express promotion of corporate ethics, gives rise to a finding of material misrepresentation. Its claim is based in three factual allegations: (1) HP and Hurd actively promoted the SBC and stated that HP had zero tolerance for SBC violations; (2) Hurd’s SBC violations led to his resignation; and (3) Hurd’s resignation caused HP’s stock price to drop. The Court cannot agree that, under the facts alleged in the complaint, Defendants’ representations about ethics were materially misleading.”

“Defendants made no objectively verifiable statements during the Class Period. As one court has aptly written, a code of conduct is “inherently aspirational.” Andropolis, 505 F. Supp. 2d at 686. Such a code expresses opinions as to what actions are preferable, as opposed to implying that all staff, directors, and officers always adhere to its aspirations. See id.”

“Similarly, Hurd’s comments prefacing the SBC are not objectively verifiable. In the 2008 preface to the SBC, Hurd stated, in part,

We want to be a company known for its ethical leadership . . . .

We know actions speak louder than words. We must make decisions and behave in ways that we can be proud of, that reflect our commitment to doing the right thing . . . .

. . . . Let us commit together, as individuals and as a company, to build trust in everything we do by living our values and conducting business consistent with the high ethical standards within our SBC.”

“The aspirational nature of these statements is evident. They emphasize a desire to commit to certain “shared values” outlined in the SBC and provide a “vague statement[] of optimism,” not capable of objective verification. See Or. Pub. Emps., 774 F.3d at 606. A contrary interpretation—that statements such as, for example, the SBC’s “we make ethical decisions,” or Hurd’s prefatory statements, can be measured for compliance—is simply untenable, as it could turn all corporate wrongdoing into securities fraud.”

However, and equally important, the Court also stated:

“We note that the case may have been closer had Hurd’s sexual harassment and false expenses scandal involved facts remotely similar to those presented by the 2006 scandal [i.e., an earlier unrelated ethics problem at HP in which “A few years earlier, in 2006, a major scandal erupted when a whistleblower informed several government agencies that HP had hired detectives to monitor the phone records and email accounts of HP directors, HP employees, and journalists to find the sources of leaks of company information to the press”], as the ethical code could then have been understood as at least promising specifically not to do what had been done in 2006. Here, however, the context does not make HP’s promotion of business ethics any less subjective or vague. Further, Retail Wholesale cites to no case law suggesting that context may operate to allow a plaintiff to import an out-of-Class-Period statement into the Class Period. The strongest statement alleged in the complaint—the suggestion of a zero tolerance policy for SBC violations—was made outside of the Class Period.”

“In sum, we conclude that as there was no statement during the Class Period that was capable of being objectively false, there was no affirmative misrepresentation.”

It could be easy to read the case too broadly, and to conclude that a securities fraud claim cannot be brought for violation of the company’s code of ethics. Whether such a claim can be brought really depends on the facts and circumstances of the case. Further, and depending on the facts of each case, it might be possible that such a claim could be brought under a different legal theory such as, for example, the Foreign Corrupt Practices Act.

Thus, companies, and their officers, managing agents and directors still must be advised to know the company’s Code of Ethics, to follow the Code, and to be careful about making specific representations about following, satisfying or complying with the Code.

* * * * *

Updated Tate’s Excellent Audit Committee Guide (02172017) – Please Use, And Pass To Others

Below I have provided a link to my updated (02172017) Tate’s Excellent Audit Committee Guide. Please use it, and tell other people who would be interested. Best to you, David Tate, Esq., Royse Law Firm, Northern and Southern California, 149 Commonwealth Drive, Ste. 1001, Menlo Park, CA 94025, (650) 813-9700, Extension 233, http://www.rroyselaw.com

Here’s the link to the updated guide tates-excellent-audit-committee-guide-02172017-with-appendix-a

david-tate-picture-large-cropped

Audit Committee 5 Lines of Defense 07182016

Why do so many practitioners misunderstand risk? Forwarding post by Norman Marks

The following is a link to a new post by Norman Marks, https://normanmarks.wordpress.com/2016/11/26/why-do-so-many-practitioners-misunderstand-risk/ , Why do so many practitioners misunderstand risk? See also the link to “A Revolution in Risk Management” which is provided in Norman’s post. This is a good, i.e., worthwhile, post and discussion – the point being, I believe, is to not be too singularly focused in your evaluation of risks and risk management. I also like Norman’s use of the tree to visually demonstrate the discussion.

Best to you, Dave Tate, Esq., San Francisco and California. Link for Tate’s Excellent Audit Committee Guide http://wp.me/p75iWX-6z

What’s up with this – the SEC disclaims a Dodd-Frank Annual Report by its Staff?

I don’t get this. See the two below screenshots. The first screenshot is of the cover page from the SEC’s annual report about Dodd-Frank. And the second screenshot is from a following page with the SEC disclaiming the report which was prepared by the SEC staff. The SEC issues an annual report, and then disclaims it, alleging that the report was from the SEC’s staff, which isn’t sufficiently reliable? I don’t believe that a company or an individual could get away with that?

sec-annual-report-to-congress-on-the-dodd-frank-cover-page

sec-annual-report-to-congress-on-the-dodd-frank-disclaimer

 

Here is the link for the entire report,

Click to access owb-annual-report-2016.pdf

I’m not criticizing the report, necessarily, just the disclaimer. How can you disclaim a report on your behalf by your own staff? Did the SEC review the report? I hope so.

Best to you, Dave Tate, Esq., San Francisco and California.

 

EEOC sues for alleged unequal female – male pay for the same employment position

Below is a screenshot from the EEOC website for a recent press release, and the EEOC’s announcement about a new lawsuit over alleged unequal female v. male pay for the same employment position. As you might well imagine, the opportunities for this type of lawsuit truly could be very numerous. Is your board or audit committee, or a director member, overseeing, to any extent, HR, employer and employee matters, including, for example, liability exposure and asset protection (trade secrets, etc.)? It’s worth some consideration. And this holds true for public companies, private companies, and nonprofits.

eeoc-sues-for-alleged-unequal-female-male-pay-for-the-same-employment-position

Who Evaluates the Chief Audit Executive (CAE)?

At the bottom of this post is a screen shot from the new publication Ethics and Pressure, Balancing the Internal Audit Profession, published primarily from the 2015 global practitioner survey of internal auditors worldwide. This is a really big survey. What do you think of the screen shot? Is it appropriate for management to evaluate the chief audit executive (“CAE”)? I say “yes,” of course.

I note however, that the writer also says “Exhibit 9 indicates that this responsibility [i.e., the responsibility for evaluating the performance of the CAE] is generally split evenly between management and the board. The big exception is in North America, where 61% of CAE’s are formally evaluated by management. Often however, these evaluations are reviewed by an audit committee.”

Let me just say, and I read a fair amount of materials from or relating to the internal audit profession, these sentences from the writer probably speak volumes. Do you mean to say that the audit committee isn’t always also doing its own evaluation of internal audit? I really hope that’s not what the writer is saying.

If you are on an audit committee, do you evaluate the performance of the CAE and of the internal audit function (if you have an internal audit function)? I certainly hope so. I mean, regardless of how internal audit operates with management, as an audit committee member aren’t you interacting with internal audit also, and isn’t internal audit helping you to satisfy your due diligence responsibilities? If not, you really need to sit down and think about how the audit committee is using internal audit.

And, if you are an internal audit CAE or member, if the audit committee isn’t sufficiently interested in you to evaluate your performance and how you help or don’t help the audit committee, then you are really missing the boat with a significant entity (i.e., the audit committee) that you should be helping.

In fact, most of the materials that I read from internal audit miss the boat, in my opinion. Yes, management’s use and interaction with internal audit is very important, but the audit committee really should value and make use of the availability of internal audit to help the audit committee satisfy it’s duties. If this isn’t happening, both the audit committee and internal audit are missing out on a tremendous opportunity. It might also be argued that both are failing to satisfy their responsibilities.

Here’s the screen shot from the survey and discussion:

who-evaluates-the-cae

Updated Tate’s Excellent Audit Committee Guide – Attached – Use It – Pass It Along – Free

Below is a link to my updated Tate’s Excellent Audit Committee Guide (updated October 20, 2016). Please use it, and pass it to other people who would be interested, such as audit committee members, directors, officers, accountants, internal and external auditors, in-house counsel, compliance professionals, and other people.

I do note that as I was updating these materials, and going through the entire Guide, it definitely hit me that all of the specifically enacted statutes, regulations, rules and pronouncements definitely could cause an audit committee member to not be able to see the forest for the tress. So let’s also not forget to look at the situation as a whole.

Although the Guide is 186 pages, I do expect some significant updates soon, and perhaps prior to the end of 2016. Many of the updates will be posted to this blog first, and then to the Guide. I am looking forward to the COSO enterprise risk management (ERM) updated framework.

Best to you. Dave Tate, Esq., San Francisco and California.

Here is a link to the updated Tate’s Excellent Audit Committee Guide (updated October 20, 2016), tates-excellent-audit-committee-guide-10202016-final-with-appendix-a

Audit Committee 5 Lines of Defense 07182016

The business judgment rule – an animated video:

 

DTatePicture_Square

Forwarding a worthwhile paper discussing objective based risk management

I am forwarding a link to a short article by Tim Leech and Lauren Hanlon discussing, as they say, Paradigm paralysis in ERM & internal audit. I am providing you with this article because of the discussion between risk management that first and primarily identifies risk, and one that first starts with the objectives of the enterprise, and then follows with the risks to those objectives.

You might also be aware that soon, perhaps next month in September, COSO will be making available its eagerly awaited ERM update, which could be an important development.

Below is the link to the Leech/Hanlon paper (I do also note that they lost me a little with the sample summary report on the second page of the paper – I prefer reports that very easily speak for themselves – but I have found that sometimes professionals with Tim’s experience tend to write in a manner that is not always the most easy or simple to understand). This is a worthwhile paper – please read it.  Dave Tate, Esq., San Francisco and California.

Click to access Risk-Oversight-Solutions-Paradigm-Paralysis-in-ERM-IA-Tim-Leech-Lauren-Hanlon.pdf