Confidential Client Communications? Maybe Not

An attorney 'appearing and practicing before the' SEC must report any material violation of any federal or state law or any breach of fiduciary duty 'up the ladder' to the chief legal officer or CEO, and, if an 'appropriate response' from the CLO or CEO is not forthcoming 'within a reasonable time,' to the company's audit committee or Board of Directors, if there is no committee of independent directors. SOX ' 307; 17 C.F.R. ' 205.3. Attorneys failing to comply with SOX's reporting requirements face civil penalties and discipline by the SEC (but there is no private right of action). 17 C.F.R. ” 205.6, 205.7. The SEC reported in late-2004 that it had named more than 30 lawyers as respondents in enforcement actions in the prior 2 years. (See The Securities Reporter, Vol. 9, Issue 3, Fall 2004, at 23.)

An attorney retained or directed by an issuer to investigate or defend a SOX complaint is most likely 'appearing and practicing before the Commission.' 17 C.F.R. ' 205.3(b)(5). If the attorney is retained by the company's CLO to investigate or defend a SOX complaint, the attorney must report any material violations he or she discovers to the CLO and confirm that the CLO has forwarded the information to appropriate representatives of the Board of Directors. 17 C.F.R. ' 205.3
(b)(6). The attorney would be well advised to get that confirmation in writing. Once that confirmation is received, the attorney has no further reporting obligations. 17 C.F.R. ' 205.3(b)(8). If the attorney does not receive such confirmation, or has reason to believe that the CLO has not reported the evidence of material violation to the Board of Directors, the attorney presumably should do so. 17 C.F.R. ' 205.3(b)(9). An attorney retained by a 'qualified legal compliance committee' to investigate or defend a SOX complaint has no reporting obligations. 17 C.F.R. ' 205.3
(b)(7).

Permissive Reports

If a retained attorney (appearing and practicing before the Commission) reasonably believes that his or her relationship with the company was terminated because he or she reported a material violation, the attorney may report that information to the Board of Directors. 17 C.F.R. ' 205.3(b)(10).

Likewise, a covered attorney may report to the Commission, without the client's consent, 'confidential information related to the representation to the extent the attorney reasonably believes is necessary' to: 1) prevent the company from committing a material violation that is likely to cause substantial injury to the financial interests or property of the company or investors; 2) prevent the company from committing perjury or fraud before the Commission; or 3) rectify the consequences of a material violation by the company that caused or might cause substantial injury to the financial interests or property of the company or investors in the furtherance of which the attorney's services were used. 17 C.F.R. ' 205.3(d). Those permissive reports are much broader in many respects than those allowed under state ethics rules.

Attempted Preemption of State Ethics Rules

According to the SEC, its permissive attorney-reporting rules preempt conflicting state rules or laws. 17 C.F.R. ' 201.1. Likewise, according to the SEC, 'an attorney who complies in good faith with the [reporting] provisions of this part shall not be subject to discipline or otherwise liable under inconsistent standards imposed by any state or other United States jurisdiction where the attorney is admitted or practices.' 17 C.F.R. ' 205.6(c). Accordingly, the SEC takes the position that a covered attorney may make permissive reports of confidential client information that might or would violate state ethics rules. At least two state bar associations (California and Washington) have indicated that their attorneys should comply with state ethics rules and would not be protected from discipline by the SEC's 'good-faith' defense regulation. (See California State Bar Comments On Proposed SEC Rules, dated April 4 and Dec. 16, 2002, and April 4 and 7, 2003; Interim Formal Ethics Opinion Re the Effect of the SEC's Sarbanes-Oxley Regulations on Washington Attorneys' Obligations Under The RPCs; Letter from Washington Bar Association to SEC General Counsel, dated Aug. 11, 2003.) The SEC has indicated that it might pursue injunctive relief in federal court on behalf of reporting attorneys should a state bar association attempt to discipline an attorney who reported client confidences under the SEC's permissive reporting rules.

Audit Letters

Attorneys often provide input to or prepare 'audit letters' for publicly traded companies. As such, they are covered by SOX and subject to SEC Rule 13b2-2(b)(1), which makes it unlawful to 'mislead' a public auditor. (See The Securities Reporter, Vol. 9, Issue 3, Fall 2004, at 23-31 (suggesting that a negligence standard will apply).) At the same time, public auditors are under much greater pressure (and liability) because of SOX to ensure that their audits are completely accurate in all material respects. Id. Consequently, public auditors have begun putting significant pressure on attorneys responding to audit inquiries to give much more information than has been traditionally required under the 1975 ABA/AICPA 'Treaty.' Id. Careful practitioners should comply with the minimum requirements of the Treaty and resist the temptation or client pressure to 'brainstorm' with auditors or discuss facts or legal authority in support of an attorney's assessment, as such information could: 1) ultimately be found to be inconsistent with other internal communications or assessments; 2) be deemed a waiver of the attorney-client or work product privileges; or 3) become an admission by a party-agent. Id.

Noisy Withdrawal Proposal

The SEC has proposed a 'noisy withdrawal' regulation that would: 1) allow a covered attorney to report the attorney's withdrawal from a representation if the attorney reasonably believed that a publicly traded client had not remedied a material violation; or 2) require a publicly traded company to immediately report to investors the withdrawal of any covered attorney and the circumstances of the withdrawal. (See SEC 2003-13 News Release, dated Jan. 23, 2003.) Due to the great controversy created by the proposal, the SEC has not yet promulgated the regulation. However, the SEC has not withdrawn the proposal either.

Pressure to Waive the Attorney-Client Privilege

Attorneys must consider carefully what is said or written to the client and outside counsel regarding a SOX investigation. Should the SEC pursue civil or criminal penalties for either the alleged SOX violation or for an underlying alleged securities violation, the SEC and DOJ may pressure the company to waive its attorney-client and work product privileges to demonstrate 'cooperation.' Both agencies weigh 'cooperation points' heavily when determining what sanctions to seek for SOX violations. (See Memorandum of Deputy Attorney General Larry Thompson, Principles of Federal Prosecution of Business Organization, at 7 (Jan. 20, 2003) (www.usdoj.gov/dag/cftf/corporate_guidelines.htm) ('One factor the prosecutor may weigh in assessing the adequacy of a corporation's cooperation is the completeness of its disclosure including, if necessary, a waiver of the attorney-client and work product protections, both with respect to its internal investigation and with respect to communications between specific officers, directors, and employees and counsel.').)

In addition, while the Thompson Memo suggests that waiver of the attorney-client privilege is not an absolute requirement as a theoretical matter, the reality on the ground may be quite different. For example, in 2003, Shirah Neiman, General Counsel in the U.S. Attorney's Office in the Southern District of New York, stated that a corporation must turn over information to the government when that information is relevant to an alleged securities violation and, if the corporation cannot turn over that information without waiving the attorney-client privilege, the corporation 'need[s] to waive the privilege.' (See John M. Callagy, The Attorney-Client Privilege: A Casualty of Post-Enron Enforcement, Andrews Sec. Litig. and Regulation Reporter (Dec. 15, 2004) (citing Susan Kavanagh, What Prosecutors Look for in a Compliance Program, Federal Ethics Report (July 2003)) (http://www-lawjournalnewsletters.iproduction.com/Admin/cgi-bin/udt/www.eoa.org/%20EOA_Resources/FER_July03.pdf). Notably, Ms. Neiman stated that she did not understand what the 'big hullabaloo' was about on the waiver issue.

Because prosecutors may view invocation of the attorney-client privilege as an admission of wrongdoing, corporate executives are often quick to waive the privilege to reduce the risk of indictment or sanction. The SEC promotes that perspective. For example, In the Matter of Gisela de Leon-Meredith, Exchange Act Release No. 44970 (Oct. 23, 2001), a controller confessed to manipulating a subsidiary's assets and expenses, and the parent company, Seaboard, immediately launched its own investigation and then fully cooperated with the prosecution of the controller. That cooperation included waiving the corporation's attorney-client privilege and work product protections. Ultimately, the controller was sanctioned, but the SEC noted that it was 'not taking action against [Seaboard], given the nature of the conduct and the company's responses,' which the SEC noted included not invoking the attorney-client privilege or the work product protection. (See U.S. Securities and Exchange Commission, Release No. 44969 (Oct. 23, 2001) (www.sec.gov/litigation/investreport/34-44969.htm).) The SEC and DOJ have continued to stress such waivers as those agencies pursue SOX investigations and related indictments. Consequently, corporate counselors investigating potential SOX violations should view every oral and written communication as one that might one day be disclosed to the SEC or DOJ in an effort by a corporate client to gain favor and avoid any threat (real or imagined) of criminal or civil penalties.

A complicating factor is that initial corporate communications related to a SOX investigation may occur months or years before the SEC or DOJ asks for a waiver and the waiver decision may be made by corporate officers who have replaced those who were involved in the initial investigation or underlying events. Additionally, potential SOX violations may be investigated by different internal teams representing different perspectives. For example, a company may commission an employment-law investigation to evaluate whistleblower allegations, a securities-law investigation to evaluate accounting allegations, and an audit-committee investigation to evaluate internal control processes. Those investigations may be conducted in parallel or serially over time. Confidential communications in each investigation may ultimately be subject to disclosure through a corporate waiver. Consequently, corporate counselors should view SOX investigations as having a long and convoluted 'life cycle,' and should be exceedingly circumspect in their own communications and in advising others on when and how to communicate.

Steve Wheeless is a partner in the Phoenix office of Steptoe & Johnson LLP, where he represents management in labor relations and employment matters. He has written and spoken extensively on the employment aspects of Sarbanes-Oxley. He can be contacted at 602-257-5234 or [email protected].

Former SEC Chairman William H. Donaldson noted in a March 5, 2004 speech that SOX was needed to deal with 'a general erosion of standards of integrity and ethics in the corporate and financial world … The acquiescence by the gatekeepers, like accountants, who turned their backs or actually condoned such accounting manipulation, combined with stock option incentives to management, fueled the short-term focus.' (www.lawjournalnewsletters.iproduction.com/Admin/cgibin/udt/www.sec%20gov/news/speech/spch030504whd.htm.) Ironically, the SEC and the Department of Justice, which enforce SOX's criminal provisions, appear ready to burden the traditional ethical obligations of corporate legal counselors to keep client communications confidential in an effort to police the integrity and ethics of other corporate gatekeepers. To that end, the SEC imposes certain reporting requirements on corporate counselors, attempts to preempt state ethics rules, and DOJ prosecutors routinely pressure 'target' corporations to waive the attorney-client privilege to obtain 'cooperation' points. Corporate counselors must be aware of those initiatives to properly balance their competing obligations.

Attorney Reporting Requirements

Mandatory Reports

An attorney 'appearing and practicing before the' SEC must report any material violation of any federal or state law or any breach of fiduciary duty 'up the ladder' to the chief legal officer or CEO, and, if an 'appropriate response' from the CLO or CEO is not forthcoming 'within a reasonable time,' to the company's audit committee or Board of Directors, if there is no committee of independent directors. SOX ' 307; 17 C.F.R. ' 205.3. Attorneys failing to comply with SOX's reporting requirements face civil penalties and discipline by the SEC (but there is no private right of action). 17 C.F.R. ” 205.6, 205.7. The SEC reported in late-2004 that it had named more than 30 lawyers as respondents in enforcement actions in the prior 2 years. (See The Securities Reporter, Vol. 9, Issue 3, Fall 2004, at 23.)

An attorney retained or directed by an issuer to investigate or defend a SOX complaint is most likely 'appearing and practicing before the Commission.' 17 C.F.R. ' 205.3(b)(5). If the attorney is retained by the company's CLO to investigate or defend a SOX complaint, the attorney must report any material violations he or she discovers to the CLO and confirm that the CLO has forwarded the information to appropriate representatives of the Board of Directors. 17 C.F.R. ' 205.3
(b)(6). The attorney would be well advised to get that confirmation in writing. Once that confirmation is received, the attorney has no further reporting obligations. 17 C.F.R. ' 205.3(b)(8). If the attorney does not receive such confirmation, or has reason to believe that the CLO has not reported the evidence of material violation to the Board of Directors, the attorney presumably should do so. 17 C.F.R. ' 205.3(b)(9). An attorney retained by a 'qualified legal compliance committee' to investigate or defend a SOX complaint has no reporting obligations. 17 C.F.R. ' 205.3
(b)(7).

Permissive Reports

If a retained attorney (appearing and practicing before the Commission) reasonably believes that his or her relationship with the company was terminated because he or she reported a material violation, the attorney may report that information to the Board of Directors. 17 C.F.R. ' 205.3(b)(10).

Likewise, a covered attorney may report to the Commission, without the client's consent, 'confidential information related to the representation to the extent the attorney reasonably believes is necessary' to: 1) prevent the company from committing a material violation that is likely to cause substantial injury to the financial interests or property of the company or investors; 2) prevent the company from committing perjury or fraud before the Commission; or 3) rectify the consequences of a material violation by the company that caused or might cause substantial injury to the financial interests or property of the company or investors in the furtherance of which the attorney's services were used. 17 C.F.R. ' 205.3(d). Those permissive reports are much broader in many respects than those allowed under state ethics rules.

Attempted Preemption of State Ethics Rules

According to the SEC, its permissive attorney-reporting rules preempt conflicting state rules or laws. 17 C.F.R. ' 201.1. Likewise, according to the SEC, 'an attorney who complies in good faith with the [reporting] provisions of this part shall not be subject to discipline or otherwise liable under inconsistent standards imposed by any state or other United States jurisdiction where the attorney is admitted or practices.' 17 C.F.R. ' 205.6(c). Accordingly, the SEC takes the position that a covered attorney may make permissive reports of confidential client information that might or would violate state ethics rules. At least two state bar associations (California and Washington) have indicated that their attorneys should comply with state ethics rules and would not be protected from discipline by the SEC's 'good-faith' defense regulation. (See California State Bar Comments On Proposed SEC Rules, dated April 4 and Dec. 16, 2002, and April 4 and 7, 2003; Interim Formal Ethics Opinion Re the Effect of the SEC's Sarbanes-Oxley Regulations on Washington Attorneys' Obligations Under The RPCs; Letter from Washington Bar Association to SEC General Counsel, dated Aug. 11, 2003.) The SEC has indicated that it might pursue injunctive relief in federal court on behalf of reporting attorneys should a state bar association attempt to discipline an attorney who reported client confidences under the SEC's permissive reporting rules.

Audit Letters

Attorneys often provide input to or prepare 'audit letters' for publicly traded companies. As such, they are covered by SOX and subject to SEC Rule 13b2-2(b)(1), which makes it unlawful to 'mislead' a public auditor. (See The Securities Reporter, Vol. 9, Issue 3, Fall 2004, at 23-31 (suggesting that a negligence standard will apply).) At the same time, public auditors are under much greater pressure (and liability) because of SOX to ensure that their audits are completely accurate in all material respects. Id. Consequently, public auditors have begun putting significant pressure on attorneys responding to audit inquiries to give much more information than has been traditionally required under the 1975 ABA/AICPA 'Treaty.' Id. Careful practitioners should comply with the minimum requirements of the Treaty and resist the temptation or client pressure to 'brainstorm' with auditors or discuss facts or legal authority in support of an attorney's assessment, as such information could: 1) ultimately be found to be inconsistent with other internal communications or assessments; 2) be deemed a waiver of the attorney-client or work product privileges; or 3) become an admission by a party-agent. Id.

Noisy Withdrawal Proposal

The SEC has proposed a 'noisy withdrawal' regulation that would: 1) allow a covered attorney to report the attorney's withdrawal from a representation if the attorney reasonably believed that a publicly traded client had not remedied a material violation; or 2) require a publicly traded company to immediately report to investors the withdrawal of any covered attorney and the circumstances of the withdrawal. (See SEC 2003-13 News Release, dated Jan. 23, 2003.) Due to the great controversy created by the proposal, the SEC has not yet promulgated the regulation. However, the SEC has not withdrawn the proposal either.

Pressure to Waive the Attorney-Client Privilege

Attorneys must consider carefully what is said or written to the client and outside counsel regarding a SOX investigation. Should the SEC pursue civil or criminal penalties for either the alleged SOX violation or for an underlying alleged securities violation, the SEC and DOJ may pressure the company to waive its attorney-client and work product privileges to demonstrate 'cooperation.' Both agencies weigh 'cooperation points' heavily when determining what sanctions to seek for SOX violations. (See Memorandum of Deputy Attorney General Larry Thompson, Principles of Federal Prosecution of Business Organization, at 7 (Jan. 20, 2003) (www.usdoj.gov/dag/cftf/corporate_guidelines.htm) ('One factor the prosecutor may weigh in assessing the adequacy of a corporation's cooperation is the completeness of its disclosure including, if necessary, a waiver of the attorney-client and work product protections, both with respect to its internal investigation and with respect to communications between specific officers, directors, and employees and counsel.').)

In addition, while the Thompson Memo suggests that waiver of the attorney-client privilege is not an absolute requirement as a theoretical matter, the reality on the ground may be quite different. For example, in 2003, Shirah Neiman, General Counsel in the U.S. Attorney's Office in the Southern District of New York, stated that a corporation must turn over information to the government when that information is relevant to an alleged securities violation and, if the corporation cannot turn over that information without waiving the attorney-client privilege, the corporation 'need[s] to waive the privilege.' (See John M. Callagy, The Attorney-Client Privilege: A Casualty of Post-Enron Enforcement, Andrews Sec. Litig. and Regulation Reporter (Dec. 15, 2004) (citing Susan Kavanagh, What Prosecutors Look for in a Compliance Program, Federal Ethics Report (July 2003)) (http://www-lawjournalnewsletters.iproduction.com/Admin/cgi-bin/udt/www.eoa.org/%20EOA_Resources/FER_July03.pdf). Notably, Ms. Neiman stated that she did not understand what the 'big hullabaloo' was about on the waiver issue.

Because prosecutors may view invocation of the attorney-client privilege as an admission of wrongdoing, corporate executives are often quick to waive the privilege to reduce the risk of indictment or sanction. The SEC promotes that perspective. For example, In the Matter of Gisela de Leon-Meredith, Exchange Act Release No. 44970 (Oct. 23, 2001), a controller confessed to manipulating a subsidiary's assets and expenses, and the parent company, Seaboard, immediately launched its own investigation and then fully cooperated with the prosecution of the controller. That cooperation included waiving the corporation's attorney-client privilege and work product protections. Ultimately, the controller was sanctioned, but the SEC noted that it was 'not taking action against [Seaboard], given the nature of the conduct and the company's responses,' which the SEC noted included not invoking the attorney-client privilege or the work product protection. (See U.S. Securities and Exchange Commission, Release No. 44969 (Oct. 23, 2001) (www.sec.gov/litigation/investreport/34-44969.htm).) The SEC and DOJ have continued to stress such waivers as those agencies pursue SOX investigations and related indictments. Consequently, corporate counselors investigating potential SOX violations should view every oral and written communication as one that might one day be disclosed to the SEC or DOJ in an effort by a corporate client to gain favor and avoid any threat (real or imagined) of criminal or civil penalties.

A complicating factor is that initial corporate communications related to a SOX investigation may occur months or years before the SEC or DOJ asks for a waiver and the waiver decision may be made by corporate officers who have replaced those who were involved in the initial investigation or underlying events. Additionally, potential SOX violations may be investigated by different internal teams representing different perspectives. For example, a company may commission an employment-law investigation to evaluate whistleblower allegations, a securities-law investigation to evaluate accounting allegations, and an audit-committee investigation to evaluate internal control processes. Those investigations may be conducted in parallel or serially over time. Confidential communications in each investigation may ultimately be subject to disclosure through a corporate waiver. Consequently, corporate counselors should view SOX investigations as having a long and convoluted 'life cycle,' and should be exceedingly circumspect in their own communications and in advising others on when and how to communicate.

Steve Wheeless is a partner in the Phoenix office of Steptoe & Johnson LLP, where he represents management in labor relations and employment matters. He has written and spoken extensively on the employment aspects of Sarbanes-Oxley. He can be contacted at 602-257-5234 or [email protected].