The Effect of Sarbanes-Oxley on Private Companies

The enactment in July 2002 of the Sarbanes-Oxley Act, the subsequent rulemaking commenced by the Securities and Exchange Commission (SEC), and anticipated changes in listing requirements by the New York Stock Exchange, Nasdaq and other exchanges, is effecting far-reaching changes in corporate governance, financial statement disclosure, management compensation and auditor independence. For the most part, these reforms are by their terms applicable only to "public" companies — corporate issuers of securities registered under the Securities Exchange Act. However, many private companies will be significantly affected by the indirect and long-term effect of these reforms, and should consider instituting appropriate corporate governance reforms as a result.

Why Should Private Companies Bother?

Several factors support a private company's institution of corporate governance reforms that track those required of public companies:

Insistence by Third Parties. Key business partners may insist on certain aspects of compliance as a precondition to instituting or continuing their relationship with the private company. For example, a lender may require independent directors and an independent audit committee in order to approve a loan. An insurance company may require financial statement certifications by the company's Chief Executive Officer and Chief Financial Officer as a condition to providing "D&O" coverage. A potential candidate for the board may require that certain governance measures be in place as a condition to his or her nomination. State or federal governments may require a broad range of assurances in order to approve government contracts — assurances that may not be possible unless certain internal controls are adopted now.

Investors and Buyers. Prospective investors in a private placement of securities — and prospective purchasers of a privately held company — will increasingly insist on audited financials, assurances as to auditor and audit committee independence, controls over and disclosure of "insider transactions" and the inclusion of a Management's Discussion and Analysis section ("MD&A") to illuminate financial statements. Existing shareholders, especially in private companies with a large number of non-management shareholders, are also expected to insist on a greater amount of ongoing disclosure, especially relating to financial statement and management compensation matters.

State Requirements. State securities regulators and attorneys general may adopt requirements similar to those associated with Sarbanes-Oxley that may extend to private companies.

Litigation Avoidance. The fiduciary duties of officers and directors of private companies — the duties of care and loyalty — are the same as those of public companies. To the extent Sarbanes-Oxley and the related requirements have established higher standards of conduct in matters such as auditor independence, financial statement review, insider transactions and disclosure, those higher standards will likely affect these duties — and therefore the potential liabilities of directors and officers of private companies. For example, the lack of an independent audit committee, or the absence of an audit committee financial expert, would be expected to be raised by a plaintiff's attorney in the event of a claim of financial mismanagement or fraud in a privately held company.

Going Public? Companies that desire eventually to go public, and to be listed on an exchange, will be subject (either immediately or shortly thereafter) to the full weight of the Sarbanes-Oxley related requirements, many of which will be difficult or impossible to comply with in a timely manner if not instituted well in advance of going public.

GAAP Changes. Sarbanes-Oxley recognizes the authority of FASB to consider accounting issues and evolving business practices and modify generally accepted accounting principles (GAAP) accordingly. Any such changes will also affect private companies' accounting practices.

Auditing Standards. Sarbanes-Oxley establishes the Public Company Accounting Oversight Board to review and set standards relating to the conduct of audits. While the standards technically apply only to audits of financial statements of public companies, accountants will likely follow the same standards in auditing financial statements of private companies, which will affect private companies' relationships with their accountants.

Adding Value. While Sarbanes-Oxley and the related requirements add significant levels of cost, and some inefficiency, to matters of corporate governance and financial oversight, they also contain many provisions that, once implemented, have the potential to strengthen a company's internal organization and procedures. Instituting codes of conduct, internal controls and independent audit procedures, as well as going though the chore of preparing an MD&A, can actually add value to private companies in the long run.

What Steps Should Private Companies Take?

Based on the considerations noted above, privately held companies—especially those with a broad base of non-management shareholders or that expect to go public or sell to a public company in the future — should consider instituting the following measures:

Independent Directors. Many private companies do not have any truly independent directors. Consideration should be given to adding such independent directors to the Board, not only for purposes of the audit committee noted below, but also for service on a compensation committee that deals with management compensation (including bonuses and options to management shareholders).

Audit Committee. Many private companies do not have independent audit committees. Private companies should adopt audit committee charters that mirror those of public companies, including requiring that audit committee members consist of independent directors and that they follow rules and procedures similar to those that public company audit committees are now required to follow. Consideration might also be given to including an audit committee financial expert on the audit committee.

Internal Accounting Controls. Periodic review of the adequacy and scope of internal accounting controls and procedures, their implementation, the operation of the internal audit function, and the prompt "follow up" of auditor recommendations should all be undertaken. Sarbanes-Oxley requires that management certify that a public company has in place internal accounting controls sufficient to gather the information needed to evaluate and reflect in the financial statements. While this "certification" is not currently required of private companies, a sound system of internal controls is recommended—in part to make such certification possible if required in the future.

Financial Transparency and the MD&A. An independent audit committee and improved internal controls should be viewed as methods of accomplishing the larger goals of full transparency of critical accounting policies and clearer financial statements. A central component of this enhanced financial disclosure is the MD&A, which reflects management's assessment of the company's performance, trends in the business and effects of critical accounting policies and estimates. Long the province solely of public companies, the MD&A is now clearly emphasized by the SEC as the key element of periodic financial statement disclosure. Private companies should consider adding an MD&A to accompany their financial statements, after having the draft MD&A reviewed by experienced counsel. The creation of an MD&A, in the detailed format expected of public companies, will present an initial challenge and cost, but should prove manageable as the company and its financial representatives gain experience with the process and format.

Review your Auditor. Sarbanes-Oxley makes it unlawful for any person not with a registered public accounting firm to prepare or participate in preparing an audit of a public company, and prohibits accounting firms preparing an audit for a public company from performing certain non-audit services (including investment adviser, appraisal, internal audit or legal services) for that company. Non-audit services that are not prohibited must be pre-approved by the audit committee. Once the registration rules are in place, private companies should consider "upgrading" to a registered accounting firm for the audit function, and limiting the company's engagement of the auditor for non-audit services.

Codes of Business Conduct and Ethics. Sarbanes-Oxley effectively requires the adoption of a code of conduct applicable to senior financial management that encourages compliance with applicable laws and deters wrongdoing. In addition, the stock exchanges have proposed rules that detail the behavior and performance expected of employees on various matters such as conflicts of interest, policies against bribery, etc. Consideration should be given to adopting such a code — and importantly, ensuring that employees are advised of it and that it is enforced. Any private company faced with a lawsuit or prosecution alleging corporate misconduct will have a much stronger defense if it can point to both a code of business conduct and ethics and diligent attempts to follow that code.

Insider Transactions. Policies adopted should provide assurance that all transactions with officers, directors and significant shareholders be on an "arms-length" basis, and that certain actions banned for public companies by Sarbanes-Oxley — such as loans to executive officers or directors — are also prohibited by the private company (or, alternatively, structured so that they can be terminated prior to an IPO without adverse consequences to the company).

Summary

Sarbanes-Oxley, and the related regulations and exchange requirements, have significantly "elevated the bar" for many areas of corporate governance and financial compliance for public companies. Many private companies can expect that several of these requirements will also, directly or indirectly, be extended to them. By taking action now to comply voluntarily with many of these requirements, larger private companies (or those companies with aspirations of achieving significant growth, going public or being acquired) can reap rewards associated with third party approvals and improved internal controls and governance, while at the same time reducing their litigation exposure. In addition, investors and acquirers may be willing to pay a premium to invest in or buy companies with sound corporate governance practices. The administrative cost — in time and dollars — associated with undertaking such actions will in most cases be outweighed by these benefits.