Statement of Commissioners Hester M. Peirce and Elad L. Roisman - Andeavor LLC

We write to explain why we voted against the Commission’s settled action in the matter of Andeavor LLC.[1]  A majority of the Commission found that Andeavor violated Exchange Act Section 13(b)(2)(B), which requires reporting companies to devise and maintain a system of “internal accounting controls,” when Andeavor repurchased its stock from shareholders after its legal department concluded that it did not possess material nonpublic information about a merger.[2]  Because we believe the Commission’s finding entails an unduly broad view of Section 13(b)(2)(B), we respectfully dissent.

Make no mistake:  Insider trading by public companies engaged in share repurchases is unacceptable, and we support all appropriate actions—including charges under Rule 10b-5—when companies use material nonpublic information to take advantage of their shareholders.  We also support all appropriate actions under Section 13(b)(2)(B) when companies have inadequate internal accounting controls that threaten to erode confidence in their financial statements.  In short, we have supported, and will continue to support, vigorous enforcement of the antifraud, disclosure, and other securities laws against corporate wrongdoers whenever appropriate.  But the tools we use must be fit for the task.  And in this case, we believe Section 13(b)(2)(B) is not the appropriate tool. 

I.

Rule 10b-5 prohibits companies from defrauding their shareholders, and this means (among other things) that companies must not take advantage of material nonpublic information when they repurchase their stock.[3]  The Commission has long recognized that companies and insiders owe their shareholders a duty of trust and confidence.[4]  It is crucial that every company heed this duty when engaging in share repurchases, especially when a company is simultaneously contemplating a market-moving transaction such as a merger. 

Yet companies are often in possession of material nonpublic information about their own businesses, and Rule 10b-5 only prohibits misuse of such information with an intent to defraud—that is, with scienter.[5]  So the Commission, through Rule 10b5-1, permits a company to trade its shares while possessing material nonpublic information if the trades are made pursuant to a written plan to which the company has committed before it becomes aware of the information.[6]  Share repurchases, or “corporate buybacks,” under Rule 10b5-1 are now a recognized means for efficiently effecting capital allocation decisions.

Here, Andeavor, a publicly traded company, executed repurchases over several weeks at the same time as its CEO discussed and reached (but did not publicly announce) an agreement for the company to be acquired by Marathon Petroleum Corporation.[7]  If you look at that timing as an isolated fact, it would seem to be an open-and-shut case of insider trading.  However, there are additional complications.  First, the repurchases were executed pursuant to a Rule 10b5-1 plan; and at the time the plan was approved on February 22, 2018, Andeavor’s legal department concluded that the company did not possess material nonpublic information.[8]  Prior acquisition discussions had been suspended in October 2017; and while Marathon’s and Andeavor’s CEOs had agreed to resume their discussions about a potential business combination and had scheduled an in-person meeting to occur on February 23, the meeting had not yet occurred.[9]  Second, Andeavor’s Board of Directors had already authorized the company to spend $2 billion for share repurchases, and its CEO directed the CFO to initiate the repurchase of $250 million of its shares over several weeks.[10] 

Based on those facts, the Commission’s order does not charge or find a violation of Rule 10b-5, which would have required finding that Andeavor acted with scienter despite the steps it took to confirm that it did not possess material nonpublic information.  Instead, the Commission’s order finds that Andeavor used an “abbreviated and informal process” to evaluate the materiality of the acquisition discussions, resulting in a “deficient understanding” of the facts and circumstances by its legal department.[11]  On this basis, the Commission finds that Andeavor failed to maintain an adequate system of internal accounting controls, in violation of Section 13(b)(2)(B), and the Commission imposes a $20 million civil penalty.[12] 

Since Section 13(b)(2)(B)’s enactment in 1977, the Commission has never before found that the “internal accounting controls” required by that provision include management’s assessment of a company’s potential insider trading liability.  This application of Section 13(b)(2)(B) exceeds its limited scope.

II.

Many have come to think of Section 13(b)(2)(B) as a general “internal controls” provision, and some may be tempted to view it as a way to ensure that companies adopt and follow all manner of worthy practices, policies, and procedures for good corporate governance and legal or ethical compliance.  That temptation may be heightened by the ease with which a violation of this provision can be alleged.  No scienter need be found; even good-faith corporate behavior may be scrutinized with 20/20 hindsight; and as others have recognized, “there are no specific standards” in the statute “by which to evaluate the sufficiency of controls,” making it “a highly subjective process in which knowledgeable individuals can arrive at totally different conclusions.”[13]

In light of those temptations, we should be especially mindful of the limits Congress chose to enact along with this provision.  By thinking of Section 13(b)(2)(B) as a generic “internal controls” provision, we overlook an important limit:  This provision requires not “internal controls” but “internal accounting controls.”  Its full text makes clear that accounting is its central focus:

[Issuers shall] devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that—

1. transactions are executed in accordance with management’s general or specific authorization;
2. transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets;
3. access to assets is permitted only in accordance with management’s general or specific authorization; and
4. the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences.[14]

Section 13(b)(2)(B)’s companion provision, Section 13(b)(2)(A), likewise requires issuers to make and keep “books, records, and accounts” that “accurately and fairly reflect the transactions and dispositions of the assets” of the issuer.[15]

Read in its statutory context, the required internal accounting controls seem primarily to concern the accounting for a public company’s assets and transactions to ensure that its financial statements are prepared in accordance with generally accepted accounting principles, thereby ensuring that financial statements are accurate and reliable when disclosed to investors.  To be sure, if one reads in isolation the language of the statute regarding “management’s general or specific authorization” for “transactions” and “access to assets,” one might take a broader view.  After all, nearly every corporate action involves transactions or corporate assets in some way; and at least in some general sense, management directs, authorizes, or controls every such action (or fails to do so).[16]  However, such a reading would go well beyond the realm of “accounting controls” to which Congress confined Section 13(b)(2)(B), and thus would read that limitation out of the statutory text.[17]

Both the “internal accounting controls” and “books, records, and accounts” provisions were enacted in the Foreign Corrupt Practices Act of 1977 (FCPA) in response to concerns about companies paying bribes to foreign officials.  Such corrupt behavior was often facilitated by inadequate accounting controls that enabled employees to omit, disguise, or conceal the source and application of corporate funds from management, auditors, and investors—for example, off-the-books “slush funds” disbursed “outside the normal financial accountability system.”[18]  As the Commission explained in an influential report to Congress in which it proposed the language that became Section 13(b)(2)(B), “[t]hese practices cast doubt on the integrity and reliability of the corporate books and records which are the very foundation of the disclosure system established by the federal securities laws.”[19]  Thus, the Commission characterized internal accounting controls as the means by which corporations ensure that they “account for their funds properly” in their accounting records.[20]  The Senate report on the FCPA echoed the same theme.  Under the heading “Accurate accounting,” the report explained that “[t]he purpose” of the section of the bill including internal accounting controls was “to strengthen the accuracy of the corporate books and records and the reliability of the audit process which constitute the foundations of our system of corporate disclosure.”[21]

Moreover, as the two reports acknowledged, the precise language of Section 13(b)(2)(B) was taken from the authoritative accounting literature, namely from a Statement on Auditing Standards published by the American Institute of Certified Public Accountants.[22]  Those auditing standards further delineated the limited scope of internal accounting controls by emphasizing a distinction between “administrative control” and “accounting control.”[23]  The standards defined “accounting control” as limited to the plan of organization and the procedures and records “that are concerned with the safeguarding of assets and the reliability of financial records.”[24]  By “safeguarding” assets, the standards clarified that they do not mean “protection against something undesirable,” which “could lead to a broad interpretation” that “any procedures or records entering into management’s decision-making processes are comprehended.”[25]  In contrast to the limited definition of accounting control, administrative control was defined in a more open-ended manner that “includes” procedures and records “concerned with the decision processes leading to management’s authorization of transactions” and is “directly associated with the responsibility for achieving the objectives of the organization.”[26] 

Thus, accounting control “is within the scope of the study and evaluation of internal control contemplated by generally accepted auditing standards, while administrative control is not.”[27]  Put another way, “accounting controls . . . generally bear directly and importantly on the reliability of financial records and require evaluation by the auditor,” while “[a]dministrative controls . . . ordinarily relate only indirectly to the financial records and thus would not require evaluation.”[28] 

More specifically with respect to the requirements that “transactions” and “access to assets” be executed or permitted “in accordance with management’s general or specific authorization,” the auditing standards shed additional light.  While the standards noted that the authorization of a transaction encompasses the transaction’s terms, the examples involved only accounting and financial terms.[29]  Accounting controls thus may involve comparing “invoices” with “purchase orders in approving vouchers for payments,” comparing “paid checks” with “approved vouchers” through reconciliations and related procedures, or comparing transactions to company policies such as “general price lists, credit policies, or automatic reorder points.”[30] 

The standards were even more circumscribed when addressing authorization of “access to assets,” which was described as requiring only that “access to assets be limited to authorized personnel.”[31]  In fact, the standards cautioned that “limiting access to authorized personnel is the maximum constraint that is feasible for accounting control purposes in this respect.”[32]  Notably absent from discussion of these standards is any reference to ethics or legal compliance policies, or to any of the other myriad corporate policies and practices that are very important in every corporation, but that do not implicate accounting.

III.

We are concerned that the Commission’s resolution of this case—if pursued to its logical conclusion in future cases—risks uprooting the core concept of “internal accounting controls” from the language, statutory context, and history of Section 13(b)(2)(B).  There may be temptation to simply view this provision as a generic “internal controls” requirement.  While this case is unprecedented in its application of the provision to the insider trading compliance context, the Commission has settled other actions in the recent past based on similar theories of inadequate internal controls that go well beyond the realm of “accounting controls.”  It has found a violation, for example, where controls were inadequate to ensure that an airline’s approval of a domestic flight route was consistent with its ethics policy.[33]  No court, however, has adopted the expansive view of Section 13(b)(2)(B) that such actions seem to require.

As for this case, we see no evidence that Andeavor’s internal controls were inadequate with respect to the accounting for its repurchase transactions.[34]  Andeavor’s Board of Directors authorized the company to spend $2 billion for share repurchases, and its CEO directed the company’s CFO to initiate the repurchase of $250 million of its shares over a period of several weeks.[35]  While we agree that Andeavor’s decision processes in this case left substantial room for improvement, and inadequate processes may expose a company to potential Rule 10b-5 liability, we doubt it is our role under Section 13(b)(2)(B) to second-guess management’s decision processes on matters that do not directly implicate the accuracy of a company’s accounting and financial statements.