Sus and Yeet: Remarks before the University of California Irvine Audit Committee Summit

Thank you, Patricia [Wellmeyer]. I am pleased to be at today’s Audit Committee Summit and to be at the University of California, Irvine, albeit only virtually. Before I begin, I must remind you that my remarks reflect solely my individual views as a Commissioner and do not necessarily reflect the views of the full Securities and Exchange Commission or my fellow Commissioners.

This year, we celebrate the twentieth anniversary of the Sarbanes-Oxley Act (“Sarbanes-Oxley” or the “Act”). Two decades should give us enough experience with Sarbanes-Oxley and distance from the events that sparked its passage to assess this law with fresh (or maybe somewhat jaded) eyes and draw lessons from it for current regulatory efforts. I do not have time to conduct a full review today since I promised Patricia that I would not speak for more than fifteen minutes, but I will offer a few thoughts on the law and its legacy and perhaps inspire others to do the heavy lifting.

Sarbanes-Oxley passed Congress with broad support. It responded to several notorious corporate accounting and disclosure frauds at large, well-known companies like Enron, WorldCom, Adelphia, and Tyco.[1] Long undetected by investors, auditors, and regulators, these companies’ problems cascaded suddenly and painfully into the markets and public discourse. The strong legislative reaction is, therefore, unsurprising, but crafting an appropriate law to respond quickly and comprehensively to a scandal is difficult.

Predicting how the words on the legislative page will play out in practice is also challenging. For example, a 2015 Supreme Court case, Yates v. United States, considered whether Sarbanes-Oxley’s criminal prohibition on destroying “any record, document, or tangible object with the intent to impede, obstruct, or influence” an investigation applied to tossing undersized fish back into the ocean after being told by a government official[2] to keep the fish onboard as evidence of breaking federal fishing regulations.[3] The Court said no:

A fish is no doubt an object that is tangible; fish can be seen, caught, and handled, and a catch, as this case illustrates, is vulnerable to destruction. But it would cut §1519 loose from its financial-fraud mooring to hold that it encompasses any and all objects, whatever their size or significance, destroyed with obstructive intent.[4]

In reaching that conclusion, the Court rejected a singular focus on the dictionary definition of “tangible object.” Justice Ginsburg explained: “Ordinarily, a word’s usage accords with its dictionary definition. In law as in life, however, the same words, placed in different contexts, sometimes mean different things.”[5] The dissent, by contrast, looked to the dictionary (supplemented by Dr. Seuss’s One Fish Two Fish Red Fish Blue Fish) to conclude that the Sarbanes-Oxley provision clearly covered fish.[6]

The Supreme Court’s dictionary debates in Yates make me think about how the task facing legislators is somewhat akin to that facing people charged with keeping dictionaries up-to-date. Whether you are responsible for writing laws or dictionaries, you try to be responsive to current events while maintaining a longer-term view. How do you figure out which words are just fads and which merit inclusion in the official dictionary, where they will stay for decades or centuries to come? What will our grandchildren think twenty years from now when they are perusing a dictionary’s digital pages and come across words we added this year? Metaverse, booster dose, side hustle, altcoin, pumpkin spice, use case, and greenwash made the list.[7] Those words and phrases likely have staying power. But sus, yeet, and adorkable—all new slang words in this year’s Merriam-Webster’s dictionary[8]—will we still be using those in twenty years? If so, the English language will be janky and in need of MacGyver[ing]—two other words on this year’s list.[9] Consider that in 2002, brain-box,[10] mizzle-shinned,[11] and celly[12] made it into the dictionary. I may be the first person to have spoken those words in 2022. Revisiting dictionary entries after the cultural moment they reflect has passed probably makes sense.

Analyzing laws well after the scandal of which they were born has faded can clarify which parts of them have lasting value and where changes might be warranted. In the process, we can learn lessons about how to address similar problems in the present and future. As I look back at Sarbanes-Oxley with the dispassion brought by the passage of time, I see a law that contributed to better corporate disclosure processes, stronger internal controls, and healthier corporate governance practices at companies; a more focused and systematic approach to reviewing periodic filings by the SEC; and more reliable financial statements.[13]

Sarbanes-Oxley, however, has not been all positive. Among other things, it has increased greatly the cost of being a public company, hastened the federalization of corporate governance, and complicated the financial regulatory bureaucracy. Sarbanes-Oxley covers a lot of territory, so I will focus today only on a handful of provisions related to the Public Company Accounting Oversight Board (“PCAOB”), internal controls, clawbacks, and board composition.

A. The Unusual Public Company Accounting Oversight Board

You just heard from Chair Erica Williams of the PCAOB about the important work the PCAOB is doing to foster audit quality and thus trust in the capital markets.[14] The PCAOB is one of Sarbanes-Oxley’s major contributions to the financial regulatory landscape; but, throughout its life, questions about its unusual place in that landscape have haunted it. Sarbanes-Oxley created the PCAOB as a self-standing body to regulate—as its name suggests—public company auditors.[15] The SEC appoints its board members and oversees it, but the PCAOB is an independent regulator. A 2010 Supreme Court opinion held that this “Government-created, Government-appointed entity, with expansive powers to govern an entire industry” was constitutionally flawed because its board members had too many layers of tenure protection.[16] In the Court’s view, a judicial tweak to make it easier for the SEC to remove board members afforded the President “adequate control over the Board, which is the regulator of first resort and the primary law enforcement authority for a vital sector of our economy.”[17]

Had Congress simply charged the SEC with regulating auditors, it could have avoided the PCAOB’s constitutional defects and consolidated related authorities in one government agency. This approach would also have diverted the considerable SEC resources that have since gone into overseeing the PCAOB, its budget, and its standard-setting, inspections, and enforcement activity to go, instead, directly into fostering audit quality.

Housing the PCAOB’s functions within the SEC could be more efficient. For example, in investigating misconduct at public companies, the SEC often also looks at the auditor, which means the PCAOB generally does not. Even when not bringing a related case against a company, the SEC often brings enforcement actions against auditors rather than entrusting them to the PCAOB. Practically speaking, the PCAOB is not, as the Supreme Court envisioned, “the primary law enforcement agency for a vital sector of our economy.”[18] Perhaps casting about for a way to spend its enforcement resources, the PCAOB has signaled recently that it will bring enforcement actions for single acts of negligent conduct.[19] If the PACOB were folded into the SEC, its enforcement resources could be focused on more serious violations.

Similarly, knowing what it does now about the deep engagement of the SEC and its staff in PCAOB standard-setting and the interactions between the two regulators’ rules, Congress might have found it more efficient simply to delegate standard-setting to the SEC. For example, Chair Gensler recently directed the PCAOB “to consider adding updates for auditor independence standards to their agenda,” which was paired with a suggestion that “[w]e may need to take a fresh look at the SEC’s auditor independence rules as well.”[20] Why we and the PCAOB need to rewrite independence rules that we both recently updated is unclear,[21] but the two projects are sure to be linked. Finally and importantly, if the PCAOB drifts from its mission in the coming years into political hot topics of the day, as some advocate, calls to fold it into the SEC are likely to increase.[22]

Whether housed at the SEC or the PCAOB, the PCAOB’s function of “protect[ing] investors and further[ing] the public interest in the preparation of informative, accurate, and independent audit reports”[23] is vital. Independent audits are critical to giving investors’ confidence in the integrity of financial statements. High-quality financial statements in turn help investors allocate money to the most productive uses, which helps the economy grow and individuals thrive.

B. The Expensive Section 404: Internal Controls

Effective internal controls over financial reporting contribute to reliable financial statements. One of the PCAOB’s early defining moments was its implementation of Section 404 of Sarbanes-Oxley. Under Section 404, management is responsible for establishing and maintaining internal controls, and auditors have to “attest to, and report on, the assessment made by the management of the issuer.”[24] Thus, the SEC and the PCAOB both had a role in implementing the provision.[25] The PCAOB’s first attempt, Auditing Standard No. 2, fostered an unproductively granular and, therefore, costly attestation process.[26] In the words of then-Commissioner Paul Atkins:

We had an atmosphere in which what-if scenarios created mountains out of molehills – a control failure for a $500 error could be just as significant as for a $50 million error. And, we had companies being told to document, analyze, and create process charts for literally tens or hundreds of thousands of supposedly key internal controls . . . . [27]

The SEC and the PCAOB, attempting to recalibrate the 404 process, issued new guidance and a new auditing standard in 2007. The changed regulatory approach helped, but Section 404 remains one of the law’s most controversial and costly provisions. Professor Stephen Bainbridge, in a recent assessment of Section 404, observed:

Section 404 compliance costs were substantial from the outset. Those costs were disproportionately borne by smaller firms from the outset. Section 404 compliance costs remain high and show no signs of dropping over time. It remains the case that those costs are disproportionately borne by smaller firms.[28]

Section 404 costs likely are a material consideration for many companies contemplating going public.[29] Thus, in the 2012 JOBS Act, Congress created the Emerging Growth Company category, which, among other things, phased in Section 404(b) compliance for smaller, newly public issuers.[30] As recently as 2020, the SEC took steps to ease the Section 404 burden for certain low-revenue companies.[31] The Commission explained that:

Although factors other than the [Internal Control over Financial Reporting] auditor attestation requirement may have contributed to the decline [in the number of listed companies], . . . the described cost reductions associated with the final amendments could be a positive factor in encouraging additional small companies to register their securities offerings or a class of their securities, which would provide an increased level of transparency and investor protection with respect to those companies.[32]

The experience with Section 404 may provide some valuable lessons applicable to the SEC’s proposed public company climate change disclosures rule. As Section 404 did, the proposed climate rule, if adopted, would require companies to set up complex systems, this time for tracking greenhouse gas emissions and climate-related expenditures and revenues. The proposal would require attestation for some greenhouse gas emissions and wrap mandatory climate-related financial statement metrics into the audit. Commenters on the climate proposal have urged us to take the Section 404 experience into consideration.[33] Cumulative regulatory burdens matter for companies deciding whether to become or remain public and, depending on how it is finalized, the climate rule could add materially to cumulative burdens.[34]

C. The Ambiguous Section 304: Forfeiture of Certain Bonuses and Profits

As is common with statutes, experience with Sarbanes-Oxley has highlighted areas of ambiguity in the statutory text. Consider Section 304, which seeks to ensure that CEOs and CFOs do not profit from financial reporting shenanigans by their companies. To that end, the statute states that “[i]f an issuer is required to prepare an accounting restatement due to the material noncompliance of the issuer, as a result of misconduct, with any financial reporting requirement under the securities laws,” then the issuer’s CEO and CFO must repay “any bonus or other incentive-based or equity-based compensation” received and “any profits realized from the sale of securities” during the year following the issuance or filing of the affected financial statement.[35] The language leaves room for interpretation, particularly as to which restatements trigger the requirement, which payments are affected, and how it should be enforced. Although some questions have been answered,[36] surprisingly, much ambiguity remains twenty years after the provision became law. Section 304(b) grants the SEC explicit authority to exempt any person from application of the provision “as it deems necessary and appropriate.” Accordingly, the SEC has an important role in shaping the interpretation and application of Section 304.

Despite its authority to do so, the SEC has not yet set forth a sensible Section 304 approach. The Division of Enforcement, for example, could state in its enforcement manual that it would prioritize seeking reimbursement in cases involving fraud. Moreover, the language in Section 304(a) is best read as being limited to incentive-based or equity-based bonuses, so the SEC should not seek repayment of other types of bonuses.[37] In addition, the text of the statute obligates the CEO and CFO to “reimburse the issuer.” CEOs and CFOs who have paid back the money as required should not be subject to Commission action under Section 304 because payment satisfies the statutory obligation. For this reason, the Commission’s recent actions instituted after the officers paid the reimbursement seem ill-founded.[38] Finally, the Commission should think about the relationship between Section 954 of the Dodd-Frank Act, under which the Commission will require exchanges to prohibit the listings of issuers that do not have policies providing for the recovery of erroneously awarded compensation, and Section 304.[39] A broad interpretation of Section 304 could discourage talented people from taking the top spots at public companies.[40]

D. The Contagious Section 407: Audit Committee Financial Expert

Sarbanes-Oxley increased the role of the federal government in corporate governance. Section 407 of the Act, for example, requires companies “to disclose whether or not, and if not, the reasons therefor, the audit committee of that issuer is comprised of at least 1 member who is a financial expert, as such term is defined by the Commission.”[41] While styled as a disclosure provision, Section 407 put tremendous pressure on boards to find someone who met the precise parameters of “financial expert” set forth in the statute and further defined by SEC rule. As former Commissioner Glassman later explained, the Commission proposed a definition so narrow that “neither Federal Reserve Chairman Alan Greenspan nor investment luminary Warren Buffett would have qualified.”[42] Commenters convinced the SEC to broaden the definition, but even a more reasonably crafted disclosure requirement indirectly drives board composition. Particularly for small companies, finding and retaining a director who is a financial expert might be difficult and might stand in the way of boards getting other expertise they need.

This provision of Sarbanes-Oxley has set the template for proposals we issued this year to require boards to disclose whether they have board members with expertise in areas like climate or cybersecurity.[43] While some commenters on those proposals have been supportive,[44] others have asked us to consider whether these requirements would drive boards into a one-size-fits-all mold, undercut the collective and collaborative decision-making of boards, and insinuate that boards play a managerial, rather than oversight, role at companies.[45]

E. Conclusion

Even if you are—drawing on the 2002 new word list here—a brain-box,[46] reviewing Sarbanes-Oxley is not an easy task. It is, however, a worthwhile task at the twenty-year mark. We need to “collabo”—another new 2022 word, this time from the Oxford English Dictionary[47]—on thinking about what lessons we can draw from our experience with Sarbanes-Oxley. Those lessons can help us assess whether changes are needed to the Act, but also can help us think about how to solve today’s problems.