Notes

Outline

Disclosure Controls Boris Feldman National Investor Relations Institute October 8, 2002 © 2002, Boris Feldman

Topics Statutory and Regulatory Framework Principles of Design Components Alternative Structures for Disclosure Committee

Statutory and Regulatory Framework Sarbanes-Oxley Section 302(a)(4) SEC shall adopt regulations requiring CEO and CFO to certify every quarter that they: “are responsible for establishing and maintaining internal controls” “have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared” “have evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report” “have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date”

Statutory and Regulatory Framework (cont.) SEC regulations (SEC Release 33-8124) Exchange Act Rules 13a-14 and 15d-14 Rule 13a-14(c):  “Disclosure controls and procedures include … controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files … is accumulated and communicated to the issuer's management … as appropriate to allow timely decisions regarding required disclosure.” Disclosure controls vs. accounting controls

Principles of Design One size does not fit all Begin by analyzing how you currently handle disclosures Don’t be overly ambitious Comply with what you create Don’t adopt boilerplate

Components -- Topics Internal information flow External reporting and disclosure Borrowing mechanisms from internal accounting controls

Components Internal information flow Real-time information with respect to operational metrics Across subsidiaries, divisions, and geographies Consistency with other internal information Analytical tools Whistleblowing channel

Components (cont.) External reporting and disclosure Participation of outside counsel Requires meaningful access to information Routine press releases “Due-diligence checklist” approach to confirm accuracy Sign-off authority Investor presentations Due-diligence checklist Confirmation that prior disclosures remain accurate Reg. FD compliance issues

Components (cont.) End-of-quarter disclosures Earnings release, script, Q&A Need to formalize and adopt best practices Think of this as first MD&A drafting session Obtain buy-in to guidance Identify near-term downsides Involve Audit Committee Periodic filings Set internal schedules that permit meaningful review Brainstorming sessions on trends and risks Review by senior executives Review by outside accountants Involve Audit Committee

Components (cont.) Time-sensitive disclosures Mechanism for identifying time-sensitive disclosures Rapid-response team Borrowing mechanisms from internal accounting controls Disclosure “policies and procedures” manual Checks and balances Interaction with other legal requirements Reg. FD Insider stock-sale windows Certification requirements Documentation Audit of disclosure controls

Alternative Structures for Disclosure Committee SEC Release 33-8124 “We do recommend, however, that, if it has not already done so, an issuer create a committee with responsibility for considering the materiality of information and determining disclosure obligations on a timely basis.  …  [S]uch a committee would report to senior management, … who bear express responsibility for designing, establishing, maintaining, reviewing and evaluating the issuer's disclosure controls and procedures.” Disclosure Committee not required, but will be common

Alternative Structures for Disclosure Committee (cont.) Key issues Scope of responsibilities Membership Footnote 60:  “[C]ommittee could include the principal accounting officer (or the controller), the general counsel or other senior legal official with responsibility for disclosure matters who reports to the general counsel, the principal risk management officer, the chief investor relations officer (or an officer with equivalent responsibilities) and such other officers or employees, including individuals associated with the issuer's business units, as the issuer deems appropriate.”

Alternative Structures for Disclosure Committee (cont.) Model I:  only reviews controls Model II:  drafts periodic reports Model III:  makes real-time disclosure decisions