ACFE Designations Under Sarbanes-Oxley: Directors Beware!

We deal here with one of the more challenging provisions of the Sarbanes-Oxley Act of 2002, referred to by some as “SarbOx.” Specifically, section 407 of that Act requires public companies to disclose in their annual reports to the Securities and Exchange Commission, pursuant to an implementing SEC regulation, whether their audit committees include a financial expert–and if not, why not.

SarbOx spells out a complex schema for a financial expert’s qualifications. According to the statute, an expert is expected to have (1) an understanding of (i) generally accepted accounting principles (GAAP), (ii) financial statements, and (iii) audit committee functions, and (2) experience with (i) internal accounting controls, (ii) the preparation or auditing of “generally comparable” issuers’ financial statements, and (iii) applying GAAP to accounting for estimates, accruals and reserves.

A draft SEC regulation implementing this SarbOx provision was put out for comment in October of 2002, while the final rule was adopted in January and became effective in July of 2003. In response to a flood tide of comments on the rule proposal, some ameliorating adjustments were made in the final rule. For example, the “financial expert” term was repositioned as “audit committee financial expert”–ACFE, or “ack-fee”–to distinguish it from the long-familiar expertise concepts embedded in securities regulation.

Also, to qualify as a financial expert under the final rule, an audit committee member is required to have: (1) an understanding of (i) GAAP and (ii) financial statements; (2) an ability to assess GAAP’s application with respect to accounting for estimates, accruals and reserves; (3)(i) experience preparing, auditing, analyzing or evaluating financial statements presenting accounting issues that are generally comparable to those raised by the issuer’s financial statements, or (3)(ii) experience actively supervising others engaged in such activities; (4) an understanding of (i) internal controls and (ii) financial reporting procedures; and (5) an understanding of audit committee functions. (Emphasis supplied to indicate moderating adjustments made in the final rule.) However, the Commission had limited latitude in light of the clear-cut attributes for ACFE qualification spelled out in the Act. Please note that all five qualifications described above must be met–it is not a matter of “multiple choice”!

Public boards have been confronted with the dilemma of tagging one (or more) of their audit committee members as an ACFE or “confessing” that their audit committees lack this special expertise. Parenthetically, it is the responsibility of the board of directors–not the management–to designate ACFEs. Thus, if a designated audit committee member does not qualify as an ACFE, the other directors who made that designation may have actionable accountability for a significant misrepresentation. (Designations presumably confirm that the audit committee member does in fact qualify as an ACFE.)

Directors have been confronted with difficult imponderables when trying to deal with this challenge. The most paramount are the proper interpretations of each of the five skill-sets required for the ACFE designation. For example, how deep is the needed “understanding” of GAAP? In reality, does “understanding” require a “working knowledge” of GAAP or something less? Is an ACFE expected to maintain some measure of “currency” vis-à-vis new accounting principle pronouncements? Should an ACFE be able not only to understand (and explain) the company’s financial statements but also to understand (and explain) the major principles employed in those statements, such as pension plan accounting and accounting for (i) retiree benefit obligations, (ii) environmental reserves, (iii) taxes, and (iv) contingencies? Should his or her “understanding” of GAAP include the issues pending before the Financial Accounting Standards Board? Given this “understanding GAAP” requirement, is the pool of potential ACFEs who are qualified realistically limited to CPAs and CFOs or can other audit committee members qualify and, if so, on what basis?

What experience satisfies the requirement involving the preparation and auditing of financial statements? The SEC did broaden this skill-set requirement in the final rule by adding experience “analyzing or evaluating” financial statements. The expected experience must involve “actually working directly and closely with financial statements” presenting accounting issues that are generally comparable to those raised by the company’s financial statements. Supervisory experience may qualify, but it must be “hands on”–so a CEO role, without more, would be insufficient.

To what extent is “general currency” a consideration? That is, would experience “preparing, auditing, analyzing or evaluating” financial statements at an early stage of an audit committee member’s career satisfy the skill-set requirement? Or does that requirement contemplate an involvement that is more or less “recent?” When does a retired CFO’s experience (or “understanding” of GAAP) become stale?

In fairness, the SEC attempted to make the ACFE concept workable; for example, the term “understanding” was substituted for the term “experience” in connection with the internal control skill-set requirement. Indeed, the final rule includes some safe-harbor discussion and states that an ACFE designation does not impose any greater duties, obligations or liability than what exist for other audit committee members not so designated. That comforting disclaimer is rather disingenuous, however, given the statement in the Adopting Release that an ACFE is expected to have “the ability to ask the right questions to determine whether the company’s financial statements are complete and accurate.” (Needless to say, determinations whether financial statements are “complete and accurate,” if part of an ACFE’s role, would be a new and novel duty having profound implications for designees’ obligations and liability!) While the SEC rule’s safe-harbor protections may have relevance in SEC enforcement actions, its disclaimers are unlikely to carry much weight in private litigation. The bold articulation of skill sets required by SarbOx for ACFE designees would seem to argue against that disclaimer.

As a related matter, it would be folly to ignore “public expectations” keyed to ACFE designations–ramped up by the class action bar. For example, what should be expected vis-à-vis an ACFE who has been serving on the audit committee of a financial institution? Should that ACFE be expected to know about the “liquidity put” (a device that enables the buyer of subprime-related securities to return the investment to the seller and recover the original purchase price)? Should s/he be aware of how–and the extent to which–that device was being employed by the firm’s marketing department in recent times, or how subprime-related securities were being “marked-to-market”? More broadly, should the ACFE have an understanding about the enterprise’s risk management policies and procedures?

If, in the litigation context, it was established that an ACFE designee did not qualify as such, the material misstatement in the company’s SEC filing that the director did qualify could have implications for the firm’s liability. Unless the audit committee does include a member who qualifies as an ACFE, a public company may be well advised to make a disclaimer. For example, this could be accomplished by a simple statement to the effect that:

While the board endorses the effectiveness of our Audit Committee, its membership does not include a member who qualifies as an “audit committee financial expert”–a special concept under federal regulations that contemplate such a designation only when a director properly satisfies each of five requirements, such as experience preparing, auditing, analyzing or evaluating financial statements presenting a level of accounting complexity comparable to what is encountered in connection with our company’s financial statements (or “experience actively supervising” such activities).

What has happened since 2003? Conventional wisdom quickly emerged to the effect that every public company must have an ACFE on its audit committee–and virtually every public company today does have a designated ACFE. In fact, some public companies have designated every audit committee member as an ACFE! In all likelihood, some public companies do have qualified ACFEs on their audit committees, while we can speculate that many do not! (It hardly deserves mention that there is one thing worse than not having an ACFE on the audit committee: having one who does not qualify for that designation!)

The consequences of a flawed designation have yet to be resolved, although public expectations will undoubtedly attribute special significance to an ACFE designation. (SEC enforcement to date can best be described in terms of “benign neglect” and we can speculate that it will continue to be slow to develop.) Private litigation challenges–following a restatement of the company’s financial statements–can be expected to entail assertions of material misstatement or omission if it can be established that any ACFE serving on the audit committee (during the relevant time period) did not in fact satisfy one or more of the five required attributes for qualification. Whether a qualified ACFE would have recognized the accounting problem causing the restatement may be problematic. However, that issue is probably irrelevant: the misrepresentation with respect to the individual’s qualifications, without more, may be actionable.

It is only a matter of time before some unsuspecting board is faced with an ACFE challenge by a class action lawyer, and public companies will thereupon reevaluate their ACFE designations. In recognition of that exposure, it behooves all directors–as well as counsel advising the board and/or the audit committee–to give careful attention to audit committee designees and their ACFE qualifications.