With the Democratic majority in both houses of Congress expected to take an aggressive approach to investigations, this Mayer Brown memo provides some guidance on whether a particular company is likely to be on the receiving end of an investigative subpoena. This excerpt highlights questions that companies that have interacted with the Trump administration should ask in assessing their risk of being targeted by Congress:
– Have interactions with the administration resulted in significant regulatory decisions, transaction approvals, exemptions, tariff relief, federal funding, or other benefits that could become the subject of congressional inquiry?
– Has the company entered into prominent commercial relationships or participated in initiatives that may attract political or public attention?
– Could internal communications, board materials, or other records be interpreted differently from the company’s public statements or explanations of its decisions?
– Are there issues involving government relationships, corporate conduct, or public policy that could become relevant to a broader investigation of administration actions?
The memo says that companies expecting possible congressional scrutiny should identify potential areas of exposure, ensure they can preserve and collect relevant records, and establish a coordinated, cross-functional response. Senior executives and directors should also be prepared for possible inquiries or testimony and a strategy for engaging with policymakers and managing internal and external communications should be developed.
By the way, if you represent a tech sector company – particularly one that’s played footsie with the Trump administration – be sure to check out this Fenwick memo on oversight topics that tech companies should expect to see inquiries from Congress about in 2027.
Latham recently published a summary of insights provided by senior congressional staff members on how congressional oversight has evolved and what private sector companies should consider when responding to congressional inquiries. This excerpt discusses the importance of early and cooperative engagement:
– Proactive outreach: Committees often send broad initial requests, either through a formal letter or informal email outreach. In many instances, early, constructive dialogue can narrow the scope of these requests and help clarify the focus of the inquiry. The panel stated that a helpful posture is for companies to use their government affairs resources to monitor committee priorities and anticipate potential activity so that, under appropriate circumstances, they can proactively reach out prior to formal requests.
– Responding to sector-wide letter “blitzes” requires a thoughtful approach: When congressional committees or individual members send a similar letter to many companies in the same industry, each company should carefully determine an appropriate response. Entities that do not respond or send incomplete responses stand out when others cooperate fully, potentially triggering follow-up. Companies should aim for timely responses, and should be aware that committees could analyze responses across sectors for indications of industry viewpoints or vulnerabilities.
The memo says that companies should integrate their government relations, communications, and legal functions in order to ensure an effective response to congressional oversight. It also cautions companies that when an administration tries to stiff-arm Congress on investigative demands, it often turns to private sector players to access the information it wants.
For a practical deep dive on the midterms, take a look at this Akin alert. At a high level, it says:
Democratic control of both chambers significantly shifts the policy environment during the final two years of President Trump’s term. With sizable majorities, Democrats will have greater ability to advance their agenda, particularly on affordability and oversight of the Trump administration. Their ability to enact major legislation will remain constrained by the Senate’s 60-vote threshold for most legislation and President Trump’s veto authority (requiring an override vote of 67 votes in the Senate and 290 votes in the House).
Democratic priorities are expected to center on affordability and accountability across several industries including health care, tax policy, international trade, artificial intelligence and data centers, energy, and financial services. Control of the Senate will also give Democrats authority over committees and the confirmation process for executive branch and judicial nominees. However, Democrats will still need Republican support to advance major legislation, placing greater importance on areas of potential bipartisan agreement and on appropriations, authorization bills, and other must-pass legislation as vehicles for policy changes. Specific proposals and sector impacts are discussed in greater detail in the Issues to Watch section below.
For the Trump administration, the loss of unified Republican control will all but eliminate the path to advancing President Trump’s legislative priorities. The administration is therefore likely to rely more heavily on executive and regulatory authorities, while potentially devoting greater attention to foreign policy, international trade, and national security. Divided government is unlikely to mean a quieter policy environment, with executive actions, regulatory changes, tariffs and trade measures, and congressional oversight among the key areas to watch.
Here are some highlights for public companies from the “Issues to Watch” section:
With Rep. Maxine Waters (D-CA) and Sen. Elizabeth Warren (D-MA) poised to chair the House Financial Services Committee and Senate Banking Committee, respectively, expect an agenda focused on consumer protection, corporate accountability, and heightened scrutiny of the Trump Administration.
Democrats will shift the committee agenda toward stronger consumer and investor protections, expanded regulation, and oversight of the Administration’s deregulatory agenda and financial institutions, including their climate and Diversity, Equity, and Inclusion commitments and ties to President Trump.
Democrats will intensify scrutiny of AI, bank mergers, executive compensation, shareholder buybacks, private equity ownership, expanded retail investor access to private markets, and market concentration, along with increased attention to nonbank financial institutions and broader financial stability risks.
With a stablecoin framework in place, Democrats will focus on implementation through a consumer protection and financial stability lens while pursuing additional digital asset guardrails addressing investor protection, conflicts of interest, and illicit finance.
The midterms didn’t just shake things up at the Federal level. We may also see major policy changes at the state level — particularly in Texas, where Democrats will take over the Governor, Lieutenant Governor and Attorney General offices, plus take control of the state house. That’s causing practitioners and academics to wonder what this means for the state, which has been a favored jurisdiction for companies reincorporating out of Delaware and the site of several recent stock exchange launches.
On LinkedIn, Law Prof Christine Hurt pointed out that Texas Business Court judges are appointed for only two-year terms, making those appointments potentially influenced by political winds. Law Prof Ann Lipton also noted that the new Democratic Attorney General may not pursue the state’s existing lawsuits against the proxy advisors or want to defend the proxy advisor law that is currently enjoined on a First Amendment basis.
We’re all questions and speculation today because none of us have a crystal ball, but asking the questions can be helpful to avoid being blindsided when current trends come to an abrupt halt or reverse course. To that end, the Cooley team has spent some time brainstorming how the midterm results might impact general trends and the SEC’s agenda, and on the Governance Beat blog, Broc shared 10 questions for companies to consider. For example:
– Many companies pulled back on DEI programs and disclosure in response to Administration pressure. Will those companies now face congressional scrutiny or otherwise feel pressure to reverse course?
– Even if SEC leadership remains unchanged, could a shift in Congressional control influence which rulemaking initiatives move forward, slow down or get abandoned
– How might the elections affect the SEC’s budget and staffing? Could Congressional appropriations, oversight hearings and staffing constraints influence the agency’s ability to conduct examinations, pursue enforcement actions and adopt new rules?
– Will cryptocurrency and tokenization face a different political environment? How might the new Congress approach digital asset market structure, tokenized securities, investor protections and the division of regulatory authority between the SEC and CFTC?
On Friday, Reuters shared takeaways from an interview with David Woodcock, Director of the SEC’s Division of Enforcement. His remarks were focused on AI-enabled fraud and AI-related disclosures, private markets and prediction markets. Here are some snippets:
The US Securities and Exchange Commission is examining artificial intelligence companies’ corporate disclosures as investor worries mount over a potential AI bubble that may have been fueled by circular deals, the agency’s enforcement director told Reuters on Friday [. . .] [T]he agency does not want to stand in the way of tech innovation, but that it is the agency’s job to ensure issuers are giving investors the full picture on potential risks.
Woodcock said the SEC also has a role in overseeing prediction markets [. . .] Woodcock said the agency’s enforcement staff are working with policy officials as well as the Commodity Futures Trading Commission, which broadly oversees swap markets, to monitor and regulate the booming new markets.
David Woodcock also spoke at Practicing Law Institute’s 58th Annual Institute on Securities Regulation yesterday. Here are a few highlights from his remarks, which you can watch on YouTube.
– The number of financial reporting and accounting cases had been down before the launch of the Financial Reporting and Accounting Unit, possibly because these cases take longer to investigate (over 4 years, on average) and are very complex, highly technical and judgment laden. The new unit is staffed with a specialized team of accountants and lawyers and meant to be durable. The types of cases they’re investigating are the same as always: e.g., revenue recognition, valuation issues and areas of accounting that require significant judgment.
– He noted that the Enforcement Division is trying to avoid pushing the envelope, from a legal perspective, on the claims they are pursuing (i.e., avoiding regulation by enforcement) and focused on being transparent while welcoming the perspective of the defense and its counsel so that the Commission can see their side.
– Enforcement Staff wants to give cooperation credit. He pointed to the recent enforcement action regarding the issuance of ESPP shares in excess of the number registered on Form S-8, which involved no civil penalty. (The company promptly suspended the ESPP, conducted an investigation, self-reported to the Commission and voluntarily initiated a rescission offer.) He suggested that companies carefully consider self reporting with their counsel because once a whistleblower reports to the SEC, cooperation credit becomes fuzzy. He stressed that the Staff doesn’t talk about instances where no charges were brought, but that does happen.
No official report of SEC enforcement activity for the fiscal year ended September 30, 2026 has been released so far, but we have some data on enforcement activity nonetheless from the Brattle Group and Covington. Kevin LaCroix recently summarized these reports on the D&O Diary blog. Overall, they found the total number of enforcement actions in the fiscal year was down, though it increased in the second half.
The Brattle Group’s report puts the number of FY 2026 SEC enforcement actions at 308, the lowest annual number of SEC enforcement actions since at least FY 2018, figures that the Covington law firm memo describes as “historically low enforcement numbers.” The Covington report also states that the FY 2026 numbers represent the “lowest SEC enforcement stats in over a decade.”
To be sure, SEC enforcement activity increased in the second half of FY 2026, with the agency bringing 163 actions in the second half of the fiscal year, compared to just 69 in the first half of the fiscal year. As the Covington memo notes, the higher number of enforcement actions in the second half of FY 2026 is “consistent with historical trends even as overall enforcement numbers have declined.”
The D&O Diary points to a number of factors contributing to this overall decline, including a recentering of enforcement cases on the Commission’s core mission, staffing levels, the government shutdown and leadership changes. The blog also highlights the concentration of cases in four of the nine common categories, with continued focus especially on insider trading and securities offerings.
During FY 2026, 88% of the SEC enforcement activity was concentrated in just four of the nine categories into which the SEC itself normally categorizes its activity. The four categories in which the activity was concentrated are securities offerings; issuer reporting and auditing; investment advisers and investment companies; and insider trading. By contrast, activity in these four categories represented 75% of the SEC’s FY 2025 enforcement activity, and 64% in FY 2024.
Activities in the other five categories (broker-dealers, market manipulation, the Foreign Corrupt Practices Act, municipal securities, and other matters) declined to only 12% of FY 2026 activity, compared to 25% in FY 2025, and 36% in FY 2024.
Kevin points out that a reduction in enforcement activity often means a reduction in private securities litigation because “historically at least 20% of securities class action litigation filings have followed in the wake of SEC enforcement actions” — especially FCPA cases.
In light of the Enforcement Division’s focus on both AI and financial reporting, Debevoise shared tips for vetting your AI-related disclosures.
– Review Public and Investor-Facing Statements. Involve legal, compliance, and technical personnel in the review of SEC filings, earnings-call scripts, investor presentations, websites, and marketing materials. Private companies should apply similar scrutiny to fundraising communications. Reviews should test for inaccurate claims and material omissions, including statements that conceal or downplay a company’s use of AI or the associated financial and strategic resources, a practice sometimes called “AI hushing.”
– Define AI and Agentic Capabilities Precisely. Use consistent AI terminology internally and externally, reflecting what AI systems actually do. Distinguish conventional automation from agentic functionality, and avoid portraying pilots as scaled deployments or human-supervised workflows as fully autonomous. Descriptions of safeguards should match the controls actually in place.
– Substantiate—and Revisit—Claims About Results. Document the basis for claims about AI functionality, reliability, revenue, productivity, or staffing impacts through testing, deployment records, and other reasonable evidence. Distinguish existing capabilities and demonstrated benefits from future plans, and reassess claims as systems, adoption, and performance change.
– Use Risk Assessments to Inform Disclosures. For higher-risk AI uses, consider conducting impact assessments to identify foreseeable risks and mitigation measures. Use those findings to evaluate whether disclosures adequately address material AI uses and risks, including hallucinations, confidentiality, cybersecurity, and reliance on human review. These practices can also help mitigate securities class action risk.
And, if asked, take a page from Director Woodcock’s playbook. In response to a question about what specifically the Division is doing with SI, he said he didn’t want to oversell and would defer publicly discussing until he can talk about ways the Division is using SI at scale.
Following an open meeting yesterday, the PCAOB announced that it has proposed amendments to AS 6101, Letters for Underwriters and Certain Other Requesting Parties, to be issued for public comment. The open meeting and proposed amendments follow a request for public comment on PCAOB standard setting issued in June, which explains that the amendments address one of the big questions everyone has been asking after the SEC’s semiannual reporting proposal:
Under the [Semiannual Reporting] Proposal, the existing financial statement requirements for periodic reports, registration statements, and proxy statements in Regulation S-X that govern the age of financial statements would be simplified and amended to reflect the new semiannual reporting option. AS 6101, Letters for Underwriters and Certain Other Requesting Parties, addresses the auditor’s responsibilities for performing engagements to issue comfort letters.
Certain provisions of AS 6101, specifically those that establish limitations on the auditor’s ability to provide negative assurance on subsequent changes in specified financial statement items, are based on the most recent audited or reviewed period and the existing SEC requirements for determining the age of financial statements, which assumes a quarterly filing cadence, and would change if the SEC Proposal were adopted. In conjunction with the SEC Proposal, the PCAOB is considering whether to make narrow, conforming amendments to AS 6101 to accommodate the changes the SEC may adopt to its reporting requirements.
But those existing limitations created complications unrelated to the semiannual reporting proposal (see the graphics in Figures 1 & 2 on pages 11 & 12 of the proposal showing the periods when underwriters are unable to provide negative assurance for a non-accelerated filer under quarterly reporting and semiannual reporting regimes), and the PCAOB has apparently decided that it’s time to address this now — without waiting on the SEC to adopt final rules related to semiannual reporting. The press release says:
Under the current requirements within AS 6101, which has not been substantially amended since its adoption as an interim standard in 2003, an auditor may be unable to provide negative assurance as to subsequent changes in select financial statement items in a comfort letter solely because more than 135 days have passed since the company’s most recent audit or review – even when the company remains current with all applicable U.S. Securities and Exchange Commission (SEC) filing requirements. For example, for a calendar-year filer, the auditor is unable to provide negative assurance between a date that is 135 days after the third quarter reporting date (generally, September 30) and the annual report filing deadlines (which is generally due no earlier than March 1 and up to March 31).
As a result, issuers could be unnecessarily constrained in accessing capital markets if underwriters are unwilling to engage in offerings after the 135-day period without an auditor’s ability to provide negative assurance as to subsequent changes. Such obstacles can impede capital formation, with no clear benefit to investors.
Here’s the TL; DR: The proposed amendments would move away from a fixed day convention by replacing the 135 day limitation with references to the filing deadline for the next annual or interim period for which financial statements are required to be filed. No more gaps between the date through which auditors can provide negative assurance and an issuer’s next filing deadline!
The proposal also contemplates the addition of a new note listing examples of risk factors that may influence the auditor’s decision to provide negative assurance, even within a permitted period. In addition to the length of time that has passed since the auditor’s last audit or review, those factors include management’s ability to respond to inquiries regarding changes in financial statement line items, changes in senior management, the effectiveness of the company’s ICFR, the company’s ability to continue as a going concern, restatements or other financial statement changes or the appointment of new accountants during the period. The proposal clarifies that these are meant to be reminders; the presence of one or more of these factors does not restrict an auditor’s ability to provide negative assurance. Also, while this list of factors is new, auditor discretion on negative assurance is not. Auditors have always had the ability to decline to provide negative assurance even within the 135 days, although I’m not sure I’ve ever seen that happen….
Public comments should be submitted by January 4, 2027.
While we’re on the topic of audits and auditors, the PCAOB recently reported on the results of its 2025 inspections of 143 PCAOB-registered public accounting firms and reviews of 780 public company audits. Here are the key findings featured in the press release:
– Overall: For all inspected firms, the aggregate Part I.A deficiency rate decreased to 23% in 2025, down from 38% in 2024.
– U.S. Global Network Firms (GNF): The aggregate Part I.A deficiency rate for the six U.S. GNFs decreased to 13% in 2025, from 26% in 2024. U.S. GNF firms regularly provide audit reports for more than 100 issuers and must be inspected by the PCAOB annually.
– “Big Four” U.S. Firms: The aggregate Part I.A deficiency rate for the Big Four U.S. firms – which as of December 31, 2025, collectively audited approximately 80% of the market capitalization of public companies listed on U.S. exchanges – decreased to 8% in 2025, from 20% in 2024.
– U.S. Non-Affiliated Firms (NAF) Annual: Part I.A deficiency rates at the annually inspected NAF firms decreased to 18% in the aggregate in 2025, compared to 52% in 2024. U.S. NAF firms that regularly provide audit reports for more than 100 issuers must be inspected by the PCAOB annually.
– U.S. NAF Triennial: Firms in this category regularly provide audit reports for 100 or fewer issuers and thus must be inspected by the PCAOB at least triennially (i.e., not less frequently than once every three years). Aggregate Part I.A deficiency rates in this category dropped to 32% in 2025, from 53% in 2024.
– Non-U.S. Firms: The aggregate deficiency rate at Non-U.S. GNFs increased to 26% in 2025, from 24% in 2024. Non-U.S. NAF deficiency rates declined in the aggregate from 76% in 2024 to 58% in 2025.
