It will be interesting to see if Equilar’s new ‘pay ratio’ survey proves accurate after the proxy season – the survey predicts that companies will disclose a ratio of 140:1 on average. Here’s the intro from the blog by Cooley’s Cydney Posner about the survey results (see this related WSJ article):
Equilar has just released the results of an anonymous survey of public companies, with 356 respondents, which asked these companies to indicate the CEO-employee pay ratios they anticipated reporting in their 2018 proxy statements. As you would expect, there was a lot of variation among companies based on industry, market cap, revenue, workforce size and geography. In addition, because the rule provided significant flexibility in how companies could identify the median employee and in how they calculate his or her total annual compensation, variations in company methodology likely had a significant impact on the results.
These variations in the data underscore the soundness of the SEC’s view, expressed at the time it adopted the pay-ratio rule, that the rule was “designed to allow shareholders to better understand and assess a particular [company’s] compensation practices and pay ratio disclosures rather than to facilitate a comparison of this information from one [company] to another”; “the primary benefit” of the pay-ratio disclosure, according to the SEC, was to provide shareholders with a “company-specific metric” that can be used to evaluate CEO compensation within the context of that company.
Tomorrow’s Webcast: “Conflict Minerals – Tackling Your Next Form SD”
Tune in tomorrow for the webcast – “Conflict Minerals: Tackling Your Next Form SD” – to hear our own Dave Lynn of Jenner & Block, Ropes & Gray’s Michael Littenberg, Elm Sustainability Partners’ Lawrence Heim and Deloitte’s Christine Robinson discuss what you should now be considering as you prepare your Form SD for 2018.
By the way, check out Lawrence’s new book – “Killing Sustainability” – which attacks old myths, unrealistic expectations and flawed valuation methodologies related to corporate sustainability/CSR. The book lays out a pragmatic foundation from which readers can develop a credible approach to demonstrating financial contributions of CSR programs…
SEC Approves NYSE Change: Facilitate Listing Without an IPO
Here’s the intro from this blog by Steve Quinlivan:
The SEC has approved a rule change to the NYSE listing standards to facilitate the listing of an issuer without conduction an IPO. According to the NYSE, the rule change is necessary to compete for listings that might otherwise by listed on NASDAQ.
As revised, the NYSE will, on a case by case basis, exercise discretion to list companies whose stock is not previously registered under the Exchange Act, when the company is listed upon effectiveness of a registration statement registering only the resale of shares sold by the company in earlier private placements.
There’s a serious issue brewing at the PCAOB – and SEC – regarding auditor independence. This summary report issued by the PCAOB a few months ago about inspections conducted over 2016 year-end audits states on pages 14-15 that independence issues were found. That apparently caused the PCAOB to delay issuing inspection reports. Inspection reports for the Big 4 were issued in the August-November time-frame during the prior year. For 2017, only one report – about Deloitte – has been issued so far. This also highlights the periodic lack of transparency & timeliness of the PCAOB inspection process.
Fight Over Independence Disclosures
It’s my understanding that PCAOB inspectors found independence violations by the audit firms that were not reported to either investors or audit committees. This would mean these violations were not reported in writing as required by PCAOB Rule 3526, as noted in the PCAOB’s summary report. As an investor & audit committee member, I find this misleading disclosure to be troubling. Footnote 30 of the report (pg. 14) states: “PCAOB Rule 3520, Auditor Independence, requires auditors to satisfy all independence criteria applicable to an engagement, including the criteria in PCAOB rules and the criteria in the rules and regulations of the SEC.”
The Big 4 firms have prepared a white paper – collectively – that they submitted as a group to the PCAOB and its inspection group. The firms are apparently arguing they should not have to make the necessary disclosures – and despite the violations, can still publicly tell investors they are independent. I understand that white paper hasn’t been made public.
The firms argue that if they engage in a violation, they should be able to somehow “fix” the problem. But that is clearly not how the auditor independence rules work. The SEC has stated that the independence rules are prophylactic – so as to ensure investors can have trust & confidence in the audit. Yet, apparently in the instances found by inspectors, the auditors failed to notify the proper people (audit committee, PCAOB, SEC, investors) about the problems. Similar issues were found by regulators in the Netherlands a number of years ago, who found that one could not rely on the auditors to put in place “safeguards” for their independence, as the auditors put in place self-serving “remedies” in some cases.
The Use of Indemnification Clauses
The PCAOB’s summary report also notes that auditors continue to put indemnification clauses in their audit engagement contracts – despite the fact the AICPA has a clearly stated rule, as does the SEC, that indemnification clauses are not permitted for public company audits. In the recent Colonial Bank case, the judge ruled that PWC had improperly included an indemnification clause in one of its engagement letters and was therefore not independent.
The SEC also brought an enforcement case against an auditor in Florida for including an indemnification clause in the audit engagement letter (the auditor’s second enforcement action within a few years). It appears some auditors believe they can “slip one by” if no one notices these. In fact, to the PCAOB’s credit, they have been citing auditors for violations of the professional standards and GAAS for indemnification clauses for a number of years. This raises the question of why doesn’t the PCAOB take enforcement actions instead of just writing up the deficiencies in inspection reports. Clearly, the latter action is not having the necessary impact.
The SEC’s independence rules (Regulation 210.2-03) have a provision to exempt an audit firm if an inadvertent violation occurs, The exemption applies provided the person or persons on the audit: (1) were not aware of the circumstances giving rise to the violation, (2) the firm had adequate internal controls for independence in place, (3) violation was promptly corrected, (4) the firm had a training program in place, and (5) had an enforcement mechanism in place. But the SEC’s rules don’t permit an exemption if at the time of the violation, the auditor knew – or should have known – they were violating the rules. Here’s a lawsuit involving such an example.
The SEC & PCAOB rules are very clear. The auditor must follow the independence rules throughout the audit year. The firms are required to have training programs in place to require this. These rules are not new to anyone – and any professional knows they are serious and to be followed. In fact, GAAS states that a violation of independence is a violation of one of the ten primary “Generally Accepted Auditing Standards” – and that such a violation cannot be corrected through other auditing procedures.
Will the States Be Brought In?
It will interesting to learn if the PCAOB has involved the “National Association of State Boards of Accountancy” in these discussions as the State Boards each have independence rules which are built around compliance with the rules of the SEC, PCAOB and AICPA. If you can’t trust an auditor to follow the laws & regulations, what can you trust them for? Particularly if they engage in covering up their violations.
Transcript: “Handling the Proxy Season – The In-House Perspective”
We have posted the transcript for our recent popular webcast: “Handling the Proxy Season – The In-House Perspective.”
This Bloomberg article says that the SEC may be open to revisiting the permissibility of bylaws requiring investors to arbitrate their claims against public companies. Here’s an excerpt:
The SEC in its long history has never allowed companies to sell shares in initial public offerings while also letting them ban investors from seeking big financial damages through class-action lawsuits. That’s because the agency has considered the right to sue a crucial shareholder protection against fraud and other securities violations.
But as President Donald Trump’s pro-business agenda sweeps through Washington, the SEC is laying the groundwork for a possible policy shift, said three people familiar with the matter. The agency, according to two of the people, has privately signaled that it’s open to at least considering whether companies should be able to force investors to settle disputes through arbitration, an often closed-door process that can limit the bad publicity and high legal costs triggered by litigation.
The SEC’s willingness to take up the issue is apparently based on its desire to encourage more companies to take the IPO plunge. As I blogged last year, at least one Commissioner is on record as being open to permitting mandatory arbitration bylaws.
The article suggests that any action by the SEC to allow mandatory arbitration would be a “big gift” to companies – but as Broc pointed out in this blog, others say that companies should be careful what they wish for…
Activism: Glass Lewis Says “Hey, Don’t Blame Us!”
Some companies have grumbled that proxy advisors – like ISS and Glass Lewis – are fueling activism by generally supporting insurgent nominees in activist campaigns. This Glass Lewis blog pleads “not guilty”:
This perception isn’t borne out by the overall numbers. We’d caution against reading too much into the data, since the yearly sample of contested meetings is both too small to be free of significant variance, and too big to reflect the particular combination of parties and moving parts that makes each contest unique. That said, Glass Lewis’ support for contests dropped from 40% in 2016 to 32% in 2017, and has historically stayed within that range. Nor has Glass Lewis’ approach to contested meetings changed in a way that would result in increased activist support; our methodologies, our case-by-case approach and our team have remained consistent.
Glass Lewis suggests that the perception that proxy advisors are all-in for activists is fueled by the changing nature of the activism. Larger activists have a lot of capital, sophisticated strategies & a long-term approach, and that’s allowed them to hunt larger game & win proxy advisor support in some cases:
This combination of long-term goals, sophisticated tactics and significant investment has allowed activists to pursue larger, more established companies that perhaps were not previously at risk of a shareholder campaign. As well known companies are targeted, the contests themselves are generating more headlines; and with campaign strategies getting more and more refined, Glass Lewis supported some, but not all, of the highest profile dissidents in 2017 — for example, at Arconic, Cypress Semiconductor and P&G.
There were also a number of large contests where we supported management (General Motors, Buffalo Wild Wings and Ardent Leisure), and as noted above Glass Lewis’ overall support for 2017 contests was at the lower end of the historical range; nonetheless, the combination of high profile contests, and sophisticated campaigns, may explain a perception of increased overall dissident support.
Securities Litigation: You Can Get Into Trouble Without Saying a Word…
Did you know that most securities litigation involves alleged material omissions, not misstatements? Me either. This recent Katten Muchin article reviews the legal landscape for omissions claims and offers tips to directors on how to reduce their company’s risk of being on the receiving end of such a claim.
Early Bird Rates – Act by April 13th: Huge changes are afoot for executive compensation practices with pay ratio disclosures on the horizon. We are doing our part to help you address all these changes – and avoid costly pitfalls – by offering a special early bird discount rate to help you attend these critical conferences (both of the Conferences are bundled together with a single price). So register by April 13th to take advantage of the 20% discount.
More on Voting: When Is An Investor “Passive”?
A while back, Liz blogged about investors who break from their normal approach of voting with ISS to support management. Does voting with management make those investors more “passive”? Not necessarily. Here’s an excerpt from “Proxy Insight’s” follow-up article (pg. 7) by Aon Governance’s Karla Bos:
Certainly, at the investment firms I worked for, overriding our voting policy was anything but a passive act. With the value placed on thoughtful and thorough decision-making and the constant spotlight on our voting decisions, the override process was intentionally designed to take some measure of time and effort. It took an active voting process to engage with issuers, hold internal discussions and debates, ensure no conflicts were present, and document our rationale for voting differently than we typically might have.
Furthermore, like the ISS auto-voters, many of our overrides resulted in decisions to vote with management. Similar to the ISS voting policy, many of our stated voting policies addressed potential governance concerns, so they were written to lay out the voting action we would take in those cases. Therefore it is not surprising that our overrides often occurred where we ultimately deemed the company’s practice acceptable and appropriate based on the particular facts and circumstances.
This is a good reminder that even some so-called “passive” investors are actively engaged…
Our February Eminders is Posted!
We have posted the February issue of our complimentary monthly email newsletter. Sign up today to receive it by simply inputting your email address!
I am still trying to wrap my head around last week’s allegations against KPMG’s former partners & employees involving the misappropriation of PCAOB inspection data. “Shocking” doesn’t seem to be too strong a word here.
This case doesn’t involve ambiguous conduct that might just raise some eyebrows about the “revolving door.” No, this time, the revolving door smacked us right in the mouth. As the SEC’s Co-Head of Enforcement Steve Peikin put it, what’s alleged to have gone down here was equivalent to “stealing the exam.”
The SEC’s press release and the DOJ’s indictment make for some tough reading. In a separate statement, SEC Chair Jay Clayton went to great lengths to reassure the market that the scandal didn’t implicate the reliability of KPMG’s audits. As this MarketWatch.com article points out, some prominent commenters aren’t so sure:
Former SEC Chief Accountant Lynn Turner is not convinced KPMG’s audits should still be relied upon. “This episode raises a serious question about the culture of the KPMG firm. Under the circumstances, how can the SEC expect investors to trust KPMG’s audits?” asked Turner.
The MarketWatch article says that the indictment suggests 5 other KPMG partners and an outside consultant “either knew – or chose to ignore – the illegal source of the information.” That isn’t very reassuring either.
How Did KPMG Dodge the Bullet?
Since a number of pretty senior people were implicated in this situation, some have asked why KPMG wasn’t indicted? The pains that SEC Chair Clayton took to reassure the market about the continued reliability of KPMG’s audits hints at one likely reason – the collateral damage that can result from charges against a major accounting firm.
Another reason KPMG may dodge the criminal bullet here is the way it handled the situation once it was brought to management’s attention by a whistleblower. As detailed in this NYT DealBook article from last April, KPMG promptly retained outside counsel to investigate the matter, fired the individuals involved, self-reported, and cooperated with regulators.
Given KPMG’s previous legal troubles, it probably didn’t take the firm’s lawyers long to conclude that it was dealing with a potentially existential threat – and had no alternative but aggressive efforts to cooperate with authorities.
Tomorrow’s Webcast: “Audit Committees in Action – The Latest Developments”
Tune in tomorrow for the webcast – “Audit Committees in Action: The Latest Developments” to hear E&Y’s Josh Jones, Deloitte’s Consuelo Hitchcock, and Gibson Dunn’s Mike Scanlon discuss how to cope with the ever-growing demands on audit committees – including those arising out of the new revenue recognition standards and a host of other SEC, FASB & PCAOB requirements.
Virtual-only annual meetings seem to be gaining traction – as Broc blogged last summer, despite opposition from a number of prominent investor groups, the number of companies going virtual-only increased significantly in 2017. However, this Bloomberg article says that some big companies are having second thoughts about the virtual-only approach:
Railroad operator Union Pacific Corp. will revert to an in-person annual meeting this year, after its 2017 virtual-only gathering drew a shareholder rebuke and a proposal to end the practice, a company lawyer told the Securities and Exchange Commission in a letter dated Monday. ConocoPhillips is also backpedaling after investors objected to the oil producer’s online meeting last year.
“A virtual-only meeting is a totally disembodied event online — there’s no exchange or opportunity for investors to look the board in the eye,” said Tim Smith, a director at Boston-based Walden Asset Management who worked with shareholders of ConocoPhillips and Comcast Corp. opposed to virtual-only meetings.
The article points out that some investors prefer the hybrid meeting approach – where shareholders can attend in-person or online. However, according to Broadridge, only 1-in-5 virtual meetings last year adopted the hybrid approach.
White Collar: Antitrust Cops Say “No Poach” Prosecutions On the Way
Last fall, I blogged about the DOJ’s reminder that it intended to prosecute “no poaching” & wage fixing agreements between companies. Now, this Ropes & Gray memo says that the DOJ plans to make good on that promise. Here’s the intro:
Speaking at an antitrust conference on January 19, 2018, Makan Delrahim, the Assistant Attorney General for the Antitrust Division, stated that over the next few months DOJ will be announcing indictments charging criminal antitrust violations relating to no-poach agreements. DOJ’s position is that these agreements, under which companies agree not to hire each other’s employees, restrain competition in the market for employees and may constitute per se violations of the antitrust laws.
Delrahim’s announcement follows joint DOJ/FTC guidance issued in October 2016, which alerted companies that parties to no-poach agreements would be subject, not just to civil antitrust liability, but also potentially to criminal investigation and sanction. Delrahim also highlighted the extent to which the prior guidance had put companies on notice of the federal antitrust agencies’ approach to no-poach agreements.
Transcript: “Pat McGurn’s Forecast for 2018 Proxy Season”
We have posted the transcript for our recent popular webcast: “Pat McGurn’s Forecast for 2018 Proxy Season.”
Since we nearly gave many of you a pre-Christmas coronary by raising the topic of tax reform’s impact on deferred tax assets, you’re probably not thrilled to see another blog from me on income statement hits resulting from the new tax legislation. Sorry about that, but it’s got to be done.
So, anyway, here it goes – it turns out that whatever benefits tax reform may ultimately have, this “Audit Analytics” blog says it’s resulting in pretty eye-popping charges to some companies’ bottom lines:
Under GAAP, tax assets and liabilities are required to be re-measured during the period in which the new tax legislation is enacted. In some cases, if the impact is expected to be material, companies are also required to disclose estimated impact through 8-K filings. So far, at least 36 companies made such a disclosure, reducing the net income by a total of at least $50 billion. Eight of these 36 companies disclosed write-downs that exceeded $1 billion. Interestingly, two out of 36 companies have large deferred tax liability positions, so the effect is expected to be positive.
Citigroup’s the leader in the clubhouse with a staggering $20 billion estimated charge – and 6 of the other 7 companies taking whacks exceeding $1 billion are also financial institutions. The charges won’t all result from valuation allowances for deferred tax assets – the one-time repatriation tax on foreign cash will also represent a big hit for some companies.
How big is this going to get? The blog points to this MarketWatch article, which estimates that the 15 companies with the largest deferred tax asset balances may have to write down nearly $75 billion.
Tax Reform: First Batch of Disclosures Is “In”!
In this blog, Steve Quinlivan notes the disclosures made by companies with fiscal quarters ended 12/31/17, but not fiscal-year ends that show the effects of the tax legislation in recently filed Form 10-Qs in accordance with SAB 118. Some may find these disclosures as a useful starting point for drafting Form 10-K disclosures…
It’s Halloween all over again! In this article, Carl Hagberg of the “Shareholder Service Optimizer” scares us. Here’s the intro:
One of our fellow Inspectors of Election left a message to say that a client just learned that protestors at their upcoming shareholder meeting would be coming dressed as ZOMBIES. “Have you ever heard of costumes at shareholder meetings? Any ideas on what to do?” he asked.
“Guess what? Coming to shareholder meetings in costumes is a very old tradition!” Check out this article for a photo of old-time gadfly Wilma Soss dressed as Molly Pitcher – and as a “Cleaning Lady” following the TV Game Show scandals – and one year, she came to the General Motors meeting in a wheelchair, wrapped head-to-toe in fake-blood-smeared bandages to dramatize a steering-defect scandal.
For some reason, this reminded me of “Scabby the Rat,” who pays a visit to businesses all over the country when the unions are on strike. Like me, Scabby’s a Chicago native, but he gets around. Even has his own Facebook page.
The NYSE has sent its “annual corporate governance letter,” highlighting considerations for NYSE-listed issuers as the proxy season approaches. The reminders include one about advance notice of dividend or stock distribution announcements to take effect February 1st…
Broc Tales: The Next Nine
Reg FD-style! Here are the second nine stories that have run in my new “Broc Tales Blog”:
1. The Inconvenient Truth
2. Is This One More Like “Psycho” or “Rear Window”?
3. The Curiously Challenging Distinction of Private Guidance Reaffirmations & Going to Jail
4. The Low-Level Employee on a Mission From God
5. Low-Level Employee As Spokesperson
6. The Director Spokesperson: A Bad Idea?
7. Who Should Be Taking You to the Dance?
8. The Most Confusing Part of FD In All the World
9. Training Your FD Dragon
Check ’em out. If you like them, that’s great – insert your email address when you click the “Subscribe” link if you want these precious tales pushed out to you…
When I first heard that ISS was launching “Corporate Due Diligence Profiles,” my kneejerk reaction was that they were just rebranding the governance rating product that they have renamed a number of times over the years (eg. CGQ, GRId, QuickScore). But “Corporate Profile Products” is much more than a numerical rating applied to your governance profile. This blog by Davis Polk’s Ning Chiu explains – here’s an excerpt:
We understand from ISS that the product was designed to meet investor demands in reviewing companies for possible shareholder engagement and seeking more insight on individual directors. While the overall data is not new, as the report aggregates information primarily from prior ISS reports and QualityScore into new formats, companies will likely want to be aware of they are being perceived by investors.
Companies may be interested in particular in the 50+ page sample report (you need to fill in a form to receive the report), which shows:
– Historical vote recommendations by ISS on all annual meeting matters and vote results.
– A simple director skills matrix chart based on company disclosure, which interestingly highlights the director skills disclosed by another board where the director sits that is not disclosed in the company’s proxy statement. Companies may want to review how other companies’ describe the skills and qualifications of their directors.
– The QualityScore analysis measuring a company’s governance and compensation practices against the peer group selected by the company, and the industry peer group. Red flags note deviations from “best practices.” Companies may not always be aware of the QualityScore standards. Recent QualityScore updates reflect that for board diversity, as one example, a company must have three women directors serving on its board to qualify for meeting best practices. Two women on a ten-member board would earn a company a red flag. On tenure, a red flag would highlight a company with more than a third of board members who have served over nine years.
– A page devoted to each director, including that director’s election history at other companies where the director serves, as well as the TSR of those companies over the length of the director’s tenure.
Life as a Proxy Designer
In this 14-minute podcast, Labrador’s Molly Doran discusses her exciting career, including:
1. How did you wind up getting into the regulated communication industry?
2. What do you tell people that you do when you first meet them?
3. What are the hot topics that you’re grabbling with now?
4. What are the hardest parts of your job?
5. How is it working with the French?
6. What are the best parts of your job?
7. What advice would you give to someone new in your field?
8. What types of changes do you see coming in the near term for proxy design?
More on “The Mentor Blog”
We continue to post new items daily on our blog – “The Mentor Blog” – for TheCorporateCounsel.net members. Members can sign up to get that blog pushed out to them via email whenever there is a new entry by simply inputting their email. Here’s some of the newer entries:
– Wanna Earn Big $$$? Change Your Company’s Name
– Q&A With Keith Higgins
– FCPA: Is a Follow-On Lawsuit an End-Run Around?
– Auditor Liability: Auditors May Now Be Forced to Look for Fraud
– Revenue Recognition: Lessons from “Early Adopter” Comments
– Disgorgement: Tax Reform’s Impact on Deductibility
As we blogged on several occasions last year, the issue of concurrent state jurisdiction over Securities Act claims is very much a live one, with the Supreme Court expected to weigh in on it later this term. However, it seems fair to say that state courts – particularly California state courts – have seen a booming business in Section 11 lawsuits in recent years.
In response, a number of IPO companies have adopted bylaws making federal courts the exclusive forum for Securities Act litigation – but this recent blog from Davis Polk’s Ning Chiu notes that this practice has recently been challenged in a declaratory judgment action filed in the Delaware Chancery Court. The lawsuit targets three companies – Snap, Roku & Stitch Fix – that have similar choice of forum bylaws. The plaintiff claims these bylaws don’t pass muster under Delaware law:
Plaintiff argues that the purpose of the forum provision is to regulate choice of venue in actions that do not assert internal corporate claims governed by Delaware law, or in the alternative, if claims under the Securities Act are internal corporate claims, then these forum provisions are inconsistent with the DGCL. The DGCL provides that, with respect to internal corporate claims, “no provision of the certificate of incorporation … may prohibit bringing such claims in the courts of this State.”
Ning points out that several California state courts have already invalidated this type of choice of forum bylaw. The D&O Diary has posted a copy of the declaratory judgment complaint in the Delaware action.
Enforcement: Assessing the Fallout from Kokesh
This Cleary blog looks at what’s transpired in the six months following the Supreme Court’s Kokesh decision – which said that SEC disgorgement claims were subject to a 5-year limitations period & may have raised questions about the agency’s authority to seek disgorgement in the first place.
So far, the SEC has been successful in fighting off claims directly challenging its authority to seek disgorgement, but the blog notes that the news hasn’t all been good for the SEC. A number of courts have been willing to at least acknowledge questions surrounding the SEC’s disgorgement authority, and other equitable remedies have come under fire because of Kokesh – including such enforcement mainstays as “obey-the-law” injunctions & industry bars.
And then, there’s the $15 billion question:
Most of the cases addressing Kokesh have involved SEC defendants arguing that the case limits the regulator’s use of disgorgement prospectively. However, this past fall private plaintiffs launched a much more aggressive salvo in the form of a class action arguing that certain historical awards are also at issue. Jalbert v. SEC, 17-cv-12103 (D. MA. Oct. 26, 2017), ECF. 1. The Jalbert plaintiffs argue that—because (1) the SEC can only collect penalties when specifically authorized by statute and (2) Kokesh held that disgorgement, which is not specifically authorized by statute, is a penalty—the SEC must return $14.9 billion in disgorgement that it has collected over the past six years.
Audit Committees: 3rd Party Risk Oversight
As part of their increasing emphasis on enterprise risk management, companies are paying closer attention to the risks posed to their business by vendors and other 3rd parties with whom they deal. This recent memo from the Audit Committee Leadership Network addresses the audit committee’s oversight role in addressing 3rd party risks.
Here’s an excerpt discussing some of the issues associated with outsourcing arrangements:
Outsourcing also opens the door to third‐party risk. Information technology, customer service, call centers, and human resources functions like benefits processing are not traditionally defined as part of the supply chain, but as these jobs and functions are outsourced, they become sources of third‐party risk, much like suppliers or distributors. In addition, shared technologies, such as cloud data storage, are necessitating new kinds of third‐party arrangements, with attendant risks.
Companies will frequently join forces to serve each other’s customers more effectively or to reach new customers. Examples of such arrangements include contracted ventures with marketing and cobranding partners and engagements with fee‐based service providers. When these arrangements require sharing sensitive data, they become a source of risk.
Specific risks associated with 3rd parties include cybersecurity risks, operational risks, & reputational risks. The memo discusses various approaches that companies take to managing 3rd party risks, as well as the methods used by boards to assess those risks.
