As noted in this Cooley blog, there could be Congressional action in the area of cybersecurity disclosure soon enough. Here’s an excerpt from the blog:
Senators Jack Reed and Susan Collins have introduced the bipartisan “Cybersecurity Disclosure Act of 2015”, a bill to promote transparency in the oversight of cybersecurity risks at publicly traded companies. According to the press release, the bill is designed to ensure that public companies “provide a basic amount of information about the degree to which a firm is protecting the economic and financial interests of the firm from cyber attacks.” In addition, the bill “seeks to strengthen and prioritize cybersecurity at publicly traded companies by encouraging the disclosure of cybersecurity expertise, or lack thereof, on corporate boards at these companies.”
If ever enacted, this legislation would require companies to disclose – in their SEC filings – whether they have a director who is a “cybersecurity expert” – and if not, why having this expertise on the board isn’t necessary because of other cybersecurity steps taken by the company. The bill would require the SEC and the National Institute of Standards and Technology to provide guidance on the qualifications necessary to be a cybersecurity expert. This Jones Day piece by Mauricio Paez & Randi Lesnick criticize the bill…
It’s Here! “The Cybersecurity Act of 2015”
Congress & President Obama did enact a cybersecurity piece of legislation recently. One part of the omnibus appropriations bill is the “Cybersecurity Act of 2015.” As noted in the memos we are posting in our “Cybersecurity” Practice Area, the Act addresses the sharing of information between the public and private sectors about cyber threats (including privilege and confidentiality implications), liability protections for companies that monitor, how to share or receive cyber threat information and much more…
SEC Commissioner Aguilar Talks SEC’s Own Cybersecurity Risks
In this statement, SEC Commissioner Aguilar talks about the agency’s need to focus on its own cybersecurity profile. As I’ve blogged before, I think it’s just a matter of time before Edgar is hacked…if it hasn’t been already…
Recently, I blogged about the continued criticism of stock repurchase programs. In response, I received this note from Downey Brand’s Bruce Dravis:
Thanks for flagging new articles on the share buybacks. The main point of the Reuters piece tracks ground covered by a Harvard Business Review article last year on how the combined dividends and buybacks exceeded earnings over a given period. However, earnings, dividends and share buybacks are very different operational events for a company. While dividends and buybacks both involve expenditures of cash, they represent divergent strategies for providing returns to shareholders.
Conflating them in order to see if the combination exceeds company earnings generates an interesting number—but shouldn’t generate an automatic conclusion that shareholder payments are crowding out capital allocations for company development. It’s true that companies are under pressure from some activists to deliver short-term results. There is also a countervailing pressure from institutional investors to deliver sustainable results, which requires strategic investment.
Measured in absolute dollars, the amount spent on stock repurchases is a big number. A fairer picture, though, should include looking at how much the share repurchase expenditure is offset by the cash companies take in through equity compensation plans.
For example, I looked at Intel from 2006-13. Over those eight years, the company issued roughly 850m shares in equity compensation, taking in roughly $12.5b in cash and tax benefits. The issuances, by themselves, would have diluted shareholders by about 15% from the Jan. 1, 2006 starting point. In the same period, Intel repurchased 1.8b shares, for about $40b. Netting the equity plan issuances against the repurchases, you find about $27.5b in net cash expenditures to generate at net anti-dilutive impact of about 20% compared to the Jan. 1, 2006 starting point (in other words, the company bought back all the dilutive equity compensation shares, plus a lot more).
Since equity issuances and repurchases are both capital transactions, I think this comparison is more apt—or at least, adds to creating a more complete picture — than a comparison to earnings alone. If you also consider equity issued for acquisitions — arguably an investment in growing company revenues, albeit not made in R&D dollars — you get an even more complex picture than is suggested by the “Earnings=Dividends+Buybacks” formula.
Here’s a response that I got to Bruce’s note:
Perhaps Bruce should look at the whether the companies with buybacks are granting stock options instead of restricted stock! I gather that most stock based compensation is in the form of the latter. Besides, having buybacks that are tied to stock options means the company is buying shares when employees are selling, instead of making an independent capital allocation decision, and his comment has positive connotation – so just wanted to point this out.
In addition, here’s a Bloomberg piece with a countervailing view about the pace of buybacks…
Nasdaq’s Proposal: Regain Compliance Before Delisting for Failure to Hold Annual Meeting
As noted in this blog by Steve Quinlivan, Nasdaq has proposed to have the discretion to grant listed companies an extension to regain compliance before delisting a company that fails to hold an annual meeting. In determining whether to grant a company an extension to comply with the annual meeting requirement, Nasdaq will consider the likelihood that the company would be able to hold an annual meeting within the exception period, the company’s past compliance history, the reasons for the failure to timely hold an annual meeting, corporate events that may occur within the exception period, the company’s general financial status, and the company’s disclosures to the market.
What is “Private Ordering”?
Here’s an excerpt from this blog by “The Activist Investor” to explain a concept that wasn’t familiar to securities lawyers a decade ago:
It refers to a long-standing legal concept in which individual parties agree on how to police an activity, instead of relying on government regulation. It can apply to all sorts of activities – for example, development of information technology and the Internet, and the rules for standardizing structures and processes in online affairs.
To activist investors, it refers to how shareholders agree, with each other and with company management, on how corp gov will work at a given portfolio company. They do so instead of relying on states, Congress, and the SEC to prescribe corp gov principles as law and regulation.
This is different than self-regulation. When an industry self-regulates, it promulgates its own standard rules that apply to all parties (companies, consumers). Private ordering defines specific rules for each individual situation, in this case each individual company.
In the corp gov world, private ordering can apply to just about any part of company bylaws. Most recently, bylaw provisions for forum selection and litigation costs have stoked the debate about whether state corporate law and regulation or agreement among shareholders and management should prevail.
It also applies to the debate over proxy access, among other areas that fall within Federal jurisdiction. Recall how proxy access started as a strict SEC regulation requiring access on specific terms, pursuant to the Dodd-Frank Act. The SEC also allowed shareholders to propose different proxy access terms, in a bylaw amendment or non-binding resolution. A friendly judge vacated the regulations, but let stand the part that allowed shareholders to propose some form of proxy access for that company.
We note that regulation and private ordering sit at the two ends of a continuum of choices, rather than as the only two choices. We (the investing public) can decide to regulate something that won’t work for private ordering. We can leave to private ordering something else that is too expensive or complicated to regulate. We can regulate lightly, and leave some elements of a subject to private ordering. The possibilities are endless.
On Monday, Corp Fin issued 4 more CDIs (#3-6) on the FAST Act, tripling the number issued so far…
SEC Rulemaking Petitions: Political Spending Rulemaking Not Happening (At Least Not Soon)
The recent omnibus spending bill from Congress (page 1982) contains a provision prohibiting the SEC from conducting rulemaking in the area of political contributions disclosures as I blogged last week on “The Mentor Blog.”
As noted in this blog by Steve Quinlivan, 28 Senators and 66 House reps then sent a letter to the SEC explaining that the agency is free to propose a rule to require disclosure of corporate political spending – so long as the SEC doesn’t finalize, issue or implement it. The letter is supported by an opinion from Professor John Coates. The upshot is that this means that the petition from Harvard’s Lucian Bebchuk – which has received over 1 million comments in support – is not going to be both proposed and adopted this year…
The prohibition is just for this budget year as this is a budget bill for the 2016 fiscal year. Section 707 of the bill provides: “[n]one of the funds made available by any division of this Act shall be used by the Securities and Exchange Commission to finalize, issue, or implement any rule, regulation, or order regarding the disclosure of political contributions, contributions to tax exempt organizations, or dues paid to trade associations.” So it seems that Congress would have to renew the prohibition next year (or do it differently) to make it permanent – as I read it. I think that’s why the letter talks about why the SEC is allowed to propose rules now and get the ball rolling. But I believe it could be done in the next fiscal year, so long as it doesn’t use FY 16 funds…
Once my boys were no longer toddlers, we became a “swim team” family. I’m not a good swimmer & didn’t grow up in an environment that facilitated that. But my wife did – and she brought that incredible experience into our lives. As my boys grew into men, they learned how to mentor kids of all ages – and both genders – from an early age. It was invaluable as a teaching tool – and a lot of fun. Swimming is a popular sport in the DC area – and a lot of our country’s top swimmers hail from here (egs. Michael Phelps & Katie Ledecky).
One of the major swim family benefits was meeting a slew of swimmers who are simply amazing. They put in endless work to achieve their goals (often getting up at 4:30 am to swim before school) – and don’t have the egos that you sometimes see in other sports. They are humble, funny and smart. And the best of them all is Chuck Katis. Chuck was on our swim team and broke a national breaststroke record (& a number of state records. He went on to swim for Harvard – and then transferred to Cal-Berkeley, helping to lead that team to win the NCAAs in his senior year (including setting an American relay record in the process). It was a joy to watch Chuck grow and see his hard work pay off.
Chuck graduated last year and is spending this year training in the hopes of making the Olympic team next year. Not an easy task as only two swimmers in each event earn the right to go to Rio. To help support himself, he’s getting creative with funding by putting on a series of magic shows in the San Fran area – half of the money raised will go to the homeless (a status that he flirted with growing up). Or you can just donate without going to a show. Please help Chuck – learn more.
As Chuck says: “Think these shows are a unique way to allow myself to give back and change some lives in the process of accomplishing my own goals. Will make me that much stronger in the water.”
Anyways, this short video of our local team gives you an idea of the swim family experience:
E-Holiday Cards: Do You Look At Them?
I’ll admit I didn’t open any of the numerous holiday cards I received by email – until I tweeted a question on Friday asking if anybody does. Then I happened to look and I’m glad I did. My favorite was one from Falls Communications that asked you to submit a note of gratitude to display on this wall. Display your own gratitude now!
All of them looked good, but they all do different things. Some firms sent animated cards that display in HD. For example, check out this groovy 1-minute one from FTI Consulting. They are all quite distinct – Dix & Eaton’s & Pearl Meyers are simple (which I like), Davis Polk has one that is like a puzzle (sort of), Morris Nichols has a pretty winter scene of Wilmington, and Haynes and Boone has a very elaborate flight through a traditional winter wonderland…thanks to WilmerHale’s Tom White & BrooksPierce’s David Smyth for the inspiration to follow-through on this blog…
On Friday, Corp Fin (& Risk Fin) issued this 118-page Staff Report on the “Accredited Investor” definition, as noted in this press release. Dodd-Frank requires the SEC to study the definition every four years – and this is the first study. Comments are invited on the Staff recommendations contained in the report. See this Cooley blog…
Crowdfunding: SEC Now Allowing “Form C” Test Filings
As noted in this Corp Fin announcement, companies may immediately begin test filings of the form to be used when conducting Regulation Crowdfunding offerings. The tests can be run til February 29th (yeah, a leap year).
During this test period, filers should identify their Form Cs as “test” filings. Live filings aren’t permitted until the rules are effective on May 16th. Test filings will not be reviewed by SEC staff or available to the public. As is the case with any document submitted on EDGAR, test filers should not submit confidential or personally identifiable information in the tests.
Board Diversity: Examples of Companies With More Women
Perhaps one way to encourage companies to better diversify their boards is to highlight those companies that have already done so. This Pay Governance memo does just that…
Today, ISS issued 78 FAQs on its US proxy voting policies – there are two FAQs on proxy access that are literally highlighted in the document. FAQ #30 describes the policy regarding a board’s implementation of proxy access in response to a proxy access shareholder proposal that received majority support and FAQ #60 sets forth the analytical framework for evaluating proxy access director nominees.
ISS also posted 69 compensation-related FAQs – note it’s hard to discern the year-over-year changes from last year’s comp FAQs since the 2015 FAQs are formatted differently from the 2016 FAQs.
FERF & EY recently released the results of their joint Disclosure Effectiveness study, reflecting the survey input of more than 120 executives from various industries – supplemented by interviews of key stakeholders in the financial reporting process such as preparers, investors, audit committee members and legal counsel.
Key findings include:
Almost 75% of respondents are taking action to improve their financial reporting.
The three key focus areas are: disclosing material information and eliminating immaterial information (80%), reducing redundancies and using more cross-referencing (77%), and eliminating outdated information (70%).
Disclosure effectiveness initiatives are predominantly driven by management teams who have questioned the clarity and readability of financial communications. However, a number of other important catalysts were cited – including SEC and FASB disclosure effectiveness initiatives.
Areas that companies have improved the most in their 10-Ks include the MD&A, business section, risk factors, and certain footnotes to the financial statements.
Disclosure effectiveness is a cross-functional effort. Respondents noted that it’s important to engage from the outset those involved in the company’s financial reporting process — including senior executives, controllers/financial reporting, IR, in-house and external counsel, and directors.
Companies cited a number of key benefits to improving disclosures, including receiving favorable reactions from senior management, directors, investors and analysts who found the information easier to read and digest — allowing them to make more informed decisions. In addition to improving financial communications, companies also reported finding meaningful process efficiencies as a result of their efforts.
Regulator and accounting standard-setter support is needed to address some of the challenges with disclosure effectiveness – most notably w/r/t the notion of materiality, which has since been the focus of two FASB proposed ASUs (see Broc’s earlier blog).
Many companies plan to continue the process they have been using to improve disclosures, but have become wiser about potential hurdles, including, e.g., the need to start disclosure effectiveness early and get broader buy-in, especially from the IR team. In addition, companies expressed the need to engage investors – who have increasingly become more sophisticated – to better understand their needs and processes so they can deliver more transparent reports.
FASB Deliberates Next Steps on Disclosure Effectiveness Initiatives
With the December 8th comment deadline just passed, online comments to the FASB’s two proposed ASUs (hereand here) aimed atclarifying the concept of “materiality” for financial disclosure purposes were relatively limited – with investor groups and corporations tending to – not surprisingly – express divergent views as to the benefits of proposals that are anticipated to reduce but enhance overall disclosure. Next steps? FASB will redeliberate its proposed changes based on stakeholder feedback received through the comment letter process.
We continue to post new items daily on our blog – “The Mentor Blog” – for TheCorporateCounsel.net members. Members can sign up to get that blog pushed out to them via email whenever there is a new entry by simply inputting their email address on the left side of that blog. Here are some of the latest entries:
This recent memo from New York’s State Department of Financial Services (NYDFS) to federal and state banking, securities and insurance regulators contains a robust list of potential new cybersecurity requirements that would apply to NY financial institutions – including a requirement to have a designated CISO responsible for (among other things) overseeing and implementing the organization’s cybersecurity program, enforcing its cybersecurity policy, and submitting an annual report to the NYDFS that assesses the cybersecurity program and risks – and which has been reviewed by the board of directors.
The proposed requirements would apply only to New York financial institutions; however, the memo notes benefits associated with coordinating its efforts with relevant federal and state agencies to develop a comprehensive cybersecurity framework, while retaining the flexibility to address NY-specific concerns. As such, the NYDFS purportedly welcomes dialogue/input on the proposals from other relevant regulators.
Astounding in its depth and breadth, the new regulatory requirements would be expected to cover these areas, at a minimum:
Implementation of written cybersecurity policies & procedures
Implementation of policies & procedures to ensure data security accessible to/held by third parties
Use of multi-factor authentication as it applies to enumerated applications, servers, data
Designation of a CISO with enumerated responsibilities, including annual reporting to the NYDFS
Implementation of procedures to ensure application security
Employment and training of adequate cybersecurity personnel
Conduct of annual and quarterly auditing-related testing and assessment
Immediate notification to the NYDFS of any cybersecurity incident that has a “reasonable likelihood of materially affecting the normal operation of the entity” including (among other enumerated circumstances) any incident of which the company’s board is notified
Potential CISO “Defense”?
Among the potential considerations discussed in this recently released NYSE Governance Services/Veracode report concerning whether a company has made “reasonable efforts” to secure customer data is whether the company has a dedicated CISO.
According to the report – which discusses the results of a survey of 276 public company directors and officers concerning cybersecurity practices and liability – almost 90% of respondents believe that a company that doesn’t make “reasonable efforts” to secure its data should be held liable by regulators, and studies reportedly have shown that that companies that have a dedicated CISO detected more security incidents and reported lower average financial losses per incident. That being the case (if accurate), the report asks whether we can assume that a company lacking a CISO is, in effect, negligent, or failing to make reasonable efforts to secure its data.
Additional noteworthy survey results include:
90% agree that third-party software providers should be held liable when vulnerabilities are found in their packaged software.
65% of respondents say they have already begun or are planning to insert liability clauses into contracts with their third-party providers.
80% of respondents stated they’ve brought the issue of cybersecurity liability to the forefront of their boardroom discussions.
60% of respondents foresee an increase in shareholder lawsuits as a result of heightened corporate cybersecurity liability.
More than half of respondents believe investors will demand greater cyber-incident transparency from companies as a result of the increased public focus on cyber liability.
Majority of respondent companies say they carry some form of cyber coverage.
More on “The Mentor Blog”
We continue to post new items daily on our blog – “The Mentor Blog” – for TheCorporateCounsel.net members. Members can sign up to get that blog pushed out to them via email whenever there is a new entry by simply inputting their email address on the left side of that blog. Here are some of the latest entries:
– SEC Comment Letters: Does Auditor “CC” Signal Materiality?
– EDGAR: Having Trouble Displaying Graphics
– IPOs: Does Loyalty Count?
– Vertical Promotion is Not Always Route to a GC Job
– SEC Approves Proposed Research Analyst Rules
As noted in this release, the PCAOB adopted new rules and related amendments to auditing standards yesterday requiring audit firms to disclose the names of each audit engagement partner – as well as the names of other audit firms that participated in each audit – on a new PCAOB form, Auditor Reporting of Certain Audit Participants, or Form AP. We’ll be posting memos in our “Auditor Engagement” Practice Area.
Subject to the SEC’s approval of the rules, auditors will be required to file a new Form AP for each audit within 35 days after the date the audit report is first included in an SEC filing (or 10 days after the audit report is first included in an IPO filing) disclosing:
Name of the engagement partner;
Names, locations, and extent of participation of other accounting firms that took part in the audit – if their work constituted 5% or more of the total audit hours; and
Number and aggregate extent of participation of all other accounting firms that took part in the audit whose individual participation was less than 5% of the total audit hours.
The disclosure requirement for the engagement partner will be effective for audit reports issued on or after January 31, 2017, or three months after the SEC’s approval of the final rules – whichever is later. For disclosure of other audit firms participating in the audit, the requirement will be effective for reports issued on or after June 30, 2017. See also this Cooley blog.
2016 Shareholder Activist Themes & Opportunities
The latest survey from FTI Consulting and Activist Insight explored themes and opportunities activists expect in the coming year, and the investing practices and strategies they plan to employ. Results are based on input from 24 activist firms that have collectively engaged in over 1200 events in more than 10 countries.
Key findings include:
Energy sector was identified among activists as the most significant activism opportunity based on undervaluation, followed by the industrial sector.
Healthcare ranked third, but is tempered by a signficant percentage of respondents reporting limited opportunity in that area – which the authors attribute to debate among activists as to the likelihood of consolidation in the healthcare industry.
Most activists believe that the best activism targets are micro- to mid-cap stocks rather than mega-caps, with the greatest activity expected among small caps.
Activists claim to have much longer holding periods than they’ve exhibited in the past – an average of 3 years compared to an average of 1.5 years two years ago, correlating with an expected increase in operational (as opposed to event-driven) activism – assuming the longer holding periods stick.
80% of investors think merger activism will increase in 2016.
In this podcast, Center for Political Accountability President Bruce Freed discusses the board’s role in corporate political spending, including:
– Why should directors get involved in the company’s political spending activities?
– What is the range of board involvement among companies currently?
– What are the risks of the board not being aware or involved at some level?
– How does a board decide on the appropriate oversight role?
– What/where can boards look to for guidance?
– Once established, how does the board ensure adherence to its political spending policies?
Korn Ferry’s recently released board practices report is particularly noteworthy for its inclusion of Wachtell Lipton Marty Lipton’s thoughts about sensible ways in which boards may ensure they evolve with the times – an increasingly challenging feat in the context of a seemingly continuously changing business environment and rising demands for non-traditional experiences and expertise such technology and cybersecurity.
Among other things, Lipton identifies these potential approaches boards may consider to ensure they – and their mix of skills and experience – remain appropriately current:
Expand the board when necessary to add additional expertise.
Adopt more rigorous director qualifications and focus on director evaluations.
Like the UK, pressures to impose director term limits may increase as a “solution” for board refreshment – but Lipton cautions against arbitrary and black-and-white standards, and justifiably notes the value of board collegiality developed over time.
Consider accessing needed knowledge and capacities with advisory directors or an advisory board.
Boards should have ready access to a wide range of internal and external experts on any issue that requires counsel and comment.
In view of how directors’ oversight responsibilities and the environment within which companies operate are evolving on a macro basis, it seems to me that use of the now-common director skills matrix in its traditional sense may be increasingly inadequate, as it presumes identified skills and attribute gaps will be addressed via new director selection. For sure, that remains one potential (and perhaps the best under the particular facts and circumstances) avenue to pursue – but it makes sense for boards to consider additional, non-traditional ways to add needed expertise, and to employ a mix of strategies to fill the inevitable, evolving gaps.
Companies may be staying or going private so that they can avoid the short-term pressures – e.g., quarterly reporting, earnings projections and associated investor reactions and pressures – associated with being public, according to this recent NYT article, which discusses the findings of this academic paper.
Purportedly consistent with the notion that short-termist pressures distort investment decisions, the paper’s principle findings include:
– Private companies invest substantially more than public ones on average, holding firm size, industry, and investment opportunities constant.
– Private companies’ investment decisions are around 4x more responsive to changes in investment opportunities than are those of public companies.
The article nonetheless cautions public companies against over-reacting to the findings – suggesting and illustrating by example that one way to avoid the potential downsides of being private and reap the benefits of being public is for public companies to behave like a private company as respects maintaining a long-term view and behavior.
Interactive Governance Platform: Bringing Your Proxy to Life
In this podcast, David Weil discusses the recently launched interactive governance platform – iiWisdom, including:
– What is iiWisdom?
– Why should companies have an interactive proxy?
– What is the process from a client’s perspective in working with you on an interactive site?
– How have investors used the site so far?
– Is this a product for institutions, retail investors or both?
– How do you balance what investors want vs. what companies want?
– What are the range of options for companies who want an interactive site?
– What are a few recommendations that people consider to create an interactive proxy?
