Issue link: https://digital.shearman.com/i/1512772
Shearman & Sterling LLP 11 | SEC Demands Stronger Disclosure Controls in Recent Enforcement Actions SEC Demands Stronger Disclosure Controls in Recent Enforcement Actions Harald Halbhuber, Sara N. Raisner, Alicia Rose, and Zhaohua Huang Insights The SEC's Division of Enforcement has significantly stepped up its push for stronger disclosure controls— i.e., the processes 1 that public companies must maintain to collect information required for timely disclosure in their SEC filings and submissions. In 2023, it has brought a number of enforcement actions that have included charges of failure to maintain adequate disclosure controls, continuing an upward trend from 2022 and 2021 which saw a number of such enforcement actions, respectively, compared to three in 2020. Early enforcement of the disclosure controls requirement—prior to 2020— had been sporadic, with one action each in 2018, 2015, and 2013. 2 In this article we analyze the drivers and policy considerations behind the SEC's recent focus on disclosure controls, summarize the types of disclosure controls at issue in the recent actions, and address what might come next in disclosure controls-based enforcement. DRIVERS AND POLICY CONSIDERATIONS UNDERLYING RECENT DISCLOSURE CONTROLS CHARGES The rise in the number of disclosure controls-based enforcement actions reflects no change in law, as the underlying rules have remained the same for two decades. Since 2002, public companies have been required to maintain controls and other procedures designed to ensure that information required to be disclosed as part of their ongoing reporting is recorded, processed, summarized and reported within the SEC's deadlines. This specifically includes procedures designed to ensure that information required to be disclosed is accumulated and communicated to management, including the CEO and CFO, to allow timely disclosure decisions. What the increasing number of disclosure controls-based charges may reflect, however, is an evolution in thinking within the SEC's Division of Enforcement. There is a certain pragmatism in controls-based enforcement. Each of the recent settlement orders helps to socialize the disclosure-controls-based charge as an increasingly established tool in Enforcement's arsenal, rather than a few one-off cases that are difficult to use as precedent. The disclosure controls based-charge is a particularly useful device for the SEC in an enforcement action because it is easier to support, as a legal and evidentiary matter, than a material misstatement or omission. This provides a potential fallback option for the SEC enforcement team when its investigative efforts towards material misstatement or omission charges do not yield fruit; they may evolve into a disclosure controls charge. And, from the perspective of corporate defendants, settling for a disclosure controls charge is certainly better than a potential SEC finding that the defendant's disclosures were false or misleading, or perhaps even fraudulent— which could be unhelpful in private securities litigation against the company and individual executives who are viewed as responsible for company disclosures. Indeed, in two of the more recent actions, the disclosure controls charge was the only charge brought—without an accompanying separate charge alleging false or misleading disclosures. In the first case, in 2021, the SEC charged First American Financial Corporation, a real estate transaction- services provider, for allegedly lacking controls and procedures designed to ensure that all available, relevant information concerning a cybersecurity vulnerability was analyzed for potential disclosure 3 1 "Controls and other procedures," as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934. 2 We do not count disclosure control charges that were based on the companies' own disclosures that their disclosure controls were ineffective or on a complete failure to file periodic reports. 3 In re First American Financial Corp., Admin. Proc. No. 3-20367, https://www.sec.gov/litigation/admin/2021/34-92176.pdf (June 14, 2021).