Rules for Lawyers Practicing Before SEC

By Roy Simon

[Originally published in NYPRR September 2002]

When I was a first year law student at NYU in 1974, one of the first law review articles I read was Frederick D. Lipman’s The SEC’s Reluctant Police Force: A New Role for Lawyers, 49 NYU L. Rev. 437 (1974). Well, it’s déjà vu all over again, because on July 30, 2002, President Bush signed into law the Sarbanes-Oxley Act of 2002. The most highly publicized portions of the new law reform the accounting profession, but one provision of the statute — little noticed in the major newspapers and wire services will create a new role for lawyers. Specifically, §307 of the Sarbanes-Oxley Act requires the Securities and Exchange Commission (SEC), within 180 days, to issue its own Rules of Professional Responsibility for Attorneys who “in any way” represent issuers before the SEC. Thus, by no later than Jan. 30, 2003 — in about five months — lawyers who engage in securities work will have to conform to a new set of rules. This article discusses the possible text and meaning of those new rules.

Statutory Mandate

Section 307 of the Sarbanes-Oxley Act provides, in full, as follows:

Rules of Professional Responsibility for Attorneys.

Not later than 180 days after the date of enactment of this Act, the [Securities and Exchange] Commission shall issue rules, in the public interest and for the protection of investors, setting forth minimum standards of professional conduct for attorneys appearing and practicing before the Commission in any way in the representation of issuers, including a rule-

(1) requiring an attorney to report evidence of a material violation of securities law or breach of fiduciary duty or similar violation by the company or any agent thereof, to the chief legal counsel or the chief executive officer of the company (or the equivalent thereof); and

(2) if the counsel or officer does not appropriately respond to the evidence (adopting, as necessary, appropriate remedial measures or sanctions with respect to the violation), requiring the attorney to report the evidence to the audit committee of the board of directors of the issuer or to another committee of the board of directors comprised solely of directors not employed directly or indirectly by the issuer, or to the board of directors.

In short, Congress has specifically commanded the SEC to issue a rule requiring attorneys to report straight to the GC or CEO any “evidence” of a securities law violation or breach of fiduciary duty. Moreover, Congress has generally commanded the SEC to issue other unspecified Rules of Professional Responsibility. I will treat the mandatory reporting rule first, then discuss what other rules the SEC may also issue.

Many lawyers will recognize some similarity to New York’s DR 5-109(B), and to ABA Model Rule 1.13(b), on which DR 5-109(B) is based. The heart of DR 5-109(B) provides as follows:

If a lawyer for an organization knows that an officer, employee or other person associated with the organization is engaged in action, intends to act or refuses to act in a matter related to the representation that is a violation of a legal obligation to the organization, or a violation of law that reasonably might be imputed to the organization, and is likely to result in substantial injury to the organization, the lawyer shall proceed as is reasonably necessary in the best interest of the organization…

The new rule mandated by §307 of the Sarbanes-Oxley Act, however, will be dramatically different. The new SEC rule will turn not on whether a lawyer “knows” of a violation, but merely on whether the lawyer has “evidence” of a violation. The new SEC rule is not required to mention the phrase “substantial injury” to the organization, and — most important — the new SEC rule will not use a fuzzy command like “proceed as is reasonably necessary” but rather will mandate a report to either the chief legal officer or the CEO. Those are major changes.

What Is Mandatory Reporting Rule Likely to Say?

If the SEC is faithful to the Congressional mandate, the mandatory reporting rule could look something like this:

(A) In the course of representing a company, an attorney shall report to the company’s chief legal counsel, or to the company’s chief executive officer, or to an equivalent person within the company, within a reasonable time, evidence that the company, or any agent of the company, is engaged in:

(1) a material violation of securities law, or

(2) a breach of fiduciary duty, or

(3) a similar violation.

(B) If the legal counsel or officer responds appropriately within a reasonable time to evidence reported by an attorney pursuant to section (A), the attorney shall have no duty to report the evidence to anyone else.

(C) An appropriate response to the evidence shall consist of measures intended to protect the interests of investors while minimizing disruption to the company, in light of all the circumstances, including (but not limited to) the credibility of the evidence, the seriousness of the possible violation or breach, and the urgency of the situation. Such measures may include, but are not limited to:

(1) ordering an appropriate investigation;

(2) seeking a legal opinion, if there are legal questions regarding whether the evidence indicates a probable violation, breach, or illegal act;

(3) adopting appropriate remedial measures;

(4) imposing appropriate sanctions; and/or

(5) reporting the evidence to:

(a) the audit committee of the issuer ‘s board of directors; or

(b) another committee of the board of directors comprised solely of directors not employed directly or indirectly by the issuer; or

(D) If the legal counsel or officer fails or refuses to respond appropriately within a reasonable time to evidence reported by an attorney pursuant to section (A), then the attorney shall report the evidence to:

(1) the audit committee of the issuer ‘s board of directors; or

(2) another committee of the board of directors comprised solely of directors not employed directly or indirectly by the issuer; or

(3) the board of directors.

If I understand §307, my rendition of the rule of professional responsibility is essentially the rule that §307 envisions. Not surprisingly, this language raises many questions.

What Is ‘Evidence’ of Violation?

The first question is: what is “evidence”? The term “evidence” is not defined in the Definitions section of the New York Code of Professional Responsibility or in the Terminology section (now Rule 1.0) of the ABA Model Rules of Professional Conduct. The word “evidence” is used many times in the Disciplinary Rules of the New York Code of Professional Responsibility, but most of those definitions concern classic courtroom evidence. For example, DR 5-102(A)(2) permits a lawyer to advocate and also testify if “there is no reason to believe that substantial evidence will be offered in opposition to the testimony.” DR 5-103(B) permits a lawyer to advance or guarantee the expenses of litigation, including “costs of obtaining and presenting evidence…” DR 7-102(A)(4) and (6) provide that a lawyer shall not knowingly use “perjured testimony or false evidence,” or “[p]articipate in the creation or preservation of evidence when the lawyer knows or it is obvious that the evidence is false.” DR 7-106(C)(1) provides that a lawyer appearing before a tribunal shall not state or allude to any matter absent a reasonable basis to believe that the matter will be “supported by admissible evidence.” I do not find any of these rules to be helpful in understanding the kinds of evidence a corporate lawyer will be required to report under the SEC’s probable rules.

Other existing rules, however, are helpful. Probably the most closely analogous provision in the New York Code of Professional Responsibility is DR 7-103(B), which provides:

A public prosecutor or other government lawyer in criminal litigation shall make timely disclosure to counsel for the defendant… of the existence of evidence, known to the prosecutor or other government lawyer that tends to negate the guilt of the accused, mitigate the degree of the offense or reduce the punishment.

This rule stems from Brady v. Maryland [373 U.S. 83 (1963)], in which the U.S. Supreme Court held that “the suppression by the prosecution of evidence favorable to an accused upon request violates due process…” However, DR 7-103, like §307’s mandatory reporting rule, requires disclosure without awaiting a request.

Lawyer as Prosecutor

In a sense, corporate lawyers with evidence of improper conduct will be like prosecutors with exculpatory evidence — under the SEC’s probable rules, corporate lawyers will in effect have to indict the company or its agents before a grand jury consisting of the chief legal officer or the CEO by reporting “evidence” that tends to suggest a violation or breach by a company or by any officer, director, or other agent of the company. This duty will be reinforced in New York by DR 7-109(A), which provides: “A lawyer shall not suppress any evidence that the lawyer or the client has a legal obligation to reveal or produce.” When the SEC issues its new rules, a lawyer will have “a legal obligation to reveal” the kinds of “evidence” specified in the rule. Thus, local disciplinary authorities as well as the SEC will have power to discipline lawyers who fail to obey the reporting rule.

The analogy to the Brady rule is far from comforting because prosecutors so often get it wrong, and courts so often disagree about what “evidence” must be disclosed, or when. One example is Mendez v. Artuz [2002 WL 1770537 (2d Cir., 8/1/2002)]. A state court jury had convicted Mendez of attempting to murder Johnny Rodriguez and actually murdering a second individual. Mendez petitioned for habeas corpus relief, arguing that New York State authorities had violated their Brady obligations by failing to disclose material evidence favorable to Mendez — namely, evidence that another individual had placed a contract on Rodriguez’s life before the shooting. The District Court granted the writ of habeas corpus, and the Second Circuit affirmed, holding that the other contract was material evidence that the prosecutor was required to disclose. (State prosecutors aren’t the only ones who have trouble defining Brady obligations — Judge Kearse dissented in the Mendez case, indicating that even appellate judges don’t agree on the meaning and application of Brady.)

Another example of a Brady reversal is United States v. Gil [2002 WL 1565399 (2d Cir., 7/17/2002)]. It was uncontested that the defendant, Gil, had submitted false and inflated invoices to OTB and had received payment, and Gil was convicted. Five months after trial, however, Gil’s lawyers discovered an internal OTB memorandum favorable to Gil. Everyone agreed that the OTB memo had been turned over to the defense before trial, but it had been delivered (together with five reams of other documents) only on the Thursday or Friday before a Monday trial. Gil asked the district court to order a judgment of acquittal or a new trial on grounds that the tardy disclosure had violated Brady, but the district court found that the memo in question (a) had been turned over in a timely fashion, (b) was neither exculpatory nor favorable to the defense, and (c) would not have altered the outcome of the trial. Gil appealed, and the Second Circuit reversed, disagreeing with the district court on all three grounds.

I don’t want to overplay the Brady analogy because prosecutors have a special duty to do justice, not merely to obtain convictions. (The original Brady opinion itself quoted former Solicitor General Simon Sobeloff as saying, “My client’s chief business is not to achieve victory but to establish justice.”) But there are many lessons in the cases that reverse convictions based on Brady violations. One important lesson is to construe broadly the category of “evidence” that must be disclosed. A securities lawyer who fails to disclose facts that turn out to be “evidence” of a securities law violation or breach of fiduciary duty may face harsh sanctions. (The SEC will have to draft sanctions provisions when it drafts the mandatory reporting rule.) Another lesson is that lawyers should disclose such evidence sooner rather than later. The purpose of the mandatory reporting rule is to get the remedial wheels spinning before it’s too late to fix things.

The Brady cases also teach a larger lesson: it will take years to establish the meaning of words like “evidence” and “appropriately respond” in the new SEC rules, and to establish clear standards for determining when that evidence suggests (indicates? proves?) a violation of law or a breach of fiduciary duty by a company or its agents. Brady was decided nearly 40 years ago, in 1963, and has been construed literally thousands of times. According to Westlaw’s KeyCite feature, there are 13,948 “citing references” to Brady, which is almost double the 7,398 references to Marbury v. Madison (1803) and more than triple the 3,891 citing references to Pennoyer v. Neff (1877) — so there’s no shortage of judicial or academic experience with Brady. Yet prosecutors, defense lawyers, district courts, appellate courts, and commentators continue to disagree on the application of Brady to the facts in case after case after case. I doubt that we will do any better nailing down the meaning of the SEC’s forthcoming new mandatory reporting rule.

Lawyer as Judge

The new SEC rule mandated by Congress will command lawyers not only to be prosecutors but also to be judges, determining whether the General Counsel and CEO “appropriately respond” to evidence of internal wrongdoing that the lawyer has reported to them. The lawyer must make this determination, because if the chief legal officer or the CEO does not respond appropriately to the disclosures, then the lawyer must take further steps, climbing the ladder to the audit committee, the independent directors, or the full board. Yet determining an appropriate response will often be difficult and will depend on many factors, such as: the strength of the evidence, whether the wrongdoing is ongoing or completed, the scope and seriousness of the violation, the feasibility of stopping or repairing the wrongdoing, corporate policies concerning alleged internal wrongdoing, the alleged wrongdoer’s record and reputation, the effect of various responses on company morale, and the overall culture of the corporation. Ordinarily, we expect these decisions to be made by corporate managers, not by lawyers.

Yet in an important sense, lawyers have already been thrust into the role of mini-managers. Consider Rule 1.13(b) of the ABA Model Rules of Professional Conduct and its nearly verbatim cousin, EC 5-18 of the New York Code of Professional Responsibility. Both of those rules discuss what a lawyer should do when the lawyer “knows” of the kind of violation or breach addressed in §307:

In determining how to proceed, the lawyer should give due consideration to the seriousness of the violation and its consequences, the scope and nature of the lawyer’s representation, the responsibility in the entity and the apparent motivation of the person involved, the policies of the entity concerning such matters and any other relevant considerations. Any measures taken should be designed to minimize disruption of the entity and the risk of revealing confidences and secrets of the entity. Such measures may include among others: asking reconsideration of the matter, advising that a separate legal opinion on the matter be sought for presentation to appropriate authority in the entity, and referring the matter to higher authority in the entity not involved in the wrongdoing, including, if warranted by the seriousness of the matter, referral to the highest authority that can act in behalf of the entity as determined by applicable law. [New York EC 5-18.]

Thus, lawyers who take their ethical obligations seriously must already weigh complex, multi-factored considerations upon discovering corporate wrongdoing.

What If Board Won’t Respond Appropriately?

One serious gap appears in the Congressional mandate. Section 307 of the Sarbanes-Oxley Act tells a lawyer what to do if the chief legal officer or the CEO does not “appropriately respond” to evidence of internal wrongdoing that the lawyer has reported” — the lawyer must then report the evidence to the audit committee, the independent directors, or the full board of directors. But §307 does not explain what a lawyer ought to do if those high authorities also fail to respond appropriately to the evidence. What must a lawyer do then?

In the 1980 draft of the ABA Model Rules (the earliest draft that was widely circulated), the ABA’s Kutak Commission recommended the following language for Model Rule 1.13(c):

(c) If, despite the lawyer ‘s efforts in accordance with paragraph (b) [the internal disclosure obligation], the highest authority that can act on behalf of the organization insists upon action, or a refusal to act, that is clearly a violation of law and is likely to result in substantial injury to the organization, the lawyer may take further remedial action, including disclosure of client confidences to the extent necessary, if the lawyer reasonably believes such action to be in the best interest of the organization. [Emphasis added.]

But when the ABA finally adopted Rule 1.13 in 1983, the House of Delegates rejected this language and substituted the following paragraph:

(c) If, despite the lawyer ‘s efforts in accordance with paragraph (b), the highest authority that can act on behalf of the organization insists upon action, or a refusal to act, that is clearly a violation of law and is likely to result in substantial injury to the organization, the lawyer may resign… [Emphasis added.]

New York adopted the same “may resign” formulation in 1999, and the ABA Ethics 2000 Commission did not propose any changes to ABA Model Rule 1.13(c) last year. Thus, the SEC has a serious decision to make: should it allow or require a lawyer to disclose “evidence” outside the corporation if the highest authorities within the corporation fail or refuse to take appropriate action.

My advice to the SEC on this point is: Quit while you’re ahead. The rule that Congress has mandated already goes much further than the ethics rules of most states because it requires lawyers to report mere “evidence” of corporate wrongdoing, as opposed to “knowledge” of corporate wrongdoing, which would be a more stringent test and would require far less internal reporting by lawyers. Consequently, the Congressionally mandated internal reporting rule is already bound to chill communications between corporate agents and the corporation’s lawyers. With lawyers acting as beat cops looking for “evidence” of wrongdoing the way traffic cops look for speeders, many corporate officers and employees are going to keep their mouths shut around anyone in a pinstriped suit.

Critics of §307 have already complained that the sky is falling. In 18 ABA/BNA Lawyers Manual Current Reports 457 (July 31, 2002), Joan C. Rogers and Rachel McTague quoted one private securities lawyer: “‘From the point of view of corporate clients’, Keller said, ‘the right to effective representation by counsel is at stake;’” SEC Must Issue Attorney Conduct Rules Under New Federal Accounting Reform Law. See, also, Stephanie Francis Cahill, Corporate-Fraud Law Forces Lawyers To Be Whistle-Blowers — Experts Fear Provision Will Chill Client Communications, 1 ABA J. E-Report No. 29, at 1 (8/2/2002) (quoting Koji F. Fukumura, co-chair of the ABA Litigation Section’s securities committee, as saying that low-level management “will be afraid of seeking advice, because the expectation they will have is the lawyer will immediately turn around and tell the CEO or general counsel.”)

The critics may or may not be right, but no one can dispute one point: For most lawyers, the new SEC mandatory reporting requirement will be a big change. ABA Model Rule 1.13(b) and New York’s DR 5-109(B) are weakly written, and the authorities have seldom enforced them. The new SEC rule is likely to have much more bite, especially in the current “witch hunt” atmosphere where everyone connected with a major corporate fraud, including lawyers, is a potential target. (Ask Vinson & Elkins.) The SEC should see how its new reporting rule works out in practice — together with the tough new regulations in the Sarbanes-Oxley Act governing accounting — before taking the next step and requiring lawyers to report mere “evidence” of corporate wrongdoing to people outside a corporation. If mandatory internal reporting might chill attorney-client communications in the corporate setting, mandatory external reporting might cryogenically freeze them. And when lawyers are cut out of the communications loop, they won’t easily learn any evidence to report. That kind of “big chill” won’t happen in every company, of course — but if it happens in enough companies, it could defeat the whole purpose of the new rule.

What Else Will SEC Rules Contain?

Congress has instructed the SEC to issue not only the mandatory reporting rule but also “rules, in the public interest and for the protection of investors, setting forth minimum standards of professional conduct for attorneys appearing and practicing before the Commission in any way in the representation of issuers…” I have some free advice for the SEC on this subject also: less is more. Be minimalist. Stick with the mandatory reporting rule Congress has forced you to write, and whatever other new rules are necessary to make that one rule work.

For example, the SEC will have to issue a rule explaining who is covered by the new rule. It must define which attorneys are “appearing and practicing before the Commission in any way in the representation of issuers.” It will have to issue a rule defining “evidence,” and a rule (probably as part of the reporting rule) explaining the phrases “appropriately respond” and “similar violation” The SEC will also have to announce appropriate sanctions for violating the mandatory reporting rule, and perhaps address some other gaps and ambiguities in the Congressional mandate. But then the SEC should stop. It took the ABA six years to draft the original ABA Model Rules of Professional Conduct, and it took five years for the Ethics 2000 Commission to review the rules and suggest revisions. The SEC should not overestimate what it can accomplish in 180 days. If it can come up with one good rule on mandatory internal reporting — a rule that lawyers and clients can understand and that regulators and courts will enforce — that will be a major accomplishment.

I should acknowledge that the ABA Presidential Task Force on Corporate Responsibility, appointed in March 2002, recommends a different approach. In a preliminary report issued on July 24, 2002, — almost exactly when Congress passed the Sarbanes-Oxley Act — the Task Force recommends amending Rule 1.13 to require lawyers to disclose outside the corporation in certain circumstances, and recommends amending other ABA Model Rules as well.

Conclusion

The new SEC Rules of Professional Responsibility for Attorneys will be a good start in restoring public confidence in the securities markets and in building up public confidence that lawyers want to stop corporate fraud, not aid and abet it. Lawyers should do their best to obey the new SEC rule by opening their eyes to internal corporate wrongdoing and taking clear evidence of such wrongdoing straight to the top of the legal or executive suites. But the SEC should hit the pause button before issuing a broad set of rules beyond the mandatory reporting rule. Lawyer regulation has historically been the province of the states, and the SEC should focus on issuing and implementing the one rule that Congress has instructed it to issue before going further. It is premature to mandate reporting outside a company until we see what effects the mandatory internal reporting rule has on lawyers, clients, and investors. If we are still experiencing massive corporate fraud in four or five years, we can debate whether mandatory external disclosure rules or other new SEC rules are needed. Until then, lawyers, corporate clients, and the SEC should all do their best to make the new mandatory reporting rule a success for everyone.

Roy Simon is a Professor of Law at Hofstra University School of Law, where he teaches Lawyers’ Ethics and serves as Director of Hofstra Institute for the Study of Legal Ethics. He is also the author of Simon’s New York Code of Professional Responsibility Annotated, which is published annually by West.

DISCLAIMER: This article provides general coverage of its subject area and is presented to the reader for informational purposes only with the understanding that the laws governing legal ethics and professional responsibility are always changing. The information in this article is not a substitute for legal advice and may not be suitable in a particular situation. Consult your attorney for legal advice. New York Legal Ethics Reporter provides this article with the understanding that neither New York Legal Ethics Reporter LLC, nor Frankfurt Kurnit Klein & Selz, nor Hofstra University, nor their representatives, nor any of the authors are engaged herein in rendering legal advice. New York Legal Ethics Reporter LLC, Frankfurt Kurnit Klein & Selz, Hofstra University, their representatives, and the authors shall not be liable for any damages resulting from any error, inaccuracy, or omission.

Fiduciary Duty Professional Responsibility Roy Simon Securities Law