Speech by SEC Staff:
Remarks at the Vanderbilt Directors College

by

Alan L. Beller

Director, Division of Corporation Finance
U.S. Securities and Exchange Commission

Nashville, Tennessee
June 10, 2003

Thank you for that kind introduction. It's a great honor to have been asked to address this audience today, at Vanderbilt University, at a conference with world class attendees and world class sponsorship, and on a subject-corporate governance — with such importance to our nation's present and future. At this point I should provide the standard Commission disclaimer — my remarks this afternoon represent my own views and not necessarily those of the Commission or any other member of the staff.

The importance of directors in setting the standards for and being the exemplars of good corporate governance is one of the keys to bringing American corporations and our capital markets to the position we want. I'm referring to a position where honest and ethical behavior is both the norm and the perceived norm. Where honest business is free to operate. That includes freedom to take honest business risks. But that involves having confidence that a company's activities are what they seem. We need to get past the situation where, in too many cases, there is suspicion either that the risks for which rewards are sought are not risks at all but part of a rigged game, where accounting gimmicks will guarantee results, or that the risks are not honest business risks but involve improper use of corporate assets, inappropriate conflicts of interest or self-dealing or fraud.

The people for whom this conference was designed and who are in this room face a large part of the challenge, but also have much of the opportunity, in leading us to this position. That's because one of the important results of all of the reforms of the last year — Sarbanes-Oxley, the pending strengthened New York Stock Exchange and Nasdaq listing standards, the standards being enunciated at the SEC and in courts of law and courts of public opinion — is clearly to shift control of the machinery of corporate governance away from CEOs and other members of management and to boards of directors.

As to increased challenges, Delaware Supreme Court Chief Justice Norman Vesey, in remarks just a week ago to a group of directors in California, described them in terms not of changes in the required fiduciary duties of directors, but of evolving heightened standards of behavior expected of directors in carrying out their duties. He was speaking of standards of behavior of directors in carrying out their duties under state law, but the same concept also underlies the Sarbanes-Oxley Act, the SEC's new rules and the pending listing standards.

How should directors go about assuring that their companies and their own behavior meet these standards? I would not start by asking, "How do we comply with the new rules?" Rather, I would suggest you ask, "What is the right thing for the company and me to do? What are the best practices we should be striving to embrace?" Following the letter of the rules is necessary but not sufficient. And focusing on following the letter of the rules detracts attention from more important objectives. Good corporate governance is not primarily about complying with rules. It is about inculcating in a company, and all of its directors, officers and employees, a mindset to do the right thing. SEC Chairman William Donaldson has a great metaphor for the goal we are seeking — to have the focus on doing the right thing become part of the DNA of a company and everyone in the company from top to bottom. One of the reasons that the DNA metaphor is such a good one is that it embodies the concept that model corporate behavior gets passed on from one corporate generation to the next.

As for the opportunity, boards of directors and especially independent directors will now have more involvement and more say about corporate governance issues. That includes, in particular, questions of strategic importance — issues about the structure and membership of boards, separation of CEO and Chairman functions, establishment and functioning of a "lead director" structure, strategic questions regarding disclosure policy and company processes, questions about adding and creating value in what is clearly a new environment. None of these questions have "bright line" or "one size fits all" answers, and that is of course one of the things that makes them both challenging and interesting.

You might be thinking that all this general talk about challenges and opportunities is not very helpful without more detailed guidance and suggestions. That is a fair point, and so I would like to take my remaining time to talk more specifically about some aspects of directors' roles in corporate governance. Any situation that a director finds himself or herself in will require consideration of particular facts, and the precise answers will depend on an analysis of those facts. That's one reason companies (and sometimes boards) have internal and external advisers. But I believe that what follows will be specific enough to be helpful.

The first steps to being a successful director, both from the legal and substantive point of view are to manage conflicts and to devote the time and effort to do the job well.

Don't cut corners on conflicts and independence. Whether directors have fulfilled their responsibilities may in at least some cases be assessed under a different, and more demanding, standard if they are found to have a conflict or not to be independent. So there is nothing to be gained in pushing the envelope on independence or conflicts. You should make sure you consider this in two different circumstances. First, when you are asked to be a director, you should be satisfied not only that you meet any rules or standards that apply regarding independence and conflicts but also that you are in your own mind independent. This is a very personal way of applying best practices rather than just a compliance mentality. Second, when you are serving on a board, and especially on a nominating committee, you should be applying the same standards in deciding whether a potential board candidate is independent and any conflicts are manageable.

Devote the necessary time and prepare. An easy one. With increased duties and heightened expectations, you should make sure you have the time to be a director, and especially an audit committee member. You have to consider your other responsibilities and then decide whether you can take on the position. And the number of directors' posts you can responsibly (both to yourself and to the company) accept is now limited.

Putting in the time also means doing the work and the necessary preparation. It may sound too obvious to say, but read the disclosure documents and the other materials supplied by the company in preparation for meetings. You should also insist that the materials be provided by the company in time. Board packages, except for unavoidable last minute developments, shouldn't be provided 24 or 48 hours before the meeting anymore.

Don't lose sight of the Director's strategic role. Your role as a director is to focus on strategy and oversight, not the details of operations and implementation. And this goes for compliance with Sarbanes-Oxley as it does for everything else. Directors have plenty to do in the new environment even if they stick to strategy and oversight.

What do I mean by focusing on strategy and oversight? Let me take the new world of Sarbanes-Oxley in two areas — financial reporting and company processes — as examples.

Apply a strategic focus to the improvement of financial reporting. After restoring confidence in and improving regulation of the accounting profession, I believe that improving financial reporting and confidence in the numbers is the principal objective of the Sarbanes-Oxley Act. But as a director the first question I would ask (and by now you should have guessed this) is not, "How do I comply with the Act?" Rather, it is, "How do we present ourselves to investors and to the world?" Then I would focus on how to use best practices to improve that presentation so that it is as good as it can be — so that it would tell me, in understandable terms, what I would want to know about the company as an investor. And that obviously means the warts and the blemishes, as well as the beauty marks. And it doesn't mean coming up with financial measures or other disclosure that makes the company look better than it is.

I would start with the obvious — read the financial statements and the other financial disclosure, especially Management's Discussion and Analysis. Is it clear and understandable (and incidentally I am talking about being understandable to a reasonably sophisticated investor or analyst)? Does it need an introduction or some other general explanation of the company's business model, the economic and financial environment, and the risks that the company faces? Does it need a roadmap to make the detailed disclosure easier to follow? Is it just a regurgitation of numbers from the financial statements that don't tell you much? And, of course, is the detailed disclosure complete and correct and as clear as it can be? In considering the company's financial reporting in this way you will be accomplishing two objectives. First, you will be performing your own necessary review of the disclosure and asking questions where you do not understand or are not comfortable with it. Second, you will be standing in for investors in improving the disclosure.

A strategic focus calls for understanding some key elements of financial reporting. These can obviously differ by company — in an oil and gas company issues around measuring reserves are critical; in a financial institution issues around measuring and accruing for losses are critical. But some of the questions I would suggest you would generally ask include:

• Does the disclosure accurately reflect management's view of the company? Is it consistent with what you understand about the company's real business situation?
   
• What is the company's cash flow and liquidity position? What does management expect going forward? What are the disparities between earnings and cash flows from operations and what are the reasons for the disparities?
   
• What choices, if any, about accounting policies and accounting estimates and judgments are the most difficult and have the largest impact on results?
   
• What are the most difficult questions that management, the outside auditors and the lawyers have addressed in preparing and auditing the financial statements and in preparing the other disclosure?
   
• What important aspects of financial performance and condition are not adequately explained in the financial statements?
   
• Does the company's accounting rank as aggressive or conservative or somewhere in between, and why? This requires candid discussions with the auditors.

There's another question you should pursue in thinking strategically. How do others view the company? If a company is followed by analysts, you should see the analysts' reports. Are there credit analysts out there that have views, especially negative views, about the company? Are there short sellers with a view on the company? The IR department will know and so should you. What's being said about the company in internet chat rooms? The IR department will know that as well, and while some of it may be scurrilous, some of it may be useful for you to hear about. So ask for it. And then evaluate the company's financial reporting against the backdrop of what others are focusing on.

Very importantly, you also of course have to address compliance with Sarbanes-Oxley. Do the financial reporting and other disclosure comply with both old and new requirements? If you have taken an approach similar to the one I describe above, then the board's role will be to follow best practices to ensure good financial disclosure and not just compliance. In that case, the disclosure should be complete and correct, clear and understandable, and many if not most of the hard questions about compliance in this area will already be dealt with. But directors must perform this oversight role, engage in an adequate review process and satisfy themselves that the company and management have taken sufficient steps to ensure compliance.

Oversee processes, especially internal controls. Some have decried the focus of Sarbanes-Oxley on processes, saying that it will require officers and employees and, yes, even directors, to become nothing more than box checkers. I have a different view. I believe that good processes and procedures matter. They make it easier for companies to comply with complex requirements and to produce good numbers and make good and timely disclosure. Of all the recent reforms, the requirement for CEO and CFO certifications and the processes that have been developed by management and companies to support those certifications have had the largest impact to date in improving financial reporting and other disclosure.

No steps will eliminate wrongdoing or ensure its detection. But good processes do make wrongdoing more difficult because they increase the chances that it will be uncovered. They also therefore provide some deterrent against people trying in the first place. Finally, attention to good processes will result in a check-the-box approach only if a company and its directors and officers embrace a check-the-box mentality.

The securities laws require internal controls and disclosure controls and procedures. Companies have other important processes as well. In ordinary circumstances boards do not implement or get involved in the operational detail of processes. But it is an important part of the board of directors' responsibility to provide oversight of these processes. From a strategic perspective, a board should be ensuring that processes operate to add value — for example, to improve a company's operations and to provide reasonable assurances that a company has accurate and reliable internal and external reporting. As part of fulfilling their responsibilities a board should satisfy itself as to the answers to a number of questions about process. The following are among those I believe would often be important:

• What processes are in place and what are they intended to achieve?
   
• Have they been reviewed carefully by management, with the assistance of inside and outside lawyers and internal and external auditors, for both effectiveness and compliance with applicable requirements? Again, as with disclosure, the directors have to engage in an adequate review process and satisfy themselves that the company and management have taken sufficient steps to ensure effective controls.
   
• Do the processes make sense for the company? and
   
• Are the design and operation of the company's processes being properly monitored and are any deficiencies being promptly addressed and disclosed as necessary?

I'd like to close with just a few comments about the Commission's most recent rules under Sarbanes-Oxley, which address processes, specifically internal control over financial reporting. They require a management assessment of the effectiveness of internal control over financial reporting and the attestation of the external auditors as to that assessment. The rules were adopted on May 27 and were posted on our web site at the end of last week.

Many of the Commission's other rules under Sarbanes-Oxley have provoked more comment and gotten more attention. I would submit that no rules are more important and deserving of the attention of companies, their managers and their directors than these new rules regarding internal control over financial reporting. They will require a significantly greater commitment of time and resources, including money, than the other Sarbanes-Oxley rules. They will require companies to evaluate their internal control structures in a more thorough-going manner. And they will require new interactions between a company and its external auditors.

The Commission determined that the implementation of these rules was a sufficiently complex and time-consuming matter that an extension of time before compliance is required is appropriate. As a result, U.S. companies that have filed one annual report with the Commission and have more than $75 million of market capitalization must comply for fiscal years ending after June 15, 2004. Compliance is required for other companies for fiscal years ending after April 15, 2005. This will give companies and auditors more time to establish the processes necessary, to design and test systems, and to provide the necessary training. It will also give the new Public Company Accounting Oversight Board time to consider and implement applicable attestation standards.

My principal reason in mentioning this today is to caution companies, officers and directors that, even though the Commission has given necessary extra time, you should already be working to prepare to meet these new requirements. Based on what we have seen and heard, companies will need the extra time and should already be committing the resources that compliance will require.

With that I will conclude. I want to thank you again for giving me the opportunity to be with you this afternoon. I would be pleased to take a few questions if time permits.

http://www.sec.gov/news/speech/spch061003alb.htm