Sarbanes-Oxley DD Checkpoints

Due diligence (DD) on a public-company target or issuer must factor in compliance with the Sarbanes-Oxley Act of 2002 (SOX). The Act's enhanced-financial-disclosure provisions drive three DD checkpoints: the personal-loan prohibition, the accelerated insider-reporting rule, and the internal-control requirement.

Enhanced Financial Disclosures (Overview)

The Sarbanes-Oxley (SOX) enhanced-financial-disclosure provisions expand required public-company disclosures around:

• Off-balance-sheet transactions
• Internal controls over financial reporting
• Insider transactions
• Pro forma reporting

For Series 79 DD purposes, three requirements stand out: the personal-loan prohibition (conflicts of interest), the accelerated insider-transaction reporting rule, and the internal-control requirement.

Personal-Loan Prohibition (Conflicts of Interest)

Sarbanes-Oxley (SOX) prohibits issuers from extending personal loans to directors and executive officers.

• Prohibits an issuer from directly or indirectly extending, maintaining, arranging, or renewing personal loans to directors and executive officers
• Applies to virtually all companies with U.S.-registered securities (including foreign private issuers listed on U.S. exchanges)
• "On market terms" or "below market" does NOT save the loan; the prohibition is on the issuer-to-insider lending relationship itself, not the rate
• Narrow exceptions exist (e.g., consumer-credit-type loans made by an issuer that is in the consumer-credit business, on market terms generally available to the public), but the general rule is a flat ban

DD checkpoint: Review the target's related-party-transaction footnote (in the financial statements) and board minutes for any insider lending. Inspect officer-and-director questionnaires for past or arranged personal loans.

Exam Tip: Gotchas

• The loan prohibition is broader than most people remember. It bans new personal loans by the issuer to directors and executive officers, full stop, with only narrow exceptions.
• "Below-market" or "on market terms" does NOT save the loan; the issue is the company extending personal credit to insiders, not the rate.
• The prohibition runs from the issuer to directors and executive officers. Personal loans between insiders (not from the issuer) are not covered.

Accelerated Insider Reporting (Form 4)

Sarbanes-Oxley (SOX) accelerated the reporting of insider securities transactions under the Exchange Act's insider-reporting regime.

• Form 4 (changes in beneficial ownership) must be filed generally within 2 business days of the transaction
• Replaced the pre-SOX timeline (which allowed reporting on the 10th day of the month following the transaction)
• Affects the same insider universe from Unit 1: officers, directors, and beneficial owners of more than 10% of a registered equity class
• The 2-business-day clock starts on the transaction date, not the settlement date; weekends and federal holidays do not count as business days

DD checkpoint: Pull the target's recent Form 4 activity from EDGAR. Heavy insider selling in the weeks before a deal announcement is a flag; late or missed Form 4 filings are a compliance flag.

Exam Tip: Gotchas

• The Form 4 deadline is 2 BUSINESS DAYS after the transaction, NOT 2 calendar days, and NOT 10 days. Pre-SOX, insiders filed Form 4 by the 10th day of the following month.
• Mixing up the new vs old deadline is a common exam trap. The 10th-day-of-the-following-month timeline is a wrong answer choice you will see.
• The clock starts on the transaction date, not settlement. Don't confuse Form 4 with the longer ownership-filing deadlines covered in Unit 1.

Internal Control Over Financial Reporting (ICFR)

The famous internal control over financial reporting (ICFR) requirement has TWO assertions, and both are required:

• Management's assessment: Management must include in the annual report an internal-control report stating its responsibility for establishing and maintaining ICFR, and containing an assessment of the effectiveness of those controls as of the end of the fiscal year
• Auditor attestation: The registered public accounting firm that audits the financial statements must attest to and report on management's assessment of internal controls (for non-smaller-reporting-company issuers; smaller reporting companies and emerging growth companies are exempt from the auditor-attestation prong)

DD checkpoint: Review the most recent annual report (Form 10-K), the Controls and Procedures section, for:

• Management's conclusion on ICFR effectiveness
• The auditor's attestation report (or note that the company is exempt)
• Any material weaknesses disclosed (a material weakness in ICFR is a flag that financial statements may not be reliable)

Think of it this way: the internal-control requirement makes two people sign off on whether the company can count its own money correctly: management says "our controls work" and the auditor says "we tested management's claim and we agree." A 10-K that includes only management's assessment but not the auditor's report is incomplete unless the company qualifies for the smaller-reporting-company exemption.

Exam Tip: Gotchas

• The internal-control requirement calls for TWO assertions: management's assessment AND the auditor's attestation. A 10-K that includes management's assessment but is silent on the auditor's report is incomplete (absent a smaller-reporting-company exemption).
• A material weakness in ICFR is a red flag in DD. It means the company's controls couldn't be relied on to prevent a material misstatement.
• Smaller reporting companies and emerging growth companies are exempt from the auditor attestation, but management's assessment is still required.

The Three Checkpoints Side-by-Side

Exam Tip: Gotchas

• Think loans, reporting, controls: the personal-loan prohibition, accelerated insider reporting, and the internal-control assessment. Don't confuse which checkpoint covers what.
• All three drop into the DD review of a public-company target. A registration statement for a follow-on offering or an M&A target review must touch each one.