In 621 B.C., the Athenian legislator Draco wrote the first national judicial code. Justice, which had previously been a private matter, for the first time was meted out publicly, through proclamation of the code and public trials. Although this was a significant accomplishment, Draco is remembered instead for the code’s stringent penalties. Athenians claimed he wrote “not with ink but with blood.” In the Fourth Century B.C., the Athenian statesman Solon was tasked with revising the code. And so, in English a “Solon” is a wise lawgiver, while things perceived as exceedingly harsh are referred to as “Draconian.”

To some, the concept of penalties for violations of the federal securities laws is, without reference to amount, “Draconian,” and the practice has been described as criminalizing the federal securities laws. While penalties have been with us at least since Draco, the exacting of penalties as a component of securities law regulation is of more modern vintage. Until 1990, when Congress passed the Remedies Act, the Securities and Exchange Commission lacked explicit authority to obtain civil money penalties in most enforcement cases. That may seem surprising, given the almost routine nature with which monetary penalties now are levied in enforcement cases. The imposition of penalties is a useful punishment and deterrent in the Division of Enforcement program’s arsenal. And, with the enactment of the Fair Funds provision under the Sarbanes-Oxley Act—an idea that originated with the SEC—legislators can sleep better at night knowing that penalties to be imposed will often be returned to wronged investors.

Yet, civil monetary penalties pose a conundrum in enforcement cases when they’re exacted from corporations, because ultimately shareholders are the ones who effectively pay the penalty. Sometimes, that’s the right result because shareholders ought to be treated like the owners they are, passive or not. But, at other times, shareholders are simply the ones left holding the bag, for which they’re penalized repeatedly—by the wrongful conduct itself, the resultant drop in share price when the violation becomes known, and through the cost of governmental investigations, lawsuits and finally civil money penalties.

Cognizant of these concerns and seeking to clarify the way in which corporate penalties are administered, the SEC in late December unanimously issued a policy statement, outlining the framework it intends to use in considering the imposition of penalties on public corporations. The Commission’s analysis is lucid and workable, and promises a measure of predictability for corporations and their counsel as to when penalties are likely to be assessed against corporations. It’s entirely fitting that the SEC issued its statement just as the football season morphs into playoff mode. In playoff games, even more than during the regular season, knowing when penalties are likely to be exacted allows the better teams to avoid giving up valuable yardage because some members of the team simply weren’t properly focused.

Of course, in life as in football, it’s also useful to know the extent of a prospective penalty. The SEC’s release understandably didn’t address the magnitude of any penalties that might be assessed against corporations, but for most public companies, avoiding a massive penalty is definitely something to be preferred, even if some penalty will be assessed. In this month’s column, we discuss how to avoid penalties, and some of the factors that might effect the magnitude of penalties that are assessed, incorporating lessons and recommendations not only from the SEC’s recent statement, but also from the U.S. Sentencing Commission’s Federal Sentencing Guidelines, and the SEC’s 2001 Seaboard release.

A Pound Of Prevention Is Worth A Ton Of Cure. The most effective means of avoiding penalties (indeed, the only certain way to do so) is to avoid violations. That is often easier to say than do, but it remains one of the few absolute truths under the ever-growing complexity of the federal securities laws. As a general proposition, companies need to spend the time and energy to develop and continually refine a successful compliance and regulatory regime. There are three critical facets of such a regime:

Active, Positive And Effective Management Support. Tone at the top determines the success of any compliance program. If senior managers take an active role in ethics and compliance, their strong message will reach every employee, supplier, customer and investor. If companies merely pay lip service to ethics and compliance, that will become glaringly obvious.

AStrong Internal Audit And Compliance Departments. Companies need to commit sufficient resources and executive talent in order to honor their commitment to ethics and compliance. The Commission’s statement on penalties notes that the Remedies Act’s legislative history stresses the importance of good compliance programs and expresses the expectation that penalties would encourage the development of such programs. Forewarned is forearmed.

APeriodic Forensic And Other Self-Evaluative Exercises. Even healthy folks need regular checkups by their physicians, notwithstanding the lack of any obvious symptoms. Far too many companies dread forensic audits or self-reviews because of the implications of such activities, the time required, the expense, and the ultimate fear that something just might be uncovered. An extra set of eyes—independent eyes—can offer a fresh perspective, and can be the predicate for management and board comfort that the reason things seem to be going well is because they in fact are going well.

Corporations Should Promote A Top-To-Bottom Culture That Encourages Ethical Conduct And A Commitment To Compliance. The U.S. Sentencing Commission’s Federal Sentencing Guidelines, revised in 2004, make it smart for corporate officers and directors to exercise due diligence to prevent and detect criminal conduct. Corporations should promote “an organizational culture that encourages ethical conduct and a commitment to compliance with the law.” One of the best approaches for companies that truly want an ethical culture is to articulate ethics as a job responsibility of senior managers, and then to reward managers who actually succeed in producing that result.

Encourage Problems To Be Brought To Management’s And The Board’s Attention. Sometimes, bad things really do happen to good companies. But, that doesn’t mean that companies need to become the victims of lengthy enforcement inquiries or severe corporate penalties. The most important tool in dealing with problems is information. The only way managers and directors can be sure their flow of critical information is sufficient is by encouraging any problem to be brought to their attention before it comes to the attention of regulators, prosecutors, competitors or others who may not always be as sensitive to a company’s plight as might be hoped. This means that companies must devote considerable attention to developing early warning systems that alert them to festering problems at the earliest possible moment. Companies that find problems first, evaluate them and then remediate them are virtual locks to avoid penalties, and perhaps even enforcement action altogether.

Don’t Shoot The Messenger. If a problem is brought to management’s or the board’s attention, it is critical that the parties explore whether the problem is real, and to what extent it occurred. Spending time worrying about the bona fides of the person raising the problem is both a waste of time and energy, and a sure-fire route to places most smart companies don’t wish to go.

If Problems Are Encountered, Don’t Circle the Wagons. When problems are suspected, it’s always better for companies to disclose their existence early and to dictate how they will be disclosed, rather than waiting for regulators, prosecutors, plaintiffs’ lawyers, reporters or others to make disclosure for them. The temptation that must be avoided, however, is to minimize—or even occasionally over-emphasize—the extent of any problems. Very often, companies delay or eschew disclosure because they neither want to deny nor prematurely assume that wrongdoing actually occurred. But when a problem is suspected, and the likely effects of that problem would be material if the problem in fact occurred, disclosure of that precise situation can be made without denying or assuming wrongdoing. The important thing is to get the facts out and emphasize the positive steps the company is taking to deal with the suspected wrongful conduct.

Management And The Board Should Pursue All Remedial Steps From The Moment They Learn Of A Potential Violation. If a company learns of actual or potential problems, the company must spring into action. Very often this means undertaking an immediate internal inquiry. From a regulatory perspective, the best internal investigation is one that does the government’s work for it. This means conducting a swift but thorough investigation and remediating problems or adverse consequences of any misconduct. In essence, if you leave nothing for the government to do, it’s less likely the government will take action or, if action is taken, that any action it takes will have devastating consequences. Before discussing any concerns with regulators, of course, the company must have a well-defined strategy for dealing with the complaint or allegation, and have considered the types of questions regulators are likely to raise when they learn of the concerns.

Regulators, Like Nature, Abhor A Vacuum. Once a problem is suspected, or the company is being investigated, how the company deals with the situation will be critical in the government’s calculus whether, and to what extent, the company will be penalized for any wrongful conduct that actually did occur. Far too many boards believe that these are issues that can be left solely to management or the government. But that’s a sure-fire prescription for disaster. The best way to prevent a problem from becoming a crisis is to ensure that, while the company attempts to learn what actually occurred, there can’t be any repetition of the suspected behavior. In the Salomon Brothers Treasury scandal, rogue trader Paul Mozer was allowed to remain on the trading desk, on the theory that only someone who was crazy would again violate the law; that proved to be a Delphic prophecy. The government is a strong adherent of my mother’s favorite admonition—fool me once, shame on you, fool me twice, shame on me. There really are no excuses for repeat violations once everyone has been alerted to the possibility of wrongdoing.

Make Sure You Know How High Up The Food Chain The Misconduct Traveled. As the Commission’s statement noted, “the more pervasive the participation in the offense by responsible persons within the corporation, the more appropriate is the use of a corporate penalty.” Stated differently: Companies need to understand whether violative conduct was isolated or systemic. If it’s the latter, the wrongdoers must fall on their swords and leave the corporation. The government likes to know, and rightly so, that if something went wrong, the likelihood of its recurrence has been minimized or virtually eliminated.

Self-Police, Self-Report, Remediate And Cooperate. The SEC’s statement regarding financial penalties lists cooperation with the SEC and other law enforcement among the factors the Commission will consider in determining the propriety of a corporate penalty. The SEC’s 21(a) Report and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions released in October 2001 (often referred to as the Seaboard release), sets forth criteria the Commission and its staff will consider in determining whether and how much to credit self-policing, self-reporting, remediation and cooperation. In brief, it requires businesses to be on top of all the issues when misconduct comes to light. The report, which reflects long-standing tenets of the SEC, is likely to be given much more attention and implementation in the newly reconstituted Commission. For additional information on the Seaboard release, see box above, right.

Former NBA guard Rodney Clark “Hot Rod” Hundley, and Minneapolis Lakers teammate Bob Leonard, missed a team plane after repeated warnings for missing team activities after late-night carousing. Hundley and Leonard were promptly called to the owner’s office. Hundley, now the radio voice of the Utah Jazz, went first, and learned he was being fined $1,000—a hefty sum at the time, especially in relation to his $10,000 annual salary. When Hundley left the owner’s office, his teammate Leonard asked him how large the fine was. “A big one, baby, a big bill,” Hundley replied. “One hundred dollars?” Leonard asked. “No, one thousand,” replied Hundley. Leonard’s face fell. “It’s a record,” Hundley said consolingly. Leonard brightened. “Let’s go out and celebrate,” he said.

While the record fines being imposed by the SEC aren’t exactly reason to celebrate, the Commission’s clear articulation of the principles that will guide whether they will be imposed surely is.

Click here for over 20 Harvey Pitt columns exclusively available at Compliance Week, including his thoughts on executive compensation, dealing with employee complaints, the changing face of transparency, guidelines for directors, and more.

This column solely reflects the views of its author, and should not be regarded as legal advice. It is for general information and discussion only, and is not a full analysis of the matters presented.

What did you think of this column? If you'd like to react or respond, we urge you to write a letter to the editor.