Remediation Center: Recordkeeping Rules

At the request of subscribers, Compliance Week offers a Remediation Center, in which readers can submit questions—anonymously—to securities and accounting experts. Compliance Week's editors will review all questions and then submit them—confidentially, of course—to specialists who can address the issues. The questions and responses will then be reprinted in a future edition of Compliance Week. Below is one of the Q&As; ask your own questions by clicking here.

QUESTION

When a public company divests a business unit that will become a private company, what are the recordkeeping considerations for SOX documentation and testing materials? Must the public seller retain the SOX records unique to the divested operation? Does Article 2-06 of SEC Regulation S-X, which requires accounting firms to retain records for seven years, have any bearing on this (assuming no agreement between the seller and its auditor)?

ANSWER

Section 13(b)(2) of the Securities Exchange Act—which was inserted in 1977 by the Foreign Corrupt Practices Act—requires the preparation and maintenance of books and records in “reasonable detail” that accurately and fairly reflect the transactions and dispositions of assets. This requirement applies to all companies that have securities registered under that Act as well as on all companies required to file reports pursuant to the Exchange Act—that is, public or reporting companies. So in answer to your first question: Yes, the public company seller must retain either the original records or copies of the original records. However, neither the Exchange Act nor SOX specifies a minimum period that this information must be maintained. There are no record retention requirements imposed upon the buyer by the Exchange Act or by SOX, provided that the buyer is not a public company.

Generally, public companies adopt record retention policies that mandate the retention of documentation supporting the companies' public reporting for a period of five to seven years. There are a number of factors that public companies and their advisers take into consideration in determining the length of time that financial records should be maintained. Included among them are:

Section 302(b) of SEC Regulation S-T (relating to electronic filings) imposes a retention period of five years on public companies for all documents executed by a signatory to an electronic filing. This includes public reports and the certifications executed by CEOs and CFOs pursuant to Sections 302 and 906 of SOX.

Section 304(c) of SEC Regulation S-T imposes a retention period of five years on issuers for each document filed with the SEC that omits certain graphic, image, audio or video material included in the document that was publicly distributed.

Instruction 1 to Item 308 of SEC Regulations S-K and S-B instructs public companies to maintain documentation that provides reasonable support for management's assessment of the effectiveness of the public company's internal control over financial reporting required by Section 404 of SOX.

Section 802 of SOX requires accountants to maintain certain corporate audit records or to review work papers following the completion of an audit or review of a company's financial statements. Article 2-06 of SEC Regulation S-X, which was adopted by the SEC to implement the requirements of Section 802 of SOX and to which your question alludes, requires that auditors of public companies retain records relevant to an audit or review of a public company's financial statements for a period of seven years from the time that the audit or review is concluded.

Section 804 of SOX increased the statute of limitations for private securities fraud lawsuits. The statute of limitations was changed to the earlier of two years following discovery of the facts constituting the violation, and five years after the violation. Previously, the time periods had been one and three years, respectively.

Foreign jurisdictions and stock exchanges are adopting mandatory record retention requirements applicable to entities located in or doing business in their jurisdictions or having securities listed on their exchange, which must be assessed in determining the company's record retention needs.

Tax advisers often recommend that financial records be maintained for tax purposes for up to seven years because of relevant tax law statutes of limitations.

The sale of a business unit should not change the public company seller's approach to records retention. Certainly, the public company is exposed to regulatory and civil litigation risk for up to five years and should therefore retain those records for a minimum of 5 years. In addition, since the public company's auditor is required by Article 2-06 of SEC Regulation S-X to retain records relevant to an audit or review of a public company's financial statements for a period of seven years from the time that the audit or review is concluded (these records would arguably be subject to subpoena by a civil litigant or regulatory authority), it seems appropriate that the company's records should be maintained for a corresponding period of time.