SOX Requirements
SOX Investigation Requirements and Considerations
According to Section 301 of the Sarbanes-Oxley Act, public companies must establish an independent audit committee which shall implement procedures for (a) the receipt, retention and treatment of complaints received about accounting, internal accounting controls or auditing matters, and (b) the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters. The audit committee must be allowed to hire outside counsel and other advisors to investigate the whistleblower complaint if it decides it is appropriate.
Not every report will require a full-blown internal investigation, however, determining how far to go with an investigation is may well be the most challenging task for the Audit Committee.
One major benefit to the Company may be its perception with the SEC, which indicated in 2001 that it will consider several criteria when evaluating a company’s response to alleged fraud: 1) whether the company thoroughly reviewed the conduct’s scope, origins, and consequences; 2) whether outside directors conducted the review; 3) whether outside counsel was engaged; and whether that counsel had previously worked for the company.
One concern for multi-national companies should be how to reconcile the requirement so Section 301 with the Whistleblower Guidelines and requirements of other countries and the European Union, which has enacted its own guidelines for the investigation and treatment of Whistleblower claims.
The Audit Committee should consider:
1) Who should conduct the investigation - this may be decided by the nature of the complaint and who is involved. If upper management is allegedly involved, the retention of outside counsel to investigate is highly recommended.
2) How should you assemble a committee of Independent Directors;
3) How do you maintain the committee’s independence? and
4) How do I preserve the confidentiality and privileges of the committee?