17 C.F.R. § 240.13a-15(a) states that certain issuers of securities must maintain “internal control over financial reporting.” The regulation defines “internal control over financial reporting” as a process designed by or under the supervision of the issuer’s principal executive and financial officers and effected by the board of directors and management to provide reasonable assurance of the reliability of financial reporting and statements in accordance with generally accepted accounting principles that:
Pertain to the maintenance of records that accurately and fairly reflect the issuer’s transactions and dispositions of assets;
Provide assurance that transactions are recorded as necessary to permit financial statement preparation in accordance with generally accepted accounting principles and that receipts and expenditures are made in accordance with management and director authorization; and
Provide assurance of prevention and/or timely detection of unauthorized use of the issuer’s assets that could materially affect financial statements.
Id. at § 240.13a-15(f).
When it adopted this regulation, the SEC explained that while broader internal controls over enterprise risk management and corporate governance are important, the regulation focuses on financial reporting, and the definition of internal controls includes that over financial reporting only. See in Re Mgmt.’s Report on Internal Control over Fin. Reporting & Certification of Disclosure in Exch. Act Periodic Reports, Release No. 8238, 80 S.E.C. Docket 1014, 2003 WL 21294970, at *7 (June 5, 2003).
Section 806 of SOX protects employees from retaliation for “provid[ing] information, caus[ing] information to be provided, or otherwise assist[ing] in an investigation regarding any conduct which the employee reasonably believes constitutes a violation of . . . any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders.” 18 U.S.C. § 1514A. It is well established that disclosures about internal control deficiencies are protected under the SOX whistleblower protection law.
In Erhart v. Bofi Holding, the District Court for the Southern District of California explained that the SEC’s internal controls rule requires compliance with applicable laws and regulations directly related to the preparation of financial statements. No. 15-cv-02287-BAS-NLS, at *26 (S.D. Cal. Mar. 31, 2020). The court described that “the rule concerns ensuring ‘the reliability of financial reporting and the preparation of financial statements.’” Id. (citing 17 C.F.R. § 240.13a-15(f)). Further, the court clarified that the internal controls rule does not require compliance with all applicable laws and corporate risk management procedures when those laws and procedures do not concern a company’s financial reporting. The court also cited Section 13(b) of the Securities Exchange Act of 1934, which requires issuers of securities to “devise and maintain a system of internal accounting controls.” Id. (citing 15 U.S.C. § 78m(b)(2)(B)) (internal quotations omitted). Because SEC rules and regulations require internal controls over financial reporting, disclosing a violation of the internal controls requirement may be protected by SOX.
In Thomas v. Tyco International Management Co, the District Court for the Southern District of Florida confirmed that reporting weaknesses in financial controls can be SOX-protected activity. 416 F. Supp. 3d 1340 (S.D. Fla. 2019). The plaintiff was a manager of financial reporting who disclosed concerns about improper segregation of duties in the financial reporting team and problems with a monthly reporting process that could have caused material weaknesses in financial statements. Id. at 1346, 48-49. Although the court ultimately found that the plaintiff’s protected activity was not causally connected to her termination, it also established that reporting failures of internal controls could constitute SOX-protected activity. Id. at 1363. It explained that “[d]ata security, approvals, and segregation of duties are controls that exist to ensure the accuracy of financial reporting” and “[a]n employee’s complaint concerning inadequate internal control over financial reporting can constitute protected activity.” Id. Finally, the plaintiff could have reasonably believed that she was engaging in SOX-protected conduct each time she reported concerns about her employer’s lack of proper internal controls for financial management. Id.
The District Court for the District of Connecticut has also found that reporting weaknesses in internal controls can establish SOX-protected activity. The plaintiff in Wiggins v. ING U.S., Inc. disclosed concerns about inaccuracies in her employer’s market value assessments and stated that she believed these inaccuracies violated securities laws because covered companies must establish internal controls to safeguard accurate financial reporting. 2015 WL 8779559, at *6 (D. Conn. Dec. 15, 2015). The court found that there was sufficient evidence that the plaintiff, who was registered with the Financial Industry Regulatory Association (FINRA) and completed educational and training in federal securities laws reasonably believed her employer violated securities laws when it had weaknesses in internal controls that resulted in inaccurate market value assessments. Id. at *7.
Protections for SEC Whistleblowers
SOX Whistleblower Attorneys
We have assembled a team of leading whistleblower lawyers to provide top-notch representation to Sarbanes-Oxley (SOX) whistleblowers. Recently Washingtonian magazine named two of our attorneys top whistleblower lawyers. U.S. News and Best Lawyers® have named Zuckerman Law a Tier 1 Law Firm in the Washington D.C. metropolitan area.
