As many of you are aware, the President signed the "Sarbanes-Oxley Act of 2002" into law on July 30, 2002 (the "New Law"). The legislation rapidly evolved from a collection of proposals into comprehensive reform legislation in less than one month. The Securities and Exchange Commission (the "SEC") has also begun implementing provisions of the New Law pursuant to its rulemaking authority under the New Law. We have circulated a memorandum outlining the New Law and identified several sections of the New Law that will be the focus of much interpretation during the remainder of 2002 and beyond. We have, and will continue, to circulate memoranda highlighting interpretations of the New Law, including future SEC rulemaking. Once circulated, these memoranda can also be retrieved from our website.

The purpose of this memorandum is to highlight significant issues presented by the certification requirements. In summary there are two sources of the certification requirements:

• Section 302(a) of the New Law required the SEC to adopt a rule which would require a CEO and CFO of any company that files annual or quarterly reports with the SEC to provide certifications in each annual and quarterly report. On August 27, 2002, the SEC adopted such a rule that went into effect on August 29, 2002. The SEC's rule requires CEOs and CFOs to begin providing their Section 302 certifications in quarterly or annual reports, including amendments, filed after August 29, 2002.
• Section 906 of the New Law requires a CEO and CFO of any company that files a periodic report containing financial statements with the SEC to provide certain certifications in such reports beginning July 30, 2002.

We want to highlight a particularly troublesome compliance issue regarding public company CEO and CFO certifications under the New Law. The New Law contains two somewhat inconsistent certification provisions, Sections 906 and 302. Though there are issues open for interpretation with respect to each of the above certification requirements, Section 906 has created the most immediate concern in part because it became effective immediately upon adoption of the New Law and in part because it is somewhat duplicative of the Section 302 certifications. Among the issues raised by Section 906 are that:

• Section 906 does not refer to the Section 302. Although there has been significant discussion since the adoption of the New Law that the Section 906 certification requirement was an unintended "mistake" in the drafting process of the New Law, it is our view that CEOs and CFOs have no choice but to comply with the Section 906 certification requirements until definitive guidance to the contrary is supplied through amending legislation or clarifying statements by the Department of Justice. The SEC has made clear that it will not interpret the substantive or procedural requirements of the Section 906 certification. What this means is that for all quarterly and annual reports filed after August 29, 2002 (including amendments to such reports), a Section 906 certification and Section 302 certification should be included until a company is directed otherwise by counsel.
• Section 906 specifies that a CEO and CFO must certify that "the periodic report containing financial statements fully complies with the requirements of section 13(a) or 15(d) of the Securities Exchange Act of 1934 and that the information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operation of the issuer." There is no explicit mention that the certification be limited to what a CEO or CFO is "aware of." Until Congress or the SEC provides further guidance, we recommend that Section 906 certifications include a "knowledge" qualifier.
• Section 906 does not contain a form of certification. The SEC did adopt a specific form of certification for Section 302. The SEC has publicly stated that Sections 906 and 302 create separate certification requirements, but it did not preclude the possibility that a CEO and CFO could each submit a combined Section 302/906 certification. However, until the SEC and Department of Justice reach a consensus on how the two certification may be combined, we believe CEOs and CFOs should file separate Section 302 and 906 certifications.
• Section 906 certifications must accompany a company's periodic report filed pursuant to Sections 13(a) or 15(d) of the Securities Exchange Act of 1934 (the "Exchange Act") which contains financial statements. The federal securities laws do not define "periodic report." Most practitioners interpret the phrase to mean a company's annual and quarterly reports, not other reports, such as current reports on Form 8-K or Form 6-Ks. However, it is unclear how broad Congress intended the reference to "periodic report" to be. In its adopting release for the Section 302 Certifications, the SEC stated that in its opinion the phrase "periodic report" does not include a current report on a Form 8-K or 6-K; therefore, we do not believe that companies need to submit Section 906 certifications in connection with filings of Forms 8-K or 6-K. We recommend that the Section 302 and 906 certifications are filed with all quarterly and annual reports, including amendments, that are filed with the SEC.
• Section 906 certifications must be provided by a CEO and CFO of any company required to file periodic reports pursuant to the Securities Exchange Act of 1934. Until the Congress or the Department of Justice indicates otherwise, all public companies, including small business issuers and foreign private issuers, are advised to comply.
• Section 906 certifications must accompany a company's periodic report. It is unclear whether Congress intended the certifications to be "filed" as part of a periodic report or submitted along with a periodic report as supplemental materials. Therefore until further guidance is provide, we believe that a CEO and CFO may
  • electronically submit their Section 906 certifications as EDGAR correspondence at the same time that the report is filed;
  • file their Section 906 certifications as part of the report; or
  • file their Section 906 certifications as exhibits to the report.
• The standards of liability under Sections 906 and 302 appear to be inconsistent. Section 906 imposes criminal liability upon CEOs and CFOs who "knowingly" or "willfully" falsely certify. Though criminal liability may be imposed upon a CEO or CFO who "willfully" provides a false certification under existing criminal statutes, there is no statutory basis for criminal liability due to a "knowingly" false certification under Section 302. There is no express criminal penalty for those who refuse to submit a Section 906 certification. While it is unclear whether there will be criminal liability for a CEO or CFO who refuses to file their Section 302 certification, the SEC has the authority under the Exchange Act to bring a legal or administrative action to enforce Section 302. Based on the language of Section 906, it is unclear whether the Department of Justice will take the position that the failure to file a Section 906 certification itself constitutes a criminal offense.

As mentioned earlier, the SEC has indicated that it will not provide any guidance regarding Section 906. Section 906, unlike Section 302, does not amend the Exchange Act. The SEC is given broad interpretive authority under the Exchange Act. Section 906 amends a criminal statute, which the SEC believes it does not have the authority to interpret. In addition, it does not appear that Congress will be considering legislation in the near future which could address the ambiguity created by Section 906. The SEC has indicated that it has discussed the confusion created by Section 906 with the Department of Justice, but it has given no indication of whether the Department of Justice is planning any interpretive guidance. Therefore, prior to filing any report containing financial statements with the SEC, a public company should consult with counsel on whether Section 906 CEO and CFO certifications are still required.