Ignore Sarbanes-Oxley at Your Peril

Whether you are an individual or entity, public or private, SOX criminal penalties may apply for destroying electronic evidence

Years after passage of the Sarbanes-Oxley Act of 2002, many companies still believe the act applies uniquely to public companies. In fact, private companies that ignore the act's obstruction-of-justice provisions do so at their peril. Two increasingly important provisions of Sarbanes-Oxley were set forth in §§ 802 and 1102 and codified, respectively, at 18 U.S.C. 1519 and 18 U.S.C. 1512(c). These provisions impose substantial criminal penalties on any individual or entity -- public or private -- for destruction of evidence or obstruction of justice regarding any actual or "contemplated" federal investigation, matter or official proceeding. A company therefore potentially could violate the law before an actual official governmental interest arises.

Thus, it is critical for every entity to ensure that its records-retention policy includes appropriate triggers -- called "litigation holds" -- to suspend the routine deletion of information for situations contemplated by §§ 802 and 1102. There is, however, an elephant in the room -- a "compliance gap" challenge that is of particular concern not only to quasi-governmental organizations but also to companies in heavily regulated industries facing routine government scrutiny. Those companies could find that an overbroad policy theoretically encompasses nearly all of their day-to-day work. Accordingly, those companies, even more than most, must balance the need for a practical records-retention policy with the need to comply with Sarbanes-Oxley's mandates.

This compliance conundrum evokes Scylla and Charybdis from Homer's "Odyssey." The late rocker Warren Zevon channeled Homer in his song, "Lawyers, Guns and Money": "I'm the innocent bystander, and somehow I got stuck between a rock and a hard place, and I'm down on my luck." The rock-hard place challenge of Sarbanes-Oxley compliance is the tension entailed in setting retention language that is broad enough to include a reasonably anticipated government interest, proceeding or regulatory inquiry contemplated by Sarbanes-Oxley, but not so broad that, when viewed in hindsight by a judge, even routine governmental oversight is deemed to have necessitated a litigation hold.

Neither the statutory language nor the scant case law provides much guidance on when a company must impose a litigation hold under §§ 802 and 1102. However, several principles may help any company devise a retention regime not only cognizant of business realities but also compliant with the act's obligations.

Sections 802 and 1102 were enacted, in part, in response to Arthur Andersen's shredding of documents during the government's investigation into Enron Corp. Arthur Andersen LLP v. U.S., 544 U.S. 696 (2005) ("jury instructions ... failed to convey the requisite consciousness of wrongdoing"). Cf. U.S. v. Quattrone, 441 F.3d 153 (2d Cir. 2006) (jury not told of defendant's lack of knowledge of investigation's specific focus). In both Andersen and Quattrone, a conviction for inciting destruction was overturned based on a jury instruction's omission of the appropriate mens rea.

Post Sarbanes Oxley, however, federal prosecutors have more arrows in their obstruction and tampering quivers. Mirroring the act's concerns, the Dec. 1, 2006, amendments to the Federal Rules of Civil Procedure focus on retention and production of electronically stored information.
In addition, courts, government regulators, public auditors and the plaintiffs' bar are becoming increasingly sophisticated as to electronic discovery issues such as metadata, keyword searching and forensic imaging. In turn, the demands have intensified for greater transparency in companies' policies and practices.

A well-crafted policy -- with which a company substantially complies and enforces as uniformly as possible -- can protect against allegations of improper spoliation. However, an overbroad and/or haphazardly applied policy can have the opposite effect. For example, a gap between the general protocol and the specific actions taken can become grist for a litigation adversary or prosecutor to undermine -- or even obtain judicial invalidation of -- the preservation steps taken. Policies must be sufficiently narrow so that companies can, as a practical matter, comply, but broad enough to satisfy the legal requirements of §§ 802 and 1102.

To Continue Reading: Click Here
------------------------------------------
Source: Law.com
By Robert D. Brownstone, Catherine Kevane and J. Carlos Orellana