The SEC today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy and governance.

The new rules will require registrants to disclose on the new Item 1.05 of Form 8-K (and for foreign private issuers in Form 6-Ks) any cybersecurity incident they determine to be material and to describe the material aspects of the incident's nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant. An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material [note this may be later than the four business days after the incident itself]. The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC of such determination in writing.

The new rules also add Regulation S-K Item 106, which will require registrants to describe their processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents. Item 106 will also require registrants to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats. These disclosures will be required in a registrant's annual report on Form 10-K or 20-F, as applicable.

The Form 10-K and Form 20-F disclosures will be due beginning with annual reports for fiscal years ending on or after December 15, 2023. The Form 8-K and Form 6-K disclosures will be due beginning the later of 90 days after the date of publication in the Federal Register or December 18, 2023. Smaller reporting companies will have an additional 180 days before they must begin providing the Form 8-K disclosure. All registrants must tag disclosures required under the rules in Inline XBRL beginning one year after initial compliance with the related disclosure requirement.

The Securities and Exchange Commission adopted final rules implementing the pay versus performance requirement as required by Congress in the Dodd-Frank Act. The rules will require registrants to disclose, in proxy or information statements in which executive compensation disclosure is required, how executive compensation actually paid by the registrants related to the financial performance of the registrants over the time horizon of the disclosure.

The rules will apply to all reporting companies, except foreign private issuers, registered investment companies, and Emerging Growth Companies. Smaller Reporting Companies (“SRCs”) will be permitted to provide scaled disclosures. Companies must begin to comply with these disclosure requirements in proxy and information statements that are required to include Regulation S-K Item 402 executive compensation disclosure for fiscal years ending on or after December 16, 2022.

New Item 402(v) of Regulation S-K will require registrants to provide a table disclosing specified executive compensation and financial performance measures for the registrant’s five most recently completed fiscal years. Registrants will be required to include in the table, for the principal executive officer (“PEO”) and, as an average, for the other named executive officers (“NEOs”), the Summary Compensation Table measure of total compensation and a measure reflecting “executive compensation actually paid,” calculated as prescribed by the rule. The financial performance measures to be included in the table are: (1) Total shareholder return (“TSR”) for the registrant; (2) TSR for the registrant’s peer group; (3) The registrant’s net income; and (4) A financial performance measure chosen by the registrant and specific to the registrant (the “Company-Selected Measure”) that, in the registrant’s assessment, represents the most important financial performance measure the registrant uses to link compensation actually paid to the registrant’s NEOs to company performance for the most recently completed fiscal year. New Item 402(v) also will require a registrant to provide a clear description of the relationships between each of the financial performance measures included in the table and the executive compensation actually paid to its PEO and, on average, to its other NEOs over the registrant’s five most recently completed fiscal years. The registrant will be required to also include a description of the relationship between the registrant’s TSR and its peer group TSR. A registrant will also be required to provide a list of three to seven financial performance measures that the registrant determines are its most important measures (using the same approach as taken for the Company-Selected Measure). Registrants are permitted, but not required, to include non-financial measures in the list if they considered such measures to be among their three to seven “most important” measures. Registrants will be required to use Inline XBRL to tag their pay versus performance disclosure.

Registrants, other than SRCs, will be required to provide the information for three years in the first proxy or information statement in which they provide the disclosure, adding another year of disclosure in each of the two subsequent annual proxy filings that require this disclosure. SRCs will initially be required to provide the information for two years, adding an additional year of disclosure in the subsequent annual proxy or information statement that requires this disclosure. In addition, an SRC will only be required to provide the required Inline XBRL data beginning in the third filing in which it provides pay versus performance disclosure, instead of the first.

The SEC’s EDGAR system will be closed on Tuesday, December 24, 2019, and Wednesday, December 25, 2019, due to the closure of the federal government on those two days. As a result, on December 24 and 25, 2019:

• Filings will not be accepted in EDGAR.
• EDGAR filing websites will not be operational.
• The Filer Support Call Center will not be open. 

Any filings required to be made no later than December 24 or December 25, 2019 will be considered timely if filed on or before December 26, 2019, the next business day.

The SEC today voted to propose amendments to the definitions of "accelerated filer" and "large accelerated filer," which are used to determine, among other things, the filing deadlines for periodic reports and the requirement for providing an audit of internal control over financial reporting (ICFR). 

The proposed amendments would better align the definition of accelerated filer with recent changes to the definition of "smaller reporting company" (SRC). The amendments would:

• Exclude from the accelerated and large accelerated filer definitions an issuer that is eligible to be an SRC and had no revenues or annual revenues of less than $100 million in the most recent fiscal year for which audited financial statements are available
• Increase the transition thresholds for accelerated and large accelerated filers becoming a non-accelerated filer from $50 million to $60 million and for exiting large accelerated filer status from $500 million to $560 million
• Add a revenue test to the transition thresholds for exiting both accelerated and large accelerated filer status

As a result of the proposed amendments, smaller reporting companies with less than $100 million in revenues would not be required to obtain an attestation of their ICFR from an independent outside auditor. 

The proposals will be subject to a 60-day public comment period, following which the SEC will determined its next steps.

Today the SEC adopted amendments to eXtensible Business Reporting Language (XBRL) requirements for operating companies and funds. The amendments are intended to improve the quality and accessibility of XBRL data by replacing the existing requirements for tagged data to be filed as exhibits to certain SEC filings and posted as separate files on companies’ websites. The amendments, which will go into effect in phases, require the use of Inline XBRL for financial statement information and risk/return summaries.    

While the amendments modify existing XBRL requirements, they do not change the categories of filers or scope of disclosures subject to XBRL requirements, nor do they change the relevant liability standards.

Operating companies that are currently required to submit financial statement information in XBRL will be required, on a phased basis, to transition to Inline XBRL, with large accelerated filers that use U.S. GAAP being required to comply beginning with fiscal periods ending on or after June 15, 2019, accelerated filers that use U.S. GAAP being required to comply beginning with fiscal periods ending on or after June 15, 2020, and all other filers being required to comply beginning with fiscal periods ending on or after June 15, 2021. Filers will be required to comply beginning with their first Form 10-Q (not 10-K) filed for a fiscal period ending on or after the applicable compliance date.

Funds that are currently required to submit risk/return summary information in XBRL will be required, on a phased basis, to transition to Inline XBRL, with large fund groups (net assets of $1 billion or more as of the end of their most recent fiscal year) being required to comply two years after the effective date of the amendments and all other funds being required to comply three years after the effective date of the amendments. The amendments also eliminate the 15 business day filing period for risk/return summary XBRL data, so that the data will be more timely available to the public.

The SEC posted today an interpretive release regarding its latest guidance public companies’ disclosure obligations under existing law with respect to matters involving cybersecurity risk and incidents. It also addresses the importance of cybersecurity policies and procedures and the application of disclosure controls and procedures, insider trading prohibitions, and Regulation FD and selective disclosure prohibitions in the cybersecurity context.

The timing of the release was a bit unusual. Initially, the SEC was scheduled to consider the guidance at an open meeting on February 21^st. It abruptly cancelled the meeting and instead put out a press release saying the interpretive guidance had been approved on February 20^th. Sounds like the SEC may be having its own issues with disclosure controls and procedures!

The SEC has approved a NYSE rule that will prohibit listed companies from issuing material news after the official closing time of trading until at least 5 minutes after closing (unless the company’s official closing price is published sooner).

As of July 10^th, the SEC’s Division of Corporation Finance will permit all companies to submit draft registration statements relating to initial public offerings for review on a non-public basis. Previously, this process was only available for “emerging growth companies” under the JOBS Act, although that covered a substantial majority of IPO candidates. 

More notably, this process will now be available for most offerings made in the first year after a company has entered the public reporting system. 

More information can be found at:  https://www.sec.gov/corpfin/announcement/draft-registration-statement-processing-procedures-expanded

The Public Company Accounting Oversight Board has approved a new standard (though still subject to SEC approval) designed to enhance the relevance and usefulness of the Auditor's Report with additional information for investors.

The new standard and related amendments require auditors to include in the auditor's report a discussion of the critical audit matters (CAMs), which are matters that have been communicated to the audit committee, are related to accounts or disclosures that are material to the financial statements, and involved especially challenging, subjective, or complex auditor judgment. Under the new standard, the auditor's report will disclose, among other things, the tenure of an auditor, specifically, the year in which the auditor began serving consecutively as the company's auditor. It also will include the phrase, "whether due to error or fraud," in describing the auditor's responsibility under PCAOB standards to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatements.

If approved by the SEC, the new auditor's report format, tenure, and other information would be effective for audits for fiscal years ending on or after December 15, 2017. The communication of CAMs for audits of large accelerated filers would be effective for audits for fiscal years ending on or after June 30, 2019 and the communication of CAMs for audits of all other companies would be effective for audits for fiscal years ending on or after December 15, 2020.

Communication of CAMs is not required for audits of emerging growth companies, brokers and dealers, investment companies other than business development companies, and employee stock purchase, savings and similar plans.

A fact sheet on the new rules also is available: https://pcaobus.org/News/Releases/Pages/fact-sheet-auditors-report-standard-adoption-6-1-17.aspx