On October 22, 2024, the SEC announced settled enforcement actions against four companies focused on disclosures about cybersecurity risks and actual cybersecurity intrusions.  The four companies were Avaya Holdings Corp., Check Point Software Technologies Ltd, Mimecast Limited, and Unisys Corp.  All four of the cases have their roots in the SolarWind’s Orion software cybersecurity hack.

According to the SEC all four of the companies downplayed the impact of cybersecurity events.  In the SEC’s Press Release Jorge G. Tenreiro, Acting Chief of the Crypto Assets and Cyber Unit, stated, “In two of these cases, the relevant cybersecurity risk factors were framed hypothetically or generically when the companies knew the warned of risks had already materialized.”  This is a recurring issue in cybersecurity cases and SEC comments.  In another of the cases the company described a breach as having involved access to a limited number of email messages when in fact the company knew that 145 files, some of which involved sensitive company information, had been breached.  The Unisys Corp. case also focused on deficient disclosure controls and procedures.

You can read more details about each case and find links to each Order in the SEC’s Press Release.

All the companies entered into cease-and-desist orders and paid fines ranging from $990,000 to $4 million.

As always, your thoughts and comments are welcome!

On September 10, 2024, the SEC announced a settled enforcement action against Keurig Dr Pepper, Inc. related to statements the company made in its 2019 and 2020 Form 10-Ks about the recyclability of its K-Cup coffee and tea pods.  In Item 1 of the company’s Form 10-K for the year ended December 31, 2020, the company said:

“In December 2020, we achieved our goal of making all K-Cup pods sold in the U.S. recyclable by the end of 2020, having converted all K-Cup pods sold in Canada to a recyclable format in 2018. The new pods are made of polypropylene #5 plastic, a material that is accepted curbside for recycling by many communities, and we have conducted extensive testing with municipal recycling facilities to validate that they can be effectively recycled. We continue to engage with municipalities and recycling facilities to advance the quantity and quality of recycled polypropylene and have committed $10 million toward the advancement of polypropylene recycling in the U.S. through the Polypropylene Recycling Coalition, an effort led by The Recycling Partnership and funded by leading brands, recyclers, converters and producers of polypropylene.”

According to the SEC’s Order what the company did not disclose in the 2019 and 2020 annual reports was that two large recycling companies “provided negative feedback concerning the commercial feasibility of curbside recycling of pods” and indicated that “they did not presently intend to accept pods for recycling.”

Without admitting or denying the findings Keurig Dr Pepper entered into a cease-and-desist order and paid a civil money penalty of $1,500,000.

An interesting aspect of this case is that it was brought under Section 13(a) of the 1934 Act and related Exchange Act Rule 13a-1, which relate to complete and accurate annual reports.

As always, your thoughts and comments are welcome.

Several years ago, on May 3, 2021, the SEC announced a settled enforcement action against Under Armour, Inc.  The starting point for this case was a 23% stock price drop when Under Armour disclosed that their revenue growth rate, historically over 20%, had fallen to 12% for the fourth quarter of 2016.  According to the SEC’s Accounting and Auditing Enforcement Release, the company used sales “pull forwards” to hide this slowing revenue growth rate from mid-2015 to the end of 2016.  The company paid a $9 million civil penalty and entered into a cease-and-desist order.

In this kind of case the SEC’s enforcement is usually only part of the story.  In a Form 8-K filed on June 20, 2024, more than three years after the SEC action, the company reported a settlement in related class action litigation:

Item 8.01. Other Events.

As previously disclosed, since early 2017 Under Armour, Inc. (the “Company”) has been engaged in securities class action litigation in the United States District Court for the District of Maryland (the “District Court”) under the caption In re Under Armour Securities Litigation, Case No. 17-cv-00388-RDB (the “Consolidated Securities Action”). The complaint asserted claims regarding the Company’s disclosures and accounting practices in connection with its sales between the third quarter of 2015 and the fourth quarter of 2016, specifically asserting claims under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), against the Company and Mr. Plank and under Section 20A of the Exchange Act against Mr. Plank.

On June 20, 2024, the Company and Mr. Plank entered into a Memorandum of Understanding (the “MOU”) with plaintiffs containing the material terms of a settlement resolving the Consolidated Securities Action. The parties intend to prepare a formal stipulation of settlement describing the terms of the proposed settlement, which will be presented to the District Court for preliminary approval in the coming weeks. Following preliminary approval of the proposed settlement by the District Court and a notice and review period for Class members, plaintiffs will seek final approval of the proposed settlement from the District Court. The settlement is not an admission of fault or wrongdoing by the Company or Mr. Plank.

The MOU provides that the Company will pay or will cause to be paid an amount equal to $434 million to the members of the class in the Consolidated Securities Action, which includes all persons and entities who purchased or otherwise acquired Class A and Class C common stock of Under Armour between September 16, 2015 and November 1, 2019(subject to certain exclusions) (the “Class”). As of March 31, 2024, the Company reported $858.7 million of cash and cash equivalents on its consolidated balance sheets, and no drawings on its $1.1 billion revolving credit facility.

As always, your thoughts and comments are welcome!

In this blog post we explored the almost two-year time lag between an SEC enforcement against a company and a related enforcement against the company’s auditor.  In a pair of more recent cases this time lag is much shorter.  In this August 15, 2023, Accounting and Auditing Enforcement Release, the SEC enumerates a number of material misstatements in the financial statements of Ault Alliance, Inc. (Ault). Issues involved included failure to disclose interests in related person transactions, improper recording of purported consulting services and erroneous accounting for investments.  Ault made multiple restatements.  The Release also asserts that Ault failed to maintain accounting and disclosure controls.

On January 18, 2024, only five months later, the SEC brought an Administrative Proceeding against the company’s auditor.  The case against the auditor is complex, involving Ault and several other engagements.  In addition, it is interesting that this action was brought using the SEC’s internal administrative court processes.  Even with these complexities, the time lag between the company enforcement and the administrative proceeding against the auditor is notably shorter.

As always, your thoughts and comments are welcome!

On May 3, 2024, the SEC announced charges against a Colorado audit firm, BF Borgers CPA PC and its owner, Benjamin F. Borgers.  The SEC’s Accounting and Auditing Enforcement Release’s extensive charges include:

“…the deliberate and systematic failure to audit and review public company and SEC-registered broker-dealer clients’ financial statements in accordance with Public Company Accounting Oversight Board (“PCAOB”) standards … and their fraudulent issuance of audit reports falsely representing that they had done so from at least January 2021 through at least June 2023.”

These failures affected over 350 clients and more than 1,500 SEC filings.

The firm and its owner will pay civil money penalties of $12 million and $2 million respectively.  They are also denied the privilege of appearing or practicing before the Commission and censured.

This case is eerily similar to a 2009 case against Moore & Associates Chartered and Michael J. Moore.  That case involved over 300 clients and also resulted in fines and bars.  (Mr. Moore’s violations actually continued, as you can read in this 2015 Litigation Release.)

Both these cases were brought by the SEC rather than the PCAOB, perhaps because of the structure of the PCAOB’s enforcement activities imposed by the Sarbanes Oxley Act.  Another interesting aspect of these two cases is the difference in the magnitude of the penalties.  In the Moore case the firm paid disgorgement of $179,500 and Moore paid a penalty of $130,000, amounts significantly less than the BF Borgers penalties.

You can find the PCAOB’s 2022 inspection report for BF Borgers CPA PC here.

Companies and their audit committees should be conscious of the issues created when an audit firm does not perform appropriately.  Because of the magnitude and complexity of the issues former BF Borgers clients face, CorpFin and the Office of the Chief Accountant issued this Statement addressing issues including the requirement to file a change in auditor Form 8-K and the impact on annual and quarterly reporting.

As always, your thoughts and comments are welcome.