QLCCs: The In-House Perspective
by Susan Hackett

I get calls pretty regularly asking, “What is a QLCC (Qualified Legal Compliance Committee)?” and “Why haven’t more companies adopted one?” For the record, here’s what I say.

First, What Is a QLCC?

The QLCC is a creation of the SEC, put forth in the SEC’s rules regulating attorney conduct pursuant to Section 307 of the Sarbanes-Oxley Act.¹ The SEC’s rules, including the description and proposed function of a QLCC, became effective on August 5, 2003.

The QLCC was the SEC’s peace offering to the legal profession during the rule-making process.

A QLCC is an optional board committee (which must conform to a prescribed composition to ensure independence), whose function is to investigate allegations of wrongdoing reported to it and to suggest remedies, as appropriate and if necessary. Under the rules, an issuer does not have to adopt a QLCC, but may create one as an alternative to the mandatory “reporting up” (and potential “reporting out”) obligations the rules impose on the company’s lawyers.

The SEC’s rules regulate attorney conduct in the representation of the issuer, requiring attorneys who uncover evidence of wrongdoing to report the allegation up the ladder of management, even over management’s head to the board if necessary, until the attorney receives an appropriate response. If an appropriate response is not forthcoming, then the attorney may (note that the original draft proposal of the rule said “must”) report the allegation outside of the company—overriding the lawyer’s professional duties of confidentiality—so that the allegation might be addressed in the client entity’s best interests. Many lawyers protested the proposal in its “must” form, citing concerns that the rule would turn corporate lawyers into client conduct policemen, and thus ensure that no client would ever willingly include in-house counsel on the kinds of strategic teams where they can do their best preventive law counseling.

The QLCC was the SEC’s peace offering to the legal profession during the rule-making process: if lawyers were uncomfortable with the role of reporters, then they could deposit evidence they’d uncovered at the feet of the QLCC and be relieved of any further responsibilities for reporting or the handling of the underlying investigation. Thus, the QLCC provides an alternative reporting route for lawyers, the effect of which is to shift the responsibility for following up to the board.

Because the rules provide that a QLCC must be in place prior to the advent of any allegation brought before it for consideration, many commentators assumed that companies would rush to create QLCCs or to designate existing committees, such as the audit committee, as a QLCC. After all, why not?

Why not, indeed? The rush never materialized. And all this was in spite of the large number of law firms that quickly created QLCC expertise (including model QLCC charters and such) and offered it aggressively to their Sarbanes–Oxley-deluged corporate clients. It also bears mentioning that most public companies adopted every Sarbanes–Oxley-related governance prescription developed by the SEC, except this one. So why are QLCCs different?

Before I tell you what I’ve learned, let me caveat it: the value of adopting a QLCC must be weighed by every company on its own merits, and this internal analysis should likely be repeated regularly since time may change the underlying presumptions. What was perceived as unlikely or unwarranted today may be much more relevant next year. My conclusions about this issue are drawn from conversations and study of a good number of legal departments, but they are not scientific, or even statistically meaningful. Add to that a total lack of real-life experience as to how things will actually play out when a QLCC is called into action (or wished for in 20/20 hindsight). Duty done, let’s get back to what CLOs are saying.

Why Not Create a QLCC?

QLCCs sound good in principle, but suffer from a number of practical flaws. I know of only a handful of companies that have instituted QLCCs, but exponentially more that have not. Let’s review the reasons why CLOs have spurned their adoption.

Why bother?

The QLCC proposal was offered when the SEC also proposed to subject lawyers to a reporting out obligation. Since mandatory reporting out requirements were removed from the final rule, there is less “pressure” to create a QLCC.

[M]ost public companies adopted every Sarbanes–Oxley-related governance prescription . . . except this one.

Currently, lawyers are only bound to report up and do not thereby violate their confidentiality obligations. Reporting out remains in the lawyer’s discretion, and can therefore be coordinated with state legal ethics obligations. Remember: a few states forbid lawyers from making any such kind of disclosure, most allow lawyer discretion, and a few mandate reporting out. One of the difficulties of the SEC rule is navigating its interplay with the states’ professional standards, especially when several states’ rules are involved.

If the SEC passes a still pending proposal that would change the rule from permissive to mandatory reporting out for lawyers,² then more CLOs might propose a QLCC to help them avoid being caught in a trap between the SEC and state conduct rules.

Lawyers should do the legal work

The QLCC option is presented as a part of the attorney conduct rules and not as a governance practice. This is because the QLCC primarily “benefits” lawyers, who are no longer responsible for handling allegations that they send to the QLCC. Boards encouraged to consider a QLCC by the CLO may perceive that they are being asked to adopt yet another board committee structure with concomitant director liability simply so that lawyers who are employed or retained by the company at great expense can “avoid” responsibility for the client’s legal compliance agenda. Many CLOs are loathe to take the risk that their board might see such a request as self-serving and evasive of the lawyer’s primary responsibility.

Who would advise the QLCC?

It’s also necessary to think through the practicalities of how the QLCC works. There are really only two ways for this board committee to operate. One way is to deputize in-house lawyers to help the QLCC fulfill its mission. And that brings us right back to the in-house lawyer’s involvement in the disposition of the matter (which creating the QLCC was supposed to supplant in the first place). The other way is for the QLCC to go to outside counsel for help, either from the company’s existing primary counsel or from other outside counsel of the QLCC’s choosing. If in-house lawyers are effectively replaced by outside counsel on the really sensitive matters of the company—especially if it’s because the board thinks in-house lawyers have abdicated their responsibilities for such matters—it may not be long before the value of the in-house lawyer and the law department generally is questioned.

If outside counsel is called in, there are other practical difficulties that weigh on the in-house counsel’s mind. First, “independent” counsel hired by the board usually knows little about the company (requiring substantial “learning curve” time and expense) and is not likely to receive a lot of supervision from the board. Their investigations will be over-costly at best, and more likely damaging to the daily operation of the organization. Those firms hired as independent counsel may investigate matters in a more adversarial, or “scorched earth,” fashion than would someone who has an ongoing relationship with the company and its employees and is interested primarily in helping the company move forward.

In short, many CLOs don’t want to endorse a governance option that not only emasculates their ability to influence such important legal decisions as these investigations entail, but also abdicates responsibility for the very duties they were retained and feel professionally obligated to fulfill.

Board members as hotline operators?

The SEC rules that define a QLCC do not limit who may report an allegation of legal wrongdoing to it; it is not the discretionary tool of the CLO or reporting lawyers alone, as many presume. Some QLCC charters have tried to limit those who can make reports to the body, but this may or may not pass muster if challenged. And if the QLCC could become a general company hotline for disgruntled employees, embittered shareholders, or whistleblowers (both legitimate and crackpot) to report any number of problems that have a legal ramification, then this body might become a repository for the resolution of all kinds of concerns that the QLCC was probably not created to address. Manning a hotline is not what board members are recruited to do, and it would be a significant drain on their attention and the performance of other vital functions of oversight.

Faced with a flood of reports (and let’s face it: five reports in a year would be a flood for most board committees, and some highly regulated companies’ hotlines get hundreds or thousands of calls each year), suppose the QLCC responds by hiring an outside firm or a number of outside firms to sift reports and to conduct investigations on its behalf.

Imagine the disruption to the workplace and worker morale that could ensue from overlapping board-requested investigations by independent outside firms underway at any given time, all conducted without legal department controls or sensitivities in place, and without experienced ombudsmen to flush out those allegations that should be handled through alternative or less drastic means. It’s not a pretty picture. What do you think runs through the mind of an employee who is unexpectedly cornered by an outside lawyer-investigator, who closes the employee’s door and grills her for the next hour on matters she now frantically begins to try to connect to only her appropriate behaviors? Maybe this outside counsel offers some version of the corporate Miranda warning. Sometimes these kinds of interviews are warranted; sometimes they do more damage than good in moving the company toward a remedy. When they are done, interviews must be handled with great sensitivity and with an eye toward remedying the problems and minimizing disruption to employee morale.

And then, there’s the money

While one hates to mention costs when Sarbanes-Oxley matters are at hand (!), when the QLCC operates by retaining firms to conduct its work, those firms will be racking up bills that may not be subject to experienced supervision or daily controls. Since firms hired by the board to conduct an investigation of a matter will likely run every issue to the ground because they will (quite correctly) worry about liabilities if they don’t, it is possible that even less significant matters or spurious allegations will receive the red carpet treatment. Where else will these costs be expensed but in the legal department budget?

CLOs have a hard enough time budgeting their own closely attended inside and outside counsel expenses. They’d generally prefer not to suggest ideas for additional “unsupervised” outside counsel expense lines, especially given the number of board members who are already consulting with outside counsel on the company’s dime on non-QLCC matters.

What Are the Alternatives?

While I am obviously painting a worst-case scenario, the point is that the creation of a QLCC is an option: in-house lawyers are loathe to suggest that the risks of creating a QLCC should be shouldered without a showing that there are corresponding and far greater benefits than are apparent in the marketplace today.

It is worth noting that most CLOs who have actively declined to suggest a QLCC have considered other initiatives to help ensure that they are preparing for the possibility of future difficult situations. Many concentrate their efforts on improving lawyer-to-board communication and information flow, and have instituted a number of “best practices” that they believe effectively substitute for the QLCC function.

[I]f the QLCC is not in place prior to the onset of . . . a problem, it cannot be constituted after the fact to handle the investigation

These include regular meetings (usually in executive session) with the board to report on legal compliance and any allegations of concern, and better lawyer involvement in the information and communication flow between senior management and the board over matters of compliance and strategic policy. Many in-house counsel have taken an increased role in reporting regularly to the board on even more routine matters in an effort to get the board familiar with and trusting of the CLO’s handle on day-to-day legal concerns. It is this reservoir of trust that the CLO can call upon when the more significant allegation arises and the board must be informed and have confidence in the CLO’s ability to advise them on the situation—including the need for CLO-supervised outside counsel to provide independent advice. The regularity of reporting helps CLOs in the event of the rare, more significant, report they must bring to the board’s attention and act upon with the board’s support.

Indeed, a number of companies encourage the CLO to report any legal matters of a heightened level of concern to the audit committee or its chairman immediately and outside of the regular reporting process to the whole board, thus effectively providing the kind of notice and board oversight that a QLCC might provide, but without some of the risks. The audit committee is, of course, empowered to take over responsibility for the matter if they so choose.

These alternative and more informal board reporting mechanisms do not, however, relieve a lawyer of the rule’s reporting and related responsibilities, which is, of course, the stated purpose of the QLCC option.

Some Companies Have Created QLCCs

While I’ve focused on why so many companies have not adopted a QLCC, I haven’t told you much about those that have and their motivations. The few CLOs I know who have encouraged the adoption of a QLCC believe that their relationship with the board is well-established and thus could be predictably managed. These CLOs also suggest that their experience with allegation hotlines indicates that few if any reports would be made, and that those made to the QLCC would likely have been in some way already vetted—whether funneled through law department screens or limited to lawyer reports.

Most of these CLOs believe that the QLCC would call upon the law department first (when possible) and that lawyers engaged in such investigations would be freed of the SEC rule’s responsibilities since they would be operating under the provisions and authority of the QLCC. A common theme emerging from this group is their comfort, and their board’s comfort, with handling legal matters at the board level.

In addition, some wish to have the QLCC option open to their company if a significant matter arises—especially one involving allegations of senior management or even legal department corruption; this is seen as a necessary precaution. These CLOs would remind us that if the QLCC is not in place prior to the onset of such a problem, it cannot be constituted after the fact to handle the investigation. (The counter to that, of course, is that the board can adopt a committee to look into a difficult matter reported to it at any time. A report to that kind of committee simply won’t offer lawyers relief from their reporting obligations.)

Do QLCCs Have a Future?

Will things change in the future? Perhaps, depending on several things. If those companies with QLCCs begin to offer up experiences that would qualify as best practice models, other companies may choose to emulate them. This will require a couple of high-profile QLCC “success stories,” and we just don’t have any experience of any kind with QLCCs yet. Similarly, if organizations that specialize in governance standards and ratings (such as ISS or the stock exchanges) add the creation of a QLCC to their list of criteria that suggest a company has good corporate governance procedures, more companies will adopt one just to get the “points” (and avoid “demerits”) when their actions are subsequently scrutinized. Of course, a company that forms a QLCC to gain the favor of a ratings organization would be adopting this important committee for all the “wrong” reasons.

It is important to remember that the SEC still has a “reporting out” rule proposal hanging over the head of the bar as of this writing. While no one knows what will happen to this rule (and indeed, you can hear predictions and rumors about its fate in both directions on any given day), the fact remains that the SEC let the rest of the rule go into effect last August without the mandatory reporting out requirements. Many of us at the bar believe the SEC has the best of both worlds already: they can continue to exert influence over the issue by holding the mandatory reporting out rule over the bar’s collective head, while avoiding lawsuits and arguments with the majority of state bars that regulate lawyers’ behavior and that would protest an SEC rule that violates the terms of their own rules regulating lawyer conduct.

So that’s my two cent’s worth. And it may be worth only that much, if your company feels that it will benefit from the adoption of a QLCC.³ Certainly those folks that have a QLCC in place do not suggest that they regret their decision, even if their numbers make them hard to find.

Notes

1. See SEC Release No. 33-8185 (Jan. 29, 2003), available at <www.sec.gov/rules/final/33-8185.htm>. The final rule is codified at 17 CFR Part 205.

2. See SEC Release No. 33-8186 (Jan. 29, 2003), available at <www.sec.gov/rules/proposed/33-8186.htm>.

3. The ACC offers its members resources on QLCCs and the SEC’s attorney conduct rules, including sample charters, model policies, and executive summaries written by in-house lawyers and outside firms alike, at <www.acca.com/legres/corpresponsibility/index.php>.

About the Author

Ms. Hackett (hackett@acca.com) is Senior Vice President and General Counsel for the Association of Corporate Counsel formerly, the American Corporate Counsel Association). This article is drawn from material written by the author for ACC’s website, and is copyrighted by the Association of Corporate Counsel.