Year 2000 Disclosure Considerations
Alton O. Turner[1]
Next Millennium Consulting, Inc.
In science fiction movies computers turn against their
creators. With the on-set of the year 2000 computer
problem, fiction becomes reality. After the turn of
the century many corporations in the US and globally
will find that their c omputer systems have turned on
them. This technological mutiny will be the
culmination of a problem that until recently laid
dormant and has been overlooked by many organizations,
both public and private. The problem has been named
simply the "Year 2000 problem",
"Y2K", or the "Millenium Bug". The
year 2000 problem in simplest terms is due to the fact
mainframes, software programs and embedded computer
chips and PC's are generally incapable of correctly
processing dates aft er 1999. While this problem may
seem simple it will lead to dire consequences if not
addressed in a timely fashion. While the year 2000
problem has the ability to cause significant problems
throughout all sectors of society, the corporations,
which rely heavily on information technology (IT) to
perform a multitude of business functions are acutely
af fected. In addition to opera-tional disruptions
wreaking havoc on corporate functioning and the
subsequent liability that can result, corporate
governance and securities regulation require various
disclosure of Y2K. Directors and Officers (D&O's)
mu st be concerned not only with proper oversight and
management of Y2K efforts, but also whether the issues
that arise are being adequately disclosed. This issue
has recently received heightened attention, partially
due to SEC and congressional concerns re garding public
company disclosures.
[2]
In order to get a clearer understanding of Y2K
disclosures this paper discusses, the origin, scope and
impact of Y2K, the regulatory environment applicable to
Y2K and the consequences for failing to meet these
requirements
What is the year 2000
Problem and why does it Still Exist?
The Year 2000 problem originated as a
protocol or product specification. Given the enormous
cost of early computer memory, wasting two digits on
every date filed was out-of-specification at best and a
breach of fiduciary re sponsibility at worst. There
was little foresight that programs and mainframes built
in the 1950's and 1960's would remain in use beyond the
year 2000. Because of this computers and the
application programs created to run on them recognize
"00" ; as 1900 and not the year 2000.
[3] Hence
"00" was and still is intended to be 1900.
While the price of memory has dropped exponentially
over the past 20 years, the protocol and specifications
did not change.[4]
The ultimate reason is three-fold: 1)
the rapid growth of IT industry and time pressure
demands to produce compe titive productss necessitated
quick turnaround; 2) new generations of IT business
leaders lacked the historical knowledge of early IT
programming; and 3) consumers demanded backwards
com-patibility in IT products so as to postpone
obsolescence. The resu lt is that most organizational
systems are built on a patchwork of old and new
component systems and customized software applications
required to keep up with continually augmented
systems.
There is a general misconception that such
a simple a problem should be easy to fix. While code
conversion is technically simple, it is also
non-automatable, time consuming and expensive.
Software programs come in two forms simultane ously:
source code and object code. The object code is what
we see on our desktops. The source code is the
propriety (copyrighted) code contained in files
non-programmers see. These files of source code
contain thousands of lines of programming code in
various languages.
[5] Each line must be retrieved in
order determine whether it contains a date (inventory).
Then it must be verified whether these dates are
compliant (conversion). At this point the logic paths
must be tested to ensure functionality was not lost
(testing). Finally, the program must be moved from the
testing environment to actual use (implementation).
Because exten-sive human interaction is required to
perform these tasks the process can not be fully
automated. While automated product s do exist there is
no "silver bullet" solution to this problem.
Who is Impacted by the Year 2000
Problem?
Based upon the nature of the problem everyone is
affected by the year 2000 problem. The true scope of
the millenium bug is only now being fully understood.
Even today, most organizations have not fully grasped
Y2K. The fact that it i mpacts all industry sectors
makes Y2K truly unique. No business operates in a
vacuum, and all organizations have resource and output
dependencies. Much in the same way everyone was
affected by the oil crisis of ‘72-'73, Y2K can impact
fuel delivery syst ems, utilities, telecommunications,
air traffic control and other core infrastructure. As
a result statements touting full com-pliance are
misleading.
Assuming internal systems are ready for the century
date change, no organization can claim full compliance
unless they can assure similar readiness for their
business partners, customers, vendors and government
agencies (federal, state, municipal), and all of their
suppliers.
With these realities in mind the SEC mad the following
statement on the impossibility of total compliance:
How Will Y2K Manifest
Itself?
Any system or application,
which calculates ages, sorts by dates, or performs any
other specialized date calculation, could possibly
incur problems.[7]
These problems include, but are not
limited to:
Due to its heavy reliance on technology the
business community will be hit hard by Y2K. Imagine
the problems that would be created for public companies
like banking institutions, insurance companies,
brokerage firms, if they were not a ble properly use
software or hardware that uses date fields. This
inability to handle dates after 1999 could possibly
cause problems with billing, asset management, money
transfers, settlement process, etc. [9]
If the
manifestations of Y2K described above we re to occur,
many companies would not be able to carry out their
mission critical functions.
Costs to Fix the Problem
This issue would not receive the attention befitting a
potential global disaster if not for the tremendous
costs associated with it. Total cost estimates are
difficult to predict especially when large corporations
substantially increas e their estimates. Estimates for
conver-sion of internal systems include $5 Billion for
the US government (according to recent GAO estimates),
$50 Billion for private industry and up to $600 billion
globally according to the Gartner Group. Chase Manhatt
an Bank recently announced that it would be increasing
its total Y2K spending budget to $300 million, up from
$250 million, because of additional costs associated
with testing.[10]
Consider the fact that Citibank recently
announced that it intends to increa se its Y2K spending
to $600 million.[11]
In a recent statement the
Securities Industry Association (SIA) estimated that
the financial services industry will spend between 4-6
Billion over the next three years. [12]
For any public
corporation, the costs alone associated with Y2K co uld
reach the level of being material, and thus have to be
disclosed in public filings. These disclosures may go
beyond costs and include matters such as litigation due
to Y2K, the potential impact on operations, and any
other issues which are considered material to
investors.
Disclosures of the Year
2000 in the Corporate Setting
Public corporations are required to provide periodic
disclosures to the public regarding its business,
results of operation and other matters.[13]
The SEC and
other regulatory bodies require these disclosures.
Regardless of the way information is provided,
companies have a general obligation to disclose all
material information. Information is
"material" where there is a substantial
likelihood that a reasonable shareholder would consider
the information important in making an i nvestment
decision. [14]
Based upon the nature of Y2K and the
potential impact it can have, it is easy to see it
becoming a material issue that should be reported. The
Supreme Court used a balancing test in TSC Indus.,
Inc. v. Northway, Inc. to determ ine if materiality
existed that focused on the probability of an event
occurring versus and the impact the event would have on
the company's operations. [15]
After the turn of the
century corporate officers and directors may find
themselves facing liability for failing to disclose
material Y2K issues, either by shareholder suits and or
SEC investigations. In legislation introduced by Sen.
Robert F.Bennett (R-UT),[16] publicly traded corporations
would be required to make specific disclosures with
regard to company's year 2000 problems. While the bill
has not reached the full congress, its mere existence
demonstrates the heightened scrutiny th is issue is
receiving.
Of all the federal agencies the Securities and Exchange
Commission (SEC) has been the most vocal in trying to
increase the awareness of the problem in the
marketplace. In its June 1997 report to Congress the
SEC discussed the negative impact Y2K could have on the
securities industry. [17]
The report states that it would
be impossible for any company to reach total Year 2000
compliance and thus the focus should be on risk
minimization. In this report and Staff Legal Bulletin
No. 5, issued J anuary 12,1998, the Commission has
given guidance on the types of disclosures that must be
made.[18]
The directors and officers of a public
corporation must therefore become informed about the
potential problems created by Y2K to determine if it
would be a material issue that should be disclosed.
Based upon current regulations and rec ent SEC
guidance, the following should be kept in mind:
The Safe-Harbor for
Forward Looking Statement
One incentive for companies to come out and disclose
their Y2K problems is found under the Private
Securities Litigation Act of 1995 ("PSLA" or
"Act"). [25]
The Act's purpose is to encourage
disclosure of forward-looking information and prevent
liability stemming from frivolous private securities
litigation. [26]
The act establishes a safe-harbor for both
written and oral statements that are 1) identified as
forward looking[27] and accompanied by meaningful
cautionary language, 2) immaterial to the litigation,
3) made by the defendant without actual knowledge that
the statement was false or misleading.
[28] The Act has
come under fire for being ineffective and incapable of
inducing companies to make more meaningful forward
looking statements.[29]
The application of the safe-harbor has not yet been
litigated extensively; however, the Year 2000 problem
is likely to be a significant test case for disclosure
immunity. For example, Company XYZ is a publicly
traded manufacturer who is heavily dependent upon an
automated production process. Corporate counsel for
XYZ, upon learning of potential negative Y2K impacts,
advises XYZ to disclose the estimates in the MD&A
portion of the upcoming 10-Q filing and subsequent
10-K. The st atements generally, in boilerplate terms,
disclose XYZ's efforts in dealing with the problem, the
projected remediation costs and the impact the problem
could potentially have on the company. In addition to
this in the Factors that may effect Future Resul ts
section management adds the following cautionary
statement:
The question of
whether the safe-harbor provision would apply is now
the issue. Again the safe harbor protects statements
that are identified as forward looking in nature and
accompanied by meaningful cautionary statements.
Whether th e forward-looking statement itself and the
accompanying cautionary language are sufficient to fall
under the safe-harbor is debatable. What is considered
meaningful cautionary lan-guage is still an area of
great uncertainty and has yet to be settled
judicially.[30]
However, in the context of the year 2000
problem boilerplate language may not be enough.
Unlike any other problem, which has faced the financial
industry none has been more pervasive as Y2K. It has
the capability of impacting an organization in numerous
ways on every level. This compounded with the fact it
will hit most companies all at once thus, making it
difficult to argue to a jury it was a problem which did
not deserve special attention in disclosures to
shareholders. While the appropriate level of
disclosure in forwarding-looking statements and the
precise meaning of meaningful cautionary language is
being settled in the courts, careful counsel may want
to err on the side of caution and provide detailed Y2K
risk factors in their forward-looking statements. In
addition to this the cautionary language accompanying
these statement should provide com-pany or industry
specific information delineating the risks Y2K
poses.
Liability under Securities
Laws for Failure to Disclose Y2K Problem
As explained above under publicly traded companies are
required to make certain disclosures in their annual
and quarterly SEC filings. If a company fails to
disclose its year 2000 problem properly it may face
liability under the regula tions governing these
reports. The following is a list of provisions, which
could create liability for corporations and their
officers and directors:
Section 11(a) of the 1933
Securities Act
Signatories to registration state-ments that fail to
undertake an earnest due diligence inquiry may be
liable to anyone purchasers of the stock that
detrimentally rely upon resulting material omissions
and misstatements. This liability extends to
D&O's, underwriters, auditors and lawyers involved
in the offering.
Section 12(2) of the 1933
Securities Act
This section applies to any public offer or sale of
securities whether registered or not, which is
disseminated by means of an oral statement or written
prospectus. It grants a private right of action to
shareholders who have purchased securities of a
corporation based upon untrue statements of material
fact in a prospectus, or failure to make statements in
a prospectus not misleading.
Section 10(b) and 10b-5 of the
1934 Securities and Exchange Act
Similarly, 10(b) and 10b-5 are anti-fraud provisions
that create a private right of action against any
person selling securities through means of interstate
commerce through manipulation or deception including
untrue statements or omiss ion of material facts. In
addition to providing a private right of action, 10(b)
and 10b-5 allow the SEC to bring separate enforcement
actions that could result in civil and criminal
penalties.
Section 17(a) of the 1933
Securities Act
This provision allows the SEC to bring actions against
parties who issue registration statements containing
mat-erial and false representations or omis-sions.
State Blue Sky Laws
While in many cases similar to the federal securities
laws, state Blue-Sky law could require certain
disclosures related to Y2K. Publicly traded entities
should review with counsel the need to disclose Y2K
under applicable Blue Sky Law s.
SRO Disclosure
Requirements
In addition to the disclosures required by the SEC most
of the major exchanges require listed companies to
disclose "material events" such as Y2K.
Considering the important role SRO's play in the
market, they could have an im pact on member's Y2K
efforts as well as protecting investors.
One SRO helping to ensure member compliance is the
NASD. The NASD has taken several steps to alert its
members to the problem, such as issuing notices and
alerts to members on Y2K,[31]
establishing on-line
resources dealing with the issue (www.nasd.com),
proposing all members strive for Y2K compliance, and
requiring all members to complete and return a Year
2000 Compliance Survey. The NASD requires companies,
which are listed on the NASDAQ to disclose to the
public by means of the press a ny material information,
which may affect the value of its securities or
influence investors' decisions.[32]
In addition the NASD
in Notice to Members 97-16 stated that Y2K related
computer failures will not generally be considered a
defense to violations of firms regulatory or compliance
responsibilities nor a mitigating factor when
determining sanctions.
The other major exchanges
such as the American Stock Exchange (AMEX), and the New
York Stock Exchange (NYSE) have taken similar actions.
They too have material information disclosure
requirements. The New York Stock Exchange requires its
listed companies to release quickly to the public any
news or information which might reasonably be expected
to materially affect the market for securities.
[33]
The
American Stock Exchange requires listed companies to
make immediate disclosures of all mat erial information
concerning its affairs, except in unusual
circumstances.[34]
Accounting Disclosure
Issues
The Emerging Issues task Force (EITF), a division of
FASB, decided that software conversion costs should be
expensed as incurred. These costs may also have to be
reported separately depending upon the materiality of
the costs.[35]
Financial Accounting Standard
("SFAS") No.5, which deals with accounting
contingencies,[36]
requires an accrual if a loss is
probable and can be reasonably estimated. This
disclosure should indicate the nature of the
contingency and the possible range of loss. Based upon
the nature of the Y2K problem a reportable contingency
could exist. Thus, under SFAS 5 if it is likely
that a company will not be Year 2000 compliant, or that
an asset will be impaired or a liability inc urred as
of the date of the financial statement, and the loss
can be reasonably estimated, then the estimated loss
must be charged against earnings and a description be
provided in the body of the financial statement. In
addition to SFAS 5, companies may have to make further
disclosures under SOP 94-6 which deals with Disclosure
of Certain Significant Risks and Uncertainties. SOP
94-6 requires disclosures in areas such as impairment
or amortization of capitalized software costs,
inventory valuation, long-term contract accounting,
warranty reserves, reserves for sales returns and
allowances, or litigation if, based on the facts and
circumstances existing at the date of the financial
statements.[37]
The Year 2000 could very well have an
effect in all of these areas.
Disclosure Concerns for
Auditors
Due to the nature of the Year 2000 problem, independent
Auditors may have to include an assessment of the
likelihood of failure due to non-compliance within a
company's financial statements. In making this
assessment auditors may want to document their clients
Y2K disclosures in order to show compliance with
current Statements on Auditing Standards (SAS) which
are drafted pursuant to Generally Accepted Accounting
Principles (GAAS). SAS No. 53 requires auditors to
conduct their audit s o that errors and irregularities
which are material are discovered. These findings
would have to be disclosed in the year that the audit
is being conducted for. In addition to these
requirements an auditor would also be required to
publicly disclose any attempts by the audited company
to cover up problems related to Y2K which would have a
material effect on it.[38]
Auditors would also have to
make necessary disclosures as required by the SEC.
Conclusion
It has been said that Y2K is not a technical problem,
but rather a business management problem. Examples of
this are the obligations and potential liability that
comes from incomplete or inaccurate disclosures of Y2K
effect on an organ ization. Considering the
incre-dible impact Y2K can have on earnings,
liabilities, and overall corporate govern-ance,
investor protection becomes paramount. Investors are
particularly vulnerable when it comes to Y2K because
its full scope is only beginn ing top reach the popular
press and each company's y2K problems are unique and
can only be determined by significant efforts. Due
to the high cost of remediation, the likelihood of
business operational disruptions and the widespread
media attention Y2K has received, it will be almost
impossible for companies to argue Y2K was not a
material issue worthy of ment ion in public
disclosures. Plaintiff's attorneys representing
disgruntled shareholders will have an easy day in court
if they can show a company's management failed to make
appropriate disclosures. Only time and significant
litigation will determine what level of disclosure was
legally sufficient.
[2] "Report to the Congress on the
Readiness of the United States Securities Industry and
Public Companies To Meet the Information Processing
Challenges of the Year 2000," ( June 1997)
(local copy)
[hereinafter Readiness Report]
[3] Mary Wisnieski Holden, Millennium Bug Threatens to Spread Mad Computer Disease, Chi. Law Rev, Aug 1996, at 78.
[4] Robert G. Gerber, Computers and the Year 2000: are you Ready?, 30 J. Marshall L. Rev. 837, 841 (1997).
[5] For a large organization there can be millions of line of code. It is estimated that a company such as General Motors, which is the world's largest corporation, has over 1 Billion lines of source code throughout its operation.
[6] See Readiness Report note 2 Supra p2 (standing for the proposition that no organization will be totally prepared to deal with the effects of Y2K so the best course of action is risk mitigation).
[7] Information Technology Association of America-Year 2000 Task Group, The Year 2000 Software Conversion issues and Observations 1 (1996).
[8] Gary E. Clayton, et. al., The Year 200 Headache "Two Thousand Zero-Zero. Party's Over OOOPS, Out of Time", 30 Tex. Tech L. Rev. 837, 840 (1997) (discussing generally manifestations of Y2K.).
[10]See Bruce Caldwell, Testing takes a Bigger Bite, InformationWeek, at the URL of
http://www.techweb.com/se/directlink.cgi IWK19980406S0070[11] Banks Face Year 2000 Problems, Florida Today , Wed, Apr 15 1998, at
http://guide-p.infoseek.com/Content?arn= ix.FLTY81050023&col=IX< /FONT>
[12]> See Year 2000 May Cost
Financial Industry $6 Billion, at http://my.excite.com/news/r/980429/10/tech-2000
[13] See also Michael R.
Cashman, Personal Liability for Year 2000 Failures, at
[14] See TSC Industries Inc. v.
Northway, Inc., 426 U.S. 224 (1988).
[16] See S.1518, 105th
Cong., 1st Sess. (1997), Computer
Remediation and Shareholder Protection Act of 1997
(CRASH) (the bill would require disclosure of phases of
remediation, summary of costs of remediation, estimate
of possible litigation costs, existence of insurance
policies and contingency planning efforts).
[17] See Readiness Report,
Supra Note 2
[18] See Readiness Report
supra; See also SEC Staff Legal
Bulletin No. 5 (October 8, 1998), revised (January 12,
1998) available at
[19] See SEC Staff Legal Bulletin
No. 5 (January 12, 1998)
[20] The Securities Exchange Act of 1934
(SEA) requires10-K annual reports under §§ 13 and
15(d), to be filed within 90 days of the end of the
fiscal year, the SEA also requires the filing of the
10-Q on a quarterly basis under §§ 13 and 15(d),
pursuant to Rule 13a-13 or Rule 15d-13. within 45 days
of the end of the fiscal quarter
[21] See Securities Exchange Act
Release No. 33-6835 (May 18, 1989) (generally
discussing purpose behind MD& requirements in
disclosures).
[22] See Staff Legal Bulletin
No 5; See also Item 303(a) of Reg. S-k
and S-B provide an expansive list of issues which
management should discuss in the companies reports on
Form 10-K (10-KSB) and 10-Q (10-QSB) these i nclude
issues such material commitments for capital
expenditures and their purpose, anticipated funds
needed to fulfill such commitments, unusual or
infrequent events or transactions or significant
economic changes that materially effect income, any
known trends and uncertainties that can be reasonably
expected to have an unfavorable impact on revenues or
income.
[23] See Staff Legal Bulletin
supra
, See also In Re Goodyear tire
& Rubber Co., 1993 WL 130381, at 4 (E.D Penn.
1993), See also TSC Indus., Inc. v.
Northway, Inc., 426 U.S. 438, 449 ( 1976).
[25] Private Securities Litigation Reform
Act of 1995, 15 U.S.C. §78u-5(c)(1).
[26] It is important to note that the act
only covers private lawsuits and does not limit the
ability of the Commission to bring an action. The act
is further limited to statements which are not included
in financial statements prepared accordi ng to GAAP
rules, or those made by investment companies regarding
IPO's, tender offers and rollups or offerings by
partnerships or LLC's
[27] See 15 U.S.C. § 78u-5(I)(1)
(forward looking statements can cover a gambit of
possibilities such as statements projecting revenues,
income, earnings, dividends, plans and objectives for
future operations, outside reports which assess a
forward looking statement)
[28] See In re Valuejet , Inc.,
Securities Litigation, 984 F. Supp. 1472, (N.D GA.
1997), See also 17 C.F.R. §240.3b6 (providing
safe-harbor in forward looking statements in quarterly
and annual reports if made on a reasonable ba sis)
[29] Since the 1995 acts passage several new
bills have been introduced in congress to try and
address this issue. See "Securities
Litigation Improvement Act of 1997" (H.R. 1653),
see also "Securities Litigat ion
Uniform Standards Act of 1997" (H.R. 1689)(an
important concern among companies making filings is
that the safe-harbor does not prevent suit under State
Blue-Sky law, thus boilerplate is still the norm). For
a further discussion of this issue see note 29
infra.
[30] See Gearld S. Backman, et. al,
Sailing in "Safe Harbors": Drafting
Forward-looking Disclosures (generally discussing the
small effect the 1995 Reform Act has had on public
companies making more substantive disclosures in fo
rward-looking statements and providing empirical
evidence to this conclusion by systematically sampling
issuer filings), see also H.R. Conf.
Rep No. 104-369 at 43 (stating boilerplate warnings
will not suffice as meaningful cautionary langu age,
while at p 44 stating failure to include a particular
factor which causes a forward looking statement not to
come will not mean the statement is not protected by
the safe harbor).
[31]See NASD Regulatory and
Compliance
Alert (September 1997); NASD Notices to Members
–"For Your Information" section (July 1996);
NASD Notice to Members Notice to Members 97-16 (March
1997); and NASDAQ's Subscriber Bulletin (J une
19997).
[32] National Association of Securities
Dealers Manual § D, Part 2, §[c] (17)(1996).
[33] New York Stock Exchange Listed Company
Manual §202.05 (1994).
[34] American Stock Exchange Company Guide §
401(b) (1996)
[35] Emerging Issues Task Force Issue No.
96-14, "Accounting for the Costs Associated with
Modifying Computer Software for the Year 2000."
July 18, 1996.
[36] SFAS defines a contingency as a
existing
condition or set of circumstances which involve an
uncertainty as to the possible gain or loss to an
enterprise that will be resolved when one or more
events occurs or fails to occur.
[37] The Year 2000 Issue- Current Accounting
and Auditing Guidance, Issued: Ocober 31, 1997
Copyright 1997 American Institute of Certified Public
Accountants, (Guidance developed by the AICPA to
address year 2000 accounting and auditing issues) .
[38] See SAS No. 59 "The
auditors Consideration of an Entit's ability to continue
as a Going Concern",
see also SAS No 54 "Illegal Acts by Clients