Stock Plan Administration in the Age of Sarbanes-Oxley

　　Compliance Considerations for Administrators

　　The information published in this paper is of a general nature and is intended merely as summary. It is not a complete discussion of all aspects of the laws, rules, regulations, standards, and principles that govern equity compensation plans. The contents are neither designed nor intended to be relied upon, and should not be considered, as legal or tax advice. Readers' specific situations may involve circumstances that cause the laws, rules, regulations, standards and principles described herein to apply differently. Readers should consult their own advisors before deciding what, if any, course of action to take in their own particular situation.

　　The Complicating Factor: Sarbanes-Oxley

　　Following on the heels of several high-profile corporate scandals, Congress responded quickly to the demands of investors for new layers of regulatory oversight and financial transparency for publicly traded companies. The “Public Company Accounting Reform and Investor Protection Act” – more familiarly known as the Sarbanes-Oxley Act of 2002 – is the broadest set of regulations for public companies since the Securities Exchange Act of 1934.

　　It mandates that companies improve corporate governance through an enhanced system of internal controls on financial and operational processes.

　　One of the key provisions to the sweeping Sarbanes-Oxley Act is Section 404, “Documenting and Evaluating Controls Over Financial Reporting.” Some of its critical elements include:

　　A requirement for management to report on the effectiveness of internal controls and procedures for financial reporting.

　　A requirement for an independent auditor to attest to management’s assertions about those controls.

　　Both of the these reports must be included in the company’s annual report to shareholders.

　　In addition, under Sections 302 and 906 of Sarbanes-Oxley Act, the company’s CEO and CFO must certify the completeness of the results reported in the company’s financial statements and effectiveness of the company’s internal controls.

　　By virtue of the complexity of its processes, stock plan administrators will be challenged to conform to the governance, auditing, and reporting provisions of the tools and processes to manage stock-plan administration. That’s especially true if administrators are still using spreadsheets or other early-generation tools and processes to manage equity-compensation administration. For example, many companies – even large ones – have long relied on simple spreadsheets or personal databases to track an increasingly complex set of data and processes. Of course, these tools provide no guarantee of data integrity or data sharing and present major limitations in reporting, auditability, and accountability – the precise flaws that

　　Section 404 of the Sarbanes-Oxley Act (SOX) seeks to remedy.

　　Stock-plan managers must select and use tools and management systems for their plans and programs that enable them to do more than efficiently administer these complex plans. They must now also ensure those automated systems streamline and simplify their ability to comply with SOX 404 provisions. The major areas of SOX-compliance concern for stock-plan administrators include:

　　Controlling Access to the Application and Data

　　Controlling Option/Award Grants

　　Controlling Employee Notifications of Grants

　　Financial Reporting of Grants and Awards

　　Exercise Processing and Procedures

　　Recording and Reporting Officer Transactions

　　Controlling Communications With Brokers and Transfer Agents

　　Financial Reporting of Exercises

　　Controlling Account Updates and Additions

　　A similar auditing issue arises for companies that use third-party stock-plan administration service providers. Statement on Auditing Standards (SAS) No. 70, Service Organizations, is an internationally recognized auditing standard developed by the American Institute ofCertified Public Accountants (AICPA). It calls for companies to audit their service organizations who provide key outsourced services, such as stock-plan administration.

　　Buyers of these services are entitled to SAS 70 audits and should request them.

　　Over the following pages, this white paper will discuss many of the important considerations

　　– some relating to automating technology and others that are purely business processrelated

　　– that stock-plan administrators must keep in mind as they endeavor to implement a comprehensive system that can deliver the consistency and compliance that regulators, auditors, and by extension, investors now require.

　　Controlling Access to the Application and Data

　　As with any application or database that manages sensitive data, stock plan administrators – whether they’re finance professionals, CFOs, HR managers, or the legal team – must have a system that properly restricts access, provides sufficient security, and documents which individuals have attempted to or successfully accessed and modified data. By contrast, spreadsheets, for example, can provide none of the enterprise-class features for security and access that are now a requirement for SOX compliance.

　　These kinds of application controls and role-based security settings are typically databasedriven – as they would be for any enterprise application such as the general ledger, CRM, ERP, or payroll systems. Some of the issues that concern auditors revolve around:

　　Roles – You need to define different classes of users who have different access rights. For example, which user-class can issue a grant? Which user-class can delete data?

　　Granting Access – You will need to document your procedure for granting access to the equity-compensation administration system. Who determines what named user gets assigned to a particular role/user-class? What’s more, who has administrator rights? Just as you find with other financial systems, experts recommend a multi-step, multi-person process that requires the signed authority

　　of multiple participants to grant access.

　　Passwords – What should be the minimum length for a password and what characters will you require? Will you mandate frequent expirations/renewals?

　　Lockout Policies – How many failed logins will you allow before requiring an administrator to intervene and reset a user’s ID?

　　Many of these parameters will mirror the larger IT policies of the company, including, for example, how data is backed up and where those backups are stored (e.g. off-site).

　　However, as routine as these may appear to be, they become essential components of the SOX 404 audit.

　　Controlling Option/Award Grants

　　The parameters of options and award grants will, of course, vary from company to company.

　　For example, grants can originate with HR, managers, boards of directors, or executives.

　　Those grants can follow different paths internally (and/or with the Board) before they are properly approved, communicated, accepted, verified, recorded, exercised, and administered.

　　Many plan administrators find it useful to create a simple matrix of authority – a table showing the number of shares/options that can be granted for each employee grade and thecorresponding approvals (or second signatures) required. For example, the procedure for grants to officers and directors should require additional approvals, procedures, and notifications to the people responsible for filing the Forms 4 to the SEC (required within two business days of the grant). Not every grant will fit neatly into your pre-defined procedures, which means your company will need procedures for “non-standard” grants.

　　SOX 404 is particularly concerned with the careful delineation and compliance of these granting procedures, and they must be explicitly documented, down to step-by-step details.

　　Given that many grants are awarded simultaneously (perhaps as part of a company-wide year-end bonus program, for example), there can be significant administrative challenges.

　　Let’s look at one example:

　　You might import grant information for hundreds or thousands of employees from an

　　HR information system or Microsoft? Excel spreadsheet into your stock plan administration system. Can you verify that data is accurate and that all necessary approvals have been secured? Can you process that data within 24 hours (the industry standard)? Can you find, reconcile, and audit any discrepancies? And can you

　　create a report that demonstrates that you have sign-off/approval that these grants were imported properly without any data irregularities? To meet SOX compliance standards, you’ll need to ensure you have documented, auditable controls at every step of the granting process.

　　Controlling Employee Notifications of Grants

　　Sarbanes-Oxley auditors will also want to see evidence of a structured, documented process for informing grantees of their stock/option awards. Ensure that your plan administration includes mechanisms for notifying all employees who have been granted options/awards. For many, this might require a signature for acceptance – which will require careful tracking. If you notify employees electronically, can you track electronic return-receipts when those messages are opened?

　　From a non-software, business-process perspective, the situation is similar. When paper copies of grants are provided, does your company have controls in place to ensure that those notices are mailed and received? Your procedures should include a way to ensure all signature/receipts are received, recorded, and stored for auditing purposes. While this isn’t a software issue, it is important to SOX auditors.

　　Financial Reporting of Grants and Awards

　　Because of their dilutive characteristics, when a company awards stock options or stock grants, it has a direct impact on financial statements and financial reports. That means it’s essential to ensure that the finance team (including controllers and CFOs) gets specific data on the time and size of grants. Payroll and HR administrators may need this information as well.

　　A proper equity-compensation system should help you ensure that you have clear responsibilities and reporting timelines to inter-company departments regarding these awards. Reporting logs can show when and where reports were completed and who receives them. Proper signoffs also help document – again, for audit purposes – that the appropriate data was delivered to finance for incorporation into statutory reports.Whether you are administering your plan internally or outsourcing to a third-party service provider, it’s essential to have a clear, documented trail of grant/award data that is accessible to external auditors and provides a granular level of detail.

　　Transaction Processing and Procedures

　　When an employee chooses to exercise options or vests in awards of stock, it should set in motion a well-orchestrated process involving brokers, the transfer agent, and plan administrators – all of which requires careful documentation for SOX auditing purposes.

　　Consider how you would handle the following processes and steps:

　　How do you enter option exercises into your database/system for managing equity compensation? How do you track employees’ elections with respect to tax payments due upon vesting for awards of stock?

　　If shares have been sold to cover the cost of the option exercise or taxes due upon vesting of an award, can you confirm that the reported price of the trade falls within the range of prices for the security for that date? If a reported execution price falls outside the price range, what are your steps for reconciling

　　and correcting?

　　If notification of the day’s trades is received electronically from the company’s designated brokers, what are your controls for how these files are accessed? Are the files stored in a secure location? Who is responsible for collecting the files and importing the data into the stock plan database?

　　Who is responsible for processing the exercises and/or award releases and determining the funds required to cover the price and/or tax withholding for each transaction? How are income levels for FICA purposes and tax withholding rates for state, local, and international tax jurisdictions verified? For transactions involving sales, how are these amounts reported to the brokers that executed the trades?

　　Who is responsible for notifying the transfer agent (manually or automatically) of the shares issued for option exercises and award releases? Who authorizes the issuance of stock (many companies require dual authorization) and verifies that the transaction records have been balanced?

　　The situation is even more difficult if exercises or releases are handled manually. For auditing purposes, you’ll need to issue, track, and store:

　　Required exercise and tax election forms (tracking whether they’ve been properly authorized)

　　Broker e-mails or faxes of the employee’s signed authorization (containing sensitive financial/contact/demographic data)

　　Delivery instructions

　　Prices, tax withholdings, and procees

　　What’s more, you’ll also need to ensure that – after proper sign-off and counterapprovals – your transfer agent releases the proper number of shares to the employee’s broker.

　　Recording and Reporting Officer Transactions

　　Exercises and sales of options and stock grants by company officers require a higher level of statutory documentation and a more complex support process. Plan administrators must design a process that supports the necessary pre-approvals that are typically required. You need to define who can approve those exercises and identify the (paper or electronic) forms required prior to processing.

　　For example, a director or officer will need to file a Form 4 with the SEC. From a SOX auditing perspective, you need a systematized way for recording those insider transactions as well as creating and filing the necessary Forms 4.

　　Also, most companies’ policies generally prohibit insiders from engaging in sales (including same-day sale exercises) and other open market transactions during periods when they are likely to have material, nonm public information. These periods are often referred to as blackout periods and typically encompass the end of a fiscal quarter. (In fact, many companies extend certain black-out periods across their entire employee populations). It’s important to document who decides when an employee is eligible for black-out restrictions, how those employees are notified, and how the black-out periods are determined.

　　Managing Interactions Between Brokers and Transfer Agents

　　One of the most important steps in the equity-compensation administration process involves coordinating and communicating with transfer agents and brokers. Auditors give high marks to companies that have carefully defined and fully controlled procedures for notifying their designated transfer agent that shares are authorized for delivery to brokers. These transactions must be audited and reconciled on a monthly basis to ensure that all funds have been received, paperwork is complete, control numbers are recorded, and delivery information has been verified and authorized for all exercised trades.

　　After executing their portion of the process, brokers will generate and e-mail (or fax) reports and confirmations to you. Generally, this data is required for taxation purposes and confirms

　　the amounts of payments due. Regardless, this carries SOX auditing implications. You need to document and track the steps required to record the wire or check as “received.” You’ll also want a complete timeline for receiving the payment and appropriate sign-offs that all payments have been received and shares can be released for delivery.

　　SOX auditors also look for detailed instructions on balancing cash due from brokers with the actual cash received. This is a time-sensitive process and calls for specific procedures for handling late payments as well.

　　Financial Reporting of Exercises

　　As noted earlier, financial statements are impacted by the dilutive nature of stock awards and option grants. Similarly, the exercises of those grants also affect financial reporting.

　　Auditors will want to ensure that a report of all options exercised balances, verifying the number of shares traded, price received by the grantee, taxes due from the broker, and option costs. SOX auditors will likely check on other matters as well:

　　The total number of shares exercised for the period – by all employees – must match with totals from the transfer agent and option brokers.

　　Accounting and finance professionals must balance the cash due from option activity.

　　There must be proper sign-off for all trades that have been entered and balanced for each time period (typically a day).

　　Employees must receive confirmations of their trades from their employer. Be sure your processes completely capture when those confirmations are issued and how they are delivered and received.

　　Account Updates and Additions

　　As with other important enterprise computing applications, stock plan administration requires you to carefully (and in a timely manner) add new hires and process terminations.

　　Consider a few examples:

　　Address Changes – Employee relocations can impact the company’s obligations with respect to tax withholding and reporting for future transactions that the employees engage in. Stock plan administration must be informed of address changes on a regular and frequent basis.

　　Organizational Changes – Promotions and departmental changes can impact the company’s segment reporting on its stock plans. Stock plan administration records should be updated to reflect recent changes prior to the end of each financial period.

　　Terminations – Terminations of employment can result in ineligible option exercises and financial reporting discrepancies if they are not processed in a timely fashion. You need strict procedures and coordination with human resource professionals to ensure that notifications are made and grace periods (if

　　any) are communicated.

　　Death and Disability – It’s important to capture and verify necessary documentation when establishing death or disability as the cause of termination.

　　Grace periods may be different for various types of terminations.

　　Grace Period Notification – What steps need to be taken to inform all employees of grace periods (ensuring simultaneous and consistent disclosure)?

　　For example, employees with voluntary terminations may have grace periods of 90 days from termination date, while employee terminations resulting from death and disability may have 365 days to exercise vested shares.

　　Leaves of Absence – Whether a leave is taken under the Family Medical Leave

　　Act or another program, your procedures must account for these employees and ensure those leaves comply with the plan’s policies.

　　Tax Authorities – Does your system access tax tables for states from your payroll or HRIS system? If so, what are the procedures for downloading that information? If it’s manually entered, what are your procedures for verifying that it’s correct and up-to-date? If you have international employees, how are you notified of changes in local tax regulations? What’s more, auditors will also check to ensure you’re tracking income from stock plan transactions as part of each employee’s FICA limitations.

　　How Can We Help?

　　E*TRADE FINANCIAL Corporate Services provides the products and services you need to comply with the Sarbanes-Oxley Act and meet the increasingly stringent requirements of

　　SOX auditors. Whether you outsource administration to our Certified Equity Professionals or manage your stock plan in-house with Equity Edge, we support all of your regulatory, record keeping, and reporting needs. For more information about products and services, visit our

　　Web site at corpservices.etrade.com or e-mail us at corpservices@etrade.com.

　　Appendix A:

　　An Abridged Checklist of SOX Compliance Issues for Stock-Plan Administrators

　　A. Application Controls

　　What are the procedures for granting access rights to the option/award database?

　　Are there unique log-in credentials (i.e., general log-in names such as “admin” not allowed)?

　　Are passwords required? What is the minimum length? Do they expire?

　　What is the lockout policy and who enforces it?

　　What is the extent of access rights? Is the ability to delete data, controlled and monitored?

　　Who has administrator rights to create additional users, etc.?

　　What are the back-up policies for the database? Are back-ups done automatically and are they stored off-site?

　　B. Data Controls

　　1. Option/Award Grants

　　Who has signature authority to generate grants? Do you have an organizational chart that defines who can authorize option grants?

　　Create a matrix that defines the number of shares that can be granted for each level and the corresponding signature authority.

　　When is a second approval signature necessary?

　　What procedures must be followed when granting to officers and directors?

　　Are there additional approvals and procedures for granting to reporting officers and directors and do you notify the department that files the Form 4 with the SEC?

　　What are the procedures for non-standard grants that do not fit the matrix?

　　How do you import and verify data from other sources?

　　Do you make sure all approvals are in place before processing?

　　What is the turn-around time for processing?

　　What approvals must be provided?

　　Can you generate a report of options granted and balance it against source documents?

　　Do you have signoff procedures for importing options/awards?

　　Do you review options numbers to ensure that no numbers are missing?

　　2. Employee Notification of Grant

　　What are your procedures to ensure all employees receive notification of an option/award?

　　Is a signature required for acceptance and how is this tracked?

　　Do you use electronic notification and a return receipt when opened?

　　For paper copies of grant notices, what controls are in place to ensure the mailing or delivery of notice of grant?

　　How is the receipt of the signature tracked and recorded?

　　What are the follow-up procedures to ensure that all signatures are received and recorded?

　　Where are records kept for audit purposes? Are they easily accessible or under secure conditions?

　　3. Reporting of Grants/Awards

　　Have you defined responsibilities and reporting timelines for reporting to intercompany departments (i.e., Finance/Accounting/Payroll/Financial Reporting) regarding option/awards granted?

　　Do you have reporting logs that show when and where the reports were completed and who received them?

　　Have you prepared a sign-off sheet that shows all reporting has been completedwith dates of completion?

　　4. Exercise Processing and Procedures

　　How are exercises entered into the database?

　　Is the reported price within the range of prices that are recorded for that date?

　　If not what are the steps for correcting?

　　If electronic files reporting option trades are received from the company’s designated brokers, how are the files accessed? Who is responsible for processing?

　　What is the timeline for processing the file?

　　Are there balancing procedures and are they reviewed by someone other then the processing administrator?

　　How do you manually enter information for exercises? How is the information received?

　　Is an exercise form required (with or without employee authorization)?

　　What information is needed to process the trade? E-mail or fax of employeesigned authorization should include:

　　o Name

　　o ID number

　　o Option number

　　o Number of shares traded

　　o Type of exercise (same-day sale or cash, etc).

　　o Delivery instructions

　　o Price the shares were sold for

　　What is the timeline for processing manual trades?

　　Is there a sign-off that these trades in fact have been processed correctly?

　　5. Recording and Reporting Officer Transactions

　　What is the pre-approval process?

　　o Who can approve exercises?

　　o What forms are required prior to processing?

　　o Electronic or paper approval?

　　o Who records the transaction, creates Form 4, and files it?

　　Are there black-out (blocking) periods?

　　o Which employees are subject to them? Who decides when an employee is blocked?

　　o What is the notification of black-out (blocking)? How is it communicated to the employees?

　　6. Transfer Agent/Broker Reporting Process

　　What are your procedures for notifying the transfer agent that shares are authorized for issuance and the respective delivery instructions?

　　How do you ensure that the required funds have been received and that all paperwork is complete with proper control numbers recorded and delivery information?

　　Do you track authorized signatures for transfer requests?

　　Broker procedures

　　Generate and transmit reports and tax files to brokers confirming payment amounts due.

　　Do you have necessary steps to record the wire or check as being received?

　　What is your timeline for receiving the payment?

　　Do you have a sign-off sheet confirming all payments have been received?

　　Settlement tracking

　　What are your detailed instructions for balancing cash due from brokers with actual cash received?

　　How do you handle late settlements?

　　7. Reporting of Exercises

　　Create a report of exercised options. This should verify number of shares exercised, sale proceeds (if any), purchase price, and taxes due.

　　The total shares exercised must equal the total issued shares reported by the transfer agent. Records for shares that have been sold to cover the cost of the exercise should be balanced against the broker’s records.

　　Reconcile capital accounts to balance cash due from option activity.

　　Create a sign-off sheet that all trades have been entered and balanced for the trade date.

　　Create updated reports after all transactions are recorded for the day, including grants, employee status changes, and exercises.

　　When do you issue confirmations to employees and how are they delivered?

　　8. Account Updates/Additions

　　What are your procedures for entering new hires, address changes, and organizational changes into your stock plan database?

　　How do you receive and process terminations?

　　How do you process late terminations?

　　What documentation is required before coding an account with death or disability as termination reason?

　　Where do you keep information on involuntary terminations? Who is the contact person?

　　What steps do you take to inform employees of grace periods?

　　Are tax authorities downloaded from payroll or human resource systems? What are the procedures for processing the downloads? If they are manually entered, where does the data come from, how is it verified, and what steps are taken to ensure that it is correct?

　　Are you tracking year-to-date income for FICA purposes? Where does that information come from and how often is it updated?

　　What is your company leave-of-absence policy, who enforces it, and what signatures are necessary to process a leave?

　　E*TRADE FINANCIAL Corporate Services

　　135 East 57th Street

　　New York, NY 10022

　　corpservices@etrade.com

　　1-800-783-3388

　　Copyright ? 2004 E*TRADE FINANCIAL Corporate Services, Inc. All rights reserved.

　　The information in this article is of a general nature and is intended merely as summary of the relevant laws, regulations, principles, and standards. The contents are neither designed nor intended to be relied upon, and should not be considered, as specific legal or accounting advice. The examples in this article have been simplified for presentation to a large audience.

　　Your company’s stock plan and other arrangements involving stock compensation may include features that cause the principles described in this article to apply differently.

　　Consult your own advisors before deciding what, if any, course of action to take in your own particular situation.