CFO Fraud, Privilege, and the Audit Representation Letter
Harborline Medical Devices' in-house counsel, Priya, learns from a controller that the CFO capitalized $3.2 million of operating expenses to keep the company within a bank covenant. The audit committee chair is the CFO's longtime friend. The CEO tells Priya to 'keep it in legal' and not to tell the outside auditors, who are requesting a management representation letter in five days. Priya also learns the CFO threatened to fire a whistleblower who emailed the board. Harborline is a U.S. public company. Priya reports to the CEO, and the general counsel position is vacant. She has not yet confirmed the accounting treatment with the controller's documents. The CFO controls the finance team and has asked Priya to characterize the capitalization as a timing adjustment.
1. What are Priya's confidentiality and reporting obligations, and can she keep the CFO's conduct inside legal?
Read the worked answer
The attorney-client privilege belongs to Harborline, not to the CFO. Communications with Priya about company accounting may be privileged, but the crime-fraud exception can strip privilege if the communication furthers an ongoing fraud. Priya cannot use privilege as a shield to keep the board ignorant. Under SEC attorney-conduct rules and state professional responsibility rules, if she knows of a material violation, she must report to the CEO or chief legal officer and, if no appropriate response, to the audit committee or board. 'Keep it in legal' is not an appropriate response. If the audit committee is conflicted because its chair is the CFO's friend, Priya should escalate to independent directors or outside counsel. She may disclose confidential information to the extent necessary to prevent the fraud, and she should document the report and the response.
2. What should Priya do before the outside auditors request the management representation letter?
Read the worked answer
Priya must not sign or support a representation letter that she knows is false. The auditors are entitled to accurate information about the capitalization issue, and misleading them could violate securities law and professional rules. She should verify the controller's documents, quantify the $3.2 million, and determine whether the covenant breach would be material. She should tell the CEO that the company cannot make a clean representation without disclosure and that the audit committee must be informed. If management refuses, she should report to the audit committee or independent directors, and if they fail to act, consider withdrawing from representation or disclosing to the SEC as permitted by the rules. She should preserve records, avoid drafting misleading letters, and ensure the whistleblower is protected.
3. How should Priya handle the CFO's threat against the whistleblower and her own position?
Read the worked answer
Retaliation against a whistleblower who reported to the board can violate SOX and Dodd-Frank. Priya should tell the CFO and CEO to stop, document the threat, and report it to the audit committee or independent directors. She should not investigate alone if the CFO controls evidence. Her duty runs to the company, not to the CEO, so she should recommend independent counsel and a disclosure plan. If the board authorizes concealment, Priya must consider withdrawal, a noisy withdrawal if required, or a report to the SEC. She should also protect her own documentation and avoid any statement that could be seen as aiding a cover-up. The best course is documented escalation, remediation, and a clear record that she advised disclosure. She should not let loyalty to the CEO override the company's legal obligations.