Best Practices for In House Counsel

1. Best Practices for In House Counsel Andrea C. Okun General Counsel Merit Management Group LP

2. Why Are You There? • Many companies combine an officer and outside counsel • reduces fixed costs • maintains flexibility • What is the return on investment and how do you identify the ROI for your company?

3. Identify Your Role • Counsel manages legal portfolio, identifies and mitigates risk, and enables the company to drive revenue. • Handling strategic transactions/contract • Complying with governmental regulations and related filings • Implementing and enforcing risk, governance, and compliance programs • Managing outside counsel and fees • Serving as a trusted advisor to management team • Protecting intellectual property • Handling employment issues • Completing corporate and board of directors’ responsibilities • Putting internal systems in place to reduce expenses and issues that complicate the daily business of the entity

4. Know Your Value to the Company • In House Counsel Should Be Business People First • Inside the organization and vested in its success • Can deal with issues proactively, before they become real problems • Company is the GC’s only client • GC should have global view of business and understand it inside and out • Should have personal relationships with internal teams • Incentives are Different than outside counsel • Frees up internal management to deal with non-legal issues

5. Expectations for Good Counsel • Knows the Business and Daily Challenges • Understands the industry • Internalizes hot buttons • Is a Business Partner and Trusted Advisor • Does not just identify problems – solves them • Understands consequences of decisions beyond the legal department

6. Expectations for Good Counsel • Delivers outstanding legal work • Communicates in business language • Builds internal relationships and maintains external ones • Understands the budget and that counsel is a cost center

7. Counsel as Trusted Advisor • Counsel as ER Doctor • Model Rule of Professional Conduct Rule 1.1 Competence • A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.

8. How Counsel Can Identify and Mitigate Risk • Have established relationship with risk management person (and know whether you’re it). • Learn company’s level of risk tolerance. • Know and understand all insurance policies and have periodic meetings with outside broker to get a briefing on coverages, expirations, calendar those dates • Create disaster plans • Collect all key data (agreements, documents, etc.) • Review and understand listing requirements of relevant exchanges

9. Identifying and Mitigating Risk • Perform line by line audit of SOX requirements, starting with board level and working down • Require D&Os to get preapproval before any corporate securities transaction and get POA to make all filings • For press and public disclosures: • Include appropriate forward looking language • Form a disclosure committee that oversees all public disclosures • Strictly limit who can speak on behalf of entity

10. Compliance Best Practices • Have a clear policy statement and written guidelines • Effective compliance procedures with appropriate review/audits • High level oversight and accountability • Visible senior level commitment • A compliance ethic that is supported both in word and deed by management • Appropriate, customized training to facilitate compliance

11. Compliance Best Practices • NEED BUY IN FROM THE TOP DOWN. • Employees must both respect judgments of legal counsel and fear the repercussions of non-compliance. • Keep it Simple

12. SOX Reporting Requirements • Section 302 of the Sarbanes-Oxley Act of 2002 requires certifications that: • The signing officers have reviewed the report  • There are no material untrue statements or material omissions • The financial statements and related information fairly present the financial condition and the results in all material respects  • Signing officers are responsible for internal controls and have evaluated them and reported findings within the previous 90 days • Must include: • A list of all deficiencies in internal controls and information on any fraud that involves employees who are involved with internal activities • Any significant changes in internal controls or related factors that could have a negative impact on the internal controls

13. SOX Reporting Requirements • Section 307 of the Sarbanes-Oxley Act of 2002 : • Requires reporting of evidence of a material violation of securities law or breach of fiduciary duty or similar violation by the company or any agent thereof to the chief legal counsel or the chief executive officer of the company (or the equivalent thereof) • If the counsel or officer does not appropriately respond to the evidence, it requires the attorney to report the evidence to the audit committee or other committee of the board

14. Reporting versus Confidentiality • Tension between ethics requirements and SOX • Model Rule of Professional Conduct 1.6: Confidentiality Of Information • (a) A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent

15. Exceptions to Confidentiality Model Rule 1.6 Continued (b) A lawyer may reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary: * * * (2) to prevent the client from committing a crime or fraud that is reasonably certain to result in substantial injury to the financial interests or property of another and in furtherance of which the client has used or is using the lawyer's services; (3) to prevent, mitigate or rectify substantial injury to the financial interests or property of another that is reasonably certain to result or has resulted from the client's commission of a crime or fraud in furtherance of which the client has used the lawyer's services; * * * (6) to comply with other law or a court order; or * * * • (c)  A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

16. SOX Reporting Requirements • SOX Section 404 requires management and the external auditor to • report on the company's Internal Control on Financial Reporting (ICFR) • Assess effectiveness of internal controls related to significant accounts and relevant assertions in the context of material misstatement risks; • Understand where in the flow of transactions a misstatement could arise; • Evaluate entity-level controls which correspond to the components of the COSO (Committee of Sponsoring Organizations of the Treadway Commission) framework; • Perform a fraud risk assessment; • Evaluate controls over period end financial reporting and designed to prevent or detect fraud; • Rely on management's work based on factors such as competency, objectivity, and risk; • Conclude on the adequacy of internal control over financial reporting.

17. Counsel Represents the Company • Not the employees, officers, directors • Model Rule 1.13 Organization As Client • (a) A lawyer employed or retained by an organization represents the organization acting through its duly authorized constituents. • (b) If a lawyer for an organization knows that an officer, employee or other person associated with the organization is engaged in action, intends to act or refuses to act in a matter related to the representation that is a violation of a legal obligation to the organization, or a violation of law that reasonably might be imputed to the organization, and that is likely to result in substantial injury to the organization, then the lawyer shall proceed as is reasonably necessary in the best interest of the organization. Unless the lawyer reasonably believes that it is not necessary in the best interest of the organization to do so, the lawyer shall refer the matter to higher authority in the organization, including, if warranted by the circumstances to the highest authority that can act on behalf of the organization as determined by applicable law.

18. Counsel Represents the Company • Upjohn v. United States, 449 U.S. 383 (1981). • Upjohn Warnings = “The Civil Miranda” • Counsel represents the company, not the employee • Purpose of communication is to provide legal advice to company • Anything the employee says is privileged, but the privilege belongs to the Company • Employee has no control over disclosure to 3rd parties • Employee can disclose underlying facts, but not substance of interview • United States v. Ruehle, 583 F.3d 600 (9th Cir. Cal. 2009)

19. How Legal Works with Business • Must engineer sales contracting process to work with and for sales people • Understand company objectives with every contract • Every customer request is a marketing opportunity • Agreements should include: • “Outs” for the company • Alternative remedies • Sunset clauses – but beware of evergreen clauses

20. How Legal Works with Business • Keeping Counsel Apprised: • Periodic meetings between GC and C-Suite • Give Counsel access to board meetings/members • Counsel should have a working database of all contracts • Work with accounting on systems for payment • Discourage business people from keeping private stashes of forms and entering into agreements without counsel