I am getting a major headache here, please help. I am under the impression that email record retention rules are going to be eventually provided by the SEC for public companies.
Is this something in SOX, because I have searched SOX and couldn't find anything pertaining to email...
Thanks...

The SEC has retention requirements now under the Securities Exchange Act of 1934, Rule 17a-4 and associated rules such as NYSE Rule 440 and NASD Rule 3110 and NYSE Rule 342 and NASD Rule 3010 (maintain and enforce a supervisory system to assure compliance with NASD and NYSE rules and the federal securities laws relating to retention of electronic communications). This group of cites were ones stated in an enforcement action. They are directly/indirectly addressing this.

Thanks Andy, this is what an examiner sent me. Also, advised us to get counsel's opinion:

Information about Section 802 of the Sarbanes-Oxley Act of 2002


A. Statutory Provisions. Section 802 added two new federal criminal law provisions, which are codified at 18 U.S.C. §§ 1519 and 1520. Set forth below is U.S. Department of Justice information about Section 802.
Field Guidance on New Criminal Authorities
Enacted in the Sarbanes-Oxley Act of 2002 (H.R. 3763)
Concerning Corporate Fraud and Accountability
Excerpted from http://www.usdoj.gov/ag/readingroom/sarox1.htm
Section 802. Criminal Penalties for Altering Documents
Previous law: Prior to the Sarbanes-Oxley Act of 2002, anyone who "corruptly persuades" others to destroy, alter or conceal evidence can be prosecuted under 18 U.S.C. § 1512. Section 1512 reaches destruction of evidence with intent to obstruct an official proceeding which may not yet have been commenced. However, Section 1512 does not reach the "individual shredder." While prosecution of obstruction under 18 U.S.C. § 1505 does not require "corrupt persuasion," it does require the existence of a pending proceeding. In addition, existing law does not explicitly address the retention of accounting work papers for a fixed period of time.
Amendment: Section 802 adds two new criminal provisions, 18 U.S.C. §§ 1519 and 1520. Section 1519 expands existing law to cover the alteration, destruction or falsification of records, documents or tangible objects, by any person, with intent to impede, obstruct or influence, the investigation or proper administration of any "matters" within the jurisdiction of any department or agency of the United States, or any bankruptcy proceeding, or in relation to or contemplation of any such matter or proceeding. This section explicitly reaches activities by an individual "in relation to or contemplation of" any matters. No corrupt persuasion is required. New Section 1519 should be read in conjunction with the amendment to 18 U.S.C. 1512 added by Section 1102 of this Act, discussed below, which similarly bars corrupt acts to destroy, alter, mutilate or conceal evidence, in contemplation of an "official proceeding."
Accountants who fail to retain the audit or review workpapers of a covered audit for a period of 5 years will violate Section 1520, which creates a new felony, with a maximum period of incarceration of ten years. Under rulemaking authority granted in Section 1520(b), the SEC will promulgate rules relating to the retention of workpapers and other audit or review documents.
New 18 U.S.C. § 1519 provides:
Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.

New 18 U.S.C. § 1520 provides:
(a)(l) Any accountant who conducts an audit of an issuer of securities to which section l0A(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78j-l(a)) applies, shall maintain all audit or review workpapers for a period of 5 years from the end of the fiscal period in which the audit or review was concluded.
(2) The Securities and Exchange Commission shall promulgate, within 180 days, after adequate notice and an opportunity for comment, such rules and regulations, as are reasonably necessary, relating to the retention of relevant records such as workpapers, documents that form the basis of an audit or review, memoranda, correspondence, communications, other documents, and records (including electronic records) which are created, sent, or received in connection with an audit or review and contain conclusions, opinions, analyses, or financial data relating to such an audit or review, which is conducted by any accountant who conducts an audit of an issuer of securities to which section l0A(a) of the Securities Exchange Act of l934 (15 U.S.C. 78j-l(a)) applies....
(b) Whoever knowingly and willfully violates subsection (a)(l), or any rule or regulation promulgated by the Securities and Exchange Commission under subsection (a)(2), shall be fined under this title, imprisoned not more than l0 years, or both.
(c) Nothing in this section shall be deemed to diminish or relieve any person of any other duty or obligation imposed by Federal or State law or regulation to maintain, or refrain from destroying, any document.

* * *
[End of excerpt]

B. SEC Regulations

The SEC issued regulations as required by Section 802 of the Sarbanes-Oxley Act. The rulemaking notice and text of new rule 2-06 to Regulation S-X is available at the SEC’s Internet site at:
http://www.sec.gov/rules/final/33-8180.htm

An excerpt of the rulemaking notice is set out below.
Final Rule:
Retention of Records Relevant to Audits and Reviews
Securities and Exchange Commission
17 CFR Part 210
[Release Nos. 33-8180; 34-47241; IC-25911; FR-66; File No. S7-46-02]
RIN 3235-AI74
Retention of Records Relevant to Audits and Reviews
Agency: Securities and Exchange Commission.
Action: Final rule.
Summary: We are adopting rules requiring accounting firms to retain for seven years certain records relevant to their audits and reviews of issuers' financial statements. Records to be retained include an accounting firm's workpapers and certain other documents that contain conclusions, opinions, analyses, or financial data related to the audit or review.
Dates: Effective Date: March 3, 2003. Compliance Date: Compliance is required for audits and reviews completed on or after October 31, 2003.
* * *
I. Executive Summary
As mandated by section 802 of the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley Act" or "the Act"),1 we are amending Regulation S-X to require accountants who audit or review an issuer's financial statements to retain certain records relevant to that audit or review. These records include workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which are created, sent or received in connection with the audit or review, and contain conclusions, opinions, analyses, or financial data related to the audit or review. To coordinate with forthcoming auditing standards concerning the retention of audit documentation, the rule requires that these records be retained for seven years after the auditor concludes the audit or review of the financial statements, rather than the proposed period of five years from the end of the fiscal period in which an audit or review was concluded. As proposed, 2 the rule addresses the retention of records related to the audits and reviews of not only issuers' financial statements but also the financial statements of registered investment companies.
II. Discussion Of Final Rule
Section 802 of the Sarbanes-Oxley Act3 is intended to address the destruction or fabrication of evidence and the preservation of "financial and audit records."4 We are directed under that section to promulgate rules related to the retention of records relevant to the audits and reviews of financial statements that issuers file with the Commission.
Section 802 states that the record retention requirements should apply to audits of issuers of securities to which section 10A(a) of the Securities Exchange Act of 1934 ("Exchange Act") applies. The term "issuer" in this context is defined in section 10A(f) of the Exchange Act to include certain entities filing reports under that Act and entities that have filed and not withdrawn registration statements to sell securities under the Securities Act of 1933.5 As adopted, the record retention requirements also apply to any audit or review of the financial statements of any registered investment company.6 We believe that it is important for these record retention requirements, like our other record retention requirements, to apply consistently with respect to all registered investment companies, regardless of whether they fall within the periodic reporting requirements of the Exchange Act.7

* * *

TEXT OF AMENDMENTS
In accordance with the foregoing, Title 17, Chapter II of the Code of Federal Regulations is amended as follows:
1. The authority citation for Part 210 is revised to read as follows:
Authority: 15 U.S.C. 77f, 77g, 77h, 77j, 77s, 77z-2, 77aa(25), 77aa(26), 78j-1, 78l, 78m, 78n, 78o(d), 78u-5, 78w(a), 78ll(d), 79e(b), 79j(a), 79n, 79t(a), 80a-8, 80a-20, 80a-29, 80a-30, 80a-31, 80a-37(a), unless otherwise noted.
2. By adding § 210.2-06 to read as follows:
§ 210.2-06 Retention of audit and review records.
(a) For a period of seven years after an accountant concludes an audit or review of an issuer's financial statements to which section 10A(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78j-1(a)) applies, or of the financial statements of any investment company registered under section 8 of the Investment Company Act of 1940 (15 U.S.C. 80a-8), the accountant shall retain records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which:
(1) Are created, sent or received in connection with the audit or review, and
(2) Contain conclusions, opinions, analyses, or financial data related to the audit or review.
(b) For the purposes of paragraph (a) of this section, workpapers means documentation of auditing or review procedures applied, evidence obtained, and conclusions reached by the accountant in the audit or review engagement, as required by standards established or adopted by the Commission or by the Public Company Accounting Oversight Board.
(c) Memoranda, correspondence, communications, other documents, and records (including electronic records) described in paragraph (a) of this section shall be retained whether they support the auditor's final conclusions regarding the audit or review, or contain information or data, relating to a significant matter, that is inconsistent with the auditor's final conclusions regarding that matter or the audit or review. Significance of a matter shall be determined based on an objective analysis of the facts and circumstances. Such documents and records include, but are not limited to, those documenting a consultation on or resolution of differences in professional judgment.
(d) For the purposes of paragraph (a) of this section, the term issuer means an issuer as defined in section 10A(f) of the Securities Exchange Act of 1934 (15 U.S.C. 78j-1(f)).

* * *

C. Additional Information

See:

1. American Bar Association information at http://www.abanet.org/buslaw/corporateresponsibility/clearinghouse/03spring/36/new_criminal.pdf

2. “Legal Backgrounder” article on Electronic Discovery from the Jones Day law firm Internet site at
http://www1.jonesday.com/FILES/tbl_s38News/UploadMaterial1322/253/8-9-02tambe.pdf

3. The State Bar of Texas published “White Collar Crime for the Civil Practitioner 2002”, which has an informative article entitled “Legalized Destruction: Which Documents Can Be Destroyed and Which Cannot?” by attorney Weston C. Loegering. See
http://www.texasbarcle.com/materials/books/139/toc.htm

Maria, we are looking at this now as well. It does relate to SOX which required changes to the federal sentencing guidelines related to destruction of records needed for a law suit or investigation. The expectation level seems to include policies and procedures, and so forth, to demonstrate compliance. We are reviewing our archiving and retrieval methods but need to consider instructions to staff regarding emails etc.

Thanks, Kath, I also PM'd you...

Quote:

---

The SEC has retention requirements now under the Securities Exchange Act of 1934, Rule 17a-4 and associated rules such as NYSE Rule 440 and NASD Rule 3110 and NYSE Rule 342 and NASD Rule 3010 (maintain and enforce a supervisory system to assure compliance with NASD and NYSE rules and the federal securities laws relating to retention of electronic communications). This group of cites were ones stated in an enforcement action. They are directly/indirectly addressing this.

---

This is freaky. I was just discussing with a SVP no more than an hour ago what the requirements are for imaging, indexing, storing, and retrieving brokerage records under SEC rule 17-4(f). We do some custom imaging, so being compliant with these requirements is key. Thanks for the cross-reference to the SOX requirements - I hadn't thought about those!

I have been looking at this (not in depth yet) for our IT people too. The new rules set a retention period for accountants and their audit papers and criminalize the destruction of evidence but I don't think these rules establish any new retention periods for the actual public company. Seems to me we can keep our existing retention schedules that are driven by BSA, fair lending, etc. (and good faith destruction schedule!) and establish policies regarding no destruction if an investigation is started.

I also found this handy article on record retention:
Perkins Coie-After SOX