A Primer For New Iran-Related Disclosures: Correspondence By The SEC's Office Of Global Security Risk

As companies, including foreign private issuers, evaluate the scope and level of detail that the recently enacted Iran Threat Reduction and Syria Human Rights Act of 2012 (ITRSHRA) requires in SEC filings,1 they may want to consider examples from published comment-letter correspondence triggered by the SEC's Office of Global Security Risk (OGSR). OGSR is an office within the Division of Corporation Finance. For nearly a decade, OGSR has been monitoring disclosures related to business activities involving U.S.-sanctioned countries, as well as prompting additional disclosures from issuers about those activities (or the lack thereof).

For example, in August 2012, International Business Machines Corp. received a comment letter from OGSR asking the company to address news reports that a Chinese company was selling IBM products to Iran, as well as reports of a Department of Commerce investigation into that same Chinese company.2 The letter also requested a general update on IBM's contacts with Syria, Sudan, and Cuba. IBM's detailed response prompted a reply by OGSR confirming that its inquiry had ended. Then, consistent with SEC policy to publish comment letters to the EDGAR public filings database as quickly as 20 business days following the SEC staff's completion of a filing review,3 all of this correspondence was made available to the public.

IBM's correspondence is just one example of correspondence with OGSR that can serve as a reference for new ITRSHRA disclosures. Although OGSR's comments to date have focused on a materiality standard and ITRSHRA requires disclosure of otherwise immaterial activities involving Iran, published OGSR correspondence may provide helpful guidance as companies evaluate how to address, and how to present sufficient context to help the SEC and investors understand, the newly required disclosures.

After describing the context in which OGSR was created and now functions, this article highlights several other examples, discussing how OGSR monitors disclosures in SEC filings concerning business conducted with and in sanctioned countries.

Office of Global Security Risk

The Office's Origins

OGSR was created in 2004, at the direction of Congress, with a mission to monitor and then seek disclosure from companies that appear to be doing business in sanctioned countries.4 In a report accompanying an appropriations bill for the fiscal year ending in 2004, the House Committee on Appropriations stated that it believed "a company's association with sponsors of terrorism and human rights abuses, no matter how large or small, can have a material adverse effect on a public company's operations, financial condition, earnings, and stock prices, all of which can negatively affect the value of an investment."5 Citing the protection of American investors, the Committee directed the SEC to create an Office of Global Security Risk within the Division of Corporation Finance that would:

(1) establish a process to identify U.S.-listed companies operating in terrorist-sponsoring states;

(2) ensure that those companies disclose such activities to investors;

(3) implement enhanced disclosure requirements based on "the asymmetric nature of the risk to corporate share value and reputation stemming from business interests in these higher risk countries";

(4) coordinate with other Federal government agencies to share relevant information; and

(5) initiate a global dialogue to ensure that U.S.-listed foreign corporations properly disclose their activities in terrorist-sponsoring states to American investors.6

Today, OGSR's website states that it works closely with the Division of Corporation Finance to "monitor whether the documents public companies file with the SEC include disclosure of material information regarding global security risk-related issues."7 Evidence of OGSR's activity confirms that affiliation. Dozens of household-name companies have received letters from OGSR in recent years, asking the companies to detail contacts with sanctioned countries – including Iran – and essentially to justify the prior lack of disclosure by explaining why those contacts were not material.8

How It Works, What They Watch For

A company's first contact with OGSR typically comes in the form of a comment letter on a recent periodic SEC filing.

TripAdvisor, Inc.'s inquiry began, for example, with a letter commenting on the company's Form 10-K for the 2011 fiscal year.9 "We note that your website enables visitors to book flights to and from Iran, Sudan, and Syria," OGSR wrote in its letter this past summer. The letter asked TripAdvisor to describe the nature and extent of the company's past, present, and anticipated contacts with each of the three countries. It also asked TripAdvisor to discuss whether those contacts "constitute a material investment risk for your security holders."

The fact that an office within the SEC's Division of Corporation Finance wrote to a company based on its independent review of the company's website should not be a surprise. A review of initial OGSR comment letters suggests that OGSR regularly uses a few common sources to monitor companies for undisclosed business with or in sanctioned countries:

- SEC filings. OGSR often makes quite broad references to statements companies have made in their SEC filings. St. Jude Medical Inc., for example, received a letter in 2010 stating: "It appears from information on page 13 [of your Form 10-K for 2010] that you have operations in the Middle East and Africa, regions generally understood to include Iran, Syria, and Sudan."10 As this example shows, even conducting business on certain continents or in a certain region can invite an OGSR inquiry if that business is not specifically described in a company's SEC filings.

- Websites. TripAdvisor's inquiry is one example of OGSR sending a comment letter based on what its staff found on an issuer's website. The comment letter sent to priceline.com Incorporated was another. The Priceline inquiry...