information or opportunity for consultation, it must bring this deficiency to the attention of the board. sarbanes - oxley act now let's turn to sarbanes - oxley. i am not going to dwell on the specifics of the act. you most likely already know the details of this important piece of legislation including, in particular, the provisions directly affecting attorneys practicing before the securities and exchange commission. what i'd like to focus on is the purpose of the act. at its core, the sarbanes - oxley act is a call to return to the basics 4 / 6 that we have been discussing. simply stated, the current status quo for corporate governance is unacceptable and must improve. this message is applicable to both public and private companies alike and affects everyone within a company, as well as outside professionals hired by the company. as in - house or independent counsel you should fulfill your duties with the competence, integrity, and independence expected of members of the bar and be sure that any material concerns that you have concerning the company's conduct are raised to appropriate levels within the organization. on a broader level, the role for legal counsel, in - house and outside, also is to ensure that the client understands the messages of sarbanes - oxley and that all areas within a company are taking appropriate steps to fulfill their obligations. to accomplish this task, legal professionals must become engaged in the mechanisms of internal controls, ensure that they receive prompt, comprehensive information from management, and have adequate access to the appropriate level of management and the board to be able to offer useful and timely counsel. the role of legal professionals in many recent cases, including the fact patterns i described a little earlier, companies did not take adequate steps to prevent the problem behavior in the first instance, and the companies'accountants, auditors and counsel were not asked to assist, were not able to assist, or were simply not actively engaged in foreseeing, identifying or addressing problems as they developed. as legal representatives to various corporate entities, you are charged with making sure that your clients understand the basic need to put into place strong internal controls, state - of - the art accounting practices, and robust corporate governance systems. you also need to make sure that your clients understand potential corporate and individual liabilities in the event that basic functions are not adequately performed. professionals such as yourselves can do a number of things to participate in effective corporate governance. when a problem rises to the level of a formal enforcement action

basics of internal controls. it is worth stating that many of the problems at the heart of those headline cases stemmed from violations of the fundamental tenets of internal control, particularly those pertaining to operational risks. based on the headlines, it seems that boards of directors, management, auditors, and counsel need a remedial course in internal controls 101. as corporations grow larger and more diverse, internal controls become more, not less, important to the ability of management and the board to monitor activity across the company. the basics of internal controls for directors and managers are simple. directors do not serve full time, so it is important that they establish an annual agenda to focus their attention on the high - risk and emerging - risk areas while ensuring that there are effective preventive or detective controls over the low - risk areas. a board of directors has the responsibility to understand the legal, reputational, and compliance risks facing an organization ; legal professionals can assist in identifying those risks, quantifying them, and providing expertise in managing them. before a company moves into new and higher - risk areas, the boards of directors and management need assurances that the organization's governance practices are sound and effective. many of the organizations that have seen their reputations tarnished in the past few years have neglected to consider emerging conflicts of interest when the organization adds new products and lines of business. for example, if a customer service or control function must be done in an independent, fiduciary, or unbiased manner relative to other activities, appropriate firewalls must be in place before the product or activity begins. internal controls and compliance are the responsibility of line managers, who must determine the acceptable level of risk in their line of business and assure themselves that the combination of earnings, capital, and internal controls is sufficient to compensate for the risk exposures. however, supporting functions such as legal, accounting, internal audit, and risk management should independently monitor the control processes to ensure that they are effective and that risks are measured appropriately. the results of these independent reviews should be routinely reported to executive management and boards of directors. directors should be sufficiently engaged in the process to determine whether these reviews are in fact independent of the operating areas and whether the officers conducting the reviews can speak freely. where it appears that supporting functions have not been sufficiently involved, directors must demand that management adjust the processes as necessary. if the in - house legal, accounting, or audit staff believes that a supporting function has not been given adequate