The U.S. Securities and Exchange Commission (SEC) recently settled an enforcement action in which it found that a public company failed to develop and implement adequate controls around a stock buyback program. The action stands as a helpful reminder that a public company must maintain and follow appropriate procedures to ensure that it does not trade when the company or its executives are in possession of material nonpublic information (MNPI).

On October 15, 2020, the SEC settled charges against Andeavor LLC (Andeavor) for failing to implement internal controls sufficient to ensure that stock buybacks were executed in accordance with a corporate trading policy that prohibited the company from repurchasing stock while in possession of MNPI. Andeavor agreed to pay a $20 million penalty to settle the charges.

According to the settlement order, in March 2017, U.S. energy companies Andeavor and Marathon Petroleum Corporation (Marathon) commenced discussions about a potential business combination. In October 2017, after months of promising negotiations, the companies suspended their merger talks; but in January 2018, the companies’ CEOs agreed that they would recommence their discussions on February 23, 2018.

On February 21, 2018, Andeavor’s CEO directed the company’s CFO to initiate a Rule 10b5-1 plan to repurchase $250 million of Andeavor shares. On February 22, the company’s legal department approved the buyback plan. And a day later, on February 23, Andeavor began repurchasing its stock on the open market. (Ultimately, Andeavor repurchased 2.6 million shares of its stock at an average price of $97 per share.)

The same day Andeavor launched its stock purchases under the buyback plan, Andeavor and Marathon recommenced their discussions about a possible business combination. Two months later, on April 30, Andeavor publicly announced that it would be acquired by Marathon in a $23 billion merger that valued Andeavor at over $150 per share — significantly higher than the price(s) at which it bought back shares under the Rule 10b5-1 plan.

According to the SEC, the buybacks were approved through an “abbreviated and informal process,” and the legal department’s conclusion that the merger talks did not constitute MNPI was “based on a deficient understanding of all relevant facts and circumstance regarding the two companies’ discussions.” Notably, the process did not involve consultation with Andeavor’s CEO, who was in the best position to evaluate the likelihood that Andeavor and Marathon would combine — an event that undoubtedly would be material to Andeavor’s investors in deciding whether or not to sell their shares.

The SEC found that these deficiencies in the vetting process stemmed from inadequate internal accounting controls. “In short,” the settlement order reads, “Andeavor did not have internal accounting controls that provided reasonable assurance that its buyback would be executed in accordance with its Board’s authorization.”

The SEC’s director of enforcement commented on the importance of developing robust procedures around stock buybacks. “Companies must have reasonable controls in place to ensure buybacks are made in accordance with management’s authorization,” she said. “As described in the SEC’s order, Andeavor’s Board of Directors set clear lines around when the company could buy back its shares, but Andeavor failed to have a process that was reasonably designed to ensure that it stayed within those lines.”

Another senior official from the SEC’s Enforcement Division, noted, “While buyback can be an important part of a company’s capital allocation plan, this case makes clear the importance of effective controls when a company is contemplating transactions with its shareholders.”

Companies considering potential stock buybacks should review — and follow — relevant internal accounting controls. Failing to do so could result in a significant penalty, reputational harm, and other collateral consequences. Companies should seek advice of counsel where there are questions about the adequacy or implementation of their procedures or the materiality of nonpublic information in the company’s possession.