A couple of weeks ago, the SEC settled charges against Andeavor, an energy company formerly traded on the NYSE and now wholly owned by Marathon Petroleum, in connection with stock repurchases, authorized by its board in 2015 and 2016. Pursuant to that authorization, in 2018, Andeavor’s CEO directed the legal department to establish a Rule 10b5-1 plan to repurchase company shares worth $250 million. At the time, however, the company’s CEO was on the verge of meeting with the CEO of Marathon Petroleum to resume previously stalled negotiations on an acquisition of Andeavor at a substantial premium. Of course, a 10b5-1 plan typically doesn’t work to protect against insider trading charges if you have material inside information when you establish the plan, and the SEC’s order highlights facts that, from the SEC’s perspective, make the information appear material—at least in hindsight. But wait—this isn’t even an insider trading case. No, it’s a case about inadequate internal controls—at least, that’s how it ended up. Instead of attempting to make a 10b-5 case based on a debatably defective 10b5-1 plan, the SEC opted instead to make its point by focusing on the failure to maintain effective internal control procedures and comply with them. Companies may want to take note that charges related to violations of the rules regarding internal controls and disclosure controls seem to be increasingly part of the SEC’s Enforcement playbook, making it worthwhile for companies to emphasize, in the words of SEC Chair Jay Clayton, the practice of “good corporate hygiene.”

In 2015 and 2016, Andeavor’s board had authorized the company to repurchase shares with a value of $2 billion, subject to compliance by Andeavor with its securities trading policy, which prohibited the company from entering into a Rule 10b5-1 plan to repurchase stock while it was in possession of material non-public information

In March 2017, Andeavor commenced “significant discussions” with Marathon Petroleum regarding a potential business combination, which discussions continued for about seven months and involved a confidentiality agreement and sharing of confidential information, positive synergy analyses, working group meetings, a timetable for the deal with a public announcement planned for four to six weeks out and drafting of a merger agreement. Price discussions involved a premium of between 15% and 20%. In October, concerned about the potential dilutive effect of a stock deal on Marathon’s cash flow per share (CFPS), Marathon’s CEO asked for a suspension of discussions. At the time Andeavor’s CEO agreed to the suspension, he was aware that Marathon had two deals pending in the first quarter of 2018 that could improve Marathon’s share price and favorably affect dilution. As a result, Andeavor’s CEO told the company’s financial advisor “that he believed the discussions would likely resume in early 2018.”

During the hiatus in negotiations, both companies continued to monitor the potential exchange ratios. By late January, the ratios had become more favorable, and Marathon’s CEO suggested a renewal of discussions. Materials developed in preparation for the meeting showed that share price changes since October 2017 would mean that “a deal would likely be immediately accretive to Marathon’s earnings and CFPS at up to a 40% premium to Andeavor’s share price,” suggesting that the dilution would no longer be a concern. On February 14, 2018, Andeavor’s board expressed support for the resumption of discussions looking toward a deal.

A week after Andeavor’s board expressed its support for resumed negotiations, on February 21, Andeavor’s CEO directed the CFO to initiate a share buyback to repurchase $250 million of shares, and the legal department established a Rule 10b5-1 plan to repurchase shares of that value shortly thereafter. However, the SEC alleges, the plan was approved after the legal department concluded, based on insufficient information, that the two companies’ merger discussions “did not constitute material non-public information at that time.” How did that happen? According to the SEC, Andeavor did not have in place adequate internal accounting controls, and instead evaluated the materiality of the merger discussions using “an abbreviated and informal process” that “did not allow for a proper analysis of the probability that Andeavor would be acquired” under a Basic v. Levinson probability/magnitude analysis. More specifically,

“Andeavor’s informal process did not require conferring with persons reasonably likely to have potentially material information regarding significant corporate developments prior to approval of share repurchases. As a result, for example, despite Andeavor’s CEO’s leadership role at the company and the fact that he was the primary negotiator with Marathon, no one involved in Andeavor’s process discussed with him the prospects that Andeavor and Marathon would agree to a deal. Because they did not do so, the company failed to appreciate that the probability of Andeavor’s acquisition by Marathon was sufficiently high at that time as to be material to investors. In short, Andeavor did not have internal accounting controls that provided reasonable assurance that its buyback would be executed in accordance with its Board’s authorization.”

Even though the CEO was the one who directed the establishment of the buyback plan, the SEC concluded that the company’s internal controls should have required those in charge of determining whether there was any material non-public information (which could have precluded the buybacks under the board authorization) to advise and consult with the CEO about the deal’s prospects to better assess its probability.

The discussions with Marathon recommenced on the same day that Andeavor entered into the 10b5-1 plan. Under the plan, Andeavor repurchased shares for almost five weeks at prices ranging from about $90 to $103 per share. Two weeks after the buyback was completed, Marathon agreed in principle to acquire Andeavor at a price over $150 per share.

Although insider trading charges were ultimately not included in the settlement, Andeavor was ordered to pay a penalty of $20 million for violation of Exchange Act Section 13(b)(2)(B), which requires the company “to devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that, among other things, transactions are executed in accordance with management’s general or specific authorizations, and access to assets is permitted only in accordance with management’s general or specific authorization.”