THOMAS S. ZILLY, District Judge.
THIS MATTER comes before the Court on the motion of Defendants Costco Wholesale Corporation ("Costco"), W. Craig Jelinek ("Jelinek"), and Richard A. Galanti ("Galanti"), to dismiss Plaintiffs' Consolidated Amended Complaint for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), docket no. 27, and Defendants' Request for Consideration of Documents Incorporated by Reference, docket no. 29. Having reviewed all papers filed in support of and in opposition to the motion, the Court enters the following order.
Plaintiffs allege violations of the Securities Exchange Act of 1934 ("Exchange Act") and Rule 10b-5 against all Defendants and violations of Section 20(a) of the Exchange Act against the individual Defendants on behalf of themselves and a putative class of shareholders who acquired Costco stock during the period from June 6, 2018 to October 25, 2018. Plaintiffs allege that Costco and the individual corporate Defendants, CEO Craig W. Jelinek and CFO Richard A. Galanti, misrepresented facts about the company's internal controls in connection with its June 6, 2018 and October 4, 2018 public statements and filings.
On June 6, 2018, Costco filed a 10-Q for the quarter ending May 13, 2018. Consolidated Amended Complaint ("AC") ¶¶ 11; 156. In the filing, Costco stated that its internal controls over financial reporting were sufficient, there were no material weaknesses related to its financial reporting, and the company was "currently making and will continue to make, significant technology investments to improve or replace critical information systems and processing capabilities." Id. ¶¶ 11; 159. On October 4, 2018, Costco announced that it "expect[ed] to report a material weakness in internal control[s]" for financial results reported for the 2018 fiscal year. Id. ¶ 12. Costco's stock price dropped from $231.68 to $218.82. Id.
On October 26, 2018, Costco filed its annual 10-K, which described the remediation measures it was planning to undertake to correct the weakness in its internal controls. Id. ¶¶ 13; 128-30. On this news, Costco's stock price dropped again from $226.40 to $218.19. Id. ¶ 14.
Specifically, Plaintiffs allege that at the time of the June 6, 2018 filing, Defendants' internal controls and procedures were "not effective." Id. ¶ 155. Plaintiffs allege Costco had "a material weakness in internal controls over financial reporting." Id. Plaintiffs also allege that the October 4, 2018 statements were false because Defendants failed to disclose the full extent of the problems with access and change controls or what caused them. Id. ¶ 163. Plaintiffs also allege that these false and misleading statements were made intentionally or with deliberate recklessness. Id. ¶¶ 211; 214. Plaintiffs rely on confidential witness statements, the individual Defendants' certifications of public disclosures, later public disclosures, and Defendants' remedial efforts to argue that the Court should infer the Defendants' scienter. Id. ¶¶ 173-183.
Defendants move to dismiss the Amended Complaint. For the reasons set forth in this Order, the Court GRANTS the Defendants' Motions, docket nos. 27 and 29, and dismisses Plaintiffs' claims without prejudice and with leave to amend.
To ensure accurate financial reporting, Costco uses the Internal Control — Integrated Framework, which is issued by the Committee of Sponsoring Organizations of the Treadway Commission ("COSO Framework"). Id. ¶ 62. Costco uses COSO to evaluate internal controls and ensure compliance with SEC regulations. Id. The COSO Framework includes guidelines regarding change and access controls. Id. ¶¶ 63; 67. Change controls are a company's process to add or modify users and devices and install or update IT. Id. Access controls concern a company's ability to control user access to systems based on their "employment status, position, and changes, thereto." Id. ¶ 72. Together, access and change controls ensure the accuracy of the financial reporting process by restricting the ability to change information to only authorized users. Id. ¶ 67. A deficiency in internal controls could, for example, allow an IT user without knowledge of accounting requirements to make a change that impacts the data used for financial reporting. Id. ¶¶ 66-74.
Plaintiffs base their securities claims on six allegedly false public statements.
On June 6, 2018, Defendants filed its 3Q2108 Form 10-Q stating:
Pursuant to the Sarbanes Oxley Act of 2002 ("SOX"), Defendants Jelinek and Galanti each certified the 3Q2018 Form 10-Q filed June 6, 2018 stating:
In the same 10-Q filed June 6, 2018, Defendants stated: "
One of the risk factors in Costco's 2017 Form 10-K stated that the company was "
On October 4, 2018, Defendants issued a Form 8-K and accompanying press release regarding the material weakness in internal controls stating:
That same day, Defendants Galanti and Jelinek participated in an earnings call with analysts. Defendant Galanti stated:
Costco's stock price dropped on this news from $231.68 on October 4, 2018 to $218.82 on October 5, 2018, a drop of 5.55%. Id. ¶ 186.
On October 26, Costco filed its annual 10-K report, which stated that "as of September 2, 2018," the company concluded that "the disclosure controls and procedures were not effective as of such date due to a material weakness in internal control over financial reporting." Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 29). Specifically, Costco "identified a material weakness in internal control[s] related to ineffective information technology general controls [] in the areas of user access and program change-management over certain information technology [] systems that support the Company's financial reporting processes." AC ¶ 128.
As part of the 10-K report, Costco's independent registered public accounting firm, KPMG, provided further explanation of the material weakness. Id. ¶ 131. KPMG stated that the control deficiencies were a result of "IT control processes [that] lacked sufficient documentation; insufficient knowledge and training of certain individuals with IT expertise; and risk-assessment processes [that were] inadequate to identify and assess changes in IT environments and personnel that could impact internal control over financial reporting." Id. On October 26, 2018, Costco's stock price dropped from $226.40 to $218.19-3.63%. Id. ¶ 14.
Lead Plaintiff brings this action on behalf of himself and all persons and entities that purchased Costco securities during the period from June 6, 2018 through October 25, 2018 and were damaged. Id. ¶ 195. Plaintiffs now allege that the six statements made in Costco's public filings and by Costco senior executives constitute securities fraud under (1) Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b), and Rule 10b-5 promulgated thereunder by the SEC at 17 C.F.R. § 240.10b-5; and (2) Section 20(a) of the Exchange Act, 15 U.S.C. § 78t(a). Plaintiffs allege that these six false and misleading statements had the effect of artificially inflating Costco's stock, resulting in harm to the putative class members when Defendants' misrepresentations became apparent to the market, and the price of Costco stock dropped. Plaintiffs rely principally on the allegations of seven confidential witnesses to allege falsity and scienter. Id. ¶¶ 23-30; 82-118; 167; 170-72; 177. Plaintiffs also rely on Costco's October 10-K filing to show the falsity of statements in the June 10-Q filing. Id. ¶ 128; Plaintiffs' Opposition to Defendants' Motion to Dismiss, docket no. 33 at 15-16. Specifically, Plaintiffs allege that Costco's Form 10-K for the fiscal year 2018 filed on October 26, 2018 "provided a description of the expensive and widespread remediation measures it was planning to undertake" as further evidence of Costco's false statements during the class period. AC ¶ 136.
Plaintiffs rely on the statements of seven confidential witnesses ("CWs") in the Amended Complaint. A complaint relying on statements from confidential witnesses must pass two hurdles to satisfy the Private Securities Litigation Reform Act ("PSLRA") pleading requirements: (1) the confidential witnesses must be described with sufficient particularity to establish their reliability and personal knowledge, and (2) those statements which are reported by confidential witnesses with sufficient reliability and personal knowledge must themselves be indicative of scienter. Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 995 (9th Cir. 2009) (citing In re Daou Sys., Inc. Sec. Litig., 411 F.3d 1006, 1015-16, 1022 (9th Cir. 2005)).
The Court must consider whether Plaintiffs have "provided sufficient detail about the confidential witness' position within the defendant company" to establish the reliability and personal knowledge of the confidential witnesses. Zucco Partners, LLC, 552 F.3d at 995. Plaintiffs must plead with "substantial specificity" how confidential witnesses "came to learn of the information they provide in the complaint." In re Northpoint Commc'ns Grp., Inc. Sec. Litig., 184 F.Supp.2d 991, 1000 (N.D. Cal. 2001). The court must be able to tell whether a confidential witness is speaking from personal knowledge, or "merely regurgitating gossip and innuendo." In re Commtouch Software Ltd. Sec. Litig., 2002 WL 31417998, at *3 (N.D. Cal. July 24, 2002). "The Court can look to the level of detail provided by the confidential witness, the corroborative nature of other facts alleged (including from other sources), the coherence and plausibility of the allegations, the number of sources, the reliability of the sources, and similar indicia." In re Metawave Commc'ns Corp. Sec. Litig., 298 F.Supp.2d 1056, 1068 (W.D. Wash. 2003) (quoting In re Cabletron Sys., Inc., 311 F.3d 11, 29-30 (1st Cir. 2002)).
The Court concludes that Plaintiffs describe CWs 1, 5, 6, and 7 with sufficient particularity to establish their reliability and personal knowledge regarding at least some of Plaintiffs' allegations. The Amended Complaint provides little support for any significant reliance on CWs 2 and 4. The Court does not rely on CW 3 primarily because that witness did not work at Costco during the relevant period.
The Amended Complaint describes CW 1 as a former Senior Compliance Analyst employed by Costco from 2015 to September 2018. Id. ¶ 24. CW 1 was three reporting levels below the Vice President ("VP") of Information Security and Compliance. Id. His responsibilities primarily included compliance with privacy regulatory regimes. Id.
CW 1 stated that the compliance team was "spread thin," understaffed, and suffered from high turnover and employee burnout. Id. ¶¶ 83-85. For example, CW 1 stated that compliance work in some departments occurred in "3-4 month fire drills," after which the department would return to minimal staffing. Id. ¶ 84. CW 1 stated that the operating systems were also antiquated, which made it difficult to hire employees knowledgeable about those systems. Id. ¶ 84. CW 1 believed that "there were never enough compliance personnel for a company the size of Costco." Id.
CW 1 stated that IT employees were not well trained. For example, many employees did not know about or did not use Archer, the system for managing governance, risk management, and compliance issues. Id. ¶¶ 102-103. CW 1 did not know about Archer until his second year at the company. Id. ¶ 103.
Most SOX compliance work fell to one employee—Barbara Egner ("Egner"). Id. ¶ 24. CW 1 described Ms. Egner as "super frustrated" with the SOX compliance process because "management didn't want to listen." Id. ¶ 83. Instead, according to CW 1, VPs would ask if they could "get by" without remediating issues. Id.
CW 1 also detailed specific user access and change management issues. CW 1 retained access to a system long after he transferred departments and had to track down management and "fight" to get access revoked. Id. ¶ 106. CW 1 stated that Costco managed user access to systems through a Google form system, which made it difficult to tell whether the work actually took place. Id. CW 1 also stated that Costco lacked a policy revoking access to email on personal cell phones when employees left the company. Id. ¶ 107. As of March 2019, CW 1 still had access to all his old Costco work emails, despite leaving the company in September of 2018. Id.
CW 1 provided insight about Costco's review of its IT processes and compliance with the European Union's General Data Protection Regulation ("GDPR"). CW 1 attended regular meetings with VP level employees and outside auditors in which they discussed how to comply with GDPR. Id. ¶ 86. One of the weaknesses CW 1 found in addressing GDPR compliance was related to internal controls and "how easy it was for anyone to log into a particular system." Id. The GDPR compliance team found "the same kind of weaknesses . . . throughout Costco's IT ecosystem." Id. When presented with possible solutions for the issues that came up in the GDPR compliance review, "senior management" stated the measures were "too costly" or required "too much headcount." Id. ¶ 86.
From the meetings with VP employees and auditors, CW 1 helped prepare materials for the management team to present at GDPR board meetings. Id. ¶ 105. Those materials included data on GDPR and SOX compliance. Id. Management used that data to create PowerPoints for the board, which met monthly in early 2018. Id. CW 1 did not attend those meetings but believed that Defendants Jelinek and Galanti discussed and were "highly engaged" with internal control problems at those meetings. Id. ¶ 104. CW 1 believed that Costco's weak internal controls got Defendants Jelinek and Galanti's attention. Id.
CW 2 was employed from 2015 until "mid-2018" and "reported through a chain" up to the VP of Information and Compliance. Id. ¶ 25. CW 2 is alleged to have "insight into issues affecting IT security." Id. CW 2's statements vaguely allude to "room for improvement." Id. ¶ 87. CW 2 also characterized Costco's attitude towards the IT Department as a "necessary evil" and an "afterthought." Id.
CW 2's statements are vague—without specific examples or dates. The precise dates of CW 2's tenure at Costco are also not clear, and Plaintiffs do not clearly allege that CW 2 worked during the class period. "Any inference that pre-Class Period practices continued during the Class Period amounts to unsubstantiated speculation," City of Roseville Emps.' Ret. Sys. v. Sterling Fin. Corp., 963 F.Supp.2d 1092, 1135-36 (E.D. Wash. 2013), aff'd, 691 Fed. Appx. 393 (9th Cir. 2017), thus CW 2 lacks a "basis to opine about [Costco's] practices after [he] left the company." In re Downey Sec. Litig., 2009 WL 2767670, at *10 (C.D. Cal. Aug. 21, 2009). The Court gives little weight to CW 2's statements.
CW 3 was employed as a Costco consultant from April 2017 until the end of May 2017—over a year before the class period began. AC ¶ 26. CW 3 reported to various managers and directors working in SAP
Primarily because CW 3 left Costco's employment at the end of May 2017, the Court gives CW 3's statements no weight. In re Downey Sec. Litig., 2009 WL 2767670, at *10 (CWs lack basis to opine about a certain practice after they left the company); City of Roseville Emps.' Ret. Sys., 963 F. Supp. 2d at 1135-36 ("Any inference that pre-Class Period practices continued during the class Period amounts to unsubstantiated speculation."). CW 3's statements are also unreliable because he makes statements that are vague (see AC ¶ 88 stating that there were "a lot of gaps in the company's change management"), and he relies on hearsay statements (see id. stating that "a colleague that remains with Costco informed him").
CW 4 was employed as a contractor for SAP implementation from May 2018 until November 2018 and was two reporting levels below the Project Manager level. Id. ¶ 27. CW 4 was responsible for performing and overseeing quality assurance testing. Id. CW 4 worked on implementing a new "premium" SAP system designed to improve reporting and provide more structure. Id. ¶ 90. Though CW 4 stated that Costco was investing in "premium" systems to improve the IT Department, he also stated that the IT department was under-resourced. Id. ¶ 91. CW 4 stated that team projects were months behind schedule because there was "slippage," and projects were not hitting the needed "velocity." Id. CW 4 also stated that the IT Department suffered from employee turnover but failed to explain the significance of that turnover except to say that "this contributed to the resources problem." Id. The only specific project that CW 4 described was the supply chain project, which he stated was "stalled." Id. That reference is vague and provides no information as to whether Defendants' statements regarding internal controls are actionable.
The Court lends little weight to CW 4's vague and inconsistent statements. CW 4's statements are internally inconsistent regarding whether or not the IT Department was actually underfunded. Applestein v. Medivation, Inc., 861 F.Supp.2d 1030, 1038 (N.D. Cal. 2012), aff'd, 561 Fed. Appx. 598 (9th Cir. 2014) ("[T]he confidential witness statements in the TAC are unreliable because they contradict statements made by the same group of witnesses in the SAC."); In re Downey Sec. Litig., 2009 WL 2767670, at *10 (finding that "contradictions [in the testimony] severely undermine the reliability of [] confidential witnesses"). Further, CW 4's vague statements regarding "slippage" and "velocity" lack particularized detail. See Limantour v. Cray, Inc., 432 F.Supp.2d 1129, 1143-44 (W.D. Wash. 2006) (CW statements regarding "scheduling slippages" were "too general and too vague" to support a securities fraud claim).
CW 5 was an IT Contract and Vendor Manager in Costco's IT Department from July 2017 until July 2018. AC ¶ 28. CW 5 was three reporting levels below the Senior VP of Information Systems. Id. CW 5's responsibilities included managing and providing recommendations to improve Costco's IT contracts procurement process. Id. CW 5 attended monthly meetings with VPs in the IT Department. Id. ¶ 93. At the meetings, CW 5 raised concerns regarding user access and change management issues, but no one ever addressed the issues. Id.
CW 5 stated that advancement in the IT Department was based on seniority, not on job performance. Id. ¶ 94. As a result, many warehouse employees without significant IT experience were able to get jobs within the IT Department and were promoted. Id. Costco lacked oversight of those inexperienced employees and how they performed their jobs. Id.
Throughout CW 5's year-long tenure at Costco, third party contractors often had unfettered access to Costco's systems. Id. ¶¶ 112; 114. For example, competing contractors could view others' bids with Costco. Id. ¶ 112. Many IT contractors also had "full badge access" to Costco's IT systems instead of just having access to what they needed to complete their projects. Id. When employees onboarded or departed, there was no process for transitioning their responsibilities to new employees. Id. ¶ 113. Like other confidential witnesses, CW 5 stated that Costco's IT project managers used Google spreadsheets for manually managing IT employee access to systems. Id. ¶¶ 113-14. CW 5 stated that the information in the Google spreadsheets was easy for anyone to access and change. Id. ¶ 113. Many contractors and employees were never offboarded from Costco's systems, and many former contractors were still listed as employees with access. Id. ¶ 114. For example, CW 5's colleague continued to have access to Costco's systems at least a month after leaving the company. Id.
The Court concludes that Plaintiffs describe CW 5 with sufficient particularity to establish his personal knowledge regarding Plaintiffs' allegations relating to Costco's internal controls.
CW 6 was a Compliance Analyst at Costco from 2012 until August 2018. Id. ¶ 29. CW 6 was two reporting levels below the VP of Security and Compliance. Id. CW 6 was responsible for "assessing security controls by collecting evidence." Id. CW 6 reported that Costco viewed the IT Department as a "cost center" that was "not adding value." Id. ¶ 95. CW 6 "heard about Defendant Jelinek complaining about how much money was spent in the IT Department, the number of employees it had, and that it was often over-budget with no major projects ever seemingly getting done." Id. CW 6 also "heard" allusions to similar comments by Defendant Jelinek in meetings and in discussions with colleagues. Id. CW 6 further heard that Defendant Jelinek wanted to fix these problems by asking the IT Department to cut costs. Id. These statements are based on unreliable hearsay from other unnamed persons.
Beginning around December 2017, VPs at Costco attended IT Department "engagement meetings" where they made it their "mission" to reduce the number of specialized IT contractors to reduce costs. Id. ¶ 96. It is unclear how CW 6 was privy to this information as he does not state that he attended these meetings.
CW 6 vaguely stated that the IT Department lacked direction, was "not healthy," and there was general discontent among IT employees. Id. ¶ 95. CW 6 described an "exodus" of IT Department employees who left the company in August 2018. Id. ¶ 97. CW 6 was the 26th employee to leave in a three-month period. Id. Without additional context or examples, these generalized allegations about the state of the IT department are vague and unreliable.
CW 6 also stated that due to the "abysmal" results of an undated IT Department employee satisfaction survey, Defendant Galanti gave a speech to the department. Id. ¶ 97. This allegation is also vague. It is unclear when Defendant Galanti gave his speech, what he discussed in his speech, and whether CW 6 even attended. It is similarly unclear whether the "abysmal" results of the employee satisfaction survey regarded issues that affected Costco's internal controls or whether it related to some other employee dissatisfaction having nothing to do with the internal controls.
CW 6 also described the internal audit process as "an informal process of risk acceptance." Id. ¶ 98. Costco lacked a clear process for reporting issues with vendors and then tracking any resulting necessary remediation. Id. CW 6 also cited Google spreadsheets as the primary mechanism for granting and revoking user access to Costco's systems. Id. ¶ 115. CW 6 reiterated that the process for managing these spreadsheets was manual and offboarding depended on the diligence of that contractor's supervisor. Id.
CW 6 also stated that there was an internal risk registry where most teams in the IT Department would log potential security threats. Id. ¶ 116. There was a six-month period in early 2018 when Costco lacked a centralized team overseeing this risk registry. Id.
CW 6's statements are reliable to the extent they provide examples about Costco's lack of internal controls including the use of Google spreadsheets and the lack of systemized risk management regarding internal controls. However, the Court lends little weight to CW 6's general statements regarding the unhealthy culture of the IT Department and the hearsay from other unnamed persons regarding what the individual Defendants knew at the time.
CW 7 was a Senior Business Analyst at Costco from 2014 until July 2018.
In sum, the Court concludes that Plaintiffs have provided sufficient detail about CWs 1, 5, 6 and 7 to establish their reliability and personal knowledge as to at least some of Plaintiffs' claims. However, the Amended Complaint fails to establish the reliability of CWs 2 and 4, and the Court lends their statements little weight. CW 3 did not work at Costco during the relevant time period, and the Court gives his statements no weight.
Pursuant to section 302 of SOX, public companies must maintain "internal control over financial reporting" and "disclosure controls and procedures." 15 U.S.C. § 7241; 17 C.F.R. § 240.13a-15(a)-(d).
Pursuant to Section 404 of SOX, public companies issue annual reports "containing an assessment . . . of the effectiveness of the company's internal control structure and procedures for financial reporting." SEC Release No. 33-8238 at *3 (implementing Section 404). In each annual report, companies must disclose "material weaknesses" in the company's internal control over financial reporting. SEC Release No. 33-8238 at *11. Pursuant to the Exchange Act, a "material weakness" in internal controls is "a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis."
Public companies issue quarterly reports pursuant to SOX "evaluat[ing] any change in the company's internal control over financial reporting that occurred during a fiscal quarter that has materially affected . . . the company's internal control over financial reporting." SEC Release No. 33-8238 at *15. The SEC does not require quarterly evaluations that are "as extensive" as the annual evaluations. Id. "Even where systems testing of [a] component would clearly be required as part of the annual evaluation of internal control over financial reporting, management could make a different determination of the appropriate nature of the evaluation of that component for purposes of a quarterly evaluation of disclosure controls and procedures." Id. at *17 n.93.
SOX requires that CEOs and CFOs of public companies certify public filings. 15 U.S.C. § 7241. Certification indicates that "based on the officer's knowledge, the report does not contain any untrue statement of material fact" and that the signing officers have "evaluated the effectiveness of the [company's] internal controls . . . within 90 days prior to the report." 15 U.S.C. § 7241(a).
A defendant normally cannot introduce additional evidence in support of a Rule 12(b)(6) motion without converting the motion into a Rule 56 motion for summary judgment. Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001), impliedly overruled on other grounds as discussed in Gallardo v. DiCarlo, 203 F.Supp.2d 1160, 1162 n.2 (C.D. Cal. 2002). However, in a securities fraud action, the court may take judicial notice of documents attached to or referenced in the complaint where the authenticity of the documents is not in dispute. In re Wet Seal, Inc. Sec. Litig., 518 F.Supp.2d 1148, 1157 (C.D. Cal. 2007). In addition, the Court may consider public filings, including SEC filings, and other matters of public record such as press releases, analyst reports, news articles, and conference call transcripts, where such documents are relied upon in the complaint. Id.
Although a complaint challenged by a Rule 12(b)(6) motion to dismiss need not provide detailed factual allegations, it must offer "more than labels and conclusions" and contain more than a "formulaic recitation of the elements of a cause of action." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). The complaint must indicate more than mere speculation of a right to relief. Id. When a complaint fails to adequately state a claim, such deficiency should be "exposed at the point of minimum expenditure of time and money by the parties and the court." Id. at 558. A complaint may be lacking for one of two reasons: (i) absence of a cognizable legal theory, or (ii) insufficient facts under a cognizable legal claim. Robertson v. Dean Witter Reynolds, Inc., 749 F.2d 530, 534 (9th Cir. 1984). In ruling on a motion to dismiss, the Court must assume the truth of the plaintiff's allegations and draw all reasonable inferences in the plaintiff's favor. Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). The question for the Court is whether the facts in the complaint sufficiently state a "plausible" ground for relief. Twombly, 550 U.S. at 570. If the Court dismisses the complaint or portions thereof, it must consider whether to grant leave to amend. Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000).
Section 10(b) of the Exchange Act makes it unlawful for any person to "use or employ, in connection with the purchase or sale of any security . . . any manipulative or deceptive device or contrivance[.]" 15 U.S.C. § 78j(b). SEC Rule 10b-5 imposes liability on any person who "make[s] any untrue statement of a material fact" or "omit[s] to state a material fact necessary in order to make the statements made, in light of the circumstances in which they were made, not misleading." 17 C.F.R. § 240.10b-5(b).
To state a Section 10(b) claim, a plaintiff must allege: (1) a material misstatement or omission by the defendant; (2) scienter; (3) a connection between the material misrepresentation and the purchase or sale of a security; (4) reliance upon the misrepresentation or omission; (5) economic loss; and (6) loss causation. Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258, 267 (2014).
Under the PSLRA, Section 10(b) claims must be pled with particularity. In re Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). The PSLRA heightens the particularity required but does not convert a motion to dismiss into a trial by papers. In re LDK Solar Sec. Litig., 584 F.Supp.2d 1230, 1260 (N.D. Cal. 2008); see also Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322 (2007) (even in PSLRA cases, courts must accept all factual allegations in the complaint as true). Further, courts are cautioned against allowing heightened pleading standards to make it "near impossible" to state a fraud claim. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018).
To allege an actionable false or misleading statement under the PSLRA, a plaintiff must "specify each statement alleged to have been misleading, the reason or reasons why the statement is misleading, and, if an allegation regarding the statement or omission is made on information and belief, . . . state with particularity all facts on which that belief is formed." In re Rigel Pharm., Inc. Sec. Litig., 697 F.3d 869, 877 (9th Cir. 2012) (quoting 15 U.S.C. § 78u-4(b)(1)). This requires a plaintiff to allege with specificity "contemporaneous statements or conditions," Ronconi v. Larkin, 253 F.3d 423, 432 (9th Cir. 2001), that demonstrate both "how and why the statements were false" when made, Metzler Inv. GMBH v. Corinthian Colleges, Inc., 540 F.3d 1049, 1070 (9th Cir. 2008) because "[f]raud by hindsight is not actionable." Ronconi, 253 F.3d at 430 n.12 (quoting Arazie v. Mullane, 2 F.3d 1456, 1468 (7th Cir. 1993)).
Scienter is the "mental state embracing intent to deceive, manipulate, or defraud." Ernst & Ernst v. Hochfelder, 425 U.S. 185, 193 n.12 (1976). Under the PSLRA, the complaint must plead a "strong inference" that defendants acted intentionally or with deliberate recklessness. "Reckless conduct may be defined as a highly unreasonable omission, involving not merely simple, or even inexcusable negligence, but an extreme departure from the standards of ordinary care." S.E.C. v. Platforms Wireless Int'l Corp., 617 F.3d 1072, 1093 (9th Cir. 2010) (citing Hollinger v. Titan Capital Corp., 914 F.2d 1564, 1569 (9th Cir. 1990)). "[D]eliberate recklessness" that "reflects some degree of intentional or conscious misconduct" is necessary to plead scienter. WPP Luxembourg Gamma Three Sarl v. Spot Runner, Inc., 655 F.3d 1039, 1051 (9th Cir. 2011) abrogated on other grounds by Lorenzo v. SEC, 139 S.Ct. 1094 (2019). In determining whether a defendant acted with scienter, a court considers "opposing inferences" and "plausible, non-culpable explanations." Tellabs, Inc., 551 U.S. at 323-24. A complaint survives only if the culpable inference is "at least as compelling" as the nonculpable inference. Id. at 324.
When analyzing the sufficiency of a plaintiff's scienter pleadings, the Court must "determine whether any of the allegations, standing alone, are sufficient to create a strong inference of scienter." N.M. State Inv. Council v. Ernst & Young LLP, 641 F.3d 1089, 1095 (9th Cir. 2011). If no individual allegation is sufficient, the Court conducts a "`holistic' review of the same allegations to determine whether the insufficient allegations combine to create a strong inference of intentional conduct or deliberate recklessness." Id. (quoting Zucco, 552 F.3d at 991-92).
Failure to satisfy the PSLRA's heightened pleading standard requires dismissal of the complaint. 15 U.S.C. § 78u-4(b)(3)(A).
Defendants request that the Court take judicial notice of 14 documents attached to the Declaration of John C. Roberts Jr. in Support of Defendants' Motion to Dismiss Consolidated Amended Complaint, docket no. 28. These fourteen documents include the related SEC public filings, the October 4, 2018 earnings call transcript, the COSO IT framework, and various SEC published regulations. The Court may consider public filings, including SEC filings, and other matters of public record such as press releases, analyst reports, news articles, and conference call transcripts, where such documents are relied upon in the complaint. In re Wet Seal, Inc. Sec. Litig., 518 F. Supp. 2d at 1157. The Court takes judicial notice of all fourteen documents. They are referenced in the Amended Complaint, are matters of public record, and their authenticity is not in dispute.
Plaintiffs allege that the June 6, 2018 10-Q and Defendants Jelinek and Galanti's accompanying certifications of that filing were false and misleading because they stated that the company had effective internal controls in place in the 2018 Fiscal Year. AC ¶¶ 151-57. The statement at issue reads:
Plaintiffs claim that this statement is false because starting as early as September 2017, Costco's internal controls were not effective. Id. ¶¶ 75; 153. Specifically, Plaintiffs allege that Costco's material weakness was due to an underfunded, inadequately supervised and trained IT Department, a lack of IT control processes, and a lack of IT risk-assessment processes. Id. ¶ 153.
To allege an actionable false or misleading statement, a plaintiff must specify with particularity the "contemporaneous statements or conditions," Ronconi, 253 F.3d at 432, that demonstrate both "how and why the statements were false" when made, Metzler Inv. GMBH, 540 F.3d at 1070. It is not enough to allege that Costco's systems and processes were imperfect in June, Plaintiffs must allege why those defects at the time rose to the level of a material weakness requiring public disclosure.
Plaintiffs argue that the later public disclosures "serve[d] as admissions by Defendants that [internal control] measures were
In support of this argument, Plaintiffs rely on Limantour v. Cray Inc., 432 F.Supp.2d 1129 (W.D. Wash. 2006). In Limantour, this court found that the complaint adequately alleged that 10-Q and SOX certifications that there were no material weaknesses in internal controls and procedures for the third quarter were false or misleading based on that year's later 10-K annual report disclosing material weaknesses in the internal controls and procedures. Id. at 1159-60. The facts in Limantour are nearly identical to the present case. As is the case here, the defendant company in Limantour issued its third quarter 10-Q, which concluded that the company "disclosure controls and procedures [were] effective." Id. at 1159. The company later filed its 10-K for the fiscal year, concluding that "as of the end of the period covered by this report . . . due to the material weaknesses in our internal control over financial reporting . . . our disclosure controls and procedures were not effective." Id. at 1160. The court noted that the 10-K "specifically refer[red]" to the same "disclosure controls and procedures" mentioned in the earlier 10-Q. Id. Other courts agree that later public disclosures may indicate the falsity of earlier disclosures. See Dobina v. Weatherford Int'l Ltd., 909 F.Supp.2d 228-244-45 (S.D.N.Y. 2012) (holding that "one may reasonably infer that [a company's] internal controls in fact were inadequate throughout the class period" where a later public filing details a material weakness in internal controls).
Here, the Costco Defendants' later 10-K filing "specifically refer[red]" to the same "disclosure controls and procedures" mentioned in the earlier 10-Q, but came to the opposite conclusion regarding their effectiveness. Compare AC ¶ 152 ("Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of the end of the period covered by this Quarterly Report,
Plaintiffs also allege with particularity "contemporaneous statements or conditions," Ronconi, 253 F.3d at 432, that demonstrate both "how and why the statements were false" when made, Metzler Inv. GMBH, 540 F.3d at 1070. Specifically, Plaintiffs' confidential witness statements support the inference that information technology controls in the areas of user access and program change-management were deficient during the class period.
Confidential witnesses 1, 5, and 7 stated that during the class period, Costco's IT Department was understaffed (AC ¶¶ 83-84), subject to high employee turnover (Id. ¶ 84), suffered from poor employee morale (Id. ¶ 85), and was staffed with untrained employees (Id. ¶¶ 84; 94; 99).
The description of the material weakness in the October 10-K also specifically corroborates these confidential witness reports. The 10-K states that the material weakness in internal control was due to "insufficient knowledge and training of certain individuals with IT expertise." See Ex. 4 to John C. Roberts Decl. (docket no. 28-1 at 26). See In re Daou Sys., Inc. Sec. Litig., 411 F.3d at 1015 (in determining the plausibility of confidential witness testimony, the court looks to "the level of detail provided by the confidential sources, the corroborative nature of other facts alleged (including from other sources), the coherence and plausibility of the allegations, the number of sources, the reliability of sources and similar indicia") (quoting In re Cabletron Sys., Inc., 311 F.3d at 29-30).
Confidential witnesses also allege specific examples where IT employees made complaints regarding IT compliance to employees at the VP level. These complaints were met with inaction and indifference. For example, CW 1 described a coworker, Barbara Egner, who raised SOX compliance issues to the VP level. AC ¶ 83. In response, management would ask whether they could "get by," rather than fix the issue. Id. In another instance, CW 5 described monthly meetings with VPs in the IT Department. Id. ¶ 93. CW 5 raised concerns at those meetings regarding issues he saw with user access and change management process. Id. CW 5 stated that his concerns were met with indifference. Id.
Understaffing, neglecting to train employees, and failing to respond to employee complaints do not necessarily preclude a functioning IT Department with sufficient IT controls. However, Plaintiffs have also alleged specific examples showing that Costco did not have adequate user access and change controls in place during the class period.
The following examples support Plaintiffs' claims that Costco lacked sufficient IT controls during the class period:
These examples go to the heart of Plaintiffs' claims. Section 302 of SOX requires an issuer of registered securities to maintain disclosure controls and procedures and internal controls over financial reporting so that unauthorized users do not gain access to and change critical financial data that is reported to the public. 17 C.F.R. § 240.13a-15. Plaintiffs' allegations containing specific examples that unauthorized users were able to access Costco's systems show that Costco's internal controls were weak during the class period. Compare In re Washington Mut., Inc. Sec., Derivative & ERISA Litig., 694 F.Supp.2d 1192, 1212 (W.D. Wash. 2009) (specific examples of accounting deficiencies and lack of process to remediate and address issues indicative of falsity at time statements regarding internal controls were made) with Weiss v. Amkor Tech., Inc., 527 F.Supp.2d 938, 953 (D. Ariz. 2007) (mere allegation of "weak internal controls and accounting systems" were insufficient to plead falsity with particularity where plaintiffs failed to allege facts supporting those conclusions).
Defendants dismiss these allegations as "anecdotal," a conflation of a material weakness with a mere deficiency and not "so severe."
"Statements by a company that are capable of objective verification . . . can constitute material misrepresentations" under the PSLRA. Oregon Pub. Emps. Ret. Fund v. Apollo Grp. Inc., 774 F.3d 598, 606 (9th Cir. 2014). Costco's statements regarding the adequacy of its internal controls were objectively verifiable. Indeed, Costco identified a material weakness in its 10-K after identifying deficient factors that it relied on in making that assessment. KPMG details those deficiencies in its 10-K report. Plaintiffs' confidential witness statements provide specific examples showing that each deficiency was also present throughout the class period. Compare Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 26) (10-K KPMG report that "IT control processes lacked sufficient documentation") with AC ¶¶ 106; 113; 115 (CW statements showing IT control processes lacked sufficient documentation); compare Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 26) (10-K KPMG report finding "insufficient knowledge and training of certain individuals with IT expertise") with AC ¶¶ 84; 94; 99 (CW statements showing that Costco's IT employees lacked adequate training); compare Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 26) (10-K KPMG report that "risk-assessment processes [were] inadequate to identify and access changes in IT environments and personnel that could impact internal control over financial reporting") with AC ¶¶ 106; 112; 114 (detailing specific examples where Costco's risk assessment processes failed to identify user changes). The CW statements referenced in the complaint are therefore sufficient to support Plaintiffs' allegations that statements 1-3 were false and misleading.
Plaintiffs also allege that the June 6, 2018 10-Q is false and misleading because it stated there were "no material changes" in Costco's risk factors and the company was making ongoing "significant technology investments." Id. ¶ 159. The statement at issue reads:
Plaintiffs argue that these statements were false and misleading because Defendants were not making "significant technology investments" to safeguard internal controls over financial reporting. Id. ¶ 160. Plaintiffs fail to state a misrepresentation for statement 4. Plaintiffs' own complaint states that Costco was making significant technology investments. For example, Plaintiffs allege Costco's IT employees were highly paid throughout the class period. See id. ¶ 95 ("IT had the highest paid employees," and the IT Department was "over-budget"). Plaintiffs also allege that Costco invested in "premium" IT products and was working on developing a change management system to improve work flow. See id. ¶¶ 90-92 (describing Costco's continued implementation of a "premium SAP product" to "improve reporting"). Plaintiffs' own allegations make clear that Costco's statement in its June 2018 10-Q that it was "currently making and will continue to make significant technology investments" was not a misrepresentation.
Plaintiffs also allege that Costco's October 4, 2018 press release and earnings call with analysts is false and misleading because Defendants "failed to disclose the full extent of the problems with access controls and change controls" including what caused the problems and the full extent of the remediation measures needed to correct the deficiencies in internal controls. Id. ¶¶ 162-63. Plaintiffs state that the market dropped an additional 3.63% after the more detailed disclosure in the 10-K filed on October 26, which is evidence that the market was not aware of the full magnitude of the issue at the time of the initial announcement on October 4. Id. ¶¶ 13-14; 163-64.
Plaintiffs fail to allege additional misrepresentations for statements 5 and 6 with particularity for two reasons. Plaintiffs take Defendants' initial disclosure out of context. As Plaintiffs note in their complaint, Defendants' initial disclosure was couched in anticipatory language. Defendants explained to investors that they were "still completing [their] assessment," they were beginning remediation, and they "expect[ed]" to report a material weakness in the forthcoming 10-K. Id. ¶ 161. Defendants further stated that the initial disclosure was all they could report and that they "can't be more positive than that until we release the Form 10-K." Id. ¶ 162. As any reasonable investor would recognize, Defendants' hedging and anticipatory language showed that the company could not prematurely provide details they did not yet know.
Plaintiffs do not allege "contemporaneous statements or conditions" demonstrating both "how and why the statements were false" when made. Ronconi, 253 F.3d at 432; Metzler Inv. GMBH, 540 F.3d at 1070. Plaintiffs have not alleged any specific facts showing that Defendants knew but failed to reveal "the extent of the [material weakness], how long it would take to resolve, and the need for extensive remediation efforts" on October 4, 2018. AC ¶¶ 162-63. Rather, the October 4 statements make clear that the company was merely making a preliminary disclosure about the lack of internal controls, but that the company was not done with its investigation. Plaintiffs do not cite or allege facts to the contrary.
Rather, Plaintiffs' allegations regarding statements 5 and 6 are fraud by hindsight. A plaintiff cannot "simply seize[] upon disclosures made in later . . . reports and allege[] that they should have been made in earlier ones." City of Roseville Emps.' Ret. Sys., 963 F. Supp. 2d at 1109 (quoting Denny v. Barber, 576 F.2d 465, 470 (2d Cir. 1978)). A company's public correction or contribution of additional facts "is not, in and of itself, indicative of fraud, as fraud by hindsight is not actionable." In re Metawave Commc'ns Corp. Sec. Litig., 629 F.Supp.2d 1207, 1219 (W.D. Wash. 2009) (quoting Ronconi, 253 F.3d at 430 n.12); see also In re Vantive Corp. Sec. Litig., 283 F.3d 1079, 1084 (9th Cir. 2002) (recognizing that the PSLRA was designed to "eliminate abusive securities litigation" such as "fraud by hindsight"). Thus, Plaintiffs have failed to allege that statements 5 and 6 constitute a false representation.
Confidential Witness Evidence of Scienter
A complaint relying on statements from confidential witnesses to establish scienter must "describe[] [those witnesses] with sufficient particularity to establish their reliability and personal knowledge," and the statements themselves must be "indicative of scienter." Zucco Partners, LLC, 552 F.3d at 995. Plaintiffs rely primarily on CW 1 to allege scienter. CW 1 provides an account of what Defendants Galanti and Jelinek allegedly knew about internal controls in early 2018. CW 1 prepared materials for the management team to present at GDPR board meetings in early 2018. AC ¶ 105. Those materials included data on GDPR and SOX compliance eventually used to create PowerPoints to show the board, which met monthly at the time. Id. CW 1 "believed" that Defendants Jelinek and Galanti would "discuss[] internal control problems" at the meetings with the Board. Id. Through the GDPR review process, CW 1 stated that Costco's weak internal controls "got" Defendants Jelinek and Galanti's attention. Id. ¶ 104.
Plaintiffs do not establish that CW 1 had personal knowledge of what Defendants Jelinek and Galanti knew at the time. Zucco Partners, LLC, 552 F.3d at 995. Plaintiffs admit that CW 1 was not at the meetings with the board or with Defendants Jelinek and Galanti. AC ¶ 105. The Amended Complaint states that CW 1 acquired his information through three degrees of separation: from managers who, in turn, heard about the information from a VP-level employee, who "only occasionally" attended meetings with the board. Id. Further, the data CW 1 prepared for board presentations was used by others who then created the board presentations for GDPR compliance—not internal controls compliance. CW 1 had no way of verifying
Plaintiffs also allege scienter through CW 6, who "heard about" and witnessed others "allud[ing] to" comments by Defendant Jelinek complaining that the IT Department spent too much money, was over-budget and was not getting things done. Id. ¶ 95. CW 6 also stated that Defendant Galanti gave a speech to the department addressing the "abysmal" results of an IT employee satisfaction survey. Id. ¶ 97.
Plaintiffs have failed to establish a basis for CW 6's personal knowledge of scienter. Zucco Partners, LLC, 552 F.3d at 995. Hearing about comments from others or overhearing "allusions" to Defendants' comments without stating that source's basis for personal knowledge cannot establish a confidential witness' personal knowledge. See Police Ret. Sys. v. Intuitive Surgical, Inc., 759 F.3d 1051, 1063 (9th Cir. 2014) (finding that "witnesses [who] lack first hand knowledge regarding what the individual defendants knew or did not know about [the company's] financial health" lack foundation). CW 6's statements are also reminiscent of "merely regurgitating gossip and innuendo." In re Metawave Commc'ns Corp. Sec. Litig., 298 F. Supp. 2d at 1068.
Plaintiffs do not allege that the CWs had any direct interactions with individual Defendants Jelinek or Galanti. There is no indication in the Amended Complaint that the individual Defendants were aware of the CWs' examples regarding the allegedly deficient internal controls. At most, the Amended Complaint refers to these concerns being raised with "VP-level" or unidentified "management."
Plaintiffs' allegations of scienter on indirect bases also fail. Plaintiffs allege that Defendants' ability to access information showing a material weakness is sufficient to support a finding of scienter.
The Court may infer scienter "where the information misrepresented is readily apparent to the defendant corporation's senior management." Zucco Partners, LLC, 552 F.3d at 1001. If a defendant "must have known about the falsity of the information they were providing to the public because the falsity was obvious from the operations of the company, the defendants' awareness of the information's falsity can be assumed." Id. In such a scenario, the facts must be so "patently obvious" that it would be "absurd to suggest that top management was unaware of them." Id. (quoting Berson v. Applied Signal Tech., Inc., 527 F.3d 982, 989 (9th Cir. 2008)). Here, Defendants did not have to revise public disclosures of financial results as a result of the material weakness in internal controls, suggesting that the material weakness did not rise to the level of "patently obvious" to Defendants. Plaintiffs do not separately plead facts showing that the weaknesses in internal controls were so "patently obvious" that it would be "absurd" to suggest that Defendants Galanti and Jelinek were unaware of it. The Court will not infer scienter based on the allegations in the Amended Complaint. Zucco Partners, LLC, 552 F.3d at 1001.
Plaintiffs argue that the remedial measures Defendants undertook after disclosing the material weakness are themselves evidence of scienter. On its own, a company's decision to enhance financial controls does not show that those controls were previously deficient. See In re GlenFed, Inc. Sec. Litig., 42 F.3d at 1553 ("The fact that policies may change over time does not mean that an earlier policy was inadequate, or that statements regarding its adequacy were falsehoods."). In the cases Plaintiffs cite finding scienter after remedial measures, there were also multiple other strong indicia of scienter. See In re Sipex Corp. Sec. Litig., 2005 WL 3096178, at *1 (N.D. Cal. Nov. 17, 2005) (remedial measures, restatement of financials, "sham" sale, and forced resignation of CEO supported scienter inference); Mild v. PPG Indus., Inc., 2018 WL 6787351, at *5-7 (C.D. Cal. Dec. 21, 2018) (remedial measures, vice president's termination, and restatement of financials including admission that vice president acted "improperly" supported scienter inference); Luna v. Marvell Tech. Grp., 2017 WL 2171273, at *5 (N.D. Cal. May 17, 2017) (company's admissions of an inappropriate tone by leadership, termination and rehiring of CEO position, and other remedial measures supported scienter inference). The remedial measures Defendants undertook after disclosing the material weakness are not themselves evidence of Defendants' scienter during the class period.
Plaintiffs argue that Defendants' SOX certifications support a finding of scienter when coupled with other allegations. The other allegations of scienter are not compelling. Also, "[a]lthough the passage of Sarbanes-Oxley may make it somewhat more reasonable to infer that a certifying Defendant whose head is in the sand is being deliberately reckless, it does not transform the PSLRA's requirement of falsity-plusscienter into a requirement of falsity-plus-a-Sarbanes-Oxley-certification." In re Watchguard Sec. Litig., 2006 WL 2038656, at *11 (W.D. Wash. Apr. 21, 2006).
Plaintiffs also argue that Defendants "conscious[ly]" neglected the IT Department. Plaintiffs' Opposition to Defendants' Motion to Dismiss, docket no. 33 at 23. The facts pled do not support a finding that Defendants intentionally or consciously neglected the IT Department. Plaintiffs also fail to establish what Defendants knew at the time. Moreover, a claim that Costco was motivated to keep costs low to maintain profits and growth is too vague and conclusory to state a claim. Such an allegation is also implausible amid Plaintiffs' other allegations that Costco's IT employees were highly paid and that Costco was making significant investments in technology. AC ¶¶ 88; 90; 92; 95; see also supra note 8.
The Court concludes that none of Plaintiffs' allegations "standing alone, are sufficient to create a strong inference of scienter." N.M. State Inv. Council v. Ernst & Young LLP, 641 F.3d 1089, 1095 (9th Cir. 2011). Moreover, "conduct[ing] a `holistic' review of the same allegations," the Court also determines that the "insufficient allegations [fail to] combine to create a strong inference of intentional conduct or deliberate recklessness." Id. (quoting Zucco, 552 F.3d at 991-92).
In determining whether a defendant acted with scienter, a court considers "competing inferences" and "plausible, non-culpable explanations." Tellabs, Inc., 551 U.S. at 323-24. A complaint survives only if the culpable inference is "at least as compelling" as the nonculpable inference. Id. at 324.
Here, the more plausible inference is that Defendants Jelinek and Galanti did not discover how serious the user access and change management issues were until after June 6, 2018. Multiple uncontested facts support this nonculpable inference. On their own, Defendants did disclose the material weakness in disclosure controls in October 2018. The Amended Complaint only alleges that they should have disclosed it sooner. If Defendants knowingly concealed the material weakness in June 2018, it does not make sense that Defendants later chose to willingly reveal a material weakness in internal controls in October 2018.
The inference that Defendants were unaware of the material weakness when they filed the quarterly report is also consistent with the relatively short time that companies take to prepare a quarterly, as opposed to annual, report.
For the foregoing reasons, the Court enters the following Order:
IT IS SO ORDERED.
