The recent trial of Fabrice Tourre has raised again the issue of whether the SEC should prosecute individuals who engage in misconduct or the firms that employ them. In the case of Tourre, some complained that the SEC targeted a relatively low level employee of Goldman Sachs rather than Goldman Sachs itself. Some even described him as a scapegoat. Not long ago, in the Bank of America case, Judge Rakoff leveled the opposite criticism at the SEC. Why was the agency seeking to impose a monetary penalty on BofA rather than prosecuting and penalizing individuals within BofA who had engaged in misconduct?
Each time this issue has come up, it seems that commentators assume that the practice in question is the predominant practice of the SEC—for example, the SEC predominantly goes after the corporation rather than individuals, or the SEC predominantly goes after low level employees rather than the corporation. We have recently completed, and intend to maintain, a database of SEC enforcement practices, and in this post, we shed some factual light on what the SEC actually does with respect to prosecuting and penalizing individual and corporate defendants. Specifically, we answer three questions: First, who does the SEC name as defendants—high level executives, lower level employees, the corporation itself? Second, to what extent does the SEC impose penalties on individual defendants? Third, how often does the SEC impose a monetary penalty on corporate defendants? We address these questions within the universe of SEC enforcement actions involving nationally listed firms for violation of disclosure-related rules—fraud, books and records and internal control rules. Our dataset covers cases filed from 2000 to the present.
Who Does the SEC Name as Defendants?
Was the BofA case unusual in that the SEC did not bring an action against any individuals? The answer is yes, it was unusual. As seen in Figure 1, only 7 percent of cases  involved no individual defendants. Focusing solely on cases involving at least one fraud count, only 4 percent of cases involved no individual defendants. In the remainder of cases, the SEC named either individual defendants only or it named both the corporation and individual defendants.
How often are companies named without individual defendants?
Is the Tourre case unusual in that only a lower level employee was named? Again, the answer is yes. As shown in Figure 2, the SEC names a wide range of individuals as defendants. It names CEOs in 56% of its cases, CFOs in 58% of cases, and lower level executives in 71% of cases. Regarding the scapegoat characterization, the SEC has targeted solely lower level executives in only 7% of its cases.
What types of executives does the SEC name?
Separating cases into those involving financial misstatements and those involving solely non-financial misstatements, the most notable, but not surprising, result is that CFOs are named disproportionately in cases with financial misstatements.
Difference by Type of Misstatement
Once Named, How Are Individuals Penalized?
Does the SEC impose penalties on individual defendants? Clearly, yes, as seen in Figure 4. We define a “severe penalty” to include a monetary penalty, disgorgement, or a bar (temporary or permanent) from serving as an officer or director of a public company.  In some of the most serious cases, where the Department of Justice brings a criminal action and imposes a fine or jail term, the SEC imposes only an injunction against future violations of the securities laws. However, we include those cases within the definition of “severe penalty.” In Figure 4, each pie chart consists of the cases in which a top executive or a lower executive has been named. Thus, among cases naming a top executive, 93% of cases result in such an executive receiving a severe penalty. It turns out that the percentage is exactly the same for lower level executives. 
Are severe penalties imposed?
Refining this somewhat further, Figure 5 shows the specific penalties imposed. For each type of executive, we take the total number of cases in which that type of executive is named and use that as a denominator. We then count the number of cases in which a particular type of penalty is imposed on that type of executive. Where there are multiple lower level executives in a case, we count a type of penalty only once. So, for example, if there are 100 cases naming a lower level executive and in 30 of those cases one or more lower level executives are given a permanent bar, that would appear as 30% of lower level executives receiving a permanent bar. Note, however, that an individual can receive multiple penalties. It is not unusual, for instance, for an individual to receive both a monetary penalty and a temporary or permanent bar.
As shown in Figure 5, the incidence of penalties does not vary significantly between CEOs, CFOs and lower level executives. The size of monetary penalties, however, does vary across types of executives. Mean and median monetary penalties are presented in Figure 6. CEO monetary penalties are substantially higher than penalties imposed on other executives.
Penalties Imposed on Individual Defendants
Size of Monetary Penalties
To What Extent Are Corporations Penalized?
As shown in Figure 1, corporations are named as defendants in 72% of all cases (and 70% of cases that include a fraud count). Of these cases, corporate defendants pay a monetary penalty 29% of the time. Combining monetary penalties with disgorgement, the mean and median payments are $57,900,000 and $9,000,000, respectively. The high mean reflects several very large penalties—for example, WorldCom ($1.5 billion penalty), AIG ($100 million penalty and $700 million disgorgement), BP ($525 million penalty) and Fannie Mae ($400 million penalty). Outliers are not the entire explanation, however. The75th percentile of corporate payment is $35 million.
In cases like the Bank of America case, where only the corporation is named as a defendant, the corporation pays a monetary penalty 63% of the time—over twice the frequency of all cases naming a corporate defendant. The size of penalties in this subset of cases, however, is roughly the same as corporate penalties generally.
 We define a “case” in a specific way in order to organize the data. A case, as we use the term, is a set of one or more enforcement actions against a company and/or its executives and/or third parties such as accountants or underwriters for the same misstatement that led to a violation. Thus, if the SEC brings an action against ABC Co and one or more separate actions against ABC Co.’s executives and its outside auditor, all for a misstatement in ABC Co.’s 2012 financial statements, we consider all those separate actions as one “case.” We omit from the dataset cases in which only administrative action(s) were involved. Thus to be included in the dataset, at least one enforcement action in a “case” must be brought in federal court.
 Some might argue that disgorgement is not a severe penalty if in fact the defendant is truly returning his or her ill-gotten gains. If we exclude disgorgement from the set of penalties defined as severe, the incidence of severe penalties would decline by 5 to 10%–for example, from 70% to between 66.5% and 63%.
 The figures do not reflect cases in which there is currently an ongoing proceeding against any individual defendant.