Johnson v. Costco Wholesale Corporation

Opinion

WESTERN DISTRICT OF WASHINGTON JAMES JOHNSON individually and on behalf of all others similarly situated, PHIL CHEN, and FRED D. DAVOLI, Plaintiffs, C18-1611 TSZ v. ORDER COSTCO WHOLESALE CORPORATION, W. CRAIG JELINEK, and RICHARD A. GALANTI, Defendants. THIS MATTER comes before the Court on the motion of Defendants Costco Wholesale Corporation (“Costco”), W. Craig Jelinek (“Jelinek”), and Richard A. Galanti (“Galanti”), to dismiss Plaintiffs’ Consolidated Amended Complaint for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), docket no. 27, and Defendants’ Request for Consideration of Documents Incorporated by Reference, docket no. 29. Having reviewed all papers filed in support of and in opposition to the motion, the Court enters the following order. I. Summary Plaintiffs allege violations of the Securities Exchange Act of 1934 (“Exchange Act”) and Rule 10b-5 against all Defendants and violations of Section 20(a) of the class of shareholders who acquired Costco stock during the period from June 6, 2018 to October 25, 2018. Plaintiffs allege that Costco and the individual corporate Defendants,

CEO Craig W. Jelinek and CFO Richard A. Galanti, misrepresented facts about the company’s internal controls in connection with its June 6, 2018 and October 4, 2018 public statements and filings. On June 6, 2018, Costco filed a 10-Q for the quarter ending May 13, 2018. Consolidated Amended Complaint (“AC”) ¶¶ 11; 156. In the filing, Costco stated that its internal controls over financial reporting were sufficient, there were no material

weaknesses related to its financial reporting, and the company was “currently making and will continue to make, significant technology investments to improve or replace critical information systems and processing capabilities.” Id. ¶¶ 11; 159. On October 4, 2018, Costco announced that it “expect[ed] to report a material weakness in internal control[s]” for financial results reported for the 2018 fiscal year. Id. ¶ 12. Costco’s stock price

dropped from $231.68 to $218.82. Id. On October 26, 2018, Costco filed its annual 10-K, which described the remediation measures it was planning to undertake to correct the weakness in its internal controls. Id. ¶¶ 13; 128-30. On this news, Costco’s stock price dropped again from $226.40 to $218.19. Id. ¶ 14.

Specifically, Plaintiffs allege that at the time of the June 6, 2018 filing, Defendants’ internal controls and procedures were “not effective.” Id. ¶ 155. Plaintiffs allege Costco had “a material weakness in internal controls over financial reporting.” Id. Plaintiffs also allege that the October 4, 2018 statements were false because Defendants failed to disclose the full extent of the problems with access and change controls or what caused them. Id. ¶ 163. Plaintiffs also allege that these false and misleading statements

were made intentionally or with deliberate recklessness. Id. ¶¶ 211; 214. Plaintiffs rely on confidential witness statements, the individual Defendants’ certifications of public disclosures, later public disclosures, and Defendants’ remedial efforts to argue that the Court should infer the Defendants’ scienter. Id. ¶¶ 173-183. Defendants move to dismiss the Amended Complaint. For the reasons set forth in this Order, the Court GRANTS the Defendants’ Motions, docket nos. 27 and 29, and

dismisses Plaintiffs’ claims without prejudice and with leave to amend. II. Background A. Costco’s Financial Reporting Control Framework To ensure accurate financial reporting, Costco uses the Internal Control – Integrated Framework, which is issued by the Committee of Sponsoring Organizations of

the Treadway Commission (“COSO Framework”). Id. ¶ 62. Costco uses COSO to evaluate internal controls and ensure compliance with SEC regulations. Id. The COSO Framework includes guidelines regarding change and access controls. Id. ¶¶ 63; 67. Change controls are a company’s process to add or modify users and devices and install or update IT. Id. Access controls concern a company’s ability to control user access to

systems based on their “employment status, position, and changes, thereto.” Id. ¶ 72. Together, access and change controls ensure the accuracy of the financial reporting process by restricting the ability to change information to only authorized users. Id. ¶ 67. A deficiency in internal controls could, for example, allow an IT user without knowledge of accounting requirements to make a change that impacts the data used for financial reporting. Id. ¶¶ 66-74.

B. Defendants’ Alleged Six False Statements1 Plaintiffs base their securities claims on six allegedly false public statements. Statement 1: On June 6, 2018, Defendants filed its 3Q2108 Form 10-Q stating: Item 4—Controls and Procedures. As of the end of the period covered by this Quarterly Report on Form 10-q, we performed an evaluation under the supervision and with the participation of management, including our Chief Executive Officer and Chief Financial Officer, of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities and Exchange Act of 1934 (the Exchange Act)). Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of the end of the period covered by this Quarterly Report, our disclosure controls and procedures are effective. There have been no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during our most recently completed fiscal quarter that have materially affected or are reasonably likely to materially affect our internal control over financial reporting. Id. ¶ 152. Statements 2 & 3: Pursuant to the Sarbanes Oxley Act of 2002 (“SOX”), Defendants Jelinek and Galanti each certified the 3Q2018 Form 10-Q filed June 6, 2018 stating: I certify that: I have reviewed this Quarterly Report on Form 10-q of Costco Wholesale Corporation (“the registrant”); 2) Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report; 3) Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report; 4) The registrant’s other certifying officer(s) and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the registrant and have: Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared; Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles; Evaluated the effectiveness of the registrant’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and Disclosed in this report any change in the registrant’s internal control over financial reporting that occurred during the registrant’s most recent fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting; and 5) The registrant’s other certifying officer(s) and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to the registrant’s auditors and the audit committee of the registrant’s board of directors (or persons performing the equivalent functions): All significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the registrant’s ability to record, process, summarize and report financial information; and Any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal control over financial reporting. Id. ¶ 154. Statement 4: In the same 10-Q filed June 6, 2018, Defendants stated: “There have been no material changes in our risk factors from those disclosed in our [2017] Annual Report on Form 10-k.” Id. ¶ 159. One of the risk factors in Costco’s 2017 Form 10-K stated that the company was “currently making and will continue to make, significant technology investments to improve or replace critical information systems and processing capabilities.” Id. Statement 5: On October 4, 2018, Defendants issued a Form 8-K and accompanying press release regarding the material weakness in internal controls stating: While the Company is still completing its assessment of the effectiveness of its internal control over financial reporting as of September 2, 2018, in its upcoming fiscal 2018 Annual Report on Form 10-k, it expects to report a material weakness in internal control. The weakness relates to general information technology controls in the areas of user access and program change- management over certain information technology systems that support the Company’s financial reporting processes. The access issues relate to the extent of privileges afforded users authorized to access company systems. As of the date of this release, there have been no misstatements identified in the financial statements as a result of these deficiencies, and the Company expects to timely file its Form 10-k. Remediation efforts have begun; the material weakness will not be considered remediated until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. The Company expects that the remediation of this material weakness will be completed prior to the end of fiscal year 2019. Id. ¶ 161. Statement 6: That same day, Defendants Galanti and Jelinek participated in an earnings call with analysts. Defendant Galanti stated: A last topic, as was noted in this afternoon’s press release, we plan to report in our Form 10-k the material weakness in internal control related to general IT management over a certain of our IT systems that relate to our financial reporting processes. I can tell you that there have been no misstatements identified in the financial statement as a result of the deficiencies, and we expect to timely file our Form 10-k. In terms of remediation, remediation efforts have begun, but material weakness will not be considered remediated until the applicable controls operate for a sufficient period of time and we can conclude through testing that the controls are operating effectively. We expect that the remediation of the material weakness will be completed prior to the end of fiscal 2019. Well, keep in mind, first of all, that we feel comfortable, and we feel that our -- ultimately, our auditors feel comfortable. We wouldn’t have expressed the level of comfort we did in the press release about the time that there’s no mistake [there’s the timing that] we filed on time, including the K. The issues had to do with internal user access, so people within IT or contractors and when somebody who may have had access to something they should have and sometimes that they -- once they should have had that access relieved, it took a little too long to do so. So the controls weren’t in place. We should have done a better job. We went back as far as we could and looked back as far as we could in some systems for the entire fiscal year, which is what you want to do. In some of the newer systems, there was no look back ability for certain things. I can tell you with all the look backs that we have done and then our outside help has done has found no issues whatsoever in terms of misstatements or breaches. So that’s what we can tell you. But we can’t be more positive than that until we release the Form 10-K. And as -- and so I don’t want to belittle it. We should have -- it should have been fixed, but it was internal to us, not external. And we’ll go from there. Id. ¶ 162. Costco’s stock price dropped on this news from $231.68 on October 4, 2018 to $218.82 on October 5, 2018, a drop of 5.55%. Id. ¶ 186. C. Costco’s 2018 10-K Report On October 26, Costco filed its annual 10-K report, which stated that “as of September 2, 2018,” the company concluded that “the disclosure controls and procedures were not effective as of such date due to a material weakness in internal control over financial reporting.” Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 29). Specifically, Costco “identified a material weakness in internal control[s] related to ineffective information technology general controls [] in the areas of user access and program change-management over certain information technology [] systems that support the Company’s financial reporting processes.” AC ¶ 128.

As part of the 10-K report, Costco’s independent registered public accounting firm, KPMG, provided further explanation of the material weakness. Id. ¶ 131. KPMG stated that the control deficiencies were a result of “IT control processes [that] lacked sufficient documentation; insufficient knowledge and training of certain individuals with IT expertise; and risk-assessment processes [that were] inadequate to identify and assess changes in IT environments and personnel that could impact internal control over

financial reporting.” Id. On October 26, 2018, Costco’s stock price dropped from $226.40 to $218.19—3.63%. Id. ¶ 14. Lead Plaintiff brings this action on behalf of himself and all persons and entities that purchased Costco securities during the period from June 6, 2018 through October 25, 2018 and were damaged. Id. ¶ 195. Plaintiffs now allege that the six statements made in

Costco’s public filings and by Costco senior executives constitute securities fraud under (1) Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b), and Rule 10b-5 promulgated thereunder by the SEC at 17 C.F.R. § 240.10b-5; and (2) Section 20(a) of the Exchange Act, 15 U.S.C. § 78t(a). Plaintiffs allege that these six false and misleading statements had the effect of artificially inflating Costco’s stock, resulting in harm to the putative

class members when Defendants’ misrepresentations became apparent to the market, and the price of Costco stock dropped. Plaintiffs rely principally on the allegations of seven confidential witnesses to allege falsity and scienter. Id. ¶¶ 23-30; 82-118; 167; 170-72; 177. Plaintiffs also rely on Costco’s October 10-K filing to show the falsity of statements in the June 10-Q filing. Id. ¶ 128; Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 15-16. Specifically, Plaintiffs allege that Costco’s Form 10-K

for the fiscal year 2018 filed on October 26, 2018 “provided a description of the expensive and widespread remediation measures it was planning to undertake” as further evidence of Costco’s false statements during the class period. AC ¶ 136. III. Confidential Witness Statements Plaintiffs rely on the statements of seven confidential witnesses (“CWs”) in the Amended Complaint. A complaint relying on statements from confidential witnesses

must pass two hurdles to satisfy the Private Securities Litigation Reform Act (“PSLRA”) pleading requirements: (1) the confidential witnesses must be described with sufficient particularity to establish their reliability and personal knowledge, and (2) those statements which are reported by confidential witnesses with sufficient reliability and personal knowledge must themselves be indicative of scienter. Zucco Partners, LLC v.

Digimarc Corp., 552 F.3d 981, 995 (9th Cir. 2009) (citing In re Daou Sys., Inc. Sec. Litig., 411 F.3d 1006, 1015-16, 1022 (9th Cir. 2005)). The Court must consider whether Plaintiffs have “provided sufficient detail about the confidential witness’ position within the defendant company” to establish the reliability and personal knowledge of the confidential witnesses. Zucco Partners, LLC,

552 F.3d at 995. Plaintiffs must plead with “substantial specificity” how confidential witnesses “came to learn of the information they provide in the complaint.” In re Northpoint Commc’ns Grp., Inc. Sec. Litig., 184 F. Supp. 2d 991, 1000 (N.D. Cal. 2001). The court must be able to tell whether a confidential witness is speaking from personal knowledge, or “merely regurgitating gossip and innuendo.” In re Commtouch Software Ltd. Sec. Litig., 2002 WL 31417998, at *3 (N.D. Cal. July 24, 2002). “The Court can

look to the level of detail provided by the confidential witness, the corroborative nature of other facts alleged (including from other sources), the coherence and plausibility of the allegations, the number of sources, the reliability of the sources, and similar indicia.” In re Metawave Commc'ns Corp. Sec. Litig., 298 F. Supp. 2d 1056, 1068 (W.D. Wash. 2003) (quoting In re Cabletron Sys., Inc., 311 F.3d 11, 29-30 (1st Cir. 2002)). The Court concludes that Plaintiffs describe CWs 1, 5, 6, and 7 with sufficient

particularity to establish their reliability and personal knowledge regarding at least some of Plaintiffs’ allegations. The Amended Complaint provides little support for any significant reliance on CWs 2 and 4. The Court does not rely on CW 3 primarily because that witness did not work at Costco during the relevant period. Confidential Witness 1 (“CW 1”)

The Amended Complaint describes CW 1 as a former Senior Compliance Analyst employed by Costco from 2015 to September 2018. Id. ¶ 24. CW 1 was three reporting levels below the Vice President (“VP”) of Information Security and Compliance. Id. His responsibilities primarily included compliance with privacy regulatory regimes. Id. CW 1 stated that the compliance team was “spread thin,” understaffed, and

suffered from high turnover and employee burnout. Id. ¶¶ 83-85. For example, CW 1 stated that compliance work in some departments occurred in “3-4 month fire drills,” after which the department would return to minimal staffing. Id. ¶ 84. CW 1 stated that the operating systems were also antiquated, which made it difficult to hire employees knowledgeable about those systems. Id. ¶ 84. CW 1 believed that “there were never enough compliance personnel for a company the size of Costco.” Id.

CW 1 stated that IT employees were not well trained. For example, many employees did not know about or did not use Archer, the system for managing governance, risk management, and compliance issues. Id. ¶¶ 102-103. CW 1 did not know about Archer until his second year at the company. Id. ¶ 103. Most SOX compliance work fell to one employee—Barbara Egner (“Egner”). Id. ¶ 24. CW 1 described Ms. Egner as “super frustrated” with the SOX compliance

process because “management didn’t want to listen.” Id. ¶ 83. Instead, according to CW 1, VPs would ask if they could “get by” without remediating issues. Id. CW 1 also detailed specific user access and change management issues. CW 1 retained access to a system long after he transferred departments and had to track down management and “fight” to get access revoked. Id. ¶ 106. CW 1 stated that Costco

managed user access to systems through a Google form system, which made it difficult to tell whether the work actually took place. Id. CW 1 also stated that Costco lacked a policy revoking access to email on personal cell phones when employees left the company. Id. ¶ 107. As of March 2019, CW 1 still had access to all his old Costco work emails, despite leaving the company in September of 2018. Id.

CW 1 provided insight about Costco’s review of its IT processes and compliance with the European Union’s General Data Protection Regulation (“GDPR”). CW 1 attended regular meetings with VP level employees and outside auditors in which they discussed how to comply with GDPR. Id. ¶ 86. One of the weaknesses CW 1 found in addressing GDPR compliance was related to internal controls and “how easy it was for anyone to log into a particular system.” Id. The GDPR compliance team found “the

same kind of weaknesses . . . throughout Costco’s IT ecosystem.” Id. When presented with possible solutions for the issues that came up in the GDPR compliance review, “senior management” stated the measures were “too costly” or required “too much headcount.” Id. ¶ 86. From the meetings with VP employees and auditors, CW 1 helped prepare materials for the management team to present at GDPR board meetings. Id. ¶ 105.

Those materials included data on GDPR and SOX compliance. Id. Management used that data to create PowerPoints for the board, which met monthly in early 2018. Id. CW 1 did not attend those meetings but believed that Defendants Jelinek and Galanti discussed and were “highly engaged” with internal control problems at those meetings. Id. ¶ 104. CW 1 believed that Costco’s weak internal controls got Defendants Jelinek

and Galanti’s attention. Id. Confidential Witness 2 (“CW 2”) CW 2 was employed from 2015 until “mid-2018” and “reported through a chain” up to the VP of Information and Compliance. Id. ¶ 25. CW 2 is alleged to have “insight into issues affecting IT security.” Id. CW 2’s statements vaguely allude to “room for

improvement.” Id. ¶ 87. CW 2 also characterized Costco’s attitude towards the IT Department as a “necessary evil” and an “afterthought.” Id. CW 2’s statements are vague—without specific examples or dates. The precise dates of CW 2’s tenure at Costco are also not clear, and Plaintiffs do not clearly allege that CW 2 worked during the class period. “Any inference that pre-Class Period practices continued during the Class Period amounts to unsubstantiated speculation,” City

of Roseville Emps.’ Ret. Sys. v. Sterling Fin. Corp., 963 F. Supp. 2d 1092, 1135-36 (E.D. Wash. 2013), aff'd, 691 Fed. Appx. 393 (9th Cir. 2017), thus CW 2 lacks a “basis to opine about [Costco’s] practices after [he] left the company.” In re Downey Sec. Litig., 2009 WL 2767670, at *10 (C.D. Cal. Aug. 21, 2009). The Court gives little weight to CW 2’s statements. Confidential Witness 3 (“CW 3”)

CW 3 was employed as a Costco consultant from April 2017 until the end of May 2017—over a year before the class period began. AC ¶ 26. CW 3 reported to various managers and directors working in SAP2 Platform security, compliance, and services. Id. He was responsible for assessing Costco’s IT Department’s change management and user and identity access management. Id. CW 3 described ChaRM, a new change

management system that Costco was developing to improve workflow. Id. ¶ 88. CW 3 stated that there were “a lot of gaps” in the company’s change management and that some employees had “way more access than they should have.” Id. ¶¶ 88; 108. CW 3 created a 50-page report detailing the weaknesses in Costco’s internal controls that he gave to the Director of Global SAP Platform services. Id. ¶ 170. CW 3 stated that the individual

Defendants “easily could have accessed” the report and Costco “should have known

2 SAP is a company that offers a wide range of business software that allows companies to track various about the issues” with internal controls. Id. CW 3 does not state that the Defendants ever, in fact, saw the report.

Primarily because CW 3 left Costco’s employment at the end of May 2017, the Court gives CW 3’s statements no weight. In re Downey Sec. Litig., 2009 WL 2767670, at *10 (CWs lack basis to opine about a certain practice after they left the company); City of Roseville Emps.’ Ret. Sys., 963 F. Supp. 2d at 1135-36 (“Any inference that pre-Class Period practices continued during the class Period amounts to unsubstantiated speculation.”). CW 3’s statements are also unreliable because he makes statements that

are vague (see AC ¶ 88 stating that there were “a lot of gaps in the company’s change management”), and he relies on hearsay statements (see id. stating that “a colleague that remains with Costco informed him”). Confidential Witness 4 (“CW 4”) CW 4 was employed as a contractor for SAP implementation from May 2018 until

November 2018 and was two reporting levels below the Project Manager level. Id. ¶ 27. CW 4 was responsible for performing and overseeing quality assurance testing. Id. CW 4 worked on implementing a new “premium” SAP system designed to improve reporting and provide more structure. Id. ¶ 90. Though CW 4 stated that Costco was investing in “premium” systems to improve the IT Department, he also stated that the IT

department was under-resourced. Id. ¶ 91. CW 4 stated that team projects were months behind schedule because there was “slippage,” and projects were not hitting the needed “velocity.” Id. CW 4 also stated that the IT Department suffered from employee turnover but failed to explain the significance of that turnover except to say that “this contributed to the resources problem.” Id. The only specific project that CW 4 described was the supply chain project, which he stated was “stalled.” Id. That reference is vague

and provides no information as to whether Defendants’ statements regarding internal controls are actionable. The Court lends little weight to CW 4’s vague and inconsistent statements. CW 4’s statements are internally inconsistent regarding whether or not the IT Department was actually underfunded. Applestein v. Medivation, Inc., 861 F. Supp. 2d 1030, 1038 (N.D. Cal. 2012), aff'd, 561 Fed. Appx. 598 (9th Cir. 2014) (“[T]he confidential witness

statements in the TAC are unreliable because they contradict statements made by the same group of witnesses in the SAC.”); In re Downey Sec. Litig., 2009 WL 2767670, at *10 (finding that “contradictions [in the testimony] severely undermine the reliability of [] confidential witnesses”). Further, CW 4’s vague statements regarding “slippage” and “velocity” lack particularized detail. See Limantour v. Cray, Inc., 432 F. Supp. 2d, 1129,

1143-44 (W.D. Wash. 2006) (CW statements regarding “scheduling slippages” were “too general and too vague” to support a securities fraud claim). Confidential Witness 5 (“CW 5”) CW 5 was an IT Contract and Vendor Manager in Costco’s IT Department from July 2017 until July 2018. AC ¶ 28. CW 5 was three reporting levels below the Senior

VP of Information Systems. Id. CW 5’s responsibilities included managing and providing recommendations to improve Costco’s IT contracts procurement process. Id. CW 5 attended monthly meetings with VPs in the IT Department. Id. ¶ 93. At the meetings, CW 5 raised concerns regarding user access and change management issues, but no one ever addressed the issues. Id.

CW 5 stated that advancement in the IT Department was based on seniority, not on job performance. Id. ¶ 94. As a result, many warehouse employees without significant IT experience were able to get jobs within the IT Department and were promoted. Id. Costco lacked oversight of those inexperienced employees and how they performed their jobs. Id. Throughout CW 5’s year-long tenure at Costco, third party contractors often had

unfettered access to Costco’s systems. Id. ¶¶ 112; 114. For example, competing contractors could view others’ bids with Costco. Id. ¶ 112. Many IT contractors also had “full badge access” to Costco’s IT systems instead of just having access to what they needed to complete their projects. Id. When employees onboarded or departed, there was no process for transitioning their responsibilities to new employees. Id. ¶ 113. Like

other confidential witnesses, CW 5 stated that Costco’s IT project managers used Google spreadsheets for manually managing IT employee access to systems. Id. ¶¶ 113-14. CW 5 stated that the information in the Google spreadsheets was easy for anyone to access and change. Id. ¶ 113. Many contractors and employees were never offboarded from Costco’s systems, and many former contractors were still listed as employees with

access. Id. ¶ 114. For example, CW 5’s colleague continued to have access to Costco’s systems at least a month after leaving the company. Id. The Court concludes that Plaintiffs describe CW 5 with sufficient particularity to establish his personal knowledge regarding Plaintiffs’ allegations relating to Costco’s

internal controls. Confidential Witness 6 (“CW 6”) CW 6 was a Compliance Analyst at Costco from 2012 until August 2018. Id. ¶ 29. CW 6 was two reporting levels below the VP of Security and Compliance. Id. CW 6 was responsible for “assessing security controls by collecting evidence.” Id. CW 6 reported that Costco viewed the IT Department as a “cost center” that was “not adding

value.” Id. ¶ 95. CW 6 “heard about Defendant Jelinek complaining about how much money was spent in the IT Department, the number of employees it had, and that it was often over-budget with no major projects ever seemingly getting done.” Id. CW 6 also “heard” allusions to similar comments by Defendant Jelinek in meetings and in discussions with colleagues. Id. CW 6 further heard that Defendant Jelinek wanted to fix

these problems by asking the IT Department to cut costs. Id. These statements are based on unreliable hearsay from other unnamed persons. Beginning around December 2017, VPs at Costco attended IT Department “engagement meetings” where they made it their “mission” to reduce the number of specialized IT contractors to reduce costs. Id. ¶ 96. It is unclear how CW 6 was privy to

this information as he does not state that he attended these meetings. CW 6 vaguely stated that the IT Department lacked direction, was “not healthy,” and there was general discontent among IT employees. Id. ¶ 95. CW 6 described an “exodus” of IT Department employees who left the company in August 2018. Id. ¶ 97. CW 6 was the 26th employee to leave in a three-month period. Id. Without additional context or examples, these generalized allegations about the state of the IT department

are vague and unreliable. CW 6 also stated that due to the “abysmal” results of an undated IT Department employee satisfaction survey, Defendant Galanti gave a speech to the department. Id. ¶ 97. This allegation is also vague. It is unclear when Defendant Galanti gave his speech, what he discussed in his speech, and whether CW 6 even attended. It is similarly unclear whether the “abysmal” results of the employee satisfaction survey regarded

issues that affected Costco’s internal controls or whether it related to some other employee dissatisfaction having nothing to do with the internal controls. CW 6 also described the internal audit process as “an informal process of risk acceptance.” Id. ¶ 98. Costco lacked a clear process for reporting issues with vendors and then tracking any resulting necessary remediation. Id. CW 6 also cited Google

spreadsheets as the primary mechanism for granting and revoking user access to Costco’s systems. Id. ¶ 115. CW 6 reiterated that the process for managing these spreadsheets was manual and offboarding depended on the diligence of that contractor’s supervisor. Id. CW 6 also stated that there was an internal risk registry where most teams in the

IT Department would log potential security threats. Id. ¶ 116. There was a six-month period in early 2018 when Costco lacked a centralized team overseeing this risk registry. Id. CW 6’s statements are reliable to the extent they provide examples about Costco’s lack of internal controls including the use of Google spreadsheets and the lack of

systemized risk management regarding internal controls. However, the Court lends little weight to CW 6’s general statements regarding the unhealthy culture of the IT Department and the hearsay from other unnamed persons regarding what the individual Defendants knew at the time. Confidential Witness 7 (“CW 7”) CW 7 was a Senior Business Analyst at Costco from 2014 until July 2018.3

Id. ¶ 30. CW 7 was two reporting levels below the Global Supply Chain VP. Id. CW 7 was responsible for working with outside consultants to create new systems designs. Id. He stated that “almost all” of the projects he worked on were cancelled before completion and two were put on hold. Id. ¶ 99. CW 7 worked on one project for two years, and the IT Department put it on hold upon his departure. Id. CW 7 reiterated the lack of IT

training stated by other confidential witnesses. Id. For example, CW 7’s direct report had no IT background, and IT training consisted of basics like “how to lock one’s computer.” Id. CW 7 observed that other employees were promoted based on tenure rather than ability. Id. Weight of Confidential Witness Statements

In sum, the Court concludes that Plaintiffs have provided sufficient detail about CWs 1, 5, 6 and 7 to establish their reliability and personal knowledge as to at least some

3 The Court notes that CW 7’s tenure overlapped with the class period for less than a two-month period. of Plaintiffs’ claims. However, the Amended Complaint fails to establish the reliability of CWs 2 and 4, and the Court lends their statements little weight. CW 3 did not work at

Costco during the relevant time period, and the Court gives his statements no weight. IV. Regulatory Scheme A. Sarbanes Oxley Act of 2002 (“SOX”) Pursuant to section 302 of SOX, public companies must maintain “internal control over financial reporting” and “disclosure controls and procedures.” 15 U.S.C. § 7241; 17 C.F.R. § 240.13a-15(a)-(d).4 “Internal control” over financial reporting is defined as

“reasonable assurance” regarding the “reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.” 17 C.F.R. § 240.13a-15(f). Internal controls safeguarding accuracy must be “under the supervision of[] the issuer’s principal executive and principal financial officers.” 17 C.F.R. § 240.13a-15(f). “[D]isclosure

controls and procedures” are “designed to ensure that information required to be disclosed by the [company] in the reports that it files or submits under the Act . . . is recorded, processed, summarized and reported” and “communicated to the [company’s] management.” 17 C.F.R. § 240.15d-15(e).

B. Public Filing Requirements Annual Reports

Pursuant to Section 404 of SOX, public companies issue annual reports “containing an assessment . . . of the effectiveness of the company’s internal control structure and procedures for financial reporting.” SEC Release No. 33-8238 at *3 (implementing Section 404). In each annual report, companies must disclose “material weaknesses” in the company’s internal control over financial reporting. SEC Release No. 33-8238 at *11. Pursuant to the Exchange Act, a “material weakness” in internal

controls is “a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis.” 5 17 C.F.R. § 240.12b-2. Quarterly Reports

Public companies issue quarterly reports pursuant to SOX “evaluat[ing] any change in the company’s internal control over financial reporting that occurred during a fiscal quarter that has materially affected . . . the company’s internal control over

5 Both Plaintiffs and Defendants attempt to massage the requirements for public disclosure of a material weakness in their favor. Defendants’ definition of material weakness is wrong. Compare Defendants’ Reply in Support of Motion to Dismiss, docket no. 36 at 8 (defining material weakness as a situation “where deficiencies have become so severe in the aggregate that there is a reasonable possibility of a material misstatement”) (emphasis added) with 17 C.F.R. § 240.12b-2 (Exchange Act definition of material weakness as “a deficiency, or a combination of deficiencies, in internal control over financial reporting”) (emphasis added). Plaintiffs’ definition of material weakness is also wrong. Compare Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 8 (material weakness necessarily exists where there is a mere “risk” of misstatement of financial results) with 17 C.F.R. § 240.12b-2 (Exchange Act requirement of a “reasonable possibility” of misstatement of financial results to financial reporting.” SEC Release No. 33-8238 at *15. The SEC does not require quarterly evaluations that are “as extensive” as the annual evaluations. Id. “Even where

systems testing of [a] component would clearly be required as part of the annual evaluation of internal control over financial reporting, management could make a different determination of the appropriate nature of the evaluation of that component for purposes of a quarterly evaluation of disclosure controls and procedures.” Id. at *17 n.93. C. Executive Certification of Filings

SOX requires that CEOs and CFOs of public companies certify public filings. 15 U.S.C. § 7241. Certification indicates that “based on the officer’s knowledge, the report does not contain any untrue statement of material fact” and that the signing officers have “evaluated the effectiveness of the [company’s] internal controls . . . within 90 days prior to the report.” 15 U.S.C. § 7241(a).

V. Legal Standards A. Incorporation by Reference A defendant normally cannot introduce additional evidence in support of a Rule 12(b)(6) motion without converting the motion into a Rule 56 motion for summary judgment. Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001), impliedly

overruled on other grounds as discussed in Gallardo v. DiCarlo, 203 F. Supp. 2d 1160, 1162 n.2 (C.D. Cal. 2002). However, in a securities fraud action, the court may take judicial notice of documents attached to or referenced in the complaint where the authenticity of the documents is not in dispute. In re Wet Seal, Inc. Sec. Litig., 518 F. filings, including SEC filings, and other matters of public record such as press releases, analyst reports, news articles, and conference call transcripts, where such documents are

relied upon in the complaint. Id. B. Motion to Dismiss Although a complaint challenged by a Rule 12(b)(6) motion to dismiss need not provide detailed factual allegations, it must offer “more than labels and conclusions” and contain more than a “formulaic recitation of the elements of a cause of action.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). The complaint must indicate more than

mere speculation of a right to relief. Id. When a complaint fails to adequately state a claim, such deficiency should be “exposed at the point of minimum expenditure of time and money by the parties and the court.” Id. at 558. A complaint may be lacking for one of two reasons: (i) absence of a cognizable legal theory, or (ii) insufficient facts under a cognizable legal claim. Robertson v. Dean Witter Reynolds, Inc., 749 F.2d 530, 534 (9th

Cir. 1984). In ruling on a motion to dismiss, the Court must assume the truth of the plaintiff’s allegations and draw all reasonable inferences in the plaintiff’s favor. Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). The question for the Court is whether the facts in the complaint sufficiently state a “plausible” ground for relief. Twombly, 550 U.S. at 570. If the Court dismisses the complaint or portions thereof, it

must consider whether to grant leave to amend. Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000). C. Pleading Standard Under the Securities Exchange Act of 1934 and the PSLRA Section 10(b) of the Exchange Act makes it unlawful for any person to “use or

employ, in connection with the purchase or sale of any security . . . any manipulative or deceptive device or contrivance[.]” 15 U.S.C. § 78j(b). SEC Rule 10b–5 imposes liability on any person who “make[s] any untrue statement of a material fact” or “omit[s] to state a material fact necessary in order to make the statements made, in light of the circumstances in which they were made, not misleading.” 17 C.F.R. § 240.10b–5(b). To state a Section 10(b) claim, a plaintiff must allege: (1) a material misstatement

or omission by the defendant; (2) scienter; (3) a connection between the material misrepresentation and the purchase or sale of a security; (4) reliance upon the misrepresentation or omission; (5) economic loss; and (6) loss causation. Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258, 267 (2014).6 Under the PSLRA, Section 10(b) claims must be pled with particularity. In re

Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). The PSLRA heightens the particularity required but does not convert a motion to dismiss into a trial by papers. In re LDK Solar Sec. Litig., 584 F. Supp. 2d 1230, 1260 (N.D. Cal. 2008); see also Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322 (2007) (even in PSLRA cases, courts must accept all factual allegations in the complaint as true). Further, courts

are cautioned against allowing heightened pleading standards to make it “near

6 Defendants move only on the basis that the Plaintiffs fail to allege falsity and scienter. The other impossible” to state a fraud claim. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018).

To allege an actionable false or misleading statement under the PSLRA, a plaintiff must “specify each statement alleged to have been misleading, the reason or reasons why the statement is misleading, and, if an allegation regarding the statement or omission is made on information and belief, . . . state with particularity all facts on which that belief is formed.” In re Rigel Pharm., Inc. Sec. Litig., 697 F.3d 869, 877 (9th Cir. 2012) (quoting 15 U.S.C. § 78u-4(b)(1)). This requires a plaintiff to allege with specificity

“contemporaneous statements or conditions,” Ronconi v. Larkin, 253 F.3d 423, 432 (9th Cir. 2001), that demonstrate both “how and why the statements were false” when made, Metzler Inv. GMBH v. Corinthian Colleges, Inc., 540 F.3d 1049, 1070 (9th Cir. 2008) because “[f]raud by hindsight is not actionable.” Ronconi, 253 F.3d at 430 n.12 (quoting Arazie v. Mullane, 2 F.3d 1456, 1468 (7th Cir. 1993)).

Scienter is the “mental state embracing intent to deceive, manipulate, or defraud.” Ernst & Ernst v. Hochfelder, 425 U.S. 185, 193 n.12 (1976). Under the PSLRA, the complaint must plead a “strong inference” that defendants acted intentionally or with deliberate recklessness. “Reckless conduct may be defined as a highly unreasonable omission, involving not merely simple, or even inexcusable negligence, but an extreme

departure from the standards of ordinary care.” S.E.C. v. Platforms Wireless Int'l Corp., 617 F.3d 1072, 1093 (9th Cir. 2010) (citing Hollinger v. Titan Capital Corp., 914 F.2d 1564, 1569 (9th Cir. 1990)). “[D]eliberate recklessness” that “reflects some degree of intentional or conscious misconduct” is necessary to plead scienter. WPP Luxembourg Gamma Three Sarl v. Spot Runner, Inc., 655 F.3d 1039, 1051 (9th Cir. 2011) abrogated on other grounds by Lorenzo v. SEC, 139 S. Ct. 1094 (2019). In determining whether a

defendant acted with scienter, a court considers “opposing inferences” and “plausible, non-culpable explanations.” Tellabs, Inc., 551 U.S. at 323-24. A complaint survives only if the culpable inference is “at least as compelling” as the nonculpable inference. Id. at 324. When analyzing the sufficiency of a plaintiff’s scienter pleadings, the Court must “determine whether any of the allegations, standing alone, are sufficient to create a strong

inference of scienter.” N.M. State Inv. Council v. Ernst & Young LLP, 641 F.3d 1089, 1095 (9th Cir. 2011). If no individual allegation is sufficient, the Court conducts a “‘holistic’ review of the same allegations to determine whether the insufficient allegations combine to create a strong inference of intentional conduct or deliberate recklessness.” Id. (quoting Zucco, 552 F.3d at 991-92).

Failure to satisfy the PSLRA’s heightened pleading standard requires dismissal of the complaint. 15 U.S.C. § 78u-4(b)(3)(A). VI. Discussion A. Documents Incorporated by Reference Defendants request that the Court take judicial notice of 14 documents attached to

the Declaration of John C. Roberts Jr. in Support of Defendants’ Motion to Dismiss Consolidated Amended Complaint, docket no. 28. These fourteen documents include the related SEC public filings, the October 4, 2018 earnings call transcript, the COSO IT framework, and various SEC published regulations. The Court may consider public filings, including SEC filings, and other matters of public record such as press releases, analyst reports, news articles, and conference call transcripts, where such documents are

relied upon in the complaint. In re Wet Seal, Inc. Sec. Litig., 518 F. Supp. 2d at 1157. The Court takes judicial notice of all fourteen documents. They are referenced in the Amended Complaint, are matters of public record, and their authenticity is not in dispute.7 Defendants’ unopposed Request for Consideration of Documents Incorporated by Reference, docket no. 29, is GRANTED. B. Misrepresentations

Statements 1 – 3: June 6, 2018 10-Q Plaintiffs allege that the June 6, 2018 10-Q and Defendants Jelinek and Galanti’s accompanying certifications of that filing were false and misleading because they stated that the company had effective internal controls in place in the 2018 Fiscal Year. AC ¶¶ 151-57. The statement at issue reads:

Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of the end of the period covered by this Quarterly Report, our disclosure controls and procedures are effective. There have been no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during our most recently completed fiscal quarter that have materially affected or are reasonably likely to materially affect our internal control over financial reporting. Id. ¶ 152. Plaintiffs claim that this statement is false because starting as early as September 2017, Costco’s internal controls were not effective. Id. ¶¶ 75; 153. Specifically, Plaintiffs allege that Costco’s material weakness was due to an underfunded, inadequately supervised and trained IT Department, a lack of IT control processes, and a lack of IT risk-assessment processes. Id. ¶ 153.

To allege an actionable false or misleading statement, a plaintiff must specify with particularity the “contemporaneous statements or conditions,” Ronconi, 253 F.3d at 432, that demonstrate both “how and why the statements were false” when made, Metzler Inv. GMBH, 540 F.3d at 1070. It is not enough to allege that Costco’s systems and processes were imperfect in June, Plaintiffs must allege why those defects at the time rose to the level of a material weakness requiring public disclosure.

Plaintiffs argue that the later public disclosures “serve[d] as admissions by Defendants that [internal control] measures were not in place during the Class Period, thus serving as confirmation that Defendants’ Certifications and other statements about internal controls were false and misleading when made.” Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 8-9; AC ¶¶ 13, 123.

In support of this argument, Plaintiffs rely on Limantour v. Cray Inc., 432 F. Supp. 2d 1129 (W.D. Wash. 2006). In Limantour, this court found that the complaint adequately alleged that 10–Q and SOX certifications that there were no material weaknesses in internal controls and procedures for the third quarter were false or misleading based on that year’s later 10-K annual report disclosing material weaknesses

in the internal controls and procedures. Id. at 1159-60. The facts in Limantour are nearly identical to the present case. As is the case here, the defendant company in Limantour issued its third quarter 10-Q, which concluded that the company “disclosure controls and procedures [were] effective.” Id. at 1159. The company later filed its 10-K for the fiscal year, concluding that “as of the end of the period covered by this report . . . due to the material weaknesses in our internal control over financial reporting . . . our disclosure

controls and procedures were not effective.” Id. at 1160. The court noted that the 10-K “specifically refer[red]” to the same “disclosure controls and procedures” mentioned in the earlier 10-Q. Id. Other courts agree that later public disclosures may indicate the falsity of earlier disclosures. See Dobina v. Weatherford Int’l Ltd., 909 F. Supp. 2d 228- 244-45 (S.D.N.Y. 2012) (holding that “one may reasonably infer that [a company’s] internal controls in fact were inadequate throughout the class period” where a later public

filing details a material weakness in internal controls). Here, the Costco Defendants’ later 10-K filing “specifically refer[red]” to the same “disclosure controls and procedures” mentioned in the earlier 10-Q, but came to the opposite conclusion regarding their effectiveness. Compare AC ¶ 152 (“Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of

the end of the period covered by this Quarterly Report, our disclosure controls and procedures are effective.”), with Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 29) (10-K disclosure that “as of September 2, 2018,” Costco’s CEO and CFO “have concluded that the disclosure controls and procedures were not effective”). Plaintiffs also allege with particularity “contemporaneous statements or

conditions,” Ronconi, 253 F.3d at 432, that demonstrate both “how and why the statements were false” when made, Metzler Inv. GMBH, 540 F.3d at 1070. Specifically, Plaintiffs’ confidential witness statements support the inference that information technology controls in the areas of user access and program change-management were deficient during the class period.

Confidential witnesses 1, 5, and 7 stated that during the class period, Costco’s IT Department was understaffed (AC ¶¶ 83-84), subject to high employee turnover (Id. ¶ 84), suffered from poor employee morale (Id. ¶ 85), and was staffed with untrained employees (Id. ¶¶ 84; 94; 99).8 These confidential witnesses corroborate each other’s statements and provide specific examples of each allegation. See, e.g., id. ¶ 99 (examples of manager with “no IT background” who “certainly wasn’t trained in the area of IT

before starting” and annual IT training consisting of “basic stuff” such as “how to lock one’s computer”); id. ¶ 103 (example of IT employee who, due to lack of training, did not know about governance management system until 18 months into employment). The Court finds that the insight from confidential witnesses is “accompanied by enough particularized detail to support a reasonable conviction in the informant's basis of

8 Plaintiffs allege that the IT Department was deliberately underfunded (AC ¶ 153), but many of Plaintiffs’ own allegations contradict this assertion. See id. ¶¶ 90-92 (describing Costco’s continued implementation of “premium SAP product” to “improve reporting”); id. ¶ 95 (“IT had the highest paid employees,” and the IT Department was “over-budget”). Plaintiffs also argue that Costco’s low Selling, General and Administrative (“SG&A”) spending indicates that the department is underfunded. Id. ¶¶ 77- 78. Costco spent 10% of its budget on SG&A, which includes all non-production related costs, including IT. Id. Plaintiffs allege that in contrast with certain competitors, Costco’s 10% SG&A spending is low. Id. Costco’s SG&A spending has also decreased, whereas Costco’s competitors have increased their SG&A spending. Id. Low SG&A spending is not directly indicative of an underfunded IT Department. SG&A includes all costs “not related to making a product or performing a service,” which includes rent, advertising, marketing, legal costs, and salary and benefits. Id. ¶ 77. It is therefore impossible to determine what percent of Costco’s SG&A was devoted to solely IT Department spending. Plaintiffs also do not allege that a particular level of SG&A spending as a percentage of revenue necessarily precluded a functioning IT Department, which is notable because Costco’s SG&A spending in 2018 was $13.87 billion. Ex. 4 to John C. Roberts Decl. (docket no. 28-1 at 28). The Court gives little weight to Plaintiffs’ knowledge.” In re Northpoint Commc’ns Grp., Inc., Sec. Litig., 221 F. Supp. 2d 1090, 1097 (N.D. Cal. 2002).

The description of the material weakness in the October 10-K also specifically corroborates these confidential witness reports. The 10-K states that the material weakness in internal control was due to “insufficient knowledge and training of certain individuals with IT expertise.” See Ex. 4 to John C. Roberts Decl. (docket no. 28-1 at 26). See In re Daou Sys., Inc. Sec. Litig., 411 F.3d at 1015 (in determining the plausibility of confidential witness testimony, the court looks to “the level of detail

provided by the confidential sources, the corroborative nature of other facts alleged (including from other sources), the coherence and plausibility of the allegations, the number of sources, the reliability of sources and similar indicia”) (quoting In re Cabletron Sys., Inc., 311 F.3d at 29-30). Confidential witnesses also allege specific examples where IT employees made

complaints regarding IT compliance to employees at the VP level. These complaints were met with inaction and indifference. For example, CW 1 described a coworker, Barbara Egner, who raised SOX compliance issues to the VP level. AC ¶ 83. In response, management would ask whether they could “get by,” rather than fix the issue. Id. In another instance, CW 5 described monthly meetings with VPs in the IT

Department. Id. ¶ 93. CW 5 raised concerns at those meetings regarding issues he saw with user access and change management process. Id. CW 5 stated that his concerns were met with indifference. Id. Understaffing, neglecting to train employees, and failing to respond to employee complaints do not necessarily preclude a functioning IT Department with sufficient IT

controls. However, Plaintiffs have also alleged specific examples showing that Costco did not have adequate user access and change controls in place during the class period. The following examples support Plaintiffs’ claims that Costco lacked sufficient IT controls during the class period: • Lack of Coherent IT Control Systems and Procedures: Plaintiffs allege that Costco lacked coherent IT control systems. CW 1 described employees that did not know the appropriate IT systems to use. See id. ¶ 103 (confusion about whether to use Archer or ServiceNow for governance management). Costco also lacked a policy for revoking access to email on personal cell phones when employees left the company. Id. ¶ 107. • Ineffective IT Control Systems: To the extent Costco did have control systems in place, Plaintiffs allege they were ineffective. Costco used Google’s suite of online applications9 as the primary method for managing user access to systems. Id. ¶¶ 106; 113; 115. Google’s online applications are known for being unsecure, in part because it is easy for any user with access to change information. Id. ¶¶ 106 n.12; 113. Even assuming the Google suite of applications was appropriate for the size and scale of Costco’s IT work, Costco’s implementation of that system lacked coherent procedures. Supervisors manually approved changes, which meant that changes in user access often did not happen. Id. ¶¶ 106; 114. Because Costco used Google applications to manage user changes instead of a work flow tool, there was no way to track whether the changes were completed. Id. ¶ 172. CW 5 stated that third party contractors had “no restrictions” and “full badge” access to Costco’s IT systems, including access to a database where they could see competitors’ bids. Id. ¶ 112. • Actual Unauthorized User Access: Plaintiffs allege specific examples of the effect of the lack of controls: users frequently had unauthorized access to company data. For example, CW 1 had access to a system after he left that department. Id. ¶ 106. He had to “fight” to get his access revoked. Id.

9 Google’s suite of online applications includes the word processor “Google Docs” and “Google Sheets.” The applications are cloud-based and online. They are readily accessible and editable to anyone with authorization from any device with internet access. AC ¶ 106 n.12. CW 5 described a colleague whose login information worked for “at least a month” after leaving Costco. Id. ¶ 114. This employee had access to “everything” including “sensitive stuff.” Id. CW 5 observed many contractors who were still listed as employees with access to systems even after they left Costco. Id.10 These examples go to the heart of Plaintiffs’ claims. Section 302 of SOX requires an issuer of registered securities to maintain disclosure controls and procedures and internal controls over financial reporting so that unauthorized users do not gain access to and change critical financial data that is reported to the public. 17 C.F.R. § 240.13a–15. Plaintiffs’ allegations containing specific examples that unauthorized users were able to access Costco’s systems show that Costco’s internal controls were weak during the class period. Compare In re Washington Mut., Inc. Sec., Derivative & ERISA Litig., 694 F. Supp. 2d 1192, 1212 (W.D. Wash. 2009) (specific examples of accounting deficiencies and lack of process to remediate and address issues indicative of falsity at time statements regarding internal controls were made) with Weiss v. Amkor Tech., Inc., 527 F. Supp. 2d

938, 953 (D. Ariz. 2007) (mere allegation of “weak internal controls and accounting systems” were insufficient to plead falsity with particularity where plaintiffs failed to allege facts supporting those conclusions).

10 The description of the material weakness in the 10-K also specifically corroborates these confidential witness reports. The 10-K states that the material weakness in internal control was due to “IT control processes [that] lacked sufficient documentation” and “processes [that were] inadequate to identify and assess changes in IT environments and personnel.” See Ex. 4 to John C. Roberts Decl. (docket no. 28-1 at 26). Defendants dismiss these allegations as “anecdotal,” a conflation of a material weakness with a mere deficiency and not “so severe.” 11 They also contend that

Defendants never restated financial results.12 Defendants’ Reply in Support of Motion to Dismiss, docket no. 36 at 11-12. Defendants rely on In re GlenFed, Inc. Sec. Litig. for the proposition that whether internal controls are adequate is a non-actionable business judgment. 42 F.3d 1541, 1549 (9th Cir. 1994) (“[P]laintiff must set forth facts explaining why the difference between the earlier and the later statements is not merely the difference between two permissible judgments, but rather the result of a falsehood.”).

However, statements regarding the adequacy of internal controls can constitute actionable misrepresentations. See In re Washington Mut., Inc. Sec., Derivative & ERISA Litig., 259 F.R.D. 490, 506 (W.D. Wash. 2009) (“Misstatements about the adequacy of internal controls are actionable.”); In re New Century, 588 F. Supp. 2d 1206, 1226 (C.D. Cal. 2008) (“Defendants made material false and misleading statements regarding the

adequacy of internal controls during the Class Period.”). “Statements by a company that are capable of objective verification . . . can constitute material misrepresentations” under the PSLRA. Oregon Pub. Emps. Ret. Fund v. Apollo Grp. Inc., 774 F.3d 598, 606 (9th Cir. 2014). Costco’s statements regarding the adequacy of its internal controls were objectively verifiable. Indeed, Costco identified a

11 That is not the standard. Plaintiffs must only show that there was a material weakness in internal controls when Defendants stated there was no such weakness. The SEC does not require a particular level of severity to state a material weakness. See supra note 5. 12 A restatement of financial results is not required to meet the PSLRA’s pleading requirements. In re material weakness in its 10-K after identifying deficient factors that it relied on in making that assessment. KPMG details those deficiencies in its 10-K report. Plaintiffs’

confidential witness statements provide specific examples showing that each deficiency was also present throughout the class period. Compare Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 26) (10-K KPMG report that “IT control processes lacked sufficient documentation”) with AC ¶¶ 106; 113; 115 (CW statements showing IT control processes lacked sufficient documentation); compare Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 26) (10-K KPMG report finding “insufficient knowledge and training of certain

individuals with IT expertise”) with AC ¶¶ 84; 94; 99 (CW statements showing that Costco’s IT employees lacked adequate training); compare Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 26) (10-K KPMG report that “risk-assessment processes [were] inadequate to identify and access changes in IT environments and personnel that could impact internal control over financial reporting”) with AC ¶¶ 106; 112; 114 (detailing

specific examples where Costco’s risk assessment processes failed to identify user changes). The CW statements referenced in the complaint are therefore sufficient to support Plaintiffs’ allegations that statements 1-3 were false and misleading.13 Statement 4 Plaintiffs also allege that the June 6, 2018 10-Q is false and misleading because it

stated there were “no material changes” in Costco’s risk factors and the company was

13 Plaintiffs also challenge Defendants Jelinek and Galanti’s SOX certifications attached to Costco’s June 2018 quarterly report. AC ¶¶ 154-56. Plaintiffs challenge the certifications on the same basis—that Costco should have disclosed a material weakness in June 2018. Thus, Plaintiffs adequately allege a making ongoing “significant technology investments.” Id. ¶ 159. The statement at issue reads:

“There have been no material changes in our risk factors from those disclosed in our [2017] Annual Report on Form 10-k.” One of the risk factors in the Company’s 2017 Form 10-K stated that the Company was “currently making and will continue to make, significant technology investments to improve or replace critical information systems and processing capabilities.” Id. Plaintiffs argue that these statements were false and misleading because Defendants were not making “significant technology investments” to safeguard internal controls over financial reporting. Id. ¶ 160. Plaintiffs fail to state a misrepresentation for statement 4. Plaintiffs’ own complaint states that Costco was making significant technology investments. For example, Plaintiffs allege Costco’s IT employees were highly paid throughout the class period. See id. ¶ 95 (“IT had the highest paid employees,” and the IT Department was “over-budget”). Plaintiffs also allege that Costco invested in “premium” IT products and was working on developing a change management system to improve work flow. See id. ¶¶ 90-92 (describing Costco’s continued implementation of a “premium SAP product” to “improve reporting”). Plaintiffs’ own allegations make clear that Costco’s statement in its June 2018 10-Q that it was “currently making and will continue to make significant technology investments” was not a misrepresentation.

Statements 5 - 6 Plaintiffs also allege that Costco’s October 4, 2018 press release and earnings call with analysts is false and misleading because Defendants “failed to disclose the full extent of the problems with access controls and change controls” including what caused deficiencies in internal controls. Id. ¶¶ 162-63. Plaintiffs state that the market dropped an additional 3.63% after the more detailed disclosure in the10-K filed on October 26,

which is evidence that the market was not aware of the full magnitude of the issue at the time of the initial announcement on October 4. Id. ¶¶ 13-14; 163-64. Plaintiffs fail to allege additional misrepresentations for statements 5 and 6 with particularity for two reasons. Plaintiffs take Defendants’ initial disclosure out of context. As Plaintiffs note in their complaint, Defendants’ initial disclosure was couched in anticipatory language. Defendants explained to investors that they were “still completing

[their] assessment,” they were beginning remediation, and they “expect[ed]” to report a material weakness in the forthcoming 10-K. Id. ¶ 161. Defendants further stated that the initial disclosure was all they could report and that they “can’t be more positive than that until we release the Form 10-K.” Id. ¶ 162. As any reasonable investor would recognize, Defendants’ hedging and anticipatory language showed that the company could not

prematurely provide details they did not yet know. Plaintiffs do not allege “contemporaneous statements or conditions” demonstrating both “how and why the statements were false” when made. Ronconi, 253 F.3d at 432; Metzler Inv. GMBH, 540 F.3d at 1070. Plaintiffs have not alleged any specific facts showing that Defendants knew but failed to reveal “the extent of the [material weakness],

how long it would take to resolve, and the need for extensive remediation efforts” on October 4, 2018. AC ¶¶ 162-63. Rather, the October 4 statements make clear that the company was merely making a preliminary disclosure about the lack of internal controls, but that the company was not done with its investigation. Plaintiffs do not cite or allege facts to the contrary.

Rather, Plaintiffs’ allegations regarding statements 5 and 6 are fraud by hindsight. A plaintiff cannot “simply seize[] upon disclosures made in later . . . reports and allege[] that they should have been made in earlier ones.” City of Roseville Emps.’ Ret. Sys., 963 F. Supp. 2d at 1109 (quoting Denny v. Barber, 576 F.2d 465, 470 (2d Cir. 1978)). A company’s public correction or contribution of additional facts “is not, in and of itself, indicative of fraud, as fraud by hindsight is not actionable.” In re Metawave Commc'ns

Corp. Sec. Litig., 629 F. Supp. 2d 1207, 1219 (W.D. Wash. 2009) (quoting Ronconi, 253 F.3d at 430 n.12); see also In re Vantive Corp. Sec. Litig., 283 F.3d 1079, 1084 (9th Cir. 2002) (recognizing that the PSLRA was designed to “eliminate abusive securities litigation” such as “fraud by hindsight”). Thus, Plaintiffs have failed to allege that statements 5 and 6 constitute a false representation.

C. Scienter Confidential Witness Evidence of Scienter A complaint relying on statements from confidential witnesses to establish scienter must “describe[] [those witnesses] with sufficient particularity to establish their reliability and personal knowledge,” and the statements themselves must be “indicative of scienter.”

Zucco Partners, LLC, 552 F.3d at 995. Plaintiffs rely primarily on CW 1 to allege scienter. CW 1 provides an account of what Defendants Galanti and Jelinek allegedly knew about internal controls in early 2018. CW 1 prepared materials for the management team to present at GDPR board meetings in early 2018. AC ¶ 105. Those materials included data on GDPR and SOX compliance eventually used to create PowerPoints to show the board, which met monthly at the time. Id. CW 1 “believed” that Defendants

Jelinek and Galanti would “discuss[] internal control problems” at the meetings with the Board. Id. Through the GDPR review process, CW 1 stated that Costco’s weak internal controls “got” Defendants Jelinek and Galanti’s attention. Id. ¶ 104. Plaintiffs do not establish that CW 1 had personal knowledge of what Defendants Jelinek and Galanti knew at the time. Zucco Partners, LLC, 552 F.3d at 995. Plaintiffs admit that CW 1 was not at the meetings with the board or with Defendants Jelinek and

Galanti. AC ¶ 105. The Amended Complaint states that CW 1 acquired his information through three degrees of separation: from managers who, in turn, heard about the information from a VP-level employee, who “only occasionally” attended meetings with the board. Id. Further, the data CW 1 prepared for board presentations was used by others who then created the board presentations for GDPR compliance—not internal

controls compliance. CW 1 had no way of verifying14 whether the information and data allegedly showing a material weakness in internal controls was presented to Defendants

14 In response, Plaintiffs cite cases in support of the argument that there is no requirement that CWs have personal knowledge of the facts in their statements. These cases deal with distinct factual scenarios in which the evidence had other, strong indicia of reliability. See Berson v. Applied Signal Tech., Inc., 527 F.3d 982, 985 (9th Cir. 2008) (though confidential witnesses didn’t “see the stop-work orders first-hand,” the orders’ issuance “had the very obvious effect of putting employees out of work” and thus the court could infer the company was losing business from confidential witness testimony); Lloyd v. CVB Fin. Corp., 811 F.3d 1200, 1208 (9th Cir. 2016) (confidential witness testimony based on another individual’s account of a board meeting was sufficiently reliable for pleading purposes because it was “specific in time, context, and details”); In re Cadence Design Sys., Inc. Sec. Litig., 692 F. Supp. 2d 1181, 1188 (N.D. Cal. 2010) (though CW’s testimony was “likely hearsay,” as an industry consultant, CW’s “livelihood depend[ed] upon his access to reliable, specific industry information,” and plaintiffs’ submission of an additional declaration establishing that CWs standing as a consultant in the industry showed that the Jelinek and Galanti. Based on the description of CW 1’s position at the company and the lack of specificity about what Defendants Jelinek and Galanti knew at the time, CW 1

does not have personal knowledge sufficient to raise an inference of scienter. Plaintiffs also allege scienter through CW 6, who “heard about” and witnessed others “allud[ing] to” comments by Defendant Jelinek complaining that the IT Department spent too much money, was over-budget and was not getting things done. Id. ¶ 95. CW 6 also stated that Defendant Galanti gave a speech to the department addressing the “abysmal” results of an IT employee satisfaction survey. Id. ¶ 97.

Plaintiffs have failed to establish a basis for CW 6’s personal knowledge of scienter. Zucco Partners, LLC, 552 F.3d at 995. Hearing about comments from others or overhearing “allusions” to Defendants’ comments without stating that source’s basis for personal knowledge cannot establish a confidential witness’ personal knowledge. See Police Ret. Sys. v. Intuitive Surgical, Inc., 759 F.3d 1051, 1063 (9th Cir. 2014) (finding

that “witnesses [who] lack first hand knowledge regarding what the individual defendants knew or did not know about [the company’s] financial health” lack foundation). CW 6’s statements are also reminiscent of “merely regurgitating gossip and innuendo.” In re Metawave Commc'ns Corp. Sec. Litig., 298 F. Supp. 2d at 1068. Plaintiffs do not allege that the CWs had any direct interactions with individual

Defendants Jelinek or Galanti. There is no indication in the Amended Complaint that the individual Defendants were aware of the CWs’ examples regarding the allegedly deficient internal controls. At most, the Amended Complaint refers to these concerns being raised with “VP-level” or unidentified “management.”15 See AC ¶¶ 83; 86; 102; 105. In sum, there is no indication—and Plaintiffs do not allege—that the Defendants

had reason to know the information that caused Costco to conclude that its internal controls were not effective in October. See In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1059 (9th Cir. 2014) (holding that although company began investigation regarding problems with computer chip at the time statements at issue were made, the court could not infer scienter in absence of allegations showing that the company’s management had knowledge of the extent of the problems at that time). Plaintiffs thus do not establish

scienter based on confidential witness statements. Other Evidence of Scienter Plaintiffs’ allegations of scienter on indirect bases also fail. Plaintiffs allege that Defendants’ ability to access information showing a material weakness is sufficient to support a finding of scienter.16 Ability to access is not enough on its own. Plaintiffs

must allege that Defendants personally accessed the information showing a material weakness in internal controls. Plaintiffs fail to do so. 17 City of Dearborn Heights Act 15 In support of this allegation, Plaintiffs also rely on CW 3’s statement that in 2017, he created a 50-page report regarding the lack of effective systems and procedures related to internal controls in the IT Department. AC ¶ 110. CW 3 did not work at Costco during the relevant time period, and the Court gives these statements no weight. 16 Specifically, Plaintiffs allege that because Barbara Egner, one employee in charge of collecting data for SOX compliance, aggregated data on internal controls, anyone at the company could access the data showing “significant deficiencies” “without extraordinary effort.” Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 27. 17 Relatedly, in their Response, Plaintiffs state that Defendants did know about the material weakness in internal controls because each Defendant “specifically addressed” internal controls in their statements. Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 22-23. Because Defendant “addressed” internal controls, Plaintiffs argue that “Defendants are presumed to have investigated the basis for the statements.” Id. at 23. Again, Plaintiffs fail to plead particularized facts showing when the 345 Police & Fire Ret. Sys. v. Align Tech., Inc., 856 F.3d 605, 620 (9th Cir. 2017) (allegations that fraud would have been “readily apparent” from financial documents

“made available” to defendants was not enough to allege scienter; defendants must have also “personally accessed” the documents showing fraud). The Court may infer scienter “where the information misrepresented is readily apparent to the defendant corporation’s senior management.” Zucco Partners, LLC, 552 F.3d at 1001. If a defendant “must have known about the falsity of the information they were providing to the public because the falsity was obvious from the operations of the company, the defendants’ awareness of the information’s falsity can be assumed.” Id. In such a scenario, the facts must be so “patently obvious” that it would be “absurd to suggest that top management was unaware of them.” Id. (quoting Berson v. Applied Signal Tech., Inc., 527 F.3d 982, 989 (9th Cir. 2008)). Here, Defendants did not have to revise public disclosures of financial results as a result of the material weakness in internal controls, suggesting that the material weakness did not rise to the level of “patently obvious” to Defendants. Plaintiffs do not separately plead facts showing that the weaknesses in internal controls were so “patently obvious” that it would be “absurd” to suggest that Defendants Galanti and Jelinek were unaware of it. The Court will not infer scienter based on the allegations in the Amended Complaint. Zucco Partners, LLC, 552 F.3d at 1001.

individual Defendants had “actual access to the disputed information.” City of Dearborn Heights Act 345 Plaintiffs argue that the remedial measures Defendants undertook after disclosing the material weakness are themselves evidence of scienter. On its own, a company’s

decision to enhance financial controls does not show that those controls were previously deficient. See In re GlenFed, Inc. Sec. Litig., 42 F.3d at 1553 (“The fact that policies may change over time does not mean that an earlier policy was inadequate, or that statements regarding its adequacy were falsehoods.”). In the cases Plaintiffs cite finding scienter after remedial measures, there were also multiple other strong indicia of scienter. See In re Sipex Corp. Sec. Litig., 2005 WL 3096178, at *1 (N.D. Cal. Nov. 17, 2005)

(remedial measures, restatement of financials, “sham” sale, and forced resignation of CEO supported scienter inference); Mild v. PPG Indus., Inc., 2018 WL 6787351, at *5-7 (C.D. Cal. Dec. 21, 2018) (remedial measures, vice president’s termination, and restatement of financials including admission that vice president acted “improperly” supported scienter inference); Luna v. Marvell Tech. Grp., 2017 WL 2171273, at *5

(N.D. Cal. May 17, 2017) (company’s admissions of an inappropriate tone by leadership, termination and rehiring of CEO position, and other remedial measures supported scienter inference). The remedial measures Defendants undertook after disclosing the material weakness are not themselves evidence of Defendants’ scienter during the class period.

Plaintiffs argue that Defendants’ SOX certifications support a finding of scienter when coupled with other allegations. The other allegations of scienter are not compelling. Also, “[a]lthough the passage of Sarbanes-Oxley may make it somewhat more reasonable to infer that a certifying Defendant whose head is in the sand is being deliberately reckless, it does not transform the PSLRA's requirement of falsity-plus- scienter into a requirement of falsity-plus-a-Sarbanes-Oxley-certification.” In re

Watchguard Sec. Litig., 2006 WL 2038656, at *11 (W.D. Wash. Apr. 21, 2006). Plaintiffs also argue that Defendants “conscious[ly]” neglected the IT Department. Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 23. The facts pled do not support a finding that Defendants intentionally or consciously neglected the IT Department. Plaintiffs also fail to establish what Defendants knew at the time. Moreover, a claim that Costco was motivated to keep costs low to maintain profits and growth is too vague and conclusory to state a claim. Such an allegation is also implausible amid Plaintiffs’ other allegations that Costco’s IT employees were highly paid and that Costco was making significant investments in technology. AC ¶¶ 88; 90; 92; 95; see also supra note 8. The Court concludes that none of Plaintiffs’ allegations “standing alone, are sufficient to create a strong inference of scienter.” N.M. State Inv. Council v. Ernst & Young LLP, 641 F.3d 1089, 1095 (9th Cir. 2011). Moreover, “conduct[ing] a ‘holistic’ review of the same allegations,” the Court also determines that the “insufficient allegations [fail to] combine to create a strong inference of intentional conduct or deliberate recklessness.” Id. (quoting Zucco, 552 F.3d at 991-92). D. More Plausible Inference In determining whether a defendant acted with scienter, a court considers “competing inferences” and “plausible, non-culpable explanations.” Tellabs, Inc., 551 U.S. at 323-24. A complaint survives only if the culpable inference is “at least as compelling” as the nonculpable inference. Id. at 324.

Here, the more plausible inference is that Defendants Jelinek and Galanti did not discover how serious the user access and change management issues were until after June 6, 2018. Multiple uncontested facts support this nonculpable inference. On their own, Defendants did disclose the material weakness in disclosure controls in October 2018. The Amended Complaint only alleges that they should have disclosed it sooner. If Defendants knowingly concealed the material weakness in June 2018, it does not make

sense that Defendants later chose to willingly reveal a material weakness in internal controls in October 2018.18 The inference that Defendants were unaware of the material weakness when they filed the quarterly report is also consistent with the relatively short time that companies take to prepare a quarterly, as opposed to annual, report.19 The more plausible inference,

therefore—is not fraud, as Plaintiffs allege in their complaint—but rather that Defendants did not discover the material weakness in internal controls until they underwent the more time-consuming process required to file the company’s annual report.

18 Defendants argue that a lack of motive “undermines” the inferences of scienter. Defendants’ Motion to Dismiss, docket no. 27 at 28. However, a motive is not required to plead securities fraud. Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 48 (2011). 19 The SEC recognizes that companies spend less time preparing quarterly reports, and it does not require quarterly evaluations that are “as extensive” as the annual evaluations. SEC Release 33-8238 at *15. For example, “even where systems testing of [a] component would clearly be required as part of the annual evaluation of internal control over financial reporting, management could make a different determination of the appropriate nature of the evaluation of that component for purposes of a quarterly evaluation of VII. Conclusion For the foregoing reasons, the Court enters the following Order:

(1) Defendants’ Request for Consideration of Documents Incorporated by Reference, docket no. 29, is GRANTED. (2) Defendants’ Motion to Dismiss Consolidated Amended Complaint, docket no. 27, is GRANTED. Plaintiffs’ claims against Defendants are DISMISSED without prejudice with leave to amend. (3) Plaintiffs shall file any amended complaint within ninety (90) days of this

Order. Dated this 26th day of November, 2019. A

Thomas S. Zilly United States District Judge