Johnson v. Costco Wholesale Corporation

• Court: District Court, W.D. Washington
• Decided: November 26, 2019
• Docket: 2:18-cv-01611
• Status: Unknown

Opinion

1 2

3 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 4 AT SEATTLE 5 JAMES JOHNSON individually and on behalf of all others similarly situated, 6 PHIL CHEN, and FRED D. DAVOLI, 7 Plaintiffs, C18-1611 TSZ 8 v. ORDER 9 COSTCO WHOLESALE CORPORATION, W. CRAIG JELINEK, 10 and RICHARD A. GALANTI, 11 Defendants. 12 THIS MATTER comes before the Court on the motion of Defendants Costco 13 Wholesale Corporation (“Costco”), W. Craig Jelinek (“Jelinek”), and Richard A. Galanti 14 (“Galanti”), to dismiss Plaintiffs’ Consolidated Amended Complaint for failure to state a 15 claim under Federal Rule of Civil Procedure 12(b)(6), docket no. 27, and Defendants’ 16 Request for Consideration of Documents Incorporated by Reference, docket no. 29. 17 Having reviewed all papers filed in support of and in opposition to the motion, the Court 18 enters the following order. 19 I. Summary 20 Plaintiffs allege violations of the Securities Exchange Act of 1934 (“Exchange 21 Act”) and Rule 10b-5 against all Defendants and violations of Section 20(a) of the 22 1 class of shareholders who acquired Costco stock during the period from June 6, 2018 to 2 October 25, 2018. Plaintiffs allege that Costco and the individual corporate Defendants,

3 CEO Craig W. Jelinek and CFO Richard A. Galanti, misrepresented facts about the 4 company’s internal controls in connection with its June 6, 2018 and October 4, 2018 5 public statements and filings. 6 On June 6, 2018, Costco filed a 10-Q for the quarter ending May 13, 2018. 7 Consolidated Amended Complaint (“AC”) ¶¶ 11; 156. In the filing, Costco stated that its 8 internal controls over financial reporting were sufficient, there were no material

9 weaknesses related to its financial reporting, and the company was “currently making and 10 will continue to make, significant technology investments to improve or replace critical 11 information systems and processing capabilities.” Id. ¶¶ 11; 159. On October 4, 2018, 12 Costco announced that it “expect[ed] to report a material weakness in internal control[s]” 13 for financial results reported for the 2018 fiscal year. Id. ¶ 12. Costco’s stock price

14 dropped from $231.68 to $218.82. Id. 15 On October 26, 2018, Costco filed its annual 10-K, which described the 16 remediation measures it was planning to undertake to correct the weakness in its internal 17 controls. Id. ¶¶ 13; 128-30. On this news, Costco’s stock price dropped again from 18 $226.40 to $218.19. Id. ¶ 14.

19 Specifically, Plaintiffs allege that at the time of the June 6, 2018 filing, 20 Defendants’ internal controls and procedures were “not effective.” Id. ¶ 155. Plaintiffs 21 allege Costco had “a material weakness in internal controls over financial reporting.” Id. 22 Plaintiffs also allege that the October 4, 2018 statements were false because Defendants 1 failed to disclose the full extent of the problems with access and change controls or what 2 caused them. Id. ¶ 163. Plaintiffs also allege that these false and misleading statements

3 were made intentionally or with deliberate recklessness. Id. ¶¶ 211; 214. Plaintiffs rely 4 on confidential witness statements, the individual Defendants’ certifications of public 5 disclosures, later public disclosures, and Defendants’ remedial efforts to argue that the 6 Court should infer the Defendants’ scienter. Id. ¶¶ 173-183. 7 Defendants move to dismiss the Amended Complaint. For the reasons set forth in 8 this Order, the Court GRANTS the Defendants’ Motions, docket nos. 27 and 29, and

9 dismisses Plaintiffs’ claims without prejudice and with leave to amend. 10 II. Background 11 A. Costco’s Financial Reporting Control Framework 12 To ensure accurate financial reporting, Costco uses the Internal Control – 13 Integrated Framework, which is issued by the Committee of Sponsoring Organizations of

14 the Treadway Commission (“COSO Framework”). Id. ¶ 62. Costco uses COSO to 15 evaluate internal controls and ensure compliance with SEC regulations. Id. The COSO 16 Framework includes guidelines regarding change and access controls. Id. ¶¶ 63; 67. 17 Change controls are a company’s process to add or modify users and devices and install 18 or update IT. Id. Access controls concern a company’s ability to control user access to

19 systems based on their “employment status, position, and changes, thereto.” Id. ¶ 72. 20 Together, access and change controls ensure the accuracy of the financial reporting 21 process by restricting the ability to change information to only authorized users. Id. ¶ 67. 22 A deficiency in internal controls could, for example, allow an IT user without knowledge 1 of accounting requirements to make a change that impacts the data used for financial 2 reporting. Id. ¶¶ 66-74.

3 B. Defendants’ Alleged Six False Statements1 4 Plaintiffs base their securities claims on six allegedly false public statements. 5 Statement 1: 6 On June 6, 2018, Defendants filed its 3Q2108 Form 10-Q stating: 7 Item 4—Controls and Procedures. As of the end of the period covered by this Quarterly Report on Form 10-q, we performed an evaluation under the 8 supervision and with the participation of management, including our Chief Executive Officer and Chief Financial Officer, of our disclosure controls and 9 procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities and Exchange Act of 1934 (the Exchange Act)). Based upon that evaluation, our 10 Chief Executive Officer and Chief Financial Officer concluded that, as of the end of the period covered by this Quarterly Report, our disclosure controls and 11 procedures are effective. 12 There have been no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) 13 during our most recently completed fiscal quarter that have materially affected or are reasonably likely to materially affect our internal control over financial 14 reporting. Id. ¶ 152. Statements 2 & 3: 15 Pursuant to the Sarbanes Oxley Act of 2002 (“SOX”), Defendants Jelinek and 16 Galanti each certified the 3Q2018 Form 10-Q filed June 6, 2018 stating: 17 I certify that: 18 I have reviewed this Quarterly Report on Form 10-q of Costco Wholesale Corporation (“the registrant”); 19 2) Based on my knowledge, this report does not contain any untrue 20 statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements 21 were made, not misleading with respect to the period covered by this report; 22 1 3) Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the 2 financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report; 3 4) The registrant’s other certifying officer(s) and I are responsible for 4 establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial 5 reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the registrant and have: 6 Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that 7 material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly 8 during the period in which this report is being prepared; 9 Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide 10 reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with 11 generally accepted accounting principles; 12 Evaluated the effectiveness of the registrant’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness 13 of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and 14 Disclosed in this report any change in the registrant’s internal control over 15 financial reporting that occurred during the registrant’s most recent fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) 16 that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting; and 17 5) The registrant’s other certifying officer(s) and I have disclosed, based on 18 our most recent evaluation of internal control over financial reporting, to the registrant’s auditors and the audit committee of the registrant’s board of 19 directors (or persons performing the equivalent functions): All significant deficiencies and material weaknesses in the design or operation 20 of internal control over financial reporting which are reasonably likely to adversely affect the registrant’s ability to record, process, summarize and report 21 financial information; and 22 1 Any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal control over 2 financial reporting. Id. ¶ 154. 3 Statement 4: In the same 10-Q filed June 6, 2018, Defendants stated: “There have been no 4 material changes in our risk factors from those disclosed in our [2017] Annual Report on Form 10-k.” Id. ¶ 159. 5 One of the risk factors in Costco’s 2017 Form 10-K stated that the company was 6 “currently making and will continue to make, significant technology investments to improve or replace critical information systems and processing capabilities.” Id. 7 Statement 5: 8 On October 4, 2018, Defendants issued a Form 8-K and accompanying press 9 release regarding the material weakness in internal controls stating: 10 While the Company is still completing its assessment of the effectiveness of its internal control over financial reporting as of September 2, 2018, in its 11 upcoming fiscal 2018 Annual Report on Form 10-k, it expects to report a material weakness in internal control. The weakness relates to general information 12 technology controls in the areas of user access and program change- management over certain information technology systems that support the 13 Company’s financial reporting processes. The access issues relate to the extent of privileges afforded users authorized to access company systems. As of the date 14 of this release, there have been no misstatements identified in the financial statements as a result of these deficiencies, and the Company expects to timely file 15 its Form 10-k. Remediation efforts have begun; the material weakness will not be 16 considered remediated until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these 17 controls are operating effectively. The Company expects that the remediation of this material weakness will be completed prior to the end of fiscal year 2019. 18 Id. ¶ 161. 19 Statement 6: 20 That same day, Defendants Galanti and Jelinek participated in an earnings call with analysts. Defendant Galanti stated: 21 A last topic, as was noted in this afternoon’s press release, we plan to report 22 in our Form 10-k the material weakness in internal control related to general IT 1 management over a certain of our IT systems that relate to our financial reporting processes. I can tell you that there have been no misstatements 2 identified in the financial statement as a result of the deficiencies, and we expect to timely file our Form 10-k. 3 In terms of remediation, remediation efforts have begun, but material 4 weakness will not be considered remediated until the applicable controls operate for a sufficient period of time and we can conclude through testing that the 5 controls are operating effectively. We expect that the remediation of the material weakness will be completed prior to the end of fiscal 2019. 6 Well, keep in mind, first of all, that we feel comfortable, and we feel that our -- ultimately, our auditors feel comfortable. We wouldn’t have expressed the 7 level of comfort we did in the press release about the time that there’s no mistake [there’s the timing that] we filed on time, including the K. The issues had to do 8 with internal user access, so people within IT or contractors and when somebody who may have had access to something they should have and 9 sometimes that they -- once they should have had that access relieved, it took a little too long to do so. So the controls weren’t in place. We should have done a 10 better job. We went back as far as we could and looked back as far as we could in some systems for the entire fiscal year, which is what you want to do. In some 11 of the newer systems, there was no look back ability for certain things. I can tell you with all the look backs that we have done and then our outside help has 12 done has found no issues whatsoever in terms of misstatements or breaches. So that’s what we can tell you. But we can’t be more positive than that until we 13 release the Form 10-K. And as -- and so I don’t want to belittle it. We should have -- it should have been fixed, but it was internal to us, not external. And 14 we’ll go from there. Id. ¶ 162. 15 Costco’s stock price dropped on this news from $231.68 on October 4, 2018 to $218.82 on October 5, 2018, a drop of 5.55%. Id. ¶ 186. 16 C. Costco’s 2018 10-K Report 17 On October 26, Costco filed its annual 10-K report, which stated that “as of 18 September 2, 2018,” the company concluded that “the disclosure controls and procedures 19 were not effective as of such date due to a material weakness in internal control over 20 financial reporting.” Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 29). 21 Specifically, Costco “identified a material weakness in internal control[s] related to 22 ineffective information technology general controls [] in the areas of user access and 1 program change-management over certain information technology [] systems that support 2 the Company’s financial reporting processes.” AC ¶ 128.

3 As part of the 10-K report, Costco’s independent registered public accounting 4 firm, KPMG, provided further explanation of the material weakness. Id. ¶ 131. KPMG 5 stated that the control deficiencies were a result of “IT control processes [that] lacked 6 sufficient documentation; insufficient knowledge and training of certain individuals with 7 IT expertise; and risk-assessment processes [that were] inadequate to identify and assess 8 changes in IT environments and personnel that could impact internal control over

9 financial reporting.” Id. On October 26, 2018, Costco’s stock price dropped from 10 $226.40 to $218.19—3.63%. Id. ¶ 14. 11 Lead Plaintiff brings this action on behalf of himself and all persons and entities 12 that purchased Costco securities during the period from June 6, 2018 through October 25, 13 2018 and were damaged. Id. ¶ 195. Plaintiffs now allege that the six statements made in

14 Costco’s public filings and by Costco senior executives constitute securities fraud under 15 (1) Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b), and Rule 10b-5 promulgated 16 thereunder by the SEC at 17 C.F.R. § 240.10b-5; and (2) Section 20(a) of the Exchange 17 Act, 15 U.S.C. § 78t(a). Plaintiffs allege that these six false and misleading statements 18 had the effect of artificially inflating Costco’s stock, resulting in harm to the putative

19 class members when Defendants’ misrepresentations became apparent to the market, and 20 the price of Costco stock dropped. Plaintiffs rely principally on the allegations of seven 21 confidential witnesses to allege falsity and scienter. Id. ¶¶ 23-30; 82-118; 167; 170-72; 22 177. Plaintiffs also rely on Costco’s October 10-K filing to show the falsity of statements 1 in the June 10-Q filing. Id. ¶ 128; Plaintiffs’ Opposition to Defendants’ Motion to 2 Dismiss, docket no. 33 at 15-16. Specifically, Plaintiffs allege that Costco’s Form 10-K

3 for the fiscal year 2018 filed on October 26, 2018 “provided a description of the 4 expensive and widespread remediation measures it was planning to undertake” as further 5 evidence of Costco’s false statements during the class period. AC ¶ 136. 6 III. Confidential Witness Statements 7 Plaintiffs rely on the statements of seven confidential witnesses (“CWs”) in the 8 Amended Complaint. A complaint relying on statements from confidential witnesses

9 must pass two hurdles to satisfy the Private Securities Litigation Reform Act (“PSLRA”) 10 pleading requirements: (1) the confidential witnesses must be described with sufficient 11 particularity to establish their reliability and personal knowledge, and (2) those 12 statements which are reported by confidential witnesses with sufficient reliability and 13 personal knowledge must themselves be indicative of scienter. Zucco Partners, LLC v.

14 Digimarc Corp., 552 F.3d 981, 995 (9th Cir. 2009) (citing In re Daou Sys., Inc. Sec. 15 Litig., 411 F.3d 1006, 1015-16, 1022 (9th Cir. 2005)). 16 The Court must consider whether Plaintiffs have “provided sufficient detail about 17 the confidential witness’ position within the defendant company” to establish the 18 reliability and personal knowledge of the confidential witnesses. Zucco Partners, LLC,

19 552 F.3d at 995. Plaintiffs must plead with “substantial specificity” how confidential 20 witnesses “came to learn of the information they provide in the complaint.” In re 21 Northpoint Commc’ns Grp., Inc. Sec. Litig., 184 F. Supp. 2d 991, 1000 (N.D. Cal. 2001). 22 The court must be able to tell whether a confidential witness is speaking from personal 1 knowledge, or “merely regurgitating gossip and innuendo.” In re Commtouch Software 2 Ltd. Sec. Litig., 2002 WL 31417998, at *3 (N.D. Cal. July 24, 2002). “The Court can

3 look to the level of detail provided by the confidential witness, the corroborative nature 4 of other facts alleged (including from other sources), the coherence and plausibility of the 5 allegations, the number of sources, the reliability of the sources, and similar indicia.” In 6 re Metawave Commc'ns Corp. Sec. Litig., 298 F. Supp. 2d 1056, 1068 (W.D. Wash. 7 2003) (quoting In re Cabletron Sys., Inc., 311 F.3d 11, 29-30 (1st Cir. 2002)). 8 The Court concludes that Plaintiffs describe CWs 1, 5, 6, and 7 with sufficient

9 particularity to establish their reliability and personal knowledge regarding at least some 10 of Plaintiffs’ allegations. The Amended Complaint provides little support for any 11 significant reliance on CWs 2 and 4. The Court does not rely on CW 3 primarily because 12 that witness did not work at Costco during the relevant period. 13 Confidential Witness 1 (“CW 1”)

14 The Amended Complaint describes CW 1 as a former Senior Compliance Analyst 15 employed by Costco from 2015 to September 2018. Id. ¶ 24. CW 1 was three reporting 16 levels below the Vice President (“VP”) of Information Security and Compliance. Id. His 17 responsibilities primarily included compliance with privacy regulatory regimes. Id. 18 CW 1 stated that the compliance team was “spread thin,” understaffed, and

19 suffered from high turnover and employee burnout. Id. ¶¶ 83-85. For example, CW 1 20 stated that compliance work in some departments occurred in “3-4 month fire drills,” 21 after which the department would return to minimal staffing. Id. ¶ 84. CW 1 stated that 22 the operating systems were also antiquated, which made it difficult to hire employees 1 knowledgeable about those systems. Id. ¶ 84. CW 1 believed that “there were never 2 enough compliance personnel for a company the size of Costco.” Id.

3 CW 1 stated that IT employees were not well trained. For example, many 4 employees did not know about or did not use Archer, the system for managing 5 governance, risk management, and compliance issues. Id. ¶¶ 102-103. CW 1 did not 6 know about Archer until his second year at the company. Id. ¶ 103. 7 Most SOX compliance work fell to one employee—Barbara Egner (“Egner”). 8 Id. ¶ 24. CW 1 described Ms. Egner as “super frustrated” with the SOX compliance

9 process because “management didn’t want to listen.” Id. ¶ 83. Instead, according to CW 10 1, VPs would ask if they could “get by” without remediating issues. Id. 11 CW 1 also detailed specific user access and change management issues. CW 1 12 retained access to a system long after he transferred departments and had to track down 13 management and “fight” to get access revoked. Id. ¶ 106. CW 1 stated that Costco

14 managed user access to systems through a Google form system, which made it difficult to 15 tell whether the work actually took place. Id. CW 1 also stated that Costco lacked a 16 policy revoking access to email on personal cell phones when employees left the 17 company. Id. ¶ 107. As of March 2019, CW 1 still had access to all his old Costco work 18 emails, despite leaving the company in September of 2018. Id.

19 CW 1 provided insight about Costco’s review of its IT processes and compliance 20 with the European Union’s General Data Protection Regulation (“GDPR”). CW 1 21 attended regular meetings with VP level employees and outside auditors in which they 22 discussed how to comply with GDPR. Id. ¶ 86. One of the weaknesses CW 1 found in 1 addressing GDPR compliance was related to internal controls and “how easy it was for 2 anyone to log into a particular system.” Id. The GDPR compliance team found “the

3 same kind of weaknesses . . . throughout Costco’s IT ecosystem.” Id. When presented 4 with possible solutions for the issues that came up in the GDPR compliance review, 5 “senior management” stated the measures were “too costly” or required “too much 6 headcount.” Id. ¶ 86. 7 From the meetings with VP employees and auditors, CW 1 helped prepare 8 materials for the management team to present at GDPR board meetings. Id. ¶ 105.

9 Those materials included data on GDPR and SOX compliance. Id. Management used 10 that data to create PowerPoints for the board, which met monthly in early 2018. Id. 11 CW 1 did not attend those meetings but believed that Defendants Jelinek and Galanti 12 discussed and were “highly engaged” with internal control problems at those meetings. 13 Id. ¶ 104. CW 1 believed that Costco’s weak internal controls got Defendants Jelinek

14 and Galanti’s attention. Id. 15 Confidential Witness 2 (“CW 2”) 16 CW 2 was employed from 2015 until “mid-2018” and “reported through a chain” 17 up to the VP of Information and Compliance. Id. ¶ 25. CW 2 is alleged to have “insight 18 into issues affecting IT security.” Id. CW 2’s statements vaguely allude to “room for

19 improvement.” Id. ¶ 87. CW 2 also characterized Costco’s attitude towards the IT 20 Department as a “necessary evil” and an “afterthought.” Id. 21 CW 2’s statements are vague—without specific examples or dates. The precise 22 dates of CW 2’s tenure at Costco are also not clear, and Plaintiffs do not clearly allege 1 that CW 2 worked during the class period. “Any inference that pre-Class Period 2 practices continued during the Class Period amounts to unsubstantiated speculation,” City

3 of Roseville Emps.’ Ret. Sys. v. Sterling Fin. Corp., 963 F. Supp. 2d 1092, 1135-36 (E.D. 4 Wash. 2013), aff'd, 691 Fed. Appx. 393 (9th Cir. 2017), thus CW 2 lacks a “basis to 5 opine about [Costco’s] practices after [he] left the company.” In re Downey Sec. Litig., 6 2009 WL 2767670, at *10 (C.D. Cal. Aug. 21, 2009). The Court gives little weight to 7 CW 2’s statements. 8 Confidential Witness 3 (“CW 3”)

9 CW 3 was employed as a Costco consultant from April 2017 until the end of May 10 2017—over a year before the class period began. AC ¶ 26. CW 3 reported to various 11 managers and directors working in SAP2 Platform security, compliance, and services. Id. 12 He was responsible for assessing Costco’s IT Department’s change management and user 13 and identity access management. Id. CW 3 described ChaRM, a new change

14 management system that Costco was developing to improve workflow. Id. ¶ 88. CW 3 15 stated that there were “a lot of gaps” in the company’s change management and that some 16 employees had “way more access than they should have.” Id. ¶¶ 88; 108. CW 3 created 17 a 50-page report detailing the weaknesses in Costco’s internal controls that he gave to the 18 Director of Global SAP Platform services. Id. ¶ 170. CW 3 stated that the individual

19 Defendants “easily could have accessed” the report and Costco “should have known 20 21

22 2 SAP is a company that offers a wide range of business software that allows companies to track various 1 about the issues” with internal controls. Id. CW 3 does not state that the Defendants 2 ever, in fact, saw the report.

3 Primarily because CW 3 left Costco’s employment at the end of May 2017, the 4 Court gives CW 3’s statements no weight. In re Downey Sec. Litig., 2009 WL 2767670, 5 at *10 (CWs lack basis to opine about a certain practice after they left the company); City 6 of Roseville Emps.’ Ret. Sys., 963 F. Supp. 2d at 1135-36 (“Any inference that pre-Class 7 Period practices continued during the class Period amounts to unsubstantiated 8 speculation.”). CW 3’s statements are also unreliable because he makes statements that

9 are vague (see AC ¶ 88 stating that there were “a lot of gaps in the company’s change 10 management”), and he relies on hearsay statements (see id. stating that “a colleague that 11 remains with Costco informed him”). 12 Confidential Witness 4 (“CW 4”) 13 CW 4 was employed as a contractor for SAP implementation from May 2018 until

14 November 2018 and was two reporting levels below the Project Manager level. Id. ¶ 27. 15 CW 4 was responsible for performing and overseeing quality assurance testing. Id. 16 CW 4 worked on implementing a new “premium” SAP system designed to improve 17 reporting and provide more structure. Id. ¶ 90. Though CW 4 stated that Costco was 18 investing in “premium” systems to improve the IT Department, he also stated that the IT

19 department was under-resourced. Id. ¶ 91. CW 4 stated that team projects were months 20 behind schedule because there was “slippage,” and projects were not hitting the needed 21 “velocity.” Id. CW 4 also stated that the IT Department suffered from employee 22 turnover but failed to explain the significance of that turnover except to say that “this 1 contributed to the resources problem.” Id. The only specific project that CW 4 described 2 was the supply chain project, which he stated was “stalled.” Id. That reference is vague

3 and provides no information as to whether Defendants’ statements regarding internal 4 controls are actionable. 5 The Court lends little weight to CW 4’s vague and inconsistent statements. 6 CW 4’s statements are internally inconsistent regarding whether or not the IT Department 7 was actually underfunded. Applestein v. Medivation, Inc., 861 F. Supp. 2d 1030, 1038 8 (N.D. Cal. 2012), aff'd, 561 Fed. Appx. 598 (9th Cir. 2014) (“[T]he confidential witness

9 statements in the TAC are unreliable because they contradict statements made by the 10 same group of witnesses in the SAC.”); In re Downey Sec. Litig., 2009 WL 2767670, at 11 *10 (finding that “contradictions [in the testimony] severely undermine the reliability of 12 [] confidential witnesses”). Further, CW 4’s vague statements regarding “slippage” and 13 “velocity” lack particularized detail. See Limantour v. Cray, Inc., 432 F. Supp. 2d, 1129,

14 1143-44 (W.D. Wash. 2006) (CW statements regarding “scheduling slippages” were “too 15 general and too vague” to support a securities fraud claim). 16 Confidential Witness 5 (“CW 5”) 17 CW 5 was an IT Contract and Vendor Manager in Costco’s IT Department from 18 July 2017 until July 2018. AC ¶ 28. CW 5 was three reporting levels below the Senior

19 VP of Information Systems. Id. CW 5’s responsibilities included managing and 20 providing recommendations to improve Costco’s IT contracts procurement process. Id. 21 CW 5 attended monthly meetings with VPs in the IT Department. Id. ¶ 93. At the 22 1 meetings, CW 5 raised concerns regarding user access and change management issues, 2 but no one ever addressed the issues. Id.

3 CW 5 stated that advancement in the IT Department was based on seniority, not 4 on job performance. Id. ¶ 94. As a result, many warehouse employees without 5 significant IT experience were able to get jobs within the IT Department and were 6 promoted. Id. Costco lacked oversight of those inexperienced employees and how they 7 performed their jobs. Id. 8 Throughout CW 5’s year-long tenure at Costco, third party contractors often had

9 unfettered access to Costco’s systems. Id. ¶¶ 112; 114. For example, competing 10 contractors could view others’ bids with Costco. Id. ¶ 112. Many IT contractors also had 11 “full badge access” to Costco’s IT systems instead of just having access to what they 12 needed to complete their projects. Id. When employees onboarded or departed, there 13 was no process for transitioning their responsibilities to new employees. Id. ¶ 113. Like

14 other confidential witnesses, CW 5 stated that Costco’s IT project managers used Google 15 spreadsheets for manually managing IT employee access to systems. Id. ¶¶ 113-14. 16 CW 5 stated that the information in the Google spreadsheets was easy for anyone to 17 access and change. Id. ¶ 113. Many contractors and employees were never offboarded 18 from Costco’s systems, and many former contractors were still listed as employees with

19 access. Id. ¶ 114. For example, CW 5’s colleague continued to have access to Costco’s 20 systems at least a month after leaving the company. Id. 21 22 1 The Court concludes that Plaintiffs describe CW 5 with sufficient particularity to 2 establish his personal knowledge regarding Plaintiffs’ allegations relating to Costco’s

3 internal controls. 4 Confidential Witness 6 (“CW 6”) 5 CW 6 was a Compliance Analyst at Costco from 2012 until August 2018. Id. 6 ¶ 29. CW 6 was two reporting levels below the VP of Security and Compliance. Id. CW 7 6 was responsible for “assessing security controls by collecting evidence.” Id. CW 6 8 reported that Costco viewed the IT Department as a “cost center” that was “not adding

9 value.” Id. ¶ 95. CW 6 “heard about Defendant Jelinek complaining about how much 10 money was spent in the IT Department, the number of employees it had, and that it was 11 often over-budget with no major projects ever seemingly getting done.” Id. CW 6 also 12 “heard” allusions to similar comments by Defendant Jelinek in meetings and in 13 discussions with colleagues. Id. CW 6 further heard that Defendant Jelinek wanted to fix

14 these problems by asking the IT Department to cut costs. Id. These statements are based 15 on unreliable hearsay from other unnamed persons. 16 Beginning around December 2017, VPs at Costco attended IT Department 17 “engagement meetings” where they made it their “mission” to reduce the number of 18 specialized IT contractors to reduce costs. Id. ¶ 96. It is unclear how CW 6 was privy to

19 this information as he does not state that he attended these meetings. 20 CW 6 vaguely stated that the IT Department lacked direction, was “not healthy,” 21 and there was general discontent among IT employees. Id. ¶ 95. CW 6 described an 22 “exodus” of IT Department employees who left the company in August 2018. Id. ¶ 97. 1 CW 6 was the 26th employee to leave in a three-month period. Id. Without additional 2 context or examples, these generalized allegations about the state of the IT department

3 are vague and unreliable. 4 CW 6 also stated that due to the “abysmal” results of an undated IT Department 5 employee satisfaction survey, Defendant Galanti gave a speech to the department. 6 Id. ¶ 97. This allegation is also vague. It is unclear when Defendant Galanti gave his 7 speech, what he discussed in his speech, and whether CW 6 even attended. It is similarly 8 unclear whether the “abysmal” results of the employee satisfaction survey regarded

9 issues that affected Costco’s internal controls or whether it related to some other 10 employee dissatisfaction having nothing to do with the internal controls. 11 CW 6 also described the internal audit process as “an informal process of risk 12 acceptance.” Id. ¶ 98. Costco lacked a clear process for reporting issues with vendors 13 and then tracking any resulting necessary remediation. Id. CW 6 also cited Google

14 spreadsheets as the primary mechanism for granting and revoking user access to Costco’s 15 systems. Id. ¶ 115. CW 6 reiterated that the process for managing these spreadsheets 16 was manual and offboarding depended on the diligence of that contractor’s supervisor. 17 Id. 18 CW 6 also stated that there was an internal risk registry where most teams in the

19 IT Department would log potential security threats. Id. ¶ 116. There was a six-month 20 period in early 2018 when Costco lacked a centralized team overseeing this risk registry. 21 Id. 22 1 CW 6’s statements are reliable to the extent they provide examples about Costco’s 2 lack of internal controls including the use of Google spreadsheets and the lack of

3 systemized risk management regarding internal controls. However, the Court lends little 4 weight to CW 6’s general statements regarding the unhealthy culture of the IT 5 Department and the hearsay from other unnamed persons regarding what the individual 6 Defendants knew at the time. 7 Confidential Witness 7 (“CW 7”) 8 CW 7 was a Senior Business Analyst at Costco from 2014 until July 2018.3

9 Id. ¶ 30. CW 7 was two reporting levels below the Global Supply Chain VP. Id. CW 7 10 was responsible for working with outside consultants to create new systems designs. Id. 11 He stated that “almost all” of the projects he worked on were cancelled before completion 12 and two were put on hold. Id. ¶ 99. CW 7 worked on one project for two years, and the 13 IT Department put it on hold upon his departure. Id. CW 7 reiterated the lack of IT

14 training stated by other confidential witnesses. Id. For example, CW 7’s direct report 15 had no IT background, and IT training consisted of basics like “how to lock one’s 16 computer.” Id. CW 7 observed that other employees were promoted based on tenure 17 rather than ability. Id. 18 Weight of Confidential Witness Statements

19 In sum, the Court concludes that Plaintiffs have provided sufficient detail about 20 CWs 1, 5, 6 and 7 to establish their reliability and personal knowledge as to at least some 21

22 3 The Court notes that CW 7’s tenure overlapped with the class period for less than a two-month period. 1 of Plaintiffs’ claims. However, the Amended Complaint fails to establish the reliability 2 of CWs 2 and 4, and the Court lends their statements little weight. CW 3 did not work at

3 Costco during the relevant time period, and the Court gives his statements no weight. 4 IV. Regulatory Scheme 5 A. Sarbanes Oxley Act of 2002 (“SOX”) 6 Pursuant to section 302 of SOX, public companies must maintain “internal control 7 over financial reporting” and “disclosure controls and procedures.” 15 U.S.C. § 7241; 8 17 C.F.R. § 240.13a-15(a)-(d).4 “Internal control” over financial reporting is defined as

9 “reasonable assurance” regarding the “reliability of financial reporting and the 10 preparation of financial statements for external purposes in accordance with generally 11 accepted accounting principles.” 17 C.F.R. § 240.13a-15(f). Internal controls 12 safeguarding accuracy must be “under the supervision of[] the issuer’s principal 13 executive and principal financial officers.” 17 C.F.R. § 240.13a-15(f). “[D]isclosure

14 controls and procedures” are “designed to ensure that information required to be 15 disclosed by the [company] in the reports that it files or submits under the Act . . . is 16 recorded, processed, summarized and reported” and “communicated to the [company’s] 17 management.” 17 C.F.R. § 240.15d-15(e). 18

19 20 21 22 1 B. Public Filing Requirements 2 Annual Reports

3 Pursuant to Section 404 of SOX, public companies issue annual reports 4 “containing an assessment . . . of the effectiveness of the company’s internal control 5 structure and procedures for financial reporting.” SEC Release No. 33-8238 at *3 6 (implementing Section 404). In each annual report, companies must disclose “material 7 weaknesses” in the company’s internal control over financial reporting. SEC Release 8 No. 33-8238 at *11. Pursuant to the Exchange Act, a “material weakness” in internal

9 controls is “a deficiency, or a combination of deficiencies, in internal control over 10 financial reporting such that there is a reasonable possibility that a material misstatement 11 of the registrant's annual or interim financial statements will not be prevented or detected 12 on a timely basis.” 5 17 C.F.R. § 240.12b-2. 13 Quarterly Reports

14 Public companies issue quarterly reports pursuant to SOX “evaluat[ing] any 15 change in the company’s internal control over financial reporting that occurred during a 16 fiscal quarter that has materially affected . . . the company’s internal control over 17

18 5 Both Plaintiffs and Defendants attempt to massage the requirements for public disclosure of a material 19 weakness in their favor. Defendants’ definition of material weakness is wrong. Compare Defendants’ Reply in Support of Motion to Dismiss, docket no. 36 at 8 (defining material weakness as a situation “where deficiencies have become so severe in the aggregate that there is a reasonable possibility of a 20 material misstatement”) (emphasis added) with 17 C.F.R. § 240.12b-2 (Exchange Act definition of material weakness as “a deficiency, or a combination of deficiencies, in internal control over financial 21 reporting”) (emphasis added). Plaintiffs’ definition of material weakness is also wrong. Compare Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 8 (material weakness 22 necessarily exists where there is a mere “risk” of misstatement of financial results) with 17 C.F.R. § 240.12b-2 (Exchange Act requirement of a “reasonable possibility” of misstatement of financial results to 1 financial reporting.” SEC Release No. 33-8238 at *15. The SEC does not require 2 quarterly evaluations that are “as extensive” as the annual evaluations. Id. “Even where

3 systems testing of [a] component would clearly be required as part of the annual 4 evaluation of internal control over financial reporting, management could make a 5 different determination of the appropriate nature of the evaluation of that component for 6 purposes of a quarterly evaluation of disclosure controls and procedures.” Id. at *17 7 n.93. 8 C. Executive Certification of Filings

9 SOX requires that CEOs and CFOs of public companies certify public filings. 15 10 U.S.C. § 7241. Certification indicates that “based on the officer’s knowledge, the report 11 does not contain any untrue statement of material fact” and that the signing officers have 12 “evaluated the effectiveness of the [company’s] internal controls . . . within 90 days prior 13 to the report.” 15 U.S.C. § 7241(a).

14 V. Legal Standards 15 A. Incorporation by Reference 16 A defendant normally cannot introduce additional evidence in support of a Rule 17 12(b)(6) motion without converting the motion into a Rule 56 motion for summary 18 judgment. Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001), impliedly

19 overruled on other grounds as discussed in Gallardo v. DiCarlo, 203 F. Supp. 2d 1160, 20 1162 n.2 (C.D. Cal. 2002). However, in a securities fraud action, the court may take 21 judicial notice of documents attached to or referenced in the complaint where the 22 authenticity of the documents is not in dispute. In re Wet Seal, Inc. Sec. Litig., 518 F. 1 filings, including SEC filings, and other matters of public record such as press releases, 2 analyst reports, news articles, and conference call transcripts, where such documents are

3 relied upon in the complaint. Id. 4 B. Motion to Dismiss 5 Although a complaint challenged by a Rule 12(b)(6) motion to dismiss need not 6 provide detailed factual allegations, it must offer “more than labels and conclusions” and 7 contain more than a “formulaic recitation of the elements of a cause of action.” Bell Atl. 8 Corp. v. Twombly, 550 U.S. 544, 555 (2007). The complaint must indicate more than

9 mere speculation of a right to relief. Id. When a complaint fails to adequately state a 10 claim, such deficiency should be “exposed at the point of minimum expenditure of time 11 and money by the parties and the court.” Id. at 558. A complaint may be lacking for one 12 of two reasons: (i) absence of a cognizable legal theory, or (ii) insufficient facts under a 13 cognizable legal claim. Robertson v. Dean Witter Reynolds, Inc., 749 F.2d 530, 534 (9th

14 Cir. 1984). In ruling on a motion to dismiss, the Court must assume the truth of the 15 plaintiff’s allegations and draw all reasonable inferences in the plaintiff’s favor. Usher v. 16 City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). The question for the Court is 17 whether the facts in the complaint sufficiently state a “plausible” ground for relief. 18 Twombly, 550 U.S. at 570. If the Court dismisses the complaint or portions thereof, it

19 must consider whether to grant leave to amend. Lopez v. Smith, 203 F.3d 1122, 1130 (9th 20 Cir. 2000). 21 22 1 C. Pleading Standard Under the Securities Exchange Act of 1934 and the PSLRA 2 Section 10(b) of the Exchange Act makes it unlawful for any person to “use or

3 employ, in connection with the purchase or sale of any security . . . any manipulative or 4 deceptive device or contrivance[.]” 15 U.S.C. § 78j(b). SEC Rule 10b–5 imposes 5 liability on any person who “make[s] any untrue statement of a material fact” or “omit[s] 6 to state a material fact necessary in order to make the statements made, in light of the 7 circumstances in which they were made, not misleading.” 17 C.F.R. § 240.10b–5(b). 8 To state a Section 10(b) claim, a plaintiff must allege: (1) a material misstatement

9 or omission by the defendant; (2) scienter; (3) a connection between the material 10 misrepresentation and the purchase or sale of a security; (4) reliance upon the 11 misrepresentation or omission; (5) economic loss; and (6) loss causation. Halliburton 12 Co. v. Erica P. John Fund, Inc., 573 U.S. 258, 267 (2014).6 13 Under the PSLRA, Section 10(b) claims must be pled with particularity. In re

14 Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). The PSLRA heightens 15 the particularity required but does not convert a motion to dismiss into a trial by papers. 16 In re LDK Solar Sec. Litig., 584 F. Supp. 2d 1230, 1260 (N.D. Cal. 2008); see also 17 Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322 (2007) (even in PSLRA 18 cases, courts must accept all factual allegations in the complaint as true). Further, courts

19 are cautioned against allowing heightened pleading standards to make it “near 20 21

22 6 Defendants move only on the basis that the Plaintiffs fail to allege falsity and scienter. The other 1 impossible” to state a fraud claim. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 2 999 (9th Cir. 2018).

3 To allege an actionable false or misleading statement under the PSLRA, a plaintiff 4 must “specify each statement alleged to have been misleading, the reason or reasons why 5 the statement is misleading, and, if an allegation regarding the statement or omission is 6 made on information and belief, . . . state with particularity all facts on which that belief 7 is formed.” In re Rigel Pharm., Inc. Sec. Litig., 697 F.3d 869, 877 (9th Cir. 2012) 8 (quoting 15 U.S.C. § 78u-4(b)(1)). This requires a plaintiff to allege with specificity

9 “contemporaneous statements or conditions,” Ronconi v. Larkin, 253 F.3d 423, 432 (9th 10 Cir. 2001), that demonstrate both “how and why the statements were false” when made, 11 Metzler Inv. GMBH v. Corinthian Colleges, Inc., 540 F.3d 1049, 1070 (9th Cir. 2008) 12 because “[f]raud by hindsight is not actionable.” Ronconi, 253 F.3d at 430 n.12 (quoting 13 Arazie v. Mullane, 2 F.3d 1456, 1468 (7th Cir. 1993)).

14 Scienter is the “mental state embracing intent to deceive, manipulate, or defraud.” 15 Ernst & Ernst v. Hochfelder, 425 U.S. 185, 193 n.12 (1976). Under the PSLRA, the 16 complaint must plead a “strong inference” that defendants acted intentionally or with 17 deliberate recklessness. “Reckless conduct may be defined as a highly unreasonable 18 omission, involving not merely simple, or even inexcusable negligence, but an extreme

19 departure from the standards of ordinary care.” S.E.C. v. Platforms Wireless Int'l Corp., 20 617 F.3d 1072, 1093 (9th Cir. 2010) (citing Hollinger v. Titan Capital Corp., 914 F.2d 21 1564, 1569 (9th Cir. 1990)). “[D]eliberate recklessness” that “reflects some degree of 22 intentional or conscious misconduct” is necessary to plead scienter. WPP Luxembourg 1 Gamma Three Sarl v. Spot Runner, Inc., 655 F.3d 1039, 1051 (9th Cir. 2011) abrogated 2 on other grounds by Lorenzo v. SEC, 139 S. Ct. 1094 (2019). In determining whether a

3 defendant acted with scienter, a court considers “opposing inferences” and “plausible, 4 non-culpable explanations.” Tellabs, Inc., 551 U.S. at 323-24. A complaint survives 5 only if the culpable inference is “at least as compelling” as the nonculpable inference. Id. 6 at 324. 7 When analyzing the sufficiency of a plaintiff’s scienter pleadings, the Court must 8 “determine whether any of the allegations, standing alone, are sufficient to create a strong

9 inference of scienter.” N.M. State Inv. Council v. Ernst & Young LLP, 641 F.3d 1089, 10 1095 (9th Cir. 2011). If no individual allegation is sufficient, the Court conducts a 11 “‘holistic’ review of the same allegations to determine whether the insufficient 12 allegations combine to create a strong inference of intentional conduct or deliberate 13 recklessness.” Id. (quoting Zucco, 552 F.3d at 991-92).

14 Failure to satisfy the PSLRA’s heightened pleading standard requires dismissal of 15 the complaint. 15 U.S.C. § 78u-4(b)(3)(A). 16 VI. Discussion 17 A. Documents Incorporated by Reference 18 Defendants request that the Court take judicial notice of 14 documents attached to

19 the Declaration of John C. Roberts Jr. in Support of Defendants’ Motion to Dismiss 20 Consolidated Amended Complaint, docket no. 28. These fourteen documents include the 21 related SEC public filings, the October 4, 2018 earnings call transcript, the COSO IT 22 framework, and various SEC published regulations. The Court may consider public 1 filings, including SEC filings, and other matters of public record such as press releases, 2 analyst reports, news articles, and conference call transcripts, where such documents are

3 relied upon in the complaint. In re Wet Seal, Inc. Sec. Litig., 518 F. Supp. 2d at 1157. 4 The Court takes judicial notice of all fourteen documents. They are referenced in the 5 Amended Complaint, are matters of public record, and their authenticity is not in 6 dispute.7 Defendants’ unopposed Request for Consideration of Documents Incorporated 7 by Reference, docket no. 29, is GRANTED. 8 B. Misrepresentations

9 Statements 1 – 3: June 6, 2018 10-Q 10 Plaintiffs allege that the June 6, 2018 10-Q and Defendants Jelinek and Galanti’s 11 accompanying certifications of that filing were false and misleading because they stated 12 that the company had effective internal controls in place in the 2018 Fiscal Year. 13 AC ¶¶ 151-57. The statement at issue reads:

14 Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of the end of the period covered by this 15 Quarterly Report, our disclosure controls and procedures are effective. 16 There have been no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) 17 during our most recently completed fiscal quarter that have materially affected or are reasonably likely to materially affect our internal control over financial 18 reporting. Id. ¶ 152. Plaintiffs claim that this statement is false because starting as early as September 2017, 19 Costco’s internal controls were not effective. Id. ¶¶ 75; 153. Specifically, Plaintiffs 20 allege that Costco’s material weakness was due to an underfunded, inadequately 21 22 1 supervised and trained IT Department, a lack of IT control processes, and a lack of IT 2 risk-assessment processes. Id. ¶ 153.

3 To allege an actionable false or misleading statement, a plaintiff must specify with 4 particularity the “contemporaneous statements or conditions,” Ronconi, 253 F.3d at 432, 5 that demonstrate both “how and why the statements were false” when made, Metzler Inv. 6 GMBH, 540 F.3d at 1070. It is not enough to allege that Costco’s systems and processes 7 were imperfect in June, Plaintiffs must allege why those defects at the time rose to the 8 level of a material weakness requiring public disclosure.

9 Plaintiffs argue that the later public disclosures “serve[d] as admissions by 10 Defendants that [internal control] measures were not in place during the Class Period, 11 thus serving as confirmation that Defendants’ Certifications and other statements about 12 internal controls were false and misleading when made.” Plaintiffs’ Opposition to 13 Defendants’ Motion to Dismiss, docket no. 33 at 8-9; AC ¶¶ 13, 123.

14 In support of this argument, Plaintiffs rely on Limantour v. Cray Inc., 432 F. Supp. 15 2d 1129 (W.D. Wash. 2006). In Limantour, this court found that the complaint 16 adequately alleged that 10–Q and SOX certifications that there were no material 17 weaknesses in internal controls and procedures for the third quarter were false or 18 misleading based on that year’s later 10-K annual report disclosing material weaknesses

19 in the internal controls and procedures. Id. at 1159-60. The facts in Limantour are nearly 20 identical to the present case. As is the case here, the defendant company in Limantour 21 issued its third quarter 10-Q, which concluded that the company “disclosure controls and 22 procedures [were] effective.” Id. at 1159. The company later filed its 10-K for the fiscal 1 year, concluding that “as of the end of the period covered by this report . . . due to the 2 material weaknesses in our internal control over financial reporting . . . our disclosure

3 controls and procedures were not effective.” Id. at 1160. The court noted that the 10-K 4 “specifically refer[red]” to the same “disclosure controls and procedures” mentioned in 5 the earlier 10-Q. Id. Other courts agree that later public disclosures may indicate the 6 falsity of earlier disclosures. See Dobina v. Weatherford Int’l Ltd., 909 F. Supp. 2d 228- 7 244-45 (S.D.N.Y. 2012) (holding that “one may reasonably infer that [a company’s] 8 internal controls in fact were inadequate throughout the class period” where a later public

9 filing details a material weakness in internal controls). 10 Here, the Costco Defendants’ later 10-K filing “specifically refer[red]” to the same 11 “disclosure controls and procedures” mentioned in the earlier 10-Q, but came to the 12 opposite conclusion regarding their effectiveness. Compare AC ¶ 152 (“Based upon that 13 evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of

14 the end of the period covered by this Quarterly Report, our disclosure controls and 15 procedures are effective.”), with Ex. 4 to John C. Roberts Jr. Decl. (docket no. 28-1 at 16 29) (10-K disclosure that “as of September 2, 2018,” Costco’s CEO and CFO “have 17 concluded that the disclosure controls and procedures were not effective”). 18 Plaintiffs also allege with particularity “contemporaneous statements or

19 conditions,” Ronconi, 253 F.3d at 432, that demonstrate both “how and why the 20 statements were false” when made, Metzler Inv. GMBH, 540 F.3d at 1070. Specifically, 21 Plaintiffs’ confidential witness statements support the inference that information 22 1 technology controls in the areas of user access and program change-management were 2 deficient during the class period.

3 Confidential witnesses 1, 5, and 7 stated that during the class period, Costco’s IT 4 Department was understaffed (AC ¶¶ 83-84), subject to high employee turnover (Id. ¶ 5 84), suffered from poor employee morale (Id. ¶ 85), and was staffed with untrained 6 employees (Id. ¶¶ 84; 94; 99).8 These confidential witnesses corroborate each other’s 7 statements and provide specific examples of each allegation. See, e.g., id. ¶ 99 (examples 8 of manager with “no IT background” who “certainly wasn’t trained in the area of IT

9 before starting” and annual IT training consisting of “basic stuff” such as “how to lock 10 one’s computer”); id. ¶ 103 (example of IT employee who, due to lack of training, did not 11 know about governance management system until 18 months into employment). The 12 Court finds that the insight from confidential witnesses is “accompanied by enough 13 particularized detail to support a reasonable conviction in the informant's basis of

14 15

16 8 Plaintiffs allege that the IT Department was deliberately underfunded (AC ¶ 153), but many of 17 Plaintiffs’ own allegations contradict this assertion. See id. ¶¶ 90-92 (describing Costco’s continued implementation of “premium SAP product” to “improve reporting”); id. ¶ 95 (“IT had the highest paid employees,” and the IT Department was “over-budget”). Plaintiffs also argue that Costco’s low Selling, 18 General and Administrative (“SG&A”) spending indicates that the department is underfunded. Id. ¶¶ 77- 78. Costco spent 10% of its budget on SG&A, which includes all non-production related costs, including 19 IT. Id. Plaintiffs allege that in contrast with certain competitors, Costco’s 10% SG&A spending is low. Id. Costco’s SG&A spending has also decreased, whereas Costco’s competitors have increased their SG&A spending. Id. Low SG&A spending is not directly indicative of an underfunded IT Department. 20 SG&A includes all costs “not related to making a product or performing a service,” which includes rent, advertising, marketing, legal costs, and salary and benefits. Id. ¶ 77. It is therefore impossible to 21 determine what percent of Costco’s SG&A was devoted to solely IT Department spending. Plaintiffs also do not allege that a particular level of SG&A spending as a percentage of revenue necessarily precluded a 22 functioning IT Department, which is notable because Costco’s SG&A spending in 2018 was $13.87 billion. Ex. 4 to John C. Roberts Decl. (docket no. 28-1 at 28). The Court gives little weight to Plaintiffs’ 1 knowledge.” In re Northpoint Commc’ns Grp., Inc., Sec. Litig., 221 F. Supp. 2d 1090, 2 1097 (N.D. Cal. 2002).

3 The description of the material weakness in the October 10-K also specifically 4 corroborates these confidential witness reports. The 10-K states that the material 5 weakness in internal control was due to “insufficient knowledge and training of certain 6 individuals with IT expertise.” See Ex. 4 to John C. Roberts Decl. (docket no. 28-1 at 7 26). See In re Daou Sys., Inc. Sec. Litig., 411 F.3d at 1015 (in determining the 8 plausibility of confidential witness testimony, the court looks to “the level of detail

9 provided by the confidential sources, the corroborative nature of other facts alleged 10 (including from other sources), the coherence and plausibility of the allegations, the 11 number of sources, the reliability of sources and similar indicia”) (quoting In re 12 Cabletron Sys., Inc., 311 F.3d at 29-30). 13 Confidential witnesses also allege specific examples where IT employees made

14 complaints regarding IT compliance to employees at the VP level. These complaints 15 were met with inaction and indifference. For example, CW 1 described a coworker, 16 Barbara Egner, who raised SOX compliance issues to the VP level. AC ¶ 83. In 17 response, management would ask whether they could “get by,” rather than fix the issue. 18 Id. In another instance, CW 5 described monthly meetings with VPs in the IT

19 Department. Id. ¶ 93. CW 5 raised concerns at those meetings regarding issues he saw 20 with user access and change management process. Id. CW 5 stated that his concerns 21 were met with indifference. Id. 22 1 Understaffing, neglecting to train employees, and failing to respond to employee 2 complaints do not necessarily preclude a functioning IT Department with sufficient IT

3 controls. However, Plaintiffs have also alleged specific examples showing that Costco 4 did not have adequate user access and change controls in place during the class period. 5 The following examples support Plaintiffs’ claims that Costco lacked sufficient IT 6 controls during the class period: 7 • Lack of Coherent IT Control Systems and Procedures: Plaintiffs allege that Costco lacked coherent IT control systems. CW 1 described employees 8 that did not know the appropriate IT systems to use. See id. ¶ 103 (confusion about whether to use Archer or ServiceNow for governance 9 management). Costco also lacked a policy for revoking access to email on personal cell phones when employees left the company. Id. ¶ 107. 10 • Ineffective IT Control Systems: To the extent Costco did have control 11 systems in place, Plaintiffs allege they were ineffective. Costco used Google’s suite of online applications9 as the primary method for managing 12 user access to systems. Id. ¶¶ 106; 113; 115. Google’s online applications are known for being unsecure, in part because it is easy for any user with 13 access to change information. Id. ¶¶ 106 n.12; 113. Even assuming the Google suite of applications was appropriate for the size and scale of 14 Costco’s IT work, Costco’s implementation of that system lacked coherent procedures. Supervisors manually approved changes, which meant that 15 changes in user access often did not happen. Id. ¶¶ 106; 114. Because Costco used Google applications to manage user changes instead of a work 16 flow tool, there was no way to track whether the changes were completed. Id. ¶ 172. CW 5 stated that third party contractors had “no restrictions” and 17 “full badge” access to Costco’s IT systems, including access to a database where they could see competitors’ bids. Id. ¶ 112. 18 • Actual Unauthorized User Access: Plaintiffs allege specific examples of the 19 effect of the lack of controls: users frequently had unauthorized access to company data. For example, CW 1 had access to a system after he left that 20 department. Id. ¶ 106. He had to “fight” to get his access revoked. Id.

21 9 Google’s suite of online applications includes the word processor “Google Docs” and “Google Sheets.” 22 The applications are cloud-based and online. They are readily accessible and editable to anyone with authorization from any device with internet access. AC ¶ 106 n.12. 1 CW 5 described a colleague whose login information worked for “at least a month” after leaving Costco. Id. ¶ 114. This employee had access to 2 “everything” including “sensitive stuff.” Id. CW 5 observed many contractors who were still listed as employees with access to systems even 3 after they left Costco. Id.10 4 These examples go to the heart of Plaintiffs’ claims. Section 302 of SOX requires 5 an issuer of registered securities to maintain disclosure controls and procedures and 6 internal controls over financial reporting so that unauthorized users do not gain access to 7 and change critical financial data that is reported to the public. 17 C.F.R. § 240.13a–15. 8 Plaintiffs’ allegations containing specific examples that unauthorized users were able to 9 access Costco’s systems show that Costco’s internal controls were weak during the class 10 period. Compare In re Washington Mut., Inc. Sec., Derivative & ERISA Litig., 694 11 F. Supp. 2d 1192, 1212 (W.D. Wash. 2009) (specific examples of accounting deficiencies 12 and lack of process to remediate and address issues indicative of falsity at time statements 13 regarding internal controls were made) with Weiss v. Amkor Tech., Inc., 527 F. Supp. 2d

14 938, 953 (D. Ariz. 2007) (mere allegation of “weak internal controls and accounting 15 systems” were insufficient to plead falsity with particularity where plaintiffs failed to 16 allege facts supporting those conclusions). 17 18

20 10 The description of the material weakness in the 10-K also specifically corroborates these confidential 21 witness reports. The 10-K states that the material weakness in internal control was due to “IT control processes [that] lacked sufficient documentation” and “processes [that were] inadequate to identify and 22 assess changes in IT environments and personnel.” See Ex. 4 to John C. Roberts Decl. (docket no. 28-1 at 26). 1 Defendants dismiss these allegations as “anecdotal,” a conflation of a material 2 weakness with a mere deficiency and not “so severe.” 11 They also contend that

3 Defendants never restated financial results.12 Defendants’ Reply in Support of Motion to 4 Dismiss, docket no. 36 at 11-12. Defendants rely on In re GlenFed, Inc. Sec. Litig. for 5 the proposition that whether internal controls are adequate is a non-actionable business 6 judgment. 42 F.3d 1541, 1549 (9th Cir. 1994) (“[P]laintiff must set forth facts explaining 7 why the difference between the earlier and the later statements is not merely the 8 difference between two permissible judgments, but rather the result of a falsehood.”).

9 However, statements regarding the adequacy of internal controls can constitute actionable 10 misrepresentations. See In re Washington Mut., Inc. Sec., Derivative & ERISA Litig., 259 11 F.R.D. 490, 506 (W.D. Wash. 2009) (“Misstatements about the adequacy of internal 12 controls are actionable.”); In re New Century, 588 F. Supp. 2d 1206, 1226 (C.D. Cal. 13 2008) (“Defendants made material false and misleading statements regarding the

14 adequacy of internal controls during the Class Period.”). 15 “Statements by a company that are capable of objective verification . . . can 16 constitute material misrepresentations” under the PSLRA. Oregon Pub. Emps. Ret. Fund 17 v. Apollo Grp. Inc., 774 F.3d 598, 606 (9th Cir. 2014). Costco’s statements regarding the 18 adequacy of its internal controls were objectively verifiable. Indeed, Costco identified a

19 20 21 11 That is not the standard. Plaintiffs must only show that there was a material weakness in internal controls when Defendants stated there was no such weakness. The SEC does not require a particular level of severity to state a material weakness. See supra note 5. 22 12 A restatement of financial results is not required to meet the PSLRA’s pleading requirements. In re 1 material weakness in its 10-K after identifying deficient factors that it relied on in making 2 that assessment. KPMG details those deficiencies in its 10-K report. Plaintiffs’

3 confidential witness statements provide specific examples showing that each deficiency 4 was also present throughout the class period. Compare Ex. 4 to John C. Roberts Jr. Decl. 5 (docket no. 28-1 at 26) (10-K KPMG report that “IT control processes lacked sufficient 6 documentation”) with AC ¶¶ 106; 113; 115 (CW statements showing IT control processes 7 lacked sufficient documentation); compare Ex. 4 to John C. Roberts Jr. Decl. (docket no. 8 28-1 at 26) (10-K KPMG report finding “insufficient knowledge and training of certain

9 individuals with IT expertise”) with AC ¶¶ 84; 94; 99 (CW statements showing that 10 Costco’s IT employees lacked adequate training); compare Ex. 4 to John C. Roberts Jr. 11 Decl. (docket no. 28-1 at 26) (10-K KPMG report that “risk-assessment processes [were] 12 inadequate to identify and access changes in IT environments and personnel that could 13 impact internal control over financial reporting”) with AC ¶¶ 106; 112; 114 (detailing

14 specific examples where Costco’s risk assessment processes failed to identify user 15 changes). The CW statements referenced in the complaint are therefore sufficient to 16 support Plaintiffs’ allegations that statements 1-3 were false and misleading.13 17 Statement 4 18 Plaintiffs also allege that the June 6, 2018 10-Q is false and misleading because it

19 stated there were “no material changes” in Costco’s risk factors and the company was 20

21 13 Plaintiffs also challenge Defendants Jelinek and Galanti’s SOX certifications attached to Costco’s June 22 2018 quarterly report. AC ¶¶ 154-56. Plaintiffs challenge the certifications on the same basis—that Costco should have disclosed a material weakness in June 2018. Thus, Plaintiffs adequately allege a 1 making ongoing “significant technology investments.” Id. ¶ 159. The statement at issue 2 reads:

3 “There have been no material changes in our risk factors from those disclosed in our [2017] Annual Report on Form 10-k.” One of the risk factors in the 4 Company’s 2017 Form 10-K stated that the Company was “currently making and will continue to make, significant technology investments to improve or replace 5 critical information systems and processing capabilities.” Id. 6 Plaintiffs argue that these statements were false and misleading because 7 Defendants were not making “significant technology investments” to safeguard internal 8 controls over financial reporting. Id. ¶ 160. Plaintiffs fail to state a misrepresentation for 9 statement 4. Plaintiffs’ own complaint states that Costco was making significant 10 technology investments. For example, Plaintiffs allege Costco’s IT employees were 11 highly paid throughout the class period. See id. ¶ 95 (“IT had the highest paid 12 employees,” and the IT Department was “over-budget”). Plaintiffs also allege that 13 Costco invested in “premium” IT products and was working on developing a change 14 management system to improve work flow. See id. ¶¶ 90-92 (describing Costco’s 15 continued implementation of a “premium SAP product” to “improve reporting”). 16 Plaintiffs’ own allegations make clear that Costco’s statement in its June 2018 10-Q that 17 it was “currently making and will continue to make significant technology investments” 18 was not a misrepresentation.

19 Statements 5 - 6 20 Plaintiffs also allege that Costco’s October 4, 2018 press release and earnings call 21 with analysts is false and misleading because Defendants “failed to disclose the full 22 extent of the problems with access controls and change controls” including what caused 1 deficiencies in internal controls. Id. ¶¶ 162-63. Plaintiffs state that the market dropped 2 an additional 3.63% after the more detailed disclosure in the10-K filed on October 26,

3 which is evidence that the market was not aware of the full magnitude of the issue at the 4 time of the initial announcement on October 4. Id. ¶¶ 13-14; 163-64. 5 Plaintiffs fail to allege additional misrepresentations for statements 5 and 6 with 6 particularity for two reasons. Plaintiffs take Defendants’ initial disclosure out of context. 7 As Plaintiffs note in their complaint, Defendants’ initial disclosure was couched in 8 anticipatory language. Defendants explained to investors that they were “still completing

9 [their] assessment,” they were beginning remediation, and they “expect[ed]” to report a 10 material weakness in the forthcoming 10-K. Id. ¶ 161. Defendants further stated that the 11 initial disclosure was all they could report and that they “can’t be more positive than that 12 until we release the Form 10-K.” Id. ¶ 162. As any reasonable investor would recognize, 13 Defendants’ hedging and anticipatory language showed that the company could not

14 prematurely provide details they did not yet know. 15 Plaintiffs do not allege “contemporaneous statements or conditions” demonstrating 16 both “how and why the statements were false” when made. Ronconi, 253 F.3d at 432; 17 Metzler Inv. GMBH, 540 F.3d at 1070. Plaintiffs have not alleged any specific facts 18 showing that Defendants knew but failed to reveal “the extent of the [material weakness],

19 how long it would take to resolve, and the need for extensive remediation efforts” on 20 October 4, 2018. AC ¶¶ 162-63. Rather, the October 4 statements make clear that the 21 company was merely making a preliminary disclosure about the lack of internal controls, 22 1 but that the company was not done with its investigation. Plaintiffs do not cite or allege 2 facts to the contrary.

3 Rather, Plaintiffs’ allegations regarding statements 5 and 6 are fraud by hindsight. 4 A plaintiff cannot “simply seize[] upon disclosures made in later . . . reports and allege[] 5 that they should have been made in earlier ones.” City of Roseville Emps.’ Ret. Sys., 963 6 F. Supp. 2d at 1109 (quoting Denny v. Barber, 576 F.2d 465, 470 (2d Cir. 1978)). A 7 company’s public correction or contribution of additional facts “is not, in and of itself, 8 indicative of fraud, as fraud by hindsight is not actionable.” In re Metawave Commc'ns

9 Corp. Sec. Litig., 629 F. Supp. 2d 1207, 1219 (W.D. Wash. 2009) (quoting Ronconi, 253 10 F.3d at 430 n.12); see also In re Vantive Corp. Sec. Litig., 283 F.3d 1079, 1084 (9th Cir. 11 2002) (recognizing that the PSLRA was designed to “eliminate abusive securities 12 litigation” such as “fraud by hindsight”). Thus, Plaintiffs have failed to allege that 13 statements 5 and 6 constitute a false representation.

14 C. Scienter 15 Confidential Witness Evidence of Scienter 16 A complaint relying on statements from confidential witnesses to establish scienter 17 must “describe[] [those witnesses] with sufficient particularity to establish their reliability 18 and personal knowledge,” and the statements themselves must be “indicative of scienter.”

19 Zucco Partners, LLC, 552 F.3d at 995. Plaintiffs rely primarily on CW 1 to allege 20 scienter. CW 1 provides an account of what Defendants Galanti and Jelinek allegedly 21 knew about internal controls in early 2018. CW 1 prepared materials for the management 22 team to present at GDPR board meetings in early 2018. AC ¶ 105. Those materials 1 included data on GDPR and SOX compliance eventually used to create PowerPoints to 2 show the board, which met monthly at the time. Id. CW 1 “believed” that Defendants

3 Jelinek and Galanti would “discuss[] internal control problems” at the meetings with the 4 Board. Id. Through the GDPR review process, CW 1 stated that Costco’s weak internal 5 controls “got” Defendants Jelinek and Galanti’s attention. Id. ¶ 104. 6 Plaintiffs do not establish that CW 1 had personal knowledge of what Defendants 7 Jelinek and Galanti knew at the time. Zucco Partners, LLC, 552 F.3d at 995. Plaintiffs 8 admit that CW 1 was not at the meetings with the board or with Defendants Jelinek and

9 Galanti. AC ¶ 105. The Amended Complaint states that CW 1 acquired his information 10 through three degrees of separation: from managers who, in turn, heard about the 11 information from a VP-level employee, who “only occasionally” attended meetings with 12 the board. Id. Further, the data CW 1 prepared for board presentations was used by 13 others who then created the board presentations for GDPR compliance—not internal

14 controls compliance. CW 1 had no way of verifying14 whether the information and data 15 allegedly showing a material weakness in internal controls was presented to Defendants 16

17 14 In response, Plaintiffs cite cases in support of the argument that there is no requirement that CWs have 18 personal knowledge of the facts in their statements. These cases deal with distinct factual scenarios in which the evidence had other, strong indicia of reliability. See Berson v. Applied Signal Tech., Inc., 527 19 F.3d 982, 985 (9th Cir. 2008) (though confidential witnesses didn’t “see the stop-work orders first-hand,” the orders’ issuance “had the very obvious effect of putting employees out of work” and thus the court could infer the company was losing business from confidential witness testimony); Lloyd v. CVB Fin. 20 Corp., 811 F.3d 1200, 1208 (9th Cir. 2016) (confidential witness testimony based on another individual’s account of a board meeting was sufficiently reliable for pleading purposes because it was “specific in 21 time, context, and details”); In re Cadence Design Sys., Inc. Sec. Litig., 692 F. Supp. 2d 1181, 1188 (N.D. Cal. 2010) (though CW’s testimony was “likely hearsay,” as an industry consultant, CW’s “livelihood 22 depend[ed] upon his access to reliable, specific industry information,” and plaintiffs’ submission of an additional declaration establishing that CWs standing as a consultant in the industry showed that the 1 Jelinek and Galanti. Based on the description of CW 1’s position at the company and the 2 lack of specificity about what Defendants Jelinek and Galanti knew at the time, CW 1

3 does not have personal knowledge sufficient to raise an inference of scienter. 4 Plaintiffs also allege scienter through CW 6, who “heard about” and witnessed 5 others “allud[ing] to” comments by Defendant Jelinek complaining that the IT 6 Department spent too much money, was over-budget and was not getting things done. Id. 7 ¶ 95. CW 6 also stated that Defendant Galanti gave a speech to the department 8 addressing the “abysmal” results of an IT employee satisfaction survey. Id. ¶ 97.

9 Plaintiffs have failed to establish a basis for CW 6’s personal knowledge of 10 scienter. Zucco Partners, LLC, 552 F.3d at 995. Hearing about comments from others or 11 overhearing “allusions” to Defendants’ comments without stating that source’s basis for 12 personal knowledge cannot establish a confidential witness’ personal knowledge. See 13 Police Ret. Sys. v. Intuitive Surgical, Inc., 759 F.3d 1051, 1063 (9th Cir. 2014) (finding

14 that “witnesses [who] lack first hand knowledge regarding what the individual defendants 15 knew or did not know about [the company’s] financial health” lack foundation). CW 6’s 16 statements are also reminiscent of “merely regurgitating gossip and innuendo.” In re 17 Metawave Commc'ns Corp. Sec. Litig., 298 F. Supp. 2d at 1068. 18 Plaintiffs do not allege that the CWs had any direct interactions with individual

19 Defendants Jelinek or Galanti. There is no indication in the Amended Complaint that the 20 individual Defendants were aware of the CWs’ examples regarding the allegedly 21 deficient internal controls. At most, the Amended Complaint refers to these concerns 22 1 being raised with “VP-level” or unidentified “management.”15 See AC ¶¶ 83; 86; 102; 2 105. In sum, there is no indication—and Plaintiffs do not allege—that the Defendants

3 had reason to know the information that caused Costco to conclude that its internal 4 controls were not effective in October. See In re NVIDIA Corp. Sec. Litig., 768 F.3d 5 1046, 1059 (9th Cir. 2014) (holding that although company began investigation regarding 6 problems with computer chip at the time statements at issue were made, the court could 7 not infer scienter in absence of allegations showing that the company’s management had 8 knowledge of the extent of the problems at that time). Plaintiffs thus do not establish

9 scienter based on confidential witness statements. 10 Other Evidence of Scienter 11 Plaintiffs’ allegations of scienter on indirect bases also fail. Plaintiffs allege that 12 Defendants’ ability to access information showing a material weakness is sufficient to 13 support a finding of scienter.16 Ability to access is not enough on its own. Plaintiffs

14 must allege that Defendants personally accessed the information showing a material 15 weakness in internal controls. Plaintiffs fail to do so. 17 City of Dearborn Heights Act 16 17 15 In support of this allegation, Plaintiffs also rely on CW 3’s statement that in 2017, he created a 50-page report regarding the lack of effective systems and procedures related to internal controls in the IT 18 Department. AC ¶ 110. CW 3 did not work at Costco during the relevant time period, and the Court gives these statements no weight. 19 16 Specifically, Plaintiffs allege that because Barbara Egner, one employee in charge of collecting data for SOX compliance, aggregated data on internal controls, anyone at the company could access the data showing “significant deficiencies” “without extraordinary effort.” Plaintiffs’ Opposition to Defendants’ 20 Motion to Dismiss, docket no. 33 at 27. 17 Relatedly, in their Response, Plaintiffs state that Defendants did know about the material weakness in 21 internal controls because each Defendant “specifically addressed” internal controls in their statements. Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 22-23. Because Defendant 22 “addressed” internal controls, Plaintiffs argue that “Defendants are presumed to have investigated the basis for the statements.” Id. at 23. Again, Plaintiffs fail to plead particularized facts showing when the 1 345 Police & Fire Ret. Sys. v. Align Tech., Inc., 856 F.3d 605, 620 (9th Cir. 2017) 2 (allegations that fraud would have been “readily apparent” from financial documents

3 “made available” to defendants was not enough to allege scienter; defendants must have 4 also “personally accessed” the documents showing fraud). 5 The Court may infer scienter “where the information misrepresented is readily 6 apparent to the defendant corporation’s senior management.” Zucco Partners, LLC, 552 7 F.3d at 1001. If a defendant “must have known about the falsity of the information they 8 were providing to the public because the falsity was obvious from the operations of the 9 company, the defendants’ awareness of the information’s falsity can be assumed.” Id. In 10 such a scenario, the facts must be so “patently obvious” that it would be “absurd to 11 suggest that top management was unaware of them.” Id. (quoting Berson v. Applied 12 Signal Tech., Inc., 527 F.3d 982, 989 (9th Cir. 2008)). Here, Defendants did not have to 13 revise public disclosures of financial results as a result of the material weakness in 14 internal controls, suggesting that the material weakness did not rise to the level of 15 “patently obvious” to Defendants. Plaintiffs do not separately plead facts showing that 16 the weaknesses in internal controls were so “patently obvious” that it would be “absurd” 17 to suggest that Defendants Galanti and Jelinek were unaware of it. The Court will not 18 infer scienter based on the allegations in the Amended Complaint. Zucco Partners, LLC, 19 552 F.3d at 1001. 20 21

22 individual Defendants had “actual access to the disputed information.” City of Dearborn Heights Act 345 1 Plaintiffs argue that the remedial measures Defendants undertook after disclosing 2 the material weakness are themselves evidence of scienter. On its own, a company’s

3 decision to enhance financial controls does not show that those controls were previously 4 deficient. See In re GlenFed, Inc. Sec. Litig., 42 F.3d at 1553 (“The fact that policies 5 may change over time does not mean that an earlier policy was inadequate, or that 6 statements regarding its adequacy were falsehoods.”). In the cases Plaintiffs cite finding 7 scienter after remedial measures, there were also multiple other strong indicia of scienter. 8 See In re Sipex Corp. Sec. Litig., 2005 WL 3096178, at *1 (N.D. Cal. Nov. 17, 2005)

9 (remedial measures, restatement of financials, “sham” sale, and forced resignation of 10 CEO supported scienter inference); Mild v. PPG Indus., Inc., 2018 WL 6787351, at *5-7 11 (C.D. Cal. Dec. 21, 2018) (remedial measures, vice president’s termination, and 12 restatement of financials including admission that vice president acted “improperly” 13 supported scienter inference); Luna v. Marvell Tech. Grp., 2017 WL 2171273, at *5

14 (N.D. Cal. May 17, 2017) (company’s admissions of an inappropriate tone by leadership, 15 termination and rehiring of CEO position, and other remedial measures supported 16 scienter inference). The remedial measures Defendants undertook after disclosing the 17 material weakness are not themselves evidence of Defendants’ scienter during the class 18 period.

19 Plaintiffs argue that Defendants’ SOX certifications support a finding of scienter 20 when coupled with other allegations. The other allegations of scienter are not 21 compelling. Also, “[a]lthough the passage of Sarbanes-Oxley may make it somewhat 22 more reasonable to infer that a certifying Defendant whose head is in the sand is being 1 deliberately reckless, it does not transform the PSLRA's requirement of falsity-plus- 2 scienter into a requirement of falsity-plus-a-Sarbanes-Oxley-certification.” In re

3 Watchguard Sec. Litig., 2006 WL 2038656, at *11 (W.D. Wash. Apr. 21, 2006). 4 Plaintiffs also argue that Defendants “conscious[ly]” neglected the IT Department. 5 Plaintiffs’ Opposition to Defendants’ Motion to Dismiss, docket no. 33 at 23. The facts 6 pled do not support a finding that Defendants intentionally or consciously neglected the 7 IT Department. Plaintiffs also fail to establish what Defendants knew at the time. 8 Moreover, a claim that Costco was motivated to keep costs low to maintain profits and 9 growth is too vague and conclusory to state a claim. Such an allegation is also 10 implausible amid Plaintiffs’ other allegations that Costco’s IT employees were highly 11 paid and that Costco was making significant investments in technology. AC ¶¶ 88; 90; 12 92; 95; see also supra note 8. 13 The Court concludes that none of Plaintiffs’ allegations “standing alone, are 14 sufficient to create a strong inference of scienter.” N.M. State Inv. Council v. Ernst & 15 Young LLP, 641 F.3d 1089, 1095 (9th Cir. 2011). Moreover, “conduct[ing] a ‘holistic’ 16 review of the same allegations,” the Court also determines that the “insufficient 17 allegations [fail to] combine to create a strong inference of intentional conduct or 18 deliberate recklessness.” Id. (quoting Zucco, 552 F.3d at 991-92). 19 D. More Plausible Inference 20 In determining whether a defendant acted with scienter, a court considers 21 “competing inferences” and “plausible, non-culpable explanations.” Tellabs, Inc., 551 22 1 U.S. at 323-24. A complaint survives only if the culpable inference is “at least as 2 compelling” as the nonculpable inference. Id. at 324.

3 Here, the more plausible inference is that Defendants Jelinek and Galanti did not 4 discover how serious the user access and change management issues were until after June 5 6, 2018. Multiple uncontested facts support this nonculpable inference. On their own, 6 Defendants did disclose the material weakness in disclosure controls in October 2018. 7 The Amended Complaint only alleges that they should have disclosed it sooner. If 8 Defendants knowingly concealed the material weakness in June 2018, it does not make

9 sense that Defendants later chose to willingly reveal a material weakness in internal 10 controls in October 2018.18 11 The inference that Defendants were unaware of the material weakness when they 12 filed the quarterly report is also consistent with the relatively short time that companies 13 take to prepare a quarterly, as opposed to annual, report.19 The more plausible inference,

14 therefore—is not fraud, as Plaintiffs allege in their complaint—but rather that Defendants 15 did not discover the material weakness in internal controls until they underwent the more 16 time-consuming process required to file the company’s annual report. 17 18

19 18 Defendants argue that a lack of motive “undermines” the inferences of scienter. Defendants’ Motion to Dismiss, docket no. 27 at 28. However, a motive is not required to plead securities fraud. Matrixx 20 Initiatives, Inc. v. Siracusano, 563 U.S. 27, 48 (2011). 19 The SEC recognizes that companies spend less time preparing quarterly reports, and it does not require 21 quarterly evaluations that are “as extensive” as the annual evaluations. SEC Release 33-8238 at *15. For example, “even where systems testing of [a] component would clearly be required as part of the annual 22 evaluation of internal control over financial reporting, management could make a different determination of the appropriate nature of the evaluation of that component for purposes of a quarterly evaluation of 1 VII. Conclusion 2 For the foregoing reasons, the Court enters the following Order:

3 (1) Defendants’ Request for Consideration of Documents Incorporated by 4 Reference, docket no. 29, is GRANTED. 5 (2) Defendants’ Motion to Dismiss Consolidated Amended Complaint, docket 6 no. 27, is GRANTED. Plaintiffs’ claims against Defendants are 7 DISMISSED without prejudice with leave to amend. 8 (3) Plaintiffs shall file any amended complaint within ninety (90) days of this

9 Order. 10 IT IS SO ORDERED. 11 Dated this 26th day of November, 2019. 12 A 13

14 Thomas S. Zilly United States District Judge 15

16 17 18 19 20 21 22