Does the Independent Security Study satisfy §1.132-5 on its own?

The ISS is one of two paths the regulation provides for establishing an overall security program. The study must be paired with consistent application of its recommendations, retained documentation, and periodic reassessment.

What happens if the IRS audits the executive's security perk?

The ISS is the foundational document examiners will request. A defensible study includes clear independence language, explicit reference to §1.132-5, documented facts and circumstances, and recommendations tied to identifiable risk.

Why don't you sell executive protection or other security services?

Because we cannot credibly study what we sell. The regulation's independence requirement exists for a reason. Our structure is our answer to it.

How long does a study take?

Standard engagements run twelve weeks from kickoff to delivery. Expedited delivery is available for compressed timelines driven by proxy filings, litigation events, or changes in executive status.

Can one study cover multiple executives?

Yes. A single governing study can document the employer's overall security program and address facts and circumstances executive by executive in structured appendices.

Who conducts the work?

Senior practitioners with federal protective, investigative, or intelligence experience — augmented by digital risk and OSINT analysts. Every engagement is led by a senior partner who signs the study.

What is an Independent Security Study?

An Independent Security Study is a formal, third-party report conducted under Treas. Reg. §1.132-5(m) that documents the facts and circumstances justifying an employer's executive security program. It defines the overall security program and establishes the defensible record required for the employer to exclude executive security benefits from the executive's taxable compensation as a working condition fringe benefit.

Who qualifies as an independent third party under §1.132-5?

The regulation requires the firm performing the study to be independent — meaning it does not sell executive protection, guard services, monitoring systems, or any of the security measures the study might recommend. A firm with a financial interest in the recommended security measures cannot credibly author an independent study of those measures. The independence requirement is structural, not just a disclosure obligation.

What triggers the need for an Independent Security Study?

An ISS is typically triggered by one of four events: a proxy filing season requiring perquisite disclosure analysis, an IRS audit or inquiry involving executive compensation, a board or compensation committee review of executive security perquisites, or a significant change in the executive's threat environment. Legal counsel and tax directors are usually the first to identify the need.

How is an Independent Security Study different from a security assessment?

A security assessment is an operational document focused on vulnerabilities and recommendations. An Independent Security Study is a regulatory compliance document that must also document a bona fide business-oriented security concern, assess risks objectively, make reasonable recommendations, and be prepared by an independent third party. The ISS is what the IRS examiner will request; the security assessment may inform it but does not replace it.

Can a company's existing security vendor conduct the Independent Security Study?

An existing security vendor may conduct the physical assessments that inform an ISS. The study itself, however, should not be authored by a party that sells the recommended measures. Many employers engage their existing vendor for operational assessments and a separate independent firm for the ISS itself. The two are complementary.

What specialized reports does an Independent Security Study engagement produce?

A full engagement produces specialized reports covering physical security (residential and corporate office assessments), digital risk (online footprint, OSINT, and data broker analysis), and PII exposure, along with stakeholder interviews and governance review. These reports are synthesized into the final Independent Security Study, which includes the regulatory determination and overall security program language.

How often should an Independent Security Study be updated?

Tax counsel typically treat an ISS as current for approximately three years. Reassessment is recommended sooner if material changes occur — including changes in the executive's threat environment, a significant public event (litigation, media exposure, activist attention), changes in residential or office location, or a change in executive status.

What is the IRS safe harbor for personal aircraft use under §1.132-5(m)(4)?

The regulation provides a safe harbor for personal flights on employer aircraft used in connection with a security program. The value of the flight is determined at 200% of the Standard Industry Fare Level (SIFL) rate rather than the full fair market charter rate. This safe harbor only applies when the security program meets the §1.132-5(m) requirements, including the Independent Security Study requirement.

Does the IRS and SEC treat executive security differently?

Yes. The IRS analyzes executive security under §132 to determine whether the benefit is excluded from taxable income as a working condition fringe. The SEC analyzes the same security expense under Item 402 of Regulation S-K to determine whether it must be disclosed as a perquisite in proxy filings. A benefit can simultaneously be a non-taxable fringe benefit under §132 and a disclosable perquisite under SEC rules. The two analyses are parallel but distinct.

What documentation does the IRS expect if it audits an executive security benefit?

Examiners typically request the Independent Security Study, evidence of consistent application across similarly situated executives, the employer's overall security program documentation, and any threat assessment or incident history relied upon. Studies that include clear independence language, explicit regulatory citations, documented facts and circumstances, and recommendations tied to identifiable risk have historically withstood examination.

SEC Compliance

Seven SEC Enforcement Actions That Show How Executive Perquisite Disclosure Goes Wrong

By Senior Partner · April 2026 · 7 min read

The SEC has made executive perquisite disclosure a recurring enforcement priority. Since 2020, the agency has charged multiple public companies for failing to properly disclose perks provided to named executive officers under Item 402 of Regulation S-K - the provision that requires companies to disclose all executive compensation, including personal benefits, in proxy statements.

The violations tend to look similar: a company provides an executive with aircraft access, personal security, club memberships, or other benefits and either fails to recognize them as disclosable perquisites or applies the wrong standard for determining what needs to be reported. Years of non-disclosure accumulate. An internal review, whistleblower, or SEC examination surfaces the gap.

The cases below are a representative record. They are all public. Each one produced a cease-and-desist order, a civil penalty, or both. The takeaways are directly applicable to any company providing meaningful benefits to named executive officers.

1. Hilton Worldwide Holdings (2020)

What happened: From 2015 through 2018, Hilton failed to disclose approximately $1.7 million in perquisites provided to its CEO and other named executive officers. The benefits primarily involved travel - the use of chartered aircraft and related expenses for personal purposes that the company did not properly identify or report.

What the SEC found: The company lacked adequate internal controls for identifying executive personal travel as a disclosable perquisite. The standard the company applied confused "business purpose" with the Item 402 test, which is not the same thing.

Penalty: $600,000 civil penalty.

Takeaway: Travel and aircraft benefits are the single most common category in perquisite enforcement. The volume of the undisclosed amount - nearly $1.7 million over four years - is consistent with what the SEC has found across multiple industries. Companies that treat "there was a business reason for the trip" as a sufficient basis for non-disclosure are applying the wrong test.

2. Gulfport Energy Corporation (2021)

What happened: From 2014 through 2018, Gulfport failed to disclose approximately $650,000 in perquisites provided to its CEO. The undisclosed benefits included personal use of a company aircraft and other personal expenses.

What the SEC found: The company's disclosures substantially understated the CEO's compensation in multiple annual filings. The CEO himself played a role in the disclosure failure by not providing accurate information.

Penalty: The company received no financial penalty, but the former CEO agreed to pay a civil penalty of $88,248. The personal liability against the executive - not just the company - is notable.

Takeaway: When executives fail to provide accurate information about their personal use of company resources, personal liability follows. The company's cooperation produced a zero corporate penalty, but the CEO's cooperation did not eliminate his individual exposure. Both outcomes matter for governance.

3. ProPetro Holding Corporation (2021)

What happened: ProPetro failed to disclose more than $428,000 in perquisites provided to its CEO over two fiscal years, including personal use of a company aircraft and related travel expenses. In addition, the CEO used company credit cards for more than $127,000 in personal charges that were not disclosed or reimbursed.

What the SEC found: ProPetro lacked adequate processes for tracking executive personal use of company resources and for requiring executives to identify and report personal expenses. The CEO did not provide accurate expense information to the company.

Penalty: The company received no financial penalty. The former CEO paid a civil penalty of $195,000.

Takeaway: Aircraft plus corporate credit cards is a recurring combination in enforcement actions. Both require the same thing: a reliable process for executives to identify and report personal use in real time, not after the fact during proxy preparation. Companies that rely on executives to self-identify perquisites without a structured process are creating conditions for disclosure failure.

4. National Beverage Corp. (2021)

What happened: From 2016 through 2020, National Beverage failed to disclose approximately $735,647 in perquisites provided to its CEO. The undisclosed benefits included personal flights on company and chartered aircraft and other personal expenses.

What the SEC found: The company's CEO took personal trips on company aircraft that were not integrally and directly related to his job duties. The company failed to apply the correct standard for determining what qualified as a perquisite versus a business expense.

Penalty: National Beverage paid a civil penalty of $481,920.

Takeaway: The "integrally and directly related" standard under Item 402 is specific and demanding. An expense is a perquisite if it primarily benefits the executive personally, regardless of whether there is also some business benefit. That standard is different from the IRS working condition fringe test and different from what many compliance teams assume. The $481,920 penalty represents roughly 65 percent of the undisclosed amount - a meaningful enforcement outcome.

5. Greenbrier Companies (2023)

What happened: From 2017 through 2021, Greenbrier failed to disclose multiple categories of perquisites provided to its founder and former CEO, William Furman. The undisclosed benefits included use of a company car, financial advisory fees, club dues, spouse travel, personal security costs, and approximately $1.6 million in personal aircraft charter costs. The company had been paying nearly $3 million to charter Furman's plane during this period; roughly half of that amount was attributable to his personal use and was not disclosed.

What the SEC found: Greenbrier's disclosures failed across multiple perquisite categories simultaneously. Personal security costs appeared in the record as a separately identified line of failure. The company and its former CEO both faced charges.

Penalty: Greenbrier paid a civil penalty of $1,000,000. Furman paid a civil penalty of $100,000.

Takeaway: This case is notable for two reasons. First, it is one of the few public enforcement actions to specifically identify personal security costs as an undisclosed perquisite. Companies that provide executive security without proper disclosure infrastructure face enforcement risk on both the IRS and SEC tracks simultaneously. Second, the scale - a $1 million corporate penalty - reflects the SEC's willingness to impose meaningful consequences when violations span multiple years and multiple categories.

6. Stanley Black & Decker (2023)

What happened: From 2017 through 2020, Stanley Black & Decker failed to disclose at least $1.3 million in perquisites and personal benefits provided to four executive officers and one director. The perquisites included personal use of corporate aircraft and other benefits. The company self-reported the violations after conducting an internal review.

What the SEC found: The company's disclosure controls failed to properly identify and quantify executive personal use of company resources.

Penalty: No civil monetary penalty against the company, reflecting credit for self-reporting, implementing remedial measures, and cooperating with the SEC investigation. A former executive paid a civil penalty of $75,000.

Takeaway: Self-reporting and cooperation produce tangible outcomes. Stanley Black & Decker avoided a financial penalty despite $1.3 million in undisclosed perquisites across multiple executives and multiple years. Companies that discover disclosure failures through internal review have a meaningful incentive to report promptly and cooperate fully. The individual executive penalty confirms, again, that personal liability is not off the table.

7. Express, Inc. (2024)

What happened: Over fiscal years 2019, 2020, and 2021, the fashion retailer Express failed to disclose approximately $979,269 in perquisites provided to its former CEO. The undisclosed benefits included personal use of chartered aircraft - including related transportation, meals, and hotel expenses - and nearly $150,000 in relocation benefits. The company's annual proxy filings understated the CEO's "All Other Compensation" by an average of 94 percent over the three-year period.

What the SEC found: Express applied an improper disclosure standard. The company did not categorize an expense as a disclosable perquisite if there was a business purpose for it. That is not the correct test under Item 402. The business-purpose question is separate from the perquisite-disclosure question, and conflating them produces systematic underdisclosure.

Penalty: No civil monetary penalty. The former CEO voluntarily reimbursed approximately $454,000 in aircraft travel and related expenses that were determined to be personal.

Takeaway: The "business purpose means no disclosure required" mistake is the most common compliance failure in this area. It appears in multiple enforcement cases because it is genuinely intuitive - if the expense served a business function, companies assume they don't need to disclose it. That assumption is wrong. The correct question is whether the expense primarily benefits the executive personally. When it does, it's a perquisite, regardless of any associated business benefit. A 94 percent average understatement of "All Other Compensation" over three years is the result of applying the wrong standard consistently.

The pattern

Seven cases, multiple industries, over five years. Several consistent features:

Aircraft use is the recurring trigger. Personal use of company or chartered aircraft accounts for the primary undisclosed benefit in every case above. Companies with corporate aircraft programs, or that pay for executives to use chartered aircraft, have elevated disclosure risk if they don't have rigorous, contemporaneous tracking of personal versus business use.

The "business purpose" test is not the Item 402 test. This mistake appears repeatedly. An expense is a perquisite if it primarily benefits the executive personally. Business purpose is irrelevant to that determination. Training compliance staff on the correct standard is a precondition to getting this right.

Individual executives face personal liability. In five of the seven cases above, individual executives faced civil penalties or personal reimbursement obligations. The company settling does not insulate the executives whose benefits were misclassified.

Self-reporting reduces but does not eliminate consequences. In cases where companies self-reported, the SEC consistently cited that cooperation in reducing or eliminating corporate penalties. The individual executive exposure persisted in most cases anyway.

Security costs are specifically on the radar. The Greenbrier case, where personal security was explicitly identified as an undisclosed perquisite, signals that the SEC is looking at security benefits with the same scrutiny it applies to aircraft. Companies providing meaningful security to named executive officers need disclosure infrastructure as well as tax infrastructure. The two are separate requirements with separate standards, and both apply to the same expense.

This post is for informational purposes and does not constitute legal or compliance advice. Readers should consult qualified disclosure counsel regarding proxy disclosure obligations for specific programs.

AVREN ADVISORY

Independent Security Studies under Treas. Reg. §1.132-5

We conduct the Independent Security Study required by Treas. Reg. §1.132-5. Physical security assessment, digital risk analysis, executive interviews, and a defensible report — delivered in 12 weeks. Federal pedigree. Structural independence.