Securities and Exchange Commission: Systematically Assessing Staff Procedures and Enhancing Control Design Would Strengthen Internal Oversight

Section 961 of the Dodd-Frank Wall Street Reform and Consumer Protection Act directs SEC to assess and report annually on internal supervisory controls and procedures applicable to staff performing examinations, investigations, and securities filing reviews. The act also contains a provision for GAO to report on SEC's internal supervisory control structure and staff procedures. GAO's last report was in 2016 ( GAO-17-16 ).

This report examines SEC's internal supervisory control framework and assessment of staff procedures, the design of selected controls, and the operation of selected controls.

GAO analyzed SEC's internal supervisory control framework and related policies and guidance and evaluated the design and execution of a non-generalizable sample of controls selected because they addressed high-risk processes.

As of fiscal year 2018, the Securities and Exchange Commission's (SEC) internal supervisory control framework—which provides guidance for division and office staff responsible for assessing the effectiveness of internal supervisory controls —reflected federal internal control standards. GAO determined that SEC's framework included elements covering each of the five components of internal control—control environment, risk assessment, control activities, information and communication, and monitoring. However, SEC does not have written policies or guidance to ensure that relevant SEC divisions and offices systematically assess the effectiveness of procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate securities filings. Establishing such policies would provide SEC greater assurance that these procedures are effective at achieving their objectives.

All the SEC controls GAO evaluated were designed consistent with standards, and a majority operated as intended. SEC guidance and federal internal control standards state that (1) controls should be designed to address objectives and respond to risks and (2) control activities should be implemented through policies, including documentation requirements, and include detail to enable management to monitor control execution.

Control design. All 39 controls GAO evaluated included design elements to achieve SEC's control objectives and respond to risks it identified. However, 10 of these 39 controls did not include key attributes, such as requirements to document, and set time frames for, control execution (see fig.).

Control operation. GAO could not assess the operation of three of 18 selected controls because documentation of control execution did not exist. Of the remaining controls, 12 operated as intended and three partially operated as intended. Examples of controls that operated as intended include SEC's approval of examinations and tracking of investigations.

By more consistently following SEC guidance and federal internal control standards for developing control activities, including documentation requirements, relevant SEC divisions and offices would enhance their ability to monitor and ensure the effectiveness of their internal supervisory controls.

Legend: Corporation Finance = Division of Corporation Finance; Enforcement = Division of Enforcement; OCIE = Office of Compliance Inspections and Examinations; and OCR = Office of Credit Ratings.

Source: GAO analysis of Securities and Exchange Commission (SEC) documents. | GAO-20-115

GAO is making five recommendations to SEC related to developing policies to assess the effectiveness of staff procedures and ensuring that all relevant divisions and offices follow SEC guidance and federal internal control standards for implementing control activities through documented policies. SEC agreed with the recommendations.

The failure of the Securities and Exchange Commission (SEC) to detect  high-profile cases of securities misconduct before and during the 2007– 2009 financial crisis raised concerns about SEC’s internal controls over  its oversight activities. Internal control comprises the plans, methods, and  procedures used to meet an agency’s mission, goals, and objectives.  SEC maintains internal controls to help staff effectively manage its  operations and financial resources, achieve its objectives, and ensure  procedures are performed consistently and in accordance with its  standards.

Section 961 of the Dodd-Frank Wall Street Reform and Consumer  Protection Act (Dodd-Frank Act) directs SEC to provide Congress with an  annual report on the conduct of SEC’s examinations, investigations, and  securities filing reviews. The report must contain an assessment of the  effectiveness of (1) SEC’s internal supervisory controls and (2) staff  procedures (that is, the procedures applicable to SEC staff who perform  reviews of corporate financial securities filings, enforcement  investigations, and examinations of registered entities). The activities  subject to section 961 fall within the purview of the Division of Corporation  Finance (Corporation Finance), Division of Enforcement (Enforcement),  Office of Compliance Inspections and Examinations (OCIE), and, since  2012, Office of Credit Ratings (OCR)—to which we refer collectively as  the divisions and offices.

Section 961 also includes a provision that GAO review SEC’s internal  supervisory control structure and staff procedures and report to Congress  at least every 3 years. In our last review, we found that as of the end of  fiscal year 2015, SEC’s internal supervisory control framework reflected  key components of federal internal control standards. The vast majority  of controls we tested operated as intended. Of those that did not, none  appeared likely to prevent the divisions and offices from achieving the  controls’ objectives. We also found that SEC’s annual section 961 reports  to Congress during fiscal years 2013–2015 were consistent with Dodd- Frank Act requirements and processes for developing the annual reports  reflected components of internal control. We recommended the SEC  Chair formalize an informal working group for activities related to section  961 or otherwise establish a formal body to facilitate the coordination of  compliance with section 961. In 2017, SEC formalized its Section 961  Working Group (Working Group) in response to our 2016  recommendation.

In this report, we examine (1) the extent to which SEC’s internal  supervisory control framework during fiscal years 2016–2018 reflected  federal internal control standards; (2) how SEC evaluated the  effectiveness of staff procedures in fiscal year 2018; (3) the extent to  which selected controls in fiscal year 2018 were designed consistent with  relevant standards; and (4) the extent to which selected controls operated  as intended in fiscal year 2018.

For our first objective, we reviewed SEC’s internal supervisory control  framework for fiscal years 2016–2018. We obtained and reviewed  documentation on policies and procedures and interviewed SEC staff to  assess SEC’s framework against internal control standards for the federal government and to determine the extent to which the framework was  consistent with these standards. We reviewed changes SEC made to its  framework since our last review and compared the framework against  federal internal control standards to determine the extent to which it  continued to reflect those standards as of fiscal year 2018. We also  reviewed the internal supervisory controls in place in the divisions and  offices in fiscal year 2018.

For our second objective, we reviewed policies, procedures, guidance  documents, and other agency documentation to evaluate how SEC and  the divisions and offices assess the effectiveness of staff procedures. We  interviewed SEC staff to obtain an understanding of the steps the  divisions and offices take to assess the effectiveness of staff procedures.

For our third objective, we used control documentation, such as the  policies, procedures, and stated control objectives of the divisions and  offices to determine if the design of selected internal supervisory controls  in place in fiscal year 2018 was consistent with federal internal control  standards and SEC guidance for designing internal controls. We  developed an evaluation template based on federal internal control  standards and assessed selected controls from each division and office  against those criteria. We reviewed documents and interviewed staff to  understand the internal supervisory controls used to oversee the  processes for conducting securities filing reviews, investigations, and  examinations.

We selected a non-generalizable sample of 53 controls in place during  fiscal year 2018 for review—13 controls in Corporation Finance, 15 in  Enforcement, 11 in OCIE, and 14 in OCR. To select controls for review,  we grouped the controls into sets if the underlying staff processes had  multiple associated controls, and we selected controls and control sets  that addressed the processes with the highest risk or potential impact, as  designated by SEC, until we reached our target of 10–15 controls per  division or office. Some control sets contained both controls that SEC  designated as internal supervisory controls and those that it did not so  designate. Therefore, to fully assess complete control sets associated  with underlying processes, our selection contained some controls that  were not related to section 961. In this report, we only discuss and  include analysis for those controls SEC identified as related to section  961, which comprised 39 controls—eight in Corporation Finance, 10 in  Enforcement, eight in OCIE, and 13 in OCR.

For our fourth objective, we used the divisions’ and offices’ policies,  procedures, and documentation of control implementation to determine if  selected internal supervisory controls in place during fiscal year 2018  operated as intended. As we did for the assessment of control design, we  created an evaluation template using SEC’s control activities and related  policy and procedural documents to assess selected controls from each  division and office. We judgmentally selected 18 internal supervisory  controls from the population of 39 internal supervisory controls reviewed  in the third objective, based on whether the controls were labeled as key  to achieving objectives, high-risk, potentially having a major impact, or as  having a likelihood of failure. For these controls, we reviewed  documentation of control implementation to determine if the procedures  outlined in the controls’ designs were followed. We created a  generalizable, random sample of cases to review for eight of the controls,  and reviewed all instances for the remaining controls because they  occurred annually or were executed in only a few instances.

We conducted this performance audit from October 2018 to December  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

The Dodd-Frank Act was enacted to promote the financial stability of the  United States by improving accountability and transparency in the  financial system and protecting consumers from abusive financial  services practices, among other purposes. To help detect and prevent  securities misconduct, section 961 of the Dodd-Frank Act promotes  complete and consistent performance of SEC staff examinations,  investigations and reviews, and appropriate supervision of these activities  through internal supervisory controls. SEC has submitted eight annual  reports to Congress under section 961, all of which stated that both its  internal supervisory controls and its staff procedures were effective for the  period under review. In addition, all such reports stated that no significant  deficiencies in internal supervisory controls were identified.

Section 961 does not define “internal supervisory control.” SEC has  defined internal supervisory controls as the processes established by  management to monitor that the procedures applicable to staff (that is,  established day-to-day procedures to be followed by the employees  within the applicable programs) are consistently being performed  according to policy and procedures, and also remain reasonable,  adequate, and current.

SEC is the primary regulator of the U.S. securities markets and is  responsible for protecting investors, maintaining fair, orderly, and efficient  markets, and facilitating capital formation. To fulfill this mission, SEC  requires public companies to disclose meaningful financial and other  information to the public, examines firms it regulates, and investigates  potential violations of the federal securities laws. SEC is organized into  five divisions and 24 offices. SEC’s approximately 4,400 staff are located  in Washington, D.C., and in 11 regional offices. As discussed previously,  four divisions and offices are subject to section 961 of the Dodd-Frank Act  (see table 1).

SEC formalized its Section 961 Working Group in 2017. The primary  purposes of the Working Group are to enhance the efficiency and  effectiveness of SEC’s processes related to section 961 compliance and  to enhance coordination and information sharing among the divisions and  offices. The Working Group is a staff-level group comprising one or more  representatives from each of the four divisions and offices subject to  section 961 as well as the Office of the Chief Operating Officer. These  staff are responsible for carrying out the Working Group’s responsibilities,  which include establishing a common understanding and consistent  approach to compliance; creating a means to share information and ideas  to improve the efficiency and effectiveness of section 961 compliance  activities; discussing best practices to streamline procedures and  documentation of internal control testing and reporting; and developing  and updating guidance related to implementing section 961.

Standards for Internal Control in the Federal Government provides the  overall framework for establishing and maintaining internal control in  federal agencies. Agency management is responsible for adapting the  framework for an agency. Furthermore, an agency may use the  framework to organize its development and implementation of internal  controls and implement its standards throughout the agency or at an  office level.

Five interrelated components and associated principles establish  requirements for developing and maintaining an effective internal control  system:

Control environment: The control environment is the foundation for  an internal control system. It provides discipline and structure, which  affect the overall quality of internal control. It influences how  objectives are defined and control activities are structured. The  oversight body and management establish and maintain an  environment throughout the entity that sets a positive attitude toward  internal control.

Risk assessment: Management assesses the risks facing the entity  as it seeks to achieve its objectives. This assessment provides the  basis for developing appropriate risk responses. Management  assesses risks the entity faces from external and internal sources.

Control activities: Control activities are the actions management  establishes through policies and procedures to achieve objectives and  respond to risks in the internal control system, which includes the  entity’s information system.

Information and communication: Management uses quality  information to support the internal control system. Effective  information and communication are vital for an entity to achieve its  objectives. Entity management needs access to relevant and reliable  communication related to internal and external events.

Monitoring: Internal controls are dynamic and have to be adapted  continually to risks and changes an entity faces. Monitoring the  internal control system is essential in helping internal control remain  aligned with changing objectives, environment, laws, resources, and  risks. Internal control monitoring assesses the quality of performance  over time and promptly resolves the findings of audits and other  reviews. Corrective actions are a necessary complement to control  activities to achieve objectives.

To be effective, an agency’s internal control system must incorporate the  five components of internal control in an integrated manner throughout its  operations and on an ongoing basis. Once in place, internal control  provides reasonable, not absolute, assurance of meeting agency  objectives. When evaluating the design of internal control, management  determines if controls individually and in combination are capable of  achieving an objective and addressing related risks.

To the extent a control does not fully achieve an objective or address  related risks, it is deficient, and such deficiencies may be associated with  a control’s design or operation.

A deficiency in design exists when a control necessary to meet a  control objective is missing, or an existing control is not properly  designed so that even if the control operated as designed, the control  objective would not be met.

A deficiency in operation exists when a properly designed control  does not operate as designed or the person performing the control  does not possess the necessary authority or competence to perform  the control effectively.

Federal Managers’ Financial Integrity Act and SEC Assurance Statement

In addition to the requirements under section 961 of the Dodd-Frank Act,  SEC must establish and maintain effective internal control and financial  management systems that meet the objectives of the Federal Managers’  Financial Integrity Act of 1982 (FMFIA). FMFIA requires agencies to  annually assess and report on the internal controls that protect the  integrity of their programs and whether financial management systems  conform to related requirements. In addition, FMFIA requires agencies to  provide an assurance statement regarding the effectiveness of the  agency’s internal controls. SEC’s internal controls for financial  management systems are not included in this report because they are  reported in our annual financial audit of SEC. In addition, all of SEC’s  internal controls—including those which constitute internal supervisory  controls—are in scope for FMFIA.

SEC’s Framework for Assessing the Effectiveness of Internal Supervisory Controls Reflected Internal Control Standards

In response to section 961 of the Dodd-Frank Act, the Working Group put  in place a framework that provides guidance for division and office staff  responsible for assessing the effectiveness of internal supervisory  controls (control framework). The control framework draws on external  sources such as federal internal control standards as well as internal  documents such as SEC’s Reference Guide for Compliance with Section  961 of the Dodd-Frank Act, the Risk Management and Internal Control  Review Reference Guide from the Office of the Chief Operating Officer,  and the charter for the Working Group. These internal documents  include definitions, criteria, and other guidance and together compose  SEC’s control framework. For example, the control framework includes  time frames for when divisions and offices should assess their internal  supervisory controls and report findings to Congress (see fig. 1).

SEC’s control framework consists of three phases—risk assessment,  internal supervisory control testing, and communication of results—during  which division and office staff conduct activities to systematically assess  and report on the effectiveness of their internal supervisory controls (see  fig. 2 for examples).

Changes to SEC’s Control Framework Included Refining Guidance and Classification of Internal Supervisory Controls

Changes to SEC’s control framework since our last review (which focused  on fiscal years 2013–2015) include revisions to key guidance  documentation and reclassification of some controls (as nonsupervisory  controls). The Working Group revised elements of its control framework  documentation since our last review. First, the Working Group  streamlined the Reference Guide for Compliance with Section 961 by  removing direct guidance—for example, steps staff should take to assess  the design and operation of internal supervisory controls—and replaced it  with references to the Risk Management and Internal Control Review  Reference Guide. Second, the Working Group also updated other  information such as the agency’s definition for internal supervisory  control. Third, some divisions and offices changed which controls they  considered to be internal supervisory controls subject to section 961  assessments. As stated previously, SEC defines internal supervisory  controls as the processes established by management to monitor that  procedures applicable to staff (the established day-to-day procedures to  be followed by the employees within the applicable program) are  consistently being performed according to policy and procedures, and  also remain reasonable, adequate, and current. Division and Office  officials elaborated further, stating they only consider controls that are  supervisory in nature and directly related to the consistent and complete  execution of examinations of registered entities, enforcement  investigation, or reviews of corporate financial securities filings to be  internal supervisory controls relevant to section 961.

More specifically, OCIE reduced the number of controls it classified as  internal supervisory controls from 40 in fiscal year 2015 to 14 in fiscal  year 2018 by reclassifying some controls as nonsupervisory controls and  by consolidating others (see table 2). For example, OCIE no longer  classifies examination program strategy and selection controls (such as  development and dissemination of examination program goals) as  internal supervisory controls. Therefore, the controls are no longer  assessed under section 961. OCIE officials explained that the strategy  and selection of controls are performed by management and related to  the selection of registrants for examinations, and not to staff conducting  examinations consistently with professional competence and integrity.

Similarly, the number of internal supervisory controls Corporation Finance  maintained decreased from 25 in fiscal year 2015 to eight in fiscal year  2018. Corporation Finance officials told us that they determined that  certain controls previously considered relevant to section 961 did not  represent processes that fall within the core function of reviewing  corporate financial securities filings and thus should not be considered  internal supervisory controls under section 961. Enforcement  maintained 25 internal supervisory controls from fiscal year 2015 to fiscal  year 2018, while OCR had 13–14 internal supervisory controls during the  same period.

SEC’s Control Framework Reflected Internal Control Standards

As of the end of fiscal year 2018, SEC’s control framework continued to  reflect key components of internal control. We compared the framework  against federal internal control standards. Specifically, we assessed  whether the control framework reflected the five components of internal  control—control environment, risk assessment, control activities,  information and communication, and monitoring.

We determined that SEC’s control framework included attributes covering  each of the components. For example, the framework included oversight  structures to monitor the design and operation of division and office  internal supervisory controls, assigned responsibilities to division and  office staff, incorporated steps for staff to follow to assess risks and test  internal supervisory controls, and included mechanisms to correct  deficiencies and report findings to internal and external stakeholders  (such as Congress). See table 3 for additional examples that illustrate  how the control framework reflected relevant standards.

SEC Lacks Policies and Procedures to Systematically Assess the Effectiveness of Staff Procedures

Divisions and offices have not developed written policies and procedures  to ensure that they systematically assess the effectiveness of procedures  applicable to staff who perform examinations of registered entities,  enforcement investigations, and reviews of corporate financial securities  filings. As mentioned previously, the report required under section 961 of  the Dodd-Frank Act must include an assessment of the effectiveness of  both internal supervisory controls and staff procedures.

Division and office officials told us that they used findings and conclusions  from their internal supervisory control assessments to support their  conclusions that staff procedures were effective. As discussed earlier,  SEC defines internal supervisory controls to include two types of  processes used by managers: (1) those used to monitor whether staff  follow existing procedures and (2) those used to monitor whether the  procedures remain reasonable, adequate, and current.

We found that SEC’s assessments of internal supervisory controls did not  directly assess the effectiveness of staff procedures for three primary  reasons. First, the controls included in SEC’s assessment generally  consist of processes that monitor whether staff follow existing procedures,  not processes that monitor whether the procedures remain reasonable,  adequate, and current. Second, SEC’s assessments of internal  supervisory control focus on evaluating the extent to which managers  executed the controls for which they are responsible. Although the  controls monitor whether staff follow underlying procedures, the control  assessments do not directly address whether those underlying staff  procedures are designed to effectively achieve their stated objectives (for  example, identifying and mitigating securities misconduct by securities  market participants). Lastly, documentation of division and office internal  supervisory control assessments did not speak to how division and office  staff reached conclusions that procedures applicable to staff were  effective.

In addition to findings from internal supervisory control assessments, SEC  officials also told us about policies and procedures, compliance testing,  and other activities that provide information regarding the effectiveness of  staff procedures. Corporation Finance officials further elaborated by  stating that there is no single or discrete assessment to test the  effectiveness of staff procedures. Rather, the officials explained that the  division relies on activities performed throughout the year that contribute  to the evaluation of the effectiveness of staff procedures. Examples of  activities all or some divisions and offices referenced included the  following:

Enforcement, Corporation Finance, OCIE, and OCR officials told us  that senior management from each division or office monitor the  effectiveness of their programs throughout the year to help assess the  effectiveness of staff procedures. Examples of monitoring activities  include discussions with staff and subject-matter experts who perform  examinations of registered entities, enforcement investigations, and  reviews of corporate financial securities filings. OCR and Corporation  Finance provided examples of documentation for these activities.

Enforcement, Corporation Finance, OCIE, and OCR provided  documentation that showed they developed review teams, task  forces, projects, or initiatives that review specific policies or risks,  which can result in updates to procedures.

Corporation Finance, OCIE, and OCR officials told us that they have  implemented reviews and redesigns of their policies and procedures  through periodic reviews of their respective program manuals.

See table 4 below for additional examples of activities that divisions and  offices referenced as assessments of the effectiveness of staff  procedures.

The activities mentioned above could provide valuable information for  staff who perform examinations of registered entities, enforcement  investigations, and reviews of corporate financial securities filings, but  they do not represent systematic assessments for the purposes of section  961. In particular, these activities varied between divisions and offices,  mostly were implemented on an irregular basis, and were not established  through written policies or procedures. In addition, none of the divisions  and offices provided documentation linking the results of these, or any  other, activities to the conclusions in SEC’s annual reports to Congress  under section 961, each of which have stated that SEC’s staff procedures  were effective for the period under review. Furthermore, only Corporation  Finance officials told us that they discuss the effectiveness of staff  procedures with their Director when they present their annual internal  supervisory control assessment findings.

As stated previously, the control framework includes an oversight  structure, timelines, evaluation criteria, and documentation requirements,  and SEC considers its control assessments under the framework to  represent assessments of the effectiveness of staff procedures. However,  SEC has not developed detailed policies, procedures, or guidance for  assessing the effectiveness of staff procedures for the purposes of  section 961. For example, the activities that divisions and offices  referenced as assessing the effectiveness of staff procedures were not  established through written policies for section 961-reporting purposes.  And, existing guidance documents such as the Reference Guide for  Compliance with Section 961 do not include steps or documentation  requirements for assessing staff procedures.

Federal internal control standards state the importance for agency  management to establish policies and procedures to achieve objectives.  Because divisions and offices lack written policies and procedures for  assessing the effectiveness of staff procedures, each uses informal  methods and varied processes instead of a systematic approach that  document how each division and office reached its conclusions (that staff  procedures were effective) in SEC’s annual section 961 report to  Congress. Establishing written policies and procedures for systematically  assessing the effectiveness of staff procedures would provide SEC with  greater assurance that the procedures were effective in the context of  section 961 and would help divisions and offices meet objectives.

Selected Controls Were Designed Consistent with Standards, but Some Lacked Directions for Implementing Control Activities

To evaluate the extent to which SEC’s internal supervisory controls met  federal internal control standards and SEC guidance, we evaluated a  non-generalizable sample of internal supervisory controls. We assessed  whether (1) controls were designed to address objectives and respond to  risks and (2) control activities were implemented through policies. We  discuss below our findings related to the 39 internal supervisory controls  that SEC identified as related to section 961. See appendix II for an  example of the template we used to evaluate the controls.

All of the Selected Controls Addressed Identified Objectives and Risks

All 39 internal supervisory controls that we evaluated incorporated design  elements to achieve SEC’s control objectives and respond to risks that  SEC identified. We assessed the overall design of selected internal  supervisory controls against four design elements identified in federal  internal control standards:

Control activities should respond to identified objectives and risks,

Appropriate types of control activities should be used,

Control activities should be designed at the appropriate levels of the  organization (Director, Assistant Director, Branch Chief, etc.), and

Control activity duties should be segregated where practical.

We found that, for the selected controls, each division and office designed  control activities to respond to identified objectives and risks by identifying  the risks addressed by each control and the control objective (how a  control will address the associated risk) in their risk and control  matrixes. In their risk and control matrixes, the divisions and offices also  have established characteristics identified by relevant standards as  important for designing appropriate controls, including the control  frequency, control owner, and whether a control is automated or manual,  preventive or detective, and key or secondary. To ensure that control  activities are designed at the appropriate levels, each division and office  identified control owners in their risk and control matrixes and in the  control descriptions they identified the job title of staff responsible for  executing the controls. Finally, the divisions and offices segregated  control duties in cases in which the need for such segregation was  apparent. For example, a second review by a higher-level official was  included in some controls that required approval decisions. For the results  of our control design assessments, see appendix III.

Some Control Activity Descriptions Lacked Sufficient Information for Implementation and Monitoring

Ten of the 39 controls we evaluated lacked key information needed to  help ensure execution of the control activities (see table 5). Federal  internal control standards state that documentation is required for the  effective design, implementation, and operating effectiveness of an  entity’s internal control system, including documentation of internal control  responsibilities through policies. We assessed SEC’s documented control  activities against three key attributes identified in federal internal control  standards:

Establishment of procedures to support control execution,

Assignment of responsibility for control execution, and

Establishment of time frames for control execution.

Two or three of the selected controls from each division and office did not  incorporate key execution attributes, as seen in table 5. For the results of  our control design assessments, see appendix III.

Descriptions for many control activities did not specify procedures to be  performed or, in some cases include time frames, but all controls we  assessed assigned responsibility for control execution (see table 6). More  specifically, 10 of the 39 controls had no requirement to document  execution of the control activities. For example, one Enforcement control  and two Corporation Finance controls intended to monitor compliance  with timeliness metrics did not include a requirement to document  whether the control activities had been executed—that managers  completed the review of the timeliness reports, noted if any cases were  nearing the time frame threshold, or took appropriate actions in response.

In addition, three of the 39 controls we reviewed did not include the  control activity attribute of follow-up actions to be taken. For example, the  Corporation Finance timeliness controls discussed above also did not  establish follow-up actions for cases in which a team or individual neared  the timeliness threshold. Follow-up actions could include emailing or  calling relevant staff when a timeliness threshold was within a certain  number of days of being breached. The divisions and offices did not  establish operational procedures for how the control activities would be  performed in three of the 39 controls we reviewed. For example, an OCIE  control intended to track enrollment and completion of new examiner  training lacked underlying procedures for identifying or tracking training  progress of new employees.

The divisions and offices did not establish time frames for executing  control activities in three of the 39 controls we reviewed. For example,  while the Corporation Finance timeliness controls discussed above  identified the reports to be reviewed, one of the two controls did not  specify when the reports should be reviewed.

By not incorporating key control attributes into their control activities, SEC  may not have reasonable assurance that internal supervisory controls are  effectively implemented. Some of the controls with weaknesses in one or  more of the control attributes lacked documentation of the controls’  execution, which hindered our ability to test whether the controls operated  as intended, as discussed in the next section. For example, two of the  timeliness controls for Corporation Finance, described above, did not  include a documentation requirement, and no documentation of control  execution was created. In lieu of reviewing documentation of control  execution, for SEC’s assessment of the effectiveness of its internal  supervisory controls, the divisions and offices asked supervisors twice a  year (by email) whether they had executed this control weekly over the  course of the year. Staff from some divisions and offices said the reason  that control activity attributes were not included in some of the controls  was because policies and procedures had been long established and  orally communicated, but not written into the control activities.

Based on Standards for Internal Control in the Federal Government, SEC  developed a reference guide to provide guidance for identifying,  documenting, and monitoring controls. The reference guide states that  internal control activities should be written to describe the actual activities  performed to meet the control objective, and at a minimum, identify  control procedures and how they are to be executed, establish a  documentation requirement for control execution, and assign  responsibility and establish time frames for control execution.

Following SEC guidance for developing control activities could help  divisions and offices ensure evidence exists of control execution and  better enable control monitoring by SEC, and oversight by external  parties, such as GAO and the SEC Inspector General. In turn, better  control monitoring would help ensure that SEC’s internal supervisory  controls are effectively implemented and that procedures necessary to  achieve organizational objectives are followed. Furthermore, enhancing  control activity descriptions would provide SEC greater assurance that  staff have the information necessary to effectively implement the controls.

Assessed Controls Operated or Partially Operated as Intended, but Some Controls Could Not Be Assessed Because of Documentation Weaknesses

We selected 18 of 39 internal supervisory controls across the four  divisions and offices to assess whether they operated as intended in  fiscal year 2018. (See figure 3 for an overview of how we determined  they operated as intended, partially operated as intended, or did not  operate as intended.) As an example of how we conducted these  assessments, we reviewed one OCIE control that called for manager  approval at three points of an examination and additional assistant  director approval to close the examination, as described in OCIE’s control  documentation. To assess whether this control operated as intended, we  selected and reviewed a random, generalizable sample of examinations  in OCIE’s internal system to determine whether all of the control’s  activities—in this case, management approvals—had been executed.

We could not assess some of the controls we selected because SEC did  not provide sufficient documentation to allow us to determine whether the  control operated as intended. For example, two of four Corporation  Finance controls did not include a documentation requirement for weekly  monitoring of staff compliance with internal policy. As a result,  documentation did not exist for us to assess whether supervisors  executed these control activities throughout the year. For more  information on how we determined whether controls were operating as  intended, see appendix I.

All of the Controls That Could Be Assessed Operated or Partially Operated as Intended

Of the 15 controls we could assess, 13 operated as intended and two  partially operated as intended (see table 7). We could not assess three  controls because sufficient documentation was not provided. More  specifically, a control documentation requirement was not established for  the three controls—as identified through our assessment of the control’s  design, described earlier.

We determined that two OCIE controls partially operated as intended. For  example, while we found that 20 percent of sampled OCIE examinations  were not approved within the designated deadline, all examinations were  closed and included all required elements (see table 8).

Some Selected Controls Could Not Be Assessed Because Documentation of Control Execution Did Not Exist

We were unable to assess three of 18 selected controls because the  divisions and offices did not provide sufficient documentation on the  execution of control activities (see table 9). We found these controls  lacked a documentation requirement for control execution in their control  activity descriptions and did not produce sufficient documentation, which  prevented us from determining whether these controls operated as  intended. For example, two of four Corporation Finance controls did not  include a requirement to document execution of the control activity— weekly monitoring of staff compliance with internal policy. Because these  controls did not produce documentation of weekly monitoring throughout  the year as prescribed in the control activity frequency, we did not receive  documentation to allow us to assess whether supervisors executed these  control activities on a weekly basis or, in some cases, at all. Additionally,  we could not assess one selected OCIE control involving tracking of new  employee training.

To help detect and prevent securities misconduct, section 961 of the  Dodd-Frank Act requires SEC to assess the effectiveness of both its  internal supervisory controls and the procedures applicable to staff who  perform examinations of registered entities, enforcement investigations,  and reviews of corporate financial securities filings. While SEC has  established a framework for systematically assessing the effectiveness of  its internal supervisory controls, it has not established a framework for  systematically assessing the effectiveness of staff procedures or  documenting how SEC reached related conclusions about the procedures  in its annual reports to Congress under section 961. Creating written  policies and procedures to systematically assess the effectiveness of staff  procedures and documenting the results of such assessments would  provide SEC with greater assurance that the staff procedures are  effective, a key objective of section 961.

Every control we reviewed incorporated design elements to achieve  SEC’s control objectives and respond to risks that it identified. However,  nine of the 39 controls did not incorporate one or more key attributes that  would help ensure execution of the control, including documentation  requirements, detailed procedures, identification of follow-up actions,  assignment of responsibility for control execution, and time frames for  control execution. Following SEC guidance for developing detailed control  activities could help divisions and offices ensure evidence of control  execution and better enable control monitoring by SEC and external  parties, such as GAO and the SEC Inspector General. In turn, better  control monitoring would help ensure that SEC’s internal supervisory  controls are effective and that procedures necessary to achieve  organizational objectives are followed. Furthermore, enhancing control  activity descriptions would provide SEC greater assurance that staff have  the information necessary to effectively implement the controls.

We are making the following five recommendations to SEC.

The SEC Chair should direct the Directors of the Division of Corporation  Finance, Division of Enforcement, Office of Compliance Inspections and  Examinations, and Office of Credit Ratings to develop written policies and  processes to systematically assess the effectiveness of staff procedures  (procedures applicable to staff who perform examinations of registered  entities, enforcement investigations, and reviews of corporate financial  securities filings). Examples of elements SEC could include in the policies  and processes are the steps necessary to conduct such assessments,  including time frames in which the assessments should be performed and  reviewed; assignment of responsibilities related to the assessments;  requirements for documenting assessments; and steps for staff to take to  mitigate and report deficiencies identified as a result of the assessments.  (Recommendation 1)

The Director of the Division of Corporation Finance should ensure that all  internal supervisory controls include documentation requirements,  detailed procedures, identified follow-up actions, implementation time  frames, and assignment of control execution responsibility, in accordance  with SEC guidance and federal internal control standards for  implementing control activities through documented policies.  (Recommendation 2)

The Director of the Division of Enforcement should ensure that all internal  supervisory controls include documentation requirements, detailed  procedures, identified follow-up actions, implementation time frames, and  assignment of control execution responsibility, in accordance with SEC  guidance and federal internal control standards for implementing control  activities through documented policies. (Recommendation 3)

The Director of the Office of Compliance Inspections and Examinations  should ensure that all internal supervisory controls include documentation  requirements, detailed procedures, identified follow-up actions,  implementation time frames, and assignment of control execution  responsibility, in accordance with SEC guidance and federal internal  control standards for implementing control activities through documented  policies. (Recommendation 4)

The Director of the Office of Credit Ratings should ensure that all internal  supervisory controls include documentation requirements, detailed  procedures, identified follow-up actions, implementation time frames, and  assignment of control execution responsibility, in accordance with SEC  guidance and federal internal control standards for implementing control  activities through documented policies. (Recommendation 5)

We provided a draft of this report to SEC for review and comment. In  written comments (reproduced in appendix VI), SEC agreed with our  findings and concurred with our recommendations. In addition, SEC  provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Chair of SEC, and other interested parties. In addition,  this report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made key contributions to  this report are listed in appendix VII.

Appendix I: Objectives, Scope, and Methodology

This report focuses on activities that fall within the purview of the Division  of Corporation Finance (Corporation Finance), Division of Enforcement  (Enforcement), Office of Compliance Inspections and Examinations  (OCIE), and Office of Credit Ratings (OCR) at the Securities and  Exchange Commission (SEC)—to which we refer collectively as the  divisions and offices. We examined (1) the extent to which SEC’s internal  supervisory control framework during fiscal years 2016–2018 reflected  federal internal control standards; (2) how SEC evaluated the  effectiveness of staff procedures in fiscal year 2018; (3) the extent to  which selected controls in fiscal year 2018 were designed consistent with  relevant standards; and (4) the extent to which selected controls operated  as intended in fiscal year 2018.

For our first objective, we obtained and reviewed relevant documentation  on SEC’s internal supervisory control framework for fiscal years 2016– 2018 and interviewed division and office staff responsible for developing  and updating the framework. We then assessed this framework against  Standards for Internal Control in the Federal Government and determined  the extent to which the framework reflected these standards. Specifically,  we assessed the framework against the five components of internal  control—control environment, risk assessment, control activities,  information and communication, and monitoring—and the 17 principles  associated with these components. We compared information on  changes SEC made to its internal supervisory control framework with  information from our previous review and federal internal control  standards to determine the extent to which the framework continued to  reflect internal control standards.

For our second objective, we reviewed policies, procedures, and  guidance documents (for fiscal year 2018) relating to SEC assessments  of the effectiveness of procedures applicable to staff who perform  examinations of registered entities, enforcement investigations, and  reviews of corporate financial securities filings. We also interviewed SEC  staff to obtain an understanding of the steps and activities that divisions  and offices take to assess the effectiveness of staff procedures. We  intended to assess how SEC assessed staff procedures to determine the  extent to which SEC’s assessments reflected federal internal control  standards. However, as discussed in the report, we found SEC did not  have a framework for assessing the effectiveness of staff procedures. We  therefore examined policies, procedures, and guidance, but did not  assess them against the components and principles associated with the  federal standards for internal control.

For our third objective, we used the policies, procedures, and control  objectives to determine if the design of selected division and office  internal supervisory controls in place during fiscal year 2018 was  consistent with federal internal control standards and SEC guidance for  designing internal controls. We developed an evaluation template and  used it to assess selected controls from each division and office by  having multiple analysts conduct independent reviews and then reached  a final consensus by conducting a joint review with the same analysts.  We used Standards for Internal Control in the Federal Government and  The Committee of Sponsoring Organizations of the Treadway  Commission’s Internal Control – Integrated Framework to develop our  template. We also reviewed documents and interviewed staff to obtain a  thorough understanding of the internal supervisory controls used to  oversee the processes for conducting examinations of registered entities,  enforcement investigations, and reviews of corporate financial securities  filings.

We selected for our review a non-generalizable sample of 53 controls in  place during fiscal year 2018—13 controls in Corporation Finance, 15  controls in Enforcement, 11 in OCIE, and 14 in OCR. We grouped these  controls into sets because some underlying staff processes had multiple  associated controls. In cases in which we selected a control that was part  of a set, we would review every control in the associated set. We selected  controls and control sets that SEC designated as being associated with  processes that have the highest risk or potential impact on achieving  stated objectives until we reached our target of 10–15 controls per  division or office. Some control sets also contained controls that were not  related to section 961. Therefore, to fully assess complete control sets  associated with underlying processes, our selection contained some  controls that were not related to section 961. However, in this report we  only discuss and include analysis for those controls that SEC identified as  related to section 961, which comprises 39 controls—eight in Corporation  Finance, 10 in Enforcement, eight in OCIE, and 13 in OCR.

For our fourth objective, we developed an evaluation template for each  control and conducted independent primary and secondary reviews to  reach a final consensus on the operation of each control. The template  was created using SEC’s control activities and related policy and  procedural documents we received as part of our design assessment. We  used the template to determine the extent to which the execution of  controls met the design criteria. Depending on the extent to which they  met criteria established from control design documents, the selected  controls were grouped under one of the following categories: (1) operated  as intended, (2) partially operated as intended, (3) did not operate as  intended, and (4) could not be assessed because control documentation  did not exist due to design weaknesses, was not received, or was not  relevant.

Because the nature of controls varied, we evaluated controls by applying  the factors below in conjunction with professional judgment. We focused  on whether deficiencies would affect the implementation and operation of  controls.

For controls that operated as intended, we determined that the  divisions and offices provided documentation demonstrating that all  control activities were executed for the instances of control  implementation we reviewed.

We considered controls to have partially operated as intended if the  documentation provided supported that only some control activities  were executed or if at least one control activity did not operate as  intended, but the overall control was executed for most instances.

We did not identify any controls that did not operate as intended. This  determination would have applied to controls for which we received  sufficient documentation to assess the control’s operation and for  which the divisions and offices did not execute all control activities in  most instances.

For controls that we could not assess, we did not receive sufficient  documentation that would enable us to make a determination of  whether the control was executed or operated as intended. For these  controls, we also used the results of our design assessments to  determine whether the controls included a documentation requirement  that would enable us to assess whether they operated as intended.

We judgmentally selected a non-generalizable sample of 18 controls  across all four divisions and offices from the population of 39 internal  supervisory controls we reviewed in the third objective. We selected  these controls based on factors such as whether they were classified as  key to achieving objectives, high-risk, or having high potential impact on  achieving stated objectives or likelihood of failure. We then created a  generalizable, random sample of cases to review for eight controls, and  we reviewed all instances for the remaining controls because they  occurred annually or had few instances. In some cases, we conducted  on-site testing in which we assessed samples of cases for controls by  demonstrations of the divisions and offices’ internal systems.

Appendix II: Template for GAO’s Assessment of the Internal Supervisory Control Design of the Securities and Exchange Commission

This appendix illustrates the template we used to assess the design of  selected controls from each division and office that we reviewed at the  Securities and Exchange Commission (SEC). For each control, we  reviewed policies, procedures, and control objectives to determine if the  design of the selected internal supervisory controls was consistent with  federal internal control standards and SEC guidance for designing  internal controls.

Appendix III: GAO Testing Results for the Design of Selected Securities and Exchange Commission Controls, Fiscal Year 2018

To assess the extent to which design of the Securities and Exchange  Commission’s (SEC) internal supervisory controls was consistent with  federal internal control standards and SEC guidance for designing  internal controls, we reviewed 39 internal supervisory controls across the  four divisions and offices in place during fiscal year 2018. We used the  policies, procedures, and control objectives to determine if the controls’  designs were consistent with the standards and guidance.

Appendix IV: Template for GAO’s Assessment of the Operation of Internal Supervisory Controls by the Securities and Exchange Commission

This appendix illustrates the template we used to assess the operation of  selected Securities and Exchange Commission internal supervisory  controls. For each control, we compared control activity descriptions,  including policy and procedure documents to determine whether selected  controls operated as intended.

Appendix V: GAO Testing Results for Selected Securities and Exchange Commission Controls, Fiscal Year 2018

As part of our review, we tested 18 internal supervisory controls across  four divisions and offices at the Securities and Exchange Commission  (SEC) to determine whether they operated as intended. Controls were  assessed using SEC’s control activity descriptions, including related  policy and procedure documents. For controls that operated as intended,  SEC provided documentation demonstrating that all control activities were  executed. We considered controls to have partially operated as intended  if the documentation supported that only some control activities were  executed or if at least one control activity did not operate as intended, but  the overall control was executed. We did not identify any controls that did  not operate as intended, but this would have applied to controls for which  we received sufficient documentation and the divisions and offices did not  execute all control activities. Controls that we could not assess lacked  sufficient documentation that would have enabled us to determine  whether they operated as intended.

Appendix VI: Comments from the Securities and Exchange Commission

Appendix VII: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Kevin Averyt (Assistant Director),  Christopher Ross (Analyst in Charge), Aaron A. Colsher, Justin Fisher,  Efrain Magallan, Marc Molino, Kirsten Noethen, Barbara Roesmann, and  Farrah Stone made key contributions to this report.

Congress passed the Dodd-Frank Act in 2010 to enhance oversight of financial markets. Under the act, SEC must report annually on the effectiveness of its internal supervisory controls—used to oversee staff performing examinations, investigations, and reviews—and of staff procedures for these areas.

We found SEC has policies for internal supervisory controls. But we didn’t find consistent written policies or guidance for assessing the staff procedures, although SEC reported each year that the procedures were effective.

We recommended that SEC develop such policies.