__________________________________________________________________________

2018 SUMMARY REPORT OF COMMISSION STAFF’S EXAMINATIONS OF

EACH NATIONALLY RECOGNIZED STATISTICAL RATING ORGANIZATION

__________________________________________________________________________

As Required by Section 15E(p)(3)(C) 

of the Securities Exchange Act of 1934

This is a report of the Staff of the U.S. Securities and Exchange Commission.

The Commission has expressed no view regarding the analysis, findings, or conclusions 

contained herein.

__________________________________

December 2018
TABLE OF CONTENTS

I. Regulatory and NRSRO Overview................................................................................2

A. Statutory Framework and Rules ................................................................................. 2

B. Registered NRSROs .................................................................................................. 6

II. Office of Credit Ratings and Examination Overview.................................................... 7

A. Examinations under Section 15E(p)(3) ....................................................................... 7

B. Examination Overview .............................................................................................. 8

III. Summary of Responses to Recommendations from Previous Examinations and 

Notable Improvements over the Course of the Examinations............................................... 9

A. Responses to Recommendations from the 2017 Section 15E Examinations.................. 9

B. Notable Improvements Over the Course of the Examinations.....................................10

IV. Summary of Essential Findings....................................................................................10

A. Review Area: Adherence to Policies, Procedures, and Methodologies .......................11

B. Review Area: Management of Conflicts of Interest...................................................19

C. Review Area: Implementation of Ethics Policies.......................................................21

D. Review Area: Internal Supervisory Controls.............................................................21

E. Review Area: Governance .......................................................................................29

F. Review Area: DCO Activities ..................................................................................30

G. Review Area: Complaints ........................................................................................30

H. Review Area: Post-Employment ..............................................................................31

V. Conclusion....................................................................................................................32
2018 Section 15E Examinations Summary Report Page 2

I. REGULATORY AND NRSRO OVERVIEW

This report (“Report”) summarizes the examinations conducted by staff from the U.S. Securities 

and Exchange Commission (the “Staff”) under Section 15E(p)(3) of the Securities Exchange Act 

of 1934 (“Exchange Act”).1 This is a report of the Staff and, as such, reflects solely the Staff’s 

views. The U.S. Securities and Exchange Commission (“Commission” or “SEC”) is making this 

Staff Report public as required by Section 15E(p)(3)(C) of the Exchange Act.

A. Statutory Framework and Rules

Section 15E of the Exchange Act (“Section 15E”) and Exchange Act Rules 17g-1 through 

17g-10 govern the registration and oversight program for credit rating agencies that are 

registered with the Commission as nationally recognized statistical rating organizations 

(“NRSROs”). This regulatory regime was established by the Credit Rating Agency Reform Act 

of 2006 (the “Rating Agency Act”)2 and amended by the Dodd-Frank Wall Street Reform and 

Consumer Protection Act of 2010 (the “Dodd-Frank Act”). 3

 

The Dodd-Frank Act mandated the creation of the Office of Credit Ratings (“OCR”), which is

responsible for oversight of credit rating agencies registered with the Commission as NRSROs. 

Pursuant to the Commission’s regulatory regime for NRSROs, an NRSRO is required to, among 

other things:

• File with the Commission annual certifications of its Form NRSRO registrations,

4

promptly update its filing in certain circumstances,

5 and make its current Form NRSRO 

filing and most of its current Form NRSRO Exhibits available on its public website.

6

 

• Disclose certain information, including information concerning the NRSRO’s 

performance measurement statistics and its procedures and methodologies to determine 

ratings.7

 1 Exchange Act Section 15E(p)(3)(C). Unless otherwise noted, all Section and Rule references in this report 

are to the Exchange Act andrules under the Exchange Act.

2 Credit Rating Agency Reform Act of 2006, Pub. L. No. 109-291, 120 Stat. 1327 (2006).

3 The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 932, 124 Stat. 

1376, 1872-83 (2010).

4 Exchange Act Section 15E(b)(2) and Exchange Act Rule 17g-1(f).

5 Exchange Act Section 15E(b)(1) and Exchange Act Rule 17g-1(e).

6 Exchange Act Section 15E(a)(3) and Exchange Act Rule 17g-1(i).

7 Exchange Act Section 15E(a)(1)(B)(i) and Exchange Act Section 15E(a)(1)(B)(ii).
2018 Section 15E Examinations Summary Report Page 3

• Establish, maintain, enforce, and document an effective internal control structure 

governing the implementation of and adherence to policies, procedures, and 

methodologies for determining credit ratings,

8 and retain records of its internal control 

structure.

9

• Consider certain factors with respect to its establishment, maintenance, enforcement, and 

documentation of an effective internal control structure.10

• Establish, maintain, enforce, and document policies and procedures reasonably designed 

to achieve certain objectives concerning its development and application of, and 

disclosures related to, methodologies and models.11 

• File an unaudited report containing an assessment by management of the effectiveness 

during the fiscal year of the NRSRO’s internal control structure governing the 

implementation of and adherence to policies, procedures, and methodologies for 

determining credit ratings.12 The report must be accompanied by a signed statement by 

the NRSRO’s chief executive officer or an individual performing similar functions.13

• Establish, maintain, enforce, and document policies and procedures that are reasonably 

designed to assess the probability that an issuer of a security or money market instrument 

will default or fail to make required payments to investors,14 and ensure that it applies 

any rating symbol, number, or score in a manner that is consistent for all types of 

obligors, securities, and money market instruments for which the symbol, number, or 

score is used.15

• Publish an information disclosure form when taking a rating action with respect to a 

rating assigned to an obligor, security, or money-market instrument in a class for which it 

is registered as an NRSRO.

16 The information form must disclose certain information 

 8 Exchange Act Section15E(c)(3)(A). 

9 Exchange Act Rule 17g-2(b)(12).

10 See, e.g., Exchange Act Rule 17g-8(d)(1) through (4). 

11 See, e.g., Exchange Act Rule 17g-8(a)(2) through (5). 

12 Exchange Act Rule 17g-3(a)(7)(i).

13 Exchange Act Rule 17g-3(b)(2).

14 Exchange Act Rule 17g-8(b)(1).

15 Exchange Act Rule 17g-8(b)(3).

16 Exchange Act Rule 17g-7(a). Rule 17g-7(a) defines rating action to include anexpected or preliminary 

rating, an initial rating, an upgrade or downgrade of an existing rating (including a downgrade to, or 

assignment of, default), and an affirmation or withdrawal of an existing rating if the affirmation or 
2018 Section 15E Examinations Summary Report Page 4

with respect to the particular rating action.17 In addition, the NRSRO must attach to the 

information disclosure form a signed statement by a person within the NRSRO with

responsibility for the rating action.

18

• Make and retain, or retain, certain records, including a record documenting its established 

procedures and methodologies used to determine credit ratings19 and records related to its 

ratings.20 An NRSRO must promptly furnish to the Commission or its representatives 

copies of required records, including English translations of those records, upon 

request.21

• Establish, maintain, and enforce written policies and procedures reasonably designed to 

prevent the misuse of material non-public information (“MNPI”), including the 

inappropriate dissemination of MNPI both within and outside the NRSRO, the 

inappropriate trading of securities using MNPI by a person within the NRSRO, and the 

inappropriate dissemination of pending credit rating actions within and outside the 

 

withdrawal is the result of the NRSRO’s review of the rating using applicable procedures and 

methodologies for determining credit ratings. Exchange Act Rule17g-7(a). Pursuant to Rule 17g-7(a)(3), 

an NRSRO is exempt from publishing an information disclosure form for a particular rating if: (i) the rated 

obligor or issuer of the rated security or money market instrument is not a U.S. person, and (ii) the NRSRO 

has a reasonable basis to conclude that a security or money market instrument issued by the rated obligor or 

the issuer will be offered and sold upon issuance, and that any underwriter or arranger linked to the security 

or money market instrument will effect transactions in the security or money market instrument after 

issuance, only in transactions that occur outside the United States. Exchange Act Rule 17g-7(a)(3). 

17 Exchange Act Rule 17g-7(a)(1)(ii)(A)-(N) specifies the information that must be disclosed in the 

information disclosure form. These required disclosures include: the version of the procedure or 

methodology usedto determine the credit rating; disclosures concerning the uncertainty of the rating, 

including regarding the reliability, accuracy, quality, and accessibility of data related to the rating; a

statement containing an overall assessment of the quality of information available and considered in 

determining the credit rating for the obligor, security, or money market instrument; and information on the 

sensitivity of the rating to assumptions made by the NRSRO. In addition, an NRSRO must attach to the 

information disclosure form any executed Form ABS Due Diligence-15E containing information about the 

security or money market instrument subject to the rating action that is received by the NRSROor obtained 

by the NRSRO through a Rule 17g-5(a)(3) website. 

18 Exchange Act Rule 17g-7(a)(1)(iii).

19 Exchange Act Rule 17g-2(a)(6).

20 The records that an NRSRO must make and retain, or retain, with respect to its ratings include the identity 

of certain persons that participated in determining or approving the rating, records used to form the basis of 

a rating, external and internal communications received or sent by the NRSRO and its employees related to 

a rating, and for ABS ratings, a record of the rationale for any material difference between the final rating 

assigned and the rating implied by a quantitative model that was a substantial component in determining 

the rating. Exchange Act Rule 17g-2(a)(2)(i) and (ii), Exchange Act Rule 17g-2(b)(2), (b)(7), and 

(a)(2)(iii).

21 Exchange Act Section15E(a) and (b) and Exchange Act Rule 17g-2(f).
2018 Section 15E Examinations Summary Report Page 5

NRSRO before issuing the rating on the Internet or through another readily accessible 

means.

22

• Establish, maintain, and enforce written policies and procedures reasonably designed to 

address and manage conflicts of interest.

23 Certain conflicts of interest are expressly 

prohibited,24 and for other types of conflicts of interest, the NRSRO must disclose the 

conflicts and have policies and procedures in place to manage them.

25

• Refrain from engaging in specified unfair, coercive, or abusive practices.26

• Provide information on whether it has in effect a code of ethics, and if not, the reasons it 

does not have a code of ethics.27

• Establish procedures for the receipt, retention, and treatment of complaints regarding 

credit ratings, models, methodologies, and compliance with the securities laws and its 

policies and procedures developed under this regulatory regime, and of confidential, 

anonymous complaints.28

 

• Designate a compliance officer (the “DCO”) responsible for administering policies and 

procedures related to MNPI and conflicts of interest, ensuring compliance with the 

securities laws and regulations, and establishing procedures for handling complaints by

employees or users of credit ratings.

29 The DCO must submit an annual report to the 

NRSRO on the compliance of the NRSRO with the securities laws and the NRSRO’s 

policies and procedures, and the NRSRO must file the report with the Commission.30

 22 Exchange Act Section15E(g) and Exchange Act Rule 17g-4.

23 Exchange Act Section15E(h) and Exchange Act Rule 17g-5.

24 Exchange Act Rule 17g-5(c).

25 Exchange Act Rule 17g-5(a)(1) and (a)(2); Exchange Act Rule 17g-5(b). Moreover, Exchange Act Rule 

17g-5(a)(3) prohibits an NRSRO from having a conflict of interest related to a rating for a security or 

money market instrument issued by an asset pool or as part of any ABS transaction unless the NRSRO, 

among other things, maintains and provides access to a password-protected Internet Web site containing a 

list of each such security or moneymarket instrument for which it is currently in the process of determining 

an initial credit rating, and obtains certain written representations from the issuer, sponsor, or underwriter 

of each such security or money market instrument. 

26 Exchange Act Rule 17g-6.

27 Exchange Act Section15E(a)(1)(B)(v).

28 Exchange Act Section 15E(j)(3).

29 Exchange Act Section15E(j)(1) and (3).

30 Exchange Act Section15E(j)(5).
2018 Section 15E Examinations Summary Report Page 6

• Have a board of directors or similar governing body, certain of whose members must be 

independent from the NRSRO.31 An NRSRO’s board of directors or governing body, or 

members thereof, are responsible for exercising oversight of specified subjects related to 

the NRSRO’s rating business and for approving the procedures and methodologies, 

including qualitative and quantitative data and models, that the NRSRO uses to determine 

ratings.32

• Establish, maintain, enforce, and document standards of training, experience, and 

competence for the individuals it employs to participate in the determination of credit 

ratings that are reasonably designed to achieve the objective that the NRSRO produces 

accurate credit ratings, and retain a record of these standards.33 

• Establish policies and procedures regarding post-employment activities of certain former 

personnel.34

B. Registered NRSROs

In 2007, the Commission began granting registrations to credit rating agencies that applied to be 

registered as an NRSRO. Credit rating agencies seeking to register with the Commission as an 

NRSRO must file a completed application on Form NRSRO, including related Exhibits. 35 A 

credit rating agency may apply to be registered with respect to one or more of the following five 

classes of credit ratings: (1) financial institutions, brokers, or dealers (“financial institutions”); 

(2) insurance companies; (3) corporate issuers; (4) issuers of asset-backed securities (“ABS”); 

and (5) issuers of government securities, municipal securities, or securities issued by a foreign 

government (“government securities”).36 

The 10 credit rating agencies registered as NRSROs as of November 30, 2018, and dates of their 

initial registrations, are listed below. More information on NRSRO registration applications and 

the state of competition, transparency, and conflicts of interest among NRSROs is included in the 

Annual Report to Congress under Section 6 of the Rating Agency Act, available on the 

Commission’s website: http://www.sec.gov/ocr.

 31 Exchange Act Section 15E(t)(2).

32 Exchange Act Section15E(t)(3) and Exchange Act Rule 17g-8(a)(1).

33 Exchange Act Rule 17g-9.

34 Exchange Act Section15E(h)(4) and (5); Exchange Act Rule 17g-8(c).

35 Exchange Act Section15E(a) and Exchange Act Rule 17g-1(a) and (b).

36 Exchange Act Section15E(c)(a)(62)(A).
2018 Section 15E Examinations Summary Report Page 7

NRSRO Date of Initial Registration

A.M. Best Rating Services, Inc. (“AMB”)37 September 24, 2007

DBRS, Inc. (“DBRS”) September 24, 2007

Egan-Jones Ratings Company (“EJR”) December 21, 2007

Fitch Ratings, Inc. (“Fitch”) September 24, 2007

HR Ratings de México, S.A. de C.V. (“HR”) November 5, 2012

Japan Credit Rating Agency, Ltd. (“JCR”) September 24, 2007

Kroll Bond Rating Agency, Inc. (“KBRA”)38 February 11, 2008

Moody’s Investors Service, Inc. (“MIS”) September 24, 2007

Morningstar Credit Ratings, LLC (“MCR”)39 June 23, 2008

S&P Global Ratings (“S&P”)40 September 24, 2007

For purposes of this Report only, we refer to Fitch, MIS, and S&P as larger NRSROs and the 

seven other NRSROs (AMB, DBRS, EJR, HR, JCR, KBRA, and MCR) as smaller NRSROs. 

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW

A. Examinations under Section 15E(p)(3)

Generally, the purpose of NRSRO examinations is to: (i) monitor compliance with applicable 

federal securities laws and rules; (ii) identify conduct, insufficient policies and procedures, or 

ineffective internal controls that potentially violate such laws and rules; and (iii) encourage 

remedial action. To facilitate such remedial action, the Staff sends each NRSRO an examination

summary letter that identifies and explains its findings related to that NRSRO and recommends 

remedial measures. Examinations also serve to inform the Commission and the NRSROs’ 

compliance personnel of regulatory obligations and noteworthy industry developments. If the 

examination Staff identifies potential violations of federal securities laws or rules, the Staff may 

refer the matter to the Commission’s Division of Enforcement, which is responsible for further 

investigation of these potential violations. 

Section 15E(p)(3)(B) provides that each NRSRO examination shall include a review of the 

following eight topic areas (“Section 15E Review Areas”): (i) whether the NRSRO conducts 

business in accordance with its policies, procedures, and rating methodologies; (ii) the 

management of conflicts of interest by the NRSRO; (iii) implementation of ethics policies by the 

NRSRO; (iv) the internal supervisory controls of the NRSRO; (v) the governance of the 

NRSRO; (vi) the activities of the DCO of the NRSRO; (vii) the processing of complaints by the 

 37 Formerly known as A.M. Best Company, Inc.

38 Formerly known as LACE Financial Corp.

39 Formerly known as Realpoint LLC.

40 Formerly known as Standard & Poor’s Ratings Services.
2018 Section 15E Examinations Summary Report Page 8

NRSRO; and (viii) the policies of the NRSRO governing the post-employment activities of its 

former staff.

Section 15E(p)(3)(C) requires the Commission to make available to the public an annual report 

summarizing: (i) the essential findings of all Section 15E examinations, as deemed appropriate 

by the Commission; (ii) the NRSROs’ responses to any material regulatory deficiencies 

identified by the Commission; and (iii) whether the NRSROs have appropriately addressed the 

recommendations of the Commission contained in previous annual reports on examinations.

B. Examination Overview

The 2018 Section 15E examinations generally focused on the NRSROs’ activities for the period 

covering January 1, 2017 through December 31, 2017 (the “Review Period”). The examinations 

also reviewed certain activities or credit rating actions from outside the Review Period.41

The 2018 Section 15E examinations reviewed the Section 15E Review Areas and examined each 

NRSRO’s adherence to Section 15E and Rules 17g-1 through 17g-10. Each of the NRSRO 

examinations encompassed all of the statutorily required Section 15E Review Areas. Within 

each of the Section 15E Review Areas, the Staff determined areas of emphasis and issues of 

focus for each NRSRO based upon an NRSRO-specific risk assessment performed by the Staff. 

The NRSRO-specific risk assessments considered a number of factors, including, but not limited 

to: (i) the NRSRO’s rating activities and operations; (ii) the Staff’s findings, recommendations,

and general observations from prior examinations; (iii) the impact of a potential or actual internal 

control or compliance failure by the NRSRO; (iv) recent industry developments affecting 

NRSROs and the asset classes in which the NRSRO is registered; (v) the NRSRO’s filings with 

the Commission and public disclosures; (vi) the NRSRO’s self-identified weaknesses; and (vii) 

relevant TCRs received by the Commission. 

The 2018 Section 15E examinations also focused on certain subjects and activities that the Staff, 

through its risk assessment process, identified as relevant to several NRSROs, as summarized 

below. 

• Information Technology (“IT”): The Staff reviewed certain NRSROs’ governance 

to analyze the extent to which NRSROs have adequate risk management and 

governance oversight of their IT and cybersecurity program/functions. The Staff 

also reviewed how each NRSRO ensures that only authorized persons have access 

to MNPI. 

• Performance Challenges: The Staff reviewed the potential impact on NRSRO credit 

ratings of the performance challenges facing certain NRSROs. Competition appears 

to be increasing in certain asset classes and subclasses on which certain NRSROs 

have historically depended. At the same time, several NRSROs appear to be 

 41 For example, the Staff may review information relating to tips, complaints, and referrals (“TCRs”) in a 

current examination, even if the referenced activities occurred outside of the Review Period.
2018 Section 15E Examinations Summary Report Page 9

seeking to diversify their activity into additional ratings classes. The Staff reviewed 

certain NRSRO’s policies and procedures regarding attribution and recognition of 

revenue for purposes of conflict of interest rules. 

Collateralized Loan Obligations (“CLOs”): The market for CLOs backed by 

broadly syndicated loans has expanded significantly in recent years. 

Simultaneously, loan markets are experiencing record refinancings, and the lower 

refinanced spreads and extended maturities are causing a number of CLOs to fall 

short of performance benchmarks. The Staff reviewed the sufficiency of NRSRO 

staffing and training to handle the substantial increase in CLO activity including the

sufficiency of surveillance activities.

III. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

EXAMINATIONS AND NOTABLE IMPROVEMENTS OVER THE COURSE OF THE 

EXAMINATIONS

A. Responses to Recommendations from the 2017 Section 15E Examinations

The Staff’s determination that an NRSRO appropriately addressed a recommendation does not 

constitute its endorsement of that NRSRO or its policies, procedures, internal controls, or 

operations. In a future examination, the Staff may reevaluate the NRSRO’s response to 

recommendations that it previously deemed to be appropriately addressed by, for example,

assessing whether the NRSRO fully implemented remedial measures and whether those remedial 

measures appear to be effective. The Staff may also review and make recommendations 

concerning the NRSRO’s policies, procedures, internal controls, or operations related to the 

general subject matter of a recommendation that it previously deemed to be appropriately 

addressed. The determination of whether an NRSRO appropriately addressed a recommendation 

reflects solely the Staff’s view and does not necessarily reflect the views of the Commission. 

The Staff’s assessment of whether an NRSRO has appropriately addressed a recommendation 

depends on the specific facts and circumstances of the recommendation, including, but not 

limited to, the promptness of the NRSRO’s response, the severity of the conduct at issue, and 

whether the remedial action undertaken by the NRSRO is expected to fully resolve the Staff’s 

concerns. To assess whether NRSROs appropriately addressed findings from the 2017 Section 

15E examinations, the Staff reviewed each NRSRO’s written response to the Staff’s examination

summary letter describing its planned remedial measures, and participated in calls with each 

NRSRO to discuss its written response. 

During the 2018 Section 15E examinations, the Staff assessed each NRSRO’s progress in

implementing remedial measures such as establishing policies or procedures or adding resources

in areas such as compliance, IT, or analytics. In assessing the effectiveness of NRSROs’ 

remedial measures, the Staff is cognizant that NRSROs may not be able to fully implement 

remedial measures before the Staff commences its Section 15E examinations for the subsequent 

year, and the Staff may not be able to fully assess the effectiveness of these measures in its 

Section 15E examinations for that subsequent year. 
2018 Section 15E Examinations Summary Report Page 10

Based on the Staff’s 2018 Section 15E examinations, the Staff has determined that all 

recommendations from the 2017 Section 15E examinations have been appropriately addressed. 

NRSROs addressed the 2017 recommendations by taking remedial measures such as adopting 

new or enhancing existing policies or procedures, implementing new or enhancing internal 

controls, implementing new systems and processes, and adding personnel and resources. 

B. Notable Improvements Over the Course of the Examinations

Since they were first conducted in 2010, the Staff’s Section 15E examinations have identified 

certain improvements at one or more of the NRSROs. Generally, NRSRO personnel at all levels 

of seniority and responsibility have continued to display greater awareness of applicable laws 

and their obligations as regulated entities. Moreover, the Staff’s summary reports covering the 

Section 15E examinations since 2012 mention specific improvements by certain NRSROs, and

the NRSROs generally have maintained or augmented those improvements by further enhancing 

the measures undertaken and embedding them in their operations and culture. 

During the 2018 Section 15E examinations, the Staff observed that NRSROs have continued to 

refine their policies, procedures, and controls related to certain NRSRO rules adopted or 

amended in 2014, most of which became effective in mid-2015, and the Staff’s 

recommendations from the 2016 and 2017 Section 15E examinations. The Staff also observed 

that generally, NRSROs’ personnel have continued to gain and display a better understanding of 

these rules and the NRSROs’ policies, procedures, processes, and controls for implementing 

these rules. Additionally, the Staff observed that, in general, most NRSROs continue to improve 

their compliance monitoring and internal audit functions. This improvement has resulted in a 

number of NRSROs becoming proactive in reporting to the Staff issues or potential issues of 

non-compliance with legal requirements or weaknesses in policies and procedures that could 

potentially lead to such non-compliance. In some of those instances, NRSROs have taken 

corrective action prior to Staff learning of the conduct or weakness. However, the Staff has 

continued to identify instances of non-compliance with legal requirements undetected by the 

NRSROs.

IV. SUMMARY OF ESSENTIAL FINDINGS

Section 15E(p)(3)(C)(i) requires this Report to contain a summary of the essential findings of the 

annual examinations, as deemed appropriate by the Commission.

For purposes of this Report, “essential findings” are all findings from the 2018 Section 15E 

examinations that were included with one or more recommendations in an examination summary 

letter sent to an NRSRO. “Essential findings” do not include the Staff’s general observations. In 

this Report, essential findings are organized by the applicable Section 15E Review Areas. This 

Report uses the phrases “significant,” “numerous,” “several,” and “some” to describe and 

distinguish the frequency of conduct or instances underlying certain findings. The particular 

phrase used generally reflects the number of instances during the Review Period, recognizing 

that the number of instances may be reflective of a test sample and not necessarily an NRSRO’s 

comprehensive activities during the Review Period. The Commission has not determined 
2018 Section 15E Examinations Summary Report Page 11

whether any finding discussed in this Report constitutes a “material regulatory deficiency,”42 but 

may do so in the future. 

In the following Sections of this Report, the numbered headers identify in general terms the 

Staff’s findings concerning one or more NRSROs, and the paragraph(s) following each 

numbered header provide additional detail concerning these findings and the Staff’s 

corresponding recommendations.

A. Review Area: Adherence to Policies, Procedures, and Methodologies 

The Staff reviewed a sample of rating actions of each NRSRO in certain asset classes for which 

they are registered and for certain issuers and obligors to determine whether the NRSRO 

operated in accordance with its policies, procedures, methodologies, criteria, and models. The 

Staff also reviewed a sample of rating files and documentation of other ratings-related activities 

to evaluate whether each NRSRO adhered to recordkeeping requirements. To select rating 

actions and rating files to review, the Staff used a risk-based sampling process that is consistent 

with its overall risk assessment approach described in Section II.B of this Report and considered 

factors including but not limited to the significance of the rated asset class to the financial 

markets and the NRSRO’s business, the NRSRO’s activity in the rated asset class, the likelihood 

of impact on investors if a rating was not determined in accordance with the NRSRO’s 

methodologies and procedures, news reports and developments concerning the NRSROs or 

particular asset classes, TCRs, and information the Staff learned during examinations. 

The Staff’s essential findings regarding NRSROs conducting ratings-related activities in 

accordance with their policies, procedures, methodologies, criteria, and models are discussed in 

this Section. The Staff’s essential findings regarding the NRSROs’ adherence to policies and 

procedures related to other Section 15E Review Areas are generally discussed in later Sections of 

this Report. Instances where policies, procedures, and methodologies need to be established or 

improved are also generally discussed in later Sections of this Report. 

The Staff’s essential findings regarding whether each NRSRO has conducted its business in 

accordance with its policies, procedures, and methodologies are as follows:

1. In certain instances, NRSROs did not always properly apply or adhere to their 

methodologies, criteria, or policies and procedures for determining ratings. 

A larger NRSRO did not adhere to its policies and procedures with regard to documenting and 

disclosing the application of its methodologies in some credit rating actions. In one instance, the 

NRSRO did not apply any published methodology in determining the credit rating and the 

related press release did not cite any published methodology. In a second instance, the 

NRSRO’s review function discovered that the wrong methodology was cited for one transaction, 

while the rating committee memoranda for two additional transactions did not explain how the 

cited methodology was applied. The Staff recommended that the NRSRO adhere to its policies 

 42 Exchange Act Section15E(p)(3)(C)(ii).
2018 Section 15E Examinations Summary Report Page 12

and procedures and regulatory requirements with respect to documentation and disclosure of the 

application of its methodologies in credit rating actions.

A larger NRSRO did not adhere to its policies and procedures regarding the use of particular 

tools in the determination of several credit rating actions. The NRSRO’s policies and procedures 

require that before convening a rating committee, the lead analyst must verify that the written 

materials presented to the rating committee clearly identify which materials were used in 

preparing the rating committee and must confirm that the version used is posted or referenced on 

an internal system. In several instances the NRSRO used incorrect or non-current versions of the 

relevant tools. The Staff recommended that the NRSRO adhere to its policies and procedures 

regarding the use of such tools in the determination of credit rating actions. 

A smaller NRSRO’s policies and procedures required timely publication of a credit rating and 

related press release, presale report, or report to the NRSRO’s website. In one instance, the 

NRSRO assigned a particular rating, but did not publish the rating or associated materials. The 

NRSRO discovered the omission four months later as a result of an investor inquiry, and 

subsequently published the rating, press release, and Rule 17g-7 information disclosure report. 

The Staff recommended that the NRSRO ensure that it adheres to statutory requirements and its 

policies and procedures regarding the publication of credit ratings on a timely basis.

A smaller NRSRO did not adhere to its applicable methodology for a significant number of 

credit ratings in which the associated rating files contained no documentation of the deviation 

from established procedures and methodologies or of the specific steps taken in executing the 

deviation. The Staff recommended that the NRSRO: (1) enhance its internal control structure

for governing adherence to its published methodology for determining fund ratings; (2) 

document the circumstances under which deviations to established methodologies are permitted

in accordance with Rule 17g-2(a)(6); (3) consider enhancing its internal control structure to 

ensure that an after-the-fact review or audit can be performed to determine whether an analyst 

adhered to the NRSRO’s procedures and methodologies for determining credit ratings; and (4) 

ensure that it retain records in accordance with Rule 17g-2(b)(2) and (3).

At a smaller NRSRO, there was a wide variation in the NRSRO’s approach to rating preferred 

equity, notwithstanding the existence of an approved methodology. For several preferred equity 

rating files, the NRSRO did not document its ratings approach and rationale and did not have a 

documented methodology with respect to notching. In addition, the NRSRO did not maintain 

documentation regarding the reasons for deviating from its established procedures and 

methodologies in determining such credit ratings and did not document the specific steps taken 

in executing the deviations. The Staff recommended that the NRSRO: (1) enhance its internal 

control structure for governing adherence to its published methodology for determining preferred 

equity ratings; (2) document the circumstances under which deviations to established 

methodologies are permitted in accordance with Rule 17g-2(a)(6); (3) consider enhancing its 

internal control structure to ensure that an after-the-fact review or audit can be performed to 

determine whether an analyst adhered to the NRSRO’s procedures and methodologies for 

determining credit ratings; and (4) ensure that it retains records in accordance with Rule 17g2(b)(2) and (3).
2018 Section 15E Examinations Summary Report Page 13

A smaller NRSRO’s policies and procedures provided that certain clients may review and 

provide comments to rating reports. In several instances the NRSRO accepted a significant 

number of comments from the issuer with little to no supporting information. While there were 

no changes to ratings, the comments were substantive to the narrative in the rating report and, in 

many cases, described the rating subject in a more favorable manner. The Staff recommended 

that the NRSRO: (1) enhance its internal controls, including policies and procedures, with 

respect to the type of comments and changes that it will accept from clients in order to ensure 

that the client does not improperly influence the content of the NRSRO’s rating reports; and (2) 

ensure that employees adhere to the NRSRO’s policies and procedures regarding client 

comments.

A smaller NRSRO’s policies and procedures required analysts to review the difference between 

model-implied and assigned credit ratings and to provide a comment in the rating report 

explaining the reason for the difference if it is more than two notches. However, in numerous

rating files, instead of a comment in the rating report explaining the difference between the 

model-implied rating and the assigned rating, the NRSRO included a short generic reference to 

the use of judgment in making adjustments. Such a statement does not explain the reasoning for 

significant differences between the model-implied and assigned rating. The Staff recommended

that the NRSRO adhere to Rule 17g-2(b)(2) and the NRSRO’s policies and procedures, and 

sufficiently document the differences between the model-implied and assigned ratings within its 

rating reports.

At a smaller NRSRO, in some instances the methodologies listed on information disclosure 

forms did not match the methodologies used to determine the related credit rating. In one 

instance, the information disclosure form did not reflect all of the rating methodologies 

referenced in the rating committee memo. In another instance, the ratings press release 

referenced a different version of the methodology than the version referenced in the rating 

committee memo. The Staff recommended that the NRSRO adhere to the requirements of Rule 

17g-7(a) relating to information disclosure forms.

A larger NRSRO discovered inconsistencies in how certain non-credit risk criteria was applied 

since August 2010 and commenced a review of outstanding ratings assigned to certain financial 

institutions. The NRSRO determined that, due to transaction volume, it did not review the terms 

and conditions of every issue to properly apply such criteria. In addition, the NRSRO discovered 

it did not retain the required documents for all such transactions. After obtaining some missing 

documents from issuers, the NRSRO withdrew a significant number of other ratings for 

insufficient information. The Staff recommended that the NRSRO apply its criteria consistently 

and adhere to its policies and procedures when assigning, maintaining, and withdrawing ratings, 

and that the NRSRO retain transaction documents in accordance with Rule 17g-2(b)(2) and the 

NRSRO’s policies and procedures.

At a larger NRSRO, there were some instances where a rating committee participant was 

ineligible to participate in such rating committee, but did so in violation of the NRSRO’s policies 

and procedures. Instances included: (1) a person chaired a resolution surveillance committee

related to an error correction, although they had chaired the prior surveillance committee for the 

rating; (2) the NRSRO did not perform a conflict check, resulting in an ineligible person chairing 

a committee; (3) a conflicted analyst acted as “person approving credit ratings” for two rating 
2018 Section 15E Examinations Summary Report Page 14

committees; and (4) an analytical manager served as a rating committee chair outside of their 

approved geographic region. The Staff recommended that the NRSRO ensure it adheres to its 

policies and procedures regarding rating committee eligibility.

A larger NRSRO did not adhere to its procedures for model verification and analytical error 

correction. There were several instances in which analysts modified an analytical model to 

correct analytical errors without following applicable procedures. This resulted in errors in tools 

underlying two models and, in each case, the appropriate oversight personnel were not properly 

notified. The analysts made corrections to the models, after being instructed to do so by their 

manager, in contravention of the NRSRO’s procedures. After discovery of the errors and flaws 

in the remediation process, two ratings were subject to re-committee, which resulted in one 

downgrade. The Staff recommended that the NRSRO adhere to its policies and procedures for 

model verification and analytical error correction.

A smaller NRSRO’s policies and procedures defined one type of material deviation as a three or 

more notch differential between a rating determined by a rating committee and the rating implied 

by a model that is a substantial component of a rating methodology. The NRSRO’s procedures

also stated that this type of material deviation is to be published in a related disclosure document, 

such as a press release, presale report, or rating report. The NRSRO did not disclose material 

deviations in the initial published reports for numerous transactions over a 13-month period. In 

the month following that period, the NRSRO amended numerous press releases, noting that the 

original press releases did not include language identifying the material deviations in the ratings 

of these issues. The Staff recommended that the NRSRO ensure that it adheres to its policies and 

procedures regarding the publication of material deviations.

A larger NRSRO’s policies and procedures required all covered models to be approved prior to 

use by a specified body through a specified process. However, in several instances the NRSRO 

used unapproved models to determine credit ratings. The Staff recommended that the NRSRO 

adhere to its model governance policies and procedures and Rules 17g-8(a)(1) and (2).

A smaller NRSRO issued private ratings using procedures and methodologies that were not 

documented in its published methodologies. In addition, the NRSRO did not document the 

procedures and methodologies that were used to determine such credit ratings in the associated 

Rule 17g-7 information disclosure forms and in Exhibit 2 to Form NRSRO. The Staff 

recommended that the NRSRO: (1) correctly identify the version of the methodology used to 

determine credit ratings, as required by Rule 17g-7(a)(1)(ii)(B); (2) disclose the various 

methodologies used to determine ratings in Exhibit 2 to Form NRSRO; and (3) document the 

established procedures and methodologies used to determine credit ratings. 

2. In certain instances, NRSROs did not always adhere to their policies and procedures with 

respect to making complete and accurate disclosures on their Rule 17g-7(a) information 

disclosure forms. 

One smaller NRSRO used nearly identical language in all of its reports for the disclosures 

required by the subparagraphs in Rule 17g-7(a)(1)(ii), including for the required disclosures of: 

(1) the potential limitations of the credit rating; (2) the uncertainty related to reliance on data 
2018 Section 15E Examinations Summary Report Page 15

obtained through public sources; (3) the types of data relied upon; (4) the assessment of the 

quality of information available; (5) the potential volatility of the credit rating; and (6) the 

historical performance of the credit rating and the expected probability of default and the 

expected loss in the event of default. The Staff recommended that the NRSRO ensure that all 

disclosures required pursuant to Rule 17g-7(a)(1) are accurate and specific to the particular 

rating action.

A larger NRSRO’s policies and procedures required that a Rule 17g-7(a) information disclosure 

form must be published for certain rating actions. For private ratings, the NRSRO may prepare

private rating letters that are provided directly to the party requesting the rating, but are not 

accompanied by a Rule 17g-7(a) information disclosure form. The NRSRO confirmed that it 

does not publish an information disclosure form for private ratings and none of its policies or 

procedures addresses such a requirement. The Staff recommended that the NRSRO ensure 

compliance with Rule 17g-7(a) when issuing private rating actions.

At a smaller NRSRO some of the Rule 17g-7(a) information disclosure forms contained 

incorrect or non-functioning hyperlinks to historical performance, including some that sent the 

reader to reports for a different issuer. In addition, two information disclosure forms contained 

hyperlinks to the wrong rating methodologies. The Staff recommended that the NRSRO: (1) 

adhere to the requirements of Rule 17g-7(a) and ensure that hyperlinks contained in the 

information disclosure forms are functioning and link to the correct information; and (2) correct 

the errors in the information disclosure forms.

A smaller NRSRO’s policies and procedures and Rule 17g-7(a)(1)(ii)(B) required that the 

version of the methodology used to determine a credit rating be disclosed in the related Rule 

17g-7(a) information disclosure form. The NRSRO did not disclose the version of the 

methodology used to determine the credit ratings in three published disclosure forms. The Staff 

recommended that the NRSRO ensure adherence to Rule 17g-7(a)(1)(ii)(B) and the NRSRO’s

policies and procedures.

A smaller NRSRO’s policies and procedures required that it make only the most recent version

of its Rule 17g-7(a) information disclosure forms available on its public website. However, in 

several instances the NRSRO’s public website contained both the current version as well as 

outdated versions of the forms, some of which had been outdated for over six months. The Staff 

recommended that the NRSRO adhere to its policies and procedures with regard to publishing 

the most recent versions of information disclosure forms to its website, and prioritize 

remediation of noncompliance with its policies and procedures.

3. In certain instances, NRSROs did not always adhere to their policies and procedures 

concerning surveillance or withdrawals of outstanding ratings.

A smaller NRSRO’s surveillance methodology for a particular type of ABS required that the 

NRSRO perform a monthly review of its entire rated portfolio for changes that directly affect the 

bonds, and that the results of the monthly review be published in surveillance reports. The Staff 

noted some instances where the NRSRO did not publish the required reports for periods ranging 

from 11 to 20 months. The Staff recommended that the NRSRO adhere to its policies and 
2018 Section 15E Examinations Summary Report Page 16

procedures for publishing monthly reports for the particular type of transactions in accordance 

with its surveillance methodology.

A smaller NRSRO rated a type of security using numerous factors that were not enumerated in 

the NRSRO’s then-current methodology, documented in the rating file, or disclosed in the 

corresponding rating publications. In addition, materials presented to the NRSRO’s board of 

directors appeared to be inconsistent with other representations that the NRSRO made 

concerning its relevant methodology. The Staff recommended that the NRSRO: (1) enhance its 

internal controls to ensure compliance with Section 15E(c)(3)(A) and Rules 17g-2(a)(6), 17g2(b)(2), and 17g-8(d)(1)(xi) with respect to documentation and record retention requirements; (2) 

ensure that its public disclosures regarding its methodologies are complete and sufficiently 

detailed to provide the users of its ratings an understanding of the processes employed in 

determining the ratings; and (3) ensure that it establishes, maintains, enforces, and documents an 

effective internal control structure with respect to the affected type of ratings and documents and 

discloses any exceptions or deviations from published methodologies.

4. In certain instances, NRSROs did not always adhere to applicable laws or their policies 

and procedures regarding potential influence on an analyst by business considerations or other 

conflicts of interest.

A smaller NRSRO’s code of conduct prohibited the NRSRO’s personnel from making 

recommendations on the legal structure of rated transactions. In one instance, an analyst 

contacted an underwriting client specifically noting that if a final rating were to be requested, the 

instrument would need to be structured in a particular way so that the rating could be an NRSRO 

rating. In a second instance, a senior manager and senior analyst sent an email to a different 

underwriting client suggesting they structure the instrument as loan or note from an operating 

company instead of a bankruptcy-remote issue, which could be considered a security in a class 

for which the NRSRO is not registered with the Commission. In both instances, the client 

accepted the recommended structuring changes and the NRSRO issued the rating. The Staff 

recommended that the NRSRO ensure that its employees do not engage in activity prohibited by 

Rule 17g-5(c)(5) and that all employees adhere to the terms of the NRSRO’s code of conduct.

A smaller NRSRO’s personal securities trading policies and procedures provided that an 

employee’s list of restricted activities is determined by the employee’s primary area of 

responsibility. However, the NRSRO does not maintain policies and procedures regarding the 

determination of what constitutes a primary area of responsibility. The absence of such a policy 

or procedure results in a lack of clarity around how primary areas of responsibility are defined, 

developed, and applied, and prevents the NRSRO from managing potential or actual conflicts of 

interest. The Staff recommended that the NRSRO establish and maintain written policies and 

procedures with respect to primary areas of responsibility. 

5. In certain instances, NRSROs did not always adhere to their policies and procedures 

concerning protection of MNPI such as pending ratings and non-public information obtained to 

determine ratings.

A larger NRSRO’s policies and procedures prohibited business-related communications from 

being conducted through web-based or personal email accounts, online commercial file-sharing 
2018 Section 15E Examinations Summary Report Page 17

services, or other non-company supported systems. However, in numerous instances, employees 

sent MNPI to their personal email accounts. In one instance an employee inadvertently used a 

co-worker’s personal email address while communicating with an issuer and the issuer 

responded to the email chain with MNPI that also included the personal email address. In 

additional instances, emails containing MNPI were inadvertently disseminated to unintended 

recipients, eight of which were sent to third-party entities. And, in some instances an issuer was 

sent a pre-publication notice via unencrypted email. The Staff recommended that the NRSRO 

ensure that all employees adhere to its policies and procedures established to prevent the 

inappropriate dissemination and misuse of MNPI. 

A larger NRSRO did not always adhere to vulnerability remediation requirements specified in its 

policies and procedures, as numerous vulnerabilities remained open beyond the designated 

remediation requirements. For example, while the NRSRO required remediation of workstation 

vulnerabilities within 30 days, the NRSRO generally had a significant number of outstanding 

critical vulnerabilities on workstations outstanding for more than 90 days. The Staff 

recommended that the NRSRO adhere to requirements defined in its applicable policies and 

procedures. 

6. In certain instances, NRSROs did not always adhere to applicable laws or their policies 

and procedures concerning documentation, record retention, and production of records to 

examination Staff.

A larger NRSRO did not retain communications as required by Rule 17g-2(b)(7) and its policies 

and procedures. The NRSRO’s policies and procedures required materials from and 

correspondence with other analysts or observers to be retained as analytical documents. The 

NRSRO’s ratings analysts used video conferencing, screen sharing, and chat functions to 

conduct meetings related to initiating, determining, maintaining, monitoring, changing, or 

withdrawing credit ratings. However, the chats received and sent through the web conferencing 

system were not captured by the NRSRO’s document retention system. The Staff recommended 

that the NRSRO enhance its internal controls regarding document retention of communications 

received and sent by employees in accordance with Rule 17g-2(b)(7) and the NRSRO’s policies 

and procedures. 

One smaller NRSRO was missing documentation in two rating files, including documentation 

regarding rating committee attendees (including the voting members and chair), and 

documentation supporting the completion of internal attestations. In addition, the NRSRO 

identified that the rating committee notes templates for several private deals were missing the 

required internal attestations, because the internal templates created by one unit of the NRSRO 

did not include the attestations. The NRSRO subsequently instructed all participants in rating 

committees to use the standard template. The Staff recommended that the NRSRO ensure that 

records are made and retained pursuant to Rule 17g-2 and the NRSRO’s policies and procedures.

A larger NRSRO’s policies and procedures required that certain models used in the rating 

process and the analysts who populated and reviewed the models be identified on a specific 

form. Two of the relevant forms included incorrect information: one did not identify a model 

that had been used and another identified an incorrect model version. The NRSRO’s policies 

and procedures also required that the names of the primary and secondary or surveillance analyst 
2018 Section 15E Examinations Summary Report Page 18

be recorded in committee minute sheets and that certain analyst information be disclosed in the 

press release. In two press releases the secondary or surveillance analyst disclosed was not the 

same one recorded in the respective committee minutes. The Staff recommended that the 

NRSRO ensure that records are made and retained in accordance with Rule 17g-2(b)(2) and the 

NRSRO’s policies and procedures.

A smaller NRSRO’s policies and procedures required that any proposed rating action 

incorporating an exception to published credit rating methodology must be submitted to the 

NRSRO’s relevant rating committee for approval. The NRSRO’s policies and procedures also 

provided that previous rating committee-approved deviations could be relied upon for a current 

rating if the circumstances that necessitated the deviation remain unchanged and the analyst 

noted the date of the prior approval on the rating committee vote sheet. In one instance, a rating 

committee vote sheet did not include the date of the prior approval. In addition, the same rating 

file also omitted another vote sheet disclosure, required by the NRSRO’s policies and 

procedures, that the lead analyst did not vote in the rating committee because the analyst had less

than six months of experience. The Staff recommended that the NRSRO adhere to its policies 

and procedures related to documentation requirements in rating files. 

A smaller NRSRO’s policies and procedures required the retention of communications involved 

in initiating, determining, maintaining, monitoring, changing, and withdrawing a rating and

records used to form the basis for rating decisions. However, in some instances rating files were 

missing or contained incomplete information. In one instance, the rating file did not contain 

records of any rating committee presentations or minutes. In another instance, the rating file did 

not contain committee minutes or legal documents other than those attached to emails. In a third 

instance the rating file included no documentation regarding website utilization pursuant to Rule 

17g-5(a)(3)(iii). In a fourth instance, the rating file did not contain the response email from the 

underwriter regarding comments to the draft pre-sale report. The Staff recommended that the 

NRSRO establish, maintain, enforce, and document effective internal controls to ensure 

compliance with its recordkeeping and retention procedures.

7. In certain instances NRSROs did not always adhere to their policies and procedures 

regarding Form ABS Due Diligence-15E disclosures. 

A larger NRSRO did not publish executed Form ABS Due Diligence-15E for some ABS 

transactions. The NRSRO included a hyperlink to the executed form in the public disclosure of 

asset-backed securities transactions. In one ABS transaction the hyperlink to the disclosed form 

was included in the press release of the expected rating but missing from that of the final rating. 

In some other ABS transactions the hyperlinks to the disclosed form did not work. The Staff 

recommended that the NRSRO ensure that it publishes Form ABS Due Diligence-15E as 

required by Rule 17g-7(a)(2).

A smaller NRSRO’s policies and procedures required that when a Form ABS Due Diligence-15E 

report is available, such report must accompany the required Rule 17g-7 information disclosure 

form and be made available to the same people who have access to the information disclosure 

form. For numerous ABS rated by the NRSRO where the NRSRO attached the required reports, 

the reports did not include documents referenced in items 4 or 5 of the reports. The Staff 
2018 Section 15E Examinations Summary Report Page 19

recommended that the NRSRO ensure Form ABS Due Diligence-15E disclosures are properly 

published as required by Rule 17g-7(a)(2) and the NRSRO’s policies and procedures.

8. In one instance, an NRSRO did not always adhere to its policies and procedures with 

respect to internal audit reports.

A smaller NRSRO’s policies and procedures required that the NRSRO’s Chief Compliance 

Officer and internal auditor report to a committee on the duties and operations they carried out 

during the relevant period. The NRSRO did not present a report to the committee at the May 

2017 and September 2017 quarterly committee meetings because, as the NRSRO stated, there 

was nothing to report. However, the NRSRO’s internal audit rules require that an internal audit 

report be provided to the committee at each meeting, and there were in fact two internal audits

conducted in August 2017. The Staff recommended that the NRSRO ensure that the committee 

minutes reflect the requirements of its committee rules.

9. In one instance, an NRSRO did not always use consistent terminology in its policies and 

procedures.

A smaller NRSRO used inconsistent titles and terminology in its policies and procedures. In 

some instances a title for an individual or a group that existed in one document did not match 

titles used in a related context in another document. And, in some instances there were

inaccurate cross-references. The Staff recommended that the NRSRO conduct a review of its 

policies and procedures to identify and correct all inconsistencies. 

B. Review Area: Management of Conflicts of Interest 

The Staff’s essential findings regarding the management of conflicts of interest are as follows:

1. Two NRSROs’ policies and procedures for addressing the 10% of revenue conflict in 

Rule 17g-5(c)(1) were weak.

A smaller NRSRO received from a single client net revenue equaling or exceeding 10% of the 

NRSRO’s total net revenue for fiscal year 2017, in non-compliance with the requirements of 

Rule 17g-5(c)(1). In addition, although the NRSRO represented that its board of directors was 

aware of the possibility that the NRSRO could exceed the 10% threshold for a single client, there 

is no record reflecting any discussion among board members or board recommendations 

regarding the conflict. The Staff recommended that the NRSRO: (1) establish, maintain, 

enforce, and document effective internal controls as required by Section 15E(c)(3)(A) to prevent 

and remediate prohibited conflicts of interest set forth in Rule 17g-5(c); and (2) take immediate 

steps to comply with Rule 17g-5(c)(1) by ceasing to issue or maintain any rating solicited by the 

client until such fiscal year end when the NRSRO in compliance with Rule 17g-5(c)(1) with 

respect to the client. 

A smaller NRSRO did not comply with certain requirements of a Commission order. The Staff 

recommended that the NRSRO ensure adherence to Commission orders and its policies and 

procedures for complying with such orders. 
2018 Section 15E Examinations Summary Report Page 20

2. One NRSRO’s policies and procedures for separating analytical activities from sales and 

marketing activities and preventing analytical activities from being influenced by sales and 

marketing considerations pursuant to Rule 17g-5(c)(8) were weak. 

One smaller NRSRO represented that its plan to diversify its revenue stream was to broaden its 

marketing efforts, including attendance at conferences. NRSRO personnel attended nine such 

conferences in 2017, with the head of the NRSRO’s ratings group being the sole attendee from 

the NRSRO at six of the conferences. The head of the ratings group participated in the 

determination of nearly all ratings issued by the NRSRO. The Staff recommended that the 

NRSRO enhance its internal controls with respect to the separation of ratings responsibilities 

from sales and marketing responsibilities to ensure that it does not engage in the prohibited 

conflict described in Rule 17g-5(c)(8).

3. In one instance, an NRSRO did not have adequate procedures for separating analytical 

activities from sales and marketing activities and preventing analytical activities from being 

influenced by sales and marketing considerations.

One smaller NRSRO did not have reasonably designed procedures for addressing analytical 

staff’s inadvertent exposure to commercial consideration through email or during meetings that 

include analysts. Certain provisions in the NRSRO’s compliance manual provided responses 

regarding specific situations that might arise with regard to analyst involvement in fee 

discussions. However, some of the responses provided were ambiguous, and appeared to 

indicate that analysts could be present for fee discussions. The responses also did not instruct the 

analysts to report such instances. The Staff recommended that the NRSRO consider enhancing 

its procedures to ensure that analysts are aware of the steps to be taken when exposed to fee 

information. 

4. In one instance, an NRSRO did not have a policy to address conflicts of interest and 

protection of MNPI with regard to a non-employee independent director.

The board of directors of a smaller NRSRO approved the election of a new non-employee, nonindependent director. The NRSRO’s policy regarding MNPI did not apply to the new director. 

Nevertheless, the NRSRO stated that it expected the new director to follow the same policies and 

procedures that apply to the NRSRO’s employees, and that the new director will be trained on 

those policies and procedures. Because the policies and procedures that apply to NRSRO 

employees are, by their terms, applicable only to such employees, the new director is not 

compelled to comply with the specifics of the NRSRO’s policies and procedures. The Staff 

recommended that the NRSRO ensure that directors who are non-independent and not NRSRO 

employees are appropriately governed by policies and procedures.

5. In one instance, an NRSRO did not process comments on proposed criteria because it did 

not have effective internal controls.

A larger NRSRO identified a technical issue that resulted in it not processing numerous comment 

submissions addressing proposed changes in criteria. While the system notified users of 

successful submission, the comments were not actually received by the NRSRO. Although the 
2018 Section 15E Examinations Summary Report Page 21

error was captured in systems logs, the NRSRO did not review the logs. The issue continued 

unremediated for approximately eight months. In addition, the incident was logged without 

detailed information as to the submitter or the specific criteria affected. The Staff recommended 

that the NRSRO: (1) enhance its internal controls to ensure adequate testing is required prior to 

change implementation; and (2) ensure sufficient processes are built into policies and procedures 

to ensure NRSRO personnel monitor and resolve applicable processing errors on a consistent 

basis.

6. In one instance, an NRSRO had multiple errors in a ratings subclass as a result of a lack 

of effective internal controls governing adherence to its policies, procedures, and methodologies.

During a 13 month period, a larger NRSRO corrected several errors in a particular subclass of 

ABS ratings issued in five European countries. Causes of the errors included incorrect 

application of stresses; incorrect categorization of loans, properties, and borrowers; counterparty 

and sovereign linkage issues; misapplication of cash flow assumptions; disclosure errors; 

calculation errors; and incorrect modeling of payment priority. Numerous ratings were affected, 

resulting in some corrections of as many as seven notches. The Staff recommended that the 

NRSRO adhere to its policies, procedures, and methodologies for determining European ABS

credit ratings in the particular subclass.

7. In one instance, NRSRO personnel did not always adhere to legal requirements and 

policies and procedures governing separation of sales and analytics and the protection of MNPI.

At a larger NRSRO a senior sales employee obtained MNPI about an upcoming rating 

downgrade and contacted senior management of the NRSRO concerning the timing of the 

downgrade and the composition of the rating committee. In addition, the similarity between 

concerns raised by the sales employee and concerns raised by analytical employees with respect 

to the rating downgrade may evidence a lack of separation between commercial and analytical 

employees. The Staff recommended that the NRSRO ensure its employees adhere to the 

statutory and regulatory requirements and the NRSRO’s policies and procedures related to 

separation of sales and analytics, and protection of MNPI.

C. Review Area: Implementation of Ethics Policies

Each NRSRO has implemented written ethics policies and procedures. The Staff reviewed each 

NRSRO’s ethics policies and procedures, as well as a sample of each NRSRO’s employee 

certifications or monitoring activities concerning its code of ethics. Much of the content of these 

policies and procedures addresses other related Review Areas. As such, the Staff’s findings and 

recommendations related to an NRSRO’s implemented ethics policies and procedures are 

addressed in other sections of this Report.

D. Review Area: Internal Supervisory Controls

The Staff reviewed each NRSRO’s overall control structure, including the internal control 

structure related to determining credit ratings. 
2018 Section 15E Examinations Summary Report Page 22

The Staff’s essential findings regarding internal supervisory controls are as follows:

1. In certain instances, NRSROs’ policies and procedures concerning the rating process did 

not meet all legal requirements or had other weaknesses. 

A larger NRSRO, while assessing the impact of a revision to a rating methodology for a 

particular type of ABS, discovered errors with respect to applications of the prior version of the 

methodology. These errors included, among other things: (a) errors resulting from the incorrect 

use of an analytical tool; (b) errors resulting from the manual population of a database without 

controls to provide for review of the entries; and (c) input of incorrect data during ad hoc 

database queries. The various errors resulted in a significant number of incorrect ratings over a 

period of at least five years, and resulted from deficiencies in internal controls over the ratings 

process, a lack of oversight of analytical tools and databases, and a lack of error detection in the 

surveillance process. The Staff recommended that the NRSRO establish, maintain, enforce, and 

document effective internal controls, including policies and procedures, for the consistent 

application of its methodologies for the type of ABS rating and surveillance processes.

A larger NRSRO did not have effective internal controls governing the timely update of ratings 

that are linked to the rating actions of another credit within the public finance sector. Ratings of 

numerous public finance entities, which depended on the credit support of other public finance 

entities, should have been affected by downgrades or upgrades of such entities, but were either 

not updated promptly, or were improperly linked to an incorrect entity. This resulted in the 

issuance and publication of incorrect ratings. The Staff recommended that the NRSRO ensure 

that the ratings of dependent credits are correctly linked and updated in a timely manner.

A larger NRSRO did not have a documented process for determining when to reconvene a rating 

committee. The NRSRO discovered that ratings for certain bonds affected by a rating upgrade

were not included in the rating committee documentation. The NRSRO concluded that the 

ratings were released without an associated rating committee. After further review, the NRSRO 

concluded that the issue was caused by a documentation error, rather than an analytical error, 

such that no repeat rating committee was necessary. Nevertheless, the NRSRO did subsequently 

reconvene a rating committee with respect to these bonds. While the NRSRO had an informal 

practice in place for determining if a rating committee needs to be reconvened, it did not have a 

documented process for such determinations. The Staff recommended that the NRSRO develop 

a documented process for determining when to reconvene a rating committee.

A larger NRSRO’s policies and procedures did not adequately address error correction for 

private ratings. The NRSRO’s policies and procedures stated that private credit ratings will be 

subject to the same information, rating committee, and internal documentation procedures that 

apply to the NRSRO’s public credit ratings. However, in one transaction where the NRSRO 

reconvened a rating committee for a private rating that had not been analyzed under the 

appropriate methodology, the NRSRO did not follow the steps required for all ratings under its 

error correction procedure. With regard to two transactions where the NRSRO did not properly 

document its analytical approach in the file, the NRSRO, after reconvening the rating committee,

did not issue the correction report or consult with the NRSRO’s legal department as required 

under its policies and procedures. The NRSRO represented to the Staff that it handles errors for 
2018 Section 15E Examinations Summary Report Page 23

private ratings on an informal, undocumented basis. The Staff recommended that the NRSRO 

enhance its policies and procedures to address error corrections in private ratings.

A smaller NRSRO provided an engagement letter to an issuer containing language that the 

NRSRO had previously determined to remove. The NRSRO also rated two transactions without 

first obtaining a signed engagement letter, as required by the NRSRO’s procedures. While the 

NRSRO’s legal department created templates to be used for engagement letters, which were to 

be altered for specific issuers or asset types, the NRSRO’s policies and procedures did not 

specify the process for altering engagement letter templates, or who was authorized to approve 

alterations. Lastly, the NRSRO had no formal sign-off or approval process for engagement 

letters. The Staff recommended that the NRSRO establish, maintain, enforce, and document 

effective internal controls, including policies and procedures, pertaining to the creation and 

approval of engagement letters. 

A smaller NRSRO’s internal controls for reviewing the feasibility of rating an exotic or bespoke 

transaction were weak. The NRSRO issued numerous ratings that were first-of-their-kind at the 

NRSRO. However, the NRSRO did not have documented methodology to rate these types of 

transactions, and there is no record that the NRSRO conducted any significant analysis prior to 

issuing ratings on any of these transactions. As a result, the NRSRO issued such first-of-theirkind ratings using an approach that was not documented in methodology. The Staff 

recommended that the NRSRO establish an effective internal control structure for determining 

credit ratings, including adopting controls reasonably designed to ensure that the NRSRO 

engages in analysis before commencing the rating of exotic or bespoke transactions.

A larger NRSRO identified significant errors that occurred from 2000 to 2012, related to the 

NRSRO’s process for assigning ratings to frequent issuers’ new issues. In 2017, analysts 

identified ratings for several issuances associated with four frequent issuers that should not have 

been rated because the issues were not eligible to be rated under the NRSRO’s criteria or were 

issued by an unrated entity. The NRSRO subsequently withdrew the affected ratings. The Staff 

recommended that the NRSRO conduct a comprehensive review of the ratings assigned to 

frequent issuers’ issuances prior to 2015 by the affected unit to ensure they are maintained in 

accordance with current criteria and policies and procedures.

A larger NRSRO defined two types of rating actions: one for which no press release will be 

distributed and one for which the press release is optional. While the NRSRO did not issue a 

Rule 17g-7(a) information disclosure form for either type of rating, its policies and procedures 

also required it to publish new and continuing variations in ratings criteria in the related press 

release. For a number of ratings, the NRSRO applied a criteria variation but did not disclose it in 

a press release because no press release was otherwise required. Subsequently, the NRSRO 

determined that it will issue an accompanying press release for ratings that have an applied 

criteria variation. The two types of ratings actions are both listed with other rating actions on the 

NRSRO’s website, potentially confusing investors without sufficient information to distinguish 

them and to fully understand the analysis that supports them. The Staff recommended that the 

NRSRO revise its policies and procedures and public disclosures with respect to rating actions to 

ensure they are consistent and clear.
2018 Section 15E Examinations Summary Report Page 24

2. In certain instances, NRSROs did not have effective policies and procedures or internal 

controls concerning the development, documentation, or application of methodologies, criteria, 

or models.

A larger NRSRO withdrew ratings on bonds covered by three municipal credit enhancement

programs and determined that it incorrectly applied its relevant methodology. The NRSRO 

identified weaknesses for the three programs that raised uncertainty as to whether required 

payments would be made consistent with the methodology’s provisions. Since 2010 analysts did 

not confirm exactly how the programs would be applied, and did not confirm that payments 

would be directed appropriately in accordance with the terms of the programs. The Staff 

recommended that the NRSRO enhance its internal control structure to ensure adherence to its 

rating methodologies.

A smaller NRSRO issued NRSRO ratings on securities in a class for which it is not currently 

registered with the Commission. The NRSRO was unfamiliar with a particular type of security it 

was asked to rate and characterized it as a corporate bond based on an insufficient analysis, 

despite receiving information from the client that indicated the security was in a class for which 

the NRSRO is not registered. The Staff recommended that the NRSRO establish, maintain, 

enforce, and document an effective internal control structure to ensure that it does not rate 

securities in a class for which it is not registered.

A smaller NRSRO issued NRSRO ratings on securities in a class for which it is not currently 

registered with the Commission. The NRSRO provided its rating analysts with little documented 

guidance as to the determination of the proper ratings class for each instrument. As a result, 

numerous rating files reviewed appear to have characteristics of securities in a class for which 

the NRSRO is not registered. The Staff recommended that the NRSRO: (1) establish, maintain, 

enforce, and document an effective internal control structure to ensure that it does not rate 

securities in a class for which it is not registered, and (2) re-evaluate transactions it has 

determined are not securities in a class for which it is not registered and take corrective action. 

A smaller NRSRO provided two different versions, dated the same date, of its policy regarding 

business acceptance, each with different individuals identified as members of the responsible 

committee. The NRSRO reconciled the different versions of the policy, but an approval form 

used in accepting business remained inconsistent for another month. The Staff recommended 

that the NRSRO ensure that its policies and procedures for the committee are consistent and 

accurate.

A smaller NRSRO’s policies and procedures provided that the NRSRO will institute and 

maintain procedures allowing for the publication of notice of the existence of a significant error 

in methodologies, criteria, quantitative models, and qualitative models used in the determination 

of credit ratings that may result in a change to current credit ratings. However, the policies and 

procedures did not define what the NRSRO considers to be a significant error triggering 

publication. In discussions with the Staff the NRSRO stated it considered any error that caused 

any rating to change to be a significant error. The Staff believes that the standard may not be 

applied consistently unless it is documented in the NRSRO’s policies and procedures. The Staff 

recommended that the NRSRO define what it considers to be a material or significant error in its 

procedures, methodologies, and models used to determine credit ratings. 
2018 Section 15E Examinations Summary Report Page 25

A smaller NRSRO’s policies and procedures required that the public be given the opportunity to 

comment on a proposed new or revised credit rating methodology prior to adoption, within a 

specified time in which to make comments, and that any comments be made publicly available 

immediately on the NRSRO’s website, except in cases where the commenter requests 

confidentiality. After the Staff inquired as to whether confidential comments would not be 

published, the NRSRO stated that, although a commenter’s identity could be kept confidential 

upon request, all of the comments themselves would be published. The Staff recommended that 

the NRSRO ensure its procedures regarding comments are consistent with its stated practice. 

3. In certain instances, there were weaknesses in NRSROs’ policies, procedures, or internal 

controls to ensure that rating publications contained complete, accurate, and timely information 

concerning the particular rating actions or the methodologies and criteria applied to those rating 

actions.

A smaller NRSRO’s internal controls framework was outdated, because it referred to internal 

control functions that were no longer associated with the NRSRO’s internal control structure. 

For example, the framework refers to a particular committee as being responsible for assisting in 

the review, development, approval, and implementation of all new policies and procedures, 

although the committee was discontinued. The Staff recommended that the NRSRO maintain 

updated documentation of its internal control structure. 

A smaller NRSRO did not update the interactive rating history files on its website no less 

frequently than monthly, as required by Rule 17g-7(b)(3). The NRSRO did not update the 

interactive data files on its website for more than two months. The Staff recommended that the 

NRSRO ensure that rating file histories are updated on its website as required by Rule 17g7(b)(3). 

A smaller NRSRO’s internal controls and policies and procedures required the rating committee 

chair and the analytical group to review certain rating documentation to ensure the rating is 

correct when the deal is finalized and closed. The NRSRO erroneously published a rating for an 

interest-only class of a particular ABS issuance, although the NRSRO never rated the specific 

class. Moreover, in subsequent ratings publications, the NRSRO’s rating announcements 

reflected the class as being affirmed and rated. The Staff recommended that the NRSRO ensure 

the accuracy of its published ratings.

A smaller NRSRO did not have adequate internal controls for ensuring the methodologies used 

to determine credit ratings are correctly disclosed. The Staff observed in several rating files

inconsistencies among the disclosed methodologies in rating reports, press releases, and the Rule 

17g-7(a) information disclosure form. The inconsistencies included references to different 

versions of a single methodology, as well as references to different methodologies. The Staff 

recommended that the NRSRO enhance its internal controls to ensure that the methodologies 

used to determine credit ratings are disclosed in the analysis report, press release, and 

information disclosure form, as applicable.
2018 Section 15E Examinations Summary Report Page 26

4. There were weaknesses in one NRSRO’s policies, procedures, or internal controls 

relating to correction of errors with regard to credit ratings. 

At a smaller NRSRO some errors were not identified or corrected. In one instance, the 

NRSRO’s analysts had made errors in the issuer names on the list of companies attached to the 

ratings prospect reports. Although the NRSRO’s information unit had been informed of the 

errors, it did not correct the errors before the incorrect list was published. In another instance, a 

published ratings list contained incorrect names for certain issuers, after two reviewers did not

identify the errors. In a third instance, the NRSRO did not discover that a press release 

contained an incorrect rating outlook for almost one year. The Staff recommended that the 

NRSRO enhance its internal controls for the identification and correction of errors in credit 

rating actions. 

5. In certain instances, there were weaknesses in NRSROs’ policies, procedures, or internal 

controls relating to surveillance of credit ratings. 

A smaller NRSRO issued private ratings valid for a period of one year from the date of issuance, 

to be withdrawn from the NRSRO’s database after expiration. However, the NRSRO’s database 

retained such ratings past one year, expunging them only at the end of the calendar year. 

Because most of the NRSRO’s private ratings were released to public electronic feeds, some 

users of the ratings may have relied on expired ratings. The NRSRO also did not disclose its 

surveillance process accurately, since it did not indicate that expired ratings remained on the 

NRSRO’s database until year-end. Maintaining different surveillance standards for private and 

non-private ratings caused the NRSRO to apply its rating symbols inconsistently. The Staff

recommended that the NRSRO: (1) perform adequate surveillance and promptly remove expired 

ratings from its database in adherence with its surveillance policy; (2) review its surveillance 

policy with respect to private ratings to ensure accurate and timely ratings; (3) accurately 

disclose its surveillance procedures in Exhibit 2 of Form NRSRO; and (4) enhance its internal 

controls to ensure that any symbol, number, or score is applied consistently.

A smaller NRSRO did not adhere to the annual surveillance review requirement described in its 

policies and procedures. The smaller NRSRO identified significant ratings that were more than 

30 days past their annual surveillance review date, a fact noted in the NRSRO’s annual Rule 

17g-3(a)(7)(i) internal controls report. In addition, in violation of the NRSRO’s error policy, the 

head of surveillance for the affected ABS subclass did not report the surveillance delays 

promptly and did not provide all the relevant details of the incidents. The Staff recommended 

that the NRSRO enhance its internal controls to ensure adherence to policies and procedures 

pertaining to surveillance reviews, and that the NRSRO ensure employees adhere to its error 

policy.

A smaller NRSRO lacked internal controls to accurately monitor and maintain credit rating 

actions in its internal systems and on its public website. The NRSRO’s policies and procedures 

required periodic reviews at approximately one-year intervals. In one instance, the NRSRO 

initially assigned a rating in April 2000, for a bond that was redeemed early in March 2002. The 

NRSRO did not discover the early redemption until September 2007, which had been overlooked 

during the NRSRO’s surveillance process for over five years. When the NRSRO corrected this 

record, it entered an incorrect rating for the bond, and the incorrect rating was overlooked for 10 
2018 Section 15E Examinations Summary Report Page 27

years until 2017. The Staff recommended that the NRSRO develop internal controls for the 

accurate monitoring and maintenance of credit rating actions in its internal systems and on its 

public website. 

6. In certain instances, there were weaknesses in certain NRSROs’ policies, procedures, 

and controls regarding IT, cybersecurity, or access controls. 

A larger NRSRO used IT systems, tools, devices, and software improperly, resulting in rating 

errors, potential conflicts of interest, and release of MNPI. The Staff noted instances including: 

errors resulting from analysts’ improper use of a calculator tool; MNPI forwarded to incorrect 

parties from NRSRO-issued smartphones; and improper use of systems by analysts that resulted

in release of MNPI. NRSRO-issued smartphones, unlike the NRSRO’s email system used on the 

NRSRO’s computers, did not contain software designed to minimize the risk of information 

being inadvertently sent to incorrect parties. However, NRSRO staff was not typically trained on 

the difference in the use of such systems and the heightened risk of inadvertent release of 

information through the use of smartphones. The Staff recommended that the NRSRO ensure 

proper use of IT systems, tools, devices, and software by its personnel.

A larger NRSRO’s internal controls were weak with respect to email mailboxes shared among 

analytical and non-analytical personnel at the NRSRO, and at an affiliate of the NRSRO. The 

NRSRO did not have a method of monitoring which employees accessed such mailboxes. In 

addition, the NRSRO did not have a process in place to manage access requests or ensure 

appropriate access to mailboxes on an ongoing basis, or to support compliance with its policies 

and procedures with respect to protection of MNPI, or with respect to conflicts of interest 

involving the use of the mailboxes by analytical and sales and marketing personnel. The Staff 

recommended that the NRSRO establish, maintain, enforce, and document effective internal 

controls over shared email mailboxes.

A smaller NRSRO’s communications portal erroneously allowed users to see messages from 

other rated companies. While users should only have been able to see their own messages to and 

from the NRSRO, the NRSRO determined that numerous users had sent or received messages 

which were available to all of users. Some users accessed messages that should not have been 

available to them, some of which contained attachments, and one user accessed an attachment

that contained MNPI of another user. The Staff recommended that the NRSRO enhance its 

internal controls to prevent the inappropriate dissemination of MNPI.

A smaller NRSRO’s policies and procedures required employees to copy managers on all 

business emails so that issues such as inadvertent dissemination of MNPI would be identified 

and remediated. The NRSRO identified several instances of emails sent that did not include the 

manager and two instances of personal email accounts used for business purposes that occurred 

during a one-year period. While the NRSRO conducted an annual review of employee emails, 

the scope and focus of such reviews were not specified in the policies and procedures. The 

NRSRO did not have a specific written requirement to conduct periodic review of emails. The 

Staff recommended that the NRSRO consider enhancing its internal controls, including policies 

and procedures, governing the adequate monitoring of email review.
2018 Section 15E Examinations Summary Report Page 28

7. In one instance, an NRSRO had weaknesses in policies, procedures, or controls related to 

employees’ securities trading activities. 

A smaller NRSRO’s policies and procedures did not adequately prevent analysts from rating an 

entity while holding securities in a directly-owned affiliated company. In one instance, an 

analyst participated in determining a credit rating of a company while simultaneously owning 

shares in a publicly traded company whose sole asset was its ownership interest in the rated 

entity. The NRSRO subsequently revoked the analyst’s access to the affected rating, removed 

the analyst from surveilling the rating, and oversaw the managed sale of the shares in question. 

While the NRSRO’s policies and procedures required analysts to disclose any association with 

an issuer and related third parties that could create a conflict or the perception of one, the 

NRSRO’s policies and procedures did not sufficiently capture the conflict at issue. The Staff 

recommended that the NRSRO: (1) enhance its internal controls with regard to the reporting and 

tracking of securities trading; and (2) consider enhancing its securities trading policies and 

procedures to include conflicts of interest that may arise out of its ratings businesses. 

8. In one instance, an NRSRO did not properly file a required financial report pursuant to 

Rule 17g-3(a)(5). 

A smaller NRSRO incorrectly filed with the Commission its annual required unaudited financial 

report listing the 20 largest issuers and subscribers that used credit rating services provided by 

the NRSRO, by amount of net revenue attributable to the issuer or subscriber, during the fiscal 

year. In a June 2017 letter addressing the Rule 17g-3(a)(5) filing for fiscal year 2016, the Staff 

informed the NRSRO that since certain underwriters are part of several groups, revenue should 

be attributed to individual entities rather than underwriter groups. However, the NRSRO, in its 

filing for fiscal year 2017, included an underwriting syndicate among the list of 20 largest 

issuers. The Staff recommended that the NRSRO ensure that it lists only individual entities in its 

annual Rule 17g-3(a)(5) filings.

9. In certain instances, an NRSRO did not properly consider whether a deficiency 

constituted a material weakness under Rule 17g-3(a)(7).

A larger NRSRO, in its 2018 Rule 17g-3(a)(7) internal controls report, identified a number of 

errors with respect to ratings of certain securities that occurred over a number of years and 

impacted a large number of ratings. The various errors resulted from deficiencies in internal 

controls over the ratings process, a lack of oversight of analytical tools, and a lack of error 

detection in the surveillance process. In its 2018 internal controls report, the NRSRO observed 

that the errors “could potentially be viewed as the product of a material weakness” in the 

NRSRO’s internal control structure but determined it could not reach that conclusion “given the 

lack of guidance from the Commission.” The Staff recommended that the NRSRO improve its 

internal controls and process for determining material weaknesses under Rule 17g-3(a)(7).

A larger NRSRO did not always adhere to a certain methodology over a prolonged period of 

time. The NRSRO withdrew several ratings, and lowered several ratings. It appears that the 

NRSRO did not consider in its annual Rule 17g-3(a)(7) internal controls report whether such 

lack of adherence constituted a deficiency or a material weakness that should have been 
2018 Section 15E Examinations Summary Report Page 29

identified in the report. The Staff recommended that the NRSRO improve its internal controls 

and process for determining deficiencies or material weaknesses under Rule 17g-3(a)(7).

At a smaller NRSRO, a major shareholder also served in several high-ranking roles, including as 

head of the NRSRO’s ratings group, constituting a material conflict of interest that the NRSRO 

was required to disclose in Exhibit 6 to Form NRSRO. In addition, a significant amount of the 

NRSRO’s revenue was earned from ratings for which those requesting the rating typically 

provided all the information for the rating and had a strong financial interest in the outcome of 

the rating process. That also should have been disclosed in Exhibit 6. The Staff recommended 

that the NRSRO identify all of its material conflicts of interest in Exhibit 6 to Form NRSRO.

10. In one instance, an NRSRO did not have an effective internal control structure and did 

not accurately reflect the state of its internal controls in its Rule 17g-3(a)(7) report.

A smaller NRSRO did not have an effective internal control structure with regard to numerous 

functions, including conflict prevention and management, adherence to ratings methodologies 

and documentation of deviations, accuracy of public disclosures, consideration of client 

comments and consistent application of ratings symbols. Also, in its 2017 Rule 17g-3(a)(7)

internal controls report, the NRSRO made numerous unsubstantiated representations as to its

capacity to rate certain instruments, its recordkeeping, and its internal audit function. In 

addition, while the NRSRO disclosed that it had a prohibited conflict of interest, the report did 

not document whether the NRSRO considered the conflict to be evidence of a material weakness 

in its internal controls. The Staff recommended that the NRSRO: (1) establish, maintain, 

enforce, and document an effective internal control structure governing the implementation of 

and adherence to policies, procedures and methodologies for determining credit ratings, 

reevaluate statements made in its internal controls report and refile an amended report; (2) 

improve its internal controls and process to prevent making unsubstantiated statements in its 

annual assessment reports; (3) improve its internal controls and process for assessing its internal 

control structure in order to produce an accurate annual assessment report and to ensure that the 

information attested to by the CEO is accurate; and (4) improve its internal controls and process 

for determining deficiencies or material weaknesses under Rule 17g-3(a)(7).

E. Review Area: Governance

The Staff interviewed members of each NRSRO’s board of directors or governing body, 

including independent directors. The Staff also reviewed minutes and other documentation 

related to the activities of each NRSRO’s board of directors or governing body. 

The Staff’s essential findings relating to the NRSROs’ corporate governance and compliance 

with Section 15E(t) is as follows: 

1. One NRSRO’s board of directors did not fulfill its oversight duties under Section 

15E(t)(3). 

The independent directors of a smaller NRSRO appeared to lack awareness of information 

relating to internal controls, conflicts of interest, ratings determination, and employee 

compensation. The NRSRO also appeared to lack transparency and adequate disclosure of 
2018 Section 15E Examinations Summary Report Page 30

information to the independent directors. In addition, the independent directors appeared not to 

have made reasonable inquiries with regard to key areas of the NRSRO’s operations, including 

conflicts of interest regarding the NRSRO’s sources of revenue and its financial resources. The 

Staff recommended that the NRSRO ensure that its independent directors fulfill all duties and 

requirements mandated by Section 15E(t)(3).

F. Review Area: DCO Activities

The Staff reviewed the role and activities of each NRSRO’s DCO and interviewed each 

DCO. The Staff’s essential findings regarding the NRSROs’ DCO activities are as follows:

1. Two NRSROs’ DCOs did not provide adequate oversight of compliance. 

One smaller NRSRO did not adequately track, remediate and monitor its compliance activities. 

The NRSRO’s DCO did not identify that ongoing compliance activities regarding the receipt by 

employees of gifts and entertainment were not accurate and remained incomplete for more than 

six months, and compliance conflict of interest logs were inconsistent or inaccurate. The Staff 

recommended that the NRSRO: (1) enhance its internal controls with regard to compliance

tracking, monitoring, and enforcement of its conflicts of interest policies and procedures; and (2) 

ensure that its DCO carries out the statutory responsibilities set forth in Section 15E(j)(1). 

One smaller NRSRO had numerous, significant compliance deficiencies and weaknesses, 

including a consistent pattern of analysts not fully documenting key aspects of their rating 

analysis as required and instances where the NRSRO did not properly document information 

required in Rule 17g-7 information disclosure forms. In addition, the DCO’s annual compliance 

report incorrectly represented the status of a request to the Commission, and a complaint log and 

report prepared by the DCO omitted key information pertaining to two different potential 

violations by the NRSRO. The Staff recommended that the NRSRO conduct a comprehensive 

evaluation of whether its DCO has the resources to perform their role in an effective manner.

2. One NRSRO’s document production contained incomplete or inaccurate information.

One smaller NRSRO provided the Staff with incomplete document productions regarding a 

particular complaint and a potential conflict of interest. The productions needed to be 

supplemented after the requested date of production. The Staff recommended that the NRSRO 

comply with Rule 17g-2(f) by promptly furnishing to the Staff legible, complete, and current 

copies of records required to be retained.

G. Review Area: Complaints

All of the NRSROs have written policies and procedures to address complaints generally. The 

Staff’s essential findings regarding complaints are as follows:
2018 Section 15E Examinations Summary Report Page 31

1. Two NRSROs did not always adhere to policies and procedures concerning complaints. 

In two instances, a larger NRSRO did not adhere to its complaint policies. In the first instance, 

Staff requested records for the resolution of a particular complaint and received only information 

regarding entry into the complaint tracking system. The Staff also observed that neither the 

complaint log nor supporting documents included information about additional allegations three 

employees made concerning the complaint. Furthermore, additional relevant documents were 

not initially produced in response to the Staff’s document request. In the second instance, the 

NRSRO did not record as a complaint, and apparently did not treat as a complaint, an allegation 

by an outside party that a rating was withdrawn for self-serving purposes. The Staff 

recommended that the NRSRO adhere to its policies and procedures involving the handling and 

documentation of complaints.

A smaller NRSRO’s complaints procedure required that complaints be handled in a confidential 

manner by the NRSRO’s legal and compliance function. An analytical employee filed a 

complaint regarding the NRSRO’s potential non-adherence to policies and procedures regarding 

the separation of analytics and marketing. While the NRSRO investigated the complaint, it did 

not do so through its legal compliance function, in contravention of its complaints procedure. 

The Staff recommended that the NRSRO adhere to its complaints procedures by having its legal 

department conduct complaint investigations.

H. Review Area: Post-Employment 

The Staff reviewed whether each NRSRO’s “look-back” policies and procedures satisfy the 

applicable statutory and Rule requirements. The Staff’s essential findings regarding NRSROs’

look-back policies and procedures are as follows:

1. In certain instances, NRSRO had weaknesses in post-employment policies, procedures, 

and controls.

A smaller NRSRO’s policies and procedures for look-back reviews did not comply with Section 

15E(h)(4)(A) and Rule 17g-8(c). The NRSRO’s policies and procedures included a look-back 

review period that was inconsistent with the period previously communicated by the Staff – the 

one year period preceding the date of the most recent rating action prior to the employee’s 

departure. In addition, the NRSRO’s policies and procedures included additional language 

indicating that the look-back period was discretionary. The Staff recommended that the NRSRO 

revise its policies and procedures for look-back reviews to comply with Section 15E(h)(4)(A)

and Rule 17g-8(c). 

A smaller NRSRO applied inconsistent definitions in its policies and procedures regarding lookback review and post-employment reports. The NRSRO included a specific group of employees 

in the definition of persons who participated in any capacity in determining credit ratings for 

purposes of employment transition reports filed pursuant to Section 15E(h)(5), but excluded the 

same group from that definition for purposes of the look-back review conducted pursuant to 

Section 15E(h)(4)(A). The Staff recommended that the NRSRO revise its policies and 

procedures to ensure consistent identification of former employees for compliance with Section 
2018 Section 15E Examinations Summary Report Page 32

15E(h)(4)(A) and Section 15E(h)(5) and to include the relevant group of employees in all cases 

to ensure compliance with Section 15E(h)(4)(A). 

A smaller NRSRO’s policies and procedures did not fully reflect the requirements of Section 

15E(h)(4)(A). While the NRSRO’s process included using the look-back review period 

previously communicated by the Staff – the one year period preceding the date of the most recent 

rating action prior to the employee’s departure – the NRSRO’s policies and procedures did not 

accurately reflect that period. In addition, the NRSRO’s policies and procedures limited lookback reviews only to employees who had separated from the NRSRO within the past year, a 

limitation not found in Section 15E(h)(4)(A). The Staff recommended that the NRSRO revise its 

policies and procedures to fully reflect the look-back review period previously communicated, 

and to track the requirements of Section 15E(h)(4)(A).

V. CONCLUSION

The Staff has identified findings and recommendations for the NRSROs. In future examinations, 

the Staff will continue to assess the NRSROs’ responses to recommendations from the 2018

Section 15E examinations. The Staff will continue to evaluate its risk assessment process to 

review compliance with laws and regulations and to identify emerging risk areas promptly. The 

Staff will also continue to evaluate examination techniques to assess and test the NRSROs’

compliance with applicable laws and rules.