Page 1 of 6 

2021 Report and Certification of Internal Supervisory Controls

Introduction 

Section 961 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the 

"Act") requires that not later than 90 days after the end of each fiscal year, the Securities and 

Exchange Commission ("SEC" or "Commission") shall report to the U.S. Senate Committee 

on Banking, Housing, and Urban Affairs and the U.S. House Committee on Financial 

Services on the conduct by the Commission of enforcement investigations, reviews of 

corporate financial securities filings, and examinations of registered entities.1 This report is 

being submitted for the Commission's fiscal year ending September 30, 2021.

Background

The SEC's mission is to protect investors; maintain fair, orderly, and efficient markets; and 

facilitate capital formation. Although the SEC's functional responsibilities are organized 

among six divisions and 24 offices, the scope of the activities covered in Section 961 fall 

principally under the purview of: the Division of Enforcement ("Enforcement"), the 

Division of Corporation Finance ("Corporation Finance"), the Division of Examinations 

("EXAMS"),2 and the Office of Credit Ratings ("OCR")3. Therefore, in the context of this 

report, references to "the Commission's internal supervisory controls" or "internal 

supervisory controls of the Commission" relate to the relevant internal supervisory controls 

of Enforcement, Corporation Finance, EXAMS, and OCR.

Enforcement is principally responsible for assisting the Commission in executing its law 

enforcement function by, among other things, conducting investigations of potential 

securities law violations; recommending, in appropriate circumstances, that the Commission 

institute civil actions in federal court or before an administrative law judge; and prosecuting 

cases on behalf of the Commission. Corporation Finance is principally responsible for 

selectively reviewing disclosure documents that securities issuers (other than investment 

companies) file with the Commission. Through Corporation Finance's review process, the 

Division provides comments where it believes filers can improve or enhance their 

compliance with the disclosure requirements of the federal securities laws. EXAMS 

principally administers the examination program for SEC-registered entities including, 

among others, self-regulatory organizations, broker-dealers, transfer agents, clearing 

agencies, municipal advisors, investment companies, and investment advisers. EXAMS 

 

1

 References to "examinations" within this report refer to both examinations and inspections conducted by either the 

Division of Examinations or the Office of Credit Ratings. 

2

 In December 2020, the Office of Compliance Inspections and Examinations was renamed the Division of Examinations. 

3

 OCR was created in June 2012 and assumed from EXAMS the responsibility for conducting examinations of entities that are 

registered as Nationally Recognized Statistical Rating Organizations (NRSROs). Consequently, OCR, as a successor office to 

the Division of Examinations, is required to provide a certification under Section 961(c)(1).
Page 2 of 6 

conducts examinations to improve compliance with the securities laws, prevent fraud, 

monitor risks, and inform policy. Finally, OCR is responsible for conducting examinations 

and monitoring the activities of nationally recognized statistical rating organizations to 

assess and promote compliance with statutory and Commission requirements.

This report describes the scope and methodology used to evaluate the internal supervisory 

controls and relevant procedures applicable to the Enforcement, Corporation Finance, 

EXAMS, and OCR staff who perform enforcement investigations, reviews of corporate 

financial securities filings, and examinations of registered entities. Furthermore, the report 

describes the assessments performed and whether any significant deficiencies in the internal 

supervisory controls under Section 961 have been identified by the evaluation to exist as of 

the end of the fiscal year. The report also includes a description of the inherent limitations of 

procedures applicable to staff, internal supervisory controls, and the evaluation process. 

Finally, the report includes the Certification of Supervisory Controls that is required by the 

Act and a summary of the Comptroller General's review pursuant to Section 961(e) of the 

Act.

Internal Supervisory Controls and Procedures Applicable to Staff

Section 96l(b)(l) of the Act requires the assessment of both the Commission's internal 

supervisory controls and procedures applicable to the Commission staff who perform 

enforcement investigations (i.e., Enforcement), reviews of corporate financial securities 

filings (i.e., Corporation Finance), and examinations of registered entities (i.e., EXAMS and 

OCR). The terms "internal supervisory controls" and "procedures applicable to staff" are not 

defined in the Act. Consistent with the scope of Section 961(b)(1)(B), "procedures 

applicable to staff" refer to the established "day-to-day" procedures to be followed by the 

employees performing examinations, investigations, and reviews. “Internal supervisory 

controls” refer to those actions established by Enforcement, EXAMS, OCR and Corporation 

Finance to monitor that the procedures applicable to staff are consistently being performed 

according to policy and procedures, and also remain reasonable, adequate and current. This 

definition of “internal supervisory controls” is linked to procedures applicable to the staff. 

Therefore, for purposes of this report and certification, internal supervisory controls are those 

that are supervisory in nature and directly related to the consistent and complete execution 

of activities within the scope of Section 961(b)(1)(B): examinations, investigations, and 

reviews. 

The evaluations of internal supervisory controls and procedures applicable to staff covered 

by this report for the Commission's fiscal year ending September 30, 2021 represent the 12th

time such evaluations have been conducted pursuant to the requirements of Section 961 of 

the Act. 
Page 3 of 6 

Scope and Methodology 

The Directors4 of Enforcement, Corporation Finance, EXAMS, and OCR, each with the 

assistance of his or her supervisory staff and other office or division personnel, evaluated the 

effectiveness of internal supervisory controls and relevant procedures applicable to staff. 

The internal supervisory control assessment encompassed controls in place during the final 

quarter of the fiscal year ending on September 30, 2021 and the evaluation of the 

effectiveness of those controls encompassed the 90-day period ending on the final day of the 

fiscal year. Upon completion of the evaluation, each Director signed a certification 

concerning the adequacy of the Commission's internal supervisory controls with respect to 

his or her office or division. Assessments of the effectiveness of the relevant procedures 

applicable to the staff were conducted throughout the year as part of on-going monitoring 

activities, specific procedure assessments, or through other assessments. The conclusion 

regarding the effectiveness of those procedures was made as of the end of the fiscal year.

To facilitate an effective, efficient, and consistent approach to the evaluations, the agency 

established a working group consisting of staff from Enforcement, Corporation Finance, 

EXAMS, OCR, and the Office of the Chief Risk Officer. The working group met and 

communicated regularly to discuss the execution of each division's or office's assessment 

and to ensure a consistent methodology for conducting the Section 961 assessment 

corresponding with relevant government-wide internal controls standards and guidance.

Enforcement, Corporation Finance, EXAMS, and OCR engaged in a "top-down, risk-based" 

consideration of their functional responsibilities, focusing on assessing their respective 

objectives of consistently conducting examinations, investigations, or reviews of corporate 

financial securities filings in accordance with adopted policies and procedures. This 

approach involved identifying risks to achieving such objectives, determining whether 

controls exist (or should exist) to address those risks, and evaluating the design and 

operating effectiveness of the controls included in the evaluation. The procedures for 

collecting information to evaluate the effectiveness of internal supervisory controls 

consisted principally of interviews, observation, process walkthroughs, inspection of 

documents, self-assessments, and through the application of judgment, as appropriate. The 

approach of Enforcement, Corporation Finance, EXAMS, and OCR in assessing the 

effectiveness of the procedures applicable to the staff who perform enforcement investigations, 

reviews of corporate financial securities filings, and examinations of registered entities generally 

involved identifying the relevant procedures applicable to the staff, determining the objective of 

those procedures, and assessing whether those procedures effectively achieve the identified 

objectives. 

In addition, relevant members of the working group reviewed and considered background 

material that included the review of the internal supervisory controls pursuant to the 

requirements of Section 961 of the Act, the Federal Managers' Financial Integrity Act 

 

4

 References to "Directors" in this report include Acting Directors as permitted by Section 961(d) of the Act. Acting 

Directors are identified on the last page of Exhibit A to this report.
Page 4 of 6 

("FMFIA") assurance statements for fiscal year 2021, and recent Office of Inspector General 

("OIG") and GAO findings.

Finally, Enforcement, Corporation Finance, EXAMS, and OCR reviewed any deficiencies 

identified in the design or operation of internal supervisory controls to determine whether 

such deficiencies were considered significant, either individually or in the aggregate. 

Enforcement, Corporation Finance, EXAMS, and OCR provided summary information for 

such determination and for the evaluation as a whole to the respective office or division 

Director in order to support the relevant effectiveness conclusions and the assertions within 

the certification. 

The SEC will continue to enhance the approach taken in 2021 to improve the effectiveness 

and efficiency of the efforts going forward. The results of GAO's reviews under Section 

96l(e) of the Act may also result in adjustments to the process in future years.

Inherent Limitations

All control systems, including internal supervisory controls, are subject to inherent 

limitations. No matter how well-conceived and operated, an internal control system cannot 

provide absolute assurance regarding the achievement of objectives, nor can an evaluation 

of an internal control system or procedures applicable to staff provide absolute assurance 

that significant deficiencies will be identified. Also, projections of any evaluation of 

effectiveness to future periods are subject to the risk that internal supervisory controls may 

become inadequate because of changes in conditions, or that the degree of compliance with 

the policies or procedures may deteriorate. 

Because of the nature, including breadth, of the Commission's investigation, review of 

corporate financial securities filings, and examination functions, as well as limitations on 

resources, management and staff must exercise judgment in conducting enforcement 

investigations, reviews of corporate financial securities filings, and examinations of 

registered entities. As such, staff procedures are inherently designed to allow for the 

application of judgment in decision-making. There may be instances where judgments made 

in good faith are in hindsight deemed inappropriate. Despite the limitations described 

above, the evaluations of the Commission's internal supervisory controls and procedures 

applicable to staff are designed to provide a reasonable and justifiable basis for the 

conclusions expressed in this report.

Certification and Reporting

Section 96l(c)(2)(D) requires each respective Director of Enforcement, Corporation Finance, 

EXAMS, and any successor offices (i.e., OCR) to certify that he or she has disclosed to the 

Commission any significant deficiencies in the design or operation of internal supervisory 

controls that could adversely affect the ability of the applicable division or office to 

consistently conduct enforcement investigations, reviews of corporate financial securities 

filings, or examinations of registered entities with professional competence and integrity. 
Page 5 of 6 

Under the terms of Reorganization Plan No. 10 of 1950, the executive and administrative 

functions of the Commission are transferred to the Chairman of the Commission, including, 

among other functions, the appointment and supervision of personnel employed under the 

Commission.5 Accordingly, the Director of each respective division or office should make 

any required disclosures to the Chairman of the Commission. To make this clear, the 

attached certification states that the respective Directors have "disclosed to the Chairman of 

the Commission any significant deficiencies in the design or operation of internal 

supervisory controls. . ." A copy of this report is also being provided to each Commissioner.

As part of the evaluation process described above, the respective Enforcement, Corporation 

Finance, EXAMS, and OCR assessment teams evaluated their findings to determine whether 

any deficiencies in the design or operation of internal supervisory controls existed as of the 

end of the fiscal year. For any such deficiencies, the severity was evaluated to determine 

whether any, either individually or in the aggregate, constituted a significant deficiency. 

For purposes of making the determinations described above, a "significant deficiency" 

meriting the attention by the Chairman of the Commission, is any deficiency, or 

combination of deficiencies, in internal supervisory controls that inhibits the respective 

office or division from achieving the overall goals established by senior management for 

consistently conducting enforcement investigations, reviews of corporate financial securities 

filings, or examinations of registered entities with professional competence and integrity. 

Summary of FY 2021 Assessment Results

Following the process and methodology described above, Enforcement, Corporation 

Finance, EXAMS, and OCR evaluated the effectiveness of the applicable internal 

supervisory controls and staff procedures with respect to the fiscal year ending September 

30, 2021. Based on the results of these evaluations, the internal supervisory controls with 

respect to Enforcement investigations, Corporation Finance reviews of corporate financial 

securities filings, and EXAMS and OCR examinations were effective for the 90-day period 

ending on the final day of the fiscal year ending on September 30, 2021. No significant 

deficiencies in the internal supervisory controls with respect to Enforcement investigations, 

Corporation Finance reviews of corporate financial securities filings, and EXAMS and OCR 

examinations were identified. In addition, the procedures applicable to the Enforcement, 

Corporation Finance, EXAMS, and OCR staff who perform enforcement investigations, 

reviews of corporate financial securities filings, and examinations of registered entities, 

respectively, were effective as of the end of the fiscal year.

 

Certification of Internal Supervisory Controls 

See Exhibit A - Section 961(c)(2) Certification 

 

5

 15 F.R. 3175, 64 Stat. 1265. Section l(a). 
Page 6 of 6 

Summary of Reviews by the GAO 

Section 96l(e) of the Act requires a triennial review by the Comptroller General of the 

United States of the adequacy and effectiveness of the Commission's internal supervisory 

control structure and procedures. Section 961(b)(3) of the Act requires this report to contain 

a summary of the GAO's review.

The SEC appreciates having the benefit of these regular GAO reviews, which have enabled 

the SEC to achieve meaningful improvements in its internal supervisory control systems and 

procedures over the past decade. 

In April 2013, the GAO completed its first triennial review under Section 961(e). This 

report (GAO-13-314) contained one recommendation for SEC action, which the SEC 

implemented. The GAO considers this recommendation closed, indicating on its website 

that it found in a subsequent review that the “SEC has improved the design, operation, and 

documentation of its internal supervisory controls since the issuance of GAO-13-314.” 

In October 2016, the GAO completed its second triennial review. This report (GAO-17-16) 

contained one recommendation for SEC action, which the SEC implemented. The GAO 

considers this recommendation closed, indicating on its web site that the actions taken by the 

SEC were a “critical step to streamline their 961 supervisory control documentation, and increase 

the operating efficiency and effectiveness within and across the divisions and offices.” 

In December 2019, the GAO completed its third triennial review. This report (GAO-20-115) 

contained five recommendations for SEC action, which the SEC implemented. In 

September 2021, the GAO updated its website to indicate that all five recommendation have 

been implemented and are now closed. 

The GAO has recently begun its fourth triennial review. The GAO held its initial entrance 

conference with the SEC in November 2021, and the SEC anticipates learning the results of 

this latest review by the end of calendar year 2022.