2017 Report and Certification of Internal Supervisory Controls 

Introduction 

Section 961 ofDodd-Frank Wall Street Reform and Consumer Protection Act (the "Act") 

requires that not later than 90 days after the end of each fiscal year, the Securities and Exchange 

Commission ("SEC" or "Commission") shall report to the Senate Committee on Banking, 

Housing, and Urban Affairs and the House Committee on Financial Services on the supervisory 

controls over the conduct by the Commission of examinations of registered entities, 1 

enforcement investigations, and review of corporate financial securities filings. This report is 

being submitted for the Commission's fiscal year ending September 30, 201 7. 

Background 

The SEC's mission is to protect investors; maintain fair, orderly, and efficient markets; and 

facilitate capital formation. Although the SEC's functional responsibilities are organized among 

five divisions and 23 offices, the scope ofthe activities covered in Section 961 fall principally 

under the purview of: the Office ofCompliance Inspections and Examinations ("OCIE"), the 

Office ofCredit Ratings ("OCR"), 2 the Division of Enforcement ("Enforcement"), and the 

Division ofCorporation Finance ("Corporation Finance"). Therefore, in the context ofthis 

report, references to "the Commission's internal supervisory controls" or "internal supervisory 

controls ofthe Commission" relate to the relevant internal supervisory controls of OCIE, OCR, 

Enforcement, and Corporation Finance. 

OCIE principally administers the examination program for SEC-registered entities including, 

among others, self-regulatory organizations, broker-dealers, transfer agents, clearing agencies, 

municipal advisors, investment companies, and investment advisers. OCIE conducts 

examinations to foster compliance with the securities laws, to detect violations ofthe law, to 

1 References to "examinations" within this report refer to both examinations and inspections conducted by either the 

Office of Compliance Inspections and Examinations or the Office of Credit Ratings. 

2 The Act also mandated the creation of OCR, which was established in June 2012 upon the hiring of its Director 

and was immediately staffed with a reassigned examination team from OCIE and a reassigned monitoring team 

from the Division ofTrading and Markets. The certification mandated by Section 961 of the Act is required for the 

"Director ofthe Division of Enforcement, the Director ofthe Division of Corporation Finance, and the Director of 

the Office of Compliance Inspections and Examinations (or the head of any successor division or office)." The SEC 

has determined that OCR should be considered a successor of OCIE and therefore subject to the reporting 

certification of Section 961. 

Page J of JO 
identify risks and to inform policy. OCR is responsible for conducting examinations and 

monitoring the activities of Nationally Recognized Statistical Rating Organizations to assess and 

promote compliance with statutory and Commission requirements. Enforcement is principally 

responsible for assisting the Commission in executing its law enforcement function by, among 

other things, conducting investigations ofpotential securities law violations; recommending, in 

appropriate circumstances, that the Commission institute civil actions in federal court or before 

an administrative law judge; and prosecuting cases on behalf ofthe Commission. Finally, 

Corporation Finance is principally responsible for selectively reviewing the disclosure 

documents that relate to the offer and sale ofsecurities in registered transactions and which 

publicly-held companies file with the Commission. Through Corporation Finance's review 

process, the Division provides comments on where it believes companies can improve or 

enhance their compliance with the disclosure requirements ofthe federal securities laws. 

Staffing within OCIE and Enforcement consists of attorneys, accountants, examiners, subject 

matter experts, and other employees located both in the Washington, D.C. office and in 11 

regional offices located throughout the country. OCR's staff is comprised ofsimilarly diverse 

professionals who are divided between Washington, D.C. and the New York Regional Office. 

The majority ofthe SEC's other offices and divisions, including Corporation Finance, are 

located exclusively in Washington, D.C. 

This report describes the scope and methodology used to evaluate the internal supervisory 

controls and relevant procedures applicable to the OCIE, OCR, Enforcement, and Corporation 

Finance staff that perform examinations ofregistered entities, enforcement investigations, and 

reviews of corporate financial securities filings. Furthermore, the report describes whether any 

significant deficiencies in these controls or procedures have been identified to exist as of the end 

ofthe fiscal year. The report also includes a description ofthe inherent limitations ofprocedures 

applicable to staff, internal supervisory controls, and the evaluation process. Finally, the report 

includes an assessment of control and procedure effectiveness, the Certification ofSupervisory 

Controls that is required by the Act, and the status of the Comptroller General's review pursuant 

to Section 961 ( e) ofthe Act. 

Internal Supervisory Controls and Procedures Applicable to Staff 

Section 96l(b)(l) ofthe Act requires the assessment ofboth the Commission's internal 

supervisory controls and procedures applicable to the Commission staff who perform 

examinations ofregistered entities (i.e., OCIE and OCR), enforcement investigations (i.e., 

Enforcement), and reviews of corporate financial securities filings (i.e., Corporation Finance). 

The terms "internal supervisory controls" and "procedures applicable to staff' are not defined in 

the Act. For purposes ofthis report and the attached certification, "procedures applicable to 

staff' refer to the established "day-to-day" procedures to be followed by the employees within 

Page 2 of 10 
the applicable programs. "Internal supervisory controls" refer to the processes established by 

management to monitor that the procedures applicable to staff are consistently being performed 

according to policy and procedures, and also remain reasonable, adequate, and current. 

Scope and Methodology 

1. Overview 

The Directors of OCIE, OCR, Enforcement, and Corporation Finance, each with the assistance 

ofhis or her supervisory staff and other office or division personnel, evaluated the effectiveness 

of internal supervisory controls and relevant procedures applicable to staff. The internal 

supervisory control review encompassed controls in place during the entire fiscal year and the 

assurance ofthose controls encompassed the 90-day period ending on the final day of the fiscal 

year ending on September 30, 2017. Upon completion ofthe evaluation, each Director signed a 

certification concerning the adequacy ofthe Commission's internal supervisory controls with 

respect to his or her office or division. 

To facilitate an effective, efficient, and consistent approach to the evaluations, the agency 

established a working group consisting of Senior Officers and staff from OCIE, OCR, 

Enforcement, Corporation Finance, and the Office ofthe Chief Operating Officer. Additionally, 

the working group, as needed, obtained input from other divisions or offices within the agency. 

The working group met and communicated regularly to discuss the execution of each division's 

or office's assessment and to ensure a consistent methodology for conducting the Section 961 

assessment corresponding with relevant government-wide internal controls standards and 

guidance. 

OCIE, OCR, Enforcement, and Corporation Finance engaged in a "top-down, risk-based" 

consideration oftheir functional responsibilities, focusing on assessing whether their respective 

objective of conducting examinations, investigations, or reviews of corporate financial securities 

filings in accordance with adopted policies and procedures had been consistently met during the 

90-day period subject to evaluation. This approach involved identifying risks to achieving such 

objectives, determining whether controls exist to address those risks, and evaluating the 

operating effectiveness ofthe controls included in the evaluation. The procedures for collecting 

information to evaluate the effectiveness ofinternal supervisory controls consisted principally of 

interviews, observation, process walkthroughs, inspection ofdocuments, self-assessments 

(including the use of sub-certifications), and through the application ofjudgment, as appropriate. 

In addition, relevant members ofthe working group reviewed and considered background 

material that included the review ofthe internal supervisory controls pursuant to the 

requirements of Section 961 ofthe Act, the Federal Managers' Financial Integrity Act (FMFIA) 

Page 3 of IO 
assurance statements for fiscal year 2017, results of an agency-wide review of entity-level 

controls, and recent Office of Inspector General ("OIG") and GAO findings. 

Finally, the divisions and offices reviewed any deficiencies identified by assessing their impact 

on the evaluation ofthe design and operating effectiveness ofinternal supervisory controls, 

including making the determination ofwhether any such deficiencies were considered 

significant, either individually or in the aggregate. OCIE, OCR, Enforcement, and Corporation 

Finance provided summary information for such determination and for the evaluation as a whole 

to the respective office or division director in order to support the relevant assertions within the 

certification. 

2. Examinations and Investigations 

To assess the effectiveness ofinternal supervisory controls over examinations and investigations 

and the procedures applicable to the staff performing such functions, OCIE, OCR, and 

Enforcement utilized assessment staff that included members ofthe working group, senior 

managers, and other staff with experience in conducting examinations or investigations, as 

applicable. The assessment staff, along with senior staff and officers, for each function identified 

and evaluated the risks and related controls that are important to the function's ability to 

consistently conduct examinations or investigations according to policies and procedures, which 

included the identification of any deficiencies in control design or operating effectiveness. 

In the case ofOCIE and Enforcement, the evaluation also included an identification ofthe 

information technology ("IT") systems used to track examinations and investigations and an 

assessment ofhow the IT systems are used to support supervisory controls and the procedures 

applicable to staff. In the case of OCR, the assessment staff reviews and tests supervisory 

controls within its examination system. 

The assessment staff for examinations and investigations conducted structured interviews with 

Home and Regional Office Senior Officers3 and other staff with the goal of obtaining their 

assistance and support in the identification and description of controls. In order to assess the 

effectiveness ofsupervisory controls, the teams designed tests around the internal supervisory 

controls that were determined to be designed appropriately. The staff used a combination of 

statistical, random, and judgmental sampling techniques to select samples for validating 

operational effectiveness, as applicable. The staff obtained and documented evidence to support 

the effective operation ofsupervisory controls. 

3 The Regional Office Directors and Home Office Senior Officers within OCIE and Enforcement have supervisory responsibility 

for staff in their respective offices; accordingly, evaluations of internal supervisory controls over examinations and investigations 

required the coordinated participation ofthe Home and Regional Offices. 

Page 4 of 10 
This process was closely coordinated with the annual Management Assurance statement process 

performed for FMFIA purposes and used the sub-certification prepared for the FMFIA assurance 

statement, due to the concurrent nature ofthe identified risks, controls and gaps. The 

sub-certifications were provided to the Director ofOCIE and Co-Directors of Enforcement, 

along with background materials, to support the assertions in the certification required by 

Section 961 ( c )(2) ofthe Act. 

3. Reviews ofCorporate Financial Securities Filings 

To assess the effectiveness of internal supervisory controls over reviews of corporate financial 

securities filings and the procedures applicable to the staff conducting those reviews, 

Corporation Finance established an assessment team that included senior management and other 

staff members. The assessment team identified and evaluated risks and related controls that are 

important to Corporation Finance's ability to consistently conduct reviews according to policies 

and procedures, which included the identification of any deficiencies in control design or 

operating effectiveness. 

The evaluation included the assistance ofthe Disclosure Standards Office, which is staffed 

with permanent managers and rotators with significant experience performing reviews of 

corporate financial securities filings. In order to assess the effectiveness of internal 

supervisory controls, the team designed and executed tests ofsupervisory controls during an 

interim period and the year-end that included a combination ofrandom and judgmental 

sampling techniques to select samples for validating operational effectiveness. The team 

obtained and documented evidence to support the effective operation of supervisory 

controls. 

This process built upon the annual Management Assurance statement process performed for 

FMFIA purposes. 

Inherent Limitations 

All control systems, including internal supervisory controls, are subject to inherent limitations. 

No matter how well-conceived and operated, an internal control system cannot provide absolute 

assurance regarding the achievement of objectives, nor can an evaluation of an internal control 

system provide absolute assurance that significant deficiencies will be identified. Also, 

projections of any evaluation of effectiveness to future periods are subject to the risk that 

internal supervisory controls may become inadequate because of changes in conditions, or that 

the degree of compliance with the policies or procedures may deteriorate. 

Page 5 of 10 
Because ofthe nature, including breadth, ofthe Commission's examination, investigation, and 

review of corporate financial securities filings functions, as well as limitations on resources, 

management and staff within the relevant offices and divisions must exercise judgment in 

conducting examinations ofregistered entities, enforcement investigations, and reviews of 

corporate financial securities filings. As such, controls are inherently designed to allow for the 

application ofjudgment in decision-making. There may be instances where judgments made in 

good faith are in hindsight deemed inappropriate. 

The evaluations of internal supervisory controls and procedures applicable to staff covered by 

this report for the Commission's fiscal year ending September 30, 2017 represent the seventh 

time such evaluations have been conducted pursuant to the requirements of Section 961 ofthe 

Act. The SEC will continue to enhance the approach taken in 2017 to improve the effectiveness 

and efficiency ofthe efforts going forward. The results of GAO's review under Section 961(e) of 

the Act may also result in adjustments to the process in future years. 

Despite the limitations described above, it is our belief that the evaluations of the Commission's 

internal supervisory controls and procedures applicable to staff provide a reasonable and 

justifiable basis for the conclusions expressed in this report. 

Significant Deficiencies 

Section 96l(c)(2)(D) requires each respective Director of OCIE, Enforcement, and Corporation 

Finance and any successor offices, such as OCR, to certify that he or she has disclosed to the 

Commission any significant deficiencies in the design or operation ofinternal supervisory 

controls that could adversely affect the ability ofthe applicable Division or Office to consistently 

conduct inspections, or investigations, or reviews of corporate financial securities filings with 

professional competence and integrity. Under the terms of Reorganization Plan No. 10 of 1950, 

the executive and administrative functions ofthe Commission are transferred to the Chairman of 

the Commission, including, among other functions, the appointment and supervision of 

personnel employed under the Commission.4 Accordingly, the Director of each respective 

Division or Office should make any required disclosures to the Chairman ofthe Commission. 

To make this clear, the attached certification states that the respective Directors have "disclosed 

to the Chairman ofthe Commission any significant deficiencies in the design or operation of 

internal supervisory controls ...." A copy ofthis report is also being provided to each 

Commissioner. 

As part ofthe evaluations described above, the respective OCIE, OCR, Enforcement, and 

Corporation Finance assessment teams evaluated their findings to determine whether any 

deficiencies existed as of September 30, 2017. The severity of all deficiencies identified was 

4 15 F.R. 3175, 64 Stat. 1265, Section l(a). 

Page 6 of IO 
evaluated to determine whether any, either individually or in the aggregate, constituted a 

significant deficiency. Upon completion ofthis process, no significant deficiencies in internal 

supervisory controls were identified. 

For purposes ofmaking the determinations described above, a "significant deficiency" meriting 

the attention by the Chairman ofthe Commission, is any deficiency, or combination of 

deficiencies, in internal supervisory controls that inhibits the respective Office or Division from 

achieving the overall goals established by senior management for consistently conducting 

examinations, investigations, or reviews of corporate financial securities filings with professional 

competence and integrity. 

Summary of Assessment Results 

Based on the results ofthe evaluations described above, as of September 30, 2017, the internal 

supervisory controls ofthe Commission with respect to OCIE and OCR examinations, 

Enforcement investigations, and Corporation Finance reviews of corporate financial securities 

filings are effective, and the procedures ofthe Commission applicable to the OCIE, OCR, 

Enforcement, and Corporation Finance staff who perfonn examinations ofregistered entities, 

enforcement investigations, and reviews of corporate financial securities filings, respectively, are 

effective. 

Certification of Internal Supervisory Controls 

See Exhibit A - Section 96l(c)(2) Certification 

Summary of Review by the GAO 

Section 961(e) ofthe Act requires a review by the Comptroller General ofthe United States of 

the adequacy and effectiveness ofthe Commission's internal supervisory control structure and 

procedures not less frequently than once every three years. Section 961(b)(3) ofthe Act requires 

this report to contain a summary ofthe GA O's review. 

The GAO initiated its triennial review under Section 961(e) and released its report in October 

2016, "Management Has Enhanced Superviso,y Controls and Could Further Improve 

Efficiency" (GAO-17-16). The report concluded that the agency's overall internal supervisory 

control framework reflected key components of internal controls, and that appropriate steps had 

been taken by the agency to enhance the framework since GAO's initial review in 2013. The 

report also stated that the agency had implemented GAO's 2013 recommendation that it should 

make certain that existing and future supervisory controls have clearly defined activities and 

readily available documentation demonstrating execution ofthe activities, and recommended 

Page 7 of 10 
that additional measures could be taken to formalize the Commission's 961 Working Group or 

otherwise establish a formal body to leverage the divisions' and offices' experiences, expand 

their collaboration to share best practices, and streamline procedures and documentation. The 

SEC has taken steps to implement all of GAO's recommendations, and looks forward to GA O's 

review in 2019. 

Page 8 of 10 
Exhibit A 

SECTION 961(c)(2) CERTIFICATION 

Pmsuant to the requirements ofSection 96 1(c)(2) ofthe Dodd-Frank Wall Street Refonn and Conswner 

Protection Act, I hereby certify that: 

I. I am directly responsible for establishing and maintaining the internal supervisory controls ofthe 

Division or Office of which I am the head. 

2. I am knowledgeable about the internal supervisory controls ofthe Division or Office ofwhich I am the 

head. 

3. I have evaluated the effectiveness du1i ng the 90-day pe1iod ending on the final day ofthe fiscal year 

ended September 30, 2017 ofthe internal supervisory contrnls ofthe Division or Office ofwhich I am 

the head. 

4. I have disclosed to the 01airman ofthe Commission any significant deficiencies in the design or 

operation ofinternal supervisory controls identified as a result ofthe evaluation desc1ibed above that 

could adversely affect the ability to consistently conduct with professional competence and integiity, 

respectively: 

(a) inspections and examinations by the Office ofCompliance Inspections and Examinations and 

its successor office, the Office ofCredit Ratings, 

(b) investigations by the Division ofEnforcement, or 

(c) reviews of corporate financial secu1ities filings by the Division ofCorporation Finance. 

This ce1tification concerning the adequacy ofthe Commission's internal supervisory controls is based on 

the review desc1ibed in the accompanying report ofthe internal supe1vis01y controls and procedures 

applicable to the staff that perfonns the duties described above within the Division or Office ofwhich I 

am the head and is accurate to the best ofmy knowledge and belief This review was pe1fonned with the 

assistance ofmy supe1vis01y staffand other personnel within my Division or Office. 

With Respect to Inspections and Examinations: 

Title: Director /~ 

Office of Compliance Inspections and Examinations 

Name: Jessica S. Kane 

Date: ~g~IL-e__ 

Title: A<ding Director ' / 'J-}?J / l7 

Office of Credit Ratings 

Page 9 of 10 
With Respect to Reviews of Corporate Financial Securities Filings: 

Name,M.iirunan 

Date: I ,...2j/~ "7 

Title: Director 

Division ofCorporation Finance 

Division ofEnforcement 

Alctl~--- Na.me: Steven Peikin 

Date: /2./7/t 1 

Title: Co-Director 

Division of Enforcement 

Page 10 of 10