__________________________________________________________________________

2015 SUMMARY REPORT OF COMMISSION STAFF’S EXAMINATIONS OF

EACH NATIONALLY RECOGNIZED STATISTICAL RATING ORGANIZATION

__________________________________________________________________________

As Required by Section 15E(p)(3)(C) 

of the Securities Exchange Act of 1934

This is a report of the Staff of the U.S. Securities and Exchange Commission.

The Commission has expressed no view regarding the analysis, findings, or conclusions 

contained herein.

__________________________________

December 2015
TABLE OF CONTENTS

I. REGULATORY AND NRSRO OVERVIEW.................................................................... 2

A. Statutory Framework and Rules....................................................................................... 2

B. Registered NRSROs......................................................................................................... 3

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW....................... 4

A. Examinations under Section 15E(p)(3)............................................................................ 4

B. Examination Overview .................................................................................................... 5

III. SETTLED ADMINISTRATIVE ENFORCEMENT PROCEEDINGS .......................... 6

IV. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

REPORTS...................................................................................................................................... 8

A. Recommendations Not Appropriately Addressed ........................................................... 8

B. Notable Improvements..................................................................................................... 9

V. SUMMARY OF ESSENTIAL FINDINGS....................................................................... 10

A. Review Area: Adherence to Policies, Procedures, and Methodologies........................ 10

B. Review Area: Management of Conflicts of Interest ..................................................... 14

C. Review Area: Implementation of Ethics Policies......................................................... 18

D. Review Area: Internal Supervisory Controls................................................................ 18

E. Review Area: Governance ............................................................................................ 25

F. Review Area: DCO Activities ...................................................................................... 27

G. Review Area: Complaints............................................................................................. 29

H. Review Area: Post-Employment................................................................................... 30

VI. CONCLUSION ................................................................................................................... 32
2015 Section 15E Examinations Summary Report Page 2

I. REGULATORY AND NRSRO OVERVIEW

This report summarizes the examinations conducted by staff from the U.S. Securities and 

Exchange Commission (the “Staff”) under Section 15E(p)(3) of the Securities Exchange Act of 

1934 (“Exchange Act”).1 This is a report of the Staff and, as such, reflects solely the Staff’s 

views. The U.S. Securities and Exchange Commission (“Commission”) is making this Staff 

report public as required by Section 15E(p)(3)(C) of the Exchange Act.

A. Statutory Framework and Rules

On September 29, 2006, President George W. Bush signed into law the Credit Rating Agency 

Reform Act of 2006 (the “Rating Agency Act”).

2

Section 4 of the Rating Agency Act added 

Section 15E to the Exchange Act (“Section 15E”), which provided authority for the Commission 

to implement registration, recordkeeping, financial reporting, and oversight rules with respect to

those credit rating agencies that register with the Commission as nationally recognized statistical 

rating organizations (“NRSROs”). The Rating Agency Act also amended Section 17 of the 

Exchange Act to provide the Commission with recordkeeping, reporting, and examination 

authority over registered NRSROs.3 Significantly, Section 15E(c)(2) expressly prohibits the 

Commission from regulating “the substance of credit ratings.”

4

In 2007, the Commission implemented the NRSRO registration and oversight program created 

by the Rating Agency Act by adopting Rules 17g-1 through 17g-6 and Form NRSRO.5 Pursuant 

to these rules, registered NRSROs must, among other things, make certain public disclosures, 

make and retain certain records, furnish certain financial reports to the Commission, establish 

and enforce procedures to manage the handling of material non-public information (“MNPI”), 

and disclose and manage conflicts of interest. These rules also prohibit an NRSRO from having 

certain conflicts of interest and engaging in certain unfair, coercive, or abusive practices. The 

Commission amended several of these rules in February 2009 and December 2009 with the goals

of further increasing the transparency of NRSRO rating methodologies; strengthening the 

disclosures of rating performance; prohibiting NRSROs from engaging in certain unfair, 

coercive, or abusive practices; and enhancing NRSRO record keeping.

6

 

1

15 U.S.C. § 78o-7(p)(3)(C). Unless otherwise noted, all Section and Rule references in this report are to 

the Exchange Act and rules under the Exchange Act. See 15 U.S.C § 78o-7; 15 U.S.C. § 78q (a) & (b); 17 

CFR 240.17g-1 through 17g-10.

2 Credit Rating Agency Reform Act of 2006, Pub. L. No. 109-291, 120 Stat. 1327 (2006).

3

See Sections 17(a) and 17(b) of the Exchange Act.

4

15 U.S.C. § 78o-7(c)(2). 

5

See Oversight of Credit Rating Agencies Registered as Nationally Recognized Statistical Rating 

Organizations, Exchange Act Release No. 55857 (Jun. 5, 2007), 72 FR 33564 (Jun. 18, 2007). 

6

See Amendments to Rules for Nationally Recognized Statistical Rating Organizations, Exchange Act 

Release No. 59342 (Feb. 2, 2009), 74 FR 6456 (Feb. 9, 2009) and Amendments to Rules for Nationally 
2015 Section 15E Examinations Summary Report Page 3

On July 21, 2010, President Barack Obama signed into law the Dodd-Frank Wall Street Reform 

and Consumer Protection Act (the “Dodd-Frank Act”), which, among other things, amended 

Section 15E to enhance the regulation and oversight of NRSROs by imposing new reporting, 

disclosure, and examination requirements.7 The Dodd-Frank Act mandated the creation of the 

Office of Credit Ratings (“OCR”), which was established in June 2012 with the appointment of 

its Director, Thomas J. Butler. OCR is responsible for oversight of credit rating agencies 

registered with the Commission as NRSROs. 

The Dodd-Frank Act directed the Commission to adopt rules to implement a number of 

provisions related to NRSROs. In January 2011, the Commission adopted new Rule 17g-7.8 In 

August 2014, the Commission adopted new Rules 17g-8, 17g-9, and 17g-10 as well as Form 

ABS Due Diligence-15E, and amended Rules 17g-1 through 17g-3 and 17g-5 through 17g-7 as 

well as Form NRSRO.

9

These new and amended rules concern NRSROs’ internal control 

structures, credit rating methodologies, conflicts of interest relating to sales and marketing 

activities, look-back reviews, disclosure forms and certifications to accompany each credit 

rating, public disclosures of NRSRO credit rating performance statistics and credit rating 

histories, Asset-Backed Securities (“ABS”) third-party due diligence providers, and NRSRO 

standards of training, experience, and competence.

New Rule 17g-2(b)(12), which requires an NRSRO to retain records related to its internal control 

structure, took effect in November 2014. The Staff’s 2015 examination activities reviewed 

NRSROs’ compliance with Rule 17g-2(b)(12). Since most of the other new and amended rules 

took effect on June 15, 2015 (which is after the time period generally covered by the 2015 

examinations) the Staff’s 2015 examination activities did not review NRSROs’ compliance with

such new and amended rules. However, the Staff did assess all of the NRSROs’ plans to 

implement the new and amended rules by the June 15, 2015 effective date. This assessment 

generally included interviewing relevant NRSRO personnel and reviewing action plans or other 

documentation concerning each NRSRO’s progress in implementing the new rules. 

B. Registered NRSROs

In 2007, following the adoption of its first set of NRSRO rules, the Commission began granting 

registrations to credit rating agencies that applied to be registered as an NRSRO. A credit rating 

agency may apply to be registered with respect to one or more of the following five classes of 

 

Recognized Statistical Rating Organizations, Exchange Act Release No. 61050 (Nov. 23, 2009), 74 FR 

63832 (Dec. 4, 2009). 

7 The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 932, 124 Stat. 

1376, 1872-83 (2010).

8

See Disclosure for Asset-Backed Securities Required by Section 943 of the Dodd-Frank Wall Street 

Reform and Consumer Protection Act, Securities Act of 1933 Release No. 9175; Exchange Act Release 

No. 63741 (Jan. 20, 2011), 76 FR 4515 (Jan. 26, 2011). 

9

See Nationally Recognized Statistical Rating Organizations; Final Rule, Exchange Act Release No. 72936 

(Aug. 27, 2014); 79 FR 55078 (Sept. 15, 2014).
2015 Section 15E Examinations Summary Report Page 4

credit ratings: (1) financial institutions, brokers, or dealers (“financial institutions”); (2) 

insurance companies; (3) corporate issuers; (4) issuers of ABS; and (5) issuers of government 

securities, municipal securities, or securities issued by a foreign government (“government 

securities”).10 

The ten credit rating agencies registered as NRSROs as of December 1, 2015, and dates of their 

initial registrations are listed below:

NRSRO11 Date of Registration

A.M. Best Company, Inc. (“AMB”) September 24, 2007

DBRS, Inc. (“DBRS”) September 24, 2007

Egan-Jones Ratings Company (“EJR”) December 21, 2007

Fitch Ratings, Inc. (“Fitch”) September 24, 2007

HR Ratings de México, S.A. de C.V. (“HR”) November 5, 2012

Japan Credit Rating Agency, Ltd. (“JCR”) September 24, 2007

Kroll Bond Rating Agency, Inc. (“KBRA”)12 February 11, 2008

Moody’s Investors Service, Inc. (“Moody’s”) September 24, 2007

Morningstar Credit Ratings, LLC (“Morningstar”)13 June 23, 2008

Standard & Poor’s Ratings Services (“S&P”) September 24, 2007

More information on NRSRO registration applications and the state of competition, 

transparency, and conflicts of interest among NRSROs is included in the Annual Report to 

Congress under Section 6 of the Rating Agency Act, available on the Commission’s website: 

http://www.sec.gov/ocr.

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW

A. Examinations under Section 15E(p)(3)

Generally, the purpose of NRSRO examinations is to monitor compliance with federal securities 

laws and rules, identify conduct or insufficient policies and procedures or internal controls that 

potentially violate such laws and rules, and encourage remedial action. Examinations also serve 

to inform the Commission and the NRSROs’ compliance personnel of regulatory obligations and 

 

10 See Section 3(a)(62)(A) of the Exchange Act.

11

 Orders granting registration can be found at: http://www.sec.gov/ocr. Paragraph (i) of Rule 17g-1 requires

an NRSRO to make its current Form NRSRO and Exhibits 1 through 9 to Form NRSRO publicly available 

on its website, or through another comparable, readily accessible means within 10 business days after the 

date the Commission grants an initial application for registration as an NRSRO or registration for an 

additional class of credit ratings, and within 10 business days after updating its registration, furnishing its 

annual certification, or withdrawing from registration.

12 Formerly known as LACE Financial Corp.

13 Formerly known as Realpoint LLC.
2015 Section 15E Examinations Summary Report Page 5

noteworthy industry developments. If the examination staff identifies potential violations of 

federal securities laws or rules, the Staff may refer the matter to the Commission’s Division of 

Enforcement (“Enforcement”), which is responsible for further investigation of these potential 

violations. 

Section 15E(p)(3)(A) requires OCR to conduct an examination of each NRSRO at least annually. 

Section 15E(p)(3)(B) provides that the examination shall include a review of the following eight 

topic areas (“Section 15E Review Areas”): (i) whether the NRSRO conducts business in 

accordance with its policies, procedures, and rating methodologies; (ii) the management of 

conflicts of interest by the NRSRO; (iii) the implementation of ethics policies by the NRSRO; 

(iv) the internal supervisory controls of the NRSRO; (v) the governance of the NRSRO; (vi) the 

activities of the designated compliance officer (“DCO”) of the NRSRO; (vii) the processing of 

complaints by the NRSRO; and (viii) the policies of the NRSRO governing the post-employment 

activities of its former personnel.

Section 15E(p)(3)(C) requires the Commission to make publicly available an annual report 

summarizing: (i) the essential findings of all Section 15E examinations, as deemed appropriate 

by the Commission; (ii) the NRSROs’ responses to any material regulatory deficiencies 

identified by the Commission; and (iii) whether the NRSROs have appropriately addressed the 

recommendations of the Commission contained in previous annual reports on examinations.

B. Examination Overview

The 2015 examinations generally focused on the NRSROs’ activities for the period covering 

January 1, 2014 through December 31, 2014 (the “Review Period”). The examinations also 

reviewed certain activities or credit rating actions from outside the Review Period.

The 2015 examinations reviewed the Section 15E Review Areas and examined how each 

NRSRO adhered to Section 15E and Rules 17g-1 through 17g-7. Each of the NRSRO 

examinations was based upon an individualized risk assessment by the Staff that determined

areas of emphasis and issues of focus for that NRSRO within the Section 15E Review Areas. 

Thus, the 2015 examinations reviewed each of the Section 15E Review Areas while also being 

tailored to each NRSRO’s specific risk profile. The individualized risk assessments took into 

account a number of factors, including the NRSRO’s credit rating activities and operations, the 

Staff’s findings, recommendations, and other observations from prior examinations, the impact 

of a potential or actual internal control or compliance failure by the NRSRO, recent industry 

developments affecting NRSROs and the asset classes in which the NRSRO is registered, the 

NRSRO’s filings with the Commission and public disclosures, the NRSRO’s self-identified 

weaknesses, and relevant tips, complaints, and referrals (“TCRs”) received by the Commission. 

Several of the Staff’s findings and recommendations from the 2015 examinations directly 

resulted from TCRs.

The 2015 examinations also focused on certain subjects and activities that the Staff identified as

relevant to multiple NRSROs, as summarized in this paragraph. First, the Staff conducted indepth reviews of multiple NRSROs’ policies, procedures, and practices regarding quantitative 

models used in the rating process. The Staff assessed whether these NRSROs had sufficient 

policies and procedures, controls, and frameworks for the development, review, testing, and 
2015 Section 15E Examinations Summary Report Page 6

validation of quantitative models. The Staff also assessed whether these NRSROs applied such 

quantitative models in the rating process consistently with their policies and procedures, 

methodologies, and criteria. Second, building on work performed during the 2014 exams, the 

Staff reviewed multiple NRSROs’ policies and procedures, controls, and documentation related 

to Information Technology (“IT”) and cybersecurity. Third, the Staff reviewed third-party 

vendors’ and non-NRSRO affiliates’ involvement in determining, issuing, or contributing to the 

NRSROs’ credit ratings or credit rating process. Any findings by the Staff concerning models, IT 

and cybersecurity, and third-party vendors or non-NRSRO affiliates are addressed in this Report 

in the Sections concerning the relevant Review Areas.

For purposes of this Report only, we will refer to Fitch, Moody’s, and S&P as larger NRSROs 

and the seven other NRSROs (AMB, DBRS, EJR, HR, JCR, KBRA, and Morningstar) as smaller 

NRSROs. 

III. SETTLED ADMINISTRATIVE ENFORCEMENT PROCEEDINGS

In January 2015, the Commission issued three orders instituting settled administrative 

proceedings against S&P and making findings.

14

 In the first settlement, the Commission charged 

S&P with making affirmative misrepresentations in its ratings publications for six conduit-fusion 

Commercial Mortgage-Backed Securities (“CMBS”) concerning the methodology applied to 

determine the ratings for these securities. S&P consented to the entry of the Commission order 

and admitted to certain underlying facts in the Commission order, but neither admitted nor

denied the findings therein. S&P also entered into similar settlements with two State Attorneys 

General concerning these securities. The second Commission settlement involved charges that 

S&P published an article that contained false and misleading statements concerning the 

conservative nature of its revised criteria for U.S. conduit-fusion CMBS, in an attempt by S&P to 

enhance its market share of U.S. conduit-fusion CMBS ratings. In the third settlement, the 

Commission charged that S&P improperly changed assumptions to its Residential MortgageBacked Securities (“RMBS”) surveillance methodology, which had the effect of making S&P’s 

RMBS surveillance ratings less conservative, without fully disclosing these changes. S&P 

consented to the entry of the Commission orders for the second and third settlements without 

admitting or denying the findings therein.

These orders found that S&P violated Section 17(a)(1) of the Securities Act, as well as Section 

15E(c)(3)(A) and Rules 17g-2(a)(2)(iii) and 17g-2(a)(6) of the Exchange Act. The Commission 

obtained several types of relief as a result of these settlements. First, S&P paid the Commission 

more than $58 million in civil money penalties, disgorgement, and pre-judgment interest. 

Second, S&P was censured. Third, the Commission obtained orders that S&P cease-and-desist 

from violating the aforementioned securities laws and regulations. Finally, S&P agreed to 

various undertakings. These undertakings include a one-year timeout from certain activities 

related to U.S. conduit-fusion CMBS, including marketing and rating of new issuances. The 

 

14 SEC Announces Charges Against Standard & Poor’s for Fraudulent Ratings Misconduct, Release No. 

2015-10 (Jan. 21, 2015); In the Matter of Standard & Poor’s Rating Services, Exchange Act Release Nos. 

74102, 74103, and 74104 (Jan. 21, 2015).
2015 Section 15E Examinations Summary Report Page 7

undertakings also required S&P to withdraw and, where applicable, revise certain rating criteria 

and the article concerning U.S. conduit-fusion CMBS. S&P also agreed to extensive measures to 

improve its internal controls related to RMBS surveillance and rating criteria generally, and to 

adopt, implement, and maintain policies, procedures, practices, and internal controls that address 

all of the recommendations from OCR Staff’s 2014 annual examination. As required by these 

settled orders, S&P provided to the Staff certifications and a report under penalty of perjury 

confirming that it completed these undertakings. OCR Staff worked closely with Enforcement 

on these matters, including monitoring S&P’s compliance with these undertakings. 

In October 2015, the Commission issued an order instituting settled administrative proceedings 

against DBRS and making findings.

15

 The Commission charged that between April 2009 and 

early 2012, DBRS did not conduct surveillance of its outstanding ratings of U.S. RMBS and resecuritized real estate mortgage investment conduits (“Re-REMICs”) consistent with its 

published methodology and Form NRSRO filings and did not disclose material changes to that 

surveillance methodology in its Form NRSRO filings. The Commission also charged that DBRS 

did not maintain adequate financial and managerial resources to conduct surveillance of U.S. 

RMBS and Re-REMIC ratings pursuant to its published methodology. Finally, the Commission 

charged that DBRS did not make and retain a record of the rationale for material differences 

between the ratings implied by its quantitative model and the final credit ratings it issued for a 

substantial number of its U.S. RMBS and Re-REMIC surveillance ratings. DBRS consented to 

the entry of the Commission order without admitting or denying the findings therein.

This order found that DBRS violated Sections 15E(b)(1), 15E(b)(2), 15E(c)(3)(A), 15E(d)(1)(E), 

and 17(a) of the Exchange Act, and Rules 17g-1(e), 17g-1(f), and 17g-2(a)(2)(iii) of the 

Exchange Act. The Commission obtained several types of relief as a result of this settlement. 

First, DBRS paid the Commission approximately $5.8 million in civil money penalty, 

disgorgement, and pre-judgment interest. Second, DBRS was censured. Third, the Commission 

obtained an order that DBRS cease-and-desist from violating the aforementioned securities laws 

and regulations. Finally, DBRS agreed to certain undertakings, including a requirement that 

DBRS retain an independent consultant not unacceptable to OCR and Enforcement. The 

independent consultant will audit certain of DBRS’s U.S. RMBS and ABS methodologies to 

determine whether DBRS is issuing ratings in accordance with those methodologies and will 

review DBRS’s compliance program and other specified aspects of DBRS’s operations and 

internal controls. Based on its audit and review, the independent consultant will make written 

recommendations for improvement to DBRS. DBRS must implement the independent 

consultant’s recommendations or agreed-upon alternatives within a specified timeframe. 

Enforcement initiated its investigation of DBRS following an annual examination of DBRS by 

the Staff. OCR Staff worked closely with Enforcement on this matter, and expects to continue to 

work with Enforcement to monitor DBRS’s compliance with these undertakings. 

 

15 SEC Charges Credit Rating Agency With Misrepresenting Surveillance Methodology, Release No. 2015-

246 (Oct. 26, 2015); In the Matter of DBRS, Inc., Exchange Act Release No. 76261 (Oct. 26, 2015).
2015 Section 15E Examinations Summary Report Page 8

IV. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

REPORTS

The Staff’s determination that an NRSRO appropriately addressed a recommendation does not 

constitute its endorsement of that NRSRO or its policies, procedures, internal controls, or 

operations. In a future examination, the Staff may reevaluate the NRSRO’s response to 

recommendations that it previously deemed to be appropriately addressed by, for example,

checking whether the NRSRO fully implemented remedial measures and whether those remedial 

measures appear to be effective. The Staff may also review and make recommendations 

concerning the NRSRO’s policies, procedures, internal controls, or operations related to the 

general subject matter of a recommendation that it previously deemed to be appropriately 

addressed. The assessment of whether an NRSRO appropriately addressed a recommendation 

reflects solely the Staff’s view and does not necessarily reflect the views of the Commission. 

The Staff’s assessment of whether an NRSRO has appropriately addressed a recommendation 

depends on the specific facts and circumstances of each recommendation, including the 

promptness of the NRSRO’s response, the severity of the conduct at issue, and whether the 

remedial action undertaken by the NRSRO is expected to fully resolve the Staff’s concerns. To 

assess whether NRSROs appropriately addressed findings from the 2014 examinations, the Staff 

reviewed each NRSRO’s written submissions that responded to the Staff’s findings and 

recommendations and described its planned remedial measures, and participated in follow-up 

calls in 2014 with each NRSRO to discuss its written submission. During the 2015

examinations, the Staff assessed each NRSRO’s progress in implementing remedial measures 

and tested the existence and effectiveness of such measures where possible. 

A. Recommendations Not Appropriately Addressed

Based on the Staff’s 2015 examinations, the Staff has determined that one smaller NRSRO did 

not appropriately address certain recommendations from the Staff’s previous examinations. 

This smaller NRSRO did not appropriately address two recommendations from the Staff’s 2014 

examination. The first recommendation that this NRSRO did not appropriately address concerns 

rating committee members’ application of its rating methodology. Notably, the Staff made

another finding and certain recommendations in the 2015 examination concerning this NRSRO’s 

rating committee members’ unfamiliarity with and non-adherence to the relevant rating 

methodology. This finding and recommendation from the 2015 examination is discussed further 

in Section V.D.2 of this Report. Second, the Staff recommended during the 2014 examination 

that this NRSRO collect annual disclosures from its Board members concerning their outside 

business activities and potential conflicts of interest and inform the Board members of their 

obligations concerning outside business activities and potential conflicts. As discussed further in 

Section V.E.2 of this Report, in the 2015 examination, the Staff found that this NRSRO did not 

collect such annual disclosures and did not sufficiently inform certain Board members of these 

obligations, and made recommendations that this NRSRO take such measures.

Moreover, during the 2015 examination, the Staff determined this smaller NRSRO had not 

appropriately addressed certain recommendations that the Staff had made in connection with 

examinations conducted prior to 2014. The Staff had previously concluded that this NRSRO 
2015 Section 15E Examinations Summary Report Page 9

appropriately addressed these recommendations from pre-2014 examinations because this 

NRSRO represented to the Staff that it would implement responsive remedial measures and took 

initial steps to implement them. The Staff planned to assess this NRSRO’s progress in fully 

implementing these remedial measures and test the existence and effectiveness of these measures 

in future examinations. 

Specifically, during the 2015 examination, the Staff determined that this smaller NRSRO had not 

made sufficient progress in implementing these remedial measures. In addition, the Staff found, 

in connection with its rating file reviews, focus on quantitative models, and other testing it 

conducted in connection with the 2015 examination, that certain remedial steps this NRSRO had 

previously taken had not been maintained or were ineffective. To illustrate, while this NRSRO 

wrote policies and procedures intended to respond to some of these pre-2014 recommendations,

the Staff found significant instances of non-adherence to these policies and procedures and found 

that the NRSRO lacked sufficient controls to ensure such adherence. One pre-2014 

recommendation that this NRSRO did not appropriately address concerned adhering to policies 

covering its management of conflicts of interest related to ancillary services that are offered by 

this NRSRO’s affiliate, as discussed in Section V.B.4. of this Report. Other pre-2014 

recommendations that this NRSRO did not appropriately address concerned this NRSRO’s

determining and documenting analytical justifications for changes to inputs of quantitative

models that it uses in the rating process and differences between the ratings implied by such

models and the final ratings assigned, as discussed in Section V.D.1. of this Report.

The Staff will follow-up concerning its recommendations from the 2014 examination and 

previous examinations that this NRSRO failed to appropriately address, as well as its related 

recommendations from the 2015 examination.

Regarding the other nine NRSROs, the Staff has determined that all recommendations from the 

2014 exam have been appropriately addressed. The NRSROs addressed the 2014

recommendations by taking remedial measures such as adopting new or enhancing existing 

policies or procedures, enhancing or implementing new internal controls, implementing new 

systems and processes, and adding compliance personnel and resources. 

B. Notable Improvements

Since the Section 15E examinations began in 2010, all of the NRSROs have taken measures 

intended to increase their understanding of their obligations as regulated entities. In addition, at 

many of the NRSROs, improvements that were initiated or implemented in previous years have 

been further integrated into their operations and culture or continue to be enhanced. For 

example, several NRSROs that previously implemented electronic systems to facilitate steps in 

the rating process or enhance recordkeeping and monitoring activities continue to evaluate the 

effectiveness of these systems and implement updates intended to improve their performance. 

During the 2015 examinations, the Staff observed improvements at some of the NRSROs. A few 

NRSROs made adherence to their rating policies and procedures, code of conduct, and 

compliance rules a tangible component of their employees’ performance evaluations, 

promotions, and compensation. Additionally, a few NRSROs displayed a greater awareness of 

risk-management issues and devoted additional personnel or other resources to risk-management 
2015 Section 15E Examinations Summary Report Page 10

issues. Finally, some NRSROs self-reported certain incidents to the Staff, and a few NRSROs 

initiated remedial measures soon after the Staff first brought an issue to their attention during an

examination rather than initiating responses only after receipt of the Staff’s exam summary letter.

Such self-reporting of incidents and greater activity in responding to issues raised by the Staff

are indicative of improvements in these NRSROs’ compliance cultures.

The Staff’s observations of these improvements do not constitute its endorsement of any NRSRO

or its particular policies, procedures, internal controls, or operations. The Staff may continue to 

evaluate and test the sufficiency of some of these NRSROs’ improvements in future 

examinations, and may make findings and recommendations related to these improvements as

appropriate.

V. SUMMARY OF ESSENTIAL FINDINGS

Section 15E(p)(3)(C)(i) requires this Report to contain a summary of the essential findings of the 

annual examinations, as deemed appropriate by the Commission.

For purposes of this Report, “essential findings” are all findings from the 2015 examinations that 

were included with one or more recommendations in an exam summary letter sent to an NRSRO. 

“Essential findings” do not include the Staff’s general observations that are not included in an 

exam summary letter. In this Report, essential findings are organized by the applicable Section 

15E Review Areas. This Report uses the phrases “substantial,” “significant,” “numerous,” 

“multiple,” “several,” “some,” and “a few” to describe and distinguish the frequency of conduct 

or instances underlying certain findings. The particular phrase used reflects directionally the 

number of instances during the Review Period, recognizing that the number of instances may be 

reflective of a test sample and not necessarily an NRSRO’s full activities during the Review 

Period. The Commission has not determined whether any finding discussed in this Report 

constitutes a “material regulatory deficiency,” but may do so in the future. 

In the following Sections of this Report, the numbered headers identify in general terms the 

Staff’s findings concerning one or more NRSROs, and the paragraph(s) following each 

numbered header provide additional detail concerning these findings and the Staff’s 

corresponding recommendations.

A. Review Area: Adherence to Policies, Procedures, and Methodologies 

Section 15E and Commission rules require that NRSROs maintain and enforce various written 

policies and procedures. Section 15E(c)(3)(A) requires NRSROs to establish, maintain, enforce, 

and document an effective internal control structure governing the implementation of and 

adherence to policies, procedures, and methodologies for determining credit ratings. Rule 17g2(a)(6) requires an NRSRO to make and retain a record documenting its established procedures 

and methodologies used to determine credit ratings. A general description of the procedures and 

methodologies the NRSRO uses to determine credit ratings must be included in Exhibit 2 to 

Form NRSRO.
2015 Section 15E Examinations Summary Report Page 11

Section 17(a) and Rule 17g-2(a) requires an NRSRO to make and retain, and Rule 17g-2(b) 

requires an NRSRO to retain, certain records, including information concerning each rating it 

issues. For example, Rule 17g-2(a)(2)(i) and (ii) require NRSROs to make and retain records of 

the identity of any analysts that participated in determining the credit rating and the identity of 

the persons that approved the credit rating before it was issued. Rule 17g-2(a)(2)(iii) requires, 

where a quantitative model is a substantial component in an NRSRO’s process of determining 

ABS credit ratings, that the NRSRO make and retain a record of the rationale for any material 

difference between the rating implied by the model and the final credit rating issued. Rule 17g2(b)(2) requires an NRSRO to retain internal records and work papers used to form the basis of a 

rating it issues. Rule 17g-2(b)(7) requires an NRSRO to retain its external and internal 

communications, including electronic communications, related to initiating, determining, 

maintaining, monitoring, changing, or withdrawing a rating. 

The Staff reviewed ratings actions of each NRSRO for certain issuers to determine whether the 

NRSRO conducted business in accordance with its policies, procedures, methodologies, criteria, 

and models. In addition, the Staff reviewed NRSROs’ other ratings-related activities such as the

development and application of methodologies, criteria, and models. The Staff also reviewed

rating files and documentation of other ratings-related activities to evaluate whether each 

NRSRO adhered to recordkeeping requirements. To select rating files to review, the Staff used a 

risk-based sampling process that considered issues such as the significance of the rated asset 

class to the financial markets and the NRSRO’s business, the NRSRO’s activity in the rated asset 

class, the likelihood of harm if a rating was not determined in accordance with the NRSRO’s

methodologies and procedures, news reports and developments concerning NRSROs or 

particular asset classes, TCRs, and information the Staff learned during examinations. 

The Staff’s reviews of the Section 15E Review Areas included testing whether each NRSRO 

operated in accordance with its policies, procedures, and methodologies. The Staff’s essential 

findings regarding NRSROs conducting ratings-related activities in accordance with their

policies, procedures, methodologies, criteria, and models are discussed in this Section of this 

Report. The Staff’s essential findings regarding NRSROs’ adherence to policies and procedures 

related to other Review Areas are generally discussed in later Sections of this Report. Instances 

where policies, procedures, and methodologies need to be established or improved are also 

generally discussed in later Sections of this Report.

The Staff’s essential findings regarding whether each NRSRO has conducted its business in 

accordance with its policies, procedures, and methodologies are as follows:

1. On numerous occasions, two larger NRSROs and one smaller NRSRO failed to adhere to 

their ratings policies and procedures, methodologies, or criteria, or to properly apply quantitative 

models. 

One larger NRSRO did not code the quantitative model used for an initial rating of a structured 

finance transaction in a manner that reflected the actual terms of the transaction, and subsequent 

surveillance ratings of this transaction did not detect this coding mistake. When the mistake was 

detected, it resulted in a substantial downgrade of this transaction’s rating. This NRSRO also 

failed to apply certain assumptions required by its RMBS criteria to numerous ratings, and it 
2015 Section 15E Examinations Summary Report Page 12

mistakenly applied its methodology to surveillance ratings of certain other RMBS transactions, 

which resulted in several erroneous ratings. The Staff recommended that this NRSRO enhance 

its internal controls to ensure that it properly applies its methodologies. Also at this NRSRO, 

two ratings determinations made by rating committees were subsequently changed at the 

prompting of senior ratings personnel, which contravened this NRSRO’s policies and procedures 

governing the rating process and rating appeals and resulted in the misapplication of its criteria. 

The Staff recommended that this NRSRO ensure that all of its analysts and supervisors be made 

aware of and be properly trained regarding its code of conduct, policies, and procedures 

concerning the determination of ratings and independence of the rating process, and rating 

criteria.

Another larger NRSRO did not adhere to its internal policies and procedures and Rule 17g2(a)(2)(iii) by assigning several ratings that differed from the ratings implied by the quantitative 

model without properly documenting in rating committee materials the rationale for this

difference. The Staff recommended that this NRSRO ensure it adheres to all applicable record 

retention requirements. In addition, when reviewing certain financial institutions ratings, this 

NRSRO did not adhere to its internal policies and procedures concerning withdrawals of ratings, 

the process for issuers to appeal ratings, and communicating with an issuer concerning the 

withdrawal and appeal processes. The Staff recommended that this NRSRO strengthen its 

internal controls over the rating appeal and withdrawal processes and ensure it adheres to its 

internal policies and procedures concerning rating publications.

At one smaller NRSRO, there were numerous instances where analysts did not process monthly 

data concerning particular transactions, in contravention of its surveillance criteria. The Staff 

recommended that this NRSRO take measures to ensure that its analysts adhere to its policies 

and procedures concerning the credit rating process.

2. Two larger NRSROs and one smaller NRSRO did not always adhere to some of their 

policies and procedures concerning review and revision of methodology, criteria, and models.

One larger NRSRO did not adequately disclose, consider, and document a material component of 

its revised methodology before it approved that methodology, as required by its policies and 

procedures. Another larger NRSRO did not review a substantial portion of its quantitative rating 

models on an annual basis as required by its policies and procedures. One smaller NRSRO did 

not prepare and retain the records required by its policies and procedures in connection with its 

approval of two rating methodologies. The Staff recommended that these three NRSROs ensure 

they adhere to all of their policies and procedures concerning the development, review, revision, 

and/or approval of methodologies, criteria, and models.

3. Two larger NRSROs and one smaller NRSRO did not adhere on multiple occasions to

their policies and procedures for ratings publications or correction of errors in ratings 

publications.
2015 Section 15E Examinations Summary Report Page 13

Analysts at one larger NRSRO learned of errors in a substantial number of third-party models 

that it had used to determine outstanding ratings but did not analyze the impact of these errors on 

the ratings or inform appropriate personnel as required by its policies and procedures. Also at 

this NRSRO, the Staff found instances where substantive statements in its rating publications 

directly contradicted substantive statements in its internal rating records. The Staff 

recommended that this NRSRO ensure that its rating publications are accurate, adhere to its error 

correction policies and procedures, and review the specific ratings where the Staff identified 

discrepancies and correct any errors.

Analytical personnel at another larger NRSRO noticed an error in calculations used to determine 

certain surveillance ratings, but subsequent rating publications did not disclose that error or its 

ratings implications. This NRSRO also made inaccurate disclosures regarding the methodology 

it used to determine some of its ratings. The Staff recommended that this larger NRSRO ensure 

that all analytical personnel be made aware of and adhere to its error correction policies and 

procedures and code of conduct provisions concerning transparent disclosure. The Staff also 

recommended that this larger NRSRO ensure that rating publications reference the actual 

published methodologies it applied. A substantial number of a smaller NRSRO’s rating

publications referenced unapproved methodologies or did not correctly reference all of the 

methodologies it applied to those ratings. The Staff recommended that this smaller NRSRO 

adhere to its policies and procedures and enhance its internal control structure concerning 

publication of ratings.

4. One larger NRSRO and one smaller NRSRO did not always adhere to their IT policies 

and procedures concerning access, updates, and use of third-party vendors.

A larger NRSRO updated one of its rating databases without obtaining the documentation or 

approval required by its IT policies and procedures, which resulted in a significant number of 

outstanding ratings being inadvertently withdrawn. Also, this NRSRO did not adhere to its 

policies and procedures concerning use of third-party vendors when attempting to update an IT 

program, which temporarily made that program inaccessible. The Staff recommended that this 

NRSRO ensure it adheres to its policies and procedures for updating its IT systems and enhance 

its oversight of third-party IT vendors that it has engaged. 

A smaller NRSRO updated its IT policies and procedures without the approval of all required 

personnel. In addition, this NRSRO did not adhere to its policies and procedures concerning 

personnel’s access to certain internet databases. The Staff recommended that this NRSRO

ensure that it adheres to its approval process when updating its IT policies and procedures, and 

adhere to or modify its policies and procedures for accessing these internet databases.

5. Certain rating files and rating publications of two larger NRSROs and three smaller 

NRSROs did not adhere to document retention requirements and other operational policies and 

procedures related to determining or reviewing ratings.
2015 Section 15E Examinations Summary Report Page 14

At one larger NRSRO, several rating files were missing required documents and information or 

contained inaccurate information, including notifications to issuers, the purpose of the rating 

committee, and references to applicable policies, procedures, and criteria. At another larger 

NRSRO, some rating files were missing required documents, including communications with the 

issuer and the inputs to quantitative models used to determine the rating of structured finance 

securities. At one smaller NRSRO, several rating files were missing required documents and 

information concerning the analysis performed, documents referenced, or conflicts of interest 

checks. At another smaller NRSRO, multiple rating files did not contain a record of the 

personnel who participated in determining the rating or who approved the rating. At a third

smaller NRSRO, some rating files were missing required documents, including rating committee 

minutes. 

The Staff recommended that these five NRSROs take various remedial measures to ensure they 

comply with Rule 17g-2 and their internal policies and procedures concerning the creation and 

retention of records and other operational procedures related to their determination of ratings.

B. Review Area: Management of Conflicts of Interest 

Section 15E(h)(1) requires an NRSRO to establish, maintain, and enforce written policies and 

procedures reasonably designed to address and manage conflicts of interest. Rule 17g-5(b)

identifies certain types of conflicts that an NRSRO must disclose in Exhibit 6 to Form NRSRO 

and establish, maintain, and enforce written policies and procedures to address and manage such 

conflicts. The NRSRO’s written policies and procedures to address and manage these conflicts 

must be disclosed in Exhibit 7 to Form NRSRO. For example, Rules 17g-5(b)(1) and (2) 

concern the conflicts related to being paid by issuers, underwriters, or obligors to determine 

ratings with respect to securities that they issue or underwrite or on which they are the obligor. 

Similarly, Rule 17g-5(b)(9) concerns the conflict related to issuing or maintaining a rating for 

certain securities or instruments that was paid for by the security’s issuer, sponsor, or 

underwriter. Rule 17g-5(c) lists certain conflicts that are strictly prohibited. For example, Rule 

17g-5(c)(6) prohibits an NRSRO from issuing a rating where the fee paid for the rating was 

negotiated, discussed, or arranged by a person within the NRSRO who had responsibility for 

determining ratings or for developing or approving procedures, methodologies, or models used to 

determine ratings. 

The Staff’s essential findings regarding the management of conflicts of interest are as follows:

1. One larger NRSRO and three smaller NRSROs did not have sufficient policies,

procedures, and controls to manage the issuer-paid conflict or to prevent analytical personnel’s 

access to fee or market-share information. 

One larger NRSRO had written policies and procedures requiring the periodic rotation of 

analysts responsible for working on the ratings of particular issuers in order to manage the 

issuer-paid conflict of interest. Although exemptions to these policies and procedures were 

required to be authorized in writing by a specified senior officer, an analytical supervisor (who 

was not authorized to grant such an exemption) at this NRSRO suspended analyst rotation for 
2015 Section 15E Examinations Summary Report Page 15

several months for a substantial number of ratings in an asset-class without obtaining the 

required written exemption. The Staff recommended that this NRSRO enhance its internal 

controls to ensure that all personnel adhere to this policy. In addition, a senior officer of this 

NRSRO violated its policies and procedures by sending emails to analytical and criteriadevelopment personnel concerning an issuer’s decision to terminate its rating in response to 

revisions by this NRSRO to its criteria. The Staff recommended that this NRSRO ensure that all 

of its personnel be made sufficiently aware of and comply with their responsibilities to manage 

conflicts of interest.

At one smaller NRSRO, there were several occasions where a senior analyst sent emails 

containing fee information to clients or potential clients, and some analytical personnel may have 

engaged in sales and marketing activities. At another smaller NRSRO, there were numerous 

instances where analytical personnel received fee information by email, and this smaller NRSRO 

did not have sufficient policies and procedures for handling instances of analysts’ exposure to fee 

information. At a third smaller NRSRO, the workspace for one of the NRSRO’s senior officers, 

whose responsibilities include the NRSRO’s financial performance, was located in the analysts’ 

work area. The Staff recommended that these three smaller NRSROs enhance their policies,

procedures, and controls to separate the analytical function from the sales and marketing function 

and to prevent inappropriate access to fee information. The Staff also recommended that one of 

these smaller NRSROs review whether its analysts engaged in improper sales and marketing 

activity and report any such incidences to the Staff.

 

2. At one larger NRSRO, there were not sufficient policies and procedures to prevent 

prohibited unfair, coercive, or abusive practices, and this larger NRSRO’s decision to issue an 

unsolicited rating of an issuer was motivated at least in part by market-share considerations. 

Rules 17g-6(a)(1) through (a)(4) prohibit an NRSRO from engaging in certain unfair, coercive, 

or abusive practices. For example, Rule 17g-6(a)(2) prohibits an NRSRO from issuing, or 

offering or threatening to issue, a credit rating that is not determined in accordance with its 

established procedures and methodologies, based on whether the entity that would be subject to 

the rating or an affiliate of this entity pays for or will pay for the credit rating or any other service 

by the NRSRO or an affiliate of the NRSRO. 

One larger NRSRO lacked written policies and procedures to prevent the conduct prohibited by 

Rule 17g-6. This larger NRSRO also lacked sufficient written policies and procedures 

concerning the issuance of unsolicited credit ratings. The Staff reviewed this larger NRSRO’s 

unsolicited rating of an issuer. The Staff’s efforts included reviewing the NRSRO’s rating file 

and emails concerning this rating, and interviewing analytical and sales personnel who were 

involved in the decision to rate this issuer or in determining this rating. During its review, the 

Staff identified emails among sales personnel suggesting that the NRSRO issue an unsolicited 

rating of this issuer for market-share considerations; these emails are inconsistent with this larger 

NRSRO’s code of conduct, yet the personnel who received these emails did not report them as 

required by its code. The Staff also identified other emails between a sales employee and 

analytical managers and senior management related to this larger NRSRO’s unsolicited rating of 

this issuer.
2015 Section 15E Examinations Summary Report Page 16

The Staff recommended that this larger NRSRO establish, maintain, enforce, and document 

written policies and procedures that govern its issuance of unsolicited ratings, and that prohibit 

all of the conduct covered by Rule 17g-6. The Staff also recommended that this NRSRO

adequately enforce its code of conduct and ensure that analytical personnel’s conduct is not 

influenced by commercial considerations. Finally, the Staff recommended that this NRSRO 

enhance its monitoring of internal communications for compliance with its policies and 

procedures and enhance training regarding its code of conduct and associated reporting 

requirements.

3. There were some weaknesses in one larger NRSRO’s and one smaller NRSRO’s

monitoring, investigation, or disclosure of conflicts of interest. 

There was more than one instance where one larger NRSRO did not timely investigate, evaluate 

the rating impact of, and disclose that an analyst who participated in determining certain credit 

ratings should have been recused due to a conflict of interest. Also, this larger NRSRO’s log for 

tracking violations did not include all violations and was not sufficiently detailed concerning the 

review and resolution of violations. The Staff recommended that this larger NRSRO enhance 

and adhere to its policies and procedures for investigating and disclosing conflicts of interest, 

and that it ensure that its log for tracking violations contains accurate and complete information. 

One smaller NRSRO lacked policies and procedures for the review of conflict of interest 

attestations submitted by its employees. The Staff recommended that this smaller NRSRO 

establish, maintain, enforce, and document policies and procedures and effective internal 

controls concerning the compilation, review, and retention of such attestation responses.

4. Four smaller NRSROs did not have sufficient policies, procedures, or controls regarding 

certain conflicts of interest or did not sufficiently disclose such conflicts of interest. 

Pursuant to Rule 17g-5(b)(3), it is a conflict of interest for an NRSRO to be paid for other related 

services in addition to determining credit ratings by issuers, underwriters, or obligors that have 

paid the NRSRO to determine a credit rating. Pursuant to Rule 17g-5(b)(7), it is a conflict of 

interest for persons within the NRSRO to have a business relationship that is more than an arm’s 

length ordinary course of business relationship with issuers or obligors subject to a credit rating 

determined by the NRSRO.

One smaller NRSRO did not have sufficient policies and procedures and controls to manage the 

conflict of interest posed by ancillary services that were offered by this NRSRO’s affiliate. The 

Staff identified several instances at this NRSRO where senior rating analysts participated in 

activities related to these ancillary services or received information concerning these ancillary 

services, in contravention of its code of conduct. The Staff recommended that this smaller 

NRSRO enhance its policies and procedures and controls to manage this conflict of interest. 

Another smaller NRSRO did not have written policies and procedures to manage conflicts of 

interest related to its owners’ other business interests. The Staff recommended that this NRSRO 
2015 Section 15E Examinations Summary Report Page 17

establish, maintain, and enforce written policies and procedures to manage this conflict of 

interest. A third smaller NRSRO did not sufficiently disclose in Exhibit 6 of Form NRSRO the 

existence of the conflict that is covered by Rule 17g-5(b)(7), and the Staff recommended that this 

NRSRO amend its disclosure in Exhibit 6.

A fourth smaller NRSRO did not have or disclose sufficient policies and procedures to manage

certain conflicts that it identified in Exhibit 6 of Form NRSRO, including the conflicts identified 

in Rule 17g-5(b)(4) and 17g-5(b)(5) related to being paid for subscriptions to receive or access 

its credit ratings. The Staff recommended that this smaller NRSRO establish policies and 

procedures to address and manage all of its conflicts and disclose such policies and procedures in 

Exhibit 7 of its Form NRSRO. 

5. There were weaknesses in securities ownership policies and procedures and controls at 

one larger NRSRO and four smaller NRSROs. 

Pursuant to Rule 17g-5(b)(6), it is a conflict of interest if an NRSRO allows its personnel to 

directly own securities or money market instruments or have direct ownership interests in issuers 

or obligors subject to a credit rating determined by that NRSRO. Such ownership is permitted

provided an NRSRO discloses it in Exhibit 6 to Form NRSRO and has sufficient written policies 

and procedures to manage it. Rule 17g-5(c)(2) prohibits an NRSRO from issuing or maintaining 

a rating with respect to a person where the NRSRO or certain personnel that participated in 

determining or approving a rating directly owns securities of or has a direct ownership in the 

person that is subject to the rating. 

At one larger NRSRO, one analyst participated in determining numerous ratings where that 

analyst should have been recused due to that analyst’s securities holdings. The analyst reported 

these securities holdings to the NRSRO, but recusals were not created in the NRSRO’s existing 

systems. The Staff recommended that this larger NRSRO enhance its internal controls

concerning recusals, and ensure that all employees adhere to its securities ownership policies and 

procedures.

One smaller NRSRO did not timely update its list of securities or issuers that the NRSRO’s 

personnel are restricted from owning, and did not have written policies and procedures 

concerning its review of securities holdings of non-U.S. personnel. Another smaller NRSRO did 

not update its securities ownership restrictions to manage conflicts of interest related to all types

of securities that it rates. The Staff recommended that these smaller NRSROs ensure that their

securities ownership policies and procedures and restricted lists are updated and complete. 

A third smaller NRSRO did not monitor its analytical employees’ securities holdings as required 

by its policies and procedures, and did not have sufficient policies and procedures concerning 

non-analytical employees’ securities holdings. At a fourth smaller NRSRO, the scope of 

reporting and monitoring of employees’ securities ownership was insufficient. The Staff 

recommended that these smaller NRSROs enhance their policies, procedures, and internal 

controls related to their employees’ securities ownership.
2015 Section 15E Examinations Summary Report Page 18

C. Review Area: Implementation of Ethics Policies

Section 15E(a)(1)(B)(v) requires that an NRSRO’s application for registration include 

information regarding whether it has in effect a code of ethics, and if not, the reasons it did not

have a code of ethics. An NRSRO must provide a copy of its written code of ethics or a 

statement of the reasons it did not have such a code in Exhibit 5 to Form NRSRO. 

Each NRSRO has implemented written ethics policies and procedures. During the 2015

examinations, the Staff reviewed each NRSRO’s ethics policies and procedures, as well as a 

sample of each NRSRO’s employee certifications or monitoring activities concerning its code of 

ethics. Much of the content of these policies and procedures addresses other related Review 

Areas. As such, the Staff’s findings and recommendations related to an NRSRO’s implemented 

ethics policies and procedures are addressed in other Sections of this Report.

D. Review Area: Internal Supervisory Controls

As discussed above, Section 15E(c)(3)(A) requires that each NRSRO establish, maintain, 

enforce, and document an effective internal control structure governing the implementation of 

and adherence to policies, procedures, and methodologies for determining credit ratings. Also as 

discussed above, Rule 17g-2 requires an NRSRO to make and retain (in the case of Rule 17g2(a)), or to retain (in the case of Rule 17g-2(b)), certain records relating to the determination of 

particular ratings. In addition, Rule 17g-2(b)(5) requires an NRSRO to retain internal audit 

plans, internal audit reports, documents relating to internal audit follow-up measures, and all 

records identified by the NRSRO’s internal auditors as necessary to audit the NRSRO’s credit 

rating business. The Staff reviewed each NRSRO’s overall control structure, including the 

internal control structure related to determining credit ratings. 

Section 15E(g)(1) requires an NRSRO to establish, maintain, and enforce written policies and 

procedures reasonably designed to prevent the misuse of MNPI by the NRSRO or any person 

associated with the NRSRO. Rule 17g-4 provides that NRSROs must establish, maintain, and 

enforce written policies and procedures to prevent the misuse of MNPI. This Rule further 

provides that these procedures must be reasonably designed to prevent inappropriate 

dissemination of MNPI, including pending rating actions, both within and outside the NRSRO, 

and to prevent a person within the NRSRO from trading on MNPI. Rule 17g-4(a)(3) requires

written policies and procedures reasonably designed to prevent the inappropriate dissemination

of pending credit rating actions within and outside the NRSRO before issuing the rating on the 

Internet or through another readily accessible means. 

Section 15E(f)(2) prohibits any credit rating agency that is not registered as an NRSRO from 

stating that it is registered as an NRSRO.

The Staff’s essential findings regarding internal supervisory controls are as follows:

1. All three larger NRSROs and two smaller NRSROs lacked certain policies, procedures,

and internal controls concerning the development, review, or use of ratings methodologies, 

criteria, and models.
2015 Section 15E Examinations Summary Report Page 19

The Staff identified multiple weaknesses concerning one larger NRSRO’s development, review, 

and testing of criteria and models. First, when revising one of its rating criteria, this NRSRO’s

personnel did not consider all relevant information and factors as required by its policies and 

procedures for criteria revision, and it was unclear how this NRSRO planned to apply the revised 

criteria to existing ratings. Due to these procedural weaknesses, this NRSRO rescinded the 

revised criteria soon after publishing it. Also at this NRSRO, the instructions for revising an 

RMBS model that were provided to the model development team were not consistent with the 

applicable criteria, which resulted in the model being revised in a manner that did not reflect the 

criteria. Furthermore, this NRSRO did not adequately test quantitative models after they were 

developed, which resulted in its use on multiple occassions of models that did not conform to the 

corresponding criteria or otherwise contained errors. This NRSRO also lacked sufficient internal 

controls regarding the permissible application of models which had not been validated, and 

lacked policies and procedures regarding single-use models, which are models that are used for 

single transactions and specific to an issue or issuer. 

The Staff recommended that this larger NRSRO adopt and enforce internal controls to ensure 

that its criteria development processes consider all relevant information, and that it develop 

policies and procedures concerning the application of revised criteria. The Staff also 

recommended that this NRSRO establish and maintain effective internal controls, including 

policies and procedures, for the development, use, and testing of all quantitative models and for 

ensuring that quantitative models reflect the corresponding criteria.

One smaller NRSRO lacked sufficient policies and procedures concerning the analytical 

justification for changes it makes to inputs for quantitative rating models that it used for its 

ratings of multiple asset classes. This NRSRO did not adequately document such changes, and it 

appeared to lack analytical justification for such changes. Moreover, this NRSRO frequently 

assigned final ratings that differ from the rating implied by its rating models, and it typically did

not disclose or internally document the rationale for the difference between the rating assigned 

and the model-implied rating. The Staff recommended that this NRSRO establish, maintain, and 

enforce effective internal controls, including written policies and procedures, concerning model 

inputs and documenting the rationale for differences between the rating implied by its model and 

the final assigned rating. In addition, this smaller NRSRO did not respond to its own

recommendations resulting from its internal model testing. The Staff recommended that this 

NRSRO promptly take remedial action in response to these model testing recommendations and 

that it document its responses to such testing.

The Staff identified several weaknesses in another larger NRSRO’s policies, procedures, and 

internal controls regarding, and oversight of, quantitative models used in the rating process.

First, this NRSRO allowed models to be altered by a single model officer and did not require 

these alterations to be reviewed independently or by a rating committee. Second, this NRSRO 

allowed non-validated models to be used in the rating process with the sole approval of an 

analytical manager, and its internal controls for model version control, including logging of 

model alterations and versions, was insufficient. Third, this NRSRO did not have effective 

internal controls regarding the oversight of third parties that provide quantitative models it uses 

in the rating process. This NRSRO did not perform due diligence of, or request any information 

from, third-party model providers concerning their operations, quality assurance, or model 

verification, and did not have written policies and procedures to conduct such activities. Finally, 
2015 Section 15E Examinations Summary Report Page 20

this NRSRO did not have written policies and procedures concerning the development, review, 

and oversight of quantitative model inputs that it determines by statistical calculations. The Staff 

recommended that this NRSRO establish, maintain, enforce, and document policies, procedures,

and effective internal controls concerning models, model inputs, and oversight of third-party 

model providers. The Staff also recommended that this NRSRO enhance its model version 

control and model-related logs, and consider designating an independent employee or group to 

be responsible for model version control.

A third larger NRSRO lacked effective internal controls, including written policies and 

procedures, for the development and verification of reusable and single-use quantitative models, 

which were created by the analytical personnel responsible for determining or reviewing the 

rating and were not required to be reviewed by the NRSRO’s model verification group. Over the 

past few years, this larger NRSRO identified a substantial number of rating errors or potential 

errors where single-use models were applied. The Staff recommended that this NRSRO 

establish, maintain, enforce, and document an effective internal control structure, including 

written policies and procedures, concerning the development and verification of reusable and 

single-use quantitative models used in the credit rating process.

Another smaller NRSRO did not have written policies and procedures for the annual certification 

of methodologies, criteria, models, and rating guidelines. The Staff recommended that this 

smaller NRSRO establish, maintain, enforce, and document written policies and procedures 

concerning such annual certifications and requiring the retention of documentation of the 

analysis conducted for each certification.

2. There were weaknesses in two larger NRSROs’ and five smaller NRSROs’ policies and 

procedures or controls concerning the determination or review of ratings.

The rating committee of one smaller NRSRO did not exercise effective oversight over certain 

types of ratings issued by that NRSRO. This NRSRO had insufficient policies and procedures 

concerning rating committee review of certain rating actions. In addition, some of this NRSRO’s 

rating committee members appeared to lack sufficient expertise and independence to effectively 

review the rating actions taken by this NRSRO, and did not appear to be familiar with or to apply

the relevant methodology when reviewing rating actions. The Staff recommended that this 

NRSRO enhance its rating committee policies and procedures and ensure that its rating 

committee members have sufficient expertise, time, and independence to fulfill their 

responsibilities. 

At another smaller NRSRO, weaknesses in its surveillance processes resulted in this NRSRO 

posting erroneous ratings for numerous CMBS tranches and erroneously withdrawing ratings for 

a significant number of outstanding CMBS tranches. The Staff recommended that this smaller 

NRSRO enhance its internal controls over its surveillance process.

Employees of one larger NRSRO did not obtain managerial pre-approval for multiple exceptions 

to its rating policies, procedures, and criteria. This NRSRO also did not sufficiently log, 

monitor, and internally report information concerning these exceptions. The Staff recommended 

that this NRSRO enhance and adhere to its policies and procedures concerning exceptions. A
2015 Section 15E Examinations Summary Report Page 21

third smaller NRSRO permitted analysts to deviate from its methodologies when determining a 

particular rating but did not require the rating publication to disclose methodology deviations. 

Such non-disclosure of methodology deviations may limit the ability of users of credit ratings to 

understand this NRSRO’s ratings and assess whether it is adhering to its methodologies. The 

Staff recommended that this smaller NRSRO establish, maintain, enforce, and document policies 

and procedures for the disclosure of methodology deviations.

Another larger NRSRO did not clearly distinguish mandatory policies and procedures 

concerning the rating process from non-mandatory guidelines or best practices concerning the 

rating process, which is potentially confusing to its personnel. The Staff recommended that this 

NRSRO ensure that it clearly distinguishes mandatory responsibilities from non-mandatory 

guidelines, and that it enforce its mandatory policies and procedures. This NRSRO also did not 

sufficiently document its determination that a credit rating action is not necessary and that it can 

instead publish a credit opinion, which is only available to subscribers and did not involve the 

same processes as a rating action. In addition, this NRSRO did not appear to retain 

documentation related to its credit opinions as required by Rule 17g-2(b)(3). The Staff 

recommended that this NRSRO establish, maintain, and enforce written policies and procedures 

to document its determination whether or not a credit rating action is necessary and to retain 

records related to its credit opinions.

Another smaller NRSRO did not sufficiently document certain aspects of its handling of external 

or internal appeals, such as the circumstances where an appeal is appropriate and the timeframe 

for resolving an appeal. This smaller NRSRO also did not sufficiently distinguish 

methodologies, which must be applied when determining relevant ratings, from less formal 

rating guidelines. The Staff recommended that this smaller NRSRO enhance its policies and 

procedures for ratings appeals, and that it clarify internally and disclose the differences between 

methodologies and guidelines.

The methodology of another smaller NRSRO entailed base and stress case scenarios and 

financial projections, both of which used weighted averages of data. However, neither this 

methodology nor the publications for specific ratings where this methodology was applied stated 

the specific weighted averages used, and rating publications and rating committee presentations 

also did not state the analytical justifications for these weighted averages. Such non-disclosure 

or lack of documentation may make it difficult to understand the rating assigned and to assess 

whether this NRSRO followed its methodology. The Staff recommended that this NRSRO

establish parameters for determining weighted averages of data, enhance disclosures in its 

published methodology and rating publications concerning weighted averages, and document in 

its internal records the analytical justification for weighted averages it applies for particular 

ratings.

3. There were weaknesses in one larger NRSRO’s and five smaller NRSROs’ policies, 

procedures, and internal controls concerning publication of ratings and correction of ratings 

errors.
2015 Section 15E Examinations Summary Report Page 22

One larger NRSRO’s policies and procedures did not provide specific guidance to analysts

regarding the extent of detail to include in rating publications. The Staff observed a substantial 

number of this NRSRO’s rating publications where the rationale for rating changes was not 

clearly explained, including instances where ratings changes resulted from errors in models used 

to determine that rating and revisions to its criteria. In addition, this NRSRO’s error-correction 

policies and procedures did not require the NRSRO to perform a root-cause analysis of the error 

and determine if the error resulted from a violation of law or its policies and procedures. The 

Staff recommended that this NRSRO enhance its internal controls, including establishing written 

policies and procedures, concerning the response to credit rating model errors, and ensure that its 

public disclosures are transparent and sufficiently detailed.

In a few instances, one smaller NRSRO issued ratings in an asset class in which it was not

registered as an NRSRO without indicating in written materials provided to the issuer that it was 

not registered for this asset class. The Staff recommended that this NRSRO prominently 

disclose in writing its non-NRSRO status for any ratings it issues for an asset class in which it is 

not currently registered as an NRSRO. Another smaller NRSRO lacked written policies and 

procedures for correcting and disclosing errors in its ratings or rating publications and for fixing 

the root cause of such errors. This NRSRO also did not have written policies and procedures that 

address whether ratings which were determined with the participation of both NRSRO analysts 

and non-NRSRO analysts are deemed to be, and published as, NRSRO ratings. The Staff 

recommended that this NRSRO establish, maintain, document, and enforce policies and 

procedures for error correction, and for determining which of its ratings are deemed to be 

NRSRO ratings and published as such.

Another smaller NRSRO’s policies and procedures concerning when it would issue rating 

publications were unclear and inconsistent. For example, these policies and procedures 

contained conflicting or ambiguous statements regarding its surveillance of outstanding ratings

and the timing of its rating publications. In addition, this NRSRO’s policies and procedures 

concerning when it must issue a press release to explain certain rating actions were not 

sufficiently transparent. For example, this NRSRO’s policies and procedures did not require,

when it changes certain outstanding ratings due to an error, that it publish a press release or 

otherwise provide notice that these rating changes resulted from an error. The Staff 

recommended that this NRSRO ensure that its policies and procedures for disseminating ratings 

are clear and consistent, and that it enhance such policies and procedures to ensure sufficient 

public dissemination of information and transparency.

Two other smaller NRSROs did not have sufficient policies, procedures, and internal controls 

concerning issuers’ review of draft rating publications and issuers’ appeal of a rating. One of 

these NRSRO’s policies and procedures were unclear regarding the length of time an issuer has 

to appeal a rating and the timeframe for the NRSRO to publish a rating after it has been 

finalized. Moreover, this NRSRO did not have sufficient policies, procedures, and internal 

controls to ensure that issuers do not inappropriately influence the substance of a rating action or 

rating publication. Another smaller NRSRO’s policies and procedures did not require approval 

by an analytical supervisor before it sends a draft rating publication to an issuer for review. The 

Staff recommended that these two NRSROs establish or enhance policies and procedures and 

processes for issuers to review draft rating publications and appeal a rating, and for these

NRSROs to finalize ratings and rating publications, to ensure that MNPI is not misused or 
2015 Section 15E Examinations Summary Report Page 23

inappropriately disseminated. The Staff also recommended that one of these NRSROs establish 

internal controls to ensure that issuers do not inappropriately influence the substance of its rating 

publications.

4. Three smaller NRSROs had some weaknesses in their IT systems or oversight of thirdparty IT vendors.

IT and cybersecurity continue to be increasingly significant components of an NRSRO’s internal 

control structure, which is subject to the requirements of Section 15E(c)(3)(A), and facilitate an 

NRSRO’s timely issuance and monitoring of ratings with integrity. IT and cybersecurity policies 

and procedures and controls are also integral to an NRSRO’s compliance with Section 15E(g) 

and Rule 17g-4 concerning the protection of and prevention of the misuse or inappropriate 

dissemination of MNPI. They also often affect an NRSRO’s capacity to publish accurate ratings 

in a timely fashion and in compliance with Rule 17g-4(a)(3).

One smaller NRSRO’s policies and procedures concerning granting analysts permission to 

access client information were inconsistent and differed from its actual practices. This NRSRO 

also did not review access permissions to ensure they are appropriate and did not have sufficient 

controls to protect against inappropriate dissemination of MNPI through web-based email 

systems or external storage devices. Another smaller NRSRO had a number of IT 

vulnerabilities, including outdated or unsupported applications and cybersecurity software, 

programs that unnecessarily connect to the internet, and insufficient IT policies and procedures. 

The Staff recommended that these two NRSROs establish or enhance written IT policies and 

procedures to address the weaknesses identified by the Staff and enhance their testing, 

monitoring, and review of IT systems and processes.

A third smaller NRSRO did not periodically assess whether third-party vendors that provide IT 

services, such as operating its data center and maintaining its website. are complying with 

applicable confidentiality agreements and service-level agreements. The Staff recommended 

that this NRSRO establish, maintain, enforce, and document effective internal controls to 

exercise adequate oversight of third-party vendors.

5. The policies and procedures or internal control frameworks of one larger NRSRO and 

three smaller NRSROs did not satisfy all applicable statutory and rule requirements. 

One larger NRSRO’s and one smaller NRSRO’s policies and procedures did not satisfy all of the 

requirements of Section 15E and applicable Commission rules. For example, the larger NRSRO 

did not have a written policy and procedure to comply with Section 15E(u), which requires an 

NRSRO to report to appropriate law enforcement or regulatory authorities certain information 

that it finds credible alleging that an issuer of securities it rated has committed or is committing a 

material violation of law. The Staff recommended that these two NRSROs establish, maintain,

and enforce written policies and procedures that fully reflect the requirements of Section 15E and 

Commission rules. This smaller NRSRO and another smaller NRSRO also did not sufficiently 

document their internal control structure as required by Rule 17g-2(b)(12). These two smaller 
2015 Section 15E Examinations Summary Report Page 24

NRSROs’ policies and procedures and internal control framework documents were insufficiently 

detailed or out-of-date. The Staff recommended that these smaller NRSROs enhance and 

maintain up-to-date documentation of their internal control structures.

A third smaller NRSRO lacked effective internal controls with respect to implementing new and 

amended Commission rules. This NRSRO did not establish an action plan to implement these 

rules and its key personnel appeared insufficiently informed of these rules or their effective date. 

The Staff recommended that this NRSRO establish, maintain, enforce, and document policies, 

procedures, and effective internal controls for its implementation of all Commission rules 

applicable to NRSROs.

6. There were some deficiencies or inaccuracies in three smaller NRSROs’ and one larger 

NRSRO’s Form NRSRO filings.

Section 15E(a)(1)(B) requires an application for NRSRO registration to disclose certain 

information, including information concerning the rating agency’s performance measurement 

statistics and its procedures and methodologies to determine ratings. Section 15E(b) requires an 

NRSRO to file updates of, and an annual certification which includes a list of material changes 

related to, its Form NRSRO registration and the information therein. Rule 17g-1 also contains 

requirements concerning the initial application for NRSRO registration and updating NRSRO 

registration. Moreover, Section 15E(k) and Rule 17g-3 require an NRSRO to confidentially file 

with the Commission certified financial statements and certain other financial information.

One smaller NRSRO did not file its 2015 annual Form NRSRO certification directly with the 

Commission; rather, it sent its certification to a third party, which forwarded it to an office within

the Commission. In addition, in its last two annual Form NRSRO certifications, this smaller 

NRSRO has not provided the required list of material changes and has not filed with the 

Commission certain required financial information and accountant’s certification. The Staff 

recommended that this smaller NRSRO ensure that its annual Form NRSRO certifications are 

filed directly with the Commission, and that it establish, maintain, document, and enforce

adequate internal controls, including written procedures, to ensure the completeness and 

accuracy of its Form NRSRO filings and related exhibits. 

There were multiple deficiencies in the annual Form NRSRO certifications filed by one larger 

NRSRO in 2014 and 2015. Exhibit 1 of this larger NRSRO’s Form NRSRO filing did not 

provide a clear explanation of its performance statistics, and Exhibit 2 did not adequately 

describe its rating process for one asset class and did not describe its policy for determining 

whether to initiate an unsolicited rating. Another smaller NRSRO did not disclose in Exhibit 3 

of its Form NRSRO filings sufficient information regarding its policies and procedures for the 

protection of MNPI as required by the Form NRSRO Instructions. A third smaller NRSRO did 

not file its code of ethics and policies and procedures for managing conflicts of interest 

consistently with the Form NRSRO Instructions. The Staff recommended that these three

NRSROs ensure that their Form NRSRO filings are complete, accurate, and consistent with

applicable laws and Form NRSRO Instructions.
2015 Section 15E Examinations Summary Report Page 25

7. There were weaknesses in one larger NRSRO’s and one smaller NRSRO’s monitoring of 

the rating process or review of rating files. 

Some NRSROs periodically review a sample of their rating files to check for conflicts of interest 

and adherence to policies and procedures. This is a positive practice, but there were weaknesses 

in the rating file review activities of one larger NRSRO and one smaller NRSRO. 

One larger NRSRO did not have a systematic and independent method to evaluate whether rating 

policies and procedures and methodologies are adhered to and applied appropriately. The Staff 

recommended that this NRSRO conduct periodic independent reviews and testing to assess 

whether its personnel are adhering to all policies, procedures, and methodologies used in the 

rating process. In addition, this NRSRO did not sufficiently and timely resolve the majority of 

recommendations made in connection with its internal methodology reviews. The Staff 

recommended that this larger NRSRO establish, maintain, and enforce effective internal controls 

for monitoring and resolving concerns and findings identified in its methodology reviews.

One smaller NRSRO did not document a significant number of its rating file reviews. The Staff 

recommended that this NRSRO ensure that it produces and maintains sufficient documentation 

for all rating file reviews that it conducts.

E. Review Area: Governance

Section 15E(t) requires each NRSRO to have a board of directors or governing committee 

(hereinafter, collectively the “Board” or “Boards”) and establishes certain requirements 

concerning the composition and conduct of each NRSRO’s Board. Section 15E(t)(2)(A) requires 

that at least half of an NRSRO’s Board, but no fewer than two such members, must be 

independent of the NRSRO.

Section 15E(t)(3)(A) through (D) identifies four areas over which an NRSRO’s Board must 

exercise oversight. Section 15E(t)(3)(A) and (B) require an NRSRO’s Board to oversee the 

establishment, maintenance, and enforcement of policies and procedures for, respectively:

determining credit ratings, and addressing, managing, and disclosing conflicts of interest. 

Section 15E(t)(3)(D) requires an NRSRO’s Board to oversee the NRSRO’s compensation and 

promotion policies and practices. 

During the 2015 examinations, the Staff interviewed each NRSRO’s Board and reviewed 

minutes and other documentation related to the activities of each NRSRO’s Board. 

The Staff’s essential findings relating to the NRSROs’ compliance with the governance 

provisions of Section 15E(t) are as follows: 

1. One larger NRSRO and two smaller NRSROs had one or more directors who were

identified as independent but also served as directors of their non-NRSRO parent companies or 

affiliates. 
2015 Section 15E Examinations Summary Report Page 26

Section 15E(t)(2)(B)(i)(II) states that for a director to be considered independent, that director 

cannot, other than in his capacity as a member of the board of directors, be a person associated 

with the NRSRO or any affiliated company of the NRSRO. Section 3(a)(63) defines person 

associated with an NRSRO to include a director. 

At one larger NRSRO and two smaller NRSROs, one or more directors that the NRSROs 

identified as independent also served as directors of non-NRSRO parent companies or affiliates. 

By serving as directors on non-NRSRO parent companies or affiliates, these individuals 

constituted persons associated with the NRSRO and thus were not independent. The Staff 

recommended that these NRSROs ensure that their corporate governance structures meet the 

requirements of Section 15E(t), including that individuals serving as independent directors 

satisfy the independence requirements of Section 15E(t)(2). 

2. Three smaller NRSROs did not have sufficient controls related to independent directors’

outside activities and potential conflicts of interest.

One smaller NRSRO did not collect annual disclosures from its independent Board members 

concerning outside business activities and other potential conflicts of interest, and this NRSRO’s 

independent directors did not appear to be sufficiently aware of their responsibilities to report 

such activities and potential conflicts of interest. Another smaller NRSRO did not obtain 

periodic updates concerning independent Board members’ outside business activities, and thus 

cannot review such activities for conflicts of interest. Also, this NRSRO’s Board rules did not 

sufficiently prohibit participation by a member in all Board activities where that member might 

have a conflict of interest. A third smaller NRSRO did not thoroughly and timely review 

questionnaire responses provided by independent directors.

 

The Staff recommended that these three NRSROs enhance their monitoring of independent 

Board members’ outside business activities by receiving or thoroughly reviewing questionnaire 

responses provided by these members. The Staff also recommended that one of these NRSROs

ensure that its independent Board members are aware of their obligation to report outside 

business activities and other potential conflicts of interest, and that another of these NRSROs 

enhance its policies and procedures to ensure that conflict of interest rules and practices 

concerning its Board members are sufficient. 

3. Minutes of three smaller NRSROs’ Board meetings were inaccurate or insufficiently 

detailed to demonstrate the Board members were fulfilling all of their oversight responsibilities. 

One smaller NRSRO’s Board minutes did not contain sufficient detail concerning information 

the Board received or discussion the Board members had regarding a revised methodology, thus 

it was unclear if this Board performed the oversight required by Section 15E(t)(3)(C). Another 

smaller NRSRO’s Board minutes did not mention the NRSRO’s promotion policies and 

practices, thus it was unclear if this Board fully performed the oversight required by Section 

15E(t)(3)(D). At another smaller NRSRO, minutes of certain Board meetings did not 
2015 Section 15E Examinations Summary Report Page 27

sufficiently document the Board’s oversight related to conflicts of interest as required by Section 

15E(t)(3)(B) and did not accurately reflect meeting attendees. 

The Staff recommended that these three smaller NRSROs ensure that their Board minutes are 

accurate and demonstrate the Board’s sufficient performance of all of its 15E(t)(3) oversight

responsibilities. 

F. Review Area: DCO Activities

Section 15E(j)(1) requires each NRSRO to designate an individual responsible for administering 

policies and procedures established to prevent the misuse of MNPI and to manage conflicts of 

interest, and for ensuring compliance with the securities laws. Under Section 15E(j)(5), the 

DCO must submit an annual report to the NRSRO on the compliance of the NRSRO with the 

securities laws and the NRSRO’s policies and procedures, and the NRSRO must file the report 

with the Commission. Rule 17g-2(b)(4) requires an NRSRO to retain compliance reports and 

compliance exception reports. Sections 17(a) and 17(b) and Rule 17g-2(f) require an NRSRO to 

promptly furnish to the Commission or its representatives copies of required records, including 

English translations of those documents upon request.

Section 15E(j)(2)(A)(iii) prohibits an NRSRO’s DCO from performing marketing or sales 

functions. Pursuant to Section 15E(j)(4), the DCO’s compensation must not be linked to the 

NRSRO’s financial performance and must be arranged to ensure the DCO’s independence. 

The DCO role is a critical element to ensure an NRSRO’s compliance with securities laws. The 

DCO at each NRSRO should have sufficient resources, institutional support, and independence 

to effectively carry out the DCO’s statutory obligations. During the 2015 examinations, the Staff 

reviewed the role and activities of each NRSRO’s DCO and interviewed each DCO.

The Staff’s essential findings regarding DCOs are as follows:

1. The DCOs and Compliance departments of two larger NRSROs and three smaller 

NRSROs did not fulfill their responsibilities related to SEC examinations and other regulatory 

compliance responsibilities, and some of these NRSROs’ Compliance departments appeared to 

lack sufficient resources to fulfill these responsibilities.

One smaller NRSRO did not implement timely responses to two recommendations from the 

Staff’s 2014 examination. The first recommendation was that this NRSRO enhance its policies, 

procedures, and internal controls to ensure the accuracy and completeness of its Form NRSRO 

filings. The second recommendation was that this NRSRO enhance its access controls to 

sufficiently protect MNPI. This NRSRO’s written response to OCR Staff concerning the 2014 

examination stated that it would take measures to respond to these recommendations. However, 

this NRSRO did not take any steps to respond to these recommendations until several months 

later, and then did so only after the Staff inquired about its responses during the 2015 

examinations and after this NRSRO filed its 2015 annual Form NRSRO certification. The Staff 

recommended that this NRSRO dedicate adequate resources to respond to the Staff’s 
2015 Section 15E Examinations Summary Report Page 28

recommendations in a timely manner and track these recommendations and its responses to 

ensure its responses are timely and effective. 

At another smaller NRSRO, the number of compliance personnel and amount of resources 

devoted to compliance were not sufficient to meet the requirements of Section 15E(j) in light of 

the types and volume of its ratings activities. Furthermore, this NRSRO’s DCO appeared to 

have engaged in sales and marketing activities, which is prohibited by Section 15E(j)(2)(A)(iii). 

This NRSRO also repeatedly failed to make complete and timely productions in response to 

OCR Staff’s document requests as required by Sections 17(a) and 17(b) and Rule 17g-2(f). The 

Staff recommended that this NRSRO ensure that its compliance resources are sufficient, that its 

DCO did not perform prohibited sales and marketing functions, and that it promptly provides all 

requested documents to the Staff.

Two larger NRSROs and one smaller NRSRO failed to make complete and timely productions of 

documents requested by OCR Staff. Such documents included policies and procedures for 

determining ratings and handling complaints as well as records related to compliance 

investigations and reviews. The smaller NRSRO’s DCO did not appear to have the capacity to 

balance implementation of new and amended Commission rules with fulfilling exam-related 

responsibilities. The Staff recommended that these three NRSROs ensure that they fulfill all 

exam-related responsibilities, including the prompt production of complete records required by 

Sections 17(a) and 17(b) and Rule 17g-2(f).

2. Two smaller NRSROs and one larger NRSRO did not sufficiently monitor their 

personnel’s business email accounts to check for compliance violations.

One smaller NRSRO reviewed a sample of its personnel’s business emails only for inappropriate 

references to rating fees, but not for other conflicts of interest or for inappropriate dissemination 

of MNPI. The Staff found that at least one of this NRSRO’s analysts transmitted MNPI from a 

business email account to a personal email account. Another smaller NRSRO lacked policies 

and procedures prohibiting personnel from transmitting MNPI to their personal email accounts 

and did not monitor employee’s work email accounts for such conduct. The Staff found 

instances of this smaller NRSRO’s personnel transmitting MNPI to their personal email 

accounts. A larger NRSRO’s email monitoring system did not detect multiple emails that 

contained market-share information and were sent to analysts and personnel responsible for 

criteria development, which was prohibited by this NRSRO’s policies and procedures. The Staff 

recommended that these three NRSROs ensure that their email review activities and other 

internal controls, including policies and procedures, are sufficient to monitor for conflicts of 

interest and inappropriate dissemination of MNPI. 

3. The Staff identified other aspects of the compliance function that can be improved at 

three smaller NRSROs. 

One smaller NRSRO did not provide annual compliance training for all employees and did not 

provide sufficient compliance training for new employees, as required by its policies and 
2015 Section 15E Examinations Summary Report Page 29

procedures. The Staff recommended that this NRSRO conduct compliance training as required 

and keep a record of attendees to ensure all employees complete required compliance training. 

Two smaller NRSROs did not perform audits of their compliance departments. Periodic 

independent internal or external audits or reviews of an NRSRO’s compliance department may 

help NRSROs improve the effectiveness of their DCO and compliance department. The Staff 

recommended that these two NRSROs consider conducting periodic independent audits of their 

compliance department. One of these smaller NRSROs also did not have written policies, 

procedures, and schedules for its compliance monitoring activities. The Staff recommended that 

this NRSRO establish, maintain, enforce, and document such written policies, procedures, and 

schedules.

G. Review Area: Complaints

Section 15E(j)(3) requires an NRSRO’s DCO to establish procedures for the receipt, retention, 

and treatment of (A) complaints regarding credit ratings, models, methodologies, and compliance 

with the securities laws and the NRSRO’s policies and procedures developed under Section 15E; 

and (B) confidential, anonymous complaints by employees or users of credit ratings. Rule 17g2(b)(8) requires an NRSRO to retain any written communications received from persons not 

associated with the NRSRO that contain complaints about the performance of a credit analyst in 

initiating, determining, maintaining, monitoring, changing, or withdrawing a credit rating. Rule 

17g-2(c) requires that such communications be retained for a period of three years after the date 

the record is made or received. Rule 17g-2(d) concerns the manner of retention of records 

related to complaints. The Staff reviewed each NRSRO’s policies and procedures for 

complaints. The Staff requested a list from each NRSRO of complaints submitted to it during the 

Review Period, and tested the policies and procedures by reviewing the files of certain 

complaints submitted to the NRSRO. 

All the NRSROs have written policies and procedures to address complaints generally. The 

Staff’s essential findings regarding complaints are as follows:

1. There were various weaknesses in one larger NRSRO’s and four smaller NRSRO’s 

complaint policies and procedures or handling of some complaints.

One smaller NRSRO did not have policies and procedures for complaints by employees as 

required by Section 15E(j)(3)(B). Also, this NRSRO’s compliance personnel were not aware of 

the statutory requirements concerning complaints and the types of employee communications 

that should be treated as complaints. The definition of complaint in two other smaller NRSROs’

policies and procedures did not include complaints regarding models and methodologies and 

complaints regarding compliance with the securities laws or their policies and procedures, as 

required by Section 15E(j)(3)(A). One of these two other NRSROs also did not provide a 

sufficient process for third parties to submit anonymous complaints. The Staff recommended 

that these three NRSROs revise their written complaints policies and procedures, including their 

definitions of complaints, to satisfy the requirements of Section 15E(j)(3).
2015 Section 15E Examinations Summary Report Page 30

One larger NRSRO did not have sufficient policies and procedures for handling oral 

communications that may constitute complaints and a sufficient process for a third-party to 

submit an anonymous email complaint. The Staff recommended that this NRSRO enhance its 

written policies and procedures and public website to address these weaknesses. Also, under this

NRSRO’s current practice for developing and revising policies and procedures, complaint 

policies and procedures may be changed without the DCO’s approval. The Staff recommended 

that this larger NRSRO ensure the DCO’s involvement in developing and reviewing complaint 

policies and procedures as required by Section 15E(j)(3).

The Staff identified weaknesses in another smaller NRSRO’s retention of complaints, as well as 

its documentation of whether a communication constitutes a complaint and the resolution of 

complaints. The Staff recommended that this smaller NRSRO ensure that it documents and 

retains sufficient records of complaints.

H. Review Area: Post-Employment 

Section 15E(h)(4)(A) requires an NRSRO to establish, maintain, and enforce policies and 

procedures reasonably designed to ensure that the NRSRO will conduct a review where an 

employee of an entity subject to a credit rating of the NRSRO or an issuer, underwriter, or 

sponsor of a security or money market instrument subject to a credit rating of the NRSRO was 

employed by the NRSRO and participated in determining the NRSRO’s rating of that entity, 

issuer, underwriter, or sponsor during the one-year period preceding the date the NRSRO took an 

action with respect to the credit rating. Section 15E(h)(5) requires each NRSRO to report to the 

Commission any instance where the NRSRO knows or can reasonably be expected to know that 

certain specified persons who were associated with the NRSRO within the previous five years 

obtain employment with any obligor, issuer, underwriter, or sponsor of a security or money 

market instrument for which the organization issued a credit rating during the twelve-month 

period prior to such employment.

The Staff reviewed each NRSRO’s “look-back” policies and procedures to assess whether they 

satisfy the statutory requirements. The Staff also requested information from each NRSRO 

concerning personnel that departed the NRSRO during the Review Period, and in some instances 

tested, on a selected and randomized basis, documentation related to such personnel to assess 

whether the NRSRO adhered to its look-back policies and procedures and satisfied the statutory 

obligations with respect to such personnel. 

The Staff’s essential findings regarding NRSRO look-back policies and procedures are as 

follows:

1. Two larger NRSROs and three smaller NRSROs did not adhere to their look-back

policies and procedures or these NRSROs’ look-back policies, procedures, and controls need 

improvement. 

One larger NRSRO did not complete look-back reviews in all circumstances required by Section 

15E(h)(4) because internal systems that it used to determine if a look-back review was necessary 

did not identify all ratings-related activities and entities that may have required a look-back
2015 Section 15E Examinations Summary Report Page 31

review. This NRSRO also did not have sufficient documented policies and procedures for 

receiving, processing, and retaining information concerning former employees’ subsequent 

employers and did not take adequate proactive measures, such as social media searches, to 

identify the subsequent employer of former employees for the required five-year-period. The 

Staff recommended that this NRSRO ensure that its policies and procedures and systems are 

sufficient to satisfy the requirements of Sections 15E(h)(4) and 15E(h)(5).

One smaller NRSRO’s policies and procedures permitted reliance solely on information 

provided by the departing analyst concerning whether that departing analyst previously 

participated in determining a rating for the new employer. Another smaller NRSRO’s postemployment policies and procedures did not sufficiently explain when a look-back review is 

required, and the Staff observed instances of this NRSRO’s non-adherence to or inconsistent 

application of such policies and procedures. A third smaller NRSRO did not adequately 

document some of its post-employment activities, and its policies and procedures did not 

establish a timeframe for completing a look-back review. The Staff recommended that these

NRSROs enhance their look-back review policies and procedures to address these identified 

weaknesses and adhere to these policies and procedures. 

One larger NRSRO did not consistently and sufficiently document its determination of whether a 

particular employee’s departure requires a look-back and did not adequately train relevant 

personnel concerning its look-back review policies and procedures. The Staff recommended that 

this NRSRO enhance its documentation of look-back review determinations and consider 

providing mandatory training concerning its look-back policies and procedures.

2. One larger NRSRO’s and two smaller NRSROs’ post-employment policies and 

procedures did not meet all statutory requirements. 

One larger NRSRO’s policies and procedures as written may result in some instances where 

look-back reviews did not cover the entire required one-year time period. One smaller NRSRO’s 

policies and procedures did not require a look-back review where a former analyst obtains 

employment with an underwriter or sponsor of rated securities. This smaller NRSRO also did 

not adhere to its look-back policies and procedures concerning the time period covered by its 

post-employment reviews. Another smaller NRSRO did not track the post-employment history 

of some former analysts for a five-year period for purposes of filing employee transition reports 

with the Commission as required by Section 15E(h)(5). The Staff recommended that these three 

NRSROs ensure that their look-back policies and procedures comply with the requirements of 

Section 15E(h)(4)(A) and Section 15E(h)(5), respectively, and that one of these smaller NRSROs 

ensure it adheres to its look-back policies and procedures. 
2015 Section 15E Examinations Summary Report Page 32

VI. CONCLUSION

The Staff has identified findings and recommendations for the NRSROs. In future examinations, 

the Staff will continue to assess the NRSROs’ responses to recommendations from the 2015

examinations and previous examinations and further utilize and refine its risk assessment to 

review compliance with laws and regulations and to examine emerging risk areas. In addition, 

the Staff will modify the scope of its future examinations to include the new and amended 

Commission rules concerning NRSROs.