EXAM SUMMARY REPORT | 

 

OFFICE OF CREDIT RATINGS 

2020 

Summary 

Report 

ON 

COMMISSION STAFF’S 

EXAMINATIONS OF EACH 

NATIONALLY RECOGNIZED 

STATISTICAL RATING 

ORGANIZATION 

As Required by Section 15E(p)(3)(C) 

of the Securities Exchange Act of 1934 

December 2020 

i

U . S . S E C U R I T I E S A N D E X C H A N G E C O M M I S S I O N 
THIS IS A REPORT OF THE STAFF OF THE U.S. SECURITIES AND EXCHANGE COMMISSION. 

THE COMMISSION HAS EXPRESSED NO VIEW REGARDING THE ANALYSIS, FINDINGS, OR CONCLUSIONS CONTAINED HEREIN. 
Table of Contents

I. REGULATORY AND NRSRO OVERVIEW. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

 

A. Statutory Framework and Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

B. Registered NRSROs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

A. Examinations under Section 15E(p)(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

B. Examination Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

A. Responses to Recommendations from the 2019 Section 15E Examinations . . . . . . 9

B. Notable Improvements Over the Course of the Examinations . . . . . . . . . . . . . 10

A. Review Area: Adherence to Policies, Procedures, and Methodologies . . . . . . . . . 11

B. Review Area: Management of Conficts of Interest . . . . . . . . . . . . . . . . . . . . .14

C. Review Area: Implementation of Ethics Policies . . . . . . . . . . . . . . . . . . . . . .15

D. Review Area: Internal Supervisory Controls . . . . . . . . . . . . . . . . . . . . . . . . .15

E. Review Area: Governance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

F. Review Area: DCO Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

G. Review Area: Complaints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

H. Review Area: Post-Employment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW. . . . . . . . . . . . . . . 6

III. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS

EXAMINATIONS AND NOTABLE IMPROVEMENTS OVER THE COURSE

OF THE EXAMINATIONS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

IV. SUMMARY OF ESSENTIAL FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

V. CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

EXAM SUMMARY REPORT | i
 

I. Regulatory and NRSRO 

Overview 

This report (“Report”) summarizes the 

examinations conducted by staff from the 

U.S. Securities and Exchange Commission 

(the “Staff”) under Section 15E(p)(3) of 

the Securities Exchange Act of 1934 (“Exchange 

Act”).1 This is a report of the Staff and, as such, 

reflects solely the Staff’s views. The U.S. Securities 

and Exchange Commission (“Commission” or 

“SEC”) is making this Staff Report public as 

required by Section 15E(p)(3)(C) of the 

Exchange Act. 

A. STATUTORY FRAMEWORK 

AND RULES 

Section 15E of the Exchange Act (“Section 15E”) 

and Exchange Act Rules 17g-1 through 

17g-10 govern the registration and oversight 

program for credit rating agencies that are registered with the Commission as nationally recognized 

statistical rating organizations (“NRSROs”). This 

regulatory regime was established by the Credit 

Rating Agency Reform Act of 2006 (the “Rating 

Agency Act”)2

 and amended by the Dodd-Frank 

Wall Street Reform and Consumer Protection Act 

of 2010 (the “Dodd-Frank Act”).3 

The Dodd-Frank Act mandated the creation of 

the Office of Credit Ratings (“OCR”), which is 

responsible for oversight of credit rating agencies 

registered with the Commission as NRSROs. 

Pursuant to the Commission’s regulatory regime for 

NRSROs, an NRSRO is required to, among other 

things: 

§	File with the Commission annual certifications 

of its Form NRSRO registrations,4

 promptly 

update its filing in certain circumstances,5 and 

make its current Form NRSRO filing and most 

of its current Form NRSRO Exhibits available 

on its public website.6 

§	Disclose certain information, including 

information concerning the NRSRO’s 

performance measurement statistics and its 

procedures and methodologies to determine 

ratings.7 

1 Exchange Act Section 15E(p)(3)(C). Unless otherwise noted, all Section and Rule references in this report are to the Exchange Act 

and rules under the Exchange Act. 

2 Credit Rating Agency Reform Act of 2006, Pub. L. No. 109-291, 120 Stat. 1327 (2006). 

3 The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 932, 124 Stat. 1376, 1872-83 (2010). 

4 Exchange Act Section 15E(b)(2) and Exchange Act Rule 17g-1(f ). 

5 Exchange Act Section 15E(b)(1) and Exchange Act Rule 17g-1(e). 

6 Exchange Act Section 15E(a)(3) and Exchange Act Rule 17g-1(i). 

7 Exchange Act Section 15E(a)(1)(B)(i) and Exchange Act Section 15E(a)(1)(B)(ii). 

EXAM SUMMARY REPORT | 1
 

 

 

 

 

§	Establish, maintain, enforce, and document an 

effective internal control structure governing the 

implementation of and adherence to policies, 

procedures, and methodologies for determining 

credit ratings,8 and retain records of its internal 

control structure.9 

§	Consider certain factors with respect to its 

establishment, maintenance, enforcement, and 

documentation of an effective internal control 

structure.10 

§	File an unaudited report containing an 

assessment by management of the effectiveness 

during the fiscal year of the NRSRO’s internal 

control structure governing the implementation 

of and adherence to policies, procedures, and 

methodologies for determining credit ratings.11 

The report must be accompanied by a signed 

statement by the NRSRO’s chief executive officer 

or an individual performing similar functions.12 

§	Establish, maintain, enforce, and document 

policies and procedures reasonably designed to 

achieve certain objectives concerning its 

development and application of, and disclosures 

related to, methodologies and models.13 

§	Establish, maintain, enforce, and document 

policies and procedures that are reasonably 

designed to: assess the probability that an issuer 

of a security or money market instrument will 

default or fail to make required payments to 

investors,14 and ensure that it applies any rating 

symbol, number, or score in a manner that is 

consistent for all types of obligors, securities, 

and money market instruments for which the 

symbol, number, or score is used.15 

§	Publish an information disclosure form when 

taking a rating action with respect to a rating 

assigned to an obligor, security, or moneymarket instrument in a class for which it is 

registered as an NRSRO.16 The information 

form must disclose certain information with 

respect to the particular rating action.17 

In addition, the NRSRO must attach to 

the information disclosure form a signed 

statement by a person within the NRSRO with 

responsibility for the rating action.18 

8 Exchange Act Section 15E(c)(3)(A). 

9 Exchange Act Rule 17g-2(b)(12). 

10 See, e.g., Exchange Act Rule 17g-8(d)(1) through (4). 

11 Exchange Act Rule 17g-3(a)(7)(i). 

12 Exchange Act Rule 17g-3(b)(2). 

13 See, e.g., Exchange Act Rule 17g-8(a)(2) through (5). 

14 Exchange Act Rule 17g-8(b)(1). 

15 Exchange Act Rule 17g-8(b)(3). 

16 Exchange Act Rule 17g-7(a). Rule 17g-7(a) defines rating action to include an expected or preliminary rating, an initial rating, 

an upgrade or downgrade of an existing rating (including a downgrade to, or assignment of, default), and an affirmation or 

withdrawal of an existing rating if the affirmation or withdrawal is the result of the NRSRO’s review of the rating using applicable 

procedures and methodologies for determining credit ratings. Pursuant to Rule 17g-7(a)(3), an NRSRO is exempt from publishing 

an information disclosure form for a particular rating if: (i) the rated obligor or issuer of the rated security or money market 

instrument is not a U.S. person; and (ii) the NRSRO has a reasonable basis to conclude that: (A) with respect to any security 

or money market instrument issued by a rated obligor, all offers and sales by any issuer, sponsor, or underwriter linked to the 

security or money market instrument will occur outside the United States; or (B) with respect to a rated security or money market 

instrument, all offers and sales by any issuer, sponsor, or underwriter linked to a security or money market instrument will occur 

outside the United States. 

17 Exchange Act Rule 17g-7(a)(1)(ii)(A)-(N) specifies the information that must be disclosed in the information disclosure form. 

These required disclosures include: the version of the procedure or methodology used to determine the credit rating; disclosures 

concerning the uncertainty of the rating, including regarding the reliability, accuracy, quality, and accessibility of data related to 

the rating; a statement containing an overall assessment of the quality of information available and considered in determining the 

credit rating for the obligor, security, or money market instrument; and information on the sensitivity of the rating to assumptions 

made by the NRSRO. In addition, an NRSRO must attach to the information disclosure form any executed Form ABS Due 

Diligence-15E containing information about the security or money market instrument subject to the rating action that is received 

by the NRSRO or obtained by the NRSRO through a Rule 17g-5(a)(3) website. 

18 Exchange Act Rule 17g-7(a)(1)(iii). 

2 | OFFICE OF CREDIT RATINGS 
 

 

 

 

§	Make and retain, or retain, certain records, 

including a record documenting its established 

procedures and methodologies used to 

determine credit ratings19 and records related 

to its ratings.20 An NRSRO must promptly 

furnish to the Commission or its representatives 

copies of required records, including English 

translations of those records, upon request.21 

§	Establish, maintain, and enforce written policies 

and procedures reasonably designed to prevent 

the misuse of material non-public information 

(“MNPI”), including the inappropriate 

dissemination of MNPI both within and outside 

the NRSRO, the inappropriate trading of securities 

using MNPI by a person within the NRSRO, and 

the inappropriate dissemination of pending credit 

rating actions within and outside the NRSRO 

before issuing the rating on the Internet or through 

another readily accessible means.22 

§	Establish, maintain, and enforce written policies 

and procedures reasonably designed to address 

and manage conflicts of interest.23 Certain 

conflicts of interest are expressly prohibited,24 and 

for other types of conflicts of interest, the NRSRO 

must disclose the conflicts and have policies and 

procedures in place to manage them.25 

§	Refrain from engaging in specified unfair, 

coercive, or abusive practices.26 

§	Provide information on whether it has in effect a 

code of ethics, and if not, the reasons it does not 

have a code of ethics.27 

§	Establish procedures for the receipt, retention, 

and treatment of complaints regarding credit 

ratings, models, methodologies, and compliance 

with the securities laws and its policies and 

procedures developed under this regulatory 

regime, and of confidential, anonymous 

complaints.28 

§	Designate a compliance officer (the “DCO”) 

responsible for administering policies and 

procedures related to MNPI and conflicts 

of interest, ensuring compliance with the 

securities laws and regulations, and establishing 

procedures for handling complaints by 

employees or users of credit ratings.29 The DCO 

must submit an annual report to the NRSRO 

on the compliance of the NRSRO with the 

securities laws and the NRSRO’s policies and 

procedures, and the NRSRO must file the report 

with the Commission.30 

19 Exchange Act Rule 17g-2(a)(6). 

20 Exchange Act Rule 17g-2(a)(2)(i), (ii), and (iii); Exchange Act Rule 17g-2(b)(2) and (b)(7). The records that an NRSRO must make 

and retain, or retain, with respect to its ratings include the identity of certain persons who participated in determining or approving 

the rating, records used to form the basis of a rating, external and internal communications received or sent by the NRSRO and 

its employees related to a rating, and for ABS ratings, a record of the rationale for any material difference between the final rating 

assigned and the rating implied by a quantitative model that was a substantial component in determining the rating. 

21 Exchange Act Section 15E(a) and (b) and Exchange Act Rule 17g-2(f ). 

22 Exchange Act Section 15E(g) and Exchange Act Rule 17g-4. 

23 Exchange Act Section 15E(h) and Exchange Act Rule 17g-5. 

24 Exchange Act Rule 17g-5(c). 

25 Exchange Act Rule 17g-5(a)(1) and (a)(2); Exchange Act Rule 17g-5(b). Moreover, Exchange Act Rule 17g-5(a)(3) prohibits an 

NRSRO from having a conflict of interest related to a rating for a security or money market instrument issued by an asset pool or 

as part of any ABS transaction unless the NRSRO, among other things, maintains and provides access to a password-protected 

Internet Web site containing a list of each such security or money market instrument for which it is currently in the process of 

determining an initial credit rating, and obtains certain written representations from the issuer, sponsor, or underwriter of each 

such security or money market instrument. 

26 Exchange Act Rule 17g-6. 

27 Exchange Act Section 15E(a)(1)(B)(v). 

28 Exchange Act Section 15E(j)(3). 

29 Exchange Act Section 15E(j)(1) and (3). 

30 Exchange Act Section 15E(j)(5). 

EXAM SUMMARY REPORT | 3
 

 

§	Have a board of directors or similar governing 

body (collectively, the “Board”), certain of 

whose members must be independent from 

the NRSRO.31 An NRSRO’s Board, or 

members thereof, are responsible for exercising 

oversight of specified subjects related to the 

NRSRO’s rating business and for approving 

the procedures and methodologies, including 

qualitative and quantitative data and models, 

that the NRSRO uses to determine ratings.32 

§	Establish, maintain, enforce, and document 

standards of training, experience, and 

competence for the individuals it employs to 

participate in the determination of credit ratings 

that are reasonably designed to achieve the 

objective that the NRSRO produces accurate 

credit ratings, and retain a record of these 

standards.33 

§	Establish policies and procedures regarding 

post-employment activities of certain former 

personnel.34 

B. REGISTERED NRSROs 

In 2007, the Commission began granting registrations to credit rating agencies that applied to be 

registered as an NRSRO. Credit rating agencies 

seeking to register with the Commission as an 

NRSRO must file a completed application on Form 

NRSRO, including related Exhibits.35 A credit 

rating agency may apply to be registered with 

respect to one or more of the following five classes 

of credit ratings: 

i. Financial institutions, brokers, or dealers 

(“financial institutions”); 

ii. Insurance companies; 

iii. Corporate issuers; 

iv. Issuers of asset-backed securities (“ABS”); and 

v. Issuers of government securities, municipal 

securities, or securities issued by a foreign 

government (“government securities”).36 

31 Exchange Act Section 15E(t)(2). 

32 Exchange Act Section 15E(t)(3) and Exchange Act Rule 17g-8(a)(1). 

33 Exchange Act Rule 17g-9. 

34 Exchange Act Section 15E(h)(4) and (5); Exchange Act Rule 17g-8(c). 

35 Exchange Act Section 15E(a) and Exchange Act Rule 17g-1(a) and (b). 

36 Exchange Act Section 3(a)(62)(A). 

4 | OFFICE OF CREDIT RATINGS 
NRSRO Date of Initial Registration 

 

A.M. Best Rating Services, Inc. (“AMB”) September 24, 2007 

DBRS, Inc. (“DBRS”)37 September 24, 2007 

Egan-Jones Ratings Company (“EJR”) December 21, 2007 

Fitch Ratings, Inc. (“Fitch”) September 24, 2007 

HR Ratings de México, S.A. de C.V. (“HR”) November 5, 2012 

Japan Credit Rating Agency, Ltd. (“JCR”) September 24, 2007 

Kroll Bond Rating Agency, Inc. (“KBRA”) February 11, 2008 

Moody’s Investors Service, Inc. (“MIS”) September 24, 2007 

S&P Global Ratings (“S&P”) September 24, 2007 

The nine credit rating agencies registered as 

NRSROs as of November 30, 2020, and dates of 

their initial registrations, are listed above. More 

information on NRSRO registration applications 

and the state of competition, transparency, and 

conflicts of interest among NRSROs is included 

in the Annual Report to Congress under Section 6 

of the Rating Agency Act.38 

For purposes of this Report only, we refer to Fitch, 

MIS, and S&P as “larger NRSROs” and the six 

other NRSROs (AMB, DBRS, EJR, HR, JCR, 

and KBRA) as “smaller NRSROs.” 

37 On July 2, 2019, Morningstar, Inc., the parent company of Morningstar Credit Ratings, LLC (“MCR”), completed an acquisition 

of DBRS. On November 15, 2019, MCR furnished a notice of withdrawal from registration to the Commission (which became 

effective on December 30, 2019), and DBRS filed an update to Form NRSRO to add MCR as a credit rating affiliate. On 

November 23, 2020, DBRS filed an update to Form NRSRO to remove MCR as a credit rating affiliate. 

38 The annual reports can be found under “Summary Examination Reports” in the “Reports and Studies” section of the OCR 

webpage, available at https://www.sec.gov/ocr/ocr-reports-and-studies.html. 

EXAM SUMMARY REPORT | 5
 

II. Office of Credit Ratings and 

Examination Overview 

A. EXAMINATIONS UNDER SECTION 

15E(p)(3) 

Generally, the purpose of NRSRO examinations 

is to: 

§	Monitor compliance with applicable federal 

securities laws and rules; 

§	Identify conduct, insufficient policies and 

procedures, or ineffective internal controls that 

potentially violate such laws and rules; and 

§	Encourage remedial action. 

To facilitate such remedial action, the Staff sends 

each NRSRO an examination summary letter 

that identifies and explains its findings related 

to that NRSRO and recommends remedial 

measures. Examinations also serve to inform 

the Commission and the NRSROs’ compliance 

personnel of regulatory obligations and noteworthy 

industry developments. When appropriate, OCR 

staff may refer potential violations of the federal 

securities laws to the Commission’s Division of 

Enforcement for further investigation. The Division 

of Enforcement investigates potential violations of 

the federal securities laws and litigates the Commission’s enforcement actions. 

Section 15E(p)(3)(B) provides that each NRSRO 

examination shall include a review of the following 

eight topic areas (“Section 15E Review Areas”): 

i. Whether the NRSRO conducts business in accordance with its policies, procedures, and rating 

methodologies; 

ii. Management of conflicts of interest by the 

NRSRO; 

iii. Implementation of ethics policies by the NRSRO; 

iv. Internal supervisory controls of the NRSRO; 

v. Governance of the NRSRO; 

vi. Activities of the DCO of the NRSRO; 

vii. Processing of complaints by the NRSRO; and 

viii. Policies of the NRSRO governing the postemployment activities of its former staff. 

Section 15E(p)(3)(C) requires the Commission 

to make available to the public an annual report 

summarizing: 

i. Essential findings of all Section 15E 

examinations, as deemed appropriate by 

the Commission; 

ii. NRSROs’ responses to any material 

regulatory deficiencies identified by the 

Commission; and 

iii. Whether the NRSROs have appropriately 

addressed the recommendations of the 

Commission contained in previous annual 

reports on examinations. 

6 | OFFICE OF CREDIT RATINGS 
 

B. EXAMINATION OVERVIEW 

The 2020 Section 15E examinations generally 

focused on the NRSROs’ activities for the period 

covering January 1, 2019 through December 31, 

2019 (the “Review Period”). Examinations also 

reviewed certain activities or credit rating actions 

from outside the Review Period.39 

The 2020 Section 15E examinations reviewed the 

Section 15E Review Areas and examined each 

NRSRO’s adherence to Section 15E and Rules 

17g-1 through 17g-10. Each of the NRSRO 

examinations encompassed all of the statutorily 

required Section 15E Review Areas. Within each 

of the Section 15E Review Areas, the Staff determined areas of emphasis and issues of focus for 

each NRSRO based upon an NRSRO-specific 

risk assessment performed by the Staff, while also 

considering how to limit the amount of personal 

data collected in the examination process. The 

NRSRO-specific risk assessments considered a 

number of factors, including, but not limited to: 

§	NRSRO’s rating activities and operations; 

§	Staff’s findings, recommendations, and general 

observations from prior examinations; 

§	Impact of a potential or actual internal control 

or compliance failure by the NRSRO; 

§	Recent industry developments affecting 

NRSROs and the asset classes in which the 

NRSRO is registered; 

§	NRSRO’s filings with the Commission and 

public disclosures; 

§	NRSRO’s self-identified weaknesses; and 

§	Relevant TCRs received by the Commission. 

The 2020 Section 15E examinations also focused 

on certain subjects and activities that the Staff, 

through its general risk assessment process, 

identified as relevant to certain NRSROs, as 

summarized below. 

§	NRSRO Response to COVID-19: The Staff 

examined the effects of the pandemic on credit 

ratings and NRSROs. Specifically, the Staff 

reviewed: NRSRO methodology changes; 

changes to macro-economic forecasts and 

assumptions, including meeting with NRSRO 

senior economists; and business continuity plans 

and operational updates, including workflow 

decisions that NRSROs made. The Staff also 

examined certain NRSRO methodology 

deviations, including adherence to relevant 

policies and procedures, and rating files for 

NRSRO activities with respect to certain asset 

classes and rating changes, including rating 

downgrades from investment-grade to sub 

investment-grade, also known as “fallen angels.” 

§	ESG Factors and Products: Certain NRSROs 

consider environmental, social, and governance 

(“ESG”) factors in their credit rating analysis. 

The Staff examined whether such NRSROs 

incorporated ESG factors into methodologies or 

took any rating actions specifically on account 

of ESG factors, as well as sales and marketing 

practices and conflicts of interests that may arise 

in connection with the NRSROs’ ESG-related 

activities. 

§	Collateralized Loan Obligations (“CLOs”): The 

Staff examined certain NRSRO rating files of 

CLOs backed by broadly syndicated corporate 

loans and by loans to middle market companies 

for, among other things, adherence to relevant 

rating policies, procedures, and methodologies. 

39 For example, the Staff may review information relating to tips, complaints, and referrals (“TCRs”) in a current examination, even 

if the referenced activities occurred outside of the Review Period. 

EXAM SUMMARY REPORT | 7
 

§	Conflicts Associated with Investor-Paid 

Ratings: The Staff reviewed the scope of 

private and investor-paid ratings activity at 

certain NRSROs. As appropriate, the Staff also 

examined for potential conflicts of interests 

created as a result of investor-paid rating activity 

at such NRSROs. 

§	LIBOR Phase-Out: The Staff reviewed 

commentaries from NRSROs, and gathered 

information on regular calls with NRSROs, 

related to the pending LIBOR phase-out, 

including whether assumptions disclosed by 

NRSROs have changed and whether NRSROs 

have adjusted any relevant policies, procedures, 

and methodologies. The Staff also reviewed 

NRSRO surveillance processes in light of the 

LIBOR transition. 

§	Low-Investment Grade-Rated Corporates: The 

Staff examined certain NRSRO rating files 

for low-investment grade-rated corporates for, 

among other things, adherence to relevant rating 

policies, procedures, and methodologies. 

§	Potential Marketing Conflicts: The Staff 

examined relevant rating files and policies and 

procedures of NRSROs, including policies 

and procedures on the separation of sales 

and marketing from analytics. The Staff also 

reviewed internal compliance reports and had 

relevant discussions with compliance staff. 

8 | OFFICE OF CREDIT RATINGS 
 

III. Summary of Responses to 

Recommendations From Previous 

Examinations and Notable Improvements 

Over the Course of the Examinations 

A. RESPONSES TO 

RECOMMENDATIONS FROM THE 

2019 SECTION 15E EXAMINATIONS 

The Staff’s determination that an NRSRO 

appropriately addressed a recommendation does 

not constitute its endorsement of that NRSRO 

or its policies, procedures, internal controls, or 

operations. In a future examination, the Staff may 

reevaluate the NRSRO’s response to recommendations that it previously deemed to be appropriately 

addressed by, for example, assessing whether the 

NRSRO fully implemented remedial measures 

and whether those remedial measures appear 

to be effective. The Staff may also review and 

make recommendations concerning the NRSRO’s 

policies, procedures, internal controls, or operations related to the general subject matter of a 

recommendation that it previously deemed to be 

appropriately addressed. The determination of 

whether an NRSRO appropriately addressed a 

recommendation reflects solely the Staff’s view 

and does not necessarily reflect the views of the 

Commission. 

The Staff’s assessment of whether an NRSRO 

has appropriately addressed a recommendation 

depends on the specific facts and circumstances, 

including, but not limited to, the promptness of the 

NRSRO’s response, the severity of the conduct at 

issue, and whether the remedial action undertaken 

by the NRSRO is expected to fully resolve the Staff’s 

concerns. 

To assess whether NRSROs appropriately 

addressed findings from the 2019 Section 15E 

examinations, the Staff reviewed each NRSRO’s 

written response to the Staff’s examination 

summary letter describing its planned remedial 

measures, and participated in calls with each 

NRSRO to discuss its written response. 

During the 2020 Section 15E examinations, the 

Staff assessed each NRSRO’s progress in implementing remedial measures such as establishing 

new or enhancing existing policies or procedures 

or internal controls, or adding personnel and other 

resources in areas such as compliance, information 

technology, or analytics. In assessing the effectiveness of NRSROs’ remedial measures, the Staff 

is cognizant that NRSROs may not be able to 

fully implement remedial measures before the Staff 

commences its Section 15E examinations for the 

subsequent year, and the Staff may not be able to 

fully assess the effectiveness of these measures in its 

Section 15E examinations for that subsequent year. 

Based on the Staff’s 2020 Section 15E examinations, 

the Staff has determined that all recommendations from the 2019 Section 15E examinations 

have been appropriately addressed. In general, 

NRSROs addressed 2019 recommendations by 

taking remedial measures such as adopting new or 

enhancing existing policies or procedures, internal 

controls, or systems and processes, and by adding 

personnel and other resources. 

EXAM SUMMARY REPORT | 9
 

B. NOTABLE IMPROVEMENTS OVER 

THE COURSE OF THE EXAMINATIONS 

Since they were first conducted in 2010, the Staff’s 

Section 15E examinations have identified certain 

improvements at one or more of the NRSROs. 

Generally, NRSRO personnel at all levels of 

seniority and responsibility have continued to 

display greater awareness of applicable laws and 

their obligations as regulated entities. Moreover, the 

Staff’s summary reports covering the Section 15E 

examinations since 2012 mention specific improvements by certain NRSROs, and the NRSROs 

generally have maintained or augmented those 

improvements by further enhancing the measures 

undertaken and embedding them in their operations and culture. 

During the 2020 Section 15E examinations, the Staff 

observed that most NRSROs have continued to 

refine, as needed, and maintain, as appropriate, their 

policies, procedures, and controls related to NRSRO 

rules and the Staff’s recommendations from Section 

15E examinations. The Staff also observed that 

generally, most NRSROs’ personnel have continued 

to gain and display a better understanding of these 

rules and the NRSROs’ policies, procedures, and 

controls for implementing these rules. 

Additionally, the Staff observed that, in general, 

most NRSROs continue to improve their 

compliance monitoring and internal audit 

functions. In recent years, and continuing in the 

2020 Section 15E examinations, the Staff has 

observed that this improvement has resulted in 

a number of NRSROs becoming proactive in 

reporting to the Staff issues or potential issues 

of non-compliance with legal requirements or 

weaknesses in policies and procedures that could 

potentially lead to such non-compliance. 

10 | OFFICE OF CREDIT RATINGS 
 

 

IV. Summary of 

Essential Findings 

Section 15E(p)(3)(C)(i) requires this Report to 

contain a summary of the essential findings of the 

annual examinations, as deemed appropriate by 

the Commission. 

For purposes of this Report, “essential findings” are 

Staff findings from the 2020 Section 15E examinations and were included with one or more recommendations in an examination summary letter sent 

to an NRSRO. “Essential findings” do not include, 

for example, the Staff’s general observations. In this 

Report, essential findings are organized by the applicable Section 15E Review Areas. This Report uses the 

phrases “significant,” “numerous,” “several,”and 

“some” to describe and distinguish the frequency of 

conduct or instances underlying certain findings. The 

particular phrase used generally reflects the number 

of instances during the Review Period, recognizing 

that the number of instances may be reflective of a 

test sample and not necessarily an NRSRO’s comprehensive activities during the Review Period. The 

Commission has not determined whether any finding 

discussed in this Report constitutes a “material 

regulatory deficiency,”40 but may do so in the future. 

In the following Sections of this Report, the 

numbered headers identify in general terms the Staff’s 

findings concerning one or more NRSROs, and 

the paragraph(s) following each numbered header 

provide additional detail concerning these findings 

and the Staff’s corresponding recommendations. 

A. REVIEW AREA: ADHERENCE 

TO POLICIES, PROCEDURES, AND 

METHODOLOGIES 

The Staff reviewed a sample of rating actions of 

each NRSRO in certain asset classes for which it 

is registered and for certain issuers and obligors 

to determine whether the NRSRO operated in 

accordance with its policies, procedures, and 

rating methodologies. The Staff also reviewed a 

sample of rating files and documentation of other 

ratings-related activities to evaluate whether each 

NRSRO adhered to recordkeeping requirements. 

To select rating actions and rating files to review, 

the Staff used a risk-based sampling process that is 

consistent with its overall risk assessment approach 

described in this Report. The Staff also considered 

factors including, but not limited to, the size of 

the rated asset class in the financial markets and 

the NRSRO’s business, the NRSRO’s activity in 

the rated asset class, the likelihood of impact on 

investors if a rating was not determined in accordance with the NRSRO’s methodologies and procedures, news reports and developments concerning 

the NRSROs or particular asset classes, TCRs, and 

information the Staff learned during examinations. 

The Staff’s essential findings regarding NRSROs 

conducting ratings-related activities in accordance 

with their policies, procedures, and rating methodologies are discussed in this Section. The Staff’s 

40 Exchange Act Section 15E(p)(3)(C)(ii). 

EXAM SUMMARY REPORT | 11
 

essential findings regarding the NRSROs’ 

adherence to policies and procedures related to 

other Section 15E Review Areas are generally 

discussed in later Sections of this Report. Instances 

where policies, procedures, and rating methodologies need to be established or improved are also 

generally discussed in later Sections of this Report. 

The Staff’s essential findings regarding whether 

each NRSRO has conducted its business in accordance with its policies, procedures, and methodologies are as follows: 

1. An NRSRO did not appear to adhere 

to its policies and procedures related to 

analysts receiving gifts. 

A smaller NRSRO received a prohibited gift but 

did not send a notification regarding the prohibited 

nature of the gift to the sender of the gift, as the 

NRSRO’s policies and procedures require. The 

Staff recommended that the NRSRO adhere to 

such policies and procedures. 

2. An NRSRO did not appear to adhere to 

its policies and procedures related to 

processing and considering comments 

when revising rating methodologies. 

A larger NRSRO overlooked numerous external 

written comments that it received in response to 

published requests for comment on a materially 

changed methodology and did not consider those 

comments prior to implementing the methodology, 

as required by its policies and procedures. The Staff 

recommended that the NRSRO enhance its internal 

controls to ensure that it adheres to its policies 

and procedures for processing and considering 

comments when revising rating methodologies. 

3. Certain NRSROs did not appear to adhere 

to their policies and procedures related to 

documentation required in rating files. 

A smaller NRSRO’s documentation in its rating 

files pertaining to conflict of interest checks did 

not appear to adhere to the requirements in the 

NRSRO’s relevant policies and procedures. The 

Staff recommended that the NRSRO adhere to its 

policies and procedures for documenting conflict of 

interest checks in rating files. 

A smaller NRSRO did not retain exception 

memoranda used for some credit ratings in the 

relevant rating file, as the NRSRO’s policies and 

procedures require. The Staff recommended that 

the NRSRO enhance its internal controls, including 

policies and procedures, with respect to retaining 

and producing required rating file documents. 

4. An NRSRO did not appear to comply with 

the Rule 17g-7(a)(1)(ii)(J)(1) requirements 

or adhere to its policies and procedures 

related to the disclosure of an unsolicited 

credit rating. 

A larger NRSRO did not disclose that the NRSRO 

was not paid to determine an unsolicited rating in 

the related information disclosure form as required 

by Rule 17g-7(a)(1)(ii)(J)(1) and the NRSRO’s 

policies and procedures. The NRSRO also did 

not disclose on its website that such rating was 

unsolicited as required by the NRSRO’s policies 

and procedures. The Staff recommended that the 

NRSRO comply with Rule 17g-7(a)(1)(ii)(J)(1) and 

adhere to its policies and procedures related to the 

disclosure of unsolicited credit ratings. 

12 | OFFICE OF CREDIT RATINGS 
 

5. An NRSRO did not appear to adhere to 

its policies and procedures related to 

documenting internal investigations. 

A larger NRSRO’s outside counsel conducted an 

investigation in response to an allegation from 

a former employee of the NRSRO, but did not 

prepare a final written report as the NRSRO’s 

policies and procedures require. Instead, outside 

counsel delivered an oral report to the NRSRO. 

The Staff recommended that the NRSRO adhere to 

its policies and procedures related to documenting 

internal investigations. 

6. An NRSRO did not appear to make and 

retain accurate records or adhere to 

its policies and procedures related to 

unsolicited credit ratings. 

A smaller NRSRO took an unsolicited rating 

action, but did not appear to adhere to its policies 

and procedures for such action. Contrary to the 

NRSRO’s unsolicited credit ratings policies and 

procedures, the rating committee minutes erroneously indicated that the rating was solicited, and 

the rating press release erroneously stated that 

the rated entity participated in the rating process 

and that the NRSRO had access to the entity’s 

accounts and other internal documents. The Staff 

recommended that the NRSRO make and retain 

accurate records and adhere to its unsolicited 

credit ratings policies and procedures to ensure 

that it correctly discloses the solicitation status 

and level of the issuer’s participation. 

7. An NRSRO did not appear to enforce its 

policies and procedures when providing 

a draft presale report to an issuer. 

A smaller NRSRO’s policies and procedures 

provided for release of preliminary credit ratings 

to an issuer in a presale report, together with 

certain pre-publication information, after a 

primary analyst presents a recommendation to 

the relevant rating committee. However, the 

Staff found that a primary analyst sent to an 

issuer preliminary rating recommendations, 

together with an incomplete notice, in a draft 

presale report on the day before the relevant 

rating committee. The Staff recommended that 

the NRSRO enforce, and ensure that employees 

adhere to, the NRSRO’s policies and procedures 

when sending presale reports to an issuer. 

8. An NRSRO did not appear to adhere to its 

policies and procedures, or the rule requirements, related to the NRSRO promptly 

publishing on its website notice of a 

significant error identified in its credit rating 

procedures or methodologies that may 

result in a change to current credit ratings. 

A smaller NRSRO identified a calculation error in 

a model that led the NRSRO to review a significant 

number of outstanding ratings that the error 

potentially impacted. The NRSRO did not publish 

notice of the existence of the error on its website as 

required by Rule 17g-8(a)(4)(ii) and the NRSRO’s 

policies and procedures. The Staff recommended 

that the NRSRO adhere to its policies and procedures regarding Rule 17g-8(a)(4)(ii) and promptly 

publish notice of the existence of a significant error 

identified in a credit rating procedure or methodology that may result in a change to current credit 

ratings, in accordance with Rule 17g-8(a)(4)(ii). 

9. An NRSRO did not appear to adhere to 

its policies and procedures regarding 

documentation evidencing the delivery 

of indicative ratings. 

A smaller NRSRO’s analysts delivered an oral indicative credit rating to a client, which the NRSRO did 

not document in the relevant rating file, in violation 

of the NRSRO’s policies and procedures. The Staff 

recommended that the NRSRO retain documentation evidencing the issuance of indicative ratings, 

including oral communication, in accordance with 

its policies and procedures. 

EXAM SUMMARY REPORT | 13
 

10. An NRSRO’s adherence to its policies 

and procedures appeared to have 

weaknesses relating to Rule 17g-9(a) and 

the periodic testing requirements in Rule 

17g-9(c)(1). 

A smaller NRSRO did not appear to administer 

compliance testing to employees in several instances, 

or appropriate remedial training to an employee 

who failed a test, as the NRSRO’s policies and 

procedures require. The Staff recommended that 

the NRSRO adhere to its policies and procedures 

adopted to comply with the requirements in Rule 

17g-9(a) and Rule 17g-9(c)(1). 

B. REVIEW AREA: MANAGEMENT OF 

CONFLICTS OF INTEREST 

The Staff’s essential findings regarding the 

management of conflicts of interest are as follows: 

1. An NRSRO’s identified conflicts of interest 

relating to the issuance of credit ratings 

appeared to be inconsistent with the 

NRSRO’s policies and procedures to 

address and manage conflicts of interest. 

A smaller NRSRO identified a certain conflict of 

interest relating to the issuance of credit ratings in 

Form NRSRO Exhibit 6 and provided policies and 

procedures to address and manage that conflict of 

interest in Form NRSRO Exhibit 7. However, such 

policies and procedures did not apply with respect 

to private credit ratings. The Staff recommended 

that the NRSRO identify conflicts of interest 

relating to the issuance of private credit ratings 

consistently with the NRSRO’s policies and procedures to address and manage conflicts of interest. 

2. Certain NRSROs’ policies and procedures 

did not appear to be reasonably designed 

to address prohibited conflicts of interest. 

A smaller NRSRO’s policies and procedures 

appeared to permit the NRSRO to grant certain 

exceptions that would allow NRSRO personnel to 

engage in activities that Rule 17g-5(c)(7) and Rule 

17g-5(c)(8) prohibit. The Staff recommended that 

the NRSRO revise its policies and procedures to 

eliminate such weakness. 

A smaller NRSRO, despite the specified prohibition 

of Rule 17g-5(c)(8), had a person who participated 

in multiple capacities in determining credit ratings 

and developing and approving procedures and 

methodologies used for determining credit ratings. 

It also appeared that the person’s involvement in 

rating activities was accompanied by sales and 

marketing activities. The Staff recommended that 

the NRSRO establish, maintain, enforce, and 

document policies and procedures reasonably 

designed to ensure compliance with, and effective 

internal controls to identify and prevent, the conflict 

of interest described in Rule 17g-5(c)(8). 

3. An NRSRO did not appear to enforce its 

policies and procedures to address and 

manage the conflict of interest set forth 

in Rule 17g-5(b)(6), as required by Rule 

17g-5(a). 

A smaller NRSRO had, in some instances, missing 

or inconsistent documentation related to personal 

financial account statements for persons associated 

with the NRSRO, as required by the NRSRO’s 

policies and procedures. The Staff recommended 

that the NRSRO enforce its policies and procedures 

to address and manage the conflict of interest set 

forth in Rule 17g-5(b)(6). 

14 | OFFICE OF CREDIT RATINGS 
 

4. An NRSRO’s policies and procedures did 

not appear to be reasonably designed 

to detect and prevent the prohibited 

conflicts of interest identified in Rule 

17g-5(c)(6) and Rule 17g-5(c)(8). 

A smaller NRSRO’s policies and procedures 

appeared to have unclear and inconsistent procedures for addressing circumstances in which 

analysts are exposed to fee information, and, in 

fact, analysts were exposed to fee information in 

several instances. The Staff recommended that the 

NRSRO ensure that its policies and procedures 

are reasonably designed to detect and prevent the 

prohibited conflicts of interest identified in Rule 

17g-5(c)(6) and Rule 17g-5(c)(8). 

C. REVIEW AREA: IMPLEMENTATION 

OF ETHICS POLICIES 

Each NRSRO has implemented written ethics 

policies and procedures. The Staff reviewed each 

NRSRO’s ethics policies and procedures. Much 

of the content of these policies and procedures 

addresses other related Review Areas. The Staff did 

not make any findings and recommendations based 

solely on an NRSRO’s implementation of ethics 

policies and procedures. 

D. REVIEW AREA: INTERNAL 

SUPERVISORY CONTROLS 

The Staff reviewed each NRSRO’s overall control 

structure, including the internal control structure 

related to determining credit ratings. 

The Staff’s essential findings regarding internal 

supervisory controls are as follows: 

1. An NRSRO did not appear to have 

effective internal controls related to its 

practice of allowing an analyst to inform 

a client of the analyst’s rating recommendation before a rating committee has 

determined the client’s rating. 

A smaller NRSRO’s analysts regularly informed 

clients of a rating recommendation before 

the proposed rating was presented to a rating 

committee, and the NRSRO’s policies and procedures did not include a requirement for the analysts 

to inform the clients that the recommendation is 

subject to the outcome of the rating committee 

process and determination, which would be 

consistent with the NRSRO’s policies and procedures. The Staff recommended that the NRSRO 

strengthen its policies and procedures governing its 

practice of allowing an analyst to inform a client 

of the analyst’s rating recommendation prior to 

determination of the rating by a committee. 

2. An NRSRO’s standards of training, 

experience, and competence for credit 

analysts did not appear to include a Rule 

17g-9(c) requirement. 

A smaller NRSRO’s policies and procedures that 

establish its standards of training, experience, and 

competence for credit analysts did not require 

that at least one individual with an appropriate 

level of experience in performing credit analysis, 

but not less than three years, participates in the 

determination of a credit rating as Rule 17g-9(c) 

(2) requires. The Staff recommended that the 

NRSRO’s policies and procedures include the 

requirement specified in Rule 17g-9(c)(2). 

3. An NRSRO did not appear to verify when 

certain credit ratings should be discontinued and did not maintain accurate 

ratings per its policies and procedures. 

A larger NRSRO prematurely discontinued certain 

ratings because it was improperly informed that 

the entire issuances had been redeemed or repaid. 

In fact, the issuances had only been partially 

redeemed or repaid. The NRSRO did not always 

reinstate the improperly discontinued ratings in a 

timely manner, and the reinstatement typically only 

EXAM SUMMARY REPORT | 15
 

followed an inquiry from an outside party. The 

NRSRO also may have improperly discontinued 

additional ratings. The Staff recommended that the 

NRSRO improve certain internal controls to avoid 

the improper discontinuance of credit ratings and 

to promptly detect ratings that were erroneously 

discontinued. 

4. An NRSRO did not appear to maintain 

adequate internal controls within a certain 

ratings group to detect long-standing 

errors and maintain accurate credit ratings. 

A larger NRSRO made several errors relating to 

applying incorrect criteria for certain credit ratings. 

The NRSRO did not detect the errors for several 

years before correcting them, resulting in credit 

ratings outstanding that did not accurately reflect 

the credit risk during that time. Correcting the 

errors resulted in one rating downgrade and some 

rating upgrades. The Staff recommended that the 

NRSRO enhance its internal control structure to 

ensure that it accurately determines and maintains 

credit ratings, including controls designed to identify 

and correct inaccurate credit ratings, in accordance 

with its policies, procedures, and methodologies. 

5. An NRSRO did not appear to have 

policies and procedures that were 

reasonably designed with respect to a 

prohibited conflict of interest. 

A smaller NRSRO did not have reasonably 

designed policies and procedures to systematically 

determine whether entities that it rates are persons 

associated with the NRSRO. The Staff noted facts 

and circumstances that raised concerns about a 

potential control relationship between a particular 

rated entity and the NRSRO, and the NRSRO’s 

policies and procedures did not consider that entity’s 

potential status as a person associated with the 

NRSRO. The Staff recommended that the NRSRO 

ensure that it does not issue or maintain ratings 

subject to the Rule 17g-5(c)(3) prohibited conflict 

of interest and conduct an analysis to ensure that its 

rating on such entity, or any other related entity, is 

not subject to that conflict of interest. 

6. Certain NRSROs did not appear to 

comply with Rule 17g-7(a) information 

disclosure form requirements when taking 

certain credit rating actions. 

A larger NRSRO did not require the publication of 

an information disclosure form for all rating actions 

as Rule 17g-7(a) requires. The NRSRO’s policies 

and procedures did not require the production of 

such form upon the issuance of a private rating, 

and the NRSRO did not require the publication of 

the form for certain other ratings actions. The Staff 

recommended that the NRSRO adhere to the Rule 

17g-7(a) disclosure requirements. 

A smaller NRSRO did not provide an information disclosure form with respect to private 

credit ratings as Rule 17g-7(a) requires. The Staff 

recommended that the NRSRO comply with Rule 

17g-7(a) disclosure requirements when taking 

private rating actions. 

A smaller NRSRO’s policies and procedures stated 

that a Rule 17g-7(a) information disclosure form is 

not required with respect to certain credit ratings in 

contravention of Rule 17g-7(a). The Staff recommended that the NRSRO’s policies and procedures ensure compliance with the Rule 17g-7(a) 

disclosure requirements. 

16 | OFFICE OF CREDIT RATINGS 
 

A smaller NRSRO published an information 

disclosure form for several rating actions that did 

not include information required by Rule 17g-7(a) 

(1)(ii)(A) and (B) the attestation required by Rule 

17g-7(a)(1)(iii). Such form also did not specify the 

information that Rule 17g-7(a)(1)(ii)(L) requires. 

Second, the NRSRO published an information 

disclosure form for a credit rating downgrade that 

contained incorrect information that Rule 17g-7(a) 

(1)(ii)(J) requires. Third, the NRSRO did not 

publish an information disclosure form in accordance with Rule 17g-7(a), and its own policies and 

procedures, when downgrading a different credit 

rating. The Staff recommended that the NRSRO 

comply with the Rule 17g-7(a) disclosure requirements, and its own policies and procedures, when 

taking credit rating actions and have sufficient 

internal controls to ensure such compliance. 

A smaller NRSRO produced certain credit ratings 

that appeared in substance to be expected credit 

ratings but failed to provide information disclosure 

forms for such ratings, as required by Rule 

17g-7(a). The Staff recommended that the NRSRO 

produce information disclosure forms for expected 

or preliminary credit ratings, as Rule 17g-7(a) 

requires. 

7. An NRSRO did not appear to have 

documented policies and procedures for 

utilizing the Rule 17g-5(a)(3)(iv) and Rule 

17g-7(a)(3) exemptions. 

A smaller NRSRO relied on the exemptions 

described in Rule 17g-5(a)(3)(iv) and Rule 

17g-7(a)(3) for some transactions without having 

policies and procedures related to applying those 

exemptions. Without policies and procedures for 

applying the exemptions, it is not clear how the 

NRSRO established the “reasonable basis” 

required for the exemptions to apply. The Staff 

recommended that the NRSRO establish policies 

and procedures related to applying the Rule 

17g-5(a)(3)(iv) and Rule 17g-7(a)(3) exemptions. 

8. Certain NRSROs appeared to file with the 

Commission an inaccurate or incomplete 

annual financial report that Rule 17g-3(a)(5) 

requires. 

A smaller NRSRO filed with the Commission a 

report required by Rule 17g-3(a)(5) that did not 

include all required information. Since the report 

included certain entries that appeared to be underwriters, the report should have included more than 

20 entries. However, the report listed only 20 entries 

and did not identify whether the NRSRO included 

each entry as an: (1) issuer or subscriber; or (2) 

obligor or underwriter. The Staff recommended that 

the NRSRO adhere to the requirements of Rule 

17g-3(a)(5) and provide complete information when 

filing with the Commission the unaudited financial 

report required by the rule. 

A smaller NRSRO filed with the Commission a 

report required by Rule 17g-3(a)(5) that contained 

inaccurate information. Such report did not include 

certain entities, including the NRSRO’s largest client 

for the fiscal year, and misstated the net revenue for 

certain listed entities. The Staff recommended that 

the NRSRO ensure the accuracy of Rule 17g-3(a)(5) 

financial reports filed with the Commission and file 

updated reports to correct any existing inaccuracies. 

EXAM SUMMARY REPORT | 17
 

 

 

 

 

 

9. An NRSRO’s internal controls with 

respect to using model inputs in the 

rating process appeared to contain 

weaknesses. 

A larger NRSRO’s analysts made certain model 

input errors for several CLO ratings, and secondary 

reviewers did not identify the errors. The Staff 

recommended that the NRSRO enhance its internal 

controls, including with respect to analytical 

training and the committee review process, to 

ensure the accuracy of model inputs 

used in determining ratings. 

10. An NRSRO appeared to have weak 

internal controls with respect to 

conducting periodic compliance 

reviews of private credit ratings. 

A larger NRSRO did not include private credit 

ratings in the sample of ratings actions that a 

compliance monitoring group used to test analyst 

adherence to the NRSRO’s policies and procedures and that a credit policy control group used 

in quarterly random testing samples. The Staff 

recommended that the NRSRO enhance its internal 

controls with respect to conducting periodic 

compliance reviews of private credit ratings. 

11. An NRSRO’s internal controls appeared 

to contain weaknesses with respect to 

assigning certain corporate credit ratings. 

A larger NRSRO did not have any documented 

policies and procedures governing its practices with 

respect to assigning a certain type of corporate 

credit ratings. The Staff recommended that the 

NRSRO enhance its internal controls with respect 

to assigning such ratings. 

12. An NRSRO’s internal controls appeared 

to contain weaknesses with respect to 

oversight of certain process documents 

related to determining credit ratings. 

A larger NRSRO did not have a framework for 

ensuring that the NRSRO’s compliance and control 

functions have a full inventory of, and proper 

oversight over, certain process documents which 

could be integral to the NRSRO’s credit rating 

process and address certain regulatory requirements. 

The Staff recommended that the NRSRO evaluate 

its internal controls framework to ensure that it 

appropriately incorporates such documents. 

13. An NRSRO’s internal controls with 

respect to disclosing methodology 

adjustments appeared to be weak. 

A smaller NRSRO incorrectly stated in a presale 

report certain methodology adjustments that the 

NRSRO made. The Staff recommended that the 

NRSRO enhance its internal controls, including 

policies and procedures, for disclosing methodology 

adjustments. 

14. Regarding internal controls, certain 

NRSROs did not appear to follow 

requirements related to, or did not have, 

certain credit rating policies, procedures, 

or methodologies. 

A smaller NRSRO determined credit ratings for 

securities issued after previously rated securities, 

but did not have written policies or procedures for 

determining those ratings. The Staff recommended 

that the NRSRO establish and maintain written 

policies and procedures for determining, and ensure 

that it properly documents, credit ratings for subsequently issued securities. 

18 | OFFICE OF CREDIT RATINGS 
 

A smaller NRSRO’s repeated and widespread use 

of exceptions memoranda effectively modified the 

NRSRO’s established and published methodologies 

by replacing defined methodology processes with 

more subjective approaches that the NRSRO did 

not publish or subject to its internal controls for 

methodology updates as, respectively, required 

by Rule 17g-8(a)(4)(i) and Rule 17g-8(d)(1)(i) and 

(ii). The NRSRO also did not subject exceptions 

memoranda to its policies and procedures for 

methodology approval by the Board, consistent 

application of methodology changes, or disclosure 

of the methodology version used when taking 

a rating action, as required by, respectively, 

Rule 17g-8(a)(1), Rule 17g-8(a)(3)(i), and 

Rule 17g-7(a)(1)(ii)(B). The Staff recommended 

that the NRSRO use exceptions memoranda in 

accordance with its policies, procedures, and 

internal controls for modifying methodologies, 

or limit the use of exceptions memoranda so that 

such use does not effectively modify the NRSRO’s 

methodologies and complies with its policies and 

procedures. The Staff also recommended that the 

NRSRO include in information disclosure forms all 

methodologies used to determine credit ratings, 

in accordance with Rule 17g-7(a)(1)(ii)(B). 

A smaller NRSRO issued several private ratings 

without a documented methodology or sufficient 

documentation to permit an after-the-fact review or 

audit to analyze analyst adherence to the NRSRO’s 

methodologies. The NRSRO also did not maintain 

in several rating files complete and current records 

documenting the established methodologies used to 

determine ratings as Rule 17g-2(a)(6) requires, and 

factors cited in the rating files as part of the rating 

rationale frequently did not appear in the applicable methodology. The Staff recommended that 

the NRSRO: (1) maintain a complete and current 

record documenting its established credit rating 

procedures and methodologies; (2) enhance its 

internal control structure governing the implementation of and adherence to credit rating policies, 

procedures, and methodologies; and (3) consider 

adopting controls reasonably designed to ensure 

that credit analysts adhere to relevant procedures 

and methodologies and document the steps taken 

in developing ratings with sufficient detail to permit 

an after-the-fact review or internal audit of rating 

files to analyze whether an analyst adhered to the 

NRSRO’s procedures and methodologies. 

A smaller NRSRO used a newly developed credit 

rating tool to, for the first time, raise a credit rating 

for a client after the client provided a written 

complaint to the NRSRO about the original rating. 

The NRSRO did not refer to such rating tool in 

its credit rating procedures or methodologies, and 

it did not have documentation as to the analytical 

basis for using the tool, which did not comply with 

Rule 17g-2(a)(6). The NRSRO’s Board also did not 

review or approve such rating tool in accordance 

with Rule 17g-8(a)(1) and the NRSRO’s policies 

and procedures, and the NRSRO did not review, 

validate, and approve the tool as the NRSRO’s 

policies and procedures require, resulting in 

non-compliance with Rule 17g-8(a)(2). The Staff 

recommended that the NRSRO: (1) make and 

retain a complete and current record documenting 

its established credit rating procedures and methodologies; (2) ensure that its Board approves the 

NRSRO’s credit rating procedures and methodologies, including qualitative and quantitative 

data and models; and (3) ensure that the NRSRO 

develops and modifies its credit rating procedures 

and methodologies, including qualitative and 

quantitative data and models, in accordance with 

its policies and procedures. 

EXAM SUMMARY REPORT | 19
 

 

A smaller NRSRO did not, in several instances, 

use the version of a model that was in effect on 

the relevant date, and several rating files included 

multiple model versions with no indication of 

which version was used to assess the rating. 

The NRSRO also used more than one model to 

determine certain corporate credit ratings, but did 

not have policies or procedures, training materials, 

or other written documentation to instruct analysts 

on which model to use for a particular corporate 

rating. The Staff recommended that the NRSRO 

establish, maintain, enforce, and document 

effective internal controls, including policies and 

procedures, to ensure that the NRSRO applies a 

current version of its applicable credit rating model 

when determining ratings and that the NRSRO 

uses the correct credit rating model to determine a 

particular corporate rating. 

15. An NRSRO did not appear to comply 

with Rule 17g-5(c)(1) by issuing and 

maintaining credit ratings solicited by 

an entity that provided more than 10% 

of the NRSRO’s total net revenue for a 

fiscal year, the NRSRO delayed recognizing revenue and filed inaccurate Rule 

17g-3(a) financial reports in order to 

appear compliant with Rule 17g-5(c)(1), 

and the NRSRO did not have effective 

internal controls related to its revenue 

recognition practices. 

A smaller NRSRO altered its billing practices to 

split the fee billing and revenue recognition for a 

client between two consecutive fiscal years and, as 

a result, decrease the recognized net revenue from 

the client to below 10% of the NRSRO’s total net 

revenue for the relevant fiscal year. The NRSRO’s 

improper revenue deferral also resulted in the 

NRSRO filing incorrect information with the 

Commission in two annual Rule 17g-3(a) financial 

reports. The Staff recommended that the NRSRO: 

(1) establish, maintain, and enforce policies and 

procedures, including with respect to its revenue 

recognition practices, reasonably designed to 

ensure that it does not issue or maintain ratings 

subject to the Rule 17g-5(c)(1) prohibited conflict 

of interest; (2) maintain and enforce an effective 

internal control structure governing the implementation of policies and procedures to identify, 

acknowledge, and remediate potential violations 

of statutes or rules; and (3) file accurate Rule 

17g-3(a) financial reports. 

16. An NRSRO did not appear to promptly 

file a Form NRSRO registration update 

to designate a DCO. 

A smaller NRSRO delayed more than one month 

after its DCO resigned and the firm designated 

a successor DCO before reflecting that change 

on Form NRSRO Item 4 and Exhibit 9. The 

Staff recommended that the NRSRO designate a 

DCO on Form NRSRO at all times and promptly 

amend any materially inaccurate information 

on Form NRSRO as Section 15E(b)(1) and Rule 

17g-1(e) require. 

20 | OFFICE OF CREDIT RATINGS 
 

 

 

 

17. An NRSRO did not appear to have 

effective internal controls governing 

the models it used to determine credit 

ratings, including model validation and 

review, and to ensure that the NRSRO’s 

rating models are consistent with its 

rating procedures and methodologies, 

and the NRSRO’s standards of training, 

experience, and competence for the 

individuals it employs to participate in 

ratings determination are not 

reasonably designed. 

A smaller NRSRO’s rating model appeared to 

contain formulas producing numerous erroneous 

results. The model also was inconsistent with the 

NRSRO’s methodology related to random sampling 

and rating assumptions, and the model provided 

instructions that were inaccurate or incomplete 

and based on prior model versions. The model 

contained internal notes indicating that certain 

sections needed to be updated, and the model 

had base assumptions and formulas that were not 

adequately safeguarded from inadvertent errors. 

There were also inconsistencies between a model 

and relevant methodology provisions. The Staff 

recommended that the NRSRO enhance its internal 

controls governing its rating models and ensure 

that the models accurately reflect the NRSRO’s 

rating procedures and methodologies. The Staff also 

recommended that the NRSRO maintain standards 

of training, experience, and competence for the 

individuals it employs to participate in the determination of credit ratings that sufficiently consider 

the technical expertise necessary to understand 

any models and model inputs that are a part of the 

procedures and methodologies. 

18. An NRSRO appeared to have weak 

internal controls governing the timely 

receipt of documents used to form the 

basis of a credit rating. 

A smaller NRSRO issued credit ratings without 

receiving and retaining certain documentation 

used to form the basis of the rating and which 

was requested by the NRSRO’s relevant rating 

committee. The Staff recommended that the 

NRSRO enhance its internal controls governing the 

timely receipt of documents used to form the basis 

of a credit rating, including documents that a rating 

committee requests. 

19. An NRSRO did not appear to have 

policies and procedures to address its 

business continuity risks to ensure an 

effective internal control structure. 

A smaller NRSRO did not have policies and 

procedures, to address its business continuity risks 

to ensure an effective internal control structure. 

The Staff recommended that the NRSRO establish, 

maintain, enforce, and document policies and 

procedures to address its business continuity risks 

and ensure an effective internal control structure 

governing the implementation of and adherence 

to policies, procedures, and methodologies for 

determining credit ratings. 

EXAM SUMMARY REPORT | 21
 

 

20. An NRSRO did not appear to establish, 

maintain, enforce, and document an 

effective internal control structure and 

did not describe in the report that it 

filed with the Commission under Rule 

17g-3(a)(7) the material weaknesses in 

its internal control structure governing 

the implementation of and adherence 

to credit rating policies, procedures, 

and methodologies. 

A smaller NRSRO did not have effective internal 

controls related to: (1) compliance with Rule 

17g-5(c)(8); (2) the implementation of and 

adherence to policies, procedures, and methodologies for determining credit ratings; (3) the 

receipt on a timely basis of documents used to form 

the basis of a credit rating, including documents 

requested by a rating committee; (4) analysts fully 

documenting their ratings analysis in internal 

records; (5) the NRSRO’s Board approving credit 

rating procedures and methodologies; (6) developing credit rating procedures and methodologies 

in accordance with its policies and procedures; (7) 

the models used to determine credit ratings; (8) 

reasonable standards of training, experience, and 

competence of its analysts and adherence to its 

policies and procedures adopted to comply with the 

requirements in Rule 17g-9(a) and Rule 17g-9(c)(1); 

and (9) ensuring the establishment, maintenance, 

enforcement, and documentation of policies and 

procedures to address business continuity risks. 

Notwithstanding such internal control weaknesses, 

the NRSRO filed with the Commission an internal 

controls report under Rule 17g-3(a)(7) concluding 

that its internal control structure was effective as 

of the relevant fiscal year end and did not describe 

any material weaknesses in its internal control 

structure. The report was accompanied by a signed 

statement of the NRSRO’s CEO to the effect that, 

to the individual’s best knowledge, the report fairly 

presents, in all material respects, an assessment by 

management of the effectiveness of the internal 

control structure during the fiscal year. The Staff 

recommended that the NRSRO: (1) establish, 

maintain, enforce, and document an effective 

internal control structure governing the implementation of and adherence to credit rating policies, 

procedures, and methodologies; (2) identify any 

material weaknesses in its internal control structure 

and include in its annual reports under Rule 

17g-3(a)(7) a description of each such material 

weakness identified during the fiscal year and a 

description, if applicable, of how the NRSRO 

addressed each identified material weakness. 

E. REVIEW AREA: GOVERNANCE 

The Staff interviewed each NRSRO’s Board, 

including independent directors. The Staff also 

reviewed minutes and other documentation related 

to the activities of each NRSRO’s Board. 

The Staff’s essential finding relating to corporate 

governance and compliance with Section 15E(t) is 

as follows: 

1. An NRSRO did not appear to adhere to 

the Rule 17g-8(a)(1) requirements related 

to Board approval of procedures used to 

determine credit ratings. 

A larger NRSRO’s Board did not approve certain 

procedures the NRSRO uses to determine credit 

ratings, such as procedures related to rating 

committees and rating withdrawal procedures. 

The Staff recommended that the NRSRO adhere 

to the Rule 17g-8(a)(1) requirements related to 

the approval of procedures used to determine 

credit ratings. 

22 | OFFICE OF CREDIT RATINGS 
 

F. REVIEW AREA: DCO ACTIVITIES 

Each NRSRO has designated an individual to 

serve as the NRSRO’s DCO. The Staff reviewed 

the role and activities of each NRSRO’s DCO and 

interviewed each DCO. Much of the content of 

these reviews and interviews relates to other Review 

Areas. As such, any Staff findings and recommendations related to an NRSRO’s DCO activities are 

addressed in other sections of this Report.41 

G. REVIEW AREA: COMPLAINTS 

All of the NRSROs have written policies and procedures to address complaints generally. The Staff’s 

essential finding regarding complaints is as follows: 

1. An NRSRO appeared to have 

inconsistent policies and procedures 

concerning complaints. 

A smaller NRSRO’s policies and procedures 

contained inconsistencies related to the circumstances under which a complaint must be reported 

to senior management and/or the Board and 

inconsistencies in whether analysts are required to 

distinguish between normal course conversations 

with, and a complaint by, a rated entity. Also, for 

a complaint to be registered, the NRSRO’s policies 

and procedures required analysts to instruct outside 

parties to repeat their complaint to a compliance 

officer. The Staff recommended that the NRSRO 

revise its complaints policies and procedures so 

that they are consistent and so that the NRSRO 

adequately addresses all complaints. 

H. REVIEW AREA: POST-EMPLOYMENT 

The Staff reviewed whether each NRSRO’s “lookback” policies and procedures satisfy the applicable statutory and rule requirements. The Staff’s 

essential findings regarding NRSROs’ look-back 

policies and procedures are as follows: 

1. An NRSRO’s look-back review policies 

and procedures did not appear to address 

all of the required Rule 17g-7(a)(1)(ii)(J)(3) 

disclosures. 

A smaller NRSRO’s policies and procedures did 

not address the requirements to disclose, for rating 

revisions and affirmations, a description of the 

impact a conflict had on the prior rating actions 

and, for rating affirmations, an explanation of 

why no rating action was taken to revise the credit 

rating notwithstanding the presence of the conflict. 

The Staff recommended that the NRSRO ensure 

that its look-back review policies and procedures 

are consistent with Rule 17g-7(a)(1)(ii)(J)(3). 

2. An NRSRO did not appear to enforce its 

policies and procedures when completing 

look-back reviews. 

A larger NRSRO generated reports incorrectly stating that NRSRO personnel completed 

look-back reviews without referring the matters 

for further review to a certain ratings review group 

and/or officer as the NRSRO’s relevant policies and 

procedures require. The Staff also observed several 

instances where the NRSRO did not complete 

look-back reviews within the time period that 

such policies and procedures require. The Staff 

recommended that the NRSRO enforce its policies 

and procedures for conducting look-back reviews 

and enhance its internal controls to ensure that 

it conducts and documents look-back reviews in 

accordance with those policies and procedures. 

41 See, e.g., Section IV.D.16. 

EXAM SUMMARY REPORT | 23
 

V. Conclusion 

This Report summarizes the essential findings 

and recommendations for the NRSROs. In future 

examinations, the Staff will continue to assess the 

NRSROs’ responses to recommendations from 

the 2020 Section 15E examinations. The Staff will 

continue to evaluate its risk assessment process 

to review compliance with laws and regulations 

and to identify emerging risk areas. The Staff will 

also continue to evaluate examination techniques 

to assess and test the NRSROs’ compliance with 

applicable laws and rules. 

24 | OFFICE OF CREDIT RATINGS 
EXAM SUMMARY REPORT | 25
U.S. SECURITIES AND EXCHANGE COMMISSION 

Washington, DC