__________________________________________________________________________

2016 SUMMARY REPORT OF COMMISSION STAFF’S EXAMINATIONS OF

EACH NATIONALLY RECOGNIZED STATISTICAL RATING ORGANIZATION

__________________________________________________________________________

As Required by Section 15E(p)(3)(C) 

of the Securities Exchange Act of 1934

This is a report of the Staff of the U.S. Securities and Exchange Commission.

The Commission has expressed no view regarding the analysis, findings, or conclusions 

contained herein.

__________________________________

December 2016
TABLE OF CONTENTS

I. REGULATORY AND NRSRO OVERVIEW.................................................................... 2

A. Statutory Framework and Rules....................................................................................... 2

B. Registered NRSROs......................................................................................................... 7

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW....................... 8

A. Examinations under Section 15E(p)(3)............................................................................ 8

B. Examination Overview .................................................................................................... 8

C. The Staff’s Findings and Future Expectations Related to the New and Amended SEC 

 Rules............. .............................................................................................................. 10

III. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

EXAMINATIONS AND NOTABLE IMPROVEMENTS OVER THE COURSE OF THE

EXAMINATIONS....................................................................................................................... 10

A. Responses to Recommendations from Previous Examinations..................................... 10

B. Notable Improvements Over the Course of the Examinations ...................................... 11

IV. SUMMARY OF ESSENTIAL FINDINGS....................................................................... 12

A. Review Area: Adherence to Policies, Procedures, and Methodologies........................ 13

B. Review Area: Management of Conflicts of Interest ..................................................... 16

C. Review Area: Implementation of Ethics Policies......................................................... 20

D. Review Area: Internal Supervisory Controls................................................................ 21

E. Review Area: Governance ............................................................................................ 32

F. Review Area: DCO Activities ...................................................................................... 34

G. Review Area: Complaints.............................................................................................. 36

H. Review Area: Post-Employment.................................................................................... 37

V. CONCLUSION ................................................................................................................... 39
2016 Section 15E Examinations Summary Report Page 2

I. REGULATORY AND NRSRO OVERVIEW

This report (“Report”) summarizes the examinations conducted by staff from the U.S. Securities 

and Exchange Commission (the “Staff”) under Section 15E(p)(3) of the Securities Exchange Act 

of 1934 (“Exchange Act”).1 This is a report of the Staff and, as such, reflects solely the Staff’s 

views. The U.S. Securities and Exchange Commission (“Commission” or “SEC”) is making this 

Staff Report public as required by Section 15E(p)(3)(C) of the Exchange Act.

A. Statutory Framework and Rules

Section 15E of the Exchange Act (“Section 15E”) and Exchange Act Rules 17g-1 through 

17g-10 govern the registration and oversight program for credit rating agencies that are 

registered with the Commission as nationally recognized statistical rating organizations 

(“NRSROs”). This regulatory regime was established by the Credit Rating Agency Reform Act 

of 2006 (the “Rating Agency Act”)2 and amended by the Dodd-Frank Wall Street Reform and 

Consumer Protection Act of 2010 (the “Dodd-Frank Act”).3

 

The Dodd-Frank Act mandated the creation of the Office of Credit Ratings (“OCR”), which is

responsible for oversight of credit rating agencies registered with the Commission as NRSROs. 

OCR was established in June 2012 with the appointment of its Director, Thomas J. Butler. The 

Dodd-Frank Act requires OCR to conduct an examination of each NRSRO at least annually and 

to make available to the public an annual report summarizing these examinations.4

The Dodd-Frank Act directed the Commission to adopt and amend a number of rules related to 

NRSROs. In August 2014, the Commission adopted new Rules 17g-8, 17g-9, and 17g-10 as 

well as Form ABS Due Diligence-15E, and amended Rules 17g-1 through 17g-3 and 17g-5 

through 17g-7 as well as Form NRSRO.5 Most of these new and amended rules became 

effective on June 15, 2015.

The subjects addressed by these new and amended rules include NRSROs’ internal control 

structures, rating methodologies and models, rating symbols, conflicts of interest relating to sales 

and marketing activities, post-employment reviews, disclosure forms and certifications to 

accompany each credit rating, public disclosures of credit rating performance statistics and credit 

 1 15 U.S.C. § 78o-7(p)(3)(C). Unless otherwise noted, all Section and Rule references in this report are to 

the Exchange Act and rules under the Exchange Act. See 15 U.S.C § 78o-7; 15 U.S.C. § 78q (a) and (b); 

17 CFR 240.17g-1 through 17g-10.

2 Credit Rating Agency Reform Act of 2006, Pub. L. No. 109-291, 120 Stat. 1327 (2006).

3 The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 932, 124 Stat. 

1376, 1872-83 (2010).

4 15 U.S.C. § 78o-7(p)(3).

5 See Nationally Recognized Statistical Rating Organizations; Final Rule, Exchange Act Release No. 72936 

(Aug. 27, 2014); 79 FR 55078 (Sept. 15, 2014).
2016 Section 15E Examinations Summary Report Page 3

rating histories, assessment and reporting by NRSROs’ management regarding the effectiveness 

of their internal control structures, asset-backed securities (“ABS”) third-party due diligence 

providers, and NRSROs’ standards of training, experience, and competence. 

Pursuant to the Commission’s regulatory regime for NRSROs, an NRSRO is required to, among 

other things:

• File with the Commission annual certifications of its Form NRSRO registrations,

6

promptly update its filing in certain circumstances,

7 and make its current Form NRSRO 

filing and most of its current Form NRSRO Exhibits available on its public website.

8

 

• Disclose certain information, including information concerning the NRSRO’s 

performance measurement statistics and its procedures and methodologies to determine 

ratings.9

• Establish, maintain, enforce, and document an effective internal control structure 

governing the implementation of and adherence to policies, procedures, and 

methodologies for determining credit ratings,

10 and retain records of its internal control 

structure.

11

• Consider certain factors with respect to its establishment, maintenance, enforcement, and 

documentation of an effective internal control structure.12

• Establish, maintain, enforce, and document policies and procedures reasonably designed 

to achieve certain objectives concerning its development and application of, and 

disclosures related to, methodologies and models.13 

• File an unaudited report containing an assessment by management of the effectiveness 

during the fiscal year of the NRSRO’s internal control structure governing the 

implementation of and adherence to policies, procedures, and methodologies for 

 6 15 U.S.C. § 78o-7(b)(2) and 17 CFR 240.17g-1(f).

7 15 U.S.C. § 78o-7(b)(1) and 17 CFR 240.17g-1(e).

8 15 U.S.C. § 78o-7(a)(3) and 17 CFR 240.17g-1(i).

9 15 U.S.C. § 78o-7(a)(1)(B)(i) and § 78o-7(a)(1)(B)(ii).

10 15 U.S.C. § 78o-7(c)(3)(A). Significantly, the regulatory regime expressly prohibits the Commission from 

regulating the substance of credit ratings. 15 U.S.C. § 78o-7(c)(2).

11 17 CFR 240.17g-2(b)(12).

12 See, e.g., 17 CFR 240.17g-8(d)(1) through (4). 

13 See, e.g., 17 CFR 240.17g-8(a)(2) through (5). 
2016 Section 15E Examinations Summary Report Page 4

determining credit ratings.14 The report must be accompanied by a signed statement by 

the NRSRO’s chief executive officer or an individual performing similar functions.15

• Establish, maintain, enforce, and document policies and procedures that are reasonably 

designed to: assess the probability that an issuer of a security or money market instrument 

will default or fail to make required payments to investors,

16 and ensure that it applies 

any rating symbol, number, or score in a manner that is consistent for all types of 

obligors, securities, and money market instruments for which the symbol, number, or 

score is used.17

• Publish an information disclosure form when taking a rating action with respect to a 

rating assigned to an obligor, security, or money-market instrument in a class for which it 

is registered as an NRSRO.

18 The information form must disclose certain information 

with respect to the particular rating action.19 In addition, the NRSRO must attach to the 

information disclosure form a signed statement by a person within the NRSRO with

responsibility for the rating action.

20

 14 17 CFR 240.17g-3(a)(7)(i).

15 17 CFR 240.17g-3(b)(2).

16 17 CFR 240.17g-8(b)(1).

17 17 CFR 240.17g-8(b)(3).

18 17 CFR 240.17g-7(a). Rule 17g-7(a) defines rating action to include an expected or preliminary rating, an 

initial rating, an upgrade or downgrade of an existing rating (including a downgrade to, or assignment of, 

default), and an affirmation or withdrawal of an existing rating if the affirmation or withdrawal is the result 

of the NRSRO’s review of the rating using applicable procedures and methodologies for determining credit 

ratings. 17 CFR 240.17g-7(a). Pursuant to Rule 17g-7(a)(3), an NRSRO is exempt from publishing an 

information disclosure form for a particular rating if (i) the rated obligor or issuer of the rated security or 

money market instrument is not a U.S. person, and (ii) the NRSRO has a reasonable basis to conclude that 

a security or money market instrument issued by the rated obligor or the issuer will be offered and sold 

upon issuance, and that any underwriter or arranger linked to the security or money market instrument will 

effect transactions in the security or money market instrument after issuance, only in transactions that occur 

outside the United States. 17 CFR 240.17g-7(a)(3).

19 The information that must be disclosed in the information disclosure form is specified in 17 CFR 240.17g7(a)(1)(ii)(A) - (N). These required disclosures include: the version of the procedure or methodology used

to determine the credit rating; disclosures concerning the uncertainty of the rating, including regarding the 

reliability, accuracy, quality, and accessibility of data related to the rating; a statement containing an overall 

assessment of the quality of information available and considered in determining the credit rating for the 

obligor, security, or money market instrument; and information on the sensitivity of the rating to 

assumptions made by the NRSRO. In addition, an NRSRO must attach to the information disclosure form 

any executed Form ABS Due Diligence-15E containing information about the security or money market 

instrument subject to the rating action that is received by the NRSRO or obtained by the NRSRO through a 

Rule 17g-5(a)(3) website.

20 17 CFR 240.17g-7(a)(1)(iii).
2016 Section 15E Examinations Summary Report Page 5

• Make and retain, or retain, certain records, including a record documenting its established 

procedures and methodologies used to determine credit ratings21 and records related to its 

ratings.22 An NRSRO must promptly furnish to the Commission or its representatives 

copies of required records, including English translations of those records upon request.23

• Establish, maintain, and enforce written policies and procedures reasonably designed to 

prevent the misuse of material non-public information (“MNPI”), including the 

inappropriate dissemination of MNPI both within and outside the NRSRO, the 

inappropriate trading of securities using MNPI by a person within the NRSRO, and the 

inappropriate dissemination of pending credit rating actions within and outside the 

NRSRO before issuing the rating on the Internet or through another readily accessible 

means.

24

• Establish, maintain, and enforce written policies and procedures reasonably designed to 

address and manage conflicts of interest.

25 Certain conflicts of interest are expressly 

prohibited,26 and for other types of conflicts of interest, the NRSRO must disclose the 

conflict and have policies and procedures in place to manage them.

27

• Refrain from engaging in specified unfair, coercive, or abusive practices.28

 21 17 CFR 240.17g-2(a)(6).

22 The records that an NRSRO must make and retain, or retain, with respect to its ratings include the identity 

of certain persons that participated in determining or approving the rating, records used to form the basis of 

a rating, external and internal communications received or sent by the NRSRO and its employees related to 

a rating, and for ABS ratings, a record of the rationale for any material difference between the final rating 

assigned and the rating implied by a quantitative model that was a substantial component in determining 

the rating. 17 CFR 240.17g-2(a)(2)(i) and (ii), 17 CFR 240.17g-2(b)(2), (b)(7), and (a)(2)(iii).

23 15 U.S.C. § 78q (a) and (b) and 17 CFR 240.17g-2(f).

24 15 U.S.C. § 78o-7(g) and 17 CFR 240.17g-4.

25 15 U.S.C. § 78o-7(h) and 17 CFR 240.17g-5.

26 17 CFR 240.17g-5(c).

27 17 CFR 240.17g-5(a)(1) and (a)(2); 17 CFR 240.17g-5(b). Moreover, Rule 17g-5(a)(3) prohibits NRSROs 

from having conflicts of interest related to a rating for a security or money market instrument issued by an 

asset pool or as part of any ABS transaction unless the NRSRO, among other things, maintains and 

provides access to a password-protected Internet Web site containing a list of each such security or moneymarket instrument for which it is currently in the process of determining an initial credit rating, and obtains 

certain written representations from the issuer, sponsor, or underwriter of each such security or moneymarket instrument. 

28 17 CFR 240.17g-6.
2016 Section 15E Examinations Summary Report Page 6

• Provide information on whether it has in effect a code of ethics, and if not, the reasons it 

does not have a code of ethics.29

• Establish procedures for the receipt retention, and treatment of complaints regarding 

credit ratings, models, methodologies, and compliance with the securities laws and its 

policies and procedures developed under this regulatory regime, and of confidential, 

anonymous complaints.30

 

• Designate a compliance officer (the “DCO”) responsible for administering policies and 

procedures related to MNPI and conflicts of interest, ensuring compliance with the 

securities laws and regulations, and establishing procedures for handling complaints by 

employees or users of credit ratings.

31 The DCO must submit an annual report to the 

NRSRO on the compliance of the NRSRO with the securities laws and the NRSRO’s 

policies and procedures, and the NRSRO must file the report with the Commission.32

• Have a board of directors or similar governing body, certain of whose members must be 

independent from the NRSRO.33 An NRSRO’s board of directors or governing body,

and/or members thereof, are responsible for exercising oversight of specified subjects 

related to the NRSRO’s rating business, and for approving the procedures and 

methodologies, including qualitative and quantitative data and models, that the NRSRO 

uses to determine ratings.34

• Establish, maintain, enforce, and document standards of training, experience, and 

competence for the individuals it employs to participate in the determination of credit 

ratings that are reasonably designed to achieve the objective that the NRSRO produces 

accurate credit ratings, and retain a record of these standards.35 

• Establish policies and procedures regarding post-employment activities of certain former 

personnel.36

 29 15 U.S.C. § 78o-7(a)(1)(B)(v).

30 15 U.S.C. § 78o-7(j)(3).

31 15 U.S.C. § 78o-7(j)(1) and (3).

32 15 U.S.C. § 78o-7(j)(5).

33 15 U.S.C. § 78o-7(t)(2).

34 15 U.S.C. § 78o-7(t)(3) and 17 CFR 240.17g-8(a)(1).

35 17 CFR 240.17g-9.

36 15 U.S.C. § 78o-7(h)(4) and (5); 17 CFR 240.17g-8(c).
2016 Section 15E Examinations Summary Report Page 7

B. Registered NRSROs

In 2007, the Commission began granting registrations to credit rating agencies that applied to be 

registered as an NRSRO. Credit rating agencies seeking to apply to register with the 

Commission as an NRSRO may do so by filing a completed Form NRSRO and related 

Exhibits.37 A credit rating agency may apply to be registered with respect to one or more of the 

following five classes of credit ratings: (1) financial institutions, brokers, or dealers (“financial 

institutions”); (2) insurance companies; (3) corporate issuers; (4) issuers of ABS; and (5) issuers 

of government securities, municipal securities, or securities issued by a foreign government 

(“government securities”).38 

The ten credit rating agencies registered as NRSROs as of December 1, 2016, and dates of their 

initial registrations are listed below. More information on NRSRO registration applications and 

the state of competition, transparency, and conflicts of interest among NRSROs is included in the 

Annual Report to Congress under Section 6 of the Rating Agency Act, available on the 

Commission’s website: http://www.sec.gov/ocr.

NRSRO Date of Initial Registration

A.M. Best Rating Services (“AMB”)39 September 24, 2007

DBRS, Inc. (“DBRS”) September 24, 2007

Egan-Jones Ratings Company (“EJR”) December 21, 2007

Fitch Ratings, Inc. (“Fitch”) September 24, 2007

HR Ratings de México, S.A. de C.V. (“HR”) November 5, 2012

Japan Credit Rating Agency, Ltd. (“JCR”) September 24, 2007

Kroll Bond Rating Agency, Inc. (“KBRA”)40 February 11, 2008

Moody’s Investors Service, Inc. (“Moody’s”) September 24, 2007

Morningstar Credit Ratings, LLC (“Morningstar”)41 June 23, 2008

S&P Global Ratings (“S&P”)42 September 24, 2007

For purposes of this Report only, we refer to Fitch, Moody’s, and S&P as larger NRSROs and 

the seven other NRSROs (AMB, DBRS, EJR, HR, JCR, KBRA, and Morningstar) as smaller 

NRSROs. 

 37 15 U.S.C. § 78o-7(a) and 17 CFR 240.17g-1(a) and (b).

38 15 U.S.C. § 78(c)(a)(62)(A).

39 Formerly known as A.M. Best Company, Inc.

40 Formerly known as LACE Financial Corp.

41 Formerly known as Realpoint LLC.

42 Formerly known as Standard & Poor’s Ratings Services.
2016 Section 15E Examinations Summary Report Page 8

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW

A. Examinations under Section 15E(p)(3)

Generally, the purpose of NRSRO examinations is to monitor compliance with federal securities 

laws and rules, identify conduct or insufficient policies and procedures or ineffective internal 

controls that potentially violate such laws and rules, and encourage remedial action. To facilitate 

such remedial action, the Staff sends each NRSRO an exam summary letter that identifies and 

explains its findings related to that NRSRO and recommends remedial measures. Examinations 

also serve to inform the Commission and the NRSROs’ compliance personnel of regulatory 

obligations and noteworthy industry developments. If the examination staff identifies potential 

violations of federal securities laws or rules, the Staff may refer the matter to the Commission’s 

Division of Enforcement (“Enforcement”), which is responsible for further investigation of these 

potential violations. 

Section 15E(p)(3)(B) provides that each NRSRO examination shall include a review of the 

following eight topic areas (“Section 15E Review Areas”): (i) whether the NRSRO conducts 

business in accordance with its policies, procedures, and rating methodologies; (ii) the 

management of conflicts of interest by the NRSRO; (iii) the implementation of ethics policies by 

the NRSRO; (iv) the internal supervisory controls of the NRSRO; (v) the governance of the 

NRSRO; (vi) the activities of the DCO of the NRSRO; (vii) the processing of complaints by the 

NRSRO; and (viii) the policies of the NRSRO governing the post-employment activities of its 

former personnel.

Section 15E(p)(3)(C) requires the Commission to make publicly available an annual report 

summarizing: (i) the essential findings of all Section 15E examinations, as deemed appropriate 

by the Commission; (ii) the NRSROs’ responses to any material regulatory deficiencies 

identified by the Commission; and (iii) whether the NRSROs have appropriately addressed the 

recommendations of the Commission contained in previous annual reports on examinations.

B. Examination Overview

The 2016 examinations generally focused on the NRSROs’ activities for the period covering 

January 1, 2015 through December 31, 2015 (the “Review Period”). The examinations also 

reviewed certain activities or credit rating actions from outside the Review Period.

The 2016 examinations reviewed the Section 15E Review Areas and examined each NRSRO’s

adherence with Section 15E and Rules 17g-1 through 17g-10. Each of the NRSRO examinations 

was based upon an individualized risk assessment performed by the Staff that determined areas 

of emphasis and issues of focus for each NRSRO within the Section 15E Review Areas. Thus, 

the 2016 examinations reviewed each of the Section 15E Review Areas and were tailored to each 

NRSRO’s specific risk profile. The individualized risk assessments took into account a number

of factors, including, but not limited to, the NRSRO’s rating activities and operations, the Staff’s

findings, recommendations, and general observations from prior examinations, the impact of a

potential or actual internal control or compliance failure by the NRSRO, recent industry 

developments affecting NRSROs and the asset classes in which the NRSRO is registered, the 

NRSRO’s filings with the Commission and public disclosures, the NRSRO’s self-identified 
2016 Section 15E Examinations Summary Report Page 9

weaknesses, and relevant tips, complaints, and referrals (“TCRs”) received by the Commission. 

The Staff’s risk assessment also incorporated certain new obligations applicable to NRSROs as a 

result of the new and amended rules. For example, the Staff’s risk assessment and evaluation of 

each NRSRO’s internal controls included consideration of a newly required report that NRSRO 

management must file with the Commission concerning its assessment of the effectiveness of the 

NRSRO’s internal control structure for determining ratings. 

The 2016 examinations also focused on certain subjects and activities that the Staff identified as

relevant to several NRSROs, as summarized below. 

• New and Amended SEC Rules: As previously mentioned, in August 2014, the 

Commission adopted new and amended rules concerning NRSROs. Most of these rules 

became effective on June 15, 2015, which was during the Review Period for the 2016 

Section 15E examinations. Thus, the 2016 Section 15E examinations are the first 

examinations to assess NRSROs’ compliance with these rules.43 Over the course of the 

2016 Section 15E examinations, the Staff reviewed whether all of the NRSROs had 

implemented an effective internal control structure, including policies and procedures, to 

comply with all of the new and amended rules by the June 15, 2015 effective date. The 

Staff also reviewed whether all of the NRSROs were complying with these new and 

amended rules and the NRSROs’ related policies and procedures. 

• Information Technology (“IT”): The Staff reviewed all NRSROs’ policies and 

procedures, controls, resources, and documentation related to IT, with particular focuses

on cybersecurity and NRSROs’ social media practices.

• Quantitative Models: The Staff conducted in-depth reviews of certain NRSROs’ policies, 

procedures, and practices regarding quantitative models used in the rating process. The 

Staff assessed whether these NRSROs had effective controls, including policies,

procedures, and frameworks, for the development, review, testing, validation, and 

documentation of quantitative models, and whether these NRSROs adhered to such 

policies, procedures, and frameworks. The Staff also assessed whether these NRSROs 

applied quantitative models in the rating process in accordance with their policies and 

procedures, methodologies, and criteria. 

• Surveillance of Outstanding Ratings: The Staff reviewed whether certain NRSROs

adhered to their policies, procedures, and methodologies related to conducting 

surveillance of outstanding ratings, including whether they conducted surveillance within

their stated timeframes. The Staff also assessed whether these NRSROs committed 

adequate resources to conduct surveillance timely and completely.

The Staff’s essential findings and recommendations concerning new and amended SEC rules, IT, 

quantitative models, and surveillance of outstanding ratings are addressed in this Report in the 

Sections concerning the relevant Section 15E Review Areas.

 43 Certain of the new and amended rules became effective in 2014. During the 2015 Section 15E 

examinations, the Staff reviewed each NRSRO’s compliance with the rules that became effective in 2014 

and also assessed each NRSRO’s plans to implement the new and amended rules.
2016 Section 15E Examinations Summary Report Page 10

In addition, because many NRSROs operate globally and have one or more credit rating affiliates 

or regional offices that are located outside the United States and which are included in their 

NRSRO registrations, the Staff’s 2016 examinations included risk-based reviews of the 

operations and rating activities of certain foreign credit rating affiliates and/or regional offices of 

some NRSROs. The Staff assessed whether these NRSROs applied rating policies and 

procedures, methodologies, criteria, and models consistently in their affiliate and regional 

offices, whether these NRSROs exercised sufficient compliance oversight of their foreign credit 

rating affiliates and regional offices, and whether these affiliates’ and foreign offices’ personnel

understood the laws applicable to NRSROs, including the new and amended SEC rules. In 

addition, based on its risk assessment, the Staff reviewed issues or operations specific to these 

NRSROs and some of their credit rating affiliates or foreign offices. The Staff also reviewed 

rating files for certain of these NRSROs’ ratings that personnel in these foreign offices 

participated in determining or reviewing. The Staff’s findings and recommendations related to 

these NRSROs’ foreign credit rating affiliates or regional offices are addressed in this Report in 

the Sections concerning the relevant Section 15E Review Areas.

C. The Staff’s Findings and Future Expectations Related to the New and Amended 

SEC Rules

As discussed in the previous Section of this Report, most of the SEC’s new and amended rules 

took effect in 2015, and the 2016 Section 15E examinations were the first examinations to assess 

NRSROs’ compliance with these rules. A significant portion of the Staff’s essential findings 

from the 2016 Section 15E examinations relate to the new and amended SEC rules. The Staff 

expects that each NRSRO will refine as needed its policies, procedures, and controls related to 

these rules based on its experiences with the rules to date and the Staff’s relevant 

recommendations from the 2016 Section 15E examinations. Also, over the passage of time, each 

NRSRO’s personnel should develop a better understanding of these rules and the NRSRO’s 

policies, procedures, processes, and controls for implementing these rules. The Staff expects that 

such developments should enhance each NRSRO’s compliance with these rules in the future.

III. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

EXAMINATIONS AND NOTABLE IMPROVEMENTS OVER THE COURSE OF THE 

EXAMINATIONS

A. Responses to Recommendations from Previous Examinations

The Staff’s determination that an NRSRO appropriately addressed a recommendation does not 

constitute its endorsement of that NRSRO or its policies, procedures, internal controls, or 

operations. In a future examination, the Staff may reevaluate the NRSRO’s response to 

recommendations that it previously deemed to be appropriately addressed by, for example,

assessing whether the NRSRO fully implemented remedial measures and whether those remedial 

measures appear to be effective. The Staff may also review and make recommendations 

concerning the NRSRO’s policies, procedures, internal controls, or operations related to the 

general subject matter of a recommendation that it previously deemed to be appropriately 
2016 Section 15E Examinations Summary Report Page 11

addressed. The determination of whether an NRSRO appropriately addressed a recommendation 

reflects solely the Staff’s view and does not necessarily reflect the views of the Commission. 

The Staff’s assessment of whether an NRSRO has appropriately addressed a recommendation 

depends on the specific facts and circumstances of each recommendation, including, but not 

limited to, the promptness of the NRSRO’s response, the severity of the conduct at issue, and 

whether the remedial action undertaken by the NRSRO is expected to fully resolve the Staff’s 

concerns. To assess whether NRSROs appropriately addressed findings from the 2015

examinations, the Staff reviewed each NRSRO’s written submission that responded to the Staff’s 

exam summary letter and described its planned remedial measures, and participated in follow-up 

calls with each NRSRO to discuss its written submission. 

During the 2016 Section 15E examinations, the Staff assessed each NRSRO’s progress in

implementing remedial measures such as drafting policies or procedures or adding resources. In 

certain instances, the Staff also tested the existence and effectiveness of such measures. In 

assessing the effectiveness of NRSROs’ remedial measures, the Staff is cognizant that NRSROs 

may not be able to fully implement remedial measures before the Staff commences its Section 

15E examinations for the subsequent year, and the Staff may not be able to fully assess the 

effectiveness of these measures in its Section 15E examinations for that subsequent year. 

Based on the Staff’s 2016 Section 15E examinations, the Staff has determined that all 

recommendations from the 2015 exam have now been appropriately addressed.44 The NRSROs 

addressed the 2015 recommendations by taking remedial measures such as adopting new or 

enhancing existing policies or procedures, enhancing or implementing new internal controls, 

implementing new systems and processes, and adding personnel and resources. 

B. Notable Improvements Over the Course of the Examinations

The Staff’s Section 15E examinations over the years have identified certain improvements at one 

or more of the NRSROs. Generally, NRSRO personnel at all levels of seniority and 

responsibility have continued to display greater awareness of applicable laws and their 

obligations as regulated entities. Moreover, the Staff’s summary reports covering the Section 

15E examinations for the years 2013 through 2015 mention specific improvements by certain 

NRSROs, and the NRSROs generally have maintained those improvements or built on those 

improvements by further enhancing the measures undertaken and embedding them in their 

operations and culture. Examples of improvements that one or more NRSRO implemented in 

the past and have maintained or enhanced include: 

• Implementing software and computer systems intended to increase the automation, 

efficiency, and capacity of document-retention, monitoring of employees’ emails and 

securities ownership, and other compliance-related tasks.

 44 As discussed in Section IV.D.3. of this Report, while a smaller NRSRO did not promptly address the 

Staff’s recommendation from the 2015 Section 15E examination concerning its disclosing methodology 

deviations in its rating publications, this NRSRO did eventually address the recommendation.
2016 Section 15E Examinations Summary Report Page 12

• Implementing software and computer systems that are used in the ratings process and 

intended to reduce the potential for manual error.

• Increased resources and commitment to documenting their operations and retaining such 

documentation.

• Increasing the number and frequency of audits and other testing conducted to assess the 

NRSROs’ adherence to policies and procedures and compliance with applicable 

regulations.

• Revising practices regarding performance evaluation, compensation, and promotion to 

specifically include consideration of an employee’s adherence to its rating policies and 

procedures, code of conduct, and compliance rules.

• Increased awareness of, and commitment of personnel and resources to address, riskmanagement issues.

In addition, during the 2016 Section 15E examinations, and similar to the Staff’s observations 

from the 2015 examinations, some NRSROs initiated remedial measures soon after the Staff first 

brought an issue to their attention during the examination rather than initiating responses only 

after they received the Staff’s exam summary letter. These particular NRSROs’ enhanced 

responsiveness to issues raised by the Staff indicates continuing improvement in their

compliance cultures and functions.

IV. SUMMARY OF ESSENTIAL FINDINGS

Section 15E(p)(3)(C)(i) requires this Report to contain a summary of the essential findings of the 

annual examinations, as deemed appropriate by the Commission.

For purposes of this Report, “essential findings” are all findings from the 2016 examinations that 

were included with one or more recommendations in an exam summary letter sent to an NRSRO. 

“Essential findings” do not include the Staff’s general observations. In this Report, essential 

findings are organized by the applicable Section 15E Review Areas. This Report uses the 

phrases “significant,” “numerous,” “several,” and “some” to describe and distinguish the 

frequency of conduct or instances underlying certain findings. The particular phrase used 

reflects directionally the number of instances during the Review Period, recognizing that the 

number of instances may be reflective of a test sample and not necessarily an NRSRO’s full 

activities during the Review Period. The Commission has not determined whether any finding 

discussed in this Report constitutes a “material regulatory deficiency,”45 but may do so in the 

future. 

 45 15 U.S.C. § 78o-7(p)(3)(C)(ii).
2016 Section 15E Examinations Summary Report Page 13

In the following Sections of this Report, the numbered headers identify in general terms the 

Staff’s findings concerning one or more NRSROs, and the paragraph(s) following each 

numbered header provide additional detail concerning these findings and the Staff’s 

corresponding recommendations.

A. Review Area: Adherence to Policies, Procedures, and Methodologies 

The Staff reviewed rating actions of each NRSRO for certain issuers and obligors to determine 

whether the NRSRO operated in accordance with its policies, procedures, methodologies,

criteria, and models. In addition, the Staff reviewed NRSROs’ other ratings-related activities 

such as the development and application of methodologies, criteria, and models. The Staff also 

reviewed rating files and documentation of other ratings-related activities to evaluate whether 

each NRSRO adhered to recordkeeping requirements. To select rating files to review, the Staff 

used a risk-based sampling process that is consistent with its overall risk assessment approach 

described in Section II.B of this Report and considered factors including but not limited to the 

significance of the rated asset class to the financial markets and the NRSRO’s business, the 

NRSRO’s activity in the rated asset class, the likelihood of impact on investors if a rating was 

not determined in accordance with the NRSRO’s methodologies and procedures, news reports 

and developments concerning NRSROs or particular asset classes, TCRs, and information the 

Staff learned during examinations. 

The Staff’s essential findings regarding NRSROs conducting ratings-related activities in 

accordance with their policies, procedures, methodologies, criteria, and models are discussed in 

this Section of this Report. The Staff’s essential findings regarding NRSROs’ adherence to 

policies and procedures related to other Section 15E Review Areas are generally discussed in 

later Sections of this Report. Instances where policies, procedures, and methodologies need to 

be established or improved are also generally discussed in later Sections of this Report.

The Staff’s essential findings regarding whether each NRSRO has conducted its business in 

accordance with its policies, procedures and methodologies are as follows:

1. Certain NRSROs did not always properly apply or adhere to their methodologies, criteria, 

or policies and procedures for determining ratings. 

A larger NRSRO’s ratings of a certain type of ABS transactions did not adhere to its policies and 

procedures concerning surveillance and data quality. Specifically, analytical personnel did not 

review information concerning these securities as frequently as required by this NRSRO’s 

surveillance policies and procedures, which resulted in these ratings not being updated in a 

timely manner. Moreover, the NRSRO did not review, or sufficiently document its review, of 

relevant information for a significant number of ratings concerning these ABS. The Staff 

recommended that the NRSRO ensure it adheres to its policies and procedures and data quality 

standards for surveillance, affirmation, and withdrawal of its ratings. 

A larger NRSRO did not properly apply its methodology when determining or reviewing certain 

other ABS ratings. Moreover, in contravention of its methodologies and its policies and 
2016 Section 15E Examinations Summary Report Page 14

procedures concerning ratings and error correction, this NRSRO refrained from taking rating 

actions concerning these ABS for several months and then initially placed the ratings on negative 

credit watch rather than downgrading them. Additionally, at a regional office of the NRSRO, 

certain analysts incorrectly applied the NRSRO’s methodology and policies and procedures 

concerning credit watch and rating publications to some ratings and did not appear to understand

the applicable methodology and policies and procedures. The Staff recommended that the

NRSRO ensure that its analysts understand and correctly apply its methodologies and policies

and procedures for determining ratings, and provide additional training to analysts concerning 

these subjects. The Staff also recommended that the NRSRO ensure it adheres to its error 

correction policy, and review whether there is sufficient oversight and controls in its regional 

offices.

At a larger NRSRO, an analyst used incorrect model inputs when determining certain ABS 

ratings. After these model input errors were discovered, this larger NRSRO did not inform 

specified NRSRO personnel of the error as required by its policies and procedures. Moreover, in 

connection with the initial determination of these ratings and the review of these ratings, the 

NRSRO did not document the rationale for differences between the ratings implied by the model 

and the final rating, as required by Rule 17g-2(a)(2)(iii) and its policies and procedures. The 

Staff recommended that the NRSRO ensure it adheres to Rule 17g-2(a)(2)(iii) and its policies 

and procedures concerning document retention and model error correction. 

In addition, a larger NRSRO’s policies and procedures require that models used for credit ratings 

must be reported to and tracked by the group responsible for model validation, and that 

temporary use of a model that has not been validated must also be reported and tracked. 

However, analysts in the NRSRO’s ABS group used a model to determine ratings prior to 

reporting the model to the group responsible for validation, and did not report and track some 

models that were used in the rating process prior to being validated. The Staff recommended 

that the NRSRO ensure it adheres to its policies and procedures concerning model version 

control and model tracking. 

A larger NRSRO did not sufficiently document or clearly disclose its application of assumptions 

that materially deviated from its published methodologies, as required by Rule 17g-2(b)(2) and 

its policies and procedures, when determining certain ratings of residential mortgage-backed 

securities (“RMBS”). Also, several RMBS ratings issued by the NRSRO did not document the 

rationale for deviations between the model-implied rating and the final rating assigned, as 

required by Rule 17g-2(a)(2)(iii) and its policies and procedures. The Staff recommended that 

the NRSRO enhance and adhere to its policies and procedures for the documentation and 

disclosure of material deviations from methodologies, and ensure compliance with Rule 17g-2 

and its document retention requirements. 

A smaller NRSRO applied incorrect identifiers to several ratings or rated entities, which resulted 

in errors in this NRSRO’s internal records and ratings transition information. The Staff 

recommended that the NRSRO enhance its internal controls to ensure adherence to its ratings 

identifiers and other policies and procedures.
2016 Section 15E Examinations Summary Report Page 15

2. Certain NRSROs did not make all required disclosures for certain ratings or did not 

disclose other required ratings-related information.

At a larger NRSRO, the rating publications and/or information disclosure forms for numerous 

rating actions did not accurately disclose the methodologies applied to determine the ratings, in 

contravention of its own policies and procedures and Rule 17g-7(a)(1)(ii)(B). 

In some instances, a smaller NRSRO did not accurately disclose certain information concerning 

the criteria applied to determine the rating and the solicited status of ratings, as required by its 

policies and procedures. 

A smaller NRSRO did not publish information disclosure forms for some preliminary credit 

ratings as required by Rule 17g-7(a), and for one rating action, the Rule 17g-7(a)(1)(iii) 

attestation was not signed by the rating committee chair as required by its policies and 

procedures. The NRSRO also did not update ratings-related XBRL information on its website 

monthly as required by Rule 17g-7(b) and its policies and procedures. 

The Staff recommended that these NRSROs ensure they publish complete and accurate 

disclosures for all applicable ratings as required by Rule 17g-7(a) and their policies and 

procedures, and also recommended that a smaller NRSRO ensure it discloses credit rating history 

information with the frequency required by Rule 17g-7(b) and its policies and procedures.

3. In some instances, certain NRSROs did not adhere to their policies and procedures 

concerning surveillance and/or withdrawals of outstanding ratings. 

A smaller NRSRO did not adhere to its policies and procedures concerning ratings surveillance. 

Two of the NRSRO’s ratings remained under review significantly longer than the time period 

permitted by its procedures. Also at this NRSRO, some ratings remained on this NRSRO’s 

public website for a significant period of time after it ceased conducting surveillance of these 

ratings. The Staff recommended that the NRSRO enhance and adhere to its policies and 

procedures concerning ratings surveillance, ratings under review, and discontinued ratings. 

A smaller NRSRO withdrew its ratings of some issuers but did not publish rating reports in 

connection with these withdrawals, as required by its policies and procedures. The Staff 

recommended that the NRSRO ensure adherence to its policies and procedures for the 

withdrawal of credit ratings. 

A smaller NRSRO did not conduct surveillance reviews of numerous ratings consistently with its

public disclosures concerning its surveillance process. The Staff recommended that the NRSRO 

consider revising its public disclosures to better describe its surveillance practices.

4. In some instances, certain NRSROs did not adhere to applicable laws and/or their policies 

and procedures when determining or reviewing some rating actions.
2016 Section 15E Examinations Summary Report Page 16

At a larger NRSRO, one final rating action was issued without first holding a rating committee 

meeting concerning a related issuer, as required by its policies and procedures, and some other 

ratings did not correctly document the applicable criteria as required by Rule 17g-2 and its 

policies and procedures. Several rating files of a larger NRSRO were missing certain 

documents, including transaction documents and model-related documents, in contravention of 

Rule 17g-2(b)(7) and this NRSRO’s policies and procedures. 

At a smaller NRSRO, several rating files did not contain complete and accurate rating committee 

minutes, conflict of interest attestations, document checklists, and internal emails concerning the 

ratings, in contravention of Rules 17g-2(b)(2) and (7) and its policies and procedures. For some 

ratings issued by a smaller NRSRO, internal documents did not indicate whether these ratings 

were identified for further review and the rating publications did not explain the difference 

between the rating implied by the model and the assigned rating and/or did not disclose 

adjustments to model inputs, as required by its policies and procedures. At a smaller NRSRO, 

numerous rating files did not contain properly completed conflict of interest certifications or 

other rating committee records required by its policies and procedures and Rule 17g-2(b). 

The Staff recommended that these NRSROs ensure they adhere to applicable laws and policies 

and procedures concerning determining ratings and make and retain or retain all required

documents.

5. In some instances, certain NRSROs did not adhere to their policies and procedures 

concerning protection of MNPI such as pending ratings and non-public information obtained to 

determine ratings.

At a larger NRSRO, a pending rating was shared with NRSRO personnel who were not involved 

in determining the rating and did not need this information to perform their job responsibilities, 

which is inconsistent with the requirements of Section 15E(g) and Rule 17g-4. A larger NRSRO 

prematurely published a rating release concerning a pending business transaction by an issuer 

before the issuer had publicly announced the transaction, in contravention of of Section 15E(g) 

and Rule 17g-4(a)(3). A smaller NRSRO disseminated a new rating prior to providing the issuer 

with an opportunity to decline the rating, in contravention of its policies and procedures. At a 

smaller NRSRO, there were several instances where NRSRO employees emailed MNPI 

concerning the rating business to their personal email accounts, which was prohibited by this 

NRSRO’s policies and procedures.

The Staff recommended that these NRSROs ensure their employees adhere to all requirements of 

Section 15E(g) and Rule 17g-4 as well as their policies and procedures concerning protection of 

MNPI.

B. Review Area: Management of Conflicts of Interest 

The Staff’s essential findings regarding the management of conflicts of interest are as follows:
2016 Section 15E Examinations Summary Report Page 17

1. Certain NRSROs’ policies and procedures for separating analytical activities from sales 

and marketing activities and preventing analytical activities from being influenced by sales and 

marketing considerations did not address all of the conduct prohibited by Rule 17g-5(c)(8). 

Also, certain NRSROs did not establish, maintain, enforce, or document effective internal 

controls to ensure that analytical activities are separated from sales and marketing activities and 

are not influenced by sales and marketing considerations. 

At a larger NRSRO, the policies and procedures intended to comply with Rule 17g-5(c)(8) 

defined sales and marketing activities too narrowly to satisfy the Rule requirements. For 

example, the NRSRO’s policies and procedures did not prohibit analytical personnel from 

discussing its rating methodologies and ratings for the purpose of soliciting or developing 

business, nor did they prohibit analysts from engaging in general discussions concerning 

contracts, pricing, fees, or sales. The Staff recommended that the NRSRO ensure its policies and 

procedures comply with Rule 17g-5(c)(8).

At a larger NRSRO, a sales and marketing manager attended a meeting that was purely analytical

in nature in order to serve as a translator at the meeting. While the NRSRO’s policies and 

procedures generally prohibited such conduct, its policies and procedures authorized its head of 

ratings to grant an exception to this prohibition and the NRSRO granted such an exception in this 

instance. However, Rule 17g-5(c)(8) strictly prohibits sales and marketing employees’ 

participation in analytical matters and does not permit an NRSRO to grant exceptions to the 

prohibited conduct, thus the provision in this NRSRO’s policies and procedures allowing it to 

grant exceptions and this sales and marketing employee’s attendance at the analytical meeting 

did not comply with the requirements of Rule 17g-5(c)(8). The Staff recommended that the

NRSRO revise its policies and procedures to ensure they meet the requirements of Rule 17g5(c)(8) and ensure its personnel adhere to Rule 17g-5(c)(8).

A smaller NRSRO’s policies and procedures did not prohibit all of the conduct covered by Rule 

17g-5(c)(8) and did not apply to all relevant NRSRO personnel. The NRSRO also did not have 

effective controls to ensure compliance with Rule 17g-5(c)(8). For example, the NRSRO

permitted analytical and sales and marketing personnel to attend joint meetings as long as the 

analytical personnel leave the meetings when commercial matters are discussed, but it did not 

monitor or document such joint meetings. A smaller NRSRO’s policies and procedures did not 

require its compliance department to be notified of instances where analytical personnel were 

exposed to sales and marketing information or commercial personnel were exposed to analytical 

information. A smaller NRSRO did not have policies and procedures that specifically and 

completely addressed all of the conduct prohibited by Rule 17g-5(c)(8) and applied to all 

applicable NRSRO personnel. The Staff recommended that these NRSROs establish, maintain, 

and enforce written policies and procedures that restrict all activities prohibited by Rule 17g5(c)(8) and apply to all applicable personnel. The Staff also recommended that one of these 

NRSROs enhance its controls over meetings that are attended jointly by analytical and sales and 

marketing personnel, and that another one of these NRSROs enhance its policies and procedures 

to address instances where analysts are exposed to rating fee information.
2016 Section 15E Examinations Summary Report Page 18

A smaller NRSRO permitted sales and marketing personnel to attend meetings with analysts and 

issuers as long as sales and marketing activities do not occur and confidential ratings information 

is not discussed at these meetings. However, the NRSRO did not monitor or document such 

meetings. The Staff recommended that the NRSRO enhance its controls over meetings that are 

attended jointly by sales and marketing and analytical personnel to ensure compliance with Rule 

17g-5(c)(8). In addition, when reviewing the NRSRO’s compliance logs, the Staff identified 

several instances where the NRSRO’s sales and marketing personnel or third-parties emailed fee 

information to the NRSRO’s analysts. The Staff recommended that the NRSRO enhance its 

policies and procedures and controls to ensure that analytical personnel are not exposed to fee 

information and to address instances where analytical personnel are exposed to fee information. 

A smaller NRSRO’s policies and procedures permitted analysts to engage in certain conduct that 

may be inconsistent with Rule 17g-5(c)(8) in some instances. The Staff recommended 

enhancements to the NRSRO concerning its policies and procedures and controls related to Rule 

17g-5(c)(8).

2. The Staff observed weaknesses in certain NRSROs’ compliance with the prohibition on 

advising issuers, obligors, or sponsors concerning assets or their activities that are subject to the 

NRSRO’s rating. 

A larger NRSRO had policies and procedures prohibiting analytical personnel from engaging in 

conduct that is prohibited by Rule 17g-5(c)(5) or could compromise the analyst’s objectivity in 

determining a rating. However, it appeared that a senior analytical manager at the NRSRO 

communicated orally to an ABS issuer that credit enhancements could be reduced, 

communicated with ABS issuers concerning subjects other than analytical matters, and 

mentioned market share considerations in discussions with a junior analyst, in contravention of 

these policies and procedures. Moreover, the NRSRO’s policies and procedures required 

specific personnel to review the rating and the NRSRO to issue a publication that confirms or 

revises the rating and discloses the potential violation of the prohibition on advising issuers. In 

this instance, the NRSRO reviewed the rating and determined there was no impact on the credit 

enhancement level, but this review was not conducted by the required personnel and the NRSRO 

did not issue the required publication. The Staff recommended that the NRSRO ensure all of its 

employees comply with its policies and procedures concerning the prohibition on advising 

issuers, and that the NRSRO adhere to its policies and procedures concerning remedial measures 

if its personnel engage in such prohibited conduct. 

A larger NRSRO prohibited its personnel from making recommendations to issuers as required 

by Rule 17g-5(c)(5), but it did not have effective internal controls, including policies and 

procedures and sufficient documentation, to ensure that analytical personnel did not engage in 

such prohibited conduct. For example, the NRSRO’s analysts communicated initial analysis and 

feedback to issuers orally and did not sufficiently document the timing or content of such 

communications, which limited the feasibility of determining whether the analyst improperly 

made a recommendation. In addition, the NRSRO’s policies and procedures and training 

materials were unclear regarding whether and how the NRSRO’s personnel were permitted to

provide issuers with initial information concerning credit enhancement. The Staff recommended 
2016 Section 15E Examinations Summary Report Page 19

that the NRSRO review its policies, procedures, and training materials to ensure they clearly 

define prohibited conduct regarding advising issuers, and that it maintain effective internal 

controls and sufficient documentation to comply with the prohibition in Rule 17g-5(c)(5).

3. An NRSRO did not have sufficient policies and procedures and effective internal controls 

concerning issuing or maintaining ratings of entities that have ownership interests in this 

NRSRO.

A larger NRSRO did not have a policy and procedure prohibiting it from issuing or maintaining 

a rating on an entity that has a controlling interest in it. The Staff recommended that the NRSRO 

establish policies and procedures to address the conflict of interest prohibited by Rule 17g5(c)(3).

A larger NRSRO acknowledged that its issuing ratings for entities that have ownership interests 

in its parent company constitutes a conflict of interest. The NRSRO’s policies and procedures

required it to take certain measures to manage this conflict if it issued or maintained a rating on 

an entity that has a significant ownership interest in its parent company. However, this policy 

did not apply to the NRSRO’s ratings of subsidiaries or affiliates of an entity that has a 

significant ownership interest in its parent company. The Staff recommended that the NRSRO 

ensure that it manages conflicts of interest related to its issuing and maintaining ratings of 

entities that have significant ownership interests in its parent company and the subsidiaries or 

affiliates of such entities.

4. There were weaknesses in certain NRSRO’s policies, procedures, and internal controls 

concerning various other conflicts of interest. 

A larger NRSRO published research concerning issuers and obligors for which the NRSRO also 

issued and maintained credit ratings. These research publications often provided context for a 

credit rating concerning such issuers and obligors, and the NRSRO sometimes considered its 

research publications when reviewing its ratings of these issuers and obligors. The same 

analytical personnel generally worked on both ratings and related research concerning particular 

issuers or obligors. However, the NRSRO’s policies, procedures, and controls did not prohibit 

issuers and obligors from improperly influencing the content of research publications. 

Moreover, it appeared to the Staff that the NRSRO’s sales and marketing personnel suggested

the subjects that research publications should cover in order to assist with developing business. 

The Staff recommended that the NRSRO enhance its internal controls, including policies and

procedures, concerning research publications to ensure that they address conflicts of interest 

covered by Rules 17g-5(b)(1), (2), and (9) related to being paid by issuers, underwriters, 

obligors, and sponsors.

A larger NRSRO’s policies and procedures did not prohibit certain unfair, coercive, or abusive 

practices as required by Rules 17g-6(a)(1) through (3). The NRSRO’s policies and procedures 

only prohibited it from engaging in the conduct addressed by Rules 17g-6(a)(1) through (3) if 

done for an anticompetitive purpose, even though anticompetitive purpose is not a requirement 
2016 Section 15E Examinations Summary Report Page 20

of Rules 17g-6(a)(1) through (3). The Staff recommended that the NRSRO ensure that its 

policies and procedures fully prohibit the unfair, coercive, or abusive practices as required by 

Rule 17g-6.

A smaller NRSRO’s policies and procedures for handling rated entities’ comments concerning

draft rating publications did not effectively ensure that rated entities did not improperly influence 

the content of its ratings or ratings publications. The Staff recommended that the NRSRO 

enhance its policies, procedures, and internal controls to ensure effective management of the

conflicts of interest covered by Rules 17g-5(b)(1) and (2) related to being paid by issuers, 

underwriters, obligors, and sponsors.

A smaller NRSRO posted on its social media account non-ratings publications that were written

by an entity related to this NRSRO. Such postings were inconsistent with the NRSRO’s policies 

and procedures requiring separation of ratings and non-ratings activities and with Rule 17g5(b)(3), which requires an NRSRO to disclose, address, and manage the conflict of being paid 

for services in addition to determining ratings by issuers, underwriters, or obligors that have paid

the NRSRO to determine a rating. The Staff recommended that the NRSRO enhance its internal 

controls, including policies and procedures, to manage the conflict related to its social media 

accounts and providing services in addition to ratings. 

A smaller NRSRO did not have written policies and procedures governing its periodic reviews of 

employees’ securities holdings, and did not accurately document and internally report on such 

reviews. The Staff recommended that the NRSRO consider enhancing its documentation of and 

reporting on its securities monitoring activities. 

At a smaller NRSRO, the seating arrangements at one of its regional offices did not separate 

analytical personnel from different groups, which resulted in analytical personnel having access 

to information that was not related to their analytical responsibilities and increased the risk that 

they could engage in securities transactions using MNPI related to issuers this NRSRO rates. 

The Staff recommended that the NRSRO ensure its office seating arrangements are consistent 

with its analysts’ responsibilities and policies and procedures concerning securities ownership 

and MNPI.

C. Review Area: Implementation of Ethics Policies

Each NRSRO has implemented written ethics policies and procedures. During the 2016

examinations, the Staff reviewed each NRSRO’s ethics policies and procedures, as well as a 

sample of each NRSRO’s employee certifications or monitoring activities concerning its code of 

ethics. Much of the content of these policies and procedures addresses other related Review 

Areas. As such, the Staff’s findings and recommendations related to an NRSRO’s implemented 

ethics policies and procedures are addressed in other Sections of this Report.
2016 Section 15E Examinations Summary Report Page 21

D. Review Area: Internal Supervisory Controls

The Staff reviewed each NRSRO’s overall control structure, including the internal control 

structure related to determining credit ratings. 

The Staff’s essential findings regarding internal supervisory controls are as follows:

1. At certain NRSROs, policies and procedures concerning the rating process did not meet 

all legal requirements or had other weaknesses. 

There were weaknesses in a larger NRSRO’s internal controls for dependent ratings, including 

internal systems that reflect dependencies between ratings or issuers and the processes for 

ensuring that dependent ratings were changed promptly when there was a change to a related 

rating or issuer. The Staff recommended that the NRSRO enhance its internal controls to ensure 

that dependent ratings are reviewed in a timely manner and that rating changes for dependent 

ratings are published in a timely manner. 

A smaller NRSRO did not have effective controls to ensure that rating committee materials 

explain criteria deviations and differences between the model-implied rating and the final rating. 

The NRSRO also did not have policies and procedures to ensure the review of information

received and used in the rating process for completeness, quality, and reliability, or to disclose 

this information as required by Rules 17g-7(a)(1)(ii)(E) and (I). The Staff recommended that the 

NRSRO ensure that its rating committee materials consistently explain criteria and model 

deviations, and that it establish, maintain, enforce, and document policies, procedures, and 

internal controls to evaluate and make required disclosures related to data and information used

in the ratings process.

A larger NRSRO and a smaller NRSRO did not have policies and procedures reasonably 

designed to ensure that they consistently apply their rating symbol, number, or score, as required 

by Rule 17g-8(b)(3). In addition, the smaller NRSRO did not have policies and procedures 

reasonably designed to determine the probability of default, as required by Rule 17g-8(b)(1). 

There were also discrepancies between the smaller NRSRO’s ratings definitions and default 

probability tables. The Staff recommended that the NRSROs establish, maintain, enforce, and 

document policies and procedures to comply with Rule 17g-8(b)(3). The Staff further

recommended that the smaller NRSRO review its default probabilities and revise any 

discrepancies, and that it establish, maintain, enforce, and document policies and procedures 

reasonably designed to assess the probability of default as required by Rule 17g-8(b)(1). 

A smaller NRSRO did not appear to consider the factors concerning its internal control structure 

that are required to be considered by Rule 17g-8(d). The Staff recommended that the NRSRO 

ensure it considers the internal control factors specified in Rule 17g-8(d) and sufficiently 

documents its consideration of these factors.

A smaller NRSRO did not sufficiently document its internal control structure. The NRSRO did 

not have sufficient policies and procedures concerning its consideration of the factors required

by Rule 17g-8(d) concerning its internal control structure, nor did it document its consideration 
2016 Section 15E Examinations Summary Report Page 22

of these factors. The NRSRO also did not document its procedure for converting private ratings 

into public ratings, and its document retention policies and procedures did not comply with all 

the requirements of Rules 17g-2(a), (b), and (c). The Staff recommended that the NRSRO 

enhance its policies, procedures, and documentation regarding its consideration of the factors 

required by Rule 17g-8(d). The Staff also recommended that the NRSRO establish, maintain, 

enforce, and document policies and procedures concerning conversion of a private rating into a 

public rating as well as policies and procedures concerning document retention that satisfy the 

requirements of Rule 17g-2(a) through (c).

At a smaller NRSRO, there were weaknesses in some policies and procedures concerning the 

rating process. Some of the NRSRO’s policies and procedures were not timely updated to reflect 

its ratings operations and applicable laws, and other policies and procedures were not internally 

consistent or referenced other policies that were no longer in effect. The Staff recommended that 

the NRSRO improve its internal controls related to revising policies and procedures governing 

the rating process in order to facilitate compliance with Section 15E(c)(3)(A). 

A smaller NRSRO’s policies and procedures did not clearly and consistently define the 

personnel and roles that were responsible for determining and reviewing ratings, which posed the 

risk that unauthorized personnel could participate in a rating committee or other rating activities. 

The NRSRO also did not have policies and procedures concerning the requirement in Section 

15E(u) to report to law enforcement authorities material information concerning securities law 

violations by a rated entity. The Staff recommended that the NRSRO revise its policies and 

procedures to address these weaknesses. 

2. Certain NRSROs did not have effective policies and procedures or internal controls

concerning the development, documentation, or application of methodologies, criteria, or 

models.

A larger NRSRO’s policies and procedures concerning model development did not 

comprehensively describe the process or identify the responsible personnel for approving 

quantitative models before their use in the rating process. The NRSRO also did not have 

effective internal controls, including policies and procedures, to manage the risk of model input 

errors. The Staff observed that a significant number of the NRSRO’s potential or actual 

analytical errors resulted from incorrect model inputs. The Staff recommended that the NRSRO 

establish, maintain, enforce, and document an effective internal control structure consistent with 

Section 15E(c)(3)(A), including policies and procedures, concerning the approval of model 

changes and the review and documentation of model inputs. 

A larger NRSRO’s criteria validation policies, procedures, and processes did not require it to 

consider whether criteria assumptions should be updated to reflect more timely data underlying 

these assumptions. In addition, the NRSRO’s assessment of the materiality of model updates did 

not consider the cumulative impact of model updates. The NRSRO also did not 

comprehensively log or track potential model errors. The Staff recommended that the NRSRO 

establish, maintain, enforce, and document an effective internal control structure consistent with 

Section 15E(c)(3)(A), including policies and procedures, for considering the timeliness of data 
2016 Section 15E Examinations Summary Report Page 23

when conducting criteria validation, assessing the materiality of model updates, and tracking 

model errors.

A smaller NRSRO did not have policies and procedures required by Rule 17g-8(a)(3) to ensure 

that it consistently applies material changes to procedures and methodologies that it uses to 

determine ratings. The NRSRO also did not have policies and procedures required by Rule 17g8(a)(4) to ensure that it promptly publishes information concerning material changes to or the 

existence of errors in the procedures and methodologies, including models and data inputs, that it 

uses to determine ratings. Moreover, the NRSRO did not have a system for model version 

control. The Staff recommended that the NRSRO establish, maintain, enforce, and document 

policies and procedures for compliance with Rules 17g-8(a)(3) and (4) and model version 

control.

A smaller NRSRO did not have effective policies and procedures for documenting models and 

did not have a system for model version control, thus its policies and procedures were not 

reasonably designed to ensure that its models are developed and modified consistently with its 

policies and procedures and that changes to its models are applied consistently, as required by 

Rule 17g-8(a)(2) and (3). The NRSRO also did not require documentation of its reviews of 

transaction-specific cash-flow models to confirm the models reflected the terms of the 

transaction being rated and to ensure the documentation of the rationale for differences between 

the ratings implied by the model and the final rating as required by Rule 17g-2(a)(2)(iii). The 

Staff recommended that the NRSRO establish, maintain, enforce, and document effective 

internal controls, including policies and procedures, for model documentation and versioncontrol and for the review of transaction-specific cash-flow models. 

A smaller NRSRO did not have effective policies, procedures, and internal controls for granting

exceptions to its published methodologies and for assigning a final rating that differs from the 

rating implied by the model. The NRSRO also did not have policies, procedures, and controls 

for internally tracking and publicly disclosing such exceptions or differences between the modelimplied rating and the rating assigned. The Staff recommended that the NRSRO establish, 

maintain, enforce, and document policies and procedures concerning exceptions to published 

methodologies and assignment of a final rating that differs from the model-implied rating, 

including documenting the rationale for differences between the ratings implied by the model 

and the final rating as required by Rule 17g-2(a)(2)(iii).

3. There were weaknesses in certain NRSROs’ policies, procedures, or internal controls to 

ensure that rating publications contained complete, accurate, and timely information concerning 

the particular rating actions or the methodologies and criteria applied to those rating actions.

A smaller NRSRO did not promptly and transparently address the Staff’s recommendation from 

the 2015 Section 15E examination concerning its disclosure in rating publications of 

methodology deviations. Throughout the course of the 2016 Section 15E exam, the NRSRO 

provided the Staff with vague information concerning the status of its response to this 

recommendation. Moreover, the NRSRO took almost one year from receipt of the Staff’s 

recommendation from the 2015 Section 15E exam to finalize a procedure for disclosing 
2016 Section 15E Examinations Summary Report Page 24

methodology deviations. The Staff recommended that the NRSRO must ensure that it addresses 

all of the Staff’s recommendations in a timely manner, and separately from this recommendation, 

the Staff specifically conveyed to this NRSRO’s senior personnel its concerns regarding this 

untimely response.

A smaller NRSRO did not have effective internal controls to ensure that the information 

disclosure forms that it published pursuant to Rule 17g-7(a) were complete and accurate for 

rating publications that contain ratings of several issuers or securities. The Staff recommended 

that the NRSRO ensure that it publishes complete and accurate information disclosure forms for 

all rating publications, including for rating publications that concern several rating actions.

A larger NRSRO did not have effective policies, procedures, and internal controls to ensure that 

its disclosures concerning methodology application and rating errors were complete, accurate, 

and transparent. The NRSRO’s methodology for certain RMBS surveillance ratings did not 

clearly explain the circumstances when a certain analytical approach is applied, nor did rating 

publications clearly explain this analytical approach was applied. Moreover, the NRSRO used a 

publication template for ratings changes resulting from model errors; this publication template, 

and the rating publications that were based on this template, included a statement that the 

securities’ performance contributed to the rating change, even if the model error was the key 

driver for the rating change. The Staff recommended that the NRSRO ensure it makes clear 

disclosures concerning the analytical approaches it takes when applying its methodology, and 

that it establish, maintain, enforce, and document effective internal controls consistent with 

Section 15E(c)(3)(A), including policies and procedures, to ensure its rating publications are 

transparent and detailed. 

A larger NRSRO did not have effective policies, procedures, and controls to disclose certain 

information in its information disclosure forms as required by Rule 17g-7(a). The NRSRO 

attempted to comply with Rule 17g-7(a)(1)(ii)(M) by developing one distinct set of sensitivity 

disclosures for each of its ratings business lines. However, the NRSRO’s assumptions and 

sensitivity disclosures were not specific to the particular rating actions; rather, all ratings in a 

particular asset class would have nearly identical sensitivity disclosures notwithstanding the

variety of assumptions and factors that could be applicable within an asset class. The Staff 

recommended that the NRSRO ensure its disclosures concerning assumptions and sensitivity are 

specific to the particular rating as required by Rule 17g-7(a)(1)(ii)(M).

A larger NRSRO did not have effective policies, procedures, and internal controls related to Rule 

17g-7(a)(3), which exempts NRSROs from publishing an information disclosure form in certain 

specified circumstances where the NRSRO has a reasonable basis to conclude that the rated 

security or money-market instrument will only be offered and sold outside of the United States. 

For example, the NRSRO appeared to rely entirely on a statement by the issuer or underwriter 

concerning the applicability of this exemption and did not have any process for determining or 

documenting the reasonableness of its reliance on the issuer’s or underwriter’s statement. The 

Staff recommended that the NRSRO enhance its internal controls, including policies and 

procedures, to ensure its utilization of the exemption is consistent with the parameters of Rule 

17g-7(a)(3).
2016 Section 15E Examinations Summary Report Page 25

A smaller NRSRO’s policies and procedures did not provide a timeframe for publishing a press 

release concerning a preliminary rating. The Staff recommended that the NRSRO consider 

revising its policies and procedures to include a timeframe for publishing such press releases. 

A smaller NRSRO did not have policies and procedures for disclosing the version of the rating 

procedure or methodology used for a particular rating as required by Rule 17g-8(a)(5). The Staff 

recommended that the NRSRO enhance its policies and procedures to address the requirements 

of Rule 17g-8(a)(5). 

A smaller NRSRO did not have policies and procedures required by Rule 17g-8(a)(5) for 

disclosing the version of the procedure or methodology applied to a particular rating, and 

numerous information disclosure forms published by the NRSRO did not disclose the proper 

version of the methodology applied to those ratings as required by Rule 17g-7(a)(1)(ii)(B). The 

Staff recommended that the NRSRO establish, maintain, enforce, and document policies and 

procedures for disclosing the version of the procedure or methodology applied as required by 

Rule 17g-8(a)(5), and internal controls to make the disclosures concerning the version of the 

procedure or methodology applied as required by Rule 17g-7(a)(1)(ii)(B).

A smaller NRSRO did not have effective internal controls to ensure that rating information is 

disseminated in a compatible and useable format, which resulted in a third-party publishing some 

of these NRSRO’s ratings inaccurately. The Staff recommended that the NRSRO establish, 

maintain, enforce, and document effective internal controls consistent with Section 15E(c)(3)(A),

including policies and procedures, to prevent the publication of erroneous ratings.

A smaller NRSRO did not publish information disclosure forms for any ratings for several 

months as a result of its incorrect reliance on the Rule 17g-7(a)(3) exemption. Also, the NRSRO 

sometimes issued a rating and a summary rating release simultaneously, and published a 

complete rating release a few days later. However, the NRSRO did not disclose this practice. 

Moreover, even after the NRSRO began publishing information disclosure forms, it did not 

publish the information disclosure form at the same time it issued the rating; rather it published 

the information disclosure form a few days later when the complete rating release was published. 

The Staff recommended that the NRSRO ensure it publishes information disclosure forms 

consistently with the requirements of Rule 17g-7(a) for all ratings, and that it consider enhancing 

its disclosures regarding its rating publication practice. 

A smaller NRSRO’s policies and procedures only required its information disclosure form to 

disclose the name of the applicable methodology applied to the rating and not the version of the 

procedure or methodology applied, in contravention of Rule 17g-8(a)(5). Moreover, the 

information disclosure forms published by the NRSRO did not include the version of the 

methodologies applied to the ratings, as required by Rule 17g-7(a)(1)(ii)(B). The Staff 

recommended that the NRSRO establish, maintain, enforce and document policies and 

procedures to disclose the version of the procedure or methodology applied pursuant to Rules 

17g-8(a)(5) and 17g-7(a)(1)(ii)(B). 

A larger NRSRO’s policies and procedures did not require it to publish an information disclosure 

form for rating withdrawals. The Staff recommended that the NRSRO revise its policies and 
2016 Section 15E Examinations Summary Report Page 26

procedures to require publication of the information disclosure form for all types of ratings 

subject to Rule 17g-7(a)(1).

A larger NRSRO’s policies and procedures did not require it to publish information disclosure 

forms for some ratings as required by Rule 17g-7(a). The Staff recommended that the NRSRO 

revise its policies and procedures to require publication of the information disclosure form for all 

types of ratings subject to Rule 17g-7(a)(1). 

A smaller NRSRO did not have policies, procedures, and internal controls that specifically 

addressed certain requirements of Rule 17g-7(a), including that it have a reasonable basis to rely 

on the exemption in Rule 17g-7(a)(3). Moreover, the Staff observed one instance where the 

NRSRO did not publish an information disclosure form for one rating action as required by Rule 

17g-7(a). The Staff recommended that the NRSRO ensure it complies with Rule 17g-7(a).

4. There were weaknesses in certain NRSROs’ policies, procedures, and controls regarding 

IT, cybersecurity, or access controls. 

At a larger NRSRO, there were weaknesses in controls over the change management process. 

These weaknesses, which consisted of a process failure and a misinterpretation of business 

requirements concerning a system change, resulted in incidents where changes or updates to this 

NRSRO’s IT system caused improper delays in publishing required disclosures for a significant

number of rating actions or improper withdrawals of a significant number of ratings. The Staff 

recommended that the NRSRO implement measures to assist analytical and IT personnel with 

developing system changes and consider implementing quality assurance measures to identify 

problems related to IT system changes.

A larger NRSRO’s policies and procedures contained inconsistent timeframes for remediation of 

vulnerabilities, and personnel did not always follow the process for exceptions to vulnerability 

remediation policies and procedures. The Staff recommended that the NRSRO ensure that it 

establishes and adheres to consistent vulnerability management policies, procedures, and 

controls. 

A larger NRSRO did not have effective internal controls over vulnerability management. The 

NRSRO did not conduct ongoing vulnerability scans for all of its IT applications and systems 

that contain MNPI, which could make this NRSRO vulnerable to inadvertent disclosure of MNPI 

or system disruption, and the NRSRO’s policies and procedures concerning certain vulnerability 

testing contained inconsistent timelines for remediation. The Staff recommended that the 

NRSRO ensure its policies and standards for vulnerability management are internally consistent, 

and consider expanding its scope of periodic vulnerability scanning to include all IT systems 

used in the rating process. 

A larger NRSRO’s policies and procedures did not provide a specific timeframe for changing IT 

access rights when an employee changes jobs or roles at the NRSRO. The Staff found one 

analyst at the NRSRO who, several months after being transferred to a new role, still had access 

to files of his former rating group that he did not need for his current role. The Staff 

recommended that the NRSRO consider enhancing its IT system access policies and procedures 
2016 Section 15E Examinations Summary Report Page 27

to ensure that changes are processed on a timely basis and NRSRO personnel’s access is 

appropriate.

A smaller NRSRO did not have procedures for creating or terminating user accounts for its IT 

systems or for reviewing access rights to such IT systems, and the Staff identified some instances 

where email accounts of former NRSRO employees remained active after they ceased 

employment with the NRSRO. In addition, the NRSRO’s policies did not specifically address 

use by one NRSRO employee of another NRSRO employee’s computer or email account, and 

the Staff identified one instance where an employee of the NRSRO sent a message from another 

employee’s email account. The Staff recommended that the NRSRO consider establishing, 

maintaining, enforcing, and documenting effective internal controls, including policies and 

procedures, that address access controls for all IT systems and prevent an employee’s use of 

other employees’ IT accounts. The Staff also recommended that the NRSRO conduct a review

to ensure that former employees’ email accounts have been terminated and are no longer in use.

A larger NRSRO did not sufficiently document its cybersecurity controls and processes, such as 

the frequency for conducting vulnerability scans, remediation timelines, tracking and reporting 

requirements, exception handling, and testing plans. The Staff recommended that the NRSRO 

enhance its policies and procedures to fully document its cybersecurity internal control 

requirements.

5. Certain NRSROs’ Form NRSRO filings and/or internal control reports contained 

incorrect information, were missing required information, or were not sufficiently detailed.

There were numerous insufficiencies in a smaller NRSRO’s filings with the Commission. As 

examples, the NRSRO’s filings did not provide information concerning its rating scales and its 

procedures and methodologies as required by Sections 15E(a)(1)(B)(i) and (ii) and the Form 

NRSRO Instructions, did not follow some other requirements of the Form NRSRO Instructions, 

did not accurately report its 20 largest clients as required by Section 15E(a)(1)(B)(viii), and did 

not file the certification that must accompany its audited financial statements. Moreover, the 

NRSRO also did not file its annual financial reports and other reports required by Rule17g-3 

within the timeframe required by Rule 17g-1(f). Also, the NRSRO’s report concerning 

management’s assessment of its internal controls did not address the requirements of Rule 17g3(a)(7)(i)(B) concerning the effectiveness of its internal control structure, and the CEO statement

accompanying this report did not satisfy the requirements of Rule 17g-3(b)(2). The Staff 

recommended that the NRSRO establish, maintain, enforce, and document effective internal 

controls, including policies and procedures, to ensure its filings with the Commission and related 

certifications are accurate, timely, and consistent with applicable legal requirements.

The Rule 17g-3 reports concerning management’s assessment of internal controls filed by a 

larger NRSRO and a smaller NRSRO were not sufficiently detailed. These reports reiterated 

language in Rule 17g-3 concerning management’s responsibility and internal controls generally, 

but did not provide sufficient detail concerning the NRSROs’ specific internal controls that 

govern the implementation of and adherence to policies, procedures, and methodologies for 

determining credit ratings. Nor did the reports state whether these NRSROs identified any 

material weaknesses or deficiencies, and if so how they were addressed. The Staff recommended 
2016 Section 15E Examinations Summary Report Page 28

that these NRSROs ensure that their internal controls reports describe in sufficient detail 

management’s responsibility in establishing and maintaining an effective internal control 

structure and the effectiveness of its internal controls. In addition, the larger NRSRO’s Rule 

17g-3 reports were not filed in accordance with the SEC’s procedural requirements concerning 

EDGAR filings. The Staff recommended that the larger NRSRO ensure it adheres to all 

Commission requirements regarding submission of Rule 17g-3 reports.

A smaller NRSRO’s Rule 17g-3 report concerning management’s assessment of internal controls 

did not address certain personnel’s role in establishing, implementing, and enforcing the internal 

control structure, even though the NRSRO stated elsewhere that these personnel had such a role. 

In addition, the NRSRO did not have policies and procedures concerning management’s 

evaluation of the internal control structure, which ultimately formed the basis of its management 

certification concerning its internal control structure. There were also insufficiencies in the 

NRSRO’s Form NRSRO filing. As examples, certifications submitted in connection with its

annual certification and certain reports were not signed as required by applicable laws, Form 

NRSRO Exhibits were not consistent with the Form NRSRO Instructions, and the annual 

certification was submitted after the deadline established by Section 15E(b)(2) and Rule 17g1(f). The Staff recommended that the NRSRO comply with all applicable regulations when 

filing documents with the Commission. 

A smaller NRSRO did not properly submit certain updated Form NRSRO Exhibits and did not 

post these Exhibits to its website within 10 business days as required by Rule 17g-1(i). The 

NRSRO also did not file its 17g-3 reports consistently with applicable laws. Moreover, the 

NRSRO’s Exhibit 2 filing did not provide sufficient information concerning its quantitative and 

qualitative models, metrics used to determine ratings, or information concerning whether 

changes to models and criteria are applied retroactively to existing ratings, or the location on its 

website where such information could be found. The Staff recommended that the NRSRO 

adhere to applicable legal requirements for filing Form NRSRO and Exhibits and establish 

procedures to ensure its Form NRSRO filings comply with all applicable rules.

A smaller NRSRO did not file its annual Form NRSRO certification and internal controls report 

and attestation within the time period required by Section 15E(b)(2) and Rules 17g-1(f) and 17g3(a), and it did not provide in Exhibit 1 certain information required by the Form NRSRO 

Instructions. The Staff recommended that the NRSRO ensure that its Form NRSRO filings and 

internal control reports are filed timely and in accordance with applicable legal requirements.

6. Certain NRSROs did not have effective internal controls to ensure appropriate and 

independent oversight over the rating process and/or the review and development of 

methodologies, criteria, and models. 

A smaller NRSRO’s policies and procedures permitted a rating group senior manager to serve as 

both secondary analyst and rating committee chair when determining or reviewing a rating. In 

addition, the NRSRO permitted rating group senior managers to oversee the group that develops 

methodologies and criteria while also serving as voting members on the committees that approve

new and revised methodologies and criteria. Moreover, the NRSRO’s senior credit officer was
2016 Section 15E Examinations Summary Report Page 29

responsible for supervising a group that was supposed to independently review criteria and 

methodologies and also was permitted to vote on the committees that initially approve 

methodologies and criteria. Such practices can result in personnel reviewing their own work 

rather than such work being reviewed separately by independent personnel. The Staff 

recommended that the NRSRO establish, maintain, enforce, and document internal controls 

reasonably designed to ensure that analytical and criteria development tasks are subject to 

appropriate and independent review. 

At a smaller NRSRO, rating releases for several issuers contained language that an analyst

copied from external sources and did not independently analyze. The NRSRO’s policies and 

procedures did not expressly prohibit such conduct by the analyst. The NRSRO’s investigation 

of this matter concluded that the language at issue was not likely to affect readers’ understanding 

of the rating publications, and also suggested that the analyst engaged in such conduct due to an 

overly heavy workload. For some issuers whose rating publications were affected by this 

conduct, the NRSRO promptly published revised rating releases that removed the improper 

language, but for other issuers, it only issued updated rating releases in accordance with its

regular surveillance procedures and timeline. The NRSRO’s rating publications policies were 

vague and provided the NRSRO with ample discretion concerning whether to issue an updated 

rating release, which appears to have contributed to its differing approaches for publishing 

revised rating publications. The Staff recommended that the NRSRO ensure that its staffing 

practices provide analysts with sufficient time and resources to produce ratings with integrity. 

The Staff also recommended that the NRSRO revise its policies and procedures to require that 

ratings work product is based on its personnel’s own work, and revise its policies concerning 

rating publications to provide more clarity and specificity concerning updating rating releases.

At a smaller NRSRO, one senior officer served as a voting member of the group that is 

responsible for approving the NRSRO’s methodologies and models and was also responsible for

auditing the effectiveness and quality of the NRSRO’s methodologies and models. Such 

practices resulted in this individual checking his/her own work and did not constitute 

independent oversight of the process for developing and approving methodologies and models. 

In addition, this senior officer did not have any dedicated staff to assist with completing these 

tasks. The Staff recommended that the NRSRO enhance the independence of its functions 

responsible for the development, approval, and audit of rating methodologies and models, and 

that it assess whether these functions have adequate staffing and resources and take any 

appropriate action in light of its assessment.

7. Certain NRSROs had some weaknesses in their standards or internal controls concerning 

training, experience, and competence. 

A smaller NRSRO had not established the required program for analytical training and testing by 

the effective date of Rule 17g-9. A smaller NRSRO did not sufficiently document its schedules 

for analytical training and testing. Also, the training that this NRSRO conducted or planned to 

conduct in a particular year only addressed some but not all asset classes in which this NRSRO is 

registered. A smaller NRSRO’s standards concerning training, experience, and competence did 

not require periodic testing. Moreover, all of these NRSROs’ training, experience, and 

competence standards did not explicitly mandate that at least one individual involved in 
2016 Section 15E Examinations Summary Report Page 30

determining a rating have at least three years of experience performing credit analysis, as 

required by Rule 17g-9(c). The Staff recommended that the NRSROs ensure that their analytical 

training, competence, and testing standards satisfy the requirements of Rule 17g-9(c) and are 

sufficiently documented. 

A larger NRSRO did not have effective internal controls to ensure all of its personnel complete 

training concerning its policies and procedures in a timely manner, and the Staff observed some

instances where the NRSRO’s employees did not receive timely training concerning its policies 

and procedures. The Staff recommended that the NRSRO enhance its internal controls regarding 

training.

8. There were weaknesses in policies, procedures, or controls related to prevention of the 

misuse of MNPI at certain NRSROs. 

At a larger NRSRO, certain pending ratings were disseminated on its restricted access websites 

shortly before they were posted on its public NRSRO website. Because pending ratings 

constitute MNPI until their publication by the NRSRO, this resulted in selective disclosure of 

MNPI to certain parties in contravention of Section 15E(g) and Rule 17g-4(a)(3). These 

selective disseminations appeared to result from the NRSRO not having a process to check that 

ratings information had been posted to its public website before it was published on restricted 

access sites. 

A smaller NRSRO shared a pending rating of an issuer with an unrelated third-party that 

solicited this NRSRO’s rating of certain bonds issued by that issuer. This pending rating of the 

issuer was MNPI, and should not have been shared with the third-party prior to the rating being 

finalized and published. At another smaller NRSRO, policies and procedures prohibiting 

NRSRO personnel from purchasing, selling, or otherwise benefitting from MNPI did not 

explicitly apply to money-market instruments, as required by Rule 17g-4(a)(2).

The Staff recommended that these NRSROs ensure they have policies and procedures and 

effective controls to protect MNPI as required by Section 15E(g) and Rule 17g-4.

9. Certain NRSROs’ public disclosures and internal controls related to non-NRSRO rating 

affiliates were insufficient.

An affiliate of a larger NRSRO that was not registered as an NRSRO issued numerous ratings, 

and its rating publications did not disclose that this affiliate was not part of the NRSRO and that 

its ratings were not NRSRO ratings. Moreover, the NRSRO’s website also did not sufficiently 

disclose that this affiliate was not part of the NRSRO. 

A smaller NRSRO did not sufficiently disclose on its website or in its rating publications that 

one of its affiliates was not registered as an NRSRO. The NRSRO also utilized non-NRSRO 

personnel to assist in determining numerous NRSRO ratings. However, such non-NRSRO 

personnel were not subject to the NRSRO’s policies and procedures requiring attestations that 
2016 Section 15E Examinations Summary Report Page 31

ratings were not influenced by conflicts of interest, even if such personnel participated in 

determining NRSRO ratings. Moreover, the NRSRO did not disclose in its Form NRSRO filings 

or in rating publications that non-NRSRO personnel may participate in determining NRSRO 

ratings. 

The Staff recommended that these NRSROs ensure they sufficiently disclose that ratings issued 

by their non-NRSRO affiliates are not NRSRO ratings. The Staff also recommended that the 

smaller NRSRO ensure that it makes adequate disclosures, and maintains effective internal 

controls consistent with Section 15E(c)(3)(A), concerning non-NRSRO personnel’s involvement 

in determining NRSRO ratings. 

10. Certain NRSROs did not have policies and procedures and internal controls to obtain 

required representations and make required disclosures when determining or issuing ratings of 

ABS.

A smaller NRSRO did not have policies, procedures, or controls for determining whether a 

particular transaction constitutes a security or money-market instrument to which the 

requirements of Rules 17g-5(a)(3) and 17g-7(a)(2) apply. Rather, the NRSRO allowed the issuer 

to decide whether Rule 17g-5(a)(3) applies, and analytical personnel working on a particular 

transaction decided for themselves whether the 17g-7(a)(2) provisions apply. The Staff observed 

one rating by the NRSRO where it did not take the measures required by Rules 17g-5(a)(3) and

17g-7(a)(2) even though this rating related to transactions that appeared to be subject to these 

Rules. In addition, the NRSRO indicated that it asks the issuer, underwriter, or sponsor to 

provide the Form ABS Due Dilligence-15E, but did not obtain a representation from the issuer, 

underwriter, or sponsor as required by Rule 17g-5(a)(3)(iii)(E). The Staff recommended that the 

NRSRO enhance its policies and procedures to ensure it fully complies with Rules 17g-5(a)(3) 

and 17g-7(a)(2), including that it obtains the required representations related to third-party due 

diligence services from issuers, sponsors, and underwriters.

A smaller NRSRO did not publish Form ABS Due Diligence-15E in connection with a rating 

action that the Staff selected for rating file review. The NRSRO acknowledged receiving the 

third-party due-diligence report, but did not publish it in connection with the rating because it did 

not use this report in determining its rating. However, Rule 17g-7(a)(2) requires an NRSRO to 

publish a third-party due diligence report if it receives such a report, regardless of whether or not 

it considers this report when determining the rating. In addition, the Staff observed that several 

other Rule 17g-7 disclosures published by the NRSRO state that no third-party due diligence

report was used, even though Rule 17g-7(a)(2) requires an NRSRO to publish a Form ABS DueDiligence 15E if it receives the Form directly or obtains the Form through a Rule 17g-5(a)(3)

website, regardless of whether the NRSRO used the Form when taking the rating action. The 

Staff recommended that the NRSRO establish, maintain, enforce, and document effective 

internal controls, including policies and procedures, to ensure full compliance with rule 17g7(a)(2).
2016 Section 15E Examinations Summary Report Page 32

E. Review Area: Governance

During the 2016 examinations, the Staff interviewed each NRSRO’s board of directors or 

governing body (hereinafter, collectively the “Board” or “Boards”), including independent 

directors. The Staff also reviewed minutes and other documentation related to the activities of 

each NRSRO’s Board. 

The Staff’s essential findings relating to the NRSROs’ corporate governance and compliance 

with Section 15E(t) and Rule 17g-8(a)(1) are as follows: 

1. Certain NRSROs’ Boards did not approve all methodologies, procedures, and models 

used to determine ratings as required by Rule 17g-8(a)(1), or did not sufficiently document such 

approval. 

At a larger NRSRO, the Board did not approve all methodologies, procedures, and models used 

to determine ratings, including those already in use, by the June 15, 2015 effective date of Rule 

17g-8(a)(1). The Staff notes that the NRSRO’s Board subsequently did make all the approvals 

required by Rule 17g-8(a)(1). The Staff recommended that the NRSRO ensure it adheres to Rule 

17g-8(a)(1).

A larger NRSRO did not sufficiently document approval of its methodologies by its Board. In 

some instances, the NRSRO’s Board did not document its approvals of methodologies, and even 

in instances when it did prepare minutes concerning its approvals of methodologies, such 

minutes were not sufficiently detailed to demonstrate Board members’ active and informed 

engagement in the process of reviewing and approving the methodologies. Moreover, Board 

members did not always receive sufficiently detailed information concerning the methodologies 

prior to approving these methodologies. In addition, the Board only approved quantitative 

models that were embedded in a particular methodology, but did not receive information specific 

to these embedded models and did not consider or discuss these models separately from the 

methodologies. Moreover, the Board did not approve other quantitative models that the NRSRO 

uses in the ratings process, such as single-use models. Also, the Board did not approve 

procedures that the NRSRO uses to determine ratings, and it did not appear that the Board was 

responsible for approving such procedures. The Staff recommended that the NRSRO’s Board 

adhere to its policies and procedures concerning Board approval as required by Rule 17g-8(a)(1), 

and that the NRSRO ensure that such Board approval is sufficiently documented.

At a smaller NRSRO, policies and procedures did not explicitly identify the Board members 

responsible for approving the procedures and methodologies, including qualitative and 

quantitative data and models, as required by Rule 17g-8(a)(1), and in some instances there were 

inconsistences between the Board members who completed such approvals and those who were 

required to complete such approvals pursuant to its policies and procedures and Board 

resolutions. In addition, the NRSRO’s Board only approved quantitative models that were 

embedded in a particular methodology, but did not receive information specific to these 

embedded models and did not consider or discuss these models separately from the 

methodologies. Moreover, the NRSRO’s Board did not approve other quantitative models that 
2016 Section 15E Examinations Summary Report Page 33

this NRSRO uses in the ratings process, such as single-use models. Finally, the NRSRO’s Board 

did not approve procedures that the NRSRO uses to determine ratings, and it did not appear that 

the Board was responsible for approving such procedures. The Staff recommended that the 

NRSRO revise its policies, procedures, and related documents to reflect the Board’s 

responsibilities to approve all of its methodologies, models, and procedures used for determining 

ratings as required by Rule 17g-8(a)(1). The Staff also recommended that the NRSRO adhere to 

these policies and procedures and related documents, and ensure that Board approval of 

procedures, methodologies, and models is sufficiently documented. 

At a smaller NRSRO, policies and procedures stated that the Board is responsible for approving 

changes to its existing methodologies but did not also state that the Board was responsible for 

approving new methodologies. These policies and procedures also did not state that the Board is 

responsible for approving models that the NRSRO uses to determine ratings. Also, the NRSRO 

did not sufficiently document its Board’s approval of existing methodologies in minutes or other 

materials, and there was no indication from minutes and other materials that the Board approved 

the NRSRO’s models. The Staff recommended that the NRSRO revise its policies, procedures,

and related documents to reflect the Board’s responsibilities to approve procedures, 

methodologies, and models as required by Rule 17g-8(a)(1). The Staff also recommended that 

the NRSRO adhere to these policies and procedures and related documents, and ensure that 

Board approval of procedures, methodologies, and models is sufficiently documented.

A smaller NRSRO’s policies and procedures did not state that this NRSRO’s Board is 

responsible for approving procedures that the NRSRO uses to determine ratings or qualitative 

and quantitative models that the NRSRO uses to determine ratings, and the NRSRO’s Board did 

not approve such procedures and models. A larger NRSRO’s and two smaller NRSROs’ policies 

and procedures did not state that the Boards are responsible for approving procedures that the 

NRSRO uses to determine ratings, and these NRSROs’ Boards did not approve such procedures. 

The Staff recommended that these NRSROs revise their policies and procedures and related 

documents to reflect the Board’s responsibilities to approve procedures and models used to 

determine ratings as required by Rule 17g-8(a)(1) and ensure that their Board’s sufficiently 

document their approvals of procedures, methodologies, and models.

2. Certain NRSROs, and/or the individuals serving as independent directors of these 

NRSROs’ Boards, did not satisfy Board independence requirements. Also, one NRSRO did not 

have effective controls to ensure that individuals serving as independent directors satisfied the 

independence requirements. 

During part of the Review Period, the Boards of certain larger NRSROs did not have the 

sufficient number of independent directors required by Section 15E(t)(2)(A) and their own 

governing documents. The Staff recommended that the NRSROs ensure their Boards comply 

with the structural requirements of Section 15E(t), including those concerning independent 

directors.

At a smaller NRSRO, two directors that the NRSRO identified as independent also served as 

directors of a non-NRSRO affiliate. By serving as directors on a non-NRSRO affiliate, these 
2016 Section 15E Examinations Summary Report Page 34

individuals constituted persons associated with the NRSRO and thus were not independent. The 

Staff recommended that the NRSRO ensure that its corporate governance structure meets the 

requirements of Section 15E(t), including that individuals serving as independent directors 

satisfy the independence requirements of Section 15E(t)(2). 

At a smaller NRSRO, a director the NRSRO identified as independent performed consulting 

services for that NRSRO which were not related to this individual’s service as an independent 

director and for which this individual received additional compensation, in violation of Section

15E(t)(2)(B)(i)(I). The Staff recommended that the NRSRO ensure its independent directors 

satisfy the independence requirements of Section 15E(t)(2)(B). 

At a smaller NRSRO, there were weaknesses in the process, analysis, and documentation for 

reviewing independent directors’ questionnaires and ensuring their compliance with Section 

15E(t)(2). The Staff recommended that the NRSRO ensure that independent directors’

questionnaires are thoroughly and completely reviewed and that independent directors are 

notified of their obligations as required by the NRSRO’s policies and procedures. The Staff also 

recommended that the NRSRO consider implementing policies and procedures for documenting 

communications with independent directors concerning their questionnaires.

3. There were weaknesses with certain NRSROs’ policies and procedures and other 

documents governing the responsibilities and obligations of the directors and/or the Board.

At a larger NRSRO, independent directors were not subject to restrictions required by applicable 

laws concerning certain conflicts of interest, such as those related to securities ownership. The 

Staff recommended that the NRSRO enhance its policies and procedures to ensure that its 

independent directors are subject to all applicable laws, including those related to conflicts of 

interest. 

At a smaller NRSRO, the policies and procedures concerning the Board’s responsibilities 

referred to other NRSRO policies and procedures that are outdated or no longer in effect. The 

Staff recommended that the NRSRO ensure that the documents governing its Board 

responsibilities are current and accurate. 

A smaller NRSRO did not comply with applicable legal requirements concerning revisions to 

documents governing its Board’s structure and responsibilities. The Staff recommended that the 

NRSRO ensure it complies with all such applicable legal requirements.

F. Review Area: DCO Activities

The DCO role is a critical element to ensure an NRSRO’s compliance with securities laws. Each 

NRSRO’s DCO should have adequate resources, institutional support, and independence to 

effectively carry out the DCO’s statutory obligations. During the 2016 examinations, the Staff 

reviewed the role and activities of each NRSRO’s DCO and interviewed each DCO.
2016 Section 15E Examinations Summary Report Page 35

The Staff’s essential findings regarding the NRSROs’ DCO activities are as follows:

1. Certain NRSROs did not promptly produce complete and accurate documents to the Staff 

as required by applicable laws.

A smaller NRSRO did not have effective internal controls to ensure it makes timely and 

complete productions to the Staff as required by Rule 17g-2(f). For example, when responding 

to Staff requests for emails, the NRSRO relied on the individual email recipients to identify all 

such emails and attachments for production, rather than searching the NRSRO’s internal systems 

for potentially responsive documents or having the DCO assist in identifying responsive 

documents. In addition, the NRSRO’s productions to the Staff did not include all applicable 

documents requested. The Staff recommended that the NRSRO enhance its internal controls, 

including policies and procedures, for the retention and production of rating files and 

communications concerning particular rating actions. 

A larger NRSRO’s productions to the Staff of documents concerning its rating activities for a 

particular type of ABS were untimely and disorganized. At a smaller NRSRO, certain 

documents responsive to the Staff’s document request, such as Board minutes, tracking logs, and 

information concerning models and IT, were missing from initial productions and were only 

provided after follow-up by the Staff. The Staff recommended that the NRSROs ensure that 

their productions to the Staff are prompt and complete as required by Sections 17(a) and (b) and 

Rule 17g-2(f).

2. There were weaknesses in the compliance department’s monitoring activities at certain 

NRSROs. 

At a larger NRSRO, a significant number of analysts’ emails were not subject to regular email 

monitoring as required by this larger NRSRO’s policies and procedures. The NRSRO’s selfassessment of this incident indicated that inadequate resources for email monitoring may have 

contributed to this email monitoring gap. The Staff recommended that the NRSRO ensure it 

maintains internal controls, including adequate resources, to conduct email monitoring 

effectively and consistently with its policies and procedures. 

At a smaller NRSRO, periodic compliance questionnaires completed by some personnel to 

certain questions indicated some instances of potential non-adherence to or risks associated with 

protection of MNPI, but the NRSRO’s compliance staff did not appear to take any follow-up 

measures based on these responses. The Staff recommended that the NRSRO establish, 

maintain, enforce, and document policies, procedures, and internal controls concerning the 

review of periodic compliance response sheets to ensure it meets the requirements of Section 

15E(j)(1). 

At a smaller NRSRO, the Staff observed that compliance logs did not list certain incidents that 

should have been listed, and some of the entries on these logs contained incorrect information. 
2016 Section 15E Examinations Summary Report Page 36

The Staff recommended that the NRSRO enhance the completeness and accuracy of its 

compliance logs to ensure it meets the requirements of Section 15E(j)(1).

3. At certain NRSROs, the staffing levels and/or quality of work product by the compliance 

department needed improvement. 

At a smaller NRSRO, there has been continuing turnover of compliance staff, which may 

weaken the effectiveness and the continuity of the NRSRO’s compliance function and its ability 

to satisfy the requirements of Section 15E(j). The NRSRO’s compliance staff also did not 

exercise sufficient oversight of a regional office that employees several analytical personnel. 

The NRSRO’s compliance staff had never visited the regional office and there was limited 

documentation of compliance oversight over this office. The Staff recommended that the 

NRSRO enhance its efforts to recruit, train, and retain compliance staff to create greater stability 

within its compliance function, and that it strengthen its compliance oversight and reporting 

related to this regional office.

At a smaller NRSRO, the DCO report required by Section 15E(j)(5) provided the incorrect filing 

date and compliance reports and logs were missing certain information or contained inaccurate 

information. There were also weaknesses in the NRSRO’s internal controls, including policies 

and procedures, for providing required compliance training to all applicable personnel in a timely 

manner. While the NRSRO indicated that it requires all NRSRO personnel and certain 

consultants to complete compliance training in a timely manner, this NRSRO’s policies and 

procedures did not explicitly contain this requirement. In addition, the Staff identified several 

NRSRO personnel and consultants who had not completed compliance training in a timely 

manner, and the NRSRO did not effectively track completion of compliance training. The Staff 

recommended that the NRSRO improve internal controls relating to the quality of its compliance 

department’s work product, and enhance its compliance training program to ensure that its 

personnel and appropriate consultants complete required compliance training on a timely basis. 

G. Review Area: Complaints

All the NRSROs have written policies and procedures to address complaints generally. The 

Staff’s essential findings regarding complaints are as follows:

1. At certain NRSROs, policies and procedures concerning complaints did not satisfy the 

statutory requirements or NRSRO personnel did not adhere to policies and procedures 

concerning complaints. 

A larger NRSRO did not have procedures for sales and marketing personnel to submit 

complaints, and the NRSRO’s sales and marketing personnel did not receive training concerning 

complaints. Also at this NRSRO, a junior analyst reported a complaint concerning potential 

violations of applicable laws and the NRSRO’s policies to his analytical supervisor. However, in 

contravention of the NRSRO’s policies and procedures concerning complaints, the junior analyst 

did not report this potential violation to the compliance department, and the analytical supervisor 
2016 Section 15E Examinations Summary Report Page 37

did not log the complaint. The Staff recommended that the NRSRO ensure that it maintains 

adequate policies and procedures for handling complaints as required by Section 15E(j)(3) and 

that it ensure all employees adhere to these policies and procedures.

At a smaller NRSRO, the definition of complaint contained in its policies and procedures did not 

include complaints concerning models, methodologies, and compliance with policies and 

procedures developed pursuant to Section 15E, as required by Section 15E(j)(3)(A). In addition, 

the NRSRO’s personnel did not fully understand the process for logging and evaluating 

complaints it received. The Staff recommended that the NRSRO enhance its policies and 

procedures for the receipt, retention, and treatment of complaints to fully comply with Section 

15E(j)(3), and ensure that its personnel understand and adhere to these policies and procedures. 

A smaller NRSRO’s complaint policies and procedures did not fully and sufficiently address oral 

complaints. The Staff recommended that the NRSRO enhance its complaint policies and 

procedures to clearly and sufficiently address oral complaints and satisfy Section 15E(j)(3). 

A smaller NRSRO’s policies and procedures did not require its personnel to consult with its 

compliance department regarding whether a particular communication may constitute a 

complaint. Moreover, the Staff observed that this NRSRO received several communications 

from an investor concerning its application of its methodology and transparency of the rating 

process, but it did not consider whether these communications constituted complaints. The Staff 

recommended that the NRSRO enhance its policies and procedures related to complaints to 

ensure that its compliance department is consulted regarding communications that may constitute 

complaints, and to ensure that its personnel receive adequate training concerning identifying and 

handling complaints and adhere to the requirements of Section 15E(j)(3) and its policies and 

procedures.

At a larger NRSRO, certain employees were unaware that communications from a third-party 

stating that the NRSRO did not follow its rating methodologies would constitute a complaint 

pursuant to Section 15E(j)(3) and its policies and procedures, and were not familiar with the 

process for handling communications that are potentially complaints. The Staff recommended 

that the NRSRO enhance its training of analysts concerning the identification, handling, and 

reporting of external complaints.

H. Review Area: Post-Employment 

The Staff reviewed whether each NRSRO’s “look-back” policies and procedures satisfy the 

applicable statutory and Rule requirements. The Staff also requested information from each 

NRSRO concerning personnel that departed the NRSRO during the Review Period, and in some 

instances tested, on a selected and randomized basis, documentation related to such personnel to

assess whether the NRSRO adhered to its look-back policies and procedures and satisfied the 

statutory and Rule obligations. In addition, OCR sent a letter to each NRSRO reminding it of its 

requirements under Section 15E(h)(4)(A) and expressing the Staff’s view that under Section 
2016 Section 15E Examinations Summary Report Page 38

15E(h)(4)(A), the look-back review period is determined based on the date of the NRSRO’s most 

recent rating action prior to the employee’s departure.46

The Staff’s essential findings regarding NRSROs’ look-back policies and procedures are as 

follows:

1. There were weaknesses in post-employment policies, procedures, and controls at certain 

NRSROs.

At a smaller NRSRO, there were two different and conflicting look-back policies in effect for 

part of the Review Period. Also, this NRSRO’s look-back procedure did not include provisions 

required by Rule 17g-8(c)(2) concerning promptly publishing a revised rating if the previous 

rating was influenced by a conflict of interest. Moreover, the Staff found incorrect or incomplete 

information in numerous questionnaires that the NRSRO used to assess whether a look-back 

review should be conducted and to assist with the review if it is required. The Staff 

recommended that the NRSRO revise its look-back policies, procedures, and questionnaires to 

ensure full compliance with Section 15E(h)(4)(A) and Rule 17g-8(c), and ensure that it 

completes and reviews look-back questionnaires in accordance with its policies and procedures

and conducts look-back reviews where required.

A smaller NRSRO’s post-employment policies and procedures were vague, inconsistent, and did 

not satisfy all requirements of Sections 15E(h)(4) and (5) and Rule 17g-8(c). For example, these 

policies and procedures only required the NRSRO to conduct a look-back if a former employee 

becomes employed by an issuer that it rated, even though Section 15E(h)(4) also requires lookbacks if a covered employee obtains employment with certain obligors, underwriters, or 

sponsors. The Staff recommended that the NRSRO review and enhance its post-employment 

policies and procedures to ensure they meet the requirements of Sections 15E(h)(4) and (5) and 

Rule 17g-8(c).

The look-back policies and procedures of a larger NRSRO and a smaller NRSRO did not require 

the proper rating action or actions to be reviewed. The larger NRSRO only reviewed the current 

rating of the issuer, underwriter, or sponsor that employs the former NRSRO employee, even if 

that rating was determined after the former employee’s departure from the NRSRO. Moreover, 

this NRSRO did not review other ratings of that issuer, underwriter, or sponsor that occurred 

during the one-year look-back period specified by Section 15E(h)(4)(A). The smaller NRSRO 

only reviewed rating actions during the one-year period in which the former employee 

participated, even though Section 15E(h)(4)(A) requires reviews of all ratings of the applicable 

issuer, underwriter, or sponsor during the one-year look-back review period, regardless of 

whether the former employee participated in determining all of those ratings. The Staff 

 46 Letter from OCR Director Thomas J. Butler (July 18, 2016), available on OCR’s webpage of the SEC’s 

public website, at https://www.sec.gov/ocr.
2016 Section 15E Examinations Summary Report Page 39

recommended that the NRSROs ensure they conduct look-back reviews for all credit rating 

actions during the look-back review period, as required by Section 15E(h)(4)(A).

A smaller NRSRO did not review the email communications of a former employee who obtained 

employment with an issuer it rated to determine whether the former employee attempted to 

influence this NRSRO’s rating of the issuer, as required by its policies and procedures. The Staff 

recommended that the NRSRO ensure it adheres to its look-back review policies and procedures.

A former senior officer of a smaller NRSRO obtained employment with a covered entity that the 

NRSRO rated. This covered entity published a press release announcing the hiring of this former 

senior officer, and the NRSRO’s DCO appeared to be aware of the former senior officer’s new 

employment. However, the NRSRO did not file an employee transition report with the 

Commission until several months after the former senior officer’s new employment. The Staff 

recommended that the NRSRO ensure that it reports information concerning former employees 

and their new employers as required by Section 15E(h)(5).

V. CONCLUSION

The Staff has identified findings and recommendations for the NRSROs. In future examinations, 

the Staff will continue to assess the NRSROs’ responses to recommendations from the 2016

Section 15E examinations and from previous examinations. 

The Staff will continue to evaluate its risk assessment process to review compliance with laws 

and regulations and to identify emerging risk areas promptly. The Staff will also continue to 

evaluate exam techniques to assess and test NRSROs’ compliance with applicable laws. In 

addition, the Staff will continue to assess the NRSROs’ compliance with the new and amended 

SEC rules, and expects enhanced compliance by the NRSROs with these rules.