2018 Report and Certification of Internal Supervisory Controls

Introduction

Section 961 of Dodd-Franlc Wall Street Reform and Consumer Protection Act (the "Act")

requires that not later than 90 days after the end of each fiscal year, the Securities and Exchange

Commission ("SEC" or "Commission") shall report to the Senate Committee on Banking,

Housing, and Urban Affairs and the House Committee on Financial Services on the supervisory

controls over the conduct by the Commission of examinations of registered entities,t

enforcement investigations, and review of corporate financial securities filings. This report is

being submitted for the Commission's fiscal year ending September 30, 2018.

Bacicgrouud

The SEC's mission is to protect investors; maintain fair, orderly, and efficient markets; and

facilitate capital formation. Although the SEC's functional responsibilities are organized among

five divisions and 23 offices, the scope of the activities covered in Section 961 fall principally

under the purview of: the Office of Compliance Inspections and Examinations ("OCIE"), the

Office of Credit Ratings ("OCR"),2 the Division of Enforcement ("Enforcement"), and the

Division of Corporation Finance ("Corporation Finance"). Therefore, in the context of this

report, references to "the Commission's internal supervisory controls" or "internal supervisory

controls of the Commission" relate to the relevant internal supervisory controls of OCIE, OCR,

Enforcement, and Corporation Finance.

OCIE principally administers the examination program for SEC-registered entities including,

among others, self-regulatory organizations, broker-dealers, transfer agents, clearing agencies,

municipal advisors, investment companies, and investment advisers. OCIE conducts

examinations to foster compliance with the securities laws, to detect violations of the law, to

identify risks and to inform policy. OCR is responsible for conducting examinations and

monitoring the activities of Nationally Recognized Statistical Rating Organizations to assess and

promote compliance with statutory and Commission requirements. Enforcement is principally

responsible for assisting the Commission in executing its law enforcement function by, among

other things, conducting investigations of potential securities law violations; recommending, in

1 References to "examinations" within this report refer to both examinations and inspections conducted by either the

Office of Compliance Inspections and Examinations or the Office of Credit Ratings.

Z The Act also mandated the creation of OCR, which was established in June 2012 upon the hiring of its Director

and was immediately staffed with a reassigned examination team from OCIE and a reassigned monitoring team

from the Division of Trading and Markets. The certification mandated by Section 961 of the Act is required for the

"Director of the Division of Enforcement, the Director of the Division of Corporation Finance, and the Director of

the Office of Compliance Inspections and Examinations (or the head of any successor division or office)." The SEC

has determined that OCR should be considered a successor of OCIE and therefore subject to the reporting

certification of Section 961.

Page 1 of 8
appropriate circumstances, that the Commission institute civil actions in federal court or before

an administrative law judge; and prosecuting cases on behalf of the Commission. Finally,

Corporation Finance is principa;ly responsible for sc~ectively re~iewiiig the disclosure

documents that relate to the offer and sale of securities in registered transactions and which

publicly-held companies file with the Commission. Through Corporation Finance's review

process, the Division provides comments on where it believes companies can improve or

enhance their compliance with the disclosure requirements of the federal securities laws.

Staffing within OCIE and Enforcement consists of attorneys, accountants, examiners, subject

matter experts, and other employees located both in the Washington, D.C. office and in 11

regional offices. OCR's staff is comprised of similarly diverse professionals who are divided

between Washington, D.C. and the New York Regional Office. The majority of the SEC's other

offices and divisions, including Corporation Finance, are located exclusively in Washington,

D.C.

This report describes the scope and methodology used to evaluate the internal supervisory

controls and relevant procedures applicable to the OCIE, OCR, Enforcement, and Corporation

Finance staff that perform examinations of registered entities, enforcement investigations, and

reviews of corporate financial securities filings. r~urthermore, the report describes whether any

significant deficiencies in these controls or procedures have been identified by the evaluation to

exist as of the end of the fiscal year. The report also includes a description of the inherent

limitations of procedures applicable to staff, internal supervisory controls, and the evaluation

process. Finally, the report includes an assessment of control and procedure effectiveness, the

Certification of Supervisory Controls that is required by the Act, and the status of the

Comptroller General's review pursuant to Section 961(e) of the Act.

I~.tep•nal ~u~~erviso~y Conte-ois aid ~'p•oee~ures Applicable to Stiff

Section 961(b)(1) of the Act requires the assessment of both the Commission's internal

supervisory controls and procedures applicable to the Commission staff who perform

examinations of registered entities (i.e., OCIE and OCR), enforcement investigations (i.e.,

Enforcement), and reviews of corporate financial securities filings (i.e., Corporation Finance).

The terms "internal supervisory controls" and "procedures applicable to staff' are not defined in

the Act. For purposes of this report and the attached certification, "procedures applicable to

staff' refer to the established "day-to-day" procedures to be followed by the employees within

the applicable programs. "Internal supervisory controls" refer to the processes established by

management to monitor that the procedures applicable to staff are consistently being performed

according to policy and procedures, and also remain reasonable, adequate, and current.

Scope and Methodology

1. Overview

The Directors of OCIE, OCR, Enforcement, and Corporation Finance, each with the assistance

of his or her supervisory staff and other office or division personnel, evaluated the effectiveness

of internal supervisory controls and relevant procedures applicable to staff. The internal

supervisory control review encompassed controls in place during the entire fiscal year and the

assurance of those controls encompassed the 90-day period ending on the final day of the fiscal

Page 2 of 8
year ending on September 30, 2018. Upon completion of the evaluation, each Director signed a

certification concerning the adequacy of the Commission's internal supervisory controls with

respect to his or her office or division.

To facilitate an effective, efficient, and consistent approach to the evaluations, the agency

established a working group consisting of staff from OCIE, OCR, Enforcement, Corporation

Finance, and the Office of the Chief Operating Officer. Additionally, the working group, as

needed, obtained input from Senior Officers in OCIE, OCR, Enforcement, and Corporation

Finance and other divisions or offices within the agency. The working group met and

communicated regularly to discuss the execution of each division's or office's assessment and to

ensure a consistent methodology for conducting the Section 961 assessment corresponding with

relevant government-wide internal controls standards and guidance.

OCIE, OCR, Enforcement, and Corporation Finance engaged in a "top-down, risk-based"

consideration of their functional responsibilities, focusing on assessing whether their respective

objective of conducting examinations, investigations, or reviews of corporate financial securities

filings in accordance with adopted policies and procedures had been consistently met during the

90-day period subject to evaluation. This approach involved identifying risks to achieving such

objectives, determining whether controls exist to address those risks, and evaluating the

operating effectiveness of the controls included in the evaluation. The procedures for collecting

information to evaluate the effectiveness of internal supervisory controls consisted principally of

interviews, observation, process walkthroughs, inspection of documents, self-assessments

(including the use ofsub-certifications), and through the application of judgment, as appropriate.

In addition, relevant members of the working group reviewed and considered background

material that included the review of the internal supervisory controls pursuant to the

requirements of Section 961 of the Act, the Federal Managers' Financial Integrity Act (FMFIA)

assurance statements for fiscal year 2018, recent Office of Inspector General ("OIG"), and GAO

findings.

Finally, the divisions and offices reviewed any deficiencies identified to determine whether such

deficiencies were considered significant, either individually or in the aggregate. OCIE, OCR,

Enforcement, and Corporation Finance provided summary information for such determination

and for the. evaluation as a whole to the respective office or division director in order to support

the relevant assertions within the certification.

2. Examinations and Investigations

To assess the effectiveness of internal supervisory controls over examinations and investigations

and the procedures applicable to the staff performing such functions, OCIE, OCR, and

Enforcement utilized assessment staff that included members of the working group, senior

managers, and other staff with experience in conducting examinations or investigations, as

applicable. The assessment staff, along with senior staff and officers, for each function identified

and evaluated the risks and related controls that are important to the function's ability to

consistently conduct examinations or investigations according to policies and procedures, which

included the identification of any deficiencies in control design or operating effectiveness.

In the case of OCIE and Enforcement, the evaluation also included an identification of the

Page 3 of 8
information technology ("IT") systems used to track examinations and investigations and an

assessment of how the IT systems are used to support supervisory controls and the procedures

ap~licaale to Staff. ir► t ie case of SCR, the assessr-ner~i siafi re-views aiid tests su~iervisory

controls within its examination system.

The assessment staff for examinations and investigations conducted structured interviews with

Home and Regional Office Senior Officers3 and other staff with the goal of obtaining their

assistance and support in the identification and description of controls. In order to assess the

effectiveness of supervisory controls, the teams designed tests around the internal supervisory

controls that were determined to be designed appropriately. The staff used a combination of

statistical, random, and judgmental sampling techniques to select samples for validating

operational effectiveness, as applicable. The staff obtained and documented evidence to sup~~ort

the effective operation of supervisory controls.

This process was closely coordinated with the annual Management Assurance statement process

performed for FMFIA and leveraged much of the work conducted for that process.

3. Reviews of CoNporate Financial Securities Filings

To assess the effectiveness of internal supervisory controls over reviews of corporate financial

securities filings and the procedures applicable to the staff conducting those reviews,

Corporation Finance established an assessment team that included senior management and other

staff members. The assessment team identified and evaluated risks and related controls that are

important to Corporation Finance's ability to consistently conduct reviews according to policies

and procedures, which included the identification of any deficiencies in control design or

operating effectiveness.

The evaluation included the assistance of the Office of Risk and Strategy, which is staffed

with permanent managers and rotators with significant experience performing reviews of

corporate financial securities filings. In order to assess the effectiveness of internal

supervisory controls, the team designed and executed tests of supervisory controls during an

interim period and the yeax-end that included a combination of random and judgmental

sampling techniques to select samples for validating operational effectiveness. The team

obtained and documented evidence to support the effective operation of supervisory

controls.

This process built upon the annual Management Assurance statement process performed for

FMFIA purposes.

Inherent Limitations

All control systems, including internal supervisory controls, are subject to inherent limitations.

No matter how well-conceived and operated, an internal control system cannot provide absolute

assurance regarding the achievement of objectives, nor can an evaluation of an internal control

3 The Regional Office Directors and Home Office Senior Officers within OCIE and Enforcement have supervisory responsibility

for staff in their respective offices; accordingly, evaluations of internal supervisory controls over examinations and investigations

required the coordinated participation of the Home and Regional Offices.

Page 4 of $
system provide absolute assurance that significant deficiencies will be identified. Also,

projections of any evaluation of effectiveness to future periods are subject to the risk that

internal supervisory controls may become inadequate because of changes in conditions, or that

the degree of compliance with the policies or procedures may deteriorate.

Because of the nature, including breadth, of the Commission's examination, investigation, and

review of corporate financial securities filings functions, as well as limitations on resources,

management and staff within the relevant offices and divisions must exercise judgment in

conducting examinations of registered entities, enforcement investigations, and reviews of

corporate financial securities filings. As such, controls are inherently designed to allow for the

application of judgment in decision-making. There may be instances where judgments made in

good faith are in hindsight deemed inappropriate.

The evaluations of internal supervisory controls and procedures applicable to staff covered by

this report for the Commission's fiscal year ending September 30, 2018 represent the eighth time

such evaluations have been conducted pursuant to the requirements of Section 961 of the Act.

The SEC will continue to enhance the approach taken in 2018 to improve the effectiveness and

efficiency of the efforts going forward. The results of GAO's review under Section 961(e) of the

Act may also result in adjustments to the process in future years.

Despite the limitations described above, it is our belief that the evaluations of the Commission's

internal supervisory controls and procedures applicable to staff provide a reasonable and

justifiable basis for the conclusions expressed in this report.

Significant Deficiencies

Section 961(c)(2)(D) requires each respective Director of OCIE, Enforcement, and Corporation

Finance and any successor offices, such as OCR, to certify that he or she has disclosed to the

Commission any significant deficiencies in the design or operation of internal supervisory

controls that could adversely affect the ability of the applicable Division or Office to consistently

conduct inspections, or investigations, or reviews of corporate financial securities filings with

professional competence and integrity. Under the terms of Reorganization Plan No. 10 of 1950,

the executive and administrative functions of the Commission are transferred to the Chairman of

the Commission, including, among other functions, the appointment and supervision of

personnel employed under the Commission.4 Accordingly, the Director of each respective

Division or Office should make any required disclosures to the Chairman of the Commission.

To make this clear, the attached certification states that the respective Directors have "disclosed

to the Chairman of the Commission any significant deficiencies in the design or operation of

internal supervisory controls...." A copy of this report is also being provided to each

Commissioner.

As part of the evaluations described above, the respective OCIE, OCR, Enforcement, and

Corporation Finance assessment teams evaluated their findings to determine whether any

deficiencies existed as of September 30, 2018. The severity of all deficiencies identified was

evaluated to determine whether any, either individually or in the aggregate, constituted a

significant deficiency. Upon completion of this process, no' significant deficiencies in internal

4 15 F.R. 3175, 64 Stat. 1265, Section 1(a).

Page 5 of 8
s~~~ee-`~isory controls were identified.

For purposes ~f making the detGrtniriati~iis - descri'~eu a'r~av~, a "si~iiificant deficiency" meriting

the attention by the Chairman of the Commission, is any deficiency, or combination of

deficiencies, in internal supervisory controls that inhibits the respective Office or Division from

achieving the overall goals established by senior management for consistently conducting

examinations, investigations, or reviews of corporate financial securities filings with professional

competence and integrity.

Summary of Assessment Results

Based on the results of the evaluations described above, as of September 30, 2018, the internal

supervisory controls and procedures of the Commission with respect to OCIE and OCR

examinations, Enforcement investigations, and Corporation Finance reviews of corporate

financial securities filings were effective for the 90-day period ending on the final day of the

fiscal year ending on September 30, 2018, and the procedures of the Commission applicable to

the OCIE, OCR, Enforcement, and Corporation Finance staff who perform examinations of

registered entities, enforcement investigations, and reviews of corporate financial securities

filings, respectively, were effective for the same period.

Certification of Internal Supervisory Controls

See E~ibit A -Section 961(c)(2) Certification

Summary of Review by the GAO

Section 961(e) of the Act requires a review by the Comptroller General of the United States of

the adequacy and effectiveness of the Commission's internal supervisory control structure and

procedures not less frequently than once every three years. Section 961(b)(3) of the Act requires

this report to contain a summary of the GAO's review.

The GAO initiated its triennial review under Section 961(e) and released its report in October

2016, "Management Has Enhanced Supervisory Controls and Could FuNther Improve

Efficiency" (GAO-17-16). The report concluded that the agency's overall internal supervisory

control framework reflected key components of internal controls, and that appropriate steps had

been taken by the agency to enhance the framework since GAO's initial review in 2013. The

report also stated that the agency had implemented GAO's 2013 recommendation that it should

make certain that existing and future supervisory controls have cleaxly defined activities and

readily available documentation demonstrating execution of the activities, and recommended

that additional measures could be taken to formalize the Commission's 961 Working Group or

otherwise establish a formal body to leverage the divisions' and offices' experiences, expand

their collaboration to share best practices, and streamline procedures and documentation. The

SEC has taken steps to implement all of GAO's recommendations. The GAO initiated its third

triennial review under Section 961(e) in December 2018.

Page 6 of 8
Exhibit A 

SECTION 961(c)(2) CERTIFICATION 

Pursuant to the requirements of Section 961 (c)(2) of the Dodd-Frank Wall Street Refonn and Consumer 

Protection Act, I hereby certify that: 

1. I am directly responsible for establishing and maintaining the internal supervisory controls of the

Division or Office of which I am the head.

2. I am knowledgeable about the internal supervisory controls of the Division or Office of which I am the

head.

3. I have evaluated the effectiveness during the 90-day period ending on the final day of the fiscal year

ended September 3 0, 2018 of the internal supervisory controls of the Division or Office of which I am

the head.

4. I have disclosed to the Chairman of the Commission any significant deficiencies in the design or

operation of internal supervisory controls identified as a result of the evaluation described above that

could adversely affect the ability to consistently conduct with professional competence and integrity,

respectively:

(a) inspections and examinations by the Office of Compliance Inspections and Examinations and

its successor office, the Office of Credit Ratings,

(b) investigations by the Division of Enforcement, or 

( c) reviews of corporate financial securities filings by the Division of Corporation Finance.

1bis certification concerning the adequacy of the Commission's internal supervisory controls is based on 

the review described in the accompanying report of the internal supervisory controls and procedures 

applicable to the staff that perfonns the duties described above within the Division or Office of which I 

am the head and is accurate to the best of my knowledge and belief. 1bis review was perfonned with the 

assistance of my supervisory staff and other personnel within my Division or Office. 

With Respect to Inspections and Examinations: 

Name: Peter B. Driscoll 

Date:G,?' �l'.""'

Title: Director 

Office of Compliance Inspections and Examinations 

Name: Jessica S. Kane 

Date: � 

Title: ·DirectorOffice of Credit Ratings 
With Respect to Reviews of Corporate Financial Securities Filings: 

Name: William H. Himnan 

Date: �IJ,,... ✓-1⁄2 .u;,, 15-

Title: Director 

With Respect to Investigations: 

Name: Stephanie A vakian 

Date: l &-l l �{ �(<if

Title: Co-Director 

Name: Steven Peikin 

Date: rz) ('1 j I 'i

Title: Co-D1rector 

Divisil of En£

. 

orcemen

. 

t

/(-b: (li)lJ