Introduction 

U.S. SECURITIES AND EXCHANGE COMMISSION 

2012 Report and Certification of Internal Supervisory Controls 

On July 21, 2010, President Obama signed into law the Dodd-Frank Wall Street Reform and 

Consumer Protection Act (the "Act"). Section 961 of the Act requires that, not later than 90 days 

after the end of each fiscal year, the Securities and Exchange Commission ("SEC" or 

"Commission") report to the Senate Committee on Banking, Housing, and Urban Affairs and the 

House Committee on Financial Services on the conduct by the Commission of examinations of 

registered entities, 1 enforcement investigations, and review of corporate financial securities 

filings. This report is being submitted for the Commission's fiscal year ending September 30, 

2012. 

Background 

The SEC's mission is to protect investors; maintain fair, orderly, and efficient markets; and 

facilitate capital formation. Although the SEC's functional responsibilities are organized among 

five divisions and 22 offices, the scope of the activities covered in Section 961 fall principally 

under the purview of the Office of Compliance Inspections and Examinations ("OCIE"), the 

Office of Credit Ratings ("OCR"),2 the Division ofEnforcement ("Enforcement"), and the 

Division of Corporation Finance ("Corporation Finance"). Therefore, in the context of this 

report, references to "the Commission's internal supervisory controls" or "internal supervisory 

controls of the Commission" relate to the relevant internal supervisory controls ofOCIE, OCR, 

Enforcement, and Corporation Finance. 

OCIE principally administers the examination program for SEC-registered entities including, 

among others, self-regulatory organizations, broker-dealers, transfer agents, clearing agencies, 

1 References to "examinations" within this report refer to both examinations and inspections conducted by either the 

Office of Compliance Inspections and Examinations or the Office of Credit Ratings. 

2 The Dodd-Frank Act also mandated the creation of the Office of Credit Ratings, which was established in June 2012, 

from a reassigned examination team from OCIE and the realignment of the monitoring team from the Division of 

Trading and Markets. The certification mandated by Section 961 of Dodd-Frank is required for the "Director ofthe 

Division of Enforcement, the Director of the Division of Corporation Finance, and the Director of the Office of 

Compliance Inspections and Examinations (or the head of any successor division or office)." The SEC has determined 

that OCR should be considered a successor ofOCIE and therefore subject to the reporting requirements of Section 

961. 
investment companies, and investment advisers. The Office conducts examinations to foster 

compliance with the securities laws, to detect violations ofthe law, to identify risks and to inform 

policy. OCR is responsible for conducting examinations and monitoring the activities of 

Nationally Recognized Statistical Rating Organizations to assess and promote compliance with 

statutory and Commission requirements. Enforcement is principally responsible for assisting the 

Commission in executing its law enforcement function by, among other things, conducting 

investigations of potential securities law violations; recommending, in appropriate circumstances, 

that the Commission institute civil actions in federal court or before an administrative law judge; 

and prosecuting cases on behalf of the Commission. Finally, Corporation Finance is principally 

responsible for selectively reviewing the disclosure documents that relate to the offer and sale of 

securities in registered transactions and which publicly-held companies file with the Commission. 

Through Corporation Finance's review process, the Division provides comments on where it 

believes publicly-held companies can improve or enhance their compliance with the disclosure 

requirements of the federal securities laws. 

Staffing within OCIE and Enforcement consists of attorneys, accountants, examiners, subject 

matter experts, and other employees located both in the Washington, D.C. office and in 11 regional 

offices located throughout the country. OCR's staff is divided between the SEC headquarters and 

the New York Regional Office. The majority of the SEC's other offices and divisions, including 

Corporation Finance, are exclusively located in Washington, DC. 

This report describes the scope and methodology used to evaluate the internal supervisory controls 

and relevant procedures applicable to the OCIE, OCR, Enforcement, and Corporation Finance 

staffwho perform examinations of registered entities, enforcement investigations, and reviews of 

corporate financial securities filings, respectively. Furthermore, the report describes whether any 

significant deficiencies in these controls or procedures have been identified to exist as ofthe end of 

the fiscal year. The report also includes a description of the inherent limitations of procedures 

applicable to staff, supervisory controls, and the evaluation process. Finally, the report includes 

an assessment of control and procedure effectiveness, the Certification of Supervisory Controls 

that is required by the Act, and the status of the Comptroller General's review pursuant to Section 

961(e) ofthe Act. 

Internal Supervisory Controls and Procedures Applicable to Staff 

Section 961(b)(1) ofthe Act requires an assessment ofboth the internal supervisory controls and 

Commission procedures applicable to the Commission staff who perform examinations of 

registered entities (i.e., OCIE and OCR), enforcement investigations (i.e., Enforcement), and 

reviews of corporate financial securities filings (i.e., Corporation Finance). Neither "internal 

supervisory controls" nor "procedures applicable to staff'' is a defined term in the Act. For 

purposes of this report and the attached certification, "procedures applicable to staff'' refer to the 

established "day-to-day" procedures to be followed by the employees charged with these 

2 
functions. "Internal supervisory controls" refer to the processes established by management of 

each respective office or division for monitoring that the "procedures applicable to staff' are 

performed consistently with competence and integrity, and also remain reasonable, adequate, and 

current. 

Scope and Methodology 

I. Overview 

The Directors ofOCIE, OCR, Enforcement, and Corporation Finance, each with the assistance of 

his or her supervisory staff and other office or division personnel, evaluated the effectiveness of 

the internal supervisory controls and the procedures applicable to the respective office or division 

staff during the 90-day period ending September 30, 2012, to determine whether their respective 

objective of consistently conducting examinations, investigations, or review of corporate 

fmancial securities filings with professional competence and integrity was met. Upon 

completion of the evaluation, each Director signed a certification concerning the adequacy of the 

Commission's internal supervisory controls with respect to his or her office or division. 

To facilitate an effective, efficient, and consistent approach to the evaluations, the Agency 

established a working group consisting ofSenior Officers and staff from OCIE, OCR, 

Enforcement, Corporation Finance, and the Offices of the Chief Operating Officer and the General 

Counsel. Additionally, the working group, as needed, obtained input from other divisions or 

offices within the Agency. The working group met and communicated regularly to discuss the 

development and implementation of the project plans that were prepared by each of the relevant 

divisions and offices and to ensure a consistent methodology for conducting the Section 961 

assessment corresponding with Office ofManagement and Budget and other relevant internal 

controls guidance. 

Each office followed the documented methodology. OCIE, OCR, Enforcement, and Corporation 

Finance engaged in a "top-down, risk based" consideration of their functional responsibilities, 

focusing on assessing whether their respective objective of conducting examinations, 

investigations, or reviews of corporate financial securities filings with professional competence 

and integrity had been consistently met. This approach involved identifying risks to achieving 

such objectives, determining whether controls exist to address those risks, and evaluating the 

operating effectiveness of the controls included in the evaluation. The procedures for collecting 

information to evaluate the effectiveness of internal supervisory controls consisted principally of 

interviews, observation, process walkthroughs, inspection of documents, self-assessments 

(including the use of sub-certifications), and through the application of judgment, as appropriate. 

In addition, relevant members of the working group reviewed and considered background material 

that included the 2011 review ofthe internal supervisory controls pursuant to the requirements of 

3 
Section 961 ofDodd-Frank, the Federal Manager's Financial Integrity Act (FMFIA) assurance 

statements for fiscal years 2011 and 2012, results of an agency-wide review of entity level controls, 

and recent Office oflnspector General and Government Accountability Office findings. 

Finally, the working group reviewed any deficiencies identified by assessing their impact on the 

evaluation ofthe design and operating effectiveness of internal supervisory controls, including 

making the determination of whether any such deficiencies were considered significant, either 

individually or in the aggregate. OCIE, OCR, Enforcement, and Corporation Finance provided 

summary information for such determination and for the evaluation as a whole to the respective 

office or division director in order to support the relevant assertions within the certification. 

2. Examinations and Investigations 

To assess the effectiveness of internal supervisory controls over examinations and investigations 

and the procedures applicable to the staff performing such functions, OCIE, OCR, and 

Enforcement developed separate assessment teams that included members of the working group, 

senior managers, and other staff with extensive experience in conducting examinations or 

investigations. The assessment team for each function identified and evaluated the risks and 

related key controls that are important to the function's ability to consistently conduct 

examinations or investigations with professional competence and integrity, which included the 

identification of any deficiencies in control design or operating effectiveness. 

The evaluation also included an identification of the information technology ("IT") systems used 

to track examinations and investigations. The assessment teams evaluated how the IT systems are 

used to support key supervisory controls and the procedures applicable to staff. 

The assessment teams for examinations and investigations coordinated their efforts and conducted 

structured interviews with Home and Regional Office Senior Officers3 and other staff with the 

goal of obtaining their assistance and support in the identification and description of controls. In 

order to assess the effectiveness of supervisory controls, the teams designed tests around the key 

internal supervisory controls that were determined to be designed appropriately. The teams used 

a combination of random and judgmental sampling techniques to select samples for validating 

operational effectiveness. The teams obtained and documented evidence to support the effective 

operation ofkey supervisory controls. 

This process was closely coordinated with the annual Management Assurance statement process 

performed for FMFIA purposes and used the sub-certification prepared for the FMFIA assurance 

3 The Regional Office Directors and Home Office Senior Officers within OCIE, OCR, and Enforcement have supervisory 

responsibility for staff in their respective offices; accordingly, evaluations of internal supervisory controls over examinations and 

investigations required the coordinated participation of the Home and Regional Offices. 

4 
statement, due to the concurrent nature of the identified risks, controls and gaps. The 

sub-certifications were provided to the Directors of OCIE and Enforcement, along with key 

background materials, to support the assertions in the certification required by Section 961(c)(2) 

of the Act. 

3. Reviews of Corporate Financial Securities Filings 

To assess the effectiveness of internal supervisory controls over reviews of corporate financial 

securities filings and the procedures applicable to the staff conducting those reviews, Corporation 

Finance established an assessment team that included senior management, and other staff 

members. The assessment team identified and evaluated risks and related key controls that are 

important to Corporation Finance's ability to consistently conduct reviews with professional 

competence and integrity, which included the identification of any deficiencies in control design 

or operating effectiveness. 

The evaluation included the support and assistance ofthe Corporation Finance Senior 

Officers and other staff responsible for the reviews of corporate financial securities filings. 

In order to assess the effectiveness of supervisory controls, the team designed tests around the 

key internal supervisory controls that were determined to be designed appropriately. The 

teams used a combination of random and judgmental sampling techniques to select samples 

for validating operational effectiveness. The team obtained and documented evidence to 

support the effective operation ofkey supervisory controls. 

This process built upon the annual Management Assurance statement process performed for 

FMFIA purposes. The assessment team provided the Director with key background 

materials to support the assertions in the certification required by Section 961 (c)(2) of the 

Act. 

Inherent Limitations 

All control systems, including internal supervisory controls, are subject to inherent limitations. 

No matter how well-conceived and operated, an internal control system cannot provide absolute 

assurance regarding the achievement of objectives, nor can an evaluation of an internal control 

system provide absolute assurance that significant deficiencies will be identified. Also, 

projections of any evaluation of effectiveness to future periods are subject to the risk that internal 

supervisory controls may become inadequate because of changes in conditions, or that the degree 

of compliance with the policies or procedures may deteriorate. 

Because of the nature, including breadth, ofthe Commission's examination, investigation, and 

review of corporate financial securities filings functions, as well as limitations on resources, 

management and staff within the relevant offices and divisions must exercise judgment in 

5 
conducting examinations of registered entities, enforcement investigations, and reviews of 

corporate financial securities filings. As such, controls are inherently designed to allow for the 

application of judgment in decision-making. There may be instances where judgments made in 

good faith are in hindsight deemed inappropriate. 

The evaluations of internal supervisory controls and procedures applicable to staff covered by this 

report for the Commission's fiscal year ending September 30, 2012 represent the third evaluation 

conducted pursuant to the requirements of Section 961 ofthe Act. The SEC will continue to 

enhance the approach taken in 2012 to improve the effectiveness and efficiency ofthe efforts 

going forward. The results ofthe Comptroller General's review under Section 961(e) may also 

result in adjustments to the process in future years. 

Despite the limitations described above, it is our belief that the evaluations of the Commission's 

internal supervisory controls and procedures applicable to staff provide a reasonable and 

justifiable basis for the conclusions expressed in this report. 

Significant Deficiencies 

Section 961(c)(2)(D) requires each respective Director ofOCIE, Enforcement, and Corporation 

Finance and any successor offices, such as OCR, to certify that he or she has disclosed to the 

Commission any significant deficiencies in the design or operation of internal supervisory controls 

that could adversely affect the ability of the Division or Office to consistently conduct inspections, 

or investigations, or reviews of corporate financial securities filings with professional competence 

and integrity. Under the terms of Reorganization Plan No. 10 of 1950, the executive and 

administrative functions ofthe Commission are transferred to the Chairman of the Commission, 

including, among other functions, the appointment and supervision of personnel employed under 

the Commission. 4 Accordingly, the Director of each respective Division or Office should make 

any required disclosures to the Chairman of the Commission. To make this clear, the attached 

certification states that the respective Directors have "disclosed to the Chairman of the 

Commission any significant deficiencies in the design or operation of internal supervisory 

controls .... " A copy of this report is also being provided to each Commissioner. 

As part of the evaluations described above, the respective OCIE, OCR, Enforcement, and 

Corporation Finance assessment teams evaluated their findings to determine whether any 

deficiencies existed as of September 30, 2012. The severity of all deficiencies identified was 

evaluated to determine whether any, either individually or in the aggregate, constituted a 

significant deficiency. Upon completion of this process, no significant deficiencies in internal 

supervisory controls were identified. 

4 15 F.R. 3175, 64 Stat. 1265, Section 1(a). 

6 
For purposes of making the determinations described above, a "significant deficiency" meriting 

the attention by the Chairman ofthe Commission, is any deficiency, or combination of 

deficiencies, in internal supervisory controls that inhibits the respective office or division from 

achieving the overall goals established by senior management for consistently conducting 

examinations, investigations, or reviews of corporate financial securities filings with professional 

competence and integrity. 

Assessment of Effectiveness 

Based on the results of the evaluations described above, as of September 30, 2012, the internal 

supervisory controls of the Commission with respect to OCIE and OCR examinations, 

Enforcement investigations, and Corporation Finance filing reviews are effective, and the 

procedures of the Commission applicable to the OCIE, OCR, Enforcement, and Corporation 

Finance staff who perform examinations of registered entities, enforcement investigations, and 

reviews of corporate financial securities filings, respectively, are effective. 

Certification of Internal Supervisory Controls 

See Exhibit A- Section 961(c)(2) Certification 

Summary of Review by the Comptroller General 

Section 961(e) of the Act requires a review by the Comptroller General of the United States ofthe 

adequacy and effectiveness of the Commission's internal supervisory control structure and 

procedures not less frequently than once every three years. Section 961 (b )(3) of the Act requires 

this report to contain a summary of the Comptroller General's review. The Comptroller General 

began a review under Section 961(e) in March 2012. However, at the time ofthis certification, 

the Comptroller General had not completed its review. 

7 
Exhibit A 

SECTION 961(c)(2) CERTIFICATION 

Pursuant to the requirements of Section 961 ( c )(2) of the Dodd-Frank Wall Street Reform and Consumer 

Protection Act, I hereby certify that: 

1. I am directly responsible for establishing and maintaining the internal supervisory controls of the 

Division or Office of which I am the head. 

2. I am knowledgeable about the internal supervisory controls of the Division or Office of which I am the 

head. 

3. I have evaluated the effectiveness during the 90-day period ending on the final day of the fiscal year 

ended September 30, 2012 of the internal supervisory controls of the Division or Office of which I am 

the head. 

4. I have disclosed to the Chairman of the Commission any significant deficiencies in the design or 

operation of internal supervisory controls identified as a result of the evaluation described above that 

could adversely affect the ability to consistently conduct with professional competence and integrity, 

respectively: 

(a) inspections and examinations by the Office of Compliance Inspections and Examinations and 

its successor office, the Office of Credit Ratings, 

(b) investigations by the Division of Enforcement, or 

(c) reviews of corporate financial securities filings by the Division of Corporation Finance. 

This certification concerning the adequacy of the Commission's internal supervisory controls is based on 

the review described in the accompanying report of the internal supervisory controls and procedures 

applicable to the staff that performs the duties described above within the Division or Office of which I am 

the head and is accurate to the best of my knowledge and belie£ This review was performed with the 

assistance of my supervisory staff and other personnel within my Division or Office. 

With Respect to Inspections and Examinations: 

Name: Carlo V. di Florio 

Title: Director 

Office of Compliance Inspections and Examinations 

Name: 

Title: Duector 

~omas J. Butler 

~.s:::;_~,~~;,~~ .. ~ ~ _=::~ Office of Credit Ratings ___ _. 

With Respect to Investigations: 

Name: RobertS. Khuzami ~ /4.'J ""-

Title: Director 

Division of Enforcement 

Date 

Date 

Date Lzj,y}IL 

8 
With Respect to Reviews of Corp. Financial Securities Filings: 

Name: Meredith B. Cross !Jq~ L 

Title: Director 

Division of Corporation Finance 

Date 

9