Page 1

2023 Report and Certification of Internal Supervisory Controls

Introduction

Section 961 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the 

“Act”)1 requires that not later than 90 days after the end of each fiscal year, the Securities 

and Exchange Commission (“SEC” or “Commission”) shall report to the U.S. Senate 

Committee on Banking, Housing, and Urban Affairs and the U.S. House Committee on 

Financial Services on the conduct by the Commission of enforcement investigations, 

reviews of corporate financial securities filings, and examinations of registered entities.

2

This report is being submitted for the Commission’s fiscal year ending September 30, 2023.

Background

The SEC’s mission is to protect investors; maintain fair, orderly, and efficient markets; and 

facilitate capital formation. Although the SEC’s functional responsibilities are organized 

among six divisions and 24 offices, the scope of the activities covered in Section 961 fall 

principally under the purview of: the Division of Enforcement (“Enforcement”), the 

Division of Corporation Finance (“Corporation Finance”), the Division of Examinations 

(“EXAMS”),3 and the Office of Credit Ratings (“OCR”).

4 Therefore, in the context of this 

report, references to “the Commission’s internal supervisory controls” or “internal 

supervisory controls of the Commission” relate to the relevant internal supervisory controls 

of Enforcement, Corporation Finance, EXAMS, and OCR.

Enforcement is principally responsible for assisting the Commission in executing its law 

enforcement function by, among other things, conducting investigations of potential 

securities law violations; recommending in appropriate circumstances that the Commission 

institute civil actions in federal court or before an administrative law judge; and prosecuting 

cases on behalf of the Commission. Corporation Finance is principally responsible for 

selectively reviewing disclosure documents that securities issuers (other than investment 

companies) file with the Commission. Through Corporation Finance’s review process, the 

Division provides comments where it believes filers can improve or enhance their 

compliance with the disclosure requirements of the federal securities laws. EXAMS 

principally administers the examination program for SEC-registered entities including, 

among others, self-regulatory organizations, broker-dealers, transfer agents, clearing 

agencies, municipal advisors, investment companies, and investment advisers. EXAMS

conducts examinations to improve compliance with the securities laws, prevent fraud, 

monitor risks, and inform policy. Finally, OCR is responsible for conducting examinations 

1 15 U.S.C. § 78d-6 2 References to “examinations” within this report refer to both examinations and inspections conducted by either the 

Division of Examinations or the Office of Credit Ratings. 3 In December 2020, the Office of Compliance Inspections and Examinations was renamed the Division of Examinations. 4 OCR was created in June 2012 and assumed from the Office of Compliance Inspections and Examinations the responsibility 

for conducting examinations of entities that are registered as nationally recognized statistical rating organizations (NRSROs). 

Consequently, OCR, as a successor office to EXAMS, is required to provide a certification under Section 961(c)(1).
Page 2

and monitoring the activities of nationally recognized statistical rating organizations to 

assess and promote compliance with statutory and Commission requirements.

This report describes the scope and methodology used to evaluate the internal supervisory 

controls and relevant procedures applicable to the Enforcement, Corporation Finance, 

EXAMS, and OCR staff who perform enforcement investigations, reviews of corporate 

financial securities filings, and examinations of registered entities. Furthermore, this report 

describes the assessments performed and whether those assessments identified any 

significant deficiencies in the internal supervisory controls under Section 961 as of the end 

of the fiscal year. This report also includes a description of the inherent limitations of 

procedures applicable to staff, internal supervisory controls, and the evaluation process. 

Finally, this report includes the Certification of Supervisory Controls that is required by the 

Act and a summary of the Comptroller General’s review pursuant to Section 961(e) of the 

Act.

Internal Supervisory Controls and Procedures Applicable to Staff

Section 96l(b)(l) of the Act requires the assessment of both the Commission’s internal 

supervisory controls and procedures applicable to the Commission staff who perform 

enforcement investigations (i.e., Enforcement), reviews of corporate financial securities 

filings (i.e., Corporation Finance), and examinations of registered entities (i.e., EXAMS and 

OCR). The terms “internal supervisory controls” and “procedures applicable to staff” are not 

defined in the Act. Consistent with the scope of Section 961(b)(1)(B), “procedures 

applicable to staff” refer to the established “day-to-day” procedures to be followed by the 

employees’ performing examinations, investigations, and reviews. “Internal supervisory 

controls” refer to those actions established by Enforcement, Corporation Finance, EXAMS, and 

OCR to monitor that the procedures applicable to staff are consistently being performed 

according to policy and procedures, and also remain reasonable, adequate and current. This 

definition of “internal supervisory controls” is linked to procedures applicable to the staff. 

Therefore, for purposes of this report and certification, internal supervisory controls are those 

that are supervisory in nature and directly related to the consistent and complete execution 

of activities within the scope of Section 961(b)(1)(B): investigations, reviews, and 

examinations. The evaluations of internal supervisory controls and procedures applicable to 

staff covered by this report for the Commission’s fiscal year ending September 30, 2023,

represent the 14th time such evaluations have been conducted pursuant to the requirements 

of Section 961 of the Act.

Scope and Methodology

The Directors of Enforcement, Corporation Finance, EXAMS, and OCR, each with the 

assistance of their supervisory staff and other office or division personnel, evaluated the 

effectiveness of internal supervisory controls and relevant procedures applicable to staff. 

Consistent with Section 961(c)(2)(C), the internal supervisory control assessment 

encompassed controls in place during the final quarter of the fiscal year ending on 

September 30, 2023, and the evaluation of the effectiveness of those controls encompassed 
Page 3

the 90-day period ending on the final day of the fiscal year. Upon completion of the 

evaluation, each Director signed a certification concerning the adequacy of the 

Commission’s internal supervisory controls with respect to their office or division.

Assessments of the effectiveness of the relevant procedures applicable to the staff were 

conducted throughout the year as part of on-going monitoring activities, specific procedure 

assessments, or through other assessments. The conclusion regarding the effectiveness of those 

procedures was made as of the end of the fiscal year.

To facilitate an effective, efficient, and consistent approach to the evaluations, the agency 

established a working group consisting of staff from Enforcement, Corporation Finance,

EXAMS, OCR, and the Office of the Chief Risk Officer. The working group met and 

communicated regularly to discuss the execution of each division’s or office’s assessment 

and to ensure a consistent methodology for conducting the Section 961 assessment 

corresponding with relevant government-wide internal controls standards and guidance.

Enforcement, Corporation Finance, EXAMS, and OCR engaged in a “top-down, risk-based”

consideration of their functional responsibilities, focusing on assessing their respective 

objectives of consistently conducting investigations, reviews of corporate financial 

securities filings, or examinations in accordance with adopted policies and procedures. This 

approach involved identifying risks to achieving such objectives, determining whether 

controls exist (or should exist) to address those risks, and evaluating the design and 

operating effectiveness of the controls included in the evaluation. The procedures for 

collecting information to evaluate the effectiveness of internal supervisory controls 

consisted principally of interviews, observation, process walkthroughs, inspection of 

documents, self-assessments, and through the application of judgment, as appropriate. The 

approach of Enforcement, Corporation Finance, EXAMS, and OCR in assessing the 

effectiveness of the procedures applicable to the staff who perform enforcement investigations, 

reviews of corporate financial securities filings, and examinations of registered entities generally 

involved identifying the relevant procedures applicable to the staff, determining the objective of 

those procedures, and assessing whether those procedures effectively achieve the identified 

objectives.

In addition, relevant members of the working group reviewed and considered background 

material that included the review of the internal supervisory controls pursuant to the 

requirements of Section 961 of the Act, the Federal Managers’ Financial Integrity Act 

(“FMFIA”) assurance statements for fiscal year 2023 and recent Office of Inspector General 

(“OIG”) and Government Accountability Office (“GAO”) findings.

Finally, Enforcement, Corporation Finance, EXAMS, and OCR reviewed any deficiencies 

identified in the design or operation of internal supervisory controls to determine whether 

such deficiencies were considered significant, either individually or in the aggregate. 

Enforcement, Corporation Finance, EXAMS, and OCR provided summary information for 

such determination and for the evaluation as a whole to the respective office or division 

Director in order to support the relevant effectiveness conclusions and the assertions within 

the certification.
Page 4

The SEC will continue to enhance the approach taken in 2023 to improve the effectiveness 

and efficiency of the efforts going forward. The results of GAO’s reviews under Section 

96l(e) of the Act may also result in adjustments to the process in future years.

Inherent Limitations

All control systems, including internal supervisory controls, are subject to inherent 

limitations. No matter how well-conceived and operated, an internal control system cannot 

provide absolute assurance regarding the achievement of objectives, nor can an evaluation 

of an internal control system or procedures applicable to staff provide absolute assurance 

that significant deficiencies will be identified. Also, projections of any evaluation of 

effectiveness to future periods are subject to the risk that internal supervisory controls may 

become inadequate because of changes in conditions, or that the degree of compliance with 

the policies or procedures may deteriorate.

Because of the nature, including breadth, of the Commission’s investigation, review of 

corporate financial securities filings, and examination functions, as well as limitations on 

resources, management and staff must exercise judgment in conducting enforcement 

investigations, reviews of corporate financial securities filings, and examinations of 

registered entities. As such, staff procedures are inherently designed to allow for the 

application of judgment in decision-making. There may be instances where judgments made 

in good faith are in hindsight deemed inappropriate. Despite the limitations described 

above, the evaluations of the Commission’s internal supervisory controls and procedures 

applicable to staff are designed to provide a reasonable and justifiable basis for the 

conclusions expressed in this report, see Summary of FY 2023 Assessment Results below.

Certification and Reporting

Section 96l(c)(2)(D) requires each respective Director of Enforcement, Corporation Finance, 

EXAMS, and any successor offices (e.g., OCR) to certify that they have disclosed to the 

Commission any significant deficiencies in the design or operation of internal supervisory 

controls that could adversely affect the ability of the applicable division or office to 

consistently conduct enforcement investigations, reviews of corporate financial securities 

filings, or examinations of registered entities with professional competence and integrity. 

Under the terms of Reorganization Plan No. 10 of 1950, the executive and administrative

functions of the Commission are transferred to the Chair of the Commission, including, 

among other functions, the appointment and supervision of personnel employed under the 

Commission.5 Accordingly, the Director of each respective division or office should make 

any required disclosures to the Chair of the Commission. To make this clear, the attached 

certification states that the respective Directors have “disclosed to the Chair of the 

5 15 F.R. 3175, 64 Stat. 1265. Section l(a).
Page 5

Commission any significant deficiencies in the design or operation of internal supervisory

controls.” A copy of this report is also being provided to each Commissioner.

As part of the evaluation process described above, the respective Enforcement, Corporation 

Finance, EXAMS, and OCR assessment teams evaluated their findings to determine whether 

any deficiencies in the design or operation of internal supervisory controls existed as of the 

end of the fiscal year. For any such deficiencies, the severity was evaluated to determine 

whether any, either individually or in the aggregate, constituted a significant deficiency. 

For purposes of making the determinations described above, a “significant deficiency”

meriting the attention by the Chair of the Commission, is any deficiency, or combination of 

deficiencies, in internal supervisory controls that inhibits the respective office or division 

from achieving the overall goals established by senior management for consistently 

conducting enforcement investigations, reviews of corporate financial securities filings, or 

examinations of registered entities with professional competence and integrity.

Summary of FY 2023 Assessment Results

Following the process and methodology described above, Enforcement, Corporation 

Finance, EXAMS, and OCR evaluated the effectiveness of the applicable internal 

supervisory controls and staff procedures with respect to the fiscal year ending September 

30, 2023. The results of these evaluations provide reasonable assurance that the internal 

supervisory controls and staff procedures applicable to Enforcement investigations, 

Corporation Finance reviews of corporate financial securities filings, and EXAMS and OCR 

examinations of registered entities were effective as of September 30, 2023. No significant 

deficiencies in the internal supervisory controls with respect to Enforcement investigations, 

Corporation Finance reviews of corporate financial securities filings, and EXAMS and OCR 

examinations of registered entities were identified. 

Certification of Internal Supervisory Controls 

See Exhibit A - Section 961(c)(2) Certification 
Page 6

Summary of Reviews by the GAO

Section 96l(e) of the Act requires a triennial review by the Comptroller General of the 

United States of the adequacy and effectiveness of the Commission's internal supervisory 

control structure and procedures. Section 961(b)(3) of the Act requires this report to contain 

a summary of the GAO’s review. The SEC staff appreciates the benefit of these regular 

GAO reviews, which have enabled the SEC to improve its internal supervisory control 

systems and procedures over the past decade: 

• In April 2013, the GAO completed its first triennial review under Section 961(e). 

This report (GAO-13-314) contained one recommendation for SEC action, which the 

SEC implemented. The GAO considers this recommendation closed, indicating on 

its website that it found in a subsequent review that the “SEC has improved the 

design, operation, and documentation of its internal supervisory controls since the 

issuance of GAO-13-314.” 

• In October 2016, the GAO completed its second triennial review. This report (GAO-17-

16) contained one recommendation for SEC action, which the SEC implemented. The 

GAO considers this recommendation closed, indicating on its web site that the actions 

taken by the SEC were a “critical step to streamline their 961 supervisory control 

documentation, and increase the operating efficiency and effectiveness within and across 

the divisions and offices.”

• In December 2019, the GAO completed its third triennial review. This report (GAO20-115) contained five recommendations for SEC action, which the SEC 

implemented. In September 2021, the GAO updated its website to indicate that all 

five recommendations have been implemented and are now closed. 

• In November 2022, the GAO completed its fourth triennial review. This report 

(GAO-23-105465) contained three recommendations for SEC action, which the SEC 

implemented. In May 2023, the GAO updated its website to indicate that all three 

recommendations have been implemented and are now closed. 
Page 7 

Exhibit A

SECTION 961(c)(2) CERTIFICATION

Pursuant to the requirements of Section 961(c)(2) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act, I hereby certify that: 

1. I am directly responsible for establishing and maintaining the internal supervisory 

controls of the division or office of which I am the head. 

2. I am knowledgeable about the internal supervisory controls of the division or office 

of which I am the head.

3. I have evaluated the effectiveness during the 90-day period ending on the final day of 

the fiscal year ended September 30, 2023 of the internal supervisory controls relevant 

to section 961 of the division or office of which I am the head. 

4. I have disclosed to the Chair of the Commission any significant deficiencies in the 

design or operation of internal supervisory controls identified as a result of the 

evaluation described above that could adversely affect the ability to consistently 

conduct with professional competence and integrity, respectively:

(a) Enforcement investigations by the Division of Enforcement; 

(b) Reviews of corporate financial securities filings by the Division of 

Corporation Finance; or 

(c) Examinations of registered entities by the Division of Examinations and the 

Office of Credit Ratings. 

This certification concerning the adequacy of the Commission’s internal supervisory controls 

relevant to Section 961 is based on the review described in the accompanying report of the 

internal supervisory controls and procedures applicable to the staff who perform the duties 

described above within the division or office of which I am the head and is accurate to the best of 

my knowledge and belief. This review was performed with the assistance of my supervisory 

staff and other personnel within my division or office. 
Page 8