Page 1

2022 Report and Certification of Internal Supervisory Controls

Introduction

Section 961 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the 

“Act”) requires that not later than 90 days after the end of each fiscal year, the Securities and 

Exchange Commission (“SEC” or “Commission”) shall report to the U.S. Senate Committee 

on Banking, Housing, and Urban Affairs and the U.S. House Committee on Financial 

Services on the conduct by the Commission of enforcement investigations, reviews of 

corporate financial securities filings, and examinations of registered entities.

1 This report is 

being submitted for the Commission's fiscal year ending September 30, 2022.

Background

The SEC’s mission is to protect investors; maintain fair, orderly, and efficient markets; and 

facilitate capital formation. Although the SEC’s functional responsibilities are organized 

among six divisions and 24 offices, the scope of the activities covered in Section 961 fall 

principally under the purview of: the Division of Enforcement (“Enforcement”), the 

Division of Corporation Finance (“Corporation Finance”), the Division of Examinations 

(“EXAMS”),2 and the Office of Credit Ratings (“OCR”).

3 Therefore, in the context of this 

report, references to “the Commission’s internal supervisory controls” or “internal 

supervisory controls of the Commission” relate to the relevant internal supervisory controls 

of Enforcement, Corporation Finance, EXAMS, and OCR.

Enforcement is principally responsible for assisting the Commission in executing its law 

enforcement function by, among other things, conducting investigations of potential 

securities law violations; recommending in appropriate circumstances that the Commission 

institute civil actions in federal court or before an administrative law judge; and prosecuting 

cases on behalf of the Commission. Corporation Finance is principally responsible for 

selectively reviewing disclosure documents that securities issuers (other than investment 

companies) file with the Commission. Through Corporation Finance’s review process, the 

Division provides comments where it believes filers can improve or enhance their 

compliance with the disclosure requirements of the federal securities laws. EXAMS

principally administers the examination program for SEC-registered entities including, 

among others, self-regulatory organizations, broker-dealers, transfer agents, clearing 

agencies, municipal advisors, investment companies, and investment advisers. EXAMS

conducts examinations to improve compliance with the securities laws, prevent fraud, 

 1 References to “examinations” within this report refer to both examinations and inspections conducted by either the 

Division of Examinations or the Office of Credit Ratings.

2 In December 2020, the Office of Compliance Inspections and Examinations was renamed the Division of Examinations. 

3 OCR was created in June 2012 and assumed from the Office of Compliance Inspections and Examinations the responsibility 

for conducting examinations of entities that are registered as nationally recognized statistical rating organizations (NRSROs). 

Consequently, OCR, as a successor office to EXAMS, is required to provide a certification under Section 961(c)(1).
Page 2

monitor risks, and inform policy. Finally, OCR is responsible for conducting examinations 

and monitoring the activities of nationally recognized statistical rating organizations to 

assess and promote compliance with statutory and Commission requirements.

This report describes the scope and methodology used to evaluate the internal supervisory 

controls and relevant procedures applicable to the Enforcement, Corporation Finance, 

EXAMS, and OCR staff who perform enforcement investigations, reviews of corporate 

financial securities filings, and examinations of registered entities. Furthermore, the report 

describes the assessments performed and whether any significant deficiencies in the internal 

supervisory controls under Section 961 have been identified by the evaluation to exist as of 

the end of the fiscal year. The report also includes a description of the inherent limitations of 

procedures applicable to staff, internal supervisory controls, and the evaluation process. 

Finally, the report includes the Certification of Supervisory Controls that is required by the 

Act and a summary of the Comptroller General’s review pursuant to Section 961(e) of the 

Act.

Internal Supervisory Controls and Procedures Applicable to Staff

Section 96l(b)(l) of the Act requires the assessment of both the Commission’s internal 

supervisory controls and procedures applicable to the Commission staff who perform 

enforcement investigations (i.e., Enforcement), reviews of corporate financial securities 

filings (i.e., Corporation Finance), and examinations of registered entities (i.e., EXAMS and 

OCR). The terms “internal supervisory controls” and “procedures applicable to staff” are not 

defined in the Act. Consistent with the scope of Section 961(b)(1)(B), “procedures 

applicable to staff” refer to the established “day-to-day” procedures to be followed by the 

employees performing examinations, investigations, and reviews. “Internal supervisory 

controls” refer to those actions established by Enforcement, Corporation Finance, EXAMS, and 

OCR to monitor that the procedures applicable to staff are consistently being performed 

according to policy and procedures, and also remain reasonable, adequate and current. This 

definition of “internal supervisory controls” is linked to procedures applicable to the staff. 

Therefore, for purposes of this report and certification, internal supervisory controls are those 

that are supervisory in nature and directly related to the consistent and complete execution 

of activities within the scope of Section 961(b)(1)(B): investigations, reviews, and 

examinations. The evaluations of internal supervisory controls and procedures applicable to 

staff covered by this report for the Commission’s fiscal year ending September 30, 2022

represent the 13th time such evaluations have been conducted pursuant to the requirements 

of Section 961 of the Act.

Scope and Methodology

The Directors4 of Enforcement, Corporation Finance, EXAMS, and OCR, each with the 

assistance of his or her supervisory staff and other office or division personnel, evaluated the 

 4 References to “Directors” in this report include any Acting Directors as permitted by Section 961(d) of the Act. Any 

Acting Directors are identified on the last page of Exhibit A to this report.
Page 3

effectiveness of internal supervisory controls and relevant procedures applicable to staff. 

Consistent with Section 961(c)(2)(C), the internal supervisory control assessment 

encompassed controls in place during the final quarter of the fiscal year ending on 

September 30, 2022 and the evaluation of the effectiveness of those controls encompassed 

the 90-day period ending on the final day of the fiscal year. Upon completion of the 

evaluation, each Director signed a certification concerning the adequacy of the 

Commission’s internal supervisory controls with respect to his or her office or division.

Assessments of the effectiveness of the relevant procedures applicable to the staff were 

conducted throughout the year as part of on-going monitoring activities, specific procedure 

assessments, or through other assessments. The conclusion regarding the effectiveness of those 

procedures was made as of the end of the fiscal year.

To facilitate an effective, efficient, and consistent approach to the evaluations, the agency 

established a working group consisting of staff from Enforcement, Corporation Finance,

EXAMS, OCR, and the Office of the Chief Risk Officer. The working group met and 

communicated regularly to discuss the execution of each division’s or office’s assessment 

and to ensure a consistent methodology for conducting the Section 961 assessment 

corresponding with relevant government-wide internal controls standards and guidance.

Enforcement, Corporation Finance, EXAMS, and OCR engaged in a “top-down, risk-based”

consideration of their functional responsibilities, focusing on assessing their respective 

objectives of consistently conducting investigations, reviews of corporate financial 

securities filings, or examinations in accordance with adopted policies and procedures. This 

approach involved identifying risks to achieving such objectives, determining whether 

controls exist (or should exist) to address those risks, and evaluating the design and 

operating effectiveness of the controls included in the evaluation. The procedures for 

collecting information to evaluate the effectiveness of internal supervisory controls 

consisted principally of interviews, observation, process walkthroughs, inspection of 

documents, self-assessments, and through the application of judgment, as appropriate. The 

approach of Enforcement, Corporation Finance, EXAMS, and OCR in assessing the 

effectiveness of the procedures applicable to the staff who perform enforcement investigations, 

reviews of corporate financial securities filings, and examinations of registered entities generally 

involved identifying the relevant procedures applicable to the staff, determining the objective of 

those procedures, and assessing whether those procedures effectively achieve the identified 

objectives.

In addition, relevant members of the working group reviewed and considered background 

material that included the review of the internal supervisory controls pursuant to the 

requirements of Section 961 of the Act, the Federal Managers’ Financial Integrity Act 

(“FMFIA”) assurance statements for fiscal year 2022, and recent Office of Inspector 

General (“OIG”) and Government Accountability Office (“GAO”) findings.

Finally, Enforcement, Corporation Finance, EXAMS, and OCR reviewed any deficiencies 

identified in the design or operation of internal supervisory controls to determine whether 

such deficiencies were considered significant, either individually or in the aggregate. 
Page 4

Enforcement, Corporation Finance, EXAMS, and OCR provided summary information for 

such determination and for the evaluation as a whole to the respective office or division 

Director in order to support the relevant effectiveness conclusions and the assertions within 

the certification.

The SEC will continue to enhance the approach taken in 2022 to improve the effectiveness 

and efficiency of the efforts going forward. The results of GAO’s reviews under Section 

96l(e) of the Act may also result in adjustments to the process in future years.

Inherent Limitations

All control systems, including internal supervisory controls, are subject to inherent 

limitations. No matter how well-conceived and operated, an internal control system cannot 

provide absolute assurance regarding the achievement of objectives, nor can an evaluation 

of an internal control system or procedures applicable to staff provide absolute assurance 

that significant deficiencies will be identified. Also, projections of any evaluation of 

effectiveness to future periods are subject to the risk that internal supervisory controls may 

become inadequate because of changes in conditions, or that the degree of compliance with 

the policies or procedures may deteriorate.

Because of the nature, including breadth, of the Commission’s investigation, review of 

corporate financial securities filings, and examination functions, as well as limitations on 

resources, management and staff must exercise judgment in conducting enforcement 

investigations, reviews of corporate financial securities filings, and examinations of 

registered entities. As such, staff procedures are inherently designed to allow for the 

application of judgment in decision-making. There may be instances where judgments made 

in good faith are in hindsight deemed inappropriate. Despite the limitations described 

above, the evaluations of the Commission’s internal supervisory controls and procedures 

applicable to staff are designed to provide a reasonable and justifiable basis for the 

conclusions expressed in this report.

Certification and Reporting

Section 96l(c)(2)(D) requires each respective Director of Enforcement, Corporation Finance, 

EXAMS, and any successor offices (i.e., OCR) to certify that he or she has disclosed to the 

Commission any significant deficiencies in the design or operation of internal supervisory 

controls that could adversely affect the ability of the applicable division or office to 

consistently conduct enforcement investigations, reviews of corporate financial securities 

filings, or examinations of registered entities with professional competence and integrity. 

Under the terms of Reorganization Plan No. 10 of 1950, the executive and administrative

functions of the Commission are transferred to the Chair of the Commission, including, 

among other functions, the appointment and supervision of personnel employed under the 
Page 5

Commission.5 Accordingly, the Director of each respective division or office should make 

any required disclosures to the Chair of the Commission. To make this clear, the attached 

certification states that the respective Directors have “disclosed to the Chair of the 

Commission any significant deficiencies in the design or operation of internal supervisory

controls.” A copy of this report is also being provided to each Commissioner.

As part of the evaluation process described above, the respective Enforcement, Corporation 

Finance, EXAMS, and OCR assessment teams evaluated their findings to determine whether 

any deficiencies in the design or operation of internal supervisory controls existed as of the 

end of the fiscal year. For any such deficiencies, the severity was evaluated to determine 

whether any, either individually or in the aggregate, constituted a significant deficiency. 

For purposes of making the determinations described above, a “significant deficiency”

meriting the attention by the Chair of the Commission, is any deficiency, or combination of 

deficiencies, in internal supervisory controls that inhibits the respective office or division 

from achieving the overall goals established by senior management for consistently 

conducting enforcement investigations, reviews of corporate financial securities filings, or 

examinations of registered entities with professional competence and integrity.

Summary of FY 2022 Assessment Results

Following the process and methodology described above, Enforcement, Corporation 

Finance, EXAMS, and OCR evaluated the effectiveness of the applicable internal 

supervisory controls and staff procedures with respect to the fiscal year ending September 

30, 2022. Based on the results of these evaluations, the internal supervisory controls with 

respect to Enforcement investigations, Corporation Finance reviews of corporate financial 

securities filings, and EXAMS and OCR examinations of registered entities were effective 

for the 90-day period ending on the final day of the fiscal year ending on September 30, 

2022. No significant deficiencies in the internal supervisory controls with respect to 

Enforcement investigations, Corporation Finance reviews of corporate financial securities 

filings, and EXAMS and OCR examinations of registered entities were identified. In

addition, the procedures applicable to the Enforcement, Corporation Finance, EXAMS, and 

OCR staff who perform enforcement investigations, reviews of corporate financial securities 

filings, and examinations of registered entities, respectively, were effective as of the end of 

the fiscal year.

Certification of Internal Supervisory Controls 

See Exhibit A - Section 961(c)(2) Certification 

 5 15 F.R. 3175, 64 Stat. 1265. Section l(a).
Page 6

Summary of Reviews by the GAO

Section 96l(e) of the Act requires a triennial review by the Comptroller General of the 

United States of the adequacy and effectiveness of the Commission's internal supervisory 

control structure and procedures. Section 961(b)(3) of the Act requires this report to contain 

a summary of the GAO's review. The SEC staff appreciates the benefit of these regular 

GAO reviews, which have enabled the SEC to improve its internal supervisory control 

systems and procedures over the past decade: 

• In April 2013, the GAO completed its first triennial review under Section 961(e). 

This report (GAO-13-314) contained one recommendation for SEC action, which the 

SEC implemented. The GAO considers this recommendation closed, indicating on 

its website that it found in a subsequent review that the “SEC has improved the 

design, operation, and documentation of its internal supervisory controls since the 

issuance of GAO-13-314.” 

• In October 2016, the GAO completed its second triennial review. This report (GAO-17-

16) contained one recommendation for SEC action, which the SEC implemented. The 

GAO considers this recommendation closed, indicating on its web site that the actions 

taken by the SEC were a “critical step to streamline their 961 supervisory control 

documentation, and increase the operating efficiency and effectiveness within and across 

the divisions and offices.”

• In December 2019, the GAO completed its third triennial review. This report (GAO20-115) contained five recommendations for SEC action, which the SEC 

implemented. In September 2021, the GAO updated its website to indicate that all 

five recommendations have been implemented and are now closed. 

The GAO recently completed its fourth triennial review. The GAO’s report (GAO-23-

105465, November 18, 2022) found that (1) the SEC in FY 2021 generally conducted risk 

assessments and established internal supervisory controls in accordance with applicable 

guidance and (2) the SEC’s framework for assessing the effectiveness of internal 

supervisory controls generally was consistent with federal internal control standards. While 

the GAO also found that the SEC’s plans for assessing the effectiveness of staff procedures 

generally were consistent with internal control standards and implemented accordingly, the 

GAO recommended that Enforcement take action to document its work performed and 

results in the memorandum used to inform the division director about the staff procedures 

assessment. The GAO also recommended that Enforcement, Corporation Finance, EXAMS, 

and OCR enhance their guidance for assessing staff procedures to address the use of 

program data and require review of their program manuals on a periodic and comprehensive 

basis. The SEC concurred with the GAO’s findings and is taking action to implement the

recommendations.
Page 7 

Exhibit A

SECTION 961(c)(2) CERTIFICATION

Pursuant to the requirements of Section 961(c)(2) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act, I hereby certify that:

1. I am directly responsible for establishing and maintaining the internal supervisory 

controls of the division or office of which I am the head. 

2. I am knowledgeable about the internal supervisory controls of the division or office 

of which I am the head.

3. I have evaluated the effectiveness during the 90-day period ending on the final day of 

the fiscal year ended September 30, 2022 of the internal supervisory controls relevant 

to section 961 of the division or office of which I am the head. 

4. I have disclosed to the Chair of the Commission any significant deficiencies in the 

design or operation of internal supervisory controls identified as a result of the 

evaluation described above that could adversely affect the ability to consistently 

conduct with professional competence and integrity, respectively:

(a) Enforcement investigations by the Division of Enforcement; 

(b) Reviews of corporate financial securities filings by the Division of 

Corporation Finance; or 

(c) Examinations of registered entities by the Division of Examinations and the 

Office of Credit Ratings.

This certification concerning the adequacy of the Commission’s internal supervisory controls 

relevant to Section 961 is based on the review described in the accompanying report of the 

internal supervisory controls and procedures applicable to the staff who perform the duties 

described above within the division or office of which I am the head and is accurate to the best of 

my knowledge and belief. This review was performed with the assistance of my supervisory 

staff and other personnel within my division or office.