Page 1 of 9 

2020 Report and Certification of Internal Supervisory Controls

Introduction 

Section 961 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the 

"Act") requires that not later than 90 days after the end of each fiscal year, the Securities and 

Exchange Commission ("SEC" or "Commission") shall report to the U.S. Senate Committee 

on Banking, Housing, and Urban Affairs and the U.S. House Committee on Financial 

Services on the conduct by the Commission of examinations of registered entities,1

enforcement investigations, and review of corporate financial securities filings. This report 

is being submitted for the Commission's fiscal year ending September 30, 2020.

Background

The SEC's mission is to protect investors; maintain fair, orderly, and efficient markets; and 

facilitate capital formation. Although the SEC's functional responsibilities are organized 

among five divisions and 25 offices, the scope of the activities covered in Section 961 fall 

principally under the purview of: the Office of Compliance Inspections and Examinations 

("OCIE"), the Office of Credit Ratings ("OCR"),2

 the Division of Enforcement 

("Enforcement"), and the Division of Corporation Finance ("Corporation Finance"). 

Therefore, in the context of this report, references to "the Commission's internal supervisory 

controls" or "internal supervisory controls of the Commission" relate to the relevant internal 

supervisory controls of OCIE, OCR, Enforcement, and Corporation Finance.

OCIE principally administers the examination program for SEC-registered entities 

including, among others, self-regulatory organizations, broker-dealers, transfer agents, 

clearing agencies, municipal advisors, investment companies, and investment advisers. 

OCIE conducts examinations to improve compliance with the securities laws, prevent fraud, 

monitor risks, and inform policy. OCR is responsible for conducting examinations and 

monitoring the activities of nationally recognized statistical rating organizations to assess 

and promote compliance with statutory and Commission requirements. Enforcement is 

principally responsible for assisting the Commission in executing its law enforcement 

function by, among other things, conducting investigations of potential securities law 

violations; recommending, in appropriate circumstances, that the Commission institute civil 

actions in federal court or before an administrative law judge; and prosecuting cases on 

 

1 References to "examinations" within this report refer to both examinations and inspections conducted by either the 

Office of Compliance Inspections and Examinations or the Office of Credit Ratings. 2 The Act also mandated the creation of OCR, which was established in June 2012 upon the hiring of its Director and was 

immediately staffed with a reassigned examination team from OCIE and a reassigned monitoring team from the Division 

of Trading and Markets. The certification mandated by Section 961 of the Act is required for the "Director of the 

Division of Enforcement, the Director of the Division of Corporation Finance, and the Director of the Office of 

Compliance Inspections and Examinations (or the head of any successor division or office)." The SEC has determined 

that OCR should be considered a successor of OCIE and therefore subject to the reporting certification of Section 961.
Page 2 of 9 

behalf of the Commission. Finally, Corporation Finance is principally responsible for 

selectively reviewing disclosure documents that securities issuers (other than investment 

companies) file with the Commission. Through Corporation Finance's review process, the 

Division provides comments where it believes filers can improve or enhance their 

compliance with the disclosure requirements of the federal securities laws.

Staffing within OCIE and Enforcement consists of attorneys, accountants, examiners, 

subject matter experts, and other employees located both in the Washington, D.C. office and 

in 11 regional offices. OCR's staff is comprised of similarly diverse professionals who are 

located in Washington, D.C. and the New York Regional Office. The majority of the SEC's 

other offices and divisions, including Corporation Finance, are located in Washington, D.C.

This report describes the scope and methodology used to evaluate the internal supervisory 

controls and relevant procedures applicable to the OCIE, OCR, Enforcement, and 

Corporation Finance staff that perform examinations of registered entities, enforcement 

investigations, and reviews of corporate financial securities filings. Furthermore, the report 

describes whether any significant deficiencies in these controls have been identified by the 

evaluation to exist as of the end of the fiscal year. The report also includes a description of 

the inherent limitations of procedures applicable to staff, internal supervisory controls, and 

the evaluation process. Finally, the report includes an assessment of control and procedure 

effectiveness, the Certification of Supervisory Controls that is required by the Act, and a 

summary of the Comptroller General's review pursuant to Section 961(e) of the Act.

Internal Supervisory Controls and Procedures Applicable to Staff

Section 96l(b)(l) of the Act requires the assessment of both the Commission's internal 

supervisory controls and procedures applicable to the Commission staff who perform 

examinations of registered entities (i.e., OCIE and OCR), enforcement investigations (i.e., 

Enforcement), and reviews of corporate financial securities filings (i.e., Corporation 

Finance). The terms "internal supervisory controls" and "procedures applicable to staff" are 

not defined in the Act. For purposes of this report and the attached certification, "procedures 

applicable to staff" refer to the established "day-to-day" procedures to be followed by the 

employees within the applicable programs. "Internal supervisory controls" refer to the 

actions established by management to monitor that the procedures applicable to staff are 

consistently being performed according to policy and procedures, and also remain reasonable, 

adequate and current.

The evaluations of internal supervisory controls and procedures applicable to staff covered 

by this report for the Commission's fiscal year ending September 30, 2020 represent the 

tenth time such evaluations have been conducted pursuant to the requirements of Section 

961 of the Act. 
Page 3 of 9 

Scope and Methodology

The Directors3 of OCIE, OCR, Enforcement, and Corporation Finance, each with the 

assistance of his or her supervisory staff and other office or division personnel, evaluated the 

effectiveness of internal supervisory controls and relevant procedures applicable to staff. 

The internal supervisory control assessment encompassed controls in place during the final 

quarter of the fiscal year ending on September 30, 2020 and the evaluation of the 

effectiveness of those controls encompassed the 90-day period ending on the final day of the 

fiscal year. Upon completion of the evaluation, each Director signed a certification 

concerning the adequacy of the Commission's internal supervisory controls with respect to 

his or her office or division. Assessments of the effectiveness of the relevant procedures 

applicable to the staff were conducted throughout the year as part of on-going monitoring 

activities, specific procedure assessments, or through other assessments. The conclusion 

regarding the effectiveness of those procedures was made as of the end of the fiscal year. 

To facilitate an effective, efficient, and consistent approach to the evaluations, the agency 

established a working group consisting of staff from OCIE, OCR, Enforcement, Corporation 

Finance, and the Office of the Chief Operating Officer. Additionally, the working group, as 

needed, obtained input from Senior Officers in OCIE, OCR, Enforcement, and Corporation 

Finance and other divisions or offices within the agency. The working group met and 

communicated regularly to discuss the execution of each division's or office's assessment 

and to ensure a consistent methodology for conducting the Section 961 assessment 

corresponding with relevant government-wide internal controls standards and guidance.

OCIE, OCR, Enforcement, and Corporation Finance engaged in a "top-down, risk-based" 

consideration of their functional responsibilities, focusing on assessing whether their 

respective objectives of consistently conducting examinations, investigations, or reviews of 

corporate financial securities filings in accordance with adopted policies and procedures 

were met. This approach involved identifying risks to achieving such objectives, 

determining whether controls exist (or should exist) to address those risks, and evaluating 

the design and operating effectiveness of the controls included in the evaluation. The 

procedures for collecting information to evaluate the effectiveness of internal supervisory 

controls consisted principally of interviews, observation, process walkthroughs, inspection 

of documents, self-assessments, and through the application of judgment, as appropriate. 

The approach of the divisions and offices to assessing the effectiveness of the procedures 

applicable to the staff who perform examinations of registered entities, enforcement 

investigations, and reviews of corporate financial securities filings generally involved identifying 

the relevant procedures applicable to the staff, determining the objective of those procedures, and 

assessing whether those procedures effectively achieve the identified objectives. 

 

3 References to "Directors" in this report include Acting Directors as permitted by Section 961(d) of the Act. Acting 

Directors are identified on the last page of Exhibit A to this report.
Page 4 of 9 

In addition, relevant members of the working group reviewed and considered background 

material that included the review of the internal supervisory controls pursuant to the 

requirements of Section 961 of the Act, the Federal Managers' Financial Integrity Act 

("FMFIA") assurance statements for fiscal year 2020, and recent Office of Inspector General 

("OIG") and GAO findings.

Finally, the divisions and offices reviewed any deficiencies identified in the design or 

operation of internal supervisory controls to determine whether such deficiencies were 

considered significant, either individually or in the aggregate. OCIE, OCR, Enforcement, 

and Corporation Finance provided summary information for such determination and for the 

evaluation as a whole to the respective office or division Director in order to support the 

relevant effectiveness conclusions and the assertions within the certification. 

The SEC will continue to enhance the approach taken in 2020 to improve the effectiveness 

and efficiency of the efforts going forward. The results of GAO's reviews under Section 

96l(e) of the Act may also result in adjustments to the process in future years.

Inherent Limitations

All control systems, including internal supervisory controls, are subject to inherent 

limitations. No matter how well-conceived and operated, an internal control system cannot 

provide absolute assurance regarding the achievement of objectives, nor can an evaluation 

of an internal control system or procedures applicable to staff provide absolute assurance 

that significant deficiencies will be identified. Also, projections of any evaluation of 

effectiveness to future periods are subject to the risk that internal supervisory controls may 

become inadequate because of changes in conditions, or that the degree of compliance with 

the policies or procedures may deteriorate. 

Because of the nature, including breadth, of the Commission's examination, investigation, 

and review of corporate financial securities filings functions, as well as limitations on 

resources, management and staff within the relevant offices and divisions must exercise 

judgment in conducting examinations of registered entities, enforcement investigations, and 

reviews of corporate financial securities filings. As such, controls and staff procedures are 

inherently designed to allow for the application of judgment in decision-making. There may 

be instances where judgments made in good faith are in hindsight deemed inappropriate.

Despite the limitations described above, the evaluations of the Commission's internal 

supervisory controls and procedures applicable to staff are designed to provide a reasonable 

and justifiable basis for the conclusions expressed in this report.

Certification and Reporting

Section 96l(c)(2)(D) requires each respective Director of OCIE, Enforcement, and 

Corporation Finance and any successor offices, such as OCR, to certify that he or she has 

disclosed to the Commission any significant deficiencies in the design or operation of 
Page 5 of 9 

internal supervisory controls that could adversely affect the ability of the applicable division 

or office to consistently conduct inspections, or investigations, or reviews of corporate 

financial securities filings with professional competence and integrity. Under the terms of 

Reorganization Plan No. 10 of 1950, the executive and administrative functions of the 

Commission are transferred to the Chairman of the Commission, including, among other 

functions, the appointment and supervision of personnel employed under the Commission.4

Accordingly, the Director of each respective division or office should make any required 

disclosures to the Chairman of the Commission. To make this clear, the attached 

certification states that the respective Directors have "disclosed to the Chairman of the 

Commission any significant deficiencies in the design or operation of internal supervisory 

controls. . ." A copy of this report is also being provided to each Commissioner.

As part of the evaluation process described above, the respective OCIE, OCR, Enforcement, 

and Corporation Finance assessment teams evaluated their findings to determine whether 

any deficiencies in the design or operation of internal supervisory controls existed as of the 

end of the fiscal year. For any such deficiencies, the severity was evaluated to determine 

whether any, either individually or in the aggregate, constituted a significant deficiency. 

For purposes of making the determinations described above, a "significant deficiency" 

meriting the attention by the Chairman of the Commission, is any deficiency, or 

combination of deficiencies, in internal supervisory controls that inhibits the respective 

office or division from achieving the overall goals established by senior management for 

consistently conducting examinations, investigations, or reviews of corporate financial 

securities filings with professional competence and integrity. 

Summary of FY 2020 Assessment Results

Following the process and methodology described above, OCIE, OCR, Enforcement, and 

Corporation Finance evaluated the effectiveness of the applicable internal supervisory 

controls and staff procedures with respect to the fiscal year ending September 30, 2020. 

Based on the results of these evaluations, the internal supervisory controls with respect to 

OCIE and OCR examinations, Enforcement investigations, and Corporation Finance 

reviews of corporate financial securities filings were effective for the 90-day period ending 

on the final day of the fiscal year ending on September 30, 2020. No significant 

deficiencies in internal supervisory controls were identified. In addition, the procedures of 

the Commission applicable to the OCIE, OCR, Enforcement, and Corporation Finance staff 

who perform examinations of registered entities, enforcement investigations, and reviews of 

corporate financial securities filings, respectively, were effective as of the end of the fiscal 

year.

 

 

4 15 F.R. 3175, 64 Stat. 1265. Section l(a). 
Page 6 of 9 

Certification of Internal Supervisory Controls 

See Exhibit A - Section 961(c)(2) Certification 

Summary of Reviews by the GAO 

Section 96l(e) of the Act requires a triennial review by the Comptroller General of the 

United States of the adequacy and effectiveness of the Commission's internal supervisory 

control structure and procedures. Section 961(b)(3) of the Act requires this report to contain 

a summary of the GAO's review.

The SEC appreciates having the benefit of these regular GAO reviews, which have enabled 

the SEC to achieve meaningful improvements in its internal supervisory control systems and 

procedures over the past decade. 

In April 2013, the GAO completed its first triennial review under Section 961(e). This 

report (GAO-13-314) contained one recommendation for SEC action, which the SEC 

implemented. The GAO considers this recommendation closed, indicating on its website 

that it found in a subsequent review that the “SEC has improved the design, operation, and 

documentation of its internal supervisory controls since the issuance of GAO-13-314.” 

In October 2016, the GAO completed its second triennial review. This report (GAO-17-16) 

contained one recommendation for SEC action, which the SEC implemented. The GAO 

considers this recommendation closed, indicating on its web site that the actions taken by the 

SEC were a “critical step to streamline their 961 supervisory control documentation, and increase 

the operating efficiency and effectiveness within and across the divisions and offices.” 

In December 2019, the GAO released the results of its third and most recent triennial 

review, "Systematically Assessing Staff Procedures and Enhancing Control Design Would 

Strengthen Oversight" (GAO-20-115). The report concludes that, as of fiscal year 2018, 

SEC's framework for assessing the effectiveness of internal supervisory controls reflected 

internal control standards. Specifically, GAO’s review found that the SEC’s framework 

included elements covering each of the five components of internal control - control 

environment, risk assessment, control activities, information and communication, and 

monitoring. The report also concluded that all the SEC controls that the GAO evaluated 

were designed consistent with standards, and that a majority operated as intended. 

However, the GAO did identify opportunities for improvement. Notably, the report 

recommended that SEC develop written policies or guidance to ensure that staff 

systematically assesses the effectiveness of procedures applicable to staff who perform 

examinations of registered entities, enforcement investigations, and reviews of corporate 

securities filings. In total, the GAO’s December 2019 report contained five 

recommendations for SEC action intended to improve control design and the assessment of 

staff procedures. In the year since the report was issued, the SEC’s Dodd-Frank 961 

Working Group and relevant offices and divisions have taken corrective action to address all 
Page 7 of 9 

five recommendations. By early December 2020, the SEC’s Office of the Chief Risk 

Officer had submitted to the GAO documentation of the actions taken and requested closure 

of the recommendations.
Page 8 of 9 

Exhibit A 

SECTION 961(c)(2) CERTIFICATION 

Pursuant to the requirements of Section 961(c)(2) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act, I hereby certify that: 

1. I am directly responsible for establishing and maintaining the internal supervisory 

controls of the division or office of which I am the head. 

2. I am knowledgeable about the internal supervisory controls of the division or office of which I 

am the head. 

3. I have evaluated the effectiveness during the 90-day period ending on the final day of the 

fiscal year ended September 30, 2020 of the internal supervisory controls of the division or 

office of which I am the head. 

4. I have disclosed to the Chairman of the Commission any significant deficiencies in the 

design or operation of internal supervisory controls identified as a result of the evaluation 

described above that could adversely affect the ability to consistently conduct with 

professional competence and integrity, respectively: 

(a) inspections and examinations by the Office of Compliance Inspections and 

Examinations and its successor office, the Office of Credit Ratings, 

(b) investigations by the Division of Enforcement, or 

(c) reviews of corporate financial securities filings by the Division of Corporation 

Finance. 

This certification concerning the adequacy of the Commission's internal supervisory controls is 

based on the review described in the accompanying report of the internal supervisory controls 

and procedures applicable to the staff that performs the duties described above within the division 

or office of which I am the head and is accurate to the best of my knowledge and belief. This 

review was performed with the assistance of my supervisory staff and other personnel within 

my division or office. 

 
Page 9 of 9 

With Respect to Examinations of Registered Entities: 

Office of Compliance Inspections and Examinations 

Name: Peter B. Driscoll 

Title: Director 

Date: 

Signature: 

 

Office of Credit Ratings 

Name: Ahmed A. Abonamah 

Title: Acting Director 

Date: 

Signature: 

 

 

With Respect to Enforcement Investigations: 

Division of Enforcement 

Name: Stephanie Avakian 

Title: Director 

Date: 

Signature: 

 

 

With Respect to Reviews of Corporate Financial Securities Filings: 

Division of Corporation Finance 

Name: Shelley Parratt 

Title: Acting Director 

Date: 

Signature: