__________________________________________________________________________

2014 SUMMARY REPORT OF COMMISSION STAFF’S EXAMINATIONS OF

EACH NATIONALLY RECOGNIZED STATISTICAL RATING ORGANIZATION

__________________________________________________________________________

As Required by Section 15E(p)(3)(C) 

of the Securities Exchange Act of 1934

This is a report of the Staff of the U.S. Securities and Exchange Commission.

The Commission has expressed no view regarding the analysis, findings, or conclusions 

contained herein.

__________________________________

December 2014
TABLE OF CONTENTS

I. REGULATORY AND NRSRO OVERVIEW.................................................................... 2

A. Statutory Framework and Rules....................................................................................... 2

B. Registered NRSROs......................................................................................................... 3

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW....................... 4

A. Examinations under Section 15E(p)(3)............................................................................ 4

B. Examination Overview .................................................................................................... 5

III. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

REPORTS AND NOTED INSTANCES OF REMEDIAL ACTION ...................................... 6

IV. SUMMARY OF ESSENTIAL FINDINGS......................................................................... 7

A. Review Area: Adherence to Policies, Procedures, and Methodologies.......................... 8

B. Review Area: Management of Conflicts of Interest ..................................................... 11

C. Review Area: Implementation of Ethics Policies......................................................... 15

D. Review Area: Internal Supervisory Controls................................................................ 15

E. Review Area: Governance ............................................................................................ 20

F. Review Area: DCO Activities ...................................................................................... 22

G. Review Area: Complaints............................................................................................. 24

H. Review Area: Post-Employment................................................................................... 25

V. CONCLUSION ................................................................................................................... 25
2014 Section 15E Examinations Summary Report Page 2

I. REGULATORY AND NRSRO OVERVIEW

This report summarizes the examinations conducted by staff from the U.S. Securities and 

Exchange Commission (the “Staff”) under Section 15E(p)(3) of the Securities Exchange Act of 

1934 (“Exchange Act”).1

 This is a report of the Staff and, as such, reflects solely the Staff’s 

views. The U.S. Securities and Exchange Commission (“Commission”) is making this Staff 

report public as required by Section 15E(p)(3)(C) of the Exchange Act.

A. Statutory Framework and Rules

On September 29, 2006, President George W. Bush signed into law the Credit Rating Agency 

Reform Act of 2006 (the “Rating Agency Act”). 2 Section 4 of the Rating Agency Act added 

Section 15E to the Exchange Act (“Section 15E”), which provided authority for the Commission 

to implement registration, recordkeeping, financial reporting, and oversight rules with respect to

those credit rating agencies that register with the Commission as nationally recognized statistical 

rating organizations (“NRSROs”). The Rating Agency Act also amended Section 17 of the 

Exchange Act to provide the Commission with recordkeeping, reporting, and examination 

authority over registered NRSROs.3 Significantly, Section 15E(c)(2) expressly prohibits the 

Commission from regulating “the substance of credit ratings or the procedures and 

methodologies by which any [NRSRO] determines credit ratings.”4

In 2007, the Commission implemented the NRSRO registration and oversight program created 

by the Rating Agency Act by adopting Rules 17g-1 through 17g-6 and Form NRSRO.5 Pursuant 

to these rules, registered NRSROs must, among other things, make certain public disclosures, 

make and retain certain records, furnish certain financial reports to the Commission, establish 

and enforce procedures to manage the handling of material non-public information, and disclose 

and manage conflicts of interest. These rules also prohibit an NRSRO from having certain 

conflicts of interest and engaging in certain unfair, coercive, or abusive practices. The 

Commission amended several of these rules in February 2009 and December 2009 with the goals

of further increasing the transparency of NRSRO rating methodologies; strengthening the 

disclosures of rating performance; prohibiting NRSROs from engaging in certain unfair, 

coercive, or abusive practices; and enhancing NRSRO record keeping.

6

 1 15 U.S.C. § 78o-7(p)(3)(C). Unless otherwise noted, all Section and Rule references in this report are to 

the Exchange Act and rules under the Exchange Act. See 15 U.S.C § 78o-7; 15 U.S.C. § 78q (a) & (b); 17 

CFR 240.17g-1 through 17g-7.

2 Credit Rating Agency Reform Act of 2006, Pub. L. No. 109-291, 120 Stat. 1327 (2006).

3 See Sections 17(a) and 17(b) of the Exchange Act.

4 15 U.S.C. § 78o-7(c)(2). 

5 See Oversight of Credit Rating Agencies Registered as Nationally Recognized Statistical Rating 

Organizations, Exchange Act Release No. 55857 (Jun. 5, 2007), 72 FR 33564 (Jun. 18, 2007). 

6 See Amendments to Rules for Nationally Recognized Statistical Rating Organizations, Exchange Act 

Release No. 59342 (Feb. 2, 2009), 74 FR 6456 (Feb. 9, 2009) and Amendments to Rules for Nationally 
2014 Section 15E Examinations Summary Report Page 3

On July 21, 2010, President Barack Obama signed into law the Dodd-Frank Wall Street Reform 

and Consumer Protection Act (the “Dodd-Frank Act”), which, among other things, amended 

Section 15E to enhance the regulation and oversight of NRSROs by imposing new reporting, 

disclosure, and examination requirements.7

 The Dodd-Frank Act mandated the creation of the 

Office of Credit Ratings (“OCR”), which was established in June 2012 with the appointment of 

its Director, Thomas J. Butler. OCR is responsible for oversight of credit rating agencies 

registered with the Commission as NRSROs. 

The Dodd-Frank Act directed the Commission to adopt rules to implement a number of 

provisions related to NRSROs. In January 2011, the Commission adopted new Rule 17g-7.8

 

In August 2014, the Commission adopted new rules and amended certain existing rules.

9

 

Specifically, the Commission adopted new Rules 17g-8, 17g-9, and 17g-10 as well as Form ABS 

Due Dilligence-15E, and amended Rules 17g-1 through 17g-3 and 17g-5 through 17g-7 as well 

as Form NRSRO. These new rules and amended rules were not in effect as of the time period 

covered by the 2014 examinations, thus the Staff’s 2014 examination activities did not review 

whether the NRSROs’ conduct complied with these new rules and amended rules. 

B. Registered NRSROs

In 2007, following the adoption of its first set of NRSRO rules, the Commission began granting 

registrations to credit rating agencies that applied to be registered as an NRSRO. A credit rating 

agency may apply to be registered with respect to one or more of the following five classes of 

credit ratings: (1) financial institutions, brokers, or dealers (“financial institutions”); (2) 

insurance companies; (3) corporate issuers; (4) issuers of asset-backed securities (“asset-backed 

securities” or “ABS”); and (5) issuers of government securities, municipal securities, or 

securities issued by a foreign government (“government securities”).10 

The ten credit rating agencies registered as NRSROs as of December 1, 2014, and dates of their 

initial registrations are listed below:

 

Recognized Statistical Rating Organizations, Exchange Act Release No. 61050 (Nov. 23, 2009), 74 FR 

63832 (Dec. 4, 2009). 

7 The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 932, 124 Stat. 

1376, 1872-83 (2010).

8 See Disclosure for Asset-Backed Securities Required by Section 943 of the Dodd-Frank Wall Street 

Reform and Consumer Protection Act, Securities Act of 1933 Release No. 9175; Exchange Act Release 

No. 63741 (Jan. 20, 2011), 76 FR 4515 (Jan. 26, 2011).

9 See Final Rule: Nationally Recognized Statistical Rating Organizations, Exchange Act Release No. 72936 

(Aug. 27, 2014); 79 FR 55078 (Sept. 15, 2014).

10 See Section 3(a)(62)(A) of the Exchange Act.
2014 Section 15E Examinations Summary Report Page 4

NRSRO11 Date of Registration

A.M. Best Company, Inc. (“AMB”) September 24, 2007

DBRS, Inc. (“DBRS”) September 24, 2007

Egan-Jones Ratings Company (“EJR”) December 21, 2007

Fitch Ratings, Inc. (“Fitch”) September 24, 2007

HR Ratings de México, S.A. de C.V. (“HR”) November 5, 2012

Japan Credit Rating Agency, Ltd. (“JCR”) September 24, 2007

Kroll Bond Rating Agency, Inc. (“KBRA”)12 February 11, 2008

Moody’s Investors Service, Inc. (“Moody’s”) September 24, 2007

Morningstar Credit Ratings, LLC (“Morningstar”)13 June 23, 2008

Standard & Poor’s Ratings Services (“S&P”) September 24, 2007

More information on NRSRO registration applications and the state of competition, 

transparency, and conflicts of interest among NRSROs is included in the Annual Report to 

Congress under Section 6 of the Rating Agency Act, available on the Commission’s website: 

http://www.sec.gov/ocr.

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW

A. Examinations under Section 15E(p)(3)

Generally, the purpose of NRSRO examinations is to monitor compliance with federal securities 

laws and rules, identify conduct or insufficient policies and procedures or internal controls that 

potentially violate such laws and rules, and encourage remedial action. Examinations also serve 

to inform the Commission and the NRSROs’ compliance personnel of regulatory obligations and 

noteworthy industry developments. If the examination staff identifies potential violations of 

federal securities laws or rules, the Staff may refer the matter to the Commission’s Division of 

Enforcement, which is responsible for further investigation of these potential violations.

Section 15E(p)(3)(A) requires OCR to conduct an examination of each NRSRO at least annually. 

Section 15E(p)(3)(B) provides that the examination shall include a review of the following eight 

topic areas (“Section 15E Review Areas”): (i) whether the NRSRO conducts business in 

accordance with its policies, procedures, and rating methodologies; (ii) the management of 

conflicts of interest by the NRSRO; (iii) the implementation of ethics policies by the NRSRO; 

(iv) the internal supervisory controls of the NRSRO; (v) the governance of the NRSRO; (vi) the 

 11 Orders granting registration can be found at: http://www.sec.gov/about/offices/ocr.shtml. Paragraph (i) of 

Rule 17g-1 requires an NRSRO to make its current Form NRSRO and Exhibits 1 through 9 to Form 

NRSRO publicly available on its website, or through another comparable, readily accessible means within 

10 business days after the date the Commission grants an initial application for registration as an NRSRO 

or registration for an additional class of credit ratings, and within 10 business days after updating its 

registration, furnishing its annual certification, or withdrawing from registration.

12 Formerly known as LACE Financial Corp.

13 Formerly known as Realpoint LLC.
2014 Section 15E Examinations Summary Report Page 5

activities of the designated compliance officer (“DCO”) of the NRSRO; (vii) the processing of 

complaints by the NRSRO; and (viii) the policies of the NRSRO governing the post-employment 

activities of its former personnel.

Section 15E(p)(3)(C) requires the Commission to make publicly available an annual report 

summarizing: (i) the essential findings of all Section 15E examinations, as deemed appropriate 

by the Commission; (ii) the NRSROs’ responses to any material regulatory deficiencies 

identified by the Commission; and (iii) whether the NRSROs have appropriately addressed the 

recommendations of the Commission contained in previous annual reports on examinations.14

B. Examination Overview

The 2014 examinations generally focused on NRSROs’ activities for the period covering January 

1, 2013 through December 31, 2013 (the “Review Period”). The examinations also reviewed 

certain activities or credit rating actions from outside of the Review Period.

The 2014 examinations reviewed the Section 15E Review Areas and examined how each 

NRSRO adhered to Section 15E and Rules 17g-1 through 17g-7. Each of the NRSRO 

examinations was based upon an individualized risk assessment by the Staff that determined

which of the Section 15E Review Areas to emphasize particularly and the issues to focus on 

within the Section 15E Review Areas. The individualized risk assessments took into account a 

number of factors, including the NRSRO’s credit rating activities and operations, the Staff’s

findings and other observations from prior examinations, the impact of an internal control or 

compliance failure by the NRSRO, recent industry developments affecting NRSROs and the 

asset classes in which the NRSRO is registered, the NRSRO’s filings with the SEC and public 

disclosures, and relevant tips, complaints, and referrals received by the Commission. As a result 

of these individualized risk assessments, the 2014 examinations included a review of each of the 

Section 15E Review Areas while also being tailored to the specific risk profile of each NRSRO.

The 2014 examinations also focused on multiple NRSROs’ activities and ratings concerning 

certain issues that the Staff’s risk assessments determined to be relevant at these NRSROs. 

Three examples are summarized in this paragraph. First, the Staff reviewed multiple NRSROs’ 

written policies and procedures, controls, and documentation, if any, related to Information 

Technology (“IT”) and cybersecurity. In addition, the Staff conducted more focused assessments 

of certain IT and cybersecurity issues at these NRSROs; these assessments leveraged the 

knowledge of and personnel from the SEC’s Office of Information Technology, and such 

personnel participated in portions of the onsite examinations of some of the NRSROs. Second, 

the Staff reviewed multiple NRSROs’ ratings activity or rating files related to government

securities. Third, the Staff reviewed some NRSROs’ ratings-related activities and publications 

concerning certain new types of asset-backed securities. Any findings by the Staff concerning 

NRSROs’ IT and cybersecurity or their ratings activity related to government securities or these

 14 This report does not cover examinations or reviews that may be conducted outside the scope of Section 

15E. 
2014 Section 15E Examinations Summary Report Page 6

new types of asset-backed securities are addressed in this Report in the Sections concerning the 

relevant Review Areas.

The operations of many NRSROs are international or global in scale, and such NRSROs have 

one or more credit rating affiliates located outside the United States which are included in their 

NRSRO registration. Such foreign credit rating affiliates and some of their personnel may 

participate in ratings activities, including determination of particular ratings, related to U.S.-

based entities or to foreign entities that Americans invest in or that otherwise affect the U.S. 

capital markets. Based on these factors, the 2014 examinations included additional focus on the 

operations and rating activity by certain NRSROs’ foreign credit rating affiliates beyond that 

conducted by OCR in years prior. The Staff assessed whether NRSROs applied rating policies 

and procedures, methodologies, criteria, and models consistently in their different offices, 

whether these NRSROs exercised sufficient compliance oversight of their foreign credit rating 

affiliates, and whether deficiencies at these foreign credit rating affiliates could pose risks to 

these NRSROs’ U.S. operations. This additional focus included the Staff’s onsite visits to 

offices of certain NRSROs’ credit rating affiliates located in countries other than the United 

States. The Staff reviewed files of selected rating actions that personnel in these foreign offices

were involved in determining, and during the onsite visits interviewed analytical personnel 

concerning these rating files and other personnel who worked in or had responsibilities related to 

these NRSROs’ foreign offices. The Staff’s findings and recommendations related to its onsite 

visits and related examination activities of the foreign credit rating affiliates of these NRSROs

are addressed in this Report in the Sections concerning the relevant Review Areas.

For purposes of this report only, we will refer to Fitch, Moody’s, and S&P as larger NRSROs 

and the seven other NRSROs (AMB, DBRS, EJR, HR, JCR, KBRA, and Morningstar) as smaller 

NRSROs. 

III. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

REPORTS AND NOTED INSTANCES OF REMEDIAL ACTION

The Staff’s determination that an NRSRO appropriately addressed a recommendation does not 

constitute the Staff’s endorsement of that NRSRO or its policies, procedures, or operations. In a 

future examination, the Staff may check the NRSRO’s response to recommendations that it 

previously deemed to be appropriately addressed. The Staff may also review and make 

recommendations concerning the NRSRO’s policies, procedures, or operations related to the 

general subject matter of a recommendation that it previously deemed to be appropriately 

addressed. The Staff’s assessment of whether an NRSRO appropriately addressed a 

recommendation reflects solely the Staff’s view and does not necessarily reflect the views of the 

Commission. 

The Staff’s assessment of whether an NRSRO has appropriately addressed a recommendation 

depends on the specific facts and circumstances of each recommendation, including the 

promptness of the NRSRO’s response, the severity of the conduct at issue, and whether the 

remedial action undertaken by the NRSRO is expected to fully resolve the Staff’s concerns. To 

assess whether NRSROs appropriately addressed findings from the 2013 examinations, the Staff 

reviewed each NRSRO’s written submissions that responded to the Staff’s findings and 

recommendations and described its planned remedial measures, and participated in a follow-up
2014 Section 15E Examinations Summary Report Page 7

call in 2013 with each NRSRO to discuss its written response. During the 2014 examinations, 

the Staff assessed each NRSRO’s progress in implementing planned remedial measures and 

tested the existence or effectiveness of such remedial measures where possible.

NRSROs responded to the 2013 recommendations with remedial measures such as adopting new 

or revising existing policies or procedures, enhancing or implementing new internal controls, 

implementing new software systems, and conducting compliance and analytical training. Based 

on the Staff’s 2014 examinations, the Staff has determined that all recommendations from the 

2013 examinations have been appropriately addressed. 

Since the Section 15E examinations began in 2010, all of the NRSROs have increased their 

understanding of their obligations as regulated entities. The frequency of communications 

between NRSROs and the Staff has increased, and there have been enhancements in the nature of 

the information provided by NRSROs to the Staff during examinations. In addition, at many of 

the NRSROs, improvements that were initiated or implemented in previous years have been 

enhanced or become embedded in their operations and culture. 

During the 2014 examinations, the Staff observed improvements at one or more NRSROs

concerning: (i) compliance resources, monitoring, and culture; (ii) documentation and resources 

for criteria and model development and validation; (iii) document retention; and (iv) board of 

directors or governing committee (“Board” or “Boards”) oversight and documentation.

The Staff’s observations of these improvements do not constitute its endorsement of any NRSRO 

or its particular policies and procedures or operations. The Staff will continue to evaluate and 

test the sufficiency of some of these NRSROs’ improvements in future examinations, and may 

make findings and recommendations related to these improvements if appropriate.

IV. SUMMARY OF ESSENTIAL FINDINGS

Section 15E(p)(3)(C)(i) requires this Report to contain a summary of the essential findings of the 

annual examinations, as deemed appropriate by the Commission.

For purposes of this Report, “essential findings” are all findings from the 2014 examinations that 

were included with one or more recommendations in an exam summary letter sent to an NRSRO. 

“Essential findings” do not include the Staff’s general observations that are not included in an 

exam summary letter to an NRSRO. These essential findings are not findings of the 

Commission. In this Report, essential findings are organized by the applicable Section 15E 

Review Areas. The Commission has not determined whether any finding discussed in this report 

constitutes a “material regulatory deficiency,” but may do so in the future. 

In the following Sections of this Report, the numbered headers identify in general terms the 

Staff’s findings concerning one or more NRSROs, and the paragraph or paragraphs following 

each numbered header provide additional NRSRO-level detail concerning these findings and the 

Staff’s corresponding recommendations.
2014 Section 15E Examinations Summary Report Page 8

A. Review Area: Adherence to Policies, Procedures, and Methodologies 

Section 15E and Commission rules require that NRSROs maintain and enforce various written 

policies and procedures. Section 15E(c)(3)(A) requires NRSROs to establish, maintain, enforce, 

and document an effective internal control structure governing the implementation of and 

adherence to policies, procedures, and methodologies for determining credit ratings. A general 

description of the procedures and methodologies used by the NRSRO to determine credit rating

must be included in Exhibit 2 to Form NRSRO.

The Staff reviewed ratings actions of each NRSRO for certain issuers to determine whether the 

NRSRO conducted business in accordance with its policies, procedures, methodologies, and 

criteria. In addition, the Staff reviewed NRSROs’ other ratings-related activities such as the

development and review of methodologies, criteria, and models. The Staff also reviewed rating 

files and documentation of other ratings-related activities to evaluate whether each NRSRO 

adhered to recordkeeping requirements. To select rating files to review, the Staff used a riskbased sampling process that considered issues such as the significance of the rated asset class to 

the financial markets and the NRSRO’s business, the NRSRO’s activity in the rated asset class, 

the likelihood of harm if a rating was not determined in accordance with the NRSRO’s

methodologies and procedures, news reports and developments concerning NRSROs or 

particular asset classes, and information the Staff learned during examinations. 

The Staff’s reviews of the Section 15E Review Areas included testing whether each NRSRO 

operated in accordance with its policies, procedures, and methodologies. The Staff’s essential 

findings regarding NRSROs conducting ratings-related activities in accordance with their

policies, procedures, methodologies, and criteria are discussed in this Section of this Report. The 

Staff’s essential findings regarding NRSROs’ adherence to policies and procedures related to

other Review Areas are generally discussed in later Sections of this Report. Instances where 

policies, procedures, and methodologies needed to be established or improved are also generally 

discussed in later Sections of this Report.

The Staff’s essential findings regarding whether each NRSRO has conducted its business in 

accordance with its policies, procedures and methodologies are as follows:

1. There were several instances where one larger NRSRO and four smaller NRSROs did not 

apply their rating policies and procedures or did not apply or make required disclosures 

concerning their methodologies or criteria. 

At one smaller NRSRO, a substantial number of rating actions did not adhere to certain policies 

and procedures concerning disclosure of methodologies applied to ratings, conducting timely 

surveillance, or implementation of issuer-requested edits to rating releases. Another smaller 

NRSRO did not appear to adhere to its rating definitions for one surveillance rating by assigning 

a rating that did not appear to reflect this NRSRO’s internal analysis concerning this issuer. In 

addition, the rating publication did not explain all of the key reasons for this rating action. 

Another rating file from this NRSRO’s foreign credit rating affiliate implemented an issuerrequested edit to a rating release that was not permitted by its policies and procedures. Several 

rating publications of one larger NRSRO did not clearly explain how this NRSRO applied its 
2014 Section 15E Examinations Summary Report Page 9

criteria to these ratings or did not describe criteria deviations made for these ratings, as required 

by its policies and procedures. 

The Staff recommended various corrective measures to these three NRSROs to ensure that they 

adhere to their rating policies and procedures and correctly apply and make required disclosures 

concerning their rating definitions, methodologies, and criteria.

Another smaller NRSRO did not downgrade certain classes of mortgage-backed securities after

these securities experienced temporary interest shortfalls, which appeared to be inconsistent with 

its published methodology and ratings definitions. This NRSRO also did not update its 

surveillance ratings of some mortgage-backed securities on a monthly basis as required by its 

methodology. The Staff recommended that this NRSRO review its ratings policies and 

procedures, methodologies, and ratings definitions, as well as related disclosures, to ensure they 

reflect its actual practices. At another smaller NRSRO, it was unclear whether rating committee 

members applied its published methodology. The Staff recommended that this NRSRO ensure 

that it applies its published methodology and documents its application of this methodology.

2. One larger NRSRO and one smaller NRSRO did not adhere to some of their policies and 

procedures concerning timely dissemination of accurate ratings.

At one larger NRSRO, there were a notable number of instances where the credit officer was not 

promptly notified of errors in a rating publication or an analyst did not document the plan to 

correct these errors, in contravention of its policies and procedures. There were also a few 

instances where this NRSRO’s public website was not promptly updated to reflect rating 

changes. 

At one smaller NRSRO, actual practices for dissemination of ratings on the NRSRO’s website 

and other sources did not adhere to its written policies and procedures, one rating action was 

published after a significant delay, and there were weaknesses in this NRSRO’s policies and

procedures concerning timely publication of ratings. 

The Staff recommended that these two NRSROs review and enhance or revise their policies and 

procedures and internal controls concerning timely publication and updating of ratings 

information. 

3. One larger NRSRO and three smaller NRSROs did not adhere to some of their policies 

and procedures when developing or reviewing certain methodologies, criteria, or models. 

One larger NRSRO issued a rating using a model that its model review committee had 

previously determined was no longer suitable, and adopted a replacement model several months 

after the timeframe set by this committee. The Staff recommended that this larger NRSRO 

ensure it has sufficient internal controls for the review and application of criteria and models. 

One smaller NRSRO published a methodology that was not approved by the responsible 

committee, in contravention of its policies and procedures. Another smaller NRSRO did not 
2014 Section 15E Examinations Summary Report Page 10

review many of its methodologies within the timeframe required by its policies and procedures. 

A third smaller NRSRO did not review its rating model as required by its policies and 

procedures. The Staff recommended that these three NRSROs ensure they adhere to their 

policies and procedures concerning reviewing rating methodologies or models. 

4. One larger NRSRO and one smaller NRSRO did not adhere to several of their policies 

and procedures concerning access to and protection of confidential information and Material 

Non-Public Information.

One larger NRSRO provided non-employee members of its Board with information regarding 

future changes in rating methodologies; it was unclear whether this NRSRO’s providing this 

information was permissible, because its policies and procedures regarding non-employee Board 

members’ access to confidential information and Material Non-Public Information (“MNPI”)

were not sufficiently clear. The Staff recommended that this NRSRO clarify its policies and 

procedures and ensure it has adequate internal controls concerning its governing body’s access to 

confidential information and MNPI. One smaller NRSRO did not review some personnel’s 

permissions to access MNPI or confidential information as required by its policies and 

procedures, and some of this NRSRO’s analysts sent MNPI or confidential information to their 

personal email accounts in contravention of its policies and procedures. The Staff recommended 

that this NRSRO adhere to and enforce such policies and procedures.

5. Certain rating files and rating publications of two larger NRSROs and four smaller 

NRSROs that were reviewed by the Staff did not adhere to document retention requirements and 

other operational policies and procedures. 

Rule 17g-2(a)(2) requires NRSROs to make and retain certain information for each rating it 

issues, including the identities of certain personnel who participated in determining or approved 

the credit rating and a record of whether the credit rating was solicited or unsolicited. Rule 17g2(b) requires an NRSRO to retain certain books and records related to its rating business. For 

example, Rule 17g-2(b)(2) requires an NRSRO to retain internal records and work papers used to 

form the basis of a rating it issues, and Rule 17g-2(b)(7) requires the NRSRO to retain its 

external and internal communications, including electronic communications, related to initiating, 

determining, maintaining, monitoring, changing, or withdrawing a rating. Rule 17g-2(f) requires 

an NRSRO to promptly furnish to the Commission or its representatives copies of required 

records, including English translations of those documents upon request.

Several rating files at one smaller NRSRO contained incomplete or inaccurate information in 

rating committee memos or were missing documents in its document retention system. This 

smaller NRSRO also had weaknesses in its email retention practices, and did not promptly 

produce certain email communications and rating file materials requested by the Staff. The Staff 

recommended that this NRSRO ensure it makes and retains required records, enhance its 

document retention practices, and comply with its obligations under Rule 17g-2(f).
2014 Section 15E Examinations Summary Report Page 11

At one larger NRSRO, several rating files and rating publications were missing required 

documents, did not adhere to operational policies and procedures, or did not make certain 

required disclosures. At another larger NRSRO and two smaller NRSROs, some rating files did 

not contain complete and accurate documentation related to rating committee presentations and 

records or the methodology, criteria, or models applied. Another smaller NRSRO’s press 

releases for unsolicited ratings did not make disclosures required by its policies and procedures.

The Staff recommended that these five NRSROs enhance their internal controls to ensure that 

they comply with Rule 17g-2 and their policies and procedures concerning determining ratings, 

creation and retention of ratings-related records, and disclosures on rating publications. 

B. Review Area: Management of Conflicts of Interest 

Section 15E(h)(1) requires an NRSRO to establish, maintain, and enforce written policies and 

procedures reasonably designed to address and manage conflicts of interest. Rule 17g-5(b)

identifies certain types of conflicts of interest that an NRSRO must disclose in Exhibit 6 to Form 

NRSRO and establish, maintain, and enforce written policies and procedures to address and 

manage. The NRSRO’s written policies and procedures to address and manage these conflicts 

must be disclosed in Exhibit 7 to Form NRSRO. For example, Rules 17g-5(b)(1) and (2) 

concern the conflicts of interest related to being paid by issuers, underwriters, or obligors to 

determine ratings with respect to securities that they issue or underwrite or with respect to the 

obligor. Similarly, Rule 17g-5(b)(9) concerns the conflict of interest related to issuing or 

maintaining a rating for certain securities or instruments that was paid for by the issuer, sponsor, 

or underwriter of the security or instrument. Rule 17g-5(c) lists certain conflicts of interest that 

are strictly prohibited. For example, Rule 17g-5(c)(5) prohibits an NRSRO from issuing or 

maintaining a rating for an obligor or security where the NRSRO made recommendations to the 

issuer or obligor about its corporate or legal structure, assets, liabilities, or activities.

The Staff’s essential findings regarding the management of conflicts of interest are as follows:

1. All three larger NRSROs and one smaller NRSRO had weaknesses concerning access to 

market-share and revenue information by certain personnel who participate in ratings and criteria 

development activities.

As discussed above, Rules 17g-5(b)(1), (2), and (9) require NRSROs to disclose and have 

policies and procedures sufficient to manage conflicts of interest related to being paid by issuers, 

underwriters, obligors, or sponsors. 

The Staff’s review of one larger NRSRO’s revisions to one of its rating criteria, including 

extensive review of its emails, suggests that this NRSRO’s business and market-share concerns 

influenced the substance of the criteria. Some of this NRSRO’s business personnel engaged in a 

concerted effort to address concerns raised by a trade association about this NRSRO’s 

contemplated revisions to the criteria report, and this criteria report was changed in a manner that 

addressed the business personnel’s concerns and was advantageous to the trade group. Also, 

documentation to support this change was lacking. The Staff recommended that this NRSRO 

enforce its policies and procedures and internal controls to separate the analytical process from 

commercial influence and ensure that the analytic justification of its criteria is adequately 
2014 Section 15E Examinations Summary Report Page 12

recorded and maintained. The Staff also recommended that this NRSRO’s Board retain an 

independent auditor, to be approved by OCR, to conduct a review of the development of the

criteria and provide a written report summarizing the review to this NRSRO’s Board and 

compliance group as well as OCR. 

At another larger NRSRO, the chief credit officer and certain other credit officers reviewed nonpublic information concerning the NRSRO’s revenue, financial performance, and market share

even though its policies and procedures prohibit credit officers from accessing such information. 

The Staff recommended that this NRSRO ensure it adheres to its policies and procedures that 

restrict specified personnel, including credit officers, from accessing certain revenue, financial, 

and market-share information. 

One larger NRSRO and one smaller NRSRO permitted some senior officers to access non-public 

information concerning their financial performance and market share and to participate in rating 

committees and other ratings activities. However, the larger NRSRO did not have sufficient 

policies and procedures to manage this conflict of interest, and the smaller NRSRO did not 

clearly disclose this conflict of interest on Exhibit 6 to Form NRSRO. The Staff recommended 

that this larger NRSRO enhance its policies and procedures to manage this conflict of interest, 

and that this smaller NRSRO enhance its disclosure concerning this conflict on Exhibit 6 to

Form NRSRO. In addition, neither of these NRSROs sufficiently disclosed on Exhibit 7 to Form 

NRSRO their policies and procedures to manage this conflict of interest related to the 

involvement in ratings activities of personnel with access to non-public financial and marketshare information, and the Staff recommended that both of these NRSROs enhance such 

disclosures on Exhibit 7 to Form NRSRO. 

2. One larger NRSRO lacked sufficient policies and procedures related to anticompetitive 

practices that are prohibited by Rule 17g-6 and some of its activities may be inconsistent with 

Rule 17g-6.

Rule 17g-6(a)(4) prohibits an NRSRO from issuing or threatening to issue a lower credit rating 

or refusing to issue a credit rating of certain securities issued by an asset pool or as part of an

asset-backed securities transaction unless the NRSRO rates all or a portion of the assets in the 

pool or the transaction, where this conduct has an anticompetitive purpose. Rule 17g-2(b)(9) 

requires an NRSRO to retain internal information and analysis used to develop a procedure or 

methodology to treat another NRSRO’s ratings when issuing a rating for a security or money 

market instrument issued by an asset pool or part of an asset-backed securities transaction. 

Several of this larger NRSRO’s criteria notched other NRSROs’ ratings below the equivalent of 

its rating and required a rated pool of securities to contain a minimum percentage of securities 

that it rates. This NRSRO lacked sufficient documentation of the analytic purposes for these 

criteria’s notching and minimum inclusion requirements, and also lacked sufficient policies and 

procedures to ensure its treatment of other NRSROs’ ratings complied with Rules 17g-6 and 

17g-2. The Staff recommended that this NRSRO enhance its internal controls and policies and 

procedures to ensure that the analytic justification of its criteria is sufficient and documented and 

that its criteria are not influenced by commercial considerations. The Staff also recommended 

that this NRSRO retain all records related to its development of criteria.
2014 Section 15E Examinations Summary Report Page 13

In addition, Rule 17g-6(a)(1) prohibits an NRSRO from conditioning the issuance of a credit 

rating on the purchase by an issuer or obligor of any other services or products of the NRSRO. 

Language in this larger NRSRO’s engagement letters and policies and procedures suggested that 

it is mandatory or automatic for the NRSRO to issue solicited ratings of all debt of an issuer that 

it rates. During the Review Period, there were numerous instances where this NRSRO rated an 

issuance and charged the issuer even though the issuer did not request that this NRSRO rate the 

issuance. The Staff recommended that this NRSRO review and revise its engagement letters and 

policies and procedures regarding its automatic treatment of additional debt ratings as solicited

and ensure that issuers fully understand their options regarding its ratings of future debt 

issuances.

 

3. One larger NRSRO and six smaller NRSROs had weaknesses in their policies and 

procedures and controls governing employee securities ownership.

Pursuant to Rule 17g-5(b)(6), it is a conflict of interest if an NRSRO allows its personnel to 

directly own securities or money market instruments or have direct ownership interests in issuers 

or obligors subject to a credit rating determined by that NRSRO. This conflict of interest is 

permitted if an NRSRO discloses it in Exhibit 6 to Form NRSRO and has sufficient written 

policies and procedures to manage it. Rule 17g-5(c)(2) prohibits an NRSRO from issuing or 

maintaining a rating with respect to a person where the NRSRO or certain personnel that 

participated in determining or approving a rating directly owns securities of or has a direct

ownership in the person that is subject to the rating. 

At one smaller NRSRO, an analyst participated in determining or approving the ratings of two 

issuers in which that analyst owned securities, in violation of Rule 17g-5(c)(2). Moreover, this 

NRSRO did not have policies and procedures for reviewing a prior rating if a conflict is 

discovered or for employee divestiture of securities. There were also weaknesses in this smaller 

NRSRO’s policies and procedures regarding pre-clearance of securities trading by certain nonanalytical personnel. The Staff recommended that this NRSRO enhance its securities ownership 

policies and procedures, including establishing policies and procedures for the review of a prior 

rating where a conflict of interest is discovered and for securities divestiture. 

At one larger NRSRO, some existing policies and procedures concerning prohibited securities 

holdings and documentation of securities ownership were not sufficiently detailed. There were 

also weaknesses in this NRSRO’s policies and procedures to prevent a recused analyst from 

participating in the rating committee and to prevent it from publishing a rating where a recused 

analyst participated in the rating committee. At the foreign credit rating affiliate of another 

smaller NRSRO, several employees did not report their securities purchases through the 

NRSRO’s electronic system, as required by its policies and procedures. There were weaknesses 

in four other smaller NRSROs’ monitoring of employees’ securities ownership. The Staff 

recommended that these six NRSROs enhance their policies and procedures and controls 

concerning securities ownership, including improving monitoring of employees’ securities 

holdings and handling of recusals.
2014 Section 15E Examinations Summary Report Page 14

4. All seven of the smaller NRSROs had weaknesses in policies and procedures concerning 

certain conflicts of interest or did not sufficiently disclose certain conflicts of interest.

Two smaller NRSROs’ policies and procedures did not address the full scope of conduct

prohibited by Rule 17g-5. The Staff recommended that both of these smaller NRSROs establish 

or revise conflicts of interest policies and procedures to sufficiently prohibit the conflicts of 

interest covered by Rule 17g-5(c).

Two smaller NRSROs did not have sufficient policies and procedures concerning certain 

conflicts of interest, including those addressed by Rules 17g-5(b)(1), (2), and (9). One of these 

smaller NRSROs lacked sufficient policies and procedures or internal controls to screen rating 

committee participants for conflicts of interest, and did not sufficiently disclose some conflicts of 

interest on Exhibit 6 to Form NRSRO. At the other smaller NRSRO, an internal questionnaire 

and a certification form that it used to manage conflicts of interest related to its issuer-paid 

business model were insufficient and were not completed promptly and accurately on some

occasions. 

Three smaller NRSROs did not have sufficient controls and procedures to identify and monitor 

conflicts of interest. At one of these smaller NRSROs, one manager did not complete a required 

conflicts-of-interest questionnaire and another manager did not comply with policies and 

procedures concerning receipt of a gift from a person that does business with the NRSRO. Two 

other smaller NRSROs did not sufficiently monitor outside business activities of its employees 

or associated persons, and one of these smaller NRSROs also did not completely and accurately 

disclose on Exhibit 6 to Form NRSRO certain conflicts of interest that it had identified. 

The Staff recommended that these five smaller NRSROs review and enhance their policies and 

procedures, as well as controls such as regular monitoring activities and certifications, to manage 

conflicts of interest. The Staff also recommended that two of the smaller NRSROs review and 

revise their disclosures on Exhibit 6 and Exhibit 7 to Form NRSRO.

5. Four smaller NRSROs did not sufficiently separate analytical activity from business 

activity.

Rule 17g-5(c)(6) prohibits an NRSRO from issuing a rating where the fee paid for the rating was

negotiated, discussed, or arranged by a person within the NRSRO who had responsibility for 

determining ratings or for developing or approving procedures, methodologies, or models used to 

determine ratings. To facilitate compliance with this Rule or as a best practice, some NRSROs 

established controls to separate analytical functions from business development.

At one smaller NRSRO, an analytical supervisor appeared to have participated in sales and 

marketing activity concerning certain ratings issued out of this NRSRO’s regional office while 

also participating in determining these ratings. Another smaller NRSRO did not have policies 

and procedures to handle inadvertent access to fee information by personnel with analytical 

responsibilities. Another smaller NRSRO permitted analytical personnel to give gifts to issuers 

and did not have any controls related to such gift-giving. At one office of another smaller 

NRSRO, there was insufficient physical separation of analytical personnel and business 
2014 Section 15E Examinations Summary Report Page 15

personnel. The Staff recommended that three of these NRSROs establish or enhance and enforce 

written policies and procedures to sufficiently separate analytical activity from business activity, 

and recommended that the other NRSRO enhance the physical separation of analytic and 

business personnel at its offices. 

C. Review Area: Implementation of Ethics Policies

Section 15E(a)(1)(B)(v) requires that an application for registration as an NRSRO include 

information regarding whether or not the NRSRO has in effect a code of ethics, and if not, the 

reasons it does not have a code of ethics. An NRSRO must provide a copy of its written code of

ethics or a statement of the reasons it does not have such a code in Exhibit 5 to Form NRSRO. 

Each NRSRO has implemented written ethics policies and procedures. During the 2014 

examinations, the Staff reviewed each NRSRO’s ethics policies and procedures, as well as a 

sample of each NRSRO’s employee certifications or monitoring activities concerning their code 

of ethics. Much of the content of these policies and procedures addresses other related review 

areas under Section 15E(p)(3)(B). As such, to the extent that the Staff made essential findings 

related to the implemented ethics policies and procedures, those findings are addressed in other 

sections of this report.

D. Review Area: Internal Supervisory Controls

Section 15E(c)(3)(A) requires that each NRSRO establish, maintain, enforce, and document an 

effective internal control structure governing the implementation of and adherence to policies, 

procedures, and methodologies for determining credit ratings. Rule 17g-2(a)(6) requires an 

NRSRO to make and retain a record documenting its established procedures and methodologies 

used to determine credit ratings. The Staff reviewed each NRSRO’s overall control structure, 

including the internal control structure related to determining credit ratings. 

Section 15E(g)(1) requires an NRSRO to establish, maintain, and enforce written policies and 

procedures reasonably designed to prevent the misuse of material, non-public information by the 

NRSRO or any person associated with the NRSRO. Rule 17g-4(a)(3) provides that these written 

policies and procedures must include policies and procedures reasonably designed to prevent the 

inappropriate dissemination of pending credit rating actions within and outside the NRSRO

before issuing the rating on the Internet or through another readily accessible means. 

The Staff’s essential findings regarding internal supervisory controls are as follows:

1. There were some weaknesses in two larger NRSROs’ and five smaller NRSROs’ 

policies and procedures or controls concerning the determination or review of ratings. 

It appears that one larger NRSRO deviated from its criteria and rating policies and procedures by 

publishing ratings for a transaction using unreliable valuations data. This NRSRO subsequently 

withdrew these ratings because of concerns about the data it used, and the transaction was 
2014 Section 15E Examinations Summary Report Page 16

removed from the market. The Staff recommended that this NRSRO establish, maintain, 

enforce, and document an effective internal control structure for its rating process.

There were weaknesses in internal controls related to the rating committee process at two smaller 

NRSROs and one larger NRSRO. One of these smaller NRSROs did not have sufficient internal 

controls concerning analysts participating in multiple roles at rating committees and exceptions 

to rating committee policies and procedures. Another smaller NRSRO did not have sufficient 

controls for documenting rating committee members and rating committees’ consideration of all 

ratings. The larger NRSRO did not sufficiently document that its rating committee meetings

satisfied certain requirements concerning rating committee eligibility and voting. The Staff 

recommended that these three NRSROs enhance their internal controls over or documentation of 

the rating committee process. This larger NRSRO also did not have clear policies and 

procedures concerning the process and documentation for certain rating opinions, and the Staff 

recommended that it establish sufficient written policies procedures for rating opinions. 

There were multiple weaknesses in two smaller NRSROs’ documentation of or controls related 

to some of their methodologies. One smaller NRSRO did not have a sufficient system to track or 

update credit ratings that it determined to be dependent on the credit rating of another entity, and 

one of this NRSRO’s rating methodologies did not sufficiently document its use of base case and 

stress case scenario tests when determining ratings. In addition, this NRSRO established a 

methodology for cured defaults during the Review Period and did not disclose or describe this 

methodology in Exhibit 2 to Form NRSRO or appear to sufficiently inform analytical personnel 

of this methodology. The Staff recommended that this NRSRO establish a system to track 

dependent ratings, ensure that its methodologies sufficiently document the use of base case and 

stress case scenario tests, and establish policies and procedures for methodology development 

and disclosure. This smaller NRSRO also did not have a sufficient system to furnish requested 

records to the Staff within the timeframe and in the format requested, and the Staff 

recommended that this NRSRO enhance its internal controls to ensure it complies with Rule 17g2(f). At another smaller NRSRO, the methodology for an ABS asset class did not sufficiently 

document committee membership, issuers’ review of pre-sale reports, and the timeframe for 

surveillance. The Staff recommended that this NRSRO revise its rating methodology for this 

ABS asset class to adequately reflect its actual practices.

At one smaller NRSRO, there were weaknesses in its policies and procedures concerning the 

timing and documentation of its reviews of significant rating changes. In addition, this smaller 

NRSRO’s policies and procedures did not require each rating release to disclose the specific 

criteria that it applied to the rating. The Staff recommended that this NRSRO develop and 

enhance policies and procedures for its reviews of significant rating changes, and consider 

revising its policies and procedures to require each rating release to disclose the criteria that it 

applied to the rating.

2. Two larger NRSROs and two smaller NRSROs lacked sufficient policies and procedures

and controls concerning contractors’ or non-NRSRO affiliates’ access to information and 

involvement in ratings activities. 
2014 Section 15E Examinations Summary Report Page 17

At one larger NRSRO, employees of a non-NRSRO affiliate participated in the rating process, 

including presenting analysis at rating committees. There were weaknesses in this NRSRO’s 

training, monitoring, and conflicts-of-interest screening of this affiliate’s employees. Also, 

employees of a third-party IT vendor that provided services to this NRSRO were not subject to 

sufficient controls concerning securities ownership and outside business activities. The Staff 

recommended that this NRSRO ensure that it has sufficient internal controls over personnel of 

non-NRSRO affiliates and third-party contractors, and that third-party vendors implement 

effective internal controls to address identified weaknesses and adhere to the NRSRO’s policies 

and procedures as required by applicable service agreements. 

At one smaller NRSRO, certain employees of a non-NRSRO affiliate participated in determining 

the NRSRO’s ratings, including voting at rating committees. Because these individuals were 

employed by the non-NRSRO affiliate, they may not have been subject to the same oversight by 

the DCO. Another smaller NRSRO lacked written policies and procedures concerning the use of 

non-employee consultants and it is unclear whether consultants were subject to this NRSRO’s 

policies and procedures. At another larger NRSRO, there were weaknesses in internal controls 

over access to the NRSRO’s confidential information by a non-NRSRO affiliate and this 

affiliate’s subcontractors. The Staff made various recommendations to these three NRSROs to 

establish or enhance their internal controls concerning non-NRSRO personnel’s and consultants’ 

involvement in the ratings process and access to confidential information.

3. One larger NRSRO and three smaller NRSROs did not sufficiently review their policies 

and procedures, criteria, methodologies, or models.

One larger NRSRO lacked effective internal controls related to models that were developed by a 

non-NRSRO affiliate and other third parties and used by the NRSRO in its credit rating process. 

This larger NRSRO’s policies and procedures did not require it to independently verify such 

models or test the third-parties’ quality controls. Errors in these third-party models resulted in 

changes to a substantial number of this NRSRO’s outstanding ratings. The Staff recommended 

that this NRSRO establish, document, and enforce effective internal controls for independent

verification of models provided by its non-NRSRO affiliate and for periodic testing of this nonNRSRO affiliate’s quality controls over the models. The Staff also recommended that this 

NRSRO ensure that its non-NRSRO affiliate promptly and sufficiently remediates weaknesses in 

its quality controls for models, and that this NRSRO present to its Board a written plan to 

remediate certain model errors and address the risk of other model errors. In addition, this larger 

NRSRO’s model review group did not verify whether model specifications appropriately 

reflected the applicable methodology requirements. The Staff recommended that this NRSRO 

establish policies and procedures to review and verify that the specifications for all models

appropriately reflect the applicable methodology requirements.

At one smaller NRSRO, there were often delays in the Board’s approval of new methodologies

and in applying new methodologies to outstanding ratings. The Staff recommended that this 

NRSRO establish, maintain, enforce, and document procedures for the timely review and 

implementation of methodology changes and for the disclosure of potential rating changes 

resulting from a change in methodology. Another smaller NRSRO did not have a policy 

concerning correction of errors in its rating model or in its ratings. At another smaller NRSRO, 
2014 Section 15E Examinations Summary Report Page 18

there were no written policies and procedures or insufficient documentation concerning its 

annual reviews of policies and procedures and methodologies, criteria, and models. The Staff 

recommended that these two NRSROs establish or enhance policies and procedures and 

documentation concerning such activities.

 

4. All three of the larger NRSROs and two of the smaller NRSROs did not have sufficient 

policies and procedures or controls related to IT or cybersecurity.

IT and cybersecurity are increasingly significant components of an NRSRO’s internal control 

structure, which is subject to the requirements of Section 15E(c)(3)(A), and facilitate an 

NRSRO’s timely issuance and monitoring of ratings with integrity. IT and cybersecurity policies 

and procedures and controls are also integral to an NRSRO’s compliance with Section 15E(g) 

and Rule 17g-4 concerning the protection and prevention of the misuse or inappropriate 

dissemination of MNPI. They also often affect an NRSRO’s capacity to publish accurate ratings 

in a timely fashion and in compliance with Rule 17g-4(a)(3).

Two of the smaller NRSROs had insufficient written policies and procedures and controls 

regarding IT and cybersecurity. One of these smaller NRSROs did not have written policies and 

procedures concerning cybersecurity and management of access to its network, systems, 

applications, and files, did not test its disaster recovery system, and did not address IT-related 

risks identified in audits. At the other smaller NRSRO, there were no policies and procedures 

and weak controls governing its electronic document retention system and access to this system. 

Also, this smaller NRSRO did not document its IT system tests or responses to findings of these 

tests. The Staff recommended that these two NRSROs establish or enhance written IT and 

cybersecurity policies and procedures and internal controls, and enhance their IT testing and 

responses to IT-related tests.

All three of the larger NRSROs had weaknesses in their IT policies and procedures or controls 

concerning personnel’s access to information that is confidential, MNPI, or otherwise restricted. 

One larger NRSRO did not have written policies and procedures concerning the use of and 

access to shared drives that contained confidential information, and its controls over granting, 

reviewing, and changing access to such drives were not sufficient. At another larger NRSRO, 

some IT systems and applications allowed ratings personnel improperly broad access to 

confidential ratings information, and the IT access rights of an employee who transferred from 

an analytical group to a business group were not changed in a sufficient timeframe. At the other

larger NRSRO, there were weaknesses in controls over access to web-based applications and 

some network files. The Staff recommended that all three of the larger NRSROs enhance their 

internal controls governing access to IT networks, systems, applications, and file shares. 

5. There were weaknesses in one larger NRSRO’s and two smaller NRSROs’ internal 

controls to protect MNPI and confidential information. 

Rule 17g-4 provides that NRSROs must establish, maintain, and enforce policies and procedures 

to prevent the misuse of MNPI. This Rule further provides that these procedures must be 

reasonably designed to prevent inappropriate dissemination of MNPI, including pending rating 
2014 Section 15E Examinations Summary Report Page 19

actions, both within and outside the NRSRO, and to prevent a person within the NRSRO from 

trading on material non-public information. 

 

One smaller NRSRO had not established sufficient controls over its employees’ use of personal 

email accounts to send, receive, and store MNPI and confidential information. This NRSRO’s 

policies and procedures prohibited employees from sending MNPI or confidential information to 

their personal email accounts, but the Staff’s review of emails of some of this NRSRO’s 

employees revealed several instances of such conduct. This NRSRO did not have

comprehensive controls to prevent such conduct and did not discipline employees who engaged 

in such conduct. The Staff recommended that this NRSRO enhance its controls to ensure that 

personnel comply with its policies and procedures concerning IT and protection of MNPI, and 

that it enforce such policies and procedures.

One larger NRSRO lacked sufficient written policies and procedures concerning the protection 

of confidential information or MNPI in certain types of publications and restricting personnel’s 

access to information that they need to know. At one smaller NRSRO, the office layout did not 

sufficiently restrict personnel employed by its non-NRSRO affiliates from accessing ratingsrelated MNPI or confidential information. The Staff recommended that these NRSROs take 

measures, such as establishing and enhancing written policies and procedures and controls, to 

sufficiently protect MNPI and confidential information.

6. One larger NRSRO and three smaller NRSROs did not have sufficient policies and 

procedures and controls concerning the dissemination of credit ratings.

At one larger NRSRO, there were multiple instances where erroneous ratings releases were 

published or the website was inoperable due to its IT weaknesses. One smaller NRSRO did not 

promptly revise an erroneous rating publication, and there were other weaknesses in this 

NRSRO’s ratings dissemination policies and procedures. The Staff recommended that these two 

NRSROs enhance their policies and procedures and systems concerning ratings dissemination 

and error prevention or correction. 

Another smaller NRSRO did not have sufficient controls over or documentation of its process for 

approving the publication of ratings. At another smaller NRSRO, the policies and procedures 

did not require sufficient documentation of instances where publication of ratings is delayed 

beyond a specified time period. The Staff recommended that these NRSROs establish or 

enhance their policies and procedures and documentation concerning publication of ratings.

7. There were weaknesses in compliance training or analytical training at four of the smaller 

NRSROs. 

One smaller NRSRO did not provide timely compliance training to new employees and did not 

appear to provide training regarding its methodology to new analysts. Another smaller NRSRO

did not provide sufficient analytical training to personnel in one of its offices. At another smaller 

NRSRO, some personnel did not complete mandatory compliance training. At another smaller 

NRSRO, training concerning some compliance issues was insufficient or too infrequent. The 
2014 Section 15E Examinations Summary Report Page 20

Staff recommended that these four NRSROs take measures to ensure that all personnel complete 

sufficient compliance training and that analytical personnel complete sufficient analytical 

training.

8. All three of the larger NRSROs and four of the smaller NRSROs made inaccurate or 

incomplete public disclosures in their Form NRSRO filings or on their websites. 

Section 15E(a)(1)(B) requires an application for NRSRO registration to disclose certain 

information, including information concerning the rating agency’s performance measurement 

statistics and its procedures and methodologies to determine ratings. Section 15E(b) requires 

NRSROs to file updates and annual certifications of their Form NRSRO registrations and the 

information therein. Rule 17g-1 also contains requirements concerning the initial application for 

NRSRO registration and updating NRSRO registration. Section 15E(f)(2) prohibits any credit 

rating agency that is not registered as an NRSRO from stating that it is registered as an NRSRO.

The Form NRSRO filings and Exhibits of one larger NRSRO and four smaller NRSROs did not 

contain complete and accurate information as required by Sections 15E(a)(1) and 15E(b) and 

Rule 17g-1. One smaller NRSRO’s Form NRSRO Exhibits included several methodologies that 

it no longer used and incorrect descriptions of its rating process and rating definitions. The Form 

NRSRO filing and Exhibits of another smaller NRSRO did not disclose several criteria that this 

NRSRO used to determine ratings and appeared to contain inaccurate information concerning the

number of its outstanding ratings. Another smaller NRSRO’s Form NRSRO and Exhibit 2 did 

not disclose or describe one of the rating methodologies that it applied when determining 

NRSRO ratings. At one larger NRSRO and another smaller NRSRO, the transition and default 

information and other Form NRSRO Exhibits were misleading or inaccurate. The Staff 

acknowledges that four of these five NRSROs had already filed revised Form NRSROs and 

Exhibits after they learned of the missing or inaccurate information but prior to the Staff’s 

conclusion of its examinations. The Staff recommended that all five of these NRSROs 

implement or enhance internal controls to ensure the accuracy and completeness of all 

information they submit in Form NRSRO filings and Exhibits. The Staff also recommended that 

the one NRSRO which had not updated its Form NRSRO and Exhibits file an updated Form 

NRSRO and Exhibits which include required information concerning all procedures and 

methodologies it uses to determine NRSRO credit ratings.

All three larger NRSROs’ websites did not clearly identify which of their offices and affiliates 

are included in their Form NRSRO registration and which ones are not. One of these larger 

NRSROs also made inaccurate public disclosures concerning some of its rating committee and 

surveillance practices. The Staff recommended that the three larger NRSROs ensure their 

websites and other public disclosures concerning its offices and affiliates and the rating process 

are accurate and sufficiently clear.

E. Review Area: Governance

Section 15E(t) requires that each NRSRO have a board of directors or governing committee 

(hereinafter, collectively the “Board” or “Boards”) and establishes certain requirements 
2014 Section 15E Examinations Summary Report Page 21

concerning the composition and conduct of each NRSRO’s Board. Section 15E(t)(3)(A) through 

(D) identifies four areas over which an NRSRO’s Board must exercise oversight. For example, 

Section 15E(t)(3)(C) requires an NRSRO’s Board to oversee the effectiveness of the NRSRO’s 

internal control system with respect to policies and procedures for determining credit ratings and 

15E(t)(3)(D) requires an NRSRO’s Board to oversee the NRSRO’s compensation and promotion 

policies and practices. Section 15E(t)(B)(ii) requires that an NRSRO’s independent director be 

disqualified from any deliberation involving a specific rating in which the independent board 

member has a financial interest in the outcome of the rating. 

During the 2014 examinations, the Staff interviewed each NRSRO’s Board and reviewed 

minutes and other documentation related to the activities of each NRSRO’s Board. The Staff’s 

2014 examinations focused on the oversight function performed by the NRSRO’s Board.

The Staff’s essential findings relating to the NRSROs’ compliance with the governance 

provisions of Section 15E(t) are as follows: 

1. The Board of one larger NRSRO and four smaller NRSROs were not in full compliance

with some requirements of Section 15E(t), including exercising the required oversight of certain 

areas or documenting their exercise of such oversight.

At one smaller NRSRO, the rules establishing the Board and its responsibilities did not 

specifically include the four duties required by Section 15E(t)(3). Also, this NRSRO’s Board did 

not appear to be fulfilling all of these statutory duties, particularly oversight of compensation and 

promotion as required by Section 15E(t)(3)(D), and this NRSRO did not sufficiently document 

its process for disqualifying a Board member from participating in a deliberation where that 

member has a financial or other interest. At one smaller NRSRO, the materials for Board 

meetings were not consistently distributed to Board members sufficiently in advance of Board 

meetings to provide time for the members to review them, and one independent Board member 

did not exercise adequate oversight as required by Section 15E(t)(3). The Staff recommended 

that these two NRSROs revise their Board rules or take other measures to ensure that their 

Boards and the members thereof exercise the oversight required by Section 15E(t)(3), and also 

recommended that one of these smaller NRSROs consider enhancing its documentation of its 

process for disqualifying a Board member because of a financial or other interest. 

At one of the larger NRSROs, the minutes of Board meetings were not sufficiently detailed to 

demonstrate that Board members are actively overseeing the areas required by Section 15E(t)(3). 

At two smaller NRSROs, the Boards were not sufficiently exercising oversight of the NRSROs’ 

compensation and promotion policies and practices as required by Section 15E(t)(3)(D). In 

addition, the Board of one of these smaller NRSROs did not sufficiently document its oversight

of the NRSRO’s internal control system as required by Section 15E(t)(3)(C). The Staff 

recommended that these two smaller NRSROs ensure that their Boards are sufficiently 

performing the duties required by Section 15E(t)(3). The Staff also recommended that this larger 

NRSRO and one of these smaller NRSROs ensure that their minutes and other records

demonstrate sufficient performance of these duties.
2014 Section 15E Examinations Summary Report Page 22

F. Review Area: DCO Activities

Section 15E(j)(1) requires each NRSRO to designate an individual responsible for administering 

the policies and procedures established to prevent the misuse of MNPI and management of

conflicts of interest, and for ensuring compliance with the securities laws. Under Section 

15E(j)(3), the DCO is responsible for establishing procedures for the receipt, retention, and 

treatment of complaints. Under Section 15E(j)(5), the DCO must submit an annual report to the 

NRSRO on the compliance of the NRSRO with the securities laws and the NRSRO’s policies 

and procedures, and the NRSRO must file the report with the Commission. Rule 17g-2(b)(4) 

requires an NRSRO to retain compliance reports and compliance exception reports. Rule 17g2(b)(5) requires an NRSRO to retain internal audit plans, internal audit reports, documents 

relating to internal audit follow-up measures, and all records identified by the NRSRO’s internal 

auditors as necessary to audit the NRSRO’s credit rating business.

Section 15E(j)(4) requires that the DCO be compensated in a manner not linked to the NRSRO’s 

financial performance and must be arranged to ensure the DCO’s independence. 

The DCO role is a critical element in helping to ensure an NRSRO’s compliance with securities 

laws. The DCO at each NRSRO should have sufficient resources, institutional support, and 

independence to effectively carry out the DCO’s statutory obligations. The Staff reviewed the 

role and activities of each NRSRO’s DCO. This review included interviews with each DCO.

The Staff’s essential findings regarding DCOs are as follows:

1. The number of compliance personnel at one larger NRSRO and one smaller NRSRO was

not sufficient. 

The larger NRSRO did not have a permanent compliance presence in or exercise sufficient 

compliance oversight of one of its largest offices and of a global region where it has multiple 

NRSRO credit rating affiliates. At the smaller NRSRO, it appeared that the number of 

compliance personnel was not sufficient to meet the requirements of Section 15E(j). During the 

Review Period, this smaller NRSRO employed only a few compliance personnel while it 

substantially expanded its operations and non-compliance personnel. 

The Staff recommended that these NRSROs add or consider adding compliance personnel to 

ensure they maintain sufficient compliance presence in all regions or offices where they operate.

2. There were weaknesses in compliance oversight and monitoring at four of the smaller 

NRSROs.

One smaller NRSRO did not have sufficient policies and procedures for, and documentation of,

the DCO’s and compliance personnel’s responsibilities such as email reviews, compliance 

monitoring activities, compliance risk assessments, and periodic reviews of rating files. At 

another smaller NRSRO, weaknesses concerning the DCO and compliance oversight included

insufficient scope and documentation of email and rating file reviews and insufficient responses 

to personnel’s compliance violations. At another smaller NRSRO, the DCO did not document 
2014 Section 15E Examinations Summary Report Page 23

certain instances of non-compliance by its personnel and the DCO’s handling of employee noncompliance may not have been sufficiently independent from the NRSRO’s management. The 

Staff recommended that these three NRSROs establish sufficient compliance policies and 

procedures, enhance monitoring activities such as email reviews and violation tracking, and 

prepare and retain sufficient documentation of compliance activities. The Staff also 

recommended that one of these smaller NRSROs review its policies and procedures to ensure the 

DCO is sufficiently independent from its senior management.

Also at one of these smaller NRSROs, the practices concerning DCO compensation may have 

been inconsistent with Section 15E(j)(4), which requires that the DCO’s compensation is 

arranged to ensure the DCO’s independence and is not linked to the NRSRO’s financial 

performance. In addition, this smaller NRSRO did not exercise oversight of the DCO in the 

manner required by its policies and procedures. The Staff recommended that this NRSRO 

ensure that its actual practices do not link DCO compensation to its financial performance,

review activities performed by an individual who served as the DCO for a certain time period to 

ensure that these activities were not influenced by its financial performance, and ensure that the 

DCO’s duties are conducted consistently with its policies and procedures.

At another smaller NRSRO, continuing turnover in the identity of the individual serving as DCO

limited the DCO’s effectiveness and the continuity of compliance operations. The Staff 

recommended that this NRSRO establish a compliance staffing and succession plan to ensure 

that the individual serving as DCO is sufficiently capable and independent.

3. There were weaknesses in compliance investigations at two of the larger NRSROs.

Some NRSROs conducted routine compliance reviews or audits to identify instances of noncompliance and investigations in response to particular potential compliance violations. While 

this is a positive practice, there were shortcomings in some of these compliance activities at two 

larger NRSROs. At both of these larger NRSROs, the personnel who had substantial 

responsibility for a compliance investigation concerning particular conduct also substantially

participated in the conduct being investigated. The Staff recommended that these NRSROs 

ensure that investigations regarding compliance or conflicts of interest are conducted by 

personnel who are sufficiently impartial.

Also at one of these larger NRSROs, the scope of a compliance audit was too narrow and the 

responses to several compliance audits were insufficient or untimely. The Staff made 

recommendations to this NRSRO concerning the scope of its compliance audits and the 

sufficiency and timeliness of its responses to compliance audits, and recommended that this 

NRSRO conduct a risk-based review of whether certain conduct identified by one of its 

compliance audits impacted its ratings. 

 
2014 Section 15E Examinations Summary Report Page 24

G. Review Area: Complaints

Section 15E(j)(3) states that an NRSRO’s DCO must establish procedures for the receipt, 

retention, and treatment of (i) complaints regarding credit ratings, models, methodologies, and 

compliance with the securities laws and the NRSRO’s policies and procedures developed under 

Section 15E; and (ii) confidential, anonymous complaints by employees or users of credit 

ratings. Rule 17g-2(b)(8) requires an NRSRO to retain any written communications received 

from persons not associated with the NRSRO that contain complaints about the performance of a 

credit analyst in initiating, determining, maintaining, monitoring, changing, or withdrawing a 

credit rating. Rule 17g-2(c) requires that such communications be retained for a period of three 

years after the date the record is made or received. Rule 17g-2(d) concerns the manner of 

retention and Rule 17g-2(e) governs the use of third party custodians for retention. The Staff 

reviewed each NRSRO’s policies and procedures for complaints and tested the policies and 

procedures by reviewing the files of certain complaints submitted to the NRSRO. 

All the NRSROs have written policies and procedures to address complaints.

The Staff’s essential findings regarding complaints are as follows:

1. Complaint policies and procedures at two larger NRSROs and one smaller NRSRO did

not address all of the statutory requirements concerning complaints.

The definition of complaint in one larger NRSRO’s policies and procedures did not include all 

types of complaints covered by Section 15E(j)(3), and there were weaknesses concerning this 

NRSRO’s determinations whether external communications constituted a complaint. At another 

larger NRSRO, written complaint policies and procedures did not address complaints submitted 

by employees and did not establish a prompt timeframe for logging a complaint. At one smaller 

NRSRO, complaint policies and procedures did not address handling of verbal complaints and

retention of complaint-related documents. The Staff recommended that these three NRSROs

revise and enhance their complaint policies and procedures to comply with Section 15E(j) and 

Rule 17g-2, and also recommended other improvements concerning complaint handling to the 

two larger NRSROs.

2. There were weaknesses in some complaint policies and procedures and treatment of 

certain complaints at two smaller NRSROs.

At one smaller NRSRO, policies and procedures contained inconsistent provisions concerning 

treatment of complaints. Also, in one of this NRSRO’s offices, some employees were unaware 

of the complaint policies and procedures and did not report communications that may have 

constituted complaints. At another smaller NRSRO, there were weaknesses in the logging and 

review of external communications that may have constituted complaints, and insufficient 

systems for external parties to submit complaints. The Staff recommended that these NRSROs 

revise and enhance their complaint policies, procedures, and controls, and enhance their systems

for external parties to submit complaints.
2014 Section 15E Examinations Summary Report Page 25

H. Review Area: Post-Employment 

Section 15E(h)(4)(A) requires an NRSRO to establish, maintain, and enforce policies and 

procedures reasonably designed to ensure that it will review a former employee’s involvement in 

the determination of credit ratings for a person or an issuer, underwriter, or sponsor of a security 

or money market instrument if the former employee is now employed by such person or entity to 

determine whether any conflicts of interest of the employee influenced the rating. Section 

15E(h)(5) requires each NRSRO to report to the Commission any instance where the NRSRO 

knows or can reasonably expected to know that certain specified persons who were associated 

with the NRSRO within the previous five years obtain employment with any obligor, issuer, 

underwriter, or sponsor of a security or money market instrument for which the organization 

issued a credit rating during the twelve-month period prior to such employment.

The Staff reviewed each NRSRO’s “look-back” policies and procedures to assess whether they 

satisfy the statutory requirements. The Staff also requested information from each NRSRO 

concerning personnel that departed the NRSRO during the Review Period, and in some instances 

tested, on a selected and randomized basis, documentation related to such personnel to assess 

whether the NRSRO adhered to its lookback policies and procedures and satisfied the statutory 

obligations with respect to such personnel. 

The Staff’s essential findings regarding NRSRO look-back policies and procedures are as 

follows:

1. There were weaknesses in two smaller NRSROs’ lookback policies and procedures. 

One smaller NRSRO did not record sufficient documentation related to its lookback review and 

its policies and procedures did not specify a timeframe for completing a lookback review. The 

Staff recommended that this NRSRO enhance its recordkeeping of lookback review activities 

and revise its policies and procedures to state a timeframe for completing the review. Another 

smaller NRSRO did not conduct periodic post-employment searches regarding one former 

analyst as required by its policies and procedures to comply with Section 15E(h)(5). The Staff 

recommended that this NRSRO ensure it applies its post-employment policies and procedures to 

all covered former employees.

V. CONCLUSION

The Staff has identified findings and recommendations for the NRSROs. In future examinations, 

the Staff will continue to refine its risk assessment to maintain a balance between verifying 

compliance with key laws and regulations and identifying and examining emerging risk areas. In 

addition, the Staff will expand the scope of its future examinations to include the new and 

amended SEC Rules concerning NRSROs.