__________________________________________________________________________

2019 SUMMARY REPORT OF COMMISSION STAFF’S EXAMINATIONS OF

EACH NATIONALLY RECOGNIZED STATISTICAL RATING ORGANIZATION

__________________________________________________________________________

As Required by Section 15E(p)(3)(C) 

of the Securities Exchange Act of 1934

This is a report of the Staff of the U.S. Securities and Exchange Commission.

The Commission has expressed no view regarding the analysis, findings, or conclusions 

contained herein.

__________________________________

January 2020
TABLE OF CONTENTS

I. Regulatory and NRSRO Overview...................................................................................... 2

A. Statutory Framework and Rules....................................................................................... 2

B. Registered NRSROs......................................................................................................... 6

II. Office of Credit Ratings and Examination Overview........................................................ 7

A. Examinations under Section 15E(p)(3)............................................................................ 7

B. Examination Overview .................................................................................................... 8

III. Summary of Responses to Recommendations from Previous Examinations and 

Notable Improvements over the Course of the Examinations.................................................. 9

A. Responses to Recommendations from the 2018 Section 15E Examinations................... 9

B. Notable Improvements Over the Course of the Examinations ...................................... 11

IV. Summary of Essential Findings......................................................................................... 11

A. Review Area: Adherence to Policies, Procedures, and Methodologies........................ 12

B. Review Area: Management of Conflicts of Interest ..................................................... 19

C. Review Area: Implementation of Ethics Policies......................................................... 22

D. Review Area: Internal Supervisory Controls................................................................ 22

E. Review Area: Governance ............................................................................................ 30

F. Review Area: DCO Activities ...................................................................................... 31

G. Review Area: Complaints............................................................................................. 31

H. Review Area: Post-Employment................................................................................... 32

V. Conclusion ........................................................................................................................... 33
2019 Section 15E Examinations Summary Report Page 2

I. REGULATORY AND NRSRO OVERVIEW

This report (“Report”) summarizes the examinations conducted by staff from the U.S. Securities 

and Exchange Commission (the “Staff”) under Section 15E(p)(3) of the Securities Exchange Act 

of 1934 (“Exchange Act”).1 This is a report of the Staff and, as such, reflects solely the Staff’s 

views. The U.S. Securities and Exchange Commission (“Commission” or “SEC”) is making this 

Staff Report public as required by Section 15E(p)(3)(C) of the Exchange Act.

A. Statutory Framework and Rules

Section 15E of the Exchange Act (“Section 15E”) and Exchange Act Rules 17g-1 through

17g-10 govern the registration and oversight program for credit rating agencies that are 

registered with the Commission as nationally recognized statistical rating organizations 

(“NRSROs”). This regulatory regime was established by the Credit Rating Agency Reform Act 

of 2006 (the “Rating Agency Act”)2 and amended by the Dodd-Frank Wall Street Reform and 

Consumer Protection Act of 2010 (the “Dodd-Frank Act”).3

The Dodd-Frank Act mandated the creation of the Office of Credit Ratings (“OCR”), which is

responsible for oversight of credit rating agencies registered with the Commission as NRSROs.

Pursuant to the Commission’s regulatory regime for NRSROs, an NRSRO is required to, among

other things:

• File with the Commission annual certifications of its Form NRSRO registrations,4

promptly update its filing in certain circumstances,5 and make its current Form NRSRO 

filing and most of its current Form NRSRO Exhibits available on its public website.6 

• Disclose certain information, including information concerning the NRSRO’s 

performance measurement statistics and its procedures and methodologies to determine 

ratings.7

 1 Exchange Act Section 15E(p)(3)(C). Unless otherwise noted, all Section and Rule references in this report 

are to the Exchange Act and rules under the Exchange Act.

2 Credit Rating Agency Reform Act of 2006, Pub. L. No. 109-291, 120 Stat. 1327 (2006).

3 The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 932, 124 Stat. 

1376, 1872-83 (2010).

4 Exchange Act Section 15E(b)(2) and Exchange Act Rule 17g-1(f).

5 Exchange Act Section 15E(b)(1) and Exchange Act Rule 17g-1(e).

6 Exchange Act Section 15E(a)(3) and Exchange Act Rule 17g-1(i).

7 Exchange Act Section 15E(a)(1)(B)(i) and Exchange Act Section 15E(a)(1)(B)(ii).
2019 Section 15E Examinations Summary Report Page 3

• Establish, maintain, enforce, and document an effective internal control structure 

governing the implementation of and adherence to policies, procedures, and 

methodologies for determining credit ratings,

8 and retain records of its internal control 

structure.9

• Consider certain factors with respect to its establishment, maintenance, enforcement, and 

documentation of an effective internal control structure.10

• Establish, maintain, enforce, and document policies and procedures reasonably designed 

to achieve certain objectives concerning its development and application of, and 

disclosures related to, methodologies and models.11

• File an unaudited report containing an assessment by management of the effectiveness 

during the fiscal year of the NRSRO’s internal control structure governing the 

implementation of and adherence to policies, procedures, and methodologies for 

determining credit ratings.12 The report must be accompanied by a signed statement by 

the NRSRO’s chief executive officer or an individual performing similar functions.13

• Establish, maintain, enforce, and document policies and procedures that are reasonably 

designed to: assess the probability that an issuer of a security or money market 

instrument will default or fail to make required payments to investors,14 and ensure that it 

applies any rating symbol, number, or score in a manner that is consistent for all types of 

obligors, securities, and money market instruments for which the symbol, number, or 

score is used.15

• Publish an information disclosure form when taking a rating action with respect to a 

rating assigned to an obligor, security, or money-market instrument in a class for which it 

 8 Exchange Act Section 15E(c)(3)(A). 

9 Exchange Act Rule 17g-2(b)(12).

10 See, e.g., Exchange Act Rule 17g-8(d)(1) through (4). 

11 See, e.g., Exchange Act Rule 17g-8(a)(2) through (5). 

12 Exchange Act Rule 17g-3(a)(7)(i).

13 Exchange Act Rule 17g-3(b)(2).

14 Exchange Act Rule 17g-8(b)(1).

15 Exchange Act Rule 17g-8(b)(3).
2019 Section 15E Examinations Summary Report Page 4

is registered as an NRSRO.

16 The information form must disclose certain information 

with respect to the particular rating action.17 In addition, the NRSRO must attach to the 

information disclosure form a signed statement by a person within the NRSRO with

responsibility for the rating action.

18

• Make and retain, or retain, certain records, including a record documenting its established 

procedures and methodologies used to determine credit ratings19 and records related to its 

ratings.20 An NRSRO must promptly furnish to the Commission or its representatives 

copies of required records, including English translations of those records, upon 

request.21

• Establish, maintain, and enforce written policies and procedures reasonably designed to 

prevent the misuse of material non-public information (“MNPI”), including the 

 16 Exchange Act Rule 17g-7(a). Rule 17g-7(a) defines rating action to include an expected or preliminary 

rating, an initial rating, an upgrade or downgrade of an existing rating (including a downgrade to, or 

assignment of, default), and an affirmation or withdrawal of an existing rating if the affirmation or 

withdrawal is the result of the NRSRO’s review of the rating using applicable procedures and 

methodologies for determining credit ratings. Pursuant to Rule 17g-7(a)(3), an NRSRO is exempt from 

publishing an information disclosure form for a particular rating if: (i) the rated obligor or issuer of the 

rated security or money market instrument is not a U.S. person; and (ii) the NRSRO has a reasonable basis 

to conclude that: (A) with respect to any security or money market instrument issued by a rated obligor, all 

offers and sales by any issuer, sponsor, or underwriter linked to the security or money market instrument 

will occur outside the United States; or (B) with respect to a rated security or money market instrument, all 

offers and sales by any issuer, sponsor, or underwriter linked to a security or money market instrument will 

occur outside the United States.

17 Exchange Act Rule 17g-7(a)(1)(ii)(A)-(N) specifies the information that must be disclosed in the 

information disclosure form. These required disclosures include: the version of the procedure or 

methodology used to determine the credit rating; disclosures concerning the uncertainty of the rating, 

including regarding the reliability, accuracy, quality, and accessibility of data related to the rating; a

statement containing an overall assessment of the quality of information available and considered in 

determining the credit rating for the obligor, security, or money market instrument; and information on the 

sensitivity of the rating to assumptions made by the NRSRO. In addition, an NRSRO must attach to the 

information disclosure form any executed Form ABS Due Diligence-15E containing information about the 

security or money market instrument subject to the rating action that is received by the NRSRO or obtained 

by the NRSRO through a Rule 17g-5(a)(3) website. 

18 Exchange Act Rule 17g-7(a)(1)(iii).

19 Exchange Act Rule 17g-2(a)(6).

20 The records that an NRSRO must make and retain, or retain, with respect to its ratings include the identity 

of certain persons who participated in determining or approving the rating, records used to form the basis of 

a rating, external and internal communications received or sent by the NRSRO and its employees related to 

a rating, and for ABS ratings, a record of the rationale for any material difference between the final rating 

assigned and the rating implied by a quantitative model that was a substantial component in determining 

the rating. Exchange Act Rule 17g-2(a)(2)(i), (ii), and (iii); Exchange Act Rule 17g-2(b)(2) and (b)(7).

21 Exchange Act Section 15E(a) and (b) and Exchange Act Rule 17g-2(f).
2019 Section 15E Examinations Summary Report Page 5

inappropriate dissemination of MNPI both within and outside the NRSRO, the 

inappropriate trading of securities using MNPI by a person within the NRSRO, and the 

inappropriate dissemination of pending credit rating actions within and outside the 

NRSRO before issuing the rating on the Internet or through another readily accessible 

means.

22

• Establish, maintain, and enforce written policies and procedures reasonably designed to 

address and manage conflicts of interest.

23 Certain conflicts of interest are expressly 

prohibited,24 and for other types of conflicts of interest, the NRSRO must disclose the 

conflicts and have policies and procedures in place to manage them.25

• Refrain from engaging in specified unfair, coercive, or abusive practices.26

• Provide information on whether it has in effect a code of ethics, and if not, the reasons it 

does not have a code of ethics.27

• Establish procedures for the receipt, retention, and treatment of complaints regarding 

credit ratings, models, methodologies, and compliance with the securities laws and its 

policies and procedures developed under this regulatory regime, and of confidential, 

anonymous complaints.28

 

• Designate a compliance officer (the “DCO”) responsible for administering policies and 

procedures related to MNPI and conflicts of interest, ensuring compliance with the 

securities laws and regulations, and establishing procedures for handling complaints by 

employees or users of credit ratings.

29 The DCO must submit an annual report to the 

 22 Exchange Act Section 15E(g) and Exchange Act Rule 17g-4.

23 Exchange Act Section 15E(h) and Exchange Act Rule 17g-5.

24 Exchange Act Rule 17g-5(c).

25 Exchange Act Rule 17g-5(a)(1) and (a)(2); Exchange Act Rule 17g-5(b). Moreover, Exchange Act Rule 

17g-5(a)(3) prohibits an NRSRO from having a conflict of interest related to a rating for a security or 

money market instrument issued by an asset pool or as part of any ABS transaction unless the NRSRO, 

among other things, maintains and provides access to a password-protected Internet Web site containing a 

list of each such security or money market instrument for which it is currently in the process of determining 

an initial credit rating, and obtains certain written representations from the issuer, sponsor, or underwriter 

of each such security or money market instrument. 

26 Exchange Act Rule 17g-6.

27 Exchange Act Section 15E(a)(1)(B)(v).

28 Exchange Act Section 15E(j)(3).

29 Exchange Act Section 15E(j)(1) and (3).
2019 Section 15E Examinations Summary Report Page 6

NRSRO on the compliance of the NRSRO with the securities laws and the NRSRO’s 

policies and procedures, and the NRSRO must file the report with the Commission.30

• Have a board of directors or similar governing body (collectively, the “Board”), certain 

of whose members must be independent from the NRSRO.31 An NRSRO’s Board, or 

members thereof, are responsible for exercising oversight of specified subjects related to 

the NRSRO’s rating business and for approving the procedures and methodologies, 

including qualitative and quantitative data and models, that the NRSRO uses to determine 

ratings.32

• Establish, maintain, enforce, and document standards of training, experience, and 

competence for the individuals it employs to participate in the determination of credit 

ratings that are reasonably designed to achieve the objective that the NRSRO produces 

accurate credit ratings, and retain a record of these standards.33 

• Establish policies and procedures regarding post-employment activities of certain former 

personnel.34

B. Registered NRSROs

In 2007, the Commission began granting registrations to credit rating agencies that applied to be 

registered as an NRSRO. Credit rating agencies seeking to register with the Commission as an 

NRSRO must file a completed application on Form NRSRO, including related Exhibits.35 A 

credit rating agency may apply to be registered with respect to one or more of the following five 

classes of credit ratings: (1) financial institutions, brokers, or dealers (“financial institutions”); 

(2) insurance companies; (3) corporate issuers; (4) issuers of asset-backed securities (“ABS”); 

and (5) issuers of government securities, municipal securities, or securities issued by a foreign 

government (“government securities”).36 

The nine credit rating agencies registered as NRSROs as of January 15, 2020, and dates of their 

initial registrations, are listed below. More information on NRSRO registration applications and 

the state of competition, transparency, and conflicts of interest among NRSROs is included in the 

 30 Exchange Act Section 15E(j)(5).

31 Exchange Act Section 15E(t)(2).

32 Exchange Act Section 15E(t)(3) and Exchange Act Rule 17g-8(a)(1).

33 Exchange Act Rule 17g-9.

34 Exchange Act Section 15E(h)(4) and (5); Exchange Act Rule 17g-8(c).

35 Exchange Act Section 15E(a) and Exchange Act Rule 17g-1(a) and (b).

36 Exchange Act Section 3(a)(62)(A).
2019 Section 15E Examinations Summary Report Page 7

Annual Report to Congress under Section 6 of the Rating Agency Act, available on the 

Commission’s website: http://www.sec.gov/ocr.

NRSRO Date of Initial Registration

A.M. Best Rating Services, Inc. (“AMB”)37 September 24, 2007

DBRS, Inc. (“DBRS”) September 24, 2007

Egan-Jones Ratings Company (“EJR”) December 21, 2007

Fitch Ratings, Inc. (“Fitch”) September 24, 2007

HR Ratings de México, S.A. de C.V. (“HR”) November 5, 2012

Japan Credit Rating Agency, Ltd. (“JCR”) September 24, 2007

Kroll Bond Rating Agency, Inc. (“KBRA”)38 February 11, 2008

Moody’s Investors Service, Inc. (“MIS”) September 24, 2007

S&P Global Ratings (“S&P”)39 September 24, 2007

On July 2, 2019, Morningstar, Inc., the parent company of Morningstar Credit Ratings, LLC 

(“MCR”),

40 completed an acquisition of DBRS. On November 15, 2019, MCR furnished a 

notice of withdrawal from registration to the Commission (which became effective on December 

30, 2019), and DBRS filed an update to Form NRSRO to add MCR as a credit rating affiliate. 

MCR and DBRS were separately owned entities throughout 2018 and were therefore examined 

separately during the 2019 Section 15E examination cycle. 

For purposes of this Report only, we refer to Fitch, MIS, and S&P as “larger NRSROs” and the 

seven other NRSROs (AMB, DBRS, EJR, HR, JCR, KBRA, and MCR) as “smaller NRSROs.” 

II. OFFICE OF CREDIT RATINGS AND EXAMINATION OVERVIEW

A. Examinations under Section 15E(p)(3)

Generally, the purpose of NRSRO examinations is to: (i) monitor compliance with applicable 

federal securities laws and rules; (ii) identify conduct, insufficient policies and procedures, or 

ineffective internal controls that potentially violate such laws and rules; and (iii) encourage 

remedial action. To facilitate such remedial action, the Staff sends each NRSRO an examination 

summary letter that identifies and explains its findings related to that NRSRO and recommends 

remedial measures. Examinations also serve to inform the Commission and the NRSROs’ 

compliance personnel of regulatory obligations and noteworthy industry developments. When 

appropriate, OCR staff may refer potential violations of the federal securities laws to the 

Commission’s Division of Enforcement for further investigation. The Division of Enforcement 

 37 Formerly known as A.M. Best Company, Inc.

38 Formerly known as LACE Financial Corp.

39 Formerly known as Standard & Poor’s Ratings Services.

40 Formerly known as Realpoint LLC.
2019 Section 15E Examinations Summary Report Page 8

investigates potential violations of the federal securities laws and litigates the Commission’s 

enforcement actions. 

Section 15E(p)(3)(B) provides that each NRSRO examination shall include a review of the 

following eight topic areas (“Section 15E Review Areas”): (i) whether the NRSRO conducts 

business in accordance with its policies, procedures, and rating methodologies; (ii) the 

management of conflicts of interest by the NRSRO; (iii) the implementation of ethics policies by 

the NRSRO; (iv) the internal supervisory controls of the NRSRO; (v) the governance of the 

NRSRO; (vi) the activities of the DCO of the NRSRO; (vii) the processing of complaints by the 

NRSRO; and (viii) the policies of the NRSRO governing the post-employment activities of its 

former staff.

Section 15E(p)(3)(C) requires the Commission to make available to the public an annual report 

summarizing: (i) the essential findings of all Section 15E examinations, as deemed appropriate 

by the Commission; (ii) the NRSROs’ responses to any material regulatory deficiencies 

identified by the Commission; and (iii) whether the NRSROs have appropriately addressed the 

recommendations of the Commission contained in previous annual reports on examinations.

B. Examination Overview

The 2019 Section 15E examinations generally focused on the NRSROs’ activities for the period 

covering January 1, 2018 through December 31, 2018 (the “Review Period”). The examinations 

also reviewed certain activities or credit rating actions from outside the Review Period.41

The 2019 Section 15E examinations reviewed the Section 15E Review Areas and examined each 

NRSRO’s adherence to Section 15E and Rules 17g-1 through 17g-10. Each of the NRSRO 

examinations encompassed all of the statutorily required Section 15E Review Areas. Within 

each of the Section 15E Review Areas, the Staff determined areas of emphasis and issues of 

focus for each NRSRO based upon an NRSRO-specific risk assessment performed by the Staff,

while also considering how to limit the amount of personal data collected in the examination 

process. The NRSRO-specific risk assessments considered a number of factors, including, but 

not limited to: (i) the NRSRO’s rating activities and operations; (ii) the Staff’s findings, 

recommendations, and general observations from prior examinations; (iii) the impact of a 

potential or actual internal control or compliance failure by the NRSRO; (iv) recent industry 

developments affecting NRSROs and the asset classes in which the NRSRO is registered; (v) the 

NRSRO’s filings with the Commission and public disclosures; (vi) the NRSRO’s self-identified 

weaknesses; and (vii) relevant TCRs received by the Commission.

The 2019 Section 15E examinations also focused on certain subjects and activities that the Staff, 

through its risk assessment process, identified as relevant to certain NRSROs, as summarized 

below. 

 41 For example, the Staff may review information relating to tips, complaints, and referrals (“TCRs”) in a 

current examination, even if the referenced activities occurred outside of the Review Period.
2019 Section 15E Examinations Summary Report Page 9

• Increase in Debt Rated at the Lowest Investment Grade Level: In light of a number 

of public reports regarding an overall decrease in corporate debt quality, a record 

amount of corporate debt at the lowest investment grade rating level, and increasing 

levels of debt taken on by many corporations, the Staff reviewed certain NRSROs’

adherence to policies, procedures, and methodologies in the corporate ratings class. 

The Staff also reviewed certain NRSROs’ surveillance practices for low-investment 

grade ratings. 

• Collateralized Loan Obligations (“CLOs”): In recent years there have been a 

number of reports discussing an overall increase in the percentage of loans 

underlying CLOs that are subject to more permissive covenants than before. For 

certain NRSROs, the Staff reviewed issues such as whether the NRSRO takes into 

account as part of its rating analysis such looser covenants and other borrowerfriendly provisions in credit agreements as well as shifts in the market such as 

increased borrower covenant flexibility. The Staff also reviewed whether certain 

NRSROs’ procedures are designed to ensure that their assumptions and analysis 

with respect to CLO ratings are consistent with their corporate credit analysis.

• Municipal Bond Ratings: For certain NRSROs, the Staff reviewed allocation of 

resources to municipal ratings and whether those NRSROs’ policies and procedures 

are reasonably designed to ensure that the large volume of such ratings remain 

consistent with their rating methodologies. Among the areas that the Staff reviewed

for certain NRSROs were the use of technology to monitor such ratings and 

whether municipal methodologies have been updated to take into account potential 

emerging risks.

III. SUMMARY OF RESPONSES TO RECOMMENDATIONS FROM PREVIOUS 

EXAMINATIONS AND NOTABLE IMPROVEMENTS OVER THE COURSE OF THE

EXAMINATIONS

A. Responses to Recommendations from the 2018 Section 15E Examinations

The Staff’s determination that an NRSRO appropriately addressed a recommendation does not 

constitute its endorsement of that NRSRO or its policies, procedures, internal controls, or 

operations. In a future examination, the Staff may reevaluate the NRSRO’s response to 

recommendations that it previously deemed to be appropriately addressed by, for example, 

assessing whether the NRSRO fully implemented remedial measures and whether those remedial 

measures appear to be effective. The Staff may also review and make recommendations 

concerning the NRSRO’s policies, procedures, internal controls, or operations related to the 

general subject matter of a recommendation that it previously deemed to be appropriately 

addressed. The determination of whether an NRSRO appropriately addressed a recommendation 

reflects solely the Staff’s view and does not necessarily reflect the views of the Commission. 

The Staff’s assessment of whether an NRSRO has appropriately addressed a recommendation 

depends on the specific facts and circumstances of the recommendation, including, but not 
2019 Section 15E Examinations Summary Report Page 10

limited to, the promptness of the NRSRO’s response, the severity of the conduct at issue, and 

whether the remedial action undertaken by the NRSRO is expected to fully resolve the Staff’s 

concerns. To assess whether NRSROs appropriately addressed findings from the 2018 Section 

15E examinations, the Staff reviewed each NRSRO’s written response to the Staff’s examination 

summary letter describing its planned remedial measures, and participated in calls with each 

NRSRO to discuss its written response. 

During the 2019 Section 15E examinations, the Staff assessed each NRSRO’s progress in 

implementing remedial measures such as establishing policies or procedures or adding resources 

in areas such as compliance, information technology (“IT”), or analytics. In assessing the 

effectiveness of NRSROs’ remedial measures, the Staff is cognizant that NRSROs may not be 

able to fully implement remedial measures before the Staff commences its Section 15E 

examinations for the subsequent year, and the Staff may not be able to fully assess the 

effectiveness of these measures in its Section 15E examinations for that subsequent year. 

Based on the Staff’s 2019 Section 15E examinations, the Staff has determined that not all 

recommendations from the 2018 Section 15E examinations have been appropriately addressed. 

In three instances, findings and recommendations from the 2018 Section 15E examinations were 

not appropriately addressed.

In one instance, discussed further in Section IV.A.5, the Staff found in 2018 that a smaller 

NRSRO did not accurately disclose in its information disclosure form the methodologies it used 

to determine certain ratings, and recommended that the NRSRO adhere to the requirements of 

Rule 17g-7(a). However, in 2019 the Staff found that the NRSRO had not updated its 

information disclosure form to include the required disclosures.

In another instance, discussed further in Section IV.B.4, the Staff found in 2018 that a smaller 

NRSRO lacked a mechanism to ensure the application of certain policies and procedures to 

certain directors, and recommended that the NRSRO ensure that such persons are appropriately 

governed by the NRSRO’s policies and procedures. However, in 2019 the Staff found that the 

NRSRO did not implement a fully compliant process for such directors to certify their 

compliance with relevant policies and procedures.

In another instance, discussed further in Section IV.D.13, the Staff found in 2018 that a smaller 

NRSRO had not established, maintained, enforced, and documented an effective internal control 

structure governing the implementation of and adherence to policies, procedures, and 

methodologies for determining credit ratings. The Staff found that the NRSRO lacked effective 

internal controls with regard to several functions, including conflicts of interest, adherence to 

methodologies, documentation, and compliance, and recommended that the NRSRO establish, 

maintain, enforce, and document an effective internal control structure. However, in 2019 the 

Staff found again that the NRSRO had not established, maintained, enforced, and documented an 

effective internal control structure governing the implementation of and adherence to policies, 

procedures, and methodologies for determining credit ratings. Again in 2019, the Staff found 

that the NRSRO lacked effective internal controls with regard to several functions, including 

conflicts of interest, adherence to methodologies, documentation, and compliance.
2019 Section 15E Examinations Summary Report Page 11

Except for the three instances noted above, NRSROs generally addressed 2018 recommendations 

by taking remedial measures such as adopting new or enhancing existing policies or procedures, 

internal controls, or systems and processes, and by adding personnel and resources.

B. Notable Improvements Over the Course of the Examinations

Since they were first conducted in 2010, the Staff’s Section 15E examinations have identified 

certain improvements at one or more of the NRSROs. Generally, NRSRO personnel at all levels 

of seniority and responsibility have continued to display greater awareness of applicable laws 

and their obligations as regulated entities. Moreover, the Staff’s summary reports covering the 

Section 15E examinations since 2012 mention specific improvements by certain NRSROs, and 

the NRSROs generally have maintained or augmented those improvements by further enhancing 

the measures undertaken and embedding them in their operations and culture.

During the 2019 Section 15E examinations, the Staff observed that most NRSROs have 

continued to refine where needed and maintain where appropriate their policies, procedures, and 

controls related to certain NRSRO rules adopted or amended in 2014, most of which became 

effective in mid-2015, and the Staff’s recommendations from subsequent Section 15E 

examinations. The Staff also observed that generally, most NRSROs’ personnel have continued 

to gain and display a better understanding of these rules and the NRSROs’ policies, procedures, 

processes, and controls for implementing these rules.

Additionally, the Staff observed that, in general, most NRSROs continue to improve their 

compliance monitoring and internal audit functions. In recent years, and continuing in the 2019 

Section 15E examinations, the Staff has observed that this improvement has resulted in a number 

of NRSROs becoming proactive in reporting to the Staff issues or potential issues of noncompliance with legal requirements or weaknesses in policies and procedures that could 

potentially lead to such non-compliance.

IV. SUMMARY OF ESSENTIAL FINDINGS

Section 15E(p)(3)(C)(i) requires this Report to contain a summary of the essential findings of the 

annual examinations, as deemed appropriate by the Commission.

For purposes of this Report, “essential findings” are all Staff findings from the 2019 Section 15E 

examinations that were included with one or more recommendations in an examination summary 

letter sent to an NRSRO. “Essential findings” do not include the Staff’s general observations. In 

this Report, essential findings are organized by the applicable Section 15E Review Areas. This 

Report uses the phrases “significant,” “numerous,” “several,” and “some” to describe and 

distinguish the frequency of conduct or instances underlying certain findings. The particular 

phrase used generally reflects the number of instances during the Review Period, recognizing 

that the number of instances may be reflective of a test sample and not necessarily an NRSRO’s 

comprehensive activities during the Review Period. The Commission has not determined 
2019 Section 15E Examinations Summary Report Page 12

whether any finding discussed in this Report constitutes a “material regulatory deficiency,”42 but 

may do so in the future.

In the following Sections of this Report, the numbered headers identify in general terms the 

Staff’s findings concerning one or more NRSROs, and the paragraph(s) following each 

numbered header provide additional detail concerning these findings and the Staff’s 

corresponding recommendations.

A. Review Area: Adherence to Policies, Procedures, and Methodologies 

The Staff reviewed a sample of rating actions of each NRSRO in certain asset classes for which 

it is registered and for certain issuers and obligors to determine whether the NRSRO operated in 

accordance with its policies, procedures, methodologies, criteria, and models. The Staff also 

reviewed a sample of rating files and documentation of other ratings-related activities to evaluate 

whether each NRSRO adhered to recordkeeping requirements. To select rating actions and 

rating files to review, the Staff used a risk-based sampling process that is consistent with its 

overall risk assessment approach described in Section II.B of this Report and considered factors 

including, but not limited to, the significance of the rated asset class to the financial markets and 

the NRSRO’s business, the NRSRO’s activity in the rated asset class, the likelihood of impact on 

investors if a rating was not determined in accordance with the NRSRO’s methodologies and 

procedures, news reports and developments concerning the NRSROs or particular asset classes, 

TCRs, and information the Staff learned during examinations.

The Staff’s essential findings regarding NRSROs conducting ratings-related activities in 

accordance with their policies, procedures, methodologies, criteria, and models are discussed in 

this Section. The Staff’s essential findings regarding the NRSROs’ adherence to policies and 

procedures related to other Section 15E Review Areas are generally discussed in later Sections of 

this Report. Instances where policies, procedures, and methodologies need to be established or 

improved are also generally discussed in later Sections of this Report.

The Staff’s essential findings regarding whether each NRSRO has conducted its business in 

accordance with its policies, procedures, and methodologies are as follows:

1. In certain instances, NRSROs did not adhere to their policies and procedures relating to 

information disclosed with credit ratings.

A smaller NRSRO did not consistently disclose in its public ratings reports the rationale for a 

material difference between a final rating and the rating implied by a model that was a 

substantial component in determining the rating. In some transactions, the difference between 

the model-implied rating and final rating was material, and the public rating report did not 

include the required rationale. In another instance, the NRSRO did not document in rating

committee notes or minutes the rationale for a difference between a credit rating implied by a

model and the final rating. The Staff recommended that the NRSRO adhere to its policies and 

 42 Exchange Act Section 15E(p)(3)(C)(ii).
2019 Section 15E Examinations Summary Report Page 13

procedures regarding the disclosure and documentation of deviations between a final rating 

assigned by the rating committee and the rating implied by the NRSRO’s models.

A smaller NRSRO did not publicly disclose its methodological approach in assigning a credit 

rating. At a rating committee meeting, participants discussed whether to apply a specific 

approach under the NRSRO’s relevant methodology. The NRSRO applied such approach, but 

the applicable press release did not disclose that fact, why the NRSRO chose such approach, or 

any other important factors taken into account. The Staff recommended that the NRSRO adhere 

to its policies and procedures for sufficiently disclosing its methodological approach to assigning 

credit ratings.

A smaller NRSRO did not adhere to its policies and procedures with respect to the modification 

of a press release based on an issuer comment. The NRSRO provided a draft press release to an 

issuer prior to announcing a rating action, and the issuer recommended revised wording for a 

sentence in the release. The NRSRO revised a sentence in the final press release by accepting 

substantially the same wording that the issuer suggested, which appeared to remove negative 

terms. It did not appear that the NRSRO examined alternative opinions, contrary to requirements 

in the NRSRO’s policies and procedures. The Staff recommended that the NRSRO adhere to its 

policies and procedures with respect to the modification of press releases based on issuer 

comments.

2. In certain instances, NRSROs did not publish Rule 17g-7(a) information disclosure forms 

when taking rating actions.

A smaller NRSRO did not, as Rule 17g-7(a) and the NRSRO’s policies and procedures require, 

publish an information disclosure form when issuing the final rating confirmation for several

transactions. The Staff recommended that the NRSRO properly publish information disclosure 

forms as required by Rule 17g-7(a) and the NRSRO’s policies and procedures.

A smaller NRSRO did not adhere to Rule 17g-7(a) disclosure requirements when taking certain 

credit rating actions. The NRSRO’s policies and procedures list rating actions for which an 

information disclosure form was not required to be published, and this list includes private 

ratings. The NRSRO confirmed that it does not provide an information disclosure form to an 

entity requesting a private rating. The Staff recommended that the NRSRO ensure compliance 

with Rule 17g-7(a) disclosure requirements when issuing private ratings.

A larger NRSRO did not publish an information disclosure form when converting a preliminary 

rating to a final rating as required by Rule 17g-7(a) and the NRSRO’s policies and procedures. 

The Staff recommended that the NRSRO adhere to the Rule 17g-7(a) disclosure requirements 

when converting a preliminary rating to a final rating.

A larger NRSRO issued private credit ratings without including an information disclosure form 

as required by Rule 17g-7(a). The NRSRO’s policies and procedures did not require the NRSRO 

to provide an information disclosure form for private credit ratings, and the NRSRO stated that it 

does not provide such disclosure. The Staff recommended that the NRSRO ensure compliance 

with Rule 17g-7(a) disclosure requirements when issuing private ratings.
2019 Section 15E Examinations Summary Report Page 14

A smaller NRSRO did not publish a Rule 17g-7(a) information disclosure form for a rating. The 

Staff recommended that the NRSRO establish, maintain, enforce, and document internal controls 

to ensure that required Rule 17g-7(a) information disclosure forms are produced for all 

applicable ratings.

3. In certain instances, NRSROs did not adhere to other requirements relating to Rule 17g7(a) information disclosure forms.

A smaller NRSRO did not adhere to relevant rule requirements and its policies and procedures 

when publishing Rule 17g-7(a) information disclosure forms. In several transactions rated by the 

NRSRO, the NRSRO did not include the assigned credit rating in the information disclosure 

form. Also, in some transactions, a person responsible for the rating action did not sign the 

required attestation. The Staff recommended that the NRSRO ensure that information disclosure 

forms contain the information required by relevant rules and its policies and procedures and that 

a person with responsibility for the rating action signs the attestation on each form.

A smaller NRSRO published an information disclosure form in a format that did not adhere to 

the requirements of Rule 17g-7(a). The NRSRO published a single information disclosure form 

that applied to multiple ratings and was hundreds of pages long. The publication did not include

an index, a single set of consecutive page numbers, or other aids to find specific information. 

The Staff recommended that the NRSRO adhere to Rule 17g-7(a)(1)(i)(B) and ensure that 

information disclosure forms are published in a format that is easy to use and helpful for users of 

credit ratings to understand the information contained within.

A smaller NRSRO did not adhere to certain Rule 17g-7(a)(1) disclosure requirements. For 

example, the NRSRO stated inaccurately that it used its published methodology in determining 

certain ratings. The NRSRO also represented that it used information that was generally 

adequate and acceptable in the rating process, when the information that was obtained from 

clients was not verified in any way. The Staff recommended that the NRSRO ensure that all 

required Rule 17g-7(a)(1) disclosures are accurate and specific to each particular rating action.

A smaller NRSRO’s information disclosure form for certain ratings did not include the rating 

and date of the rating action as required. The NRSRO stated that such information was omitted 

due to a coding error and that, in the future, the NRSRO would either manually input the affected

ratings and their respective dates into the form or fix the template coding error so that the ratings 

and relevant dates would be automatically included in the form. The Staff recommended that the 

NRSRO ensure that all required information is included in its information disclosure forms for 

the affected ratings.

4. In certain instances, NRSROs’ information disclosure form attestations did not adhere to 

the requirements in Rule 17g-7(a)(1)(iii).

A larger NRSRO’s information disclosure form attestations for certain rating actions omitted a 

specific phrase, causing the attestations to be inconsistent with the meaning of the relevant rule 

text and the NRSRO’s policies and procedures. The Staff recommended that the NRSRO 
2019 Section 15E Examinations Summary Report Page 15

enhance its policies and procedures relating to the revision and approval of the information 

disclosure form template and ensure that attestation statements are consistent with relevant rule

text and the NRSRO’s policies and procedures.

A larger NRSRO’s information disclosure form attestations contained language that varies from 

the requirements of Rule 17g-7(a)(1)(iii) and that appeared to narrow the attestation. The Staff 

recommended that the NRSRO make information disclosure form attestations in a proper and 

complete form consistent with the requirements of Rule 17g-7(a)(1)(iii).

5. In one instance, an NRSRO did not address a finding and recommendation of the 2018 

Section 15E examination.

For a smaller NRSRO, a finding and recommendation of the 2018 Section 15E examination

related to a Rule 17g-7(a) information disclosure form that did not accurately disclose the 

methodologies used to determine a credit rating. The NRSRO’s response letter stated that the 

NRSRO would analyze the issue and implement solutions. However, at the time of the Staff’s 

2019 Section 15E examination, the NRSRO had not updated the information disclosure form to 

reflect the actual methodologies used to determine the rating. The Staff recommended that the 

NRSRO adhere to the Rule 17g-7(a) information disclosure form requirements and that the 

NRSRO timely address all findings and recommendations in a manner consistent with 

representations made to the Staff.

6. In certain instances, NRSROs did not adhere to their policies and procedures related to 

rating file documentation.

A smaller NRSRO did not adhere to its policies and procedures for maintaining a list of eligible 

rating committee members. While the NRSRO requires the heads of the analytical groups to 

identify analysts eligible to vote on rating committees, some rating files did not include rating 

committee voting lists that were properly updated to include the names of the analysts eligible to 

vote. The Staff recommended that the NRSRO adhere to its policies and procedures for 

maintaining the list of eligible rating committee members.

A smaller NRSRO did not adhere to its policies and procedures requiring a rating committee 

chair to ensure that the presentation, minutes, or other documents maintained in the rating file 

identify the principal methodology and model applied in the credit rating analysis. In some 

instances, the NRSRO incorrectly documented the methodology or model, including instances 

where the disclosed number of methodologies or name of the model were not accurate. The 

Staff recommended that the NRSRO adhere to its policies and procedures.

7. In one instance, an NRSRO did not adhere to its policies and procedures related to 

applying security patches to its IT systems.

A smaller NRSRO did not consistently apply security patches to its IT systems under a defined 

schedule required in the NRSRO’s relevant policies and procedures. The Staff recommended 

that the NRSRO adhere to its policies and procedures for applying security patches to its IT

systems in accordance with specified timeframes.
2019 Section 15E Examinations Summary Report Page 16

8. In certain instances, NRSROs did not adhere to their policies and procedures related to 

accepting new business or new types of ratings.

A smaller NRSRO did not adhere to its policies and procedures for approving new business. The 

NRSRO’s policies and procedures require a committee to approve the commencement of the 

credit rating process with respect to issuer-paid business from issuers or rated entities that the 

NRSRO has not previously rated. In practice, however, the only issuers or rated entities that are 

presented to the committee are those that present potential reputational risk or jurisdictional 

issues. The Staff recommended that the NRSRO adhere to its policies and procedures for 

approving new business.

A smaller NRSRO did not adhere to its policy for accepting new types of ratings. The NRSRO 

assigned ratings to several issuers and the debt they issued, when the NRSRO had not previously 

issued ratings for that type of debt, and had no specific methodology for such ratings. Instead, 

the NRSRO relied on modifications to a separate methodology that the NRSRO detailed in an 

exceptions memorandum that was created subsequent to commencing the ratings process for 

these issuers and securities. No documentation or other evidence existed to show that the 

NRSRO analyzed its feasibility to adequately issue ratings. The Staff recommended that the 

NRSRO: (1) adhere to its policies and procedures for determining if it is adequately able to rate 

where the client or operation is significantly different from those that the NRSRO usually rates, 

or where the case is atypical or special; and (2) establish, maintain, enforce, and document 

controls reasonably designed to ensure that the NRSRO follows its relevant policies and 

procedures.

9. In certain instances, NRSROs did not provide complete, current, or accurate records to 

the Staff upon request.

A smaller NRSRO did not promptly furnish to the Staff legible, complete, and current copies of 

required records upon request, as required by Rule 17g-2(f). The Staff requested routine access 

to the NRSRO’s website, and the NRSRO did not provide access for a period of time. The 

NRSRO attributed the delay to an error in which accounts were inadvertently associated with a 

deactivation date. The Staff recommended that the NRSRO comply with Rule 17g-2(f).

A larger NRSRO produced rating file records that contained documentation errors, and the 

NRSRO’s own compliance reports concluded that recordkeeping practices needed improvement. 

Such compliance reports noted exceptions, such as inaccurate or incomplete information in 

rating committee documents, and the Staff identified other inaccurate or incomplete information 

in rating files, such as an incorrect voting status and rating committee date. The Staff 

recommended that the NRSRO ensure that its rating file records are complete, current, and 

accurate.

A smaller NRSRO did not produce complete and responsive records to the Staff when the Staff 

requested certain information. In response to Staff requests for the developmental work, testing, 

and validation that the NRSRO performed when adopting certain new and revised 

methodologies, the NRSRO produced a brief memorandum created after the adoption of the 
2019 Section 15E Examinations Summary Report Page 17

methodologies. The Staff recommended that the NRSRO ensure that all records produced to the 

Staff are complete and responsive to the Staff’s requests.

10. In one instance, an NRSRO did not properly file the annual financial report required by 

Rule 17g-3(a)(1) for two subsequent years.

A smaller NRSRO submitted its fiscal year annual financial report prior to the applicable filing 

deadline. However, the NRSRO did not include required information related to the report until 

several days later, after the filing deadline. At that time, the Staff informed the NRSRO that the 

required information must be submitted for the report to be considered properly filed. 

Thereafter, the NRSRO submitted its fiscal year annual financial report for the subsequent year, 

which was also missing the same required information. The Staff recommended that the 

NRSRO ensure that its regulatory filings are compliant with all applicable regulations.

11. In certain instances, NRSROs did not conduct sufficient reviews and remediation of

analyst non-adherence to internal policies and procedures or to Commission rules.

A larger NRSRO’s analysts in a particular group provided issuers with preliminary ratings prior 

to conducting the rating committee. An internal review determined that the affected group had a 

longstanding practice where preliminary ratings and/or rationales were sent to issuers for review 

before a rating committee had taken place. The review also discovered that a second group had 

engaged in the same conduct. The Staff recommended that the NRSRO enforce policies and 

procedures maintained in accordance with Rule 17g-4(a)(3) and ensure that employees adhere to 

them, and ensure the implementation of timely remediation when discovering non-adherence to 

Commission rules and its own policies and procedures.

A smaller NRSRO did not sufficiently evaluate adherence to its policies, procedures, and 

methodologies for determining ratings as required by its policies and procedures. The Staff 

found no evidence that the NRSRO’s risk function evaluated the quality of credit ratings or 

adherence to rating methodologies during its rating file reviews, or identified any area that 

required improvement. Also, the risk function did not identify issues that the Staff cited in its 

findings. The Staff recommended that the NRSRO’s risk function evaluate the quality of credit 

ratings and identify areas in need of improvement in the rating process, and that the NRSRO 

enhance its periodic reviews and internal audits of rating files to analyze whether analysts adhere 

to the NRSRO’s procedures and methodologies for determining credit ratings, as described in 

Rule 17g-8(d)(1)(xii).

12. In one instance, an NRSRO did not adhere to its policies and procedures for error 

corrections.

A larger NRSRO reviewed an outstanding rating that the NRSRO had, in prior years, incorrectly 

affirmed after not considering a key rating factor. At that time, the NRSRO identified the error 

and flagged the rating for further review, but an administrative error prevented the review from 

occurring. In a subsequent year, the NRSRO again identified the rating for review and lowered 

the rating, 18 months after the NRSRO first flagged the rating for review. The relevant rating 

report did not disclose the administrative error or the original error from prior years. In the 
2019 Section 15E Examinations Summary Report Page 18

following year, the NRSRO disclosed both errors. The Staff recommended that the NRSRO 

adhere to its policies and procedures for error correction, consider enhancements to its annual 

review process to ensure such errors do not occur, and consider adopting a global definition for a 

particular term used by the NRSRO.

13. In certain instances, NRSROs did not adhere to their policies, procedures, or 

methodologies for determining credit ratings.

A smaller NRSRO did not maintain records documenting its established procedures and 

methodologies, and did not correctly identify the version of the methodology used to determine 

credit ratings. A rating file indicated that the NRSRO issued a credit rating for a loan. A rating

analyst stated that the NRSRO applied a particular methodology to determine the rating for that 

loan. However, such methodology was not effective or approved by the NRSRO’s Board at the 

time of the rating, and the NRSRO’s Rule 17g-7(a) information disclosure form for the rating 

listed a different methodology. The Staff recommended that the NRSRO document its 

established procedures and methodologies, and correctly identify the version of the 

methodology, used to determine credit ratings.

A smaller NRSRO did not, in assigning certain ratings, follow its published methodology, which 

stated that the NRSRO reviews various qualitative factors relating to certain issuers. The rating 

files for certain issuers contained little or no information about any such factors, and the analysts 

assigned to those ratings could not answer basic questions regarding the factors. The Staff 

recommended that the NRSRO adhere to the relevant methodology and establish, maintain, 

enforce, and document internal controls to ensure that it adheres to its rating methodologies.

A smaller NRSRO did not follow its rating policies and procedures for certain issuers’ ratings. 

Relevant analysts of the NRSRO stated that the issuers did not provide certain financial 

information that the analysts requested. The NRSRO was required by its policies and procedures 

to suspend the rating process, but did not do so. The Staff recommended that the NRSRO adhere 

to its policies and procedures with respect to the rating process.

14. In one instance, an NRSRO did not adhere to its policies and procedures related to the 

separation of commercial and analytical activities.

At a smaller NRSRO, a commercial employee received information relevant to the analytical

process from an issuer. However, the NRSRO had no record to show that the employee notified 

the compliance function or informed the issuer that such information must be sent exclusively to 

the analytical team. The same commercial employee also forwarded issuer revenue information 

to an analyst who acted as the lead analyst on many of the issuers’ ratings. The NRSRO had no 

record that the lead analyst notified the compliance function or informed the commercial 

employee that such information must be addressed exclusively to staff in the NRSRO’s 

commercial function, also required by the NRSRO’s policies and procedures. The Staff 

recommended that the NRSRO enforce its policies and procedures related to the separation of 

commercial and analytical personnel responsibilities and enhance its internal controls to ensure 

compliance with Section 15E(h)(1) and Rule 17g-5(c)(8)(i).
2019 Section 15E Examinations Summary Report Page 19

15. In one instance, an NRSRO did not adhere to its policies and procedures related to MNPI.

A smaller NRSRO stated that an analyst mistakenly released a private rating, resulting in the 

public release of MNPI in contravention of the NRSRO’s policies and procedures. The NRSRO 

discovered the error on the same day as the release and removed the private rating from the 

NRSRO’s website. The Staff recommended that the NRSRO adhere to its policies and 

procedures to prevent the public release of MNPI.

B. Review Area: Management of Conflicts of Interest

The Staff’s essential findings regarding the management of conflicts of interest are as follows:

1. In one instance, an NRSRO’s policies and procedures did not include information 

necessary for the NRSRO to appropriately implement the policies and procedures.

A smaller NRSRO’s policy requires analytical staff to immediately contact a supervisor upon 

becoming aware that a potentially conflicted external party intends to interact with analytical 

staff on behalf of a rated entity or an entity seeking an initial credit rating. However, such policy 

did not indicate how to identify such an external party. The Staff recommended that the NRSRO 

include necessary information with its policy so that employees of the NRSRO can appropriately 

implement the policy.

2. In certain instances, NRSROs did not disclose or appropriately manage a conflict of 

interest.

A smaller NRSRO’s policies addressed certain communications that may present, or appear to 

present, a conflict of interest. The NRSRO did not, however, disclose the conflict in public

filings. The Staff recommended that the NRSRO include all material conflicts of interest in its 

filings.

A smaller NRSRO did not have policies, procedures, and internal controls for assigning and 

maintaining credit ratings of potentially conflicted parties. While the NRSRO maintained credit 

ratings for a majority of such parties, the NRSRO did not have any policies, procedures, or 

internal controls to manage and track how the NRSRO assigns and maintains credit ratings of 

those parties. The Staff recommended that the NRSRO establish, maintain, enforce, and 

document policies, procedures, and effective internal controls for assigning and maintaining 

credit ratings of such parties.

A smaller NRSRO sold subscriptions to credit ratings and certain research products, data, and/or 

information. While such sales represent a conflict of interest that may be managed and 

disclosed, the NRSRO has not established written policies and procedures to address and manage 

the conflict. In addition, the NRSRO has not disclosed the conflict in its public filings. The 

Staff recommended that the NRSRO ensure that it adheres to Rules 17g-5(a)(1) and (2) and 17g5(b)(3).
2019 Section 15E Examinations Summary Report Page 20

3. In one instance, an NRSRO’s policies and procedures were inconsistent with the 

requirements of Rule 17g-5(a)(3).

A smaller NRSRO’s policies and procedures were inconsistent with Rule 17g-5(a)(3) because

they only referred to the initial issuance of public ratings and to securities that were not already 

publicly rated by another NRSRO. The NRSRO represented to the Staff that the reference was 

made in error and that the NRSRO’s actual practice is consistent with Rule 17g-5(a)(3). The 

Staff recommended that the NRSRO modify its policies and procedures to make them consistent 

with Rule 17g-5(a)(3).

4. In one instance, an NRSRO did not appropriately address a finding and recommendation

from the 2018 Section 15E examination.

At a smaller NRSRO, the Staff made a finding in the 2018 Section 15E examination related to 

the NRSRO’s lack of policies and procedures applicable to certain directors of the NRSRO. The 

NRSRO’s response stated that the NRSRO planned to develop and implement a process by 

which such directors can certify their compliance with relevant policies and procedures. During 

the 2019 Section 15E examination, the NRSRO submitted to the Staff a questionnaire in which 

such a director acknowledged compliance with certain policies and procedures; however, the

questionnaire included a hand-written note that appeared to negate the director’s 

acknowledgement. The Staff recommended that the NRSRO ensure that policies and procedures 

govern such directors of the NRSRO and that the NRSRO clearly and unambiguously document 

the applicability of those policies and procedures.

5. In certain instances, an NRSRO did not adhere to its policies and procedures related to 

certain prohibited conflicts of interest.

A smaller NRSRO did not adhere to and enforce its securities trading policies and procedures. 

In one instance, an analyst owned a security that was subsequently added to an internal list of 

entities in which the analyst was prohibited from possessing an interest, and the NRSRO did not

recognize that the employee held a restricted security for nearly eight months despite reviewing 

the employee’s monthly holdings reports. The NRSRO also did not ensure that the employee 

sold the security in a timely manner. The Staff recommended that the NRSRO adhere to and 

enforce its securities trading policies and procedures.

A smaller NRSRO’s policies and procedures required sales and marketing personnel to 

document planned meetings, including identifying the attendees, that they and analytical 

personnel jointly attend with market participants. However, for several such meetings, the only 

evidence of the meeting was an online calendar invitation created in advance of the meeting, 

which did not contain substantive information about the meeting including the names of the

participants. Also, the relevant sales and marketing personnel did not create the invitation for

most of those meetings. The Staff recommended that the NRSRO adhere to its policies and 

procedures and ensure that all joint meetings with market participants are properly documented.
2019 Section 15E Examinations Summary Report Page 21

6. In certain instances, NRSROs’ analytical personnel participated in sales or marketing or

were influenced by sales or marketing considerations.

A larger NRSRO observed email discussions, meeting requests, and phone calls between 

analytical and commercial employees with regard to a particular rating. In one instance, a senior 

commercial employee communicated with members of the analytical team just prior to the start 

of the rating committee regarding the client’s timing needs and the sensitivity of the transaction. 

The same commercial employee had contact with a criteria employee advising on the use of 

analytical judgement in the rating. The commercial employee communicated information on the 

deal’s minimum subordination and discussed the client’s timing needs. The Staff recommended

that the NRSRO not issue or maintain a credit rating where an analytical or criteria employee 

also (i) participates in the sale or marketing of a product or service or (ii) is influenced by sales 

or marketing considerations.

A larger NRSRO asked analytical employees to contact potential clients to discuss a new product 

the NRSRO was about to launch. The NRSRO asked analysts to develop lists of key influencers 

in their respective sectors, many of whom were issuers, and provided a script to analysts 

instructing them to initiate conversations with issuers regarding the new product. Associated 

training materials appeared to direct rating analysts to advocate for the new product. The Staff 

recommended that the NRSRO ensure that its analytical employees do not participate in the sales 

or marketing of a product or service of the NRSRO or an affiliate. The Staff also recommended 

that the NRSRO adhere to its policies and procedures.

For a smaller NRSRO, a major shareholder of the NRSRO materially participated in multiple 

capacities in determining ratings. However, the NRSRO did not establish, maintain, and enforce 

written policies and procedures reasonably designed to address and manage the resulting 

conflicts of interest. The NRSRO also issued and maintained ratings where the shareholder was

influenced by sales and marketing considerations and participated in determining the ratings. 

The Staff recommended that the NRSRO establish, maintain, enforce, and document effective 

internal controls to govern the implementation of and adherence to policies and procedures to 

prevent prohibited conflicts of interest, and that the NRSRO take immediate steps to cease 

issuing and maintaining any rating where a person within the NRSRO who participates in 

determining or monitoring the rating, or developing or approving procedures or methodologies 

used to determine the rating, is influenced by sales and marketing considerations.

7. In one instance, an NRSRO did not adhere to its policies and procedures related to 

estimating the value of gifts that personnel received.

A smaller NRSRO did not, in several gift reports, indicate an estimated value of the gift received 

as the NRSRO’s policies and procedures require. The Staff recommended that the NRSRO 

ensure that gift reports contain all information required by its policies and procedures and that 

the NRSRO document the estimated value of gifts and entertainment in its gift log in order to 

ensure compliance with Rule 17g-5(c)(7).
2019 Section 15E Examinations Summary Report Page 22

C. Review Area: Implementation of Ethics Policies

Each NRSRO has implemented written ethics policies and procedures. The Staff reviewed each 

NRSRO’s ethics policies and procedures, as well as a sample of each NRSRO’s employee 

certifications or monitoring activities concerning its code of ethics. Much of the content of these 

policies and procedures addresses other related Review Areas. As such, the Staff’s findings and 

recommendations related to an NRSRO’s implemented ethics policies and procedures are 

addressed in other sections of this Report.

D. Review Area: Internal Supervisory Controls

The Staff reviewed each NRSRO’s overall control structure, including the internal control 

structure related to determining credit ratings.

The Staff’s essential findings regarding internal supervisory controls are as follows:

1. In certain instances, NRSROs had policies and procedures that were unclear or 

inconsistent.

At a smaller NRSRO, one section of a policy and procedure for methodology changes required

the NRSRO to publicly post for comment immaterial updates to the NRSRO’s credit rating 

methodologies. A different section of the policy and procedure made such action discretionary. 

The NRSRO stated that the first section was the applicable process for methodology changes,

other than the requirement to publicly post immaterial updates for comment. The Staff 

recommended that the NRSRO revise its policy and procedure with respect to methodology 

changes and updates to ensure clarity and consistency.

A smaller NRSRO updated a rating without receiving the most recent financial statements of the 

issuer’s parent entity. The NRSRO’s policies and procedures described a lack of financial 

statements as a deviation requiring further steps to be taken. Another policy and procedure, 

however, made it unclear whether such lack of financial statements constitutes a deviation. The 

Staff recommended that the NRSRO review and modify its policies and procedures to clarify the 

requirements for analyzing financial statements of a parent entity, including the timeliness of 

financial statements, and that the NRSRO ensure that its rating policies and procedures are 

consistent and unambiguous so that its analytical staff are able to adhere to them and the NRSRO 

can appropriately assess compliance with them.

2. In certain instances, NRSROs had weak internal supervisory controls related to disclosing 

or documenting errors in determining credit ratings.

A smaller NRSRO did not have procedures for determining whether a significant error existed in 

a methodology or model. The NRSRO revised its policies and procedures to address how the 

NRSRO determined whether a model or analytical tool error resulted in a rating impact, but the 

revision was not consistent with Rule 17g-8(a)(4)(ii) with regard to timing for disclosure. Also, 

the revision contemplated disclosure of a significant error only if the credit rating has changed

due to the error. The Staff recommended that the NRSRO revise its policies and procedures for 
2019 Section 15E Examinations Summary Report Page 23

providing notice of the existence of significant errors in a procedure or methodology used to 

determine credit ratings to reflect relevant rule requirements.

A smaller NRSRO did not adhere to its policies and procedures for reporting rating errors and 

internal control deficiencies or weakness. Analytical staff reported to compliance an 

inconsistency in a certain model and identified the related rating impacts and potential internal 

control deficiencies or weaknesses. However, the incident was not reported to the required 

control functions in a required timeframe, and the relevant report did not include required 

information. The Staff recommended that the NRSRO adhere to its policies and procedures for 

reporting rating errors and internal control deficiencies.

A larger NRSRO convened a number of rating committees to consider whether ratings should be 

changed as part of an error correction process; however, the relevant rating committee 

memorandum did not document that the rating committees were convened for the purposes of 

error correction. The Staff recommended that the NRSRO enhance its internal controls to ensure 

its rating committee documentation adequately documents rating errors.

3. In certain instances, NRSROs had weak internal supervisory controls related to 

preventing the misuse of MNPI.

A smaller NRSRO did not have quality assurance measures regarding the update of an internal 

systems application, resulting in the exposure of nonpublic information. The NRSRO stated that 

it publicly released numerous reports on privately-rated companies that contained nonpublic 

information, including rating rationale, assessments of the rating factors, and rating assumptions 

and drivers. The NRSRO stated that the release was the result of coding and logic errors 

stemming from changes to a report generation application in the prior year. The Staff 

recommended that the NRSRO improve its quality assurance processes and procedures for its 

applications and systems.

A smaller NRSRO’s policies and procedures allowed certain employees and third party workers

to access or obtain knowledge of confidential information, and there was no requirement for 

these workers to sign the policies and procedures or otherwise acknowledge that they had read, 

understood, and agreed to them. The Staff recommended that the NRSRO enhance its policies 

and procedures so that the employees and third party workers are prevented from misusing 

MNPI.

A smaller NRSRO had processes in place for individuals to request and terminate access to 

shared electronic mailboxes, but did not have sufficient controls in place to ensure that users who 

no longer require access are removed from the permission list. In addition, the NRSRO did not 

have a process to ensure compliance with its policies and procedures for the protection of MNPI 

contained in the mailboxes or with respect to conflicts of interest that may arise if a mailbox is 

shared between commercial and analytical personnel. The Staff recommended that the NRSRO 

establish, maintain, enforce, and document effective internal controls regarding shared electronic 

mailboxes.
2019 Section 15E Examinations Summary Report Page 24

4. In certain instances, NRSROs had inconsistencies in press releases, rating files, or rating 

reports.

A smaller NRSRO’s press release on a rating contained certain descriptive information that was 

inconsistent with information in the relevant rating committee package. The Staff recommended 

that the NRSRO ensure that the contents of its press releases are consistent with information in 

the relevant rating committee packages.

At a smaller NRSRO, the Staff found several instances of inconsistent disclosure of 

methodologies in its rating reports, press releases, and information disclosure forms. The Staff 

recommended that the NRSRO enhance its internal controls to ensure that it correctly and 

consistently discloses in a rating report, press release, and information disclosure form the 

methodologies used to determine a credit rating.

5. In certain instances, an NRSRO published Rule 17g-7(a) information disclosure forms 

that were inaccurate or incomplete.

At a smaller NRSRO, certain Rule 17g-7(a) information disclosure forms did not disclose that an 

exceptions memorandum was necessary because of a lack of certain financial information. Such 

disclosure forms also stated that the historical performance of the rating was accessible via a 

link; however, no such link existed. The NRSRO’s rating committee did not notice these

omissions in its review of the information disclosure forms, and the relevant minutes did not 

reference any discussion of the disclosure forms’ contents. The Staff recommended that the 

NRSRO establish, maintain, enforce, and document effective internal controls to ensure the 

accuracy of the information and representations in its information disclosure forms and that the 

NRSRO adhere to the requirements of its applicable policies and procedures and ensure that 

rating committee members review in detail the packet for committee meetings, including the 

information disclosure forms.

6. In one instance, an NRSRO did not have effective internal controls to manage employee 

securities trading.

A smaller NRSRO approved an employee’s request to make equity security trades at a future 

date, but did not have policies and procedures to track when the employee would execute those 

trades. Also, the NRSRO did not adhere to its securities trading policies and procedures 

requiring employees to report the securities holdings of certain family members. Moreover, the 

NRSRO’s policies and procedures contained inconsistent definitions regarding individuals 

required to report securities holdings. The Staff recommended that the NRSRO establish, 

maintain, enforce, and document policies, procedures, and effective internal controls for 

managing securities trading requests and that the NRSRO revise its policies and procedures to 

include a clear and consistent definition of individuals subject to securities holdings reporting 

requirements.
2019 Section 15E Examinations Summary Report Page 25

7. In one instance, an NRSRO had weak internal controls around the approval of its 

compliance policies and procedures.

A smaller NRSRO’s policies and procedures did not allow the DCO to vote to approve 

compliance documents, policies, and procedures and did not require the senior compliance 

officer or designee to attend meetings of the internal group responsible for the development and 

approval of compliance-related policies and procedures. The Staff recommended that the 

NRSRO adhere to Section 15E(j)(3) and that the NRSRO enhance its internal controls to ensure 

its DCO is involved in the approval of compliance-related policies and procedures.

8. In certain instances, NRSROs did not have effective internal controls.

A smaller NRSRO maintained a group of analysts independent of the analytics function to serve 

an internal control function. While the analysts in such group could attend, vote, and/or chair 

rating committees, the Staff found disparate use of the analysts across the NRSRO’s offices. The 

Staff recommended that the NRSRO establish, maintain, and enforce written policies and 

procedures to the group’s participation in rating committees to ensure the effectiveness of the 

group’s internal control function.

A larger NRSRO received a complaint from an employee regarding a type of credit estimate, 

alleging model flaws and excessive reliance on client-supplied data. The NRSRO conducted an 

internal investigation, which resulted in certain findings and recommendations. The Staff 

observed several weaknesses in the NRSRO’s process for assigning credit estimates, including a 

lack of model use oversight, insufficient robustness in the model validation process,

inconsistencies in terminology, and omission of data. Also, committee packages for the credit 

estimates did not contain all of the data required by NRSRO’s policies and procedures. The 

Staff recommended that the NRSRO enhance its internal controls for assigning credit estimates

and ensure adherence to related policies and procedures.

A larger NRSRO may, in certain cases, issue a rating that does not require a rating committee or 

any analytical input if the rating qualifies as a certain kind of rating; however, the NRSRO did 

not document policies, procedures, or effective internal controls to govern the relevant rating 

process. Also, the NRSRO’s analytical personnel were not notified when such a rating was 

published, and, in one case, such a rating was published with incorrect rating information, which 

the compliance function discovered only at a later time. The Staff recommended that the 

NRSRO establish policies, procedures, and effective internal controls to govern its relevant

ratings process.

At a larger NRSRO, the surveillance function did not adequately monitor certain ratings, the 

status of which had been incorrectly identified. Relevant analysts were not notified of the error 

and the NRSRO’s systems did not provide surveillance analysts with information needed to 

identify incorrect identification. The Staff recommended that the NRSRO enhance its internal 

controls with respect to the maintenance of the affected type of ratings.

At a larger NRSRO, a team maintained a database containing credit rating action data for 

transactions involving a particular kind of receivable, which was used for annual surveillance. 
2019 Section 15E Examinations Summary Report Page 26

An individual analyst was responsible for both inputting data into the database and verifying that 

accuracy of the database, and also for comparing the accuracy of the database to a similar 

database maintained by another group. If the analyst identified any errors between the two 

databases, the analyst updated the information in the other group’s database without any

additional control processes, procedures, or reviews. The Staff recommended that the NRSRO

enhance its internal controls within the relevant team for maintaining and monitoring credit 

rating information for the transactions involving the particular kind of receivable.

At a larger NRSRO, a rating committee assigned a rating based on factors that included an 

assumption that a particular economic stress scenario would occur, which was not consistent 

with forecasts and analysis prepared by the NRSRO’s economists and reflected in public 

statements. Such assumption was a key factor in the NRSRO being able to assign the rating. 

The NRSRO also did not consistently apply its assumption, as transactions prior and subsequent 

to the one at issue did not indicate any associated concerns. The Staff recommended that the 

NRSRO enforce its internal control structure regarding processes in place to ensure consistent 

application of macroeconomic forecasts and assumptions in the determination of ratings.

9. In certain instances, NRSROs did not demonstrate sufficient Board approval of new or 

revised rating methodologies, including models.

A larger NRSRO made changes to a ratings model that the NRSRO determined were, 

individually, not material changes and, thus, did not require Board approval. Subsequently, 

however, the NRSRO determined that the changes were, in the aggregate, material. The Board 

did not approve the model until several months later, but the NRSRO continued to use the model 

to determine credit ratings for several months prior to Board approval. The NRSRO’s 

compliance function subsequently observed that the NRSRO did not have policies and 

procedures to address such circumstances. The Staff recommended that the NRSRO ensure that 

all models that are materially changed are approved by the Board prior to being implemented.

A smaller NRSRO’s Board minutes were not sufficiently detailed to demonstrate Board 

members’ active and informed engagement in reviewing and approving new and revised rating 

methodologies. The minutes did not demonstrate that Board members received any supporting 

documentation specific to the methodologies they were approving, apart from the actual 

methodologies. The Staff recommended that the NRSRO ensure that the Board’s approval of 

methodologies is sufficiently documented.

10. In certain instances, NRSROs did not adhere to existing methodologies in determining 

credit ratings.

A smaller NRSRO did not adhere to its methodology when it issued ratings on a particular type 

of instrument for which it did not have an approved methodology. The NRSRO determined the 

ratings using an approach that was neither documented nor approved, and which did not take into 

account factors that the NRSRO stated would be considered in the rating process. The Staff 

recommended that the NRSRO: (1) establish, maintain, enforce, and document an effective 

internal control structure governing the implementation of and adherence to policies, procedures, 

and methodologies for determining credit ratings; (2) make and retain in complete and current 
2019 Section 15E Examinations Summary Report Page 27

form a record documenting the established procedures and methodologies it used to determine 

credit ratings; (3) ensure the procedures and methodologies, including qualitative and 

quantitative data and models used to determine credit ratings are approved by its Board and are 

developed in accordance with the NRSRO’s policies and procedures, and that the NRSRO 

discloses the version of the procedure or methodology used with respect to a particular credit 

rating; and (4) adhere to its rating methodologies.

A smaller NRSRO did not adhere to its methodology in determining credit ratings. In addition, 

the NRSRO’s rating files did not contain reasons for, or steps taken in, deviating from an 

established methodology, and the NRSRO did not immediately report deviations from the 

methodology to appropriate personnel as required by the NRSRO’s policies and procedures. The 

Staff recommended that the NRSRO: (1) maintain complete and current records documenting 

the established procedures and methodologies it used to determine credit ratings; (2) enhance its 

internal control structure for governing adherence to its methodology for determining credit 

ratings; (3) retain relevant records and document the circumstances under which deviations to 

established methodologies are permitted; and (4) establish, maintain, enforce, and document 

policies and procedures that are reasonably designed to clearly define and disclose the meaning 

of any symbol used to denote a credit rating and to apply each symbol, number, or score in a 

manner that is consistent for all types of obligors, securities, and money market instruments for 

which the NRSRO uses the symbol, number, or score.

A smaller NRSRO assigned certain ratings to issuers without previously having issued ratings of 

that type and without having a relevant methodology. The NRSRO determined the ratings by 

relying on material modifications to an existing methodology, which were detailed in an 

exceptions memorandum authored by the lead analyst for the ratings and which did not go 

through the NRSRO’s process for amending criteria. The Staff recommended that the NRSRO 

establish, maintain, enforce, and document effective internal controls: (1) with respect to the 

separation of duties between those who develop exceptions or modifications to methodologies 

and those who are responsible for assigning ratings; and (2) to ensure that analytical and 

methodology development tasks are subject to appropriate and independent review. The Staff 

also recommended that the NRSRO: (1) adhere to its policies and procedures with respect to the 

development and approval of methodologies; (2) enhance its internal controls with respect to 

exceptions memoranda to ensure a consistent approach to methodology development; and (3) 

enhance its policies and procedures regarding the appropriate use of exceptions memoranda.

11. In certain instances, an NRSRO did not adhere to its policies and procedures in 

developing and implementing new or revised procedures and methodologies for determining 

credit ratings.

A smaller NRSRO’s evidence of development, testing, and validation of a new rating 

methodology did not, in contravention of the NRSRO’s policies and procedures, contain any 

discussion or documentation of the relevant committee in approving the methodology, or any 

documentation illustrating that an independent analyst reviewed the development work before 

the NRSRO employed the methodology. The Staff recommended that the NRSRO adhere to its 

policies and procedures with respect to the development and modification of procedures and 

methodologies used to determine ratings.
2019 Section 15E Examinations Summary Report Page 28

A smaller NRSRO did not document the development, testing, and validation of a tool that the 

NRSRO used in determining credit ratings. The NRSRO had no records demonstrating that the 

relevant review committee oversaw or verified the development of the tool, or that it was 

reviewed by an independent analyst. The Staff recommended that the NRSRO adhere to its 

policies and procedures with respect to the development and ongoing maintenance of the tool.

A smaller NRSRO used a new methodology to issue ratings on certain transactions without first 

conducting a feasibility analysis to determine whether the NRSRO had adequate methodologies, 

competency, access to necessary information, and resources to do so, in contravention of the 

NRSRO’s policies and procedures. The Staff recommended that: (1) the NRSRO establish an 

effective internal control structure governing the implementation of and adherence to policies 

and procedures for engaging in analysis before rating a class of obligors, securities, or money 

market instruments that the NRSRO has not previously rated, to determine whether the NRSRO 

has sufficient competency, access to information, and resources to determine the rating; and (2) 

adhere to its policies and procedures and perform a feasibility analysis before commencing the 

rating of a class of obligors, securities, or money market instruments it has not previously rated.

A smaller NRSRO published a revised methodology without review committee supervision or 

independent review by an analyst, in contravention of the NRSRO’s policies and procedures. 

While the NRSRO deemed such revisions immaterial, they included a fundamental change to the 

definition of the NRSRO’s ratings. While the NRSRO also stated that such revisions did not 

impact any outstanding ratings, it did not conduct any analysis or review of specific ratings to 

reach such conclusion. The Staff recommended that the NRSRO: (1) establish, maintain, 

enforce, and document policies and procedures reasonably designed, with respect to the 

development and modification of procedures and methodologies used to determine credit ratings; 

(2) adhere to its procedures governing the development and modification of methodology and

models; (3) adhere to its rating methodology; (4) establish, maintain, enforce, and document 

policies and procedures reasonably designed to ensure that material changes to methodology are 

applied consistently to all current and future credit ratings to which the changed procedures or 

methodologies apply, and are promptly posted to the NRSRO’s website, and include the reasons 

for the changes and the likelihood the changes will result in changes to any current credit ratings; 

and (5) establish, maintain, enforce, and document policies and procedures reasonably designed 

to clearly define and disclose the meaning of any symbol, number, or score used to denote a 

credit rating and to apply any symbol, number, or score in a manner that is consistent for all 

types of obligors, securities, and money market instruments for which the symbol, number, or 

score is used.

12. In certain instances, NRSROs did not retain internal records used to form the basis of 

credit ratings or did not maintain records documenting its established procedures and 

methodologies used to determine credit ratings.

At a smaller NRSRO, rating files did not include sufficient documentation to permit an after-thefact review or audit to analyze analyst adherence to the NRSRO’s credit rating methodologies. 

The Staff recommended that the NRSRO: (1) adhere to its policies and procedures and 

sufficiently document in its rating reports the difference between model-implied and assigned 
2019 Section 15E Examinations Summary Report Page 29

ratings; (2) retain records used to form the basis of credit ratings; and (3) consider enhancing its 

internal control structure to ensure that after-the-fact reviews or audits can be performed to 

determine whether analysts adhered to the NRSRO’s procedures and methodologies for 

determining credit ratings.

A smaller NRSRO frequently determined credit ratings using a particular analysis. However, the 

NRSRO’s methodology did not contain any procedures or guidance for analysts on how to apply 

that analysis, nor did the NRSRO document the analysis as a methodology or procedure for 

determining ratings. The NRSRO also applied such analysis inconsistently and frequently 

without sufficient documentation to reflect analytical work. The Staff recommended that the 

NRSRO: (1) maintain complete and current records documenting its established procedures and 

methodologies used to determine credit ratings; (2) retain sufficient records; (3) establish, 

maintain, enforce, and document policies and procedures that are reasonably designed to clearly 

define and disclose the meaning of any symbol used to denote a credit rating and to apply each 

symbol, number, or score in a manner that is consistent for all types of obligors, securities, and 

money market instruments for which the NRSRO uses the symbol, number, or score; and (4) 

adhere to its rating methodologies.

At a smaller NRSRO, rating committees met only briefly in assigning ratings to multiple issuers

and the NRSRO did not document a number of rating factor inconsistencies in the rating 

committee process. The Staff recommended that the NRSRO establish, maintain, enforce, and 

document internal controls: (1) to ensure that rating committees conduct and document a 

thorough analysis in determining ratings; (2) that take into consideration the applicable factors 

mentioned in relevant rules; and (3) to ensure that all internal records and work papers used to 

form the basis of a credit rating are retained.

13. In one instance, an NRSRO did not establish, maintain, enforce, and document an 

effective internal control structure governing the implementation of adherence to policies, 

procedures, and methodologies for determining credit ratings.

A smaller NRSRO did not have effective internal controls to ensure, among other things, that: 

(1) it does not issue purported NRSRO ratings in classes for which it is not registered; (2) it 

adheres to its methodology; (3) the procedures and methodologies it uses to determine credit 

ratings are approved by its Board and developed in accordance with its policies and procedures; 

(4) it does not issue and maintain credit ratings where a person influenced by sales and marketing 

consideration participated in the determination of those ratings; and (5) it does not make 

inaccurate and incomplete public disclosures. The Staff recommended that the NRSRO 

establish, maintain, enforce, and document an effective internal control structure governing the 

implementation of and adherence to policies, procedures, and methodologies for determining 

credit ratings.
2019 Section 15E Examinations Summary Report Page 30

14. In one instance, an NRSRO did not comply with certain requirements in a Commission 

order.

A smaller NRSRO did not comply with certain requirements in a Commission order. The Staff 

recommended that the NRSRO establish, maintain, enforce, and document an effective internal 

control structure to ensure that it complies with Commission orders.

15. In one instance, an NRSRO had weak standards of training, experience, and competence 

for credit analysts.

At a smaller NRSRO, approximately one quarter of the analytic staff failed an analytical test that

the NRSRO administered. While the NRSRO conducted remedial training with the analysts who 

failed the test, the NRSRO did not re-test them for their knowledge of the credit rating process. 

The Staff recommended that the NRSRO establish, maintain, enforce, and document policies and 

procedures that are designed to ensure its compliance with Rule 17g-9(b)(4) and (c)(1).

16. In one instance, an NRSRO did not have effective internal controls governing the 

validation of client-provided models used in the credit rating process.

A smaller NRSRO did not on some occasions evaluate and validate client-provided models 

before employing them, contrary to the NRSRO’s policies and procedures. Also, the NRSRO’s 

policies and procedures did not address the use of client-provided models in the rating process. 

The Staff recommended that the NRSRO implement effective internal controls for the 

independent verification and validation of client-provided models used in the credit rating 

process prior to the models being put into use.

17. In one instance, an NRSRO did not sufficiently document compliance audits.

At a smaller NRSRO, a compliance audit report did not document the compliance procedure, risk 

results, or corrective action taken to mitigate identified risks. Also, the NRSRO did not complete 

compliance audits on a timely basis, which the NRSRO stated was due to staffing issues. The 

NRSRO stated that such audits were prioritized and conducted based on their level of 

importance, but the NRSRO did not document such analysis or its decision to delay the audits. 

The Staff recommended that the NRSRO adhere to its documentation requirements and enhance 

internal controls around planning for compliance audits and document processes involving 

delays and prioritizations of audits.

E. Review Area: Governance

The Staff interviewed each NRSRO’s Board, including independent directors. The Staff also 

reviewed minutes and other documentation related to the activities of each NRSRO’s Board.

The Staff’s essential findings relating to the NRSROs’ corporate governance and compliance 

with Section 15E(t) are as follows:
2019 Section 15E Examinations Summary Report Page 31

1. In one instance, an NRSRO’s Board did not have the requisite number of independent 

directors under Section 15E(t)(2).

A smaller NRSRO did not maintain the requisite number of independent directors on its Board. 

An independent director resigned from the NRSRO’s Board and, as a replacement, the NRSRO

appointed an individual who had already served a five-year term as an independent director for 

the NRSRO. The Staff recommended that the NRSRO ensure that it has, at all times, the 

requisite number of independent directors on its Board in accordance with Section 15E(t)(2)(A), 

(t)(2)(B), and (t)(2)(C).

F. Review Area: DCO Activities

The Staff reviewed the role and activities of each NRSRO’s DCO and interviewed each DCO. 

The Staff’s essential findings regarding the NRSROs’ DCO activities are as follows:

1. In one instance, an NRSRO’s DCO did not provide adequate oversight of compliance.

A smaller NRSRO’s independent directors’ and DCO’s performance of their respective required 

duties needed improvement. The independent directors were not aware of many of the 

NRSRO’s failures to adhere to policies and procedures for determining credit ratings and weak 

internal controls. The DCO’s oversight and monitoring of the NRSRO’s internal control system 

and compliance with the NRSRO’s policies and procedures and with regulatory requirements did 

not uncover the issues identified by the Staff. The Staff recommended that the NRSRO ensure 

that its directors and DCO fulfill all duties and requirements mandated by Section 15E(t)(3) and 

(j)(1), respectively, and by the NRSRO’s policies and procedures.

2. In one instance, an NRSRO’s required filings contained incomplete or inaccurate 

information.

A smaller NRSRO did not properly file two exhibits to an annual certification of its Form 

NRSRO registration and a report required by Rule 17g-3(a)(1). The Staff recommended that the 

NRSRO ensure that all Form NRSRO filings include the information required in the Form 

NRSRO instructions and that all financial statements and audit opinions filed pursuant to Rule 

17g-3(a)(1) meet relevant requirements.

G. Review Area: Complaints

All of the NRSROs have written policies and procedures to address complaints generally. The 

Staff’s essential findings regarding complaints are as follows:

1. In certain instances, NRSROs had weak, unclear, or inconsistent policies and procedures 

concerning complaints.

A smaller NRSRO had policies and procedures requiring the NRSRO’s complaints policies, 

procedures, and internal controls to specify the circumstances under which a complaint must be 

reported to senior management and/or the Board; however, other policies and procedures did not 
2019 Section 15E Examinations Summary Report Page 32

specify such circumstances. The NRSRO represented that, in practice, the NRSRO reported all 

complaints to senior management and the Board. The Staff recommended that the NRSRO 

revise its complaints policies and procedures so that they are consistent with the NRSRO’s other 

relevant policies.

A larger NRSRO had weaknesses in its policies and procedures for addressing complaints from 

its employees. The NRSRO revised certain policies and procedures to add new categories of 

complaints but, for one new category, included no information beyond a new defined term; as a 

result, the NRSRO’s process for the treatment of such complaints was not clear. Also, while the 

NRSRO’s policies and procedures described a process for reviewing certain employee 

complaints once they are logged into the NRSRO’s system, relevant personnel were not required 

to first log the complaints into such system. There also was a gap in the NRSRO’s policies and 

procedures for routing anonymous employee complaints for consideration, and certain 

complaints covered by control functions outside of compliance did not appear to be subject to 

adequate retention requirements. The Staff recommended that the NRSRO enhance its policies 

and procedures relating to the receipt, retention, and treatment of complaints from its employees.

A larger NRSRO’s policies and procedures related to the receipt, retention, and treatment of 

complaints were unclear with respect to communications about rating withdrawals. The NRSRO 

received a third-party communication identifying an incorrectly withdrawn rating that, according 

to personnel of the NRSRO, was not considered to be a complaint under the NRSRO’s policies 

and procedures because a certain non-analytical group performed withdrawals; however, such 

view did not appear to be clearly identified in the NRSRO’s policies and procedures. The Staff 

recommended that the NRSRO clarify its policies and procedures related to the receipt, retention, 

and treatment of complaints with respect to communications about rating withdrawals.

2. In one instance, an NRSRO did not adhere to its policies and procedures concerning 

complaints.

A smaller NRSRO did not adhere to its policies and procedures pertaining to complaints. The 

NRSRO’s complaints log indicated that the NRSRO received an email complaint regarding the 

NRSRO’s views on the impact of a certain event on related credit ratings. While the complaint 

included the complainant’s name and email address, the NRSRO did not respond to the 

complainant as required by the NRSRO’s policies and procedures. The Staff recommended that 

the NRSRO adhere to its complaints policies and procedures.

H. Review Area: Post-Employment 

The Staff reviewed whether each NRSRO’s “look-back” policies and procedures satisfy the 

applicable statutory and rule requirements. The Staff’s essential findings regarding NRSROs’ 

look-back policies and procedures are as follows:
2019 Section 15E Examinations Summary Report Page 33

1. In certain instances, NRSROs had weaknesses in post-employment policies, procedures,

or controls.

A smaller NRSRO’s policies and procedures for employment transition reporting defined the 

one-year review period as the one-year period prior to the most recent rating action taken by the 

NRSRO prior to the employee’s departure, which does not coincide with the timing requirements

in the relevant statute. The Staff recommended that the NRSRO revise its policies and 

procedures for employment transition reporting to be compliant with statutory requirements.

A smaller NRSRO’s policies and procedures required the NRSRO to conduct a look-back rating 

committee review of a previous rating action in certain circumstances, but did not describe the 

policies and procedures for conducting the look-back review. For example, the policies and 

procedures did not specify who is responsible for conducting the review or what the review 

entails. The Staff recommended that the NRSRO document policies and procedures for 

conducting a look-back rating committee review of a previous rating action.

A smaller NRSRO’s policy for look-back reviews did not include the full disclosure 

requirements, since it did not have, for the disclosure of a revision or affirmation of a credit 

rating, a description of the nature of the conflict and a description of the impact the conflict had 

on the prior rating action or actions. In addition, for the disclosure of an affirmation of a credit 

rating, the policy did not have an explanation of why no rating action was taken to revise the 

credit rating notwithstanding the presence of the conflict. The Staff recommended that the 

NRSRO ensure that its policies for look-back review disclosure are consistent with each other 

and with applicable requirements.

A larger NRSRO did not properly track information to comply with its post-employment 

reporting requirements. The NRSRO did not properly conduct post-employment tracking for the 

purposes of satisfying statutory reporting requirements, as it did not collect information for the 

required five-year period. The NRSRO did not have a process to ensure the integrity of the postemployment review list. The Staff recommended that the NRSRO ensure it properly tracks the 

information needed to comply with its post-employment reporting requirements.

V. CONCLUSION

The Staff has identified findings and recommendations for the NRSROs. In future examinations, 

the Staff will continue to assess the NRSROs’ responses to recommendations from the 2019

Section 15E examinations. The Staff will continue to evaluate its risk assessment process to 

review compliance with laws and regulations and to identify emerging risk areas. The Staff will 

also continue to evaluate examination techniques to assess and test the NRSROs’ compliance 

with applicable laws and rules.