GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

United States Government Accountability Office

Washington, DC 20548 

July 27, 2005 

The Honorable Cynthia A. Glassman 

Acting Chairman 

U.S. Securities and Exchange Commission 

Subject: Material Internal Control Issues Reported in SEC’s Fiscal Year 2004 

Financial Statement Audit Report 

Dear Ms. Glassman: 

In May 2005, we issued our report expressing an opinion on the Securities and 

Exchange Commission’s (SEC) fiscal year 2004 financial statements and an opinion 

on SEC’s internal control as of September 30, 2004.1 We also reported on the results 

of our tests of SEC’s compliance with selected provisions of laws and regulations 

during fiscal year 2004. 

Our report on SEC’s fiscal year 2004 financial statements identified reportable 

conditions in the internal controls over financial reporting that we considered to be 

material weaknesses.2 These weaknesses related to SEC’s controls over (1) recording 

and reporting disgorgements3 and penalties4 pertaining to those who violate securities 

laws, (2) preparing financial statements and related disclosures, and (3) information 

security. In March 2005, we reported on the information security weaknesses, 

making six recommendations to address those weaknesses.5 The purpose of this 

report is to provide SEC with 18 recommendations to addresses the remaining 

weaknesses concerning disgorgements and penalties, and financial statement 

preparation and reporting.6

 

1 GAO, Financial Audit: SEC’s Fiscal Year 2004 Financial Statements, GAO-05-244 (Washington, 

D.C.: May 26, 2005).

2

 A material weakness is a condition in which the design or operation of one or more of the internal 

control components does not reduce to a relatively low level the risk that errors, fraud, or 

noncompliance in amounts that would be material to the financial statements may occur and not be 

detected promptly by employees in the normal course of their duties. 3

 A disgorgement is the repayment of illegally earned profits. 4

A penalty is a monetary sum that is to be paid by the registrant to SEC as a result of a security law 

violation. The monetary sum is usually based on amounts prescribed by statute or the amount of 

disgorgement. 

5

GAO, Information Security: Securities and Exchange Commission Needs to Address Weak Controls 

over Financial and Sensitive Data, GAO-05-262 (Washington, D.C.: Mar. 23, 2005). 6

 A separate report to management on other issues identified during our audit that, although not 

material in relation to the financial statements, warrant management’s consideration, will be issued 

shortly. 
Page 2 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

As part of our audit of SEC’s fiscal year 2004 financial statements, we evaluated 

SEC’s internal controls and its compliance with selected provisions of laws and 

regulations. We designed our audit procedures to test relevant controls, including 

those for the proper authorization, execution, accounting, and reporting of 

transactions. We conducted our audit in accordance with U.S. generally accepted 

government auditing standards. SEC’s written comments on a draft of this report are 

included in enclosure I. Further details on our scope and methodology are included in 

our May 2005 report on the results of our audit of the 2004 financial statements and 

are reproduced in enclosure II. 

Disgorgements and Civil Penalties 

As part of its enforcement responsibilities, SEC issues and administers judgments 

that order, among other things, disgorgements and civil penalties against violators of 

federal securities laws. The resulting transactions involve material amounts of 

collections, which amounted to about $945 million in fiscal year 2004, and the 

recording and reporting of fiduciary and custodial balances on the financial 

statements.7

Presently, SEC records and tracks information on disgorgements and penalties 

through a case-tracking system. In August 2004, the Office of Financial Management 

assumed responsibility from the Division of Enforcement for entering and 

maintaining financial data on disgorgements and penalties in the case-tracking 

system, and making the necessary calculations and adjustments for preparing SEC’s 

financial statements.8 However, the case-tracking system is not designed for financial 

reporting purposes and is not integrated with the general ledger. 

To compensate for limitations in the system, SEC staff performed extensive and timeconsuming manual procedures to compile quarterly subsidiary ledgers to update the 

accounting system for disgorgement and penalty balances and activity. 

Notwithstanding the inherent inefficiencies of such manual processes, they also 

increase the risk of reporting inaccurate amounts and inhibit timely reporting. 

Despite this risk, SEC did not perform the requisite control procedures to reasonably 

assure the completeness and reliability of the disgorgement and penalty financial 

information in the case-tracking system. The risk of incomplete or inaccurate 

disgorgement and penalty data is further increased because of ineffective 

coordination and communication between various SEC divisions and offices that 

share responsibility for recording and maintaining disgorgement and penalty 

information. Our audit noted instances where, while disgorgement activity was 

entered into the case-tracking system by the Division of Enforcement and supporting 

 

7

 Fiduciary activities represent the moneys collected from federal securities law violators and 

maintained by SEC to be distributed to harmed investors. Custodial activities represent the moneys 

collected by SEC from violators of federal securities laws that are returned to the General Fund of the 

Treasury, as nonfederal individuals or entities do not have an ownership interest in these revenues.

8

 Prior to August 2004, SEC’s Division of Enforcement was responsible for entering disgorgement and 

penalty information, including financial information, into the case-tracking database. 
Page 3 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

documentation was in the files maintained by the case managers, the finance staff 

responsible for the accounting entries did not have the documentation necessary to 

make the entries into the general ledger, and therefore, had not made the related 

entries. 

GAO’s Standards for Internal Control in the Federal Government9

 requires that 

agencies establish controls to ensure that transactions be recorded in a complete, 

accurate, and timely manner. SEC has a draft policy, dated October 1, 2002, that 

covers certain aspects of accounting for disgorgements and penalties, but the policy 

is not comprehensive. For example, the draft policy does not define who is 

responsible for the various aspects of recording disgorgement and penalty data or the 

documentation that should be maintained to support the amounts recorded. Of even 

more importance, the draft policy does not identify the processes and controls that 

are critical for determining the amounts to be recorded and for reviewing the 

disgorgement and penalty financial information and related accounting entries for 

completeness and accuracy. Nor does the policy address the supervisory review 

procedures necessary to ensure consistent application of the procedures. We found 

instances where documentation in the case files contained hand-written annotations, 

without sufficient evidence, instructing certain activity with regard to a disgorgement 

or penalty amount. While SEC did not make entries into the case-tracking system on 

the basis of these handwritten instructions, their existence raises concern about the 

reliability and accuracy of the amounts recorded in the case-tracking system. 

A lack of comprehensive policies and controls increases the risk that disgorgement 

and penalty transactions will not be completely, accurately, and consistently 

recorded and reported. For example, in our audit of the estimated net amounts 

receivable from disgorgements and penalties, we found errors in the recorded 

balances for the related gross accounts receivable and allowance for loss. 

Specifically, we noted errors where SEC had made entries to the accounting system 

that conflicted with information in the files, and we noted inconsistent treatment in 

recording judgment and interest amounts, terminated debts, and collection fees 

imposed by the Department of the Treasury. We believe that these errors and 

inconsistencies occurred because of the weaknesses discussed above. While, in most 

cases, these errors and inconsistencies were offsetting, such errors raise concern 

about the controls over the reliability of the gross accounts receivable and related 

allowance amounts reported in footnote 3 to SEC’s financial statements. 

Recommendations for Executive Action

We recommend that the Chairman, SEC, take the following five actions to improve 

internal controls over disgorgements and penalties: 

1. Implement a system that is integrated with the accounting system or that 

provides the necessary input to the accounting system to facilitate timely, 

 

9

 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, 

D.C.: November 1999). 
Page 4 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

accurate, and efficient recording and reporting of disgorgement and penalty 

activity. 

2. Review the disgorgement and penalty judgments and subsequent activities 

documented in each case file by defendant to determine whether the 

individual amounts recorded in the case-tracking system are accurate and 

reliable. 

3. Implement controls so that the ongoing activities involving disgorgements and 

penalties are properly, accurately, and timely recorded in the accounting 

system. 

4. Strengthen coordination, communication, and data flow among staff of SEC’s 

Division of Enforcement and Office of Financial Management who share 

responsibility for recording and maintaining disgorgement and penalty data. 

5. Develop and implement written policies covering the procedures, 

documentation, systems, and responsible personnel involved in recording and 

reporting disgorgement and penalty financial information. The written 

procedures should also address quality control and managerial review 

responsibilities and documentation of such a review. 

Financial Statement Preparation and Reporting 

GAO’s Standards for Internal Control in the Federal Government requires that 

controls over the financial statement preparation process be designed to provide 

reasonable assurance regarding the reliability of the balances and disclosures 

reported in the financial statements and related notes in conformity with generally 

accepted accounting principles, including the maintenance of detailed support that 

accurately and fairly reflects the transactions making up the balances in the financial 

statements and disclosures. Established tools, including checklists and 

implementation guides, are available to assist in developing controls over financial 

statement compilation and review. 

We found that SEC had neither the formalized processes or documentation showing 

the procedures, systems, analysis of accounts, and personnel involved in developing 

key balances and preparing the financial statements and related disclosures, nor the 

related quality control and review procedures. As a result, SEC’s opening balances 

for its fiscal year 2004 financial statements contained material misstatements, some 

of which also materially affected the unadjusted fiscal year 2004 reported operating 

results. Although SEC ultimately posted the necessary audit adjustments and 

produced financial statements for fiscal year 2004 that were fairly presented in all 

material respects, the lack of processes and documented procedures significantly 

delayed the reporting of SEC’s fiscal year 2004 financial results, consumed significant 

SEC staff resources, caused audit inefficiencies, and resulted in higher financial 

statement preparation and audit costs. For example, SEC did not have 
Page 5 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

documentation providing an explanation or a cross-walk between the financial 

statements and the source systems, general ledger accounts, account queries, and 

account analyses. SEC did not maintain a subsidiary ledger for certain activity, such 

as customer deposit amounts pertaining to filing fees. Accounting staff also had 

difficulty in retrieving support for certain account balances, such as undelivered 

orders amounts, and for certain property and equipment leases. In addition, 

reconciliations of subsidiary and summary account balances were not prepared for 

certain financial statement line items, such as for the customer deposit liability 

relating to filing fees and the associated earned filing fee revenue, the accounts 

receivable related to exchange fees and the related amount of earned exchange fee 

revenue, and the budgetary accounts related to undelivered and delivered orders, 

thus requiring SEC staff to create an audit trail after the fact in order to reconcile 

support to general ledger balances. There also was no consistent evidence of 

supervisory review of journal entries, including closing and adjusting journal entries 

made in connection with preparing quarterly and year-end financial statements. 

Another factor contributing to identified accounting issues was that comprehensive 

accounting policies and procedures for several major areas, including disgorgements 

and penalties, filing fees, exchange fees, and fixed asset capitalization, were still in 

draft or had not yet been developed. 

If properly designed and implemented, a financial statement preparation process with 

documented policies and procedures, support, and quality assurance reviews should 

reasonably assure SEC management that the balances presented in the financial 

statements and related disclosures are supported by SEC’s underlying accounting 

records. The process should include certain components and provide a discipline 

that should greatly help SEC in preparing financial statements without having to go 

through heroic efforts as was done in fiscal year 2004. 

A fundamental problem leading to SEC’s staff-intensive and time-consuming efforts 

to prepare financial statements is that SEC’s general ledger and core financial 

management system are not set up to generate most data analysis user reports on a 

real-time basis. Users have to request reports that are generated on an ad hoc basis 

by a software application whose operations are known only to some SEC staff. Also, 

other management systems used at SEC, such as the case-tracking system used for 

disgorgements and penalties and the system used to track property, along with 

various spreadsheet applications, are not integrated with the core financial 

management system. Again, this means that such information is not readily available, 

and as we determined during the audit, necessitated significant manual processes to 

determine account balances. 

OMB Circular No. A-127, Financial Management Systems, requires that each agency 

establish and maintain a single integrated financial management system. A single 

integrated financial management system is a unified set of financial systems linked 

together electronically in an efficient and effective manner to provide agencywide 

financial system support. Integration means that the user is able to have one view 

into systems such that, at whatever level the individual is using the system, he or she 

can obtain needed information efficiently and effectively through electronic means. 
Page 6 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

A single integrated financial management system does not necessarily mean having 

only one software application within each agency covering all financial management 

system needs or storing all information in the same database. Interfaces between 

systems are acceptable as long as the supporting detail to enable reconciliation 

between the systems is maintained and accessible to managers. Interface linkages 

should be electronic unless the number of transactions is so small that it is not cost 

beneficial to automate the interface. Reconciliations between systems, where 

interface linkages are appropriate, should be maintained to ensure data accuracy. 

To support its financial management functions, SEC relies on several different 

systems to process and track financial transactions that include filing fees paid by 

corporations and disgorgements and penalties assessed and collected from 

enforcement activities. In SEC’s case, without an integrated financial management 

system to help ensure timely and reliable financial data, decision makers run the risk 

of delays in attaining relevant data or using inaccurate information inadvertently 

while at the same time dedicating scarce resources toward the basic collection of 

information. 

Recommendations for Executive Action

We recommend that the Chairman, SEC, take the following 13 actions to improve 

controls over financial statement preparation and reporting. The first 11 

recommendations concern the minimum elements that should be included in policies 

and procedures covering the financial reporting process. The other 2 

recommendations concern the leveraging of in-house resources for accounting advice 

and upgrading SEC’s capacity to improve its financial reporting system.

1. Develop written policies and procedures that provide sufficient guidance for 

the year-end closing of the general ledger as well as the preparation and 

analysis of quarterly and annual financial statements. 

2. Establish clearly defined roles and responsibilities for the staff involved in 

financial reporting and the preparation of interim and year-end financial 

statements. 

3. Prepare a cross-walk between the financial statements and the source 

systems, general ledger accounts, and the various account queries and 

analyses that make up key balances in the financial statements. 

4. Maintain subsidiary records or ledgers for all significant accounts and 

disclosures so that the amounts presented in the financial statements and 

footnotes can be supported by the collective transactions making up the 

balances. 

5. Perform monthly reconciliations of subsidiary records and summary account 

balances. 
Page 7 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

6. Consider a “formal closing” of all accounts at an interim date(s), which will 

reduce the level of accounting activity and analysis required at year-end. The 

formal closing entails ensuring that all transactions are recorded in the proper 

period through month’s end. 

7. Collect common closing and adjusting entries in a formal listing, which is used 

in the general ledger closing process and in preparing financial statements. 

8. Require supervisory review for all entries posted to the general ledger and 

financial statements, including closing entries. A supervisor should review 

revisions to previously approved entries and revised financial statements and 

footnotes. All entries and reviews should be documented. 

9. Establish milestones for preparing and reviewing the financial statements by 

setting dates for critical phases such as closing the general ledger; preparing 

financial statements, footnotes, and the performance and accountability 

report; and performing specific quality control review procedures. 

10. Utilize established tools (i.e., checklists and implementation guides) available 

for assistance in compiling and reviewing financial statements. 

11. Maintain documentation supporting all information included in the financial 

statements and footnotes. This documentation should be more selfexplanatory than what has been retained in the past. The documentation 

should be at a level of detail to enable a third party, such as an auditor, to use 

the documentation for substantiating reported data without extensive 

explanation or re-creation by the original preparer. 

12. Take advantage of in-house resources and expertise in establishing financial 

reporting policies, internal controls, and business practices, as well as in the 

review of financial statement and footnote presentation. 

13. Develop or acquire an integrated financial management system to provide 

timely and accurate recording of financial data for financial reporting and 

management decision making. 

Agency Comments 

In commenting on a draft of this report, SEC acknowledged the material weaknesses 

in internal control. SEC stated that our recommendations for resolving the material 

weakness related to disgorgements and penalties were consistent with the actions 

that it has planned, including completing a comprehensive review of files and data 

and strengthening and documenting policies and procedures for disgorgements and 

penalties. SEC anticipates that this weakness will be resolved in fiscal year 2006. 

Ultimately, SEC said it plans to undertake a multiyear project to replace the current 

case-tracking system with a system that is integrated with the accounting system in 
Page 8 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

order to improve the timeliness and better ensure the accuracy of SEC’s financial 

reporting for disgorgements and penalties. 

With regard to the material weakness related to controls over the preparation of 

financial statements, SEC stated that it intends to continue active and serious efforts 

to complete documentation of the procedures and management systems that were 

used to prepare its financial statements. To address this issue, SEC has increased its 

financial reporting staff; SEC financial management staff will continue to solicit 

advice from in-house experts; and management has confirmed, modified, or 

recommended for further review certain policies applied in preparing the fiscal year 

2004 financial statements. SEC also plans to establish a formal senior management 

committee to provide for continued regular review and advice by key officials. 

The complete text of SEC’s comments is included in enclosure I. 

- - - - - 

This report contains recommendations to you. The head of a federal agency is 

required by 31 U.S.C. § 720 to submit a written statement to the Senate Committee on 

Homeland Security and Governmental Affairs and the House Committee on 

Government Reform of the actions taken on our recommendations no later than 60 

days after the date of this report. A written statement also must be sent to the House 

and Senate Committees on Appropriations with agency’s first request for 

appropriations made more than 60 days after the date of this report. 

This report is intended for use by management of SEC. We are sending copies of this 

report to the Chairmen and Ranking Members of the Senate Committee on Banking, 

Housing, and Urban Affairs; the Senate Committee on Homeland Security and 

Governmental Affairs; the House Committee on Financial Services; and the House 

Committee on Government Reform. We are also sending copies to the Secretary of 

the Treasury, the Director of the Office of Management and Budget, and other 

interested parties. In addition, this report will be available at no charge on GAO’s 

Web site at http://www.gao.gov. 

We acknowledge and appreciate the cooperation and assistance provided by SEC 

management and staff during our audit of SEC’s fiscal year 2004 financial statements. 

If you have any questions about this report or need assistance in addressing these 
Page 9 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

issues, please contact me at (202) 512-9471 or at franzelj@gao.gov. Contact points for 

our Offices of Congressional Relations and Public Affairs may be found on the last 

page of this report. 

Sincerely yours, 

Jeanette M. Franzel 

Director 

Financial Management and Assurance 

Enclosures - 2
Enclosure I 

Page 10 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

Comments from the Securities and Exchange Commission
Enclosure I 

Page 11 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues
Enclosure II 

Page 12 GAO-05-691R SEC’s FY 2004 Material Internal Control Issues

Details on Audit Scope and Methodology

To fulfill our responsibilities as auditor of the financial statements of the Securities 

and Exchange Commission (SEC), we did the following: 

• examined, on a test basis, evidence supporting the amounts and disclosure in 

the financial statements; 

• assessed the accounting principles used and significant estimates made by 

management; 

• evaluated the overall presentation of the financial statements; 

• obtained an understanding of internal controls related to financial reporting and 

compliance with laws and regulations; 

• obtained an understanding of the recording, processing, and summarizing of 

performance measures as reported in Management’s Discussion and Analysis; 

• tested relevant internal controls over financial reporting and compliance, and 

evaluated the design and operating effectiveness of internal control; 

• considered SEC’s process for evaluating and reporting on internal control and 

financial management systems under the Federal Managers’ Financial Integrity 

Act of 1982; and 

• tested compliance with selected provisions of the following laws and 

regulations: the Securities Exchange Act of 1934, as amended; the Securities 

Act of 1933, as amended; the Anti-Deficiency Act; laws governing the pay and 

allowance system for SEC employees; and the Prompt Payment Act. 

We performed our review from February 2004 through February 2005 in accordance 

with generally accepted government auditing standards. For a further explanation of 

our audit scope and methodology, see our financial audit report (GAO-05-244). 

(194497) 
The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.