Securities and Exchange Commission: Opportunities Exist to Improve Oversight of Self-Regulatory Organizations
Published: 2007-11-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Self-regulatory organizations (SRO) are exchanges and associations that operate and govern the markets, and that are subject to oversight by the Securities and Exchange Commission (SEC). Among other things, SROs monitor the markets, investigate and discipline members involved in improper trading, and make referrals to SEC regarding suspicious trades by nonmembers. For industry self-regulation to function effectively, SEC must ensure that SROs are fulfilling their regulatory responsibilities. This report (1) discusses the structure of SEC's inspection program for SROs, (2) evaluates certain aspects of SEC's inspection program, and (3) describes the SRO referral process and evaluates SEC's information system for receiving SRO referrals. To address these objectives, GAO reviewed SEC inspection workpapers, analyzed SEC data on SRO referrals and related investigations, and interviewed SEC and SRO officials.
section_title: What GAO Found
paragraphs: To help ensure that SROs are fulfilling their regulatory responsibilities, SEC's Office of Compliance Inspections and Examinations (OCIE) conducts routine and special inspections of SRO regulatory programs. OCIE conducts routine inspections of key programs every 1 to 4 years, inspecting larger SROs more frequently, and conducts special inspections (which arise from tips or the need to follow up on prior recommendations or enforcement actions) as warranted. More specifically, OCIE's inspections of SRO surveillance, investigative, and disciplinary programs (enforcement programs) involve evaluating the parameters of surveillance systems, reviewing the adequacy of policies and procedures for handling the resulting alerts and investigations, and reviewing case files to determine whether SRO staff are complying with its policies and procedures. GAO identified several opportunities for SEC to enhance its oversight of SROs through its inspection program. First, although examiners have developed processes for inspecting SRO enforcement programs, OCIE has not documented these processes or established written policies relating to internal controls over these processes, such as supervisory review or standards for data collection. Such documentation could strengthen OCIE's ability to provide reasonable assurances that its inspection processes and products are subject to key quality controls. Second, OCIE officials said that they focus inspections of SRO enforcement programs on areas judged to be high risk. However, this risk-assessment process does not leverage the reviews that SRO internal and external auditors performed, which could result in duplication of SRO efforts or missed opportunities to direct examination resources to other higher-risk or less-examined programs. OCIE officials told us that they plan to begin assessing SRO internal audit functions in 2008, including the quality of their work products, which would allow OCIE to assess the usefulness of these products for targeting its inspections. Finally, OCIE currently does not formally track the implementation status of SRO inspection recommendations; rather, management consults with staff to obtain such information as needed. Without formal tracking, OCIE's ability to efficiently and effectively generate and evaluate trend information, such as patterns in the types of deficiencies found or the implementation status of recommendations across SROs, or over time, may be limited. SEC's Division of Enforcement uses an electronic system to receive referrals of potential violations from SROs. These referrals undergo multiple stages of review and may lead Enforcement to open an investigation. From fiscal years 2003 to 2006, SEC received an increasing number of advisories and referrals from SROs, many of which involved insider trading. However, SEC's referral receipt and case tracking systems do not allow Enforcement staff to electronically search all advisory and referral information, which may limit SEC's ability to monitor unusual market activity, make decisions about opening investigations, and allow management to assess case activities, among other things.

section_title: Letter
paragraphs: Self-regulatory organizations (SRO) include, among others, national  securities exchanges and securities associations registered with the  Securities and Exchange Commission (SEC), such as the New York Stock  Exchange (NYSE) and the Financial Industry Regulatory Authority  (FINRA). At the time that the system of self-regulation was created,  Congress, regulators, and market participants recognized that this  structure possessed inherent conflicts of interest because of the dual role  of SROs as both market operators and regulators. Nevertheless, Congress  adopted self-regulation, as opposed to direct federal regulation of the  securities markets, to prevent excessive government involvement in  market operations, which could hinder competition and market innovation.  Also, Congress concluded that self-regulation with federal oversight would  be more efficient and less costly to taxpayers.
For industry self-regulation to function effectively, SEC must ensure that  SROs are fulfilling their regulatory responsibilities. As regulators, SROs are  primarily responsible for establishing the standards under which their  members conduct business; monitoring the way that business is conducted;  bringing disciplinary actions against their members for violating applicable  federal statutes, SEC’s rules, and their own rules; and referring potential  violations of nonmembers to SEC’s Division of Enforcement  (Enforcement). SEC oversees SROs through such actions as reviewing  their rule proposals and information technology (IT) security through its  Division of Market Regulation (Market Regulation), and periodically  inspecting their operations through its Office of Compliance Inspections and  Examinations (OCIE). OCIE inspections are intended to assess the  effectiveness of SRO operations and often make recommendations  intended to improve them. If OCIE finds that an SRO has failed to comply  with, or enforce member compliance with, SRO rules or federal securities  laws, it may refer the SRO to Enforcement for further investigation and  potential sanctions. More recently, recognizing the role of internal controls  in promoting compliance and effectiveness within SROs, OCIE has begun  focusing increased attention on the activity and work products of the  internal audit function at SROs.
This report addresses your interest in the actions taken by SEC to ensure  that SROs—in particular, the two largest SROs, NASD (the SRO that  provided market oversight of the NASDAQ Stock Market and certain other  exchanges prior to FINRA) and NYSE—are fulfilling their regulatory  responsibilities by effectively monitoring and investigating suspicious  trading in listed securities and, where appropriate, prosecuting misconduct  involving member broker-dealers or referring potential misconduct by non- SRO members to SEC. It also addresses your interest in SEC’s processes  for managing and acting upon referrals received by Enforcement from  SROs. Specifically, this report  1. discusses the overall structure of SEC’s inspection program and, more  specifically, its approach to inspections of SRO surveillance,  investigative, and disciplinary programs (enforcement programs); 2. evaluates certain aspects of SEC’s inspection program, including  guidance and planning, the use of SRO internal audit products, and the  tracking of inspection recommendations; and  3. describes the SRO referral process to SEC’s Enforcement Division and  recent trends in referral numbers and related SEC investigations, and  evaluates SEC’s information system for advisories and referrals.
To address our first objective, we reviewed and analyzed OCIE  documentation of the 11 inspections completed between March 2002 and  January 2007 of NASD and NYSE enforcement programs, an OCIE  memorandum to the Commission describing the SRO inspection process,  and our prior work. Furthermore, we observed a demonstration of various  IT systems that NASD used to monitor the markets and track investigations  and disciplinary actions. We also conducted interviews with staff from  OCIE, NASD, and NYSE. To address our second objective, we reviewed  OCIE inspection guidance related to the review of SRO internal audit  reports, guidance for bank examiners from the Board of Governors of the  Federal Reserve System (Federal Reserve) and the Office of the  Comptroller of the Currency (OCC), inspection guidelines developed by the  Inspectors General (IG), and our prior work. In addition, we reviewed SRO  internal and external audits of IT security and interviewed staff from OCIE,  Market Regulation, NASD, and NYSE. Furthermore, we reviewed internal  control standards for the federal government and conducted interviews  with OCIE and Enforcement officials on their respective procedures for  ensuring that SROs implement inspection recommendations and remedial  actions required as part of enforcement actions. In addition, we reviewed  and summarized the enforcement actions brought by SEC against SROs  between 1995 and 2007. To address our third objective, we observed a  demonstration from Enforcement staff on the division’s system for  receiving SRO referrals, and we interviewed Enforcement, NASD, and  NYSE staff to determine how SEC manages SRO referrals and conducts  investigations. To understand trends in SRO referrals and SEC  investigations related to these referrals, we requested and analyzed data  from SEC’s referral receipt system and case tracking system from fiscal  years 2003 through 2006. We inquired about checks that SEC performs on  these data and determined they were reliable for our purposes.
We performed our work in Washington, D.C.; New York, New York; and  Rockville, Maryland, between September 2006 and September 2007 in  accordance with generally accepted government auditing standards.  Appendix I provides a more detailed description of our scope and  methodology.
subsections: section_title: Background
paragraphs: SROs are responsible for the surveillance of the trading activity on their  markets. Market transactions take place on electronic or floor-based  platforms. SROs employ electronic surveillance systems to monitor market  participants’ compliance with SRO rules and federal securities laws.  Electronic surveillance systems are programmed to review trading and  other data for aberrational trading patterns or scenarios within defined  parameters. Also, SROs review trading as a result of complaints from the  public, members, and member firms and as a result of required  notifications, such as those concerning offerings. One of the key  surveillance systems employed by SROs monitors the markets for insider  trading. We discuss SRO surveillance systems and investigatory procedures  related to insider trading in more detail in appendix II.
SRO staff review alerts generated by the electronic surveillance systems to  identify those that warrant further investigation. When SROs find evidence  of potential violations of securities laws or SRO rules involving their  members, they can conduct disciplinary hearings and impose penalties.
These penalties can range from disciplinary letters to the imposition of  monetary fines to expulsion from trading and SRO membership. SROs do  not have jurisdiction over entities and individuals that are not part of their  membership, and, as such, any suspected violations on the part of  nonmembers are referred directly to Enforcement. SROs maintain records  of their investigations and the resulting disciplinary actions as part of their  internal case tracking systems. In addition, as part of their market  surveillance efforts, SROs, such as NASD and NYSE, maintain databases  with information on individuals and firms associated with suspicious  trading activity, such as insider trading. NASD also maintains the Central  Registration Depository, the securities industry online registration and  licensing database. This database makes complaint and disciplinary  information about registered brokers and securities firms available to the  public and, in more detailed form, to SEC, other securities regulators, and  law enforcement authorities.
OCIE administers SEC’s nationwide examination and inspection program.  Within OCIE, the Office of Market Oversight primarily focuses on issues  related to securities trading activities, with the objective of evaluating  whether SRO enforcement programs and procedures are adequate for  providing surveillance of the markets, investigating potential violations,  and disciplining violators under SRO jurisdiction. OCIE also inspects other  SRO regulatory programs, which include, among others, arbitration,  listings, sales practice, and financial and operational programs. As part of  the latter, OCIE coordinates the compliance inspections of NASD’s   district offices, which are responsible for examining broker-dealer  members for compliance with SRO rules and federal securities laws.
In cases where OCIE discovers potentially egregious violations of federal  securities laws or SRO rules during an SRO inspection, it may refer the case  to Enforcement, which is responsible for further investigating these  potential violations; recommending Commission action when appropriate,  either in a federal court or before an administrative law judge (ALJ); and  negotiating settlements.
SEC’s Market Regulation administers and executes the agency’s programs  relating to the structure and operation of the securities markets, which  include regulation of SROs and review of their proposed rule changes. SEC  has delegated authority to Market Regulation for other aspects of SRO  rulemaking as well, including the authority to publish notices of proposed  rule changes and to approve proposed rule changes.
section_title: OCIE Approach to SRO Inspections Focuses on Determining Whether SROs Identify Violations and Enforce and Comply with SRO Rules Effectively
paragraphs: OCIE conducts both routine and special inspections of SRO regulatory  programs as part of its oversight efforts. We found that the SRO inspection  process generally includes a planning phase, an on-site review of SRO  programs, and a written report to the SRO documenting inspection findings  and recommendations that is reviewed and approved by the Commission.  OCIE typically staffs inspections with a lead attorney and from 2 to 6 other  staff, who also work concurrently on at least 1 other SRO inspection. The  number of staff dedicated to SRO inspections has fluctuated in recent  years, but as of September 2007 totaled 46. According to OCIE officials,  inspections of SRO enforcement programs are intended to assess the  design and operation of SRO enforcement programs to determine if they  effectively fulfill SRO regulatory responsibilities. As part of these  inspections, OCIE takes steps to assess SRO surveillance systems, reviews  SRO policies and procedures for investigating potential violations and  disciplining violators of rules and laws, and reviews samples of SRO case  files to determine whether SRO staff were complying with the policies and  procedures.
subsections: section_title: Overall Structure of OCIE Program Encompasses Routine Inspections of Key Regulatory Programs at SROs as Well as Special Inspections
paragraphs: As part of its SRO oversight responsibilities, OCIE conducts both routine  and special inspections of SRO regulatory programs. At regular intervals,  OCIE conducts routine inspections of key regulatory programs, such as  SRO enforcement, arbitration, examination, and listings programs. The  inspection cycles are based on the size of the SRO market and the type of  regulatory program, with key programs of larger SROs, such as NYSE and  NASD, being inspected from every 1 to 2 years, and smaller regional SROs  from every 3 to 4 years. Inspection of enforcement programs typically  include a review of SRO surveillance programs for identifying potential  violations of trading rules or laws, investigating those potential violations,  and disciplining those who violate the rule or law. While sometimes OCIE  conducts a comprehensive review of these programs, especially at the  smaller SROs, often these inspections focus on a specific aspect of the  programs, such as fixed income. We discuss OCIE’s process for targeting  their routine inspections later in this report. OCIE also conducts special  inspections of SRO regulatory programs, as warranted. Special inspections  typically originate from a tip or need to follow up on past inspection  findings and recommendations. Special inspections also can include sweep  inspections, where OCIE probes specific activities of all SROs or a sample  of them to identify emerging compliance issues. According to OCIE  officials, some aspect of every SRO is generally examined every year  through a routine examination of a specific regulatory program or through  a special inspection.
OCIE’s inspection process for SROs generally includes a planning phase, an  on-site review and analysis, and a final inspection report to the SRO (see  fig. 1). During inspection planning, OCIE identifies the SRO program to be  inspected and assigns staff who conduct initial research on the program,  prepare materials for each individual inspection on the basis of the  inspection’s focus, and draft a planning memorandum. In preparation for  the on-site inspection, OCIE typically sends an initial document request to  the SRO, asking for general program information such as organizational  charts and copies of SRO policies and procedures or, if OCIE is reviewing a  surveillance program, logs of alerts and the resulting investigations. We  discuss OCIE’s review of enforcement programs in more detail later in this  section. After reviewing the documents provided, staff plan the on-site  phase of the inspection, which can include additional requests for specific  documents, such as case files, to be made available for review while on- site. OCIE staff typically spends 1 week on-site interviewing SRO staff and  reviewing SRO case files and other documentation. After the on-site visit,  OCIE staff continue their analysis in the home office; conduct follow-up  interviews or request additional documentation, as needed; and begin  drafting the inspection report. Staff present their initial inspection findings  and recommendations to the SRO in an exit interview and incorporate  initial SRO responses into the draft inspection report. Once the report is  drafted, staff then circulate it to other interested SEC divisions and  offices—such as the Office of General Counsel, Market Regulation, or  Enforcement—for their review and comment, and then submit the report  to the Commission for review. Following Commission consideration and  authorization, staff issue a nonpublic report to the SRO and request that the  SRO respond in writing within a specified time frame, typically 30 days.
According to OCIE officials, they staff SRO inspections with a lead attorney  and from 2 to 6 other staff reporting to an OCIE branch chief. These  individuals are typically staffed concurrently on at least 1 other SRO  inspection. As shown in table 1, as of September 2007, the SRO inspection  group consisted of 46 staff, including 14 managers, 29 examiners, and   3 other support staff. Of the 32 examiners and support staff, 16 are  dedicated to market oversight inspections.
Table 1 shows that between fiscal years 2002 and 2005, SRO inspection  staffing increased from 36 to 62, or 72 percent. OCIE staff said that this  increase was largely due to the increase in funding SEC received as a result  of the Sarbanes-Oxley Act of 2002. Since then, SRO inspection staffing has  declined from 62 to 46, or 26 percent, which OCIE officials attributed to  staff attrition and the inability of OCIE to hire replacements during a SEC- wide hiring freeze that occurred from May 2005 to October 2006. OCIE  officials stated that despite the decrease in staff numbers, they have  continued to conduct routine inspections on schedule, although the  inspections may last longer than usual. Also, they said that they have not  been able to do as many special inspections as they otherwise would have  conducted. OCIE officials told us that the SRO inspection group recently  received 6 additional professional staff positions, which it is now in the  process of filling.
section_title: OCIE Assesses Design and Operation of SRO Enforcement Programs to Determine Whether SROs Effectively Fulfill Their Regulatory Responsibilities
paragraphs: According to OCIE officials, inspections of SRO enforcement programs are  intended to assess the design and operation of SRO enforcement programs  to determine whether they effectively identify violations, enforce  compliance among members, and follow their own procedures. More  specifically, OCIE officials said that when inspecting SRO surveillance  programs, their objectives are to determine whether (1) the parameters of  SRO electronic surveillance systems are appropriately designed to generate  exceptions that identify potential instances of noncompliance with SRO  rules and federal securities laws and (2) the systems are effectively  detecting such activity. When reviewing SRO surveillance systems, OCIE  begins by asking the SRO for copies of the exchange rules that it is required  to enforce, a description of the coding behind the surveillance systems  designed to monitor the markets for compliance with these rules, and logs  of the alerts that these systems generated. OCIE staff then review this  information to determine whether the system is appropriately designed to  identify noncompliance and whether it is functioning as designed. For  example, as part of one inspection, OCIE staff found that the parameters of  a specific surveillance system were too restrictive, after observing that the  system did not generate any alerts over the inspection period. Conversely,  OCIE staff said that if in reviewing a surveillance system, the inspection  team saw that the system generated 10,000 alerts every quarter, they would  follow up with the SRO to determine whether the indications of numerous  rule violations were plausible or whether the parameters of the system  were set appropriately. Either way, they said that the inspection team  would dedicate resources to looking at that system.
Similarly, when evaluating SRO programs for investigating potential  violations of SRO rules or federal securities laws and disciplining broker- dealer members, OCIE officials stated that their objective is to determine  whether (1) SRO policies and procedures are appropriately designed to  uncover violations of SRO rules and federal securities laws and to  administer the appropriate disciplinary measures and (2) the SRO is  complying with these policies and procedures. OCIE staff first request  copies of the relevant policies and procedures for investigating surveillance  alerts and for disciplining members found to be in violation of SRO rules  and federal securities laws. They also ask for lists of the resulting  investigations and enforcement actions, including referrals on  nonmembers to SEC. OCIE staff then analyze this information to assess the  extent to which SRO policies and procedures direct the SRO staff to  conduct thorough reviews and investigations and, when applicable, to take  appropriate disciplinary action. For example, during a recently completed  sweep inspection of SRO surveillance and investigative programs related to  insider trading, OCIE evaluated related SRO policies and procedures for  reviewing alerts and opening investigations to determine whether they  directed staff to coordinate appropriately with other SROs. We discuss the  results of this sweep inspection—including a plan that the options SROs  submitted to SEC to create a more uniform and coordinated method for the  regulation, surveillance, investigation, and detection of insider trading—in  appendix II. As part of another inspection we reviewed, OCIE found that an  SRO had not yet developed formal procedures for its analysts to review  alerts that were generated by a recently implemented surveillance system.  OCIE recommended that the SRO develop such procedures.
When reviewing SRO enforcement programs, OCIE also assesses whether  the SRO is in compliance with its own policies and procedures. To  accomplish this objective, OCIE staff select and review case files  pertaining to a sample of alerts, investigations, and disciplinary files from  the lists that they have asked the SRO to generate. OCIE staff said when  reviewing these files, they pay particular attention to the strength of the  evidence upon which the SRO analyst relied in determining whether to  close an alert or an investigation or to refer the case to SRO enforcement,  SEC, or other appropriate regulators. In this way, OCIE staff said they can  evaluate whether the SRO is enforcing its rules and federal securities laws  consistently among its members and, in the case of certain federal laws  such as those prohibiting insider-trading, between members and  nonmembers. For example, in one inspection we reviewed, OCIE found  that the SRO used its informal disciplinary measures inappropriately when  disciplining its members, and recommended that formal disciplinary  actions be taken when informal actions had already occurred.
OCIE inspections may result in recommendations to SROs that are  intended to address any deficiencies identified and to improve SRO  effectiveness. OCIE officials said that for SRO enforcement programs, they  tend to make recommendations flexible enough to allow SROs to  implement them in a manner that best fits their unique business models and  surveillance systems. As we have previously discussed, if OCIE finds  serious deficiencies at an SRO, it can refer the case to Enforcement. Such  referrals are relatively infrequent—between January 1995 and September  2007, SEC brought and settled 10 enforcement actions against SROs (see  app. III). According to OCIE officials, recommendation follow-up is  primarily the responsibility of the examination team, under the supervision  of the assistant director assigned to the inspection. Inspection follow-up  begins with evaluating written responses by SROs to the inspection report  and obtaining documentation of SRO efforts to address the  recommendations, and can continue for several years, depending on the  complexity of the recommendation. For example, OCIE officials said that  some recommendations, such as those that involve the design and  implementation of new information technology, may require continued  dialogue with the SRO over several years before the recommendation is  fully implemented. OCIE also may follow up on inspection  recommendations during a subsequent inspection of the SRO. OCIE  officials said that in the event the SRO does not take steps to address a  recommendation that staff believe is critical, they can elevate the matter to  OCIE management or the Commission, although they said that this  happens infrequently. We discuss the tracking of inspection  recommendations later in this report.
section_title: Written Inspection Guidance, Increased Leveraging of SRO Internal Audit Products, and IT Improvements Could Enhance SEC Oversight of SROs
paragraphs: We identified several opportunities for OCIE and Market Regulation to  enhance their oversight of SROs by developing formal guidance, leveraging  the work of SRO internal audit functions, and enhancing information  systems. First, although OCIE has developed a general process for  inspecting SRO enforcement programs, it has not developed an  examination manual or other formal guidance for examiners to use when  conducting inspections, as it has for examinations of other market  participants. Such guidance could help OCIE ensure that its inspection  procedures and products are subject to uniform standards and quality  controls. Second, OCIE has recently expanded the use of the SRO internal  and external audit reports while on-site at the SRO; however, OCIE does  not leverage this work in the planning process, which could result in  duplication of effort and missed opportunities to better target inspection  resources. Third, in accordance with SEC policy, Market Regulation  regularly inspects SRO IT systems related to market operations for  adequate security controls and reviews related to SRO internal audit  reports. However, this review does not target SRO enforcement-related  databases, which contain investigative and disciplinary information that  SROs maintain and upon which other regulators rely. Finally, OCIE  currently does not formally track the implementation status of inspection  recommendations, which ranged as high as 29 in the inspections that we  reviewed. The lack of formal tracking may reduce OCIE’s ability to  efficiently and effectively generate and evaluate trend information, such as  patterns in the types of deficiencies found or the implementation status of  recommendations across SROs, or over time.
subsections: section_title: Lack of Formal Guidance for Inspections of SRO Enforcement Programs Could Limit OCIE’s Ability to Ensure Staff Compliance with Internal Controls
paragraphs: Our interviews with OCIE officials and reviews of selected inspection  workpapers indicated that OCIE examiners typically follow a general  process when conducting reviews of SRO enforcement programs. This  process begins with examination planning, is followed by data gathering,  and ends with reporting. However, OCIE has not developed an examination  manual or other formal guidance for its examiners to use when conducting  inspections of SRO enforcement programs. According to OCIE officials,  because SRO rules and corresponding surveillance systems are unique and  constantly evolving, it would be difficult to develop a detailed inspection  manual that could be tailored to all SROs and also remain current. These  officials said that an examination manual is not necessary to ensure  consistency among SRO inspections because the SRO inspection group is a  relatively small group within OCIE, and all of the staff are centralized in  headquarters. On the other hand, they said that because OCIE’s inspection  program for investment companies, investment advisers, and broker- dealers has hundreds of examiners across SEC headquarters and its  regional offices who are responsible for examining thousands of firms,  OCIE has developed detailed inspection manuals to ensure consistency  across examinations of these firms. Similarly, OCIE officials said that they  have developed guidelines for SRO examiners conducting oversight  inspections of NASD’s district offices because OCIE relies on examination  staff in the SEC regional offices to assist them in conducting these  inspections.
In contrast to OCIE, federal banking regulators, such as the Federal  Reserve and OCC, have developed written guidance for the examination of  large banks—also highly complex and diverse institutions—that outlines  the objectives of the program and describes the processes and functional  approaches used to meet those objectives. By not establishing written  guidance for conducting inspections of SRO enforcement and other  regulatory programs, OCIE may be limiting its ability to ensure that its  inspection processes and products are subject to basic quality controls in  such areas as examination planning, data collection, and report review. For  example, in several of the inspections we reviewed, we did not find  evidence of supervisory review, which is a key aspect of inspection quality  control. According to OCIE officials, the team leader is expected to review  the work of team members. However, without written policies and  procedures specifying how and when this review is to be conducted and  documented, it is difficult to establish whether the team leaders comply  with this quality control. According to inspection standards developed by  the IG community, each organization that conducts inspections should  develop and implement written policies and procedures for internal  controls over its inspection processes to provide reasonable assurance  over conformance with organizational policies and procedures. As another  example, when conducting inspections of SRO enforcement programs,  OCIE officials said that team leaders often require their teams to use data  collection instruments, such as checklists, when reviewing SRO files to  ensure a consistent and complete review of all of the files selected,  particularly when there are inexperienced staff on the team. While  potentially an effective means of collecting data, according to OCIE  officials, the decision to use these tools is up to the individual team leader,  and not all teams employ them. According to IG inspection standards,  evidence developed under an effective system of internal controls generally  is more reliable than evidence obtained where such controls are lacking.  By not establishing standards addressing quality controls in data collection,  OCIE’s ability to ensure the consistency and reliability of data collected  across its SRO inspection teams may be limited. Furthermore, without  written guidelines, new examiners lack a reference tool that could facilitate  their orientation in the inspection program.
section_title: OCIE’s Limited Use of SRO Internal Audit Reports in Inspection Planning May Diminish Opportunities to Better Target Inspection Resources
paragraphs: While OCIE employs a risk-based approach to conducting SRO inspections,  OCIE’s risk-assessment and inspection planning processes do not  incorporate information gathered through SRO internal audits. According  to OCIE officials, OCIE tailors inspections of SRO programs (particularly at  the two largest SROs) to focus on those areas judged to pose the greatest  risk to the SRO or the general market. In determining which areas present  the highest risk, OCIE officials said they consider such factors as the  amount of time that has passed since a particular area was last inspected,  the size of the area, the results of past inspections, and consultations with  other SEC offices and divisions. For example, because the enforcement  programs at NASD and NYSE encompass hundreds of surveillance  systems, OCIE officials said examiners cannot review all systems as part of  one inspection. As a result, OCIE officials said examiners first conduct a  preliminary analysis of requested documents and focus inspection  resources on those systems or areas that are judged to pose the greatest  risk. According to OCIE officials, because the regional SROs have smaller  programs, OCIE staff typically are able to conduct a more comprehensive  review of the entire enforcement program during a single inspection.
We previously recommended that OCIE develop and implement a policy  requiring examiners to routinely use SRO internal review reports in  planning and conducting SRO inspections. Prior to October 2006, OCIE’s  practice was to request SRO internal audit reports only when OCIE  believed specific problems existed at an SRO. In October 2006, OCIE issued  a memorandum broadening the circumstances in which OCIE would  request and use these reports. The memorandum directs examiners to  request that SROs make all internal audit reports related to the program  area under inspection available for the staff’s on-site review, including  workpapers or any reviews conducted by any regulatory quality review unit  of the SRO or an outside auditor. According to the memorandum, on-site  review of these reports may be useful in determining whether the SRO has  identified particular areas of concern in a program area and adequately  addressed those problems, assessing whether an SRO addressed prior  inspection findings and recommendations, and helping staff determine  whether they should limit or expand their review of particular issues during  an inspection.
OCIE staff said that in fiscal year 2008, they also plan to begin reviewing  the internal audit functions of SROs, with the goal of determining whether  SRO internal audit functions are effective. For example, OCIE officials said  that they plan to evaluate whether the internal audit functions are  independent of SRO management, conduct thorough reviews of all relevant  areas (particularly, regulatory programs), and have sufficient staffing  levels. OCIE officials said that as part of their reviews, they also plan to  assess the quality and reliability of SRO internal audit reports and assess  whether SROs have implemented the recommendations resulting from  these reports. OCIE officials told us that they are in the planning phase of  this review, and, as such, they have not yet developed written guidance for  their examiners in conducting these reviews.
While OCIE’s October 2006 memorandum broadened the use of SRO  internal audit reports to encompass on-site reviews during inspections, it  did not address the use of internal audit reports for planning purposes, as  we had recommended. In contrast, the risk assessments of large banks that  federal bank examiners conduct during the planning phase are based, in  part, on internal audit reports, and examiners may adjust their examination  plans to avoid duplication of effort and minimize burden to the bank. For  example, according to examination guidance that the Federal Reserve  issued, to avoid duplication of effort and burden to the institution,  examiners may consider using these workpapers and conclusions to the  extent that examiners test the work performed by the internal or external  auditors and determine it is reliable. Similarly, examination guidance  issued by OCC states that examiners’ assessments of a bank’s audit and  control functions help leverage OCC resources, establish the scope of  current and future supervisory activities, and assess the quality of risk  management.
By not considering the work and work products of SRO internal audit  functions in its inspection planning process, OCIE examiners may be  duplicating SRO efforts, causing regulatory burden, or missing  opportunities to direct examination resources to other higher-risk or less- examined program areas. For example, our previous work, which focused  on the listing programs of SROs, showed that SRO internal audit functions  had examined or were in the process of examining aspects of their listing  programs that OCIE had covered in its most recent inspections, and that  resulting reports could be useful to OCIE in planning as well as conducting  inspections. As OCIE begins to assess the quality of SRO internal audit  functions and work products, the opportunity exists for OCIE to further  leverage these products in targeting its own inspection efforts. OCIE  officials said that as part of their upcoming reviews of SRO internal audit  functions, they will assess whether SRO internal audit products may be  helpful in assisting them in targeting inspections of particular SRO  functions.
OCIE could also further leverage the work performed by SRO internal and  external auditors to monitor a particular regulatory program between  inspections. In our review of OCIE inspections of NASD and NYSE  enforcement programs, as many as 8 years passed between inspections of a  particular surveillance system and related investigations and disciplinary  actions. Moreover, as OCIE officials noted, the recent decline in SRO  inspection staff has lengthened the time it takes to complete a routine SRO  inspection and limited their ability to conduct additional special  inspections. Unless OCIE regularly informed itself of the results of SRO  efforts to review these systems, it may not know of emerging or resurgent  issues until the next inspection.
section_title: SEC Does Not Obtain Information on the Security of SRO Enforcement- Related Systems and Databases
paragraphs: As we have previously discussed, SROs conduct surveillance of trading  activity on their markets; carry out investigations; and bring disciplinary  proceedings involving their own members or, when appropriate, make  referrals to SEC when the suspicious activity involves nonmembers.  However, SEC’s Market Regulation does not obtain information on the  security of SRO enforcement-related databases—IT applications for storing  data about SRO investigations and disciplinary actions taken against SRO  members—when conducting reviews of IT security at SROs. Under SEC’s  Automation Review Policy (ARP), Market Regulation conducts on-site  reviews of SRO trading systems, information dissemination systems,  clearance and settlement systems, and electronic communications  networks and makes recommendations for improvements when  necessary. Market Regulation also conducts reviews of SRO general and  application controls over the collection of fees under section 31 of the  Securities Exchange Act of 1934. These are IT systems designated for  remitting fees to SEC as part of the section 31 program, which ensures that  the data produced by these systems are authorized, and completely and  accurately processed and reported.
Market Regulation officials said that they do not target enforcement-related  databases for specific review, since the ARP policy statement is specifically  intended to oversee systems essential to market operations. These officials  said that Market Regulation could include a review of the security of  enforcement-related databases both in their general assessments of SRO IT  infrastructure security within the ARP and in section 31 reviews. They  explained that both of these reviews include testing of components and  evaluations of general access controls and changes made within SRO  organizationwide network structures in their routine reviews of specific IT  programs and systems, such as SRO computer operations, security  assessments, internal and external audit IT coverage, and systems outage  notification procedures and systems change notifications. However, these  general assessments by Market Regulation would not necessarily provide  SEC with information on potential risks specific to the security of the data  contained in enforcement-related databases.
NASD and NYSE officials told us that they conduct their own regular  internal inspections of security of IT systems, which include reviews of  enforcement-related databases. In addition, both SROs contract with  external companies that regularly conduct reviews of the security controls  of their technology systems. We reviewed several of these internal and  external audits, which include reviews of SRO enforcement-related  systems and databases conducted from fiscal years 2002 through 2006.  These reviews generally concluded that NASD and NYSE have adequate  controls in place to protect sensitive enforcement-related data.
The internal and external audit reports of NYSE and NASD that we  reviewed showed that these reports could be a valuable source of  information for Market Regulation on specific risks to enforcement-related  databases. Market Regulation officials said that in conducting ARP-related  inspections, they review SRO internal and external audit reports related to  the infrastructure of SRO IT systems; however, they do not specifically look  for information related to the assessment of security of enforcement- related databases. In addition, SEC staff said that although they generally  receive all the internal and external audit reports done of SRO systems  relating to trading and clearing functions, they may not always receive such  reports relating to other systems, including enforcement-related databases,  from all SROs.
Since SROs, SEC, and other regulators rely on the accuracy and integrity of  the data in SRO enforcement-related databases in fulfilling their own  regulatory responsibilities, protecting this information from unauthorized  access is critical to regulatory efforts. For example, as we discuss later in  this report, SEC uses SRO surveillance data in carrying out its own  enforcement efforts related to securities trading. Furthermore, SROs are  responsible for maintaining complaint and disciplinary data on their  members—information that is essential for identifying recidivists. By not  periodically obtaining information to ensure that the SRO risk-assessment  process and SRO-sponsored audits continue to be included in SRO  assessment cycles and that the audits are comprehensive and complete,  Market Regulation cannot assess whether SROs have taken the appropriate  steps to ensure the security of sensitive enforcement-related information,  or the level of risk that a data breach could pose.
section_title: Lack of Formal Tracking System May Limit OCIE’s Ability to Effectively Assess SRO Implementation of Inspection Recommendations
paragraphs: Although OCIE officials said that they have worked with SROs to address  the intent of recent inspection recommendations, we were not able to  readily verify the status of the recommendations in the inspections we  reviewed because OCIE does not formally track inspection  recommendations or the status of their implementation. OCIE officials said  that when OCIE management is interested in obtaining an update on the  recommendations resulting from an inspection, they consult directly with  the examination team assigned to the SRO inspection. OCIE officials also  said that they do not consider the lack of a formal tracking system to have  affected their ability to manage any follow-up of inspection  recommendations because there are relatively few SROs, and OCIE staff is  in frequent contact with them. OCIE’s informal methods for tracking  inspection recommendations contrast with the expectations set by federal  internal control standards for ensuring that management has relevant,  reliable, and timely information regarding key agency activities. These  standards state that key information on agency operations should be  recorded and communicated to management and others within the entity  and within a time frame that enables management to carry out its internal  control and other responsibilities.
Without a formal tracking system, the ability of OCIE management to  effectively and efficiently monitor the implementation of SRO inspection  recommendations and conduct programwide analyses may be limited. Of  the 11 inspections of NASD and NYSE enforcement programs we reviewed,  the number of recommendations OCIE made ranged from 4 to 29, with an  average of 11. They also ranged in complexity, from asking the SRO to  update its policies and procedures to recommending that an SRO  implement an entire surveillance program. For example, we observed  recommendations calling for, among other things, improving case file  documentation, changing the parameters of a surveillance system,  implementing an automated tracking system, and improving SRO member  education. OCIE officials said that some inspections resulted in as many as  30 or 40 recommendations. Without a formal tracking system, OCIE  management must rely on staff’s availability and ability to recall  recommendation-related information, which may be reliable when  discussing an individual inspection, but may limit OCIE management’s  ability to efficiently generate and evaluate trend information, such as  patterns in the types of deficiencies found or the implementation status of  recommendations across SROs, or over time. Implementing a formal  tracking system would not only allow management to more robustly assess  the recommendations to SROs and their progress in implementing them,  but would allow it to develop performance measures that could assist  management in evaluating the effectiveness of its inspection program.
According to OCIE and SEC’s OIT officials, OCIE recently began working  with OIT to develop a new examination tracking system that will include  the capability to track SRO responses and implementation status of OCIE  recommendations. OCIE officials said that planned requirements for the  system includes a field to enter the recommendation, a field for OCIE  inspectors to broadly categorize the status of its implementation, and a text  box for inspectors to elaborate on the recommendation and its  implementation status. OCIE officials also said that they expect that the  system will be able to trace the history of a recommendation. OIT officials  told us that they are developing separate software that will allow OCIE to  generate management reports using data from the tracking systems as well  as other database; however, the requirements for any management reports  OCIE would receive have yet to be determined. According to an OCIE  official, the recommendation tracking system and reporting capabilities  may be an effective way to provide OCIE management with a high-level  characterization of implementation status. OCIE officials said that in  response to our concerns, they plan to deploy an interim, stand-alone  recommendation tracking system that will provide a management report, in  the form of a spreadsheet, that contains all open recommendations to SROs  resulting from SRO inspections and the current status of SRO efforts to  implement them. These officials said that they expect to use this  spreadsheet until the previously described OIT projects are implemented in  2008.
section_title: SRO Advisories and Referrals Have Increased, as Have Related SEC Investigations and Enforcement Actions, but Information Systems for Advisories and Referrals Have Limitations
paragraphs: Enforcement receives advisories and referrals, which undergo multiple  stages of review and may lead to opening an investigation, through an  electronic system in OMS. After opening investigations, Enforcement  further reviews the evidence gathered to decide whether to pursue civil or  administrative actions, or both. From fiscal years 2003 to 2006, OMS  received an increasing number of advisories and referrals from SROs, such  as NYSE and NASD, most of which involved insider trading. However,  limited search capabilities of the SRO system and the lack of a link between  the SRO and case activity tracking systems have limited Enforcement  staff’s ability to electronically search advisory and referral information,  monitor unusual market activity, make decisions about opening matters  under inquiry (MUI) and investigations, and assess case activities.
subsections: section_title: OMS Uses a Multistep Process to Review SRO Referral Information That Can Lead to Opening Investigations and Subsequent Enforcement Actions
paragraphs: Upon receipt of SRO information in its Web-based SRO Referral Receipt  System (SRO system), OMS makes initial decisions on referrals and  forwards selected referral materials to investigative attorneys. After initial  reviews by OMS staff, Enforcement may decide to open investigations if it  determines evidence garnered during its inquiry period warrants doing so  and staff and financial resources are available. If investigation evidence  merits, staff may pursue administrative or civil actions and seek remedies,  such as cease-and-desist orders and civil monetary penalties.
subsections: section_title: Enforcement Receives Advisories and Referrals from SROs about Unusual Market Activity through a Web-Based System
paragraphs: The referral process begins when OMS staff receive SRO advisories and  referrals on unusual market activity through a secure Web-based electronic  system called the SRO system. SEC officials noted that SRO referrals help  SEC identify and respond to unusual market activity by those who are not  members of SROs, investigate those suspected of potentially illegal  behavior, and take action when the circumstances of cases and evidence  are appropriate. OMS branch chiefs, who are responsible for reviewing  advisories and referrals, access the SRO system on a weekly basis to  review all SRO-submitted advisories and referrals.
SRO advisories and referrals usually consist of a short form with basic  background information on the suspected unusual market activity by SRO  nonmembers that includes the name of the security issuer, date of the  unusual activity, and a description of the market activity identified by the  SRO. The materials also contain a text attachment, which includes more  detailed narrative information, such as a chronology of unusual activity and  specific information about issuers and individuals potentially associated  with that activity. SEC does not receive information electronically or  otherwise on unusual market activity by SRO members or related  investigations by SROs of the unusual member activity.
section_title: OMS Reviews Both Advisories and Referrals, and Forwards Referrals to Enforcement Attorneys for Possible Investigatory Action
paragraphs: After reading advisories and referrals, OMS branch chiefs use SEC’s  National Relationship Search Index, an electronic system that connects to  and works with a range of other SEC systems, such as the Case Activity  Tracking System (CATS), to determine whether existing SEC investigations  involve the issuer noted in the SRO advisory or referral. If an investigation  already exists that involves the issuer noted in the advisory or referral, the  branch chiefs will forward the advisory or referral to the Enforcement  attorney conducting that investigation for review and incorporation into his  or her case.
If Enforcement has not already opened an investigation on a particular  issuer, OMS staff store advisories in the SRO system, but do not investigate  them because they do not contain information as detailed as that found in  referrals in the SRO system. However, SROs may continue their market  surveillance efforts on an advisory, further develop information on the  unusual market activity, and submit all information later as a referral for  potential action by SEC. For referrals, branch chiefs apply criteria—such  as (1) the nature of the unusual market activity, (2) the persons involved  and their employment positions, (3) the dollar value of the unusual activity  in question, (4) potential harm to the financial markets and individual  investors, and (5) any other information branch chiefs may have obtained  through conversations with SRO staff—to make initial decisions about the  merit of forwarding the referrals to Enforcement management and  attorneys for possible SEC investigation. Enforcement associate directors  review and either approve or disapprove branch chiefs’ recommendations  about the referrals. Referrals not recommended by branch chiefs for  approval are stored in the SRO system and may be accessed as needed.
If approved, OMS branch chiefs open an MUI, a 60-day initial inquiry  period, and electronically forward all referral information to SEC  headquarters or the appropriate regional office, where investigative  attorneys and management have up to 60 days to review all available case  information and consider staff and financial resources to decide whether to  proceed with a full investigation. Once the MUI has been opened,  Enforcement staff assigns the MUI a CATS case number, and staff use CATS  to track all components of the case until it is closed. Figure 2 outlines  SEC’s process and average time frames for receiving, processing, and  investigating unusual market activity identified by SROs.
Enforcement staff at headquarters or the regional offices use criteria that  are similar to those used by OMS staff during their initial review, but also  consider the level of financial resources available for investigations and the  availability of Enforcement staff to determine whether to close the MUI or  open an investigation. If Enforcement staff do not open an investigation,  the MUI is closed in CATS and staff document the reason(s) for closure,  which may include insufficient evidence, resource limitations, or a newly  opened case being merged with an existing case.
section_title: When Evidence from Investigation Merits, Enforcement Division Can Pursue Civil and Administrative Actions
paragraphs: If the Enforcement Division develops evidence it deems sufficient for  moving forward, SEC may institute civil or administrative enforcement  actions, or both. When determining how to proceed, Enforcement staff  consider such factors as the seriousness of the wrongdoing, the technical  nature of the matter under investigation, and the type of sanction or relief  sought. When the misconduct warrants it, SEC will bring both types of  proceedings. With civil actions, SEC files a complaint with a federal district  court that describes the misconduct, identifies the laws and rules violated,  and identifies the sanction or remedial action that is sought. For example,  SEC often seeks civil monetary penalties and the return of illegal profits,  known as disgorgement. The courts also may bar or suspend an individual  from serving as a corporate officer or director (see fig. 2).
SEC can seek a variety of sanctions through administrative enforcement  proceedings as well. An ALJ, who is independent of SEC, presides over a  hearing and considers the evidence presented by the Enforcement staff as  well as any evidence submitted by the subject of the proceeding. Following  the hearing, the ALJ issues an initial decision, which contains a  recommended sanction. Administrative sanctions or outcomes include  cease-and-desist orders, suspension or revocation of broker-dealer and  investment adviser registration, censures, bars from association with  certain persons or entities in the securities industry, payment of civil  monetary penalties, and return of illegal profits. Both Enforcement staff  and the defendant may appeal all or any portion of the initial decision to  SEC Commissioners, who may affirm the decision of the ALJ, reverse the  decision, or remand it for additional hearings. An SRO may also agree to  undertake other remedial actions in a settlement agreement with SEC.
Once civil or administrative proceedings have concluded and all outcomes  are finalized, SEC closes the investigation and terminates the case in  CATS.
Figure 2 also provides data on the durations involved with referral and  investigation processes and shows that stages of the process—from SRO  identification of unusual market activity to the closure of investigations— vary in their duration. We analyzed data SEC provided from its referral and  case tracking systems from fiscal years 2003 to 2006. For those cases for  which the data had open and close dates for the investigation stage of the  process, it took an average of 726 days or almost 2 years from the point that  SROs identify unusual market activity and send SEC referrals to the time  that SEC completely investigates and concludes cases. Of this total time,  it took, on average, 192 days for the first three steps in the process, which  include SROs identifying unusual market activity and referring it to SEC  and SEC opening an MUI to conduct its initial inquiry on referrals. It took,  on average, another 534 days for SEC to investigate that unusual market  activity; institute administrative or civil enforcement proceedings;  administer outcomes, such as issuing and collecting fines; and completely  close investigations.
section_title: From Fiscal Years 2003 through 2006, the Number of SRO Advisories and Referrals and SEC Investigations and Enforcement Actions Significantly Increased
paragraphs: Data we reviewed from SEC’s SRO system and CATS showed that the  number of advisories, referrals, and investigations significantly increased  from fiscal years 2003 through 2006. More specifically, advisories increased  from 5 in fiscal year 2003 to 190 in fiscal year 2006 and totaled 390 for the  period. Of the 4-year total, 354, or 91 percent, were insider trading  advisories, and an additional 3 percent involved market manipulation  issues. Data from SEC’s SRO system on 1,640 referrals showed that the  number of referrals SEC received from SROs grew from 438 in fiscal year  2003 to 514 in fiscal year 2006, an increase of 17 percent. Of the total  number of referrals, almost 80 percent involved suspected insider trading  activities. In addition, NYSE and NASD submitted 1,095, or almost   70 percent, of the total number of referrals. SEC and SRO officials  attributed the increase to more merger and acquisition activity in the  marketplace.
Data SEC provided to us from its case tracking system showed a  corresponding increase in the number of investigations SEC opened from  SRO referrals over the same period. The number of investigations rose  from 82 in fiscal year 2003 to 208 in fiscal year 2006, an increase of   154 percent. Case actions, which follow SEC’s determination of whether to  file a case as an administrative proceeding or a civil action, also increased.  The number of case actions rose from 2 in fiscal year 2003 to 29 in fiscal  year 2006. SEC actions result in case outcomes such as permanent  injunctions, preliminary injunctions, restraining orders, administrative  proceeding orders, and emergency actions. These case outcomes rose from  3 in fiscal year 2003 to 82 in fiscal year 2006. Case outcomes also may  include “relief,” such as disgorgement, payment of prejudgment interest  and other monetary penalties, asset freezes, and officer and director bans.
For example, in 2003, NYSE referred unusual market activity to SEC after  suspecting potential insider trading activity. After opening an MUI and  investigating the activity, the case resulted in an administrative proceeding  and a civil action. The case resulted in a range of outcomes against   6 individuals. The administrative proceeding specifically resulted in an  order barring individuals alleged in the case from associating with one  another on trading. The civil action resulted in permanent injunctions to  stop the suspected use of material, nonpublic information and in financial  penalties that included disgorgement.
Figure 3 illustrates the upward trend in the numbers of advisories,  referrals, MUIs, investigations, case actions, and case outcomes for the  period we reviewed. The figure also shows that more than three quarters  of the referrals were made for insider trading. Market manipulation and  “other” activity, including activity associated with issuer reporting and  financial disclosure and initial securities offerings, constituted the other  major categories of referrals. Appendix IV provides additional data on  these trends by fiscal year.
section_title: Limited Search Capabilities of the SRO System and Lack of Linkage to Case Tracking System May Limit Management of Process and Staff Analysis
paragraphs: SEC’s SRO system featured limited capability to electronically search  information on advisories and referrals and may limit Enforcement staff’s  ability to efficiently monitor unusual market activity, make subsequent  decisions about opening MUIs and investigations, and manage the SRO  advisory and referral process. As we have previously discussed, federal  internal control standards state that management needs relevant, reliable,  and timely communications relating to internal and external events. In  addition, these standards state that the information should be distributed in  a form and time frame that permits management and others who need it to  perform their duties efficiently.
SEC developed the SRO system to receive and store advisory and referral  information from SROs and enable SEC staff to make initial decisions  about which SRO-identified market activities to investigate. The system  primarily receives information on unusual market activity based on SRO  surveillance of trades among stock issuers. This information includes the  name of the security issuer; the date of the unusual activity; and a  description of the type of activity, among other data. The SRO system also  stores narrative attachments, which the SROs provide to SEC, that contain  additional information about individuals or entities, such as investment  advisers or hedge funds, associated with unusual market activity. While the  system allows OMS staff to search by issuer, the narrative information  cannot be easily searched in the system; instead, the attachments must be  individually opened and read. An Enforcement branch chief noted that  narrative information can help establish patterns of behavior that are  critical when SEC tries to investigate potentially fraudulent activity, such as  market manipulation and insider trading. Furthermore, only OMS branch  chiefs have access to the SRO system, so attorneys who need that  information have to consult with OMS branch chiefs or contact SRO staff  directly, rather than access that information electronically. In addition,  since the referral receipt and case tracking systems are not linked,  management is unable to readily assess the efficiency and effectiveness of  the referral and investigation processes. For example, SEC is unable to  extract information from a single source on how long it takes both SROs  and SEC to work through different stages of cases over time, from referral  receipt (SRO system) to opening MUIs and conducting investigations (case  tracking system). SEC headquarters and regional office officials noted  that receiving information in a timely manner is critical to the investigative  steps of assembling the facts of the case and collecting evidence on those  potentially involved with unusual market activity. To obtain this  information and customized reports and statistics on Enforcement  operations, division officials said they must submit requests to SEC’s OIT  and then wait for OIT staff to respond to the request. As noted in our 2007  report on Enforcement Division operations, these requests may take  several days to 1 week to complete. Having recognized system limitations,  SEC officials have undertaken efforts to make improvements to CATS by  developing a new case information management system called the Hub.  However, these planned improvements do not address limitations of the  SRO system and do not include expanded linkages between the SRO  system and CATS.
section_title: Conclusions
paragraphs: SEC’s oversight of SRO enforcement programs has produced positive  outcomes. For example, in response to an OCIE recommendation, SROs in  the options market have developed a new surveillance authority, which is  intended to improve coordination among SROs in monitoring the markets  for insider trading and investigating any resulting alerts. The equities  markets are expected to soon follow with a similar plan. SEC, through its  Enforcement Division, has worked with SROs to detect and respond to  potential securities laws violations. Between fiscal years 2003 and 2006,  SEC responded to an increasing number of SRO referrals—a large  percentage of which are related to insider trading—with an increasing  number of investigations and enforcement actions. SEC has started to  incorporate the results of SRO internal audits into its on-site inspections,  which helps to leverage resources. In addition, the agency plans to expand  its oversight of SRO functions to include reviews of the internal audit  function—with an emphasis on independence, staffing levels, and scope of  coverage. Such reviews could help ensure that SROs are effectively  assessing risks, instituting appropriate controls, and carrying out their  responsibilities.
However, several opportunities exist to enhance the efforts used by SEC to  oversee SROs and, particularly, their enforcement programs. Specifically,  OCIE examiners are conducting inspections of SRO enforcement programs  without formal guidance. Although our review of a sample of inspections  found that examiners have developed a methodology for reviewing SRO  enforcement programs, the lack of written guidance—which establishes  minimum standards and quality controls—could limit OCIE’s ability to  provide reasonable assurances that its inspection processes and products  are subject to basic quality controls in such areas as examination planning,  data collection, and report review. Moreover, the lack of formal guidance  could result in individual inspection teams creating data collection and  other examination tools that otherwise would be centralized and more  efficiently shared across inspection teams.
Furthermore, OCIE’s recent internal guidance on the use of SRO internal  audit-related reports does not address the use of these reports for risk- assessment and inspection planning purposes, as we have previously  recommended. We continue to believe that the use of these reports when  conducting risk assessments and determining the scope of an upcoming  inspection could allow OCIE to better leverage its inspection resources,  especially if OCIE determines that the reports produced by SRO internal  audit functions are reliable. As OCIE officials noted, they plan to begin  assessing SRO internal audit functions in 2008, including the quality and  reliability of their work products, although they have not yet developed  guidance for inspection staff on conducting these reviews. By not  considering the work and work products of the SRO internal audit function  in its inspection planning process, OCIE may be duplicating SRO efforts  and not maximizing the use of its limited resources. OCIE also may be  missing an opportunity to better monitor the effectiveness of the SRO  regulatory programs (including enforcement programs) between  inspections.
SEC also has an opportunity to leverage the work of SRO internal audit  functions in its assessment of information security at SROs. Since ARP  Policy Statements specifically are intended to oversee systems essential to  market operations, Market Regulation officials do not target enforcement- related databases for specific review. Although SROs have assessed the  security controls of these databases, Market Regulation officials have little  knowledge of the content or comprehensiveness of these audits. As a  result, Market Regulation cannot determine whether SROs have taken the  appropriate steps to ensure the security of this sensitive information.  Market Regulation could facilitate this evaluation by making certain that  enforcement-related databases continue to be periodically reviewed by  SROs, and that these reviews are comprehensive and complete.
Both OCIE and Enforcement could benefit from improvements to  information technology systems when overseeing SROs. OCIE currently  lacks a system that tracks the status of inspection recommendations. OCIE  officials told us that a new examination tracking database is in  development that will allow OCIE to track the implementation of  inspection recommendations as well as software that will allow OCIE to  generate management reports from this database. By ensuring these  system capabilities, OCIE management could improve its ability to monitor  the implementation of OCIE recommendations, and begin developing  measures for assessing the effectiveness of its program.
Finally, while SEC has responded to a significant increase in SRO referrals  between fiscal years 2003 and 2006, Enforcement’s systems for receiving  referrals and tracking the resulting investigations have limited capabilities  for searching and analyzing information related to these referrals.  Enforcement is currently working to address some limitations in its case  tracking system; however, this effort does not include making  improvements to the separate system used to receive and manage SRO  referrals. By including system improvements to allow electronic access to  all of the information contained in advisories and referrals submitted by  SROs, generate management reports, and provide links to the case tracking  system, Enforcement could enhance its ability to efficiently and effectively  manage SRO advisories and referrals and conduct analyses that could  contribute to improved SEC planning, operations, and oversight.
section_title: Recommendations for Executive Action
paragraphs: To enhance SEC oversight of SROs, we recommend that the SEC Chairman  take the following three actions:  establish a written framework for conducting inspections of SRO  enforcement programs to help ensure a reliable and consistent source of  information on SRO inspection processes, minimum standards, and  quality controls; and, as part of this framework, broaden current  guidance to SRO inspection staff on the use of SRO internal audit  reports to direct examiners to consider the extent to which they will rely  on reports and reviews of internal and external audit and other risk- management systems when planning SRO inspections;  ensure that Market Regulation makes certain that SROs include in their  periodic risk assessment of their IT systems a review of the security of  their enforcement-related databases, and that Market Regulation  reviews the comprehensiveness and completeness of the related SRO- sponsored audits of their enforcement-related databases; and  as part of the agency’s ongoing efforts to improve information   ensure that any software developed for tracking SRO inspections  includes the ability to track and report SRO responses to and  implementation status of OCIE inspections recommendations and   consider system improvements that would allow Enforcement staff  to electronically access and search all information in advisories and  referrals submitted by SROs and generate reports that would  facilitate monitoring and analysis of trend information and case  activities.
section_title: Agency Comments and Our Evaluation
paragraphs: We requested comments on a draft of this report from SEC. SEC provided  written comments on the draft, which we have reprinted in appendix V.  SEC also provided technical comments on a draft of the report, which were  incorporated in this report as appropriate. In its written comments, SEC  agreed with our recommendations. SEC noted that OCIE will provide SRO  inspectors with written guidance on its risk-scoping techniques and  compiled summary of inspection practices. In addition, OCIE plans to  assess the quality and reliability of SRO internal audit programs and  determine whether, and the degree to which, inspections can be risk- focused on the basis of SRO internal audit work. SEC also noted that it is  developing a database to track the status of SRO inspection  recommendations and provide management reports and that this  enhancement should create additional efficiencies for inspection planning  purposes. SEC’s Market Regulation will implement our recommendation to  ensure that enforcement-related databases continue to be periodically  reviewed by SRO internal audit programs, and that these reviews are  comprehensive and complete. Furthermore, Enforcement plans to consider  recommended system improvements to more effectively manage the  advisory and referral processes.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  date. At that time, we will send copies of this report to interested  congressional committees and the Chairman of the Senate Committee on  Finance. We will also send a copy to the Chairman of the Securities and  Exchange Commission. We will also make copies available to others upon  request. The report will be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions regarding this report, please contact  me at (202) 512-8678 or hillmanr@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix VI.
section_title: Scope and Methodology
paragraphs: To discuss the overall structure of the Securities and Exchange  Commission’s (SEC) inspection program—more specifically, its approach  to inspections of self-regulatory organizations’ (SRO) surveillance,  investigative, and enforcement programs (enforcement programs)—we  reviewed and analyzed documentation of all 11 inspections that SEC’s  Office of Compliance Inspections and Examinations (OCIE) completed  from March 2002 through January 2007 of enforcement programs related to  the former NASD and the New York Stock Exchange (NYSE). We also  reviewed and analyzed an OCIE memorandum to the Commission  describing the SRO inspection process, staffing data provided by OCIE, and  our prior work. Furthermore, we observed a demonstration of various  information technology systems that NASD used to monitor the markets  and track investigations and disciplinary actions. Finally, we reviewed and  summarized the enforcement actions brought by SEC against SROs from  1995 to 2007. We also conducted interviews with staff from OCIE, NASD,  and NYSE.
To evaluate certain aspects of SEC’s inspection program, including  guidance and planning, the use of SRO internal audit products, and the  tracking of inspection recommendations, we reviewed OCIE inspection  guidance related to the review of NASD district offices and SRO internal  audit reports, guidance for bank examiners from the Board of Governors of  the Federal Reserve System and the Office of the Comptroller of the  Currency, inspection guidelines developed by the inspectors general, and  our prior work. In addition, we reviewed SEC guidance for conducting  reviews of SRO information technology (IT) related to market trading  operations and regulatory fee remittance, and NASD and NYSE internal  and external audits of IT security. Furthermore, we reviewed internal  control standards for the federal government and conducted interviews  with officials from OCIE and SEC’s Division of Enforcement  (Enforcement) on their respective procedures for ensuring that SROs  implement inspection recommendations and remedial actions required as  part of enforcement actions. We also conducted interviews with staff from  OCIE, SEC’s Division of Market Regulation and Office of Information  Technology, NASD, and NYSE.
To describe the SRO referral process and recent trends in referral numbers  and related SEC investigations, and evaluate SEC’s information system for  advisories and referrals, we observed a demonstration from Enforcement  staff on the capabilities of their IT systems, analyzed data from SEC’s SRO  Referral Receipt System (SRO system) and Case Activity Tracking System  (CATS), and interviewed Enforcement, NASD, and NYSE staff to determine  how SEC manages the processes for receiving SRO referrals and  conducting subsequent investigations. In particular, to understand trends in  SRO advisories, referrals, and subsequent SEC investigations, we requested  and analyzed data from SEC’s referral and case tracking systems from  fiscal years 2003 through 2006. We analyzed the data to provide descriptive  information on the number of SEC’s advisories, referrals, matters under  inquiry (MUI), investigations, actions, and case outcomes during the  period. We also analyzed these data by manually merging records from the  SRO system and CATS to obtain descriptive data on the amount of time it  takes SROs to identify unusual market activity and convey that information  to SEC, as well as how long it takes SEC to respond by opening MUIs and  investigations and achieving case outcomes. We inquired about checks SEC  performs on the data and deemed the data reliable for the purposes of  addressing our objectives. When calculating the average duration of stages  to process SRO referrals, we distinguished between case stages that  featured both open and close dates and those that were open or active as of  the date we received data from SEC, and we reported duration information  accordingly. In addition, to calculate case stage durations, we consulted  with SEC and SRO staff to distinguish between initial and updated referrals  and performed duration calculations using initial referrals only to avoid  double counting that could skew the average duration results.
We performed our work in Washington, D.C.; New York, New York; and  Rockville, Maryland, between September 2006 and September 2007 in  accordance with generally accepted government auditing standards.
section_title: SEC Oversight of SRO Enforcement Programs Related to Insider Trading
paragraphs: SRO surveillance, investigative, and disciplinary programs are designed to  enforce SRO rules and federal securities laws related to insider trading— the buying or selling of a security by someone who has access to material,  nonpublic information about the security—and are subject to SEC  oversight through periodic inspections by OCIE. In January 2007, OCIE  completed a sweep inspection (a probe of specific activities across all or a  sample of SROs) of SRO enforcement programs related to insider trading.  As a result of OCIE’s inspection, the options SROs submitted a plan to SEC  to create a more uniform and coordinated method for surveillance and  investigation of insider trading in the options markets, and the equities  SROs indicated their intent to submit a similar plan. From fiscal years 2003  through 2006, SEC significantly increased the number of investigations that  related to insider trading.
subsections: section_title: SROs Coordinate with SEC and Use Surveillance, Investigative, and Disciplinary Programs to Enforce Insider Trading Rules and Laws
paragraphs: SROs employ enforcement programs to enforce SRO rules and federal  securities laws related to insider trading. Insider trading is illegal because  any trading that is based on this information is unfair to investors who do  not have access to the information. When persons buy or sell securities on  the basis of information not generally available to the public, investor  confidence in market fairness can be eroded. Information that could be  exploited for personal gain by insiders include such things as advance  knowledge of mergers or acquisitions, development of a new drug or  product, or earnings announcements. While company insiders (e.g.,  directors and senior executives) may be the most likely individuals to  possess material, nonpublic information, others outside of the company  also may gain access to the information and use it for their personal gain.  For example, employees at a copy store who discovered material,  nonpublic information while making presentation booklets for a firm could  commit insider trading if they traded on that information prior to it being  made public.
To detect insider trading, SROs have established electronic surveillance  systems that monitor their markets for aberrational movements in a stock’s  price or volume of shares traded, among other things, and generate alerts if  a stock’s price or volume of shares traded moves outside of set parameters.  These systems link trade activity data to news and research about  corporate transactions (such as mergers, acquisitions, or earnings  announcements); public databases of listed company officers and  directors; and other internal and external sources of information to detect  possible insider trading. For example, the NASD Securities Observation  News Analysis and Regulation system combines trade activity on NASDAQ,  the American Stock Exchange, and the over-the-counter markets with news  stories and other external sources of information to detect potential  instances of insider trading and other potential violations of federal  securities laws or NASD rules.
SRO staff review the thousands of alerts generated by the electronic  surveillance systems annually to identify those that are most likely to  involve insider trading or fraud and warrant further investigation. In  conducting reviews of these alerts, SRO staff consider such factors as the  materiality of news, the existence of any previous news announcements,  and the profit potential. If, in reviewing the trading associated with the  alert, SRO staff determines there is a strong likelihood of insider trading,  they can expand this review to a full investigation. In the course of a full  investigation, SROs gather information from their member broker-dealers  and the issuer of the traded stock to determine whether there is any  relationship between those individuals who traded the stock and those  individuals who had advance knowledge of the transaction or event. For  example, SRO staff will typically request from their member broker-dealers  the names of individuals and organizations that traded in advance of a  corporate transaction or event, a process known as bluesheeting. These  data are then cross-referenced with information the SRO staff obtain from  the issuer of the stock, including a chronology of the events leading up to  the corporate transaction or event and the names of individuals who had  knowledge of inside information.
SROs have created technology-based tools to assist in the identification of  potential repeat offenders. For example, SROs can compare their blue  sheets to a database called the Unusual Activity File (UAF), which includes  data on suspicious trading activity identified by all SROs that are part of the  Intermarket Surveillance Group, to help identify persons or entities that  have been flagged in prior referrals or cases related to insider trading,  fraud, or market manipulation. Some SROs have also developed other  databases for their internal use. For example, NASD developed a database  similar to the UAF for suspicious trading activity it has identified. NYSE  also has developed a database of individuals who are affiliated with entities  that it considers at high risk for insider trading.
When SROs find evidence of insider trading involving their members, they  can conduct disciplinary hearings and impose penalties ranging from  disciplinary letters to fines to expulsion from trading and SRO  membership. Because SROs do not have jurisdiction over entities and  individuals that are not part of their membership, they refer suspicious  trading on the part of nonmembers directly to Enforcement. Although  Enforcement staff do not have direct access to SRO surveillance data or  recidivist databases like the UAF, several staff told us they are able to  obtain any needed information from the SRO analysts who made the  referrals.
Data we reviewed from NASD and NYSE between fiscal years 2003 and  2006 showed that the SROs referred significantly more nonmembers to  SEC for suspected insider trading than they referred members internally to  their own Enforcement staff. According to SRO staff, this may be because  the majority of the entities and individuals who trade on the basis of  material, nonpublic information do so as a result of connections to the  issuers of the stocks traded, rather than the investment advisor role that  would involve member firms and their employees. Another possible  explanation, according to SRO staff, is that the individual registered  persons (SRO members) typically conceal their misconduct by trading in  nominee accounts or secretly sharing in the profits generated by  nonregistered persons involved in the scheme. As a result, they said that  concealed member misconduct is often exposed through evidence  developed by SEC using its broader jurisdictional tools after the SRO has  referred a nonmember to SEC. For example, they said that SEC can expose  the concealed member misconduct by fully investigating the nonregistered  person’s activities through documents such as telephone and bank records  obtained by subpoena. SEC also has the ability to issue subpoenas to  nonmembers to appear for investigative testimony.
section_title: SEC’s Inspection Program to Oversee SRO Enforcement Efforts Has Identified Opportunities for SROs to Improve Surveillance of Insider Trading
paragraphs: OCIE assesses the effectiveness of SRO regulatory programs, including  enforcement programs, through periodic inspections. OCIE officials said  that when evaluating SRO enforcement programs related to insider trading,  their objective is to assess whether the parameters of the surveillance  systems are appropriately set to detect abnormal movements in a stocks’  price or volume and generate an alert, the extent to which SRO policies and  procedures direct the SRO staff to conduct thorough reviews of alerts and  resulting investigations, and the extent to which SRO analysts comply with  these policies and procedures and apply them consistently. OCIE staff said  that when reviewing case files, one of their priorities is to assess the  evidence upon which the SRO analyst relied when deciding to terminate  the review of an alert or investigation. For example, they said that they will  assess whether the analyst selected an appropriate period to review trading  records (because suspicious trades may have occurred several days or  weeks prior to the material news announcement), whether the analyst  reviewed the UAF and internal databases for evidence of recidivism, and  whether the analyst appropriately reviewed any other stocks or entities  related to the trading alert.
OCIE officials said that in light of the recent increase in merger and  acquisition activity and the increased potential for insider trading, SROs  are making greater efforts to detect attempts of individuals or firms to  benefit on both sides of a merger or acquisition. For example, they said  that where previously it was common for one SRO analyst to investigate  any alerts generated from the movement of the target firm and for a  different analyst to investigate any alerts generated from the movement of  the acquiring firm—making it difficult to identify an account or individual  that may have traded on both sides of the acquisition—SRO policies now  generally require one analyst to review and investigate both stocks  involved in a merger or acquisition. Generally speaking, mergers and  acquisitions present opportunities for insider trading because the acquiring  company generally must pay more per share than the current price, causing  the target firm’s stock price to increase. In this case, an individual with  knowledge of an upcoming acquisition could purchase the target’s stock  prior to the announcement and then sell for a gain the stock after the  announcement at the higher price. An individual also could sell any  holdings or sell short the stock of the acquiring firm if the individual  believed that the acquiring firm’s stock price would decrease after the  announcement. Finally, an individual could attempt to buy the target firm  and sell (or short sell) the acquiring firm in an attempt to benefit on both  sides of an acquisition.
In January 2007, OCIE completed sweep inspections of surveillance and  investigatory programs related to insider trading at 10 SROs. As a result of  its inspections, OCIE identified opportunities for improved coordination  and standardization among SROs in monitoring and investigating possible  insider trading. OCIE found that because each SRO at the time maintained  its own surveillance systems, the variances in the system parameters could  result in the possibility that stock or option movements might generate an  alert at one SRO but not another. Furthermore, OCIE found that because  each SRO was responsible for monitoring every stock that traded on its  market, the SROs were duplicating the initial screening of alerts.
As a result of OCIE’s then ongoing inspection, the options SROs submitted  a plan to SEC to create a more uniform and coordinated method for the  regulation, surveillance, investigation, and detection of insider trading in  the options markets. SEC approved the plan, called Options Regulatory  Surveillance Authority (ORSA), in June 2006. The plan allows the options  SROs to delegate part or all of the responsibility of conducting insider  trading surveillance and investigations for all options trades to one or more  SROs, with individual SROs remaining responsible for the regulation of  their respective markets and retaining responsibility to bring disciplinary  proceedings as appropriate. ORSA has currently delegated this surveillance  and investigative responsibility to the Chicago Board Options Exchange.  The ORSA plan also provides for the establishment of a policy committee  that is responsible for overseeing the operation of the plan and for making  all relevant policy decisions, including reviewing and approving  surveillance standards and other parameters to be used by the SRO  performing the surveillance and investigative functions under the plan. The  committee also will establish guidelines for generating, reviewing, and  closing insider trading alerts; specific and detailed instructions on how  analysts should review alerts; and instructions on closing procedures,  including proper documentation and rationale for closing an alert. OCIE  officials stated that they have met regularly with the options SROs to  monitor the implementation of the plan and the development of related  policies and procedures. According to the Commission, the ORSA plan  should allow the options exchanges to more efficiently implement  surveillance programs for the detection of insider trading, while  eliminating redundant effort. As a result, OCIE officials believe the plan  will promote more effective regulation and surveillance.
According to OCIE officials, the equities SROs are currently drafting a  similar plan for coordinating insider trading surveillance in equities  markets. However, instead of designating one SRO to conduct all insider  trading-related surveillance, OCIE officials said that the current draft  proposal would require each listing market, or its designee, to conduct  insider trading surveillance for its listed issues, regardless of where trading  in the security occurred. This includes reviewing alerts, pursuing  investigations, and resolving cases through referrals (to SEC) or  disciplinary action. OCIE officials said that the equities SROs anticipate  voting on a proposed plan at the October 2007 Intermarket Surveillance  Group meeting and to submit the plan to SEC by the end of 2007.
section_title: SEC Civil Enforcement Actions against SROs, January 1995–September 2007
paragraphs: Pursuant to sections 19 and 21 of the Securities Exchange Act of 1934, SEC  may bring enforcement actions against an SRO either in federal court or  through an administrative proceeding if it has found that an SRO has  violated or is unable to comply with the provisions of the act and related  rules and regulations, or if it has failed to enforce member compliance with  SRO rules without reasonable justification or excuse. The act authorizes  SEC to seek a variety of sanctions in an administrative proceeding,  including the revocation of SRO registration, issuance a cease-and-desist  order, or censure. An SRO may also agree to undertake other remedial  actions in a settlement agreement with SEC. In addition to the remedies  available in administrative enforcement action, a district court in a civil  enforcement action may impose civil monetary penalties and has discretion  to fashion such other equitable remedy it deems appropriate under the  circumstances.
Tables 2 through 11 summarize the 10 civil enforcement actions SEC  brought against SROs from January 1995 through September 2007. For this  report, we have included only those findings and terms of settlement  related to SRO surveillance, investigative, or disciplinary programs  (enforcement programs). As such, these summaries do not necessarily  identify all findings and terms of the settlement agreements.
section_title: Analyses of SEC-Provided Data on Various Case Stages
paragraphs: Tables 12 to 22 include analyses of data from fiscal years 2003 to 2006  provided by SEC from its SRO system and CATS. This appendix provides  specific analyses on the number and types of advisories; referrals; matters  under inquiry (MUI); investigations; case actions; and case outcomes, by  fiscal year and SRO. It also describes reasons that SEC closed MUIs and  provides data on average and median investigation durations, by type of  investigation.
section_title: Comments from the Securities and Exchange Commission
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Karen Tremba (Assistant Director),  Nina Horowitz, Stefanie Jonkman, Matthew Keeler, Marc Molino, Omyra  Ramsingh, Barbara Roesmann, and Steve Ruszczyk made key contributions  to this report.