Financial Audit: Securities and Exchange Commission's Financial Statements for Fiscal Years 2007 and 2006
Published: 2007-11-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Established in 1934 to enforce the securities laws and protect investors, the Securities and Exchange Commission (SEC) plays an important role in maintaining the integrity of the U.S. securities markets. Pursuant to the Accountability of Tax Dollars Act of 2002, SEC is required to prepare and submit to Congress and the Office of Management and Budget audited financial statements. GAO agreed, under its audit authority, to perform the audit of SEC's financial statements. GAO's audit was done to determine whether, in all material respects, (1) SEC's fiscal year 2007 financial statements were reliable and (2) SEC's management maintained effective internal control over financial reporting and compliance with laws and regulations. GAO also tested SEC's compliance with certain laws and regulations.
section_title: What GAO Found
paragraphs: In GAO's opinion, SEC's fiscal year 2007 and 2006 financial statements were fairly presented in all material respects. However, because of a material weakness in internal control over SEC's financial reporting process, in GAO's opinion, SEC did not have effective internal control over financial reporting as of September 30, 2007. Recommendations for corrective action will be included in a separate report. Although certain compliance controls should be improved, SEC did maintain in all material respects effective internal control over compliance with laws and regulations material in relation to the financial statements as of September 30, 2007. In addition, GAO did not find reportable instances of noncompliance with the laws and regulations it tested. In its 2006 report, GAO reported on weaknesses in the areas of SEC's (1) recording and reporting of disgorgements and penalties, (2) information systems controls, and (3) property and equipment controls. During fiscal year 2007, SEC improved its controls over the accuracy, timeliness, and completeness of the disgorgement and penalty data and used a much improved database for the initial recording and tracking of these data. However, the processing of these data for financial reporting purposes is still done through a manual process that is prone to error. GAO found that the internal controls that compensated for the manual processing of the related accounts receivable balances in fiscal year 2006 were not effective in fiscal year 2007. This issue is included in the material weakness in SEC's financial reporting process for fiscal year 2007. Other control deficiencies included in this material weakness concern SEC's period-end closing process, accounting for transaction fee revenue, and preparation of financial statement disclosures. GAO also identified three significant deficiencies in internal control during fiscal year 2007. Although SEC has taken steps to strengthen its information security, some of the weaknesses identified in GAO's previous audit persisted and GAO found new weaknesses during this year's audit. Therefore, GAO is reporting information security as a significant deficiency as of September 30, 2007. In addition, GAO continued to identify the same weaknesses in controls over property and equipment and therefore considers this area a significant deficiency as of September 30, 2007. GAO also identified a new significant deficiency concerning SEC's accounting for budgetary transactions. In commenting on a draft of this report, SEC's Chairman emphasized SEC's commitment to enhance its controls in all operational areas and to ensure reliability of financial reporting, soundness of operations, and public confidence in SEC's mission.

section_title: Letter
paragraphs: This report presents our opinion on whether the financial statements of  the Securities and Exchange Commission (SEC) for the fiscal years ended  September 30, 2007, and 2006 are presented fairly, in all material respects,  in conformity with U.S. generally accepted accounting principles. This  report also presents (1) our opinion on the effectiveness of SEC’s internal  control over financial reporting and compliance as of September 30, 2007,  and (2) the results of our evaluation of SEC’s compliance with selected  laws and regulations during 2007.
The Accountability of Tax Dollars Act of 2002 requires that SEC prepare  and submit to Congress and the Office of Management and Budget (OMB)  audited financial statements. We decided, under our audit authority, to  audit SEC’s financial statements. We conducted this audit in accordance  with U.S. generally accepted government auditing standards and OMB  guidance.
We are sending copies of this report to the Chairman and Ranking  Minority Members of the Senate Committee on Banking, Housing, and  Urban Affairs; the Senate Committee on Homeland Security and  Governmental Affairs; the House Committee on Financial Services; and  the House Committee on Oversight and Government Reform. We are also  sending copies to the Secretary of the Treasury, the Director of the Office  of Management and Budget, and other interested parties. In addition, this  report will be available at no charge on our Web site at  http://www.gao.gov.
This report was prepared under the direction of Jeanette M. Franzel,  Director, Financial Management and Assurance, who can be reached at  (202) 512-9471 or franzelj@gao.gov. If I can be of further assistance, please  call me at (202) 512-5500.
To the Chairman of the United States Securities and Exchange  Commission  In our audits of the United States Securities and Exchange Commission  (SEC) for fiscal years 2007 and 2006, we found  the financial statements as of and for the fiscal years ended September 30,  2007, and 2006, including the accompanying notes, are presented fairly, in  all material respects, in conformity with U.S. generally accepted  accounting principles;   SEC did not have effective internal control over financial reporting;  although certain compliance controls should be improved, SEC had  effective control over compliance with laws and regulations that could  have a direct and material effect on the financial statements as of  September 30, 2007; and   no reportable noncompliance with laws and regulations we tested.
The following sections discuss in more detail these conclusions as well as  our conclusions on Management’s Discussion and Analysis and other  supplementary information. They also present information on the  objectives, scope, and methodology of our audit and our discussion of SEC  management’s comments on a draft of this report.
subsections: section_title: Opinion on Financial Statements
paragraphs: SEC’s financial statements, including the accompanying notes, present  fairly, in all material respects, in conformity with U.S. generally accepted  accounting principles, SEC’s assets, liabilities, net position, net costs,  changes in net position, budgetary resources, and custodial activity as of,  and for the fiscal years ended, September 30, 2007, and September 30,  2006. However, misstatements may nevertheless occur in other financial  information reported by SEC and may not be prevented or detected  because of the internal control deficiencies described in this report.
As disclosed in footnote 1.C. to SEC’s financial statements, in fiscal year  2007, SEC changed its method of accounting for user fees collected in  excess of current-year appropriations.
section_title: Opinion on Internal Control
paragraphs: Because of the material weakness and significant deficiencies in internal  control discussed below, SEC did not maintain effective internal control  over financial reporting as of September 30, 2007, and thus did not have  reasonable assurance that misstatements material in relation to the  financial statements would be prevented or detected on a timely basis.  Although certain compliance controls should be improved, SEC  maintained, in all material respects, effective internal control over  compliance with laws and regulations as of September 30, 2007, that  provided reasonable assurance that noncompliance with laws and  regulations that could have a direct and material effect on the financial  statements would be prevented or detected on a timely basis. Our opinion  on internal control is based on criteria established under 31 U.S.C. §  3512(c)(d), commonly referred to as the Federal Managers’ Financial  Integrity Act (FMFIA) and the Office of Management and Budget (OMB)  Circular No. A-123, Management Accountability and Control.
During this year’s audit, we identified significant control deficiencies in  SEC’s financial reporting process, which taken collectively, result in more  than a remote likelihood that a material misstatement of the financial  statements will not be prevented or detected. Therefore, we considered  the combination of the following control deficiencies to collectively  constitute a material weakness in SEC’s financial reporting process:    period-end financial reporting process,    disgorgements and penalties accounts receivable,    accounting for transaction fee revenue, and    preparing financial statement disclosures.
In addition to the material weakness discussed above, we identified three  significant deficiencies in internal control, which although not material  weaknesses, represent significant deficiencies in the design or operation  of internal control. Although we are considering these issues separately  from the material weakness described above, they nevertheless adversely  affect SEC’s ability to meet financial reporting and other internal control  objectives. These deficiencies concern    property and equipment, and    accounting for budgetary resources.
In our prior year audit, we reported on weaknesses we identified in the  areas of SEC’s (1) recording and reporting of disgorgements and penalties,  (2) information systems controls, and (3) property and equipment  controls. During fiscal year 2007, SEC improved its controls over the  accuracy, timeliness, and completeness of the disgorgement and penalty  data and used a much improved database for the initial recording and  tracking of these data. However, the processing of these data for financial  reporting purposes is still done through a manual process that is prone to  error. We found that the internal controls that compensated for the  manual processing of the related accounts receivable balances in fiscal  year 2006 were not effective in fiscal year 2007. This issue is included in  the material weakness in SEC’s financial reporting process for fiscal year  2007.
SEC continues to make progress in resolving the information security  weaknesses. Previously identified weaknesses, though, still need to be  addressed, along with new weaknesses we found during this year’s audit.  Therefore, we consider information security to be a significant deficiency  as of September 30, 2007. In addition, we continued to identify the same  weaknesses in controls over property and equipment during this year’s  audit, and therefore, we considered this area to be a significant deficiency  as of September 30, 2007.
Although SEC had one material weakness and three significant control  deficiencies in internal control, SEC’s financial statements were fairly  stated in all material respects for fiscal years 2007 and 2006. However, the  weaknesses in internal control noted above may adversely affect decisions  by SEC management that is based, in whole or in part, on information that  is inaccurate because of this weakness. In addition, unaudited financial  information reported by SEC, including performance information, may  also contain misstatements resulting from these weaknesses.
We will be reporting additional details concerning the material weakness  and the significant deficiencies separately to SEC management, along with  recommendations for corrective actions. We will also be reporting less  significant matters involving SEC’s system of internal controls separately  to SEC management.
section_title: Material Weakness
subsections: section_title: Financial Reporting Process
paragraphs: During this year’s audit, we found control deficiencies in SEC’s period-end  financial reporting process, in its calculation of accounts receivable for  disgorgements and penalties, in its accounting for transaction fee revenue,  and in preparing its financial statement disclosures. We believe these  control deficiencies, collectively, constitute a material weakness.
subsections: section_title: Period-End Financial Reporting Process:
paragraphs: SEC’s financial management system does not conform to the systems  requirements of OMB Circular No. A-127, Financial Management  Systems. Specifically, Circular No. A-127 requires that financial  management systems be designed to provide for effective and efficient  interrelationships between software, hardware, personnel, procedures,  controls, and data contained within the systems. Circular No. A-127 further  states that financial systems must have common data elements, common  transaction processing, consistent internal controls, and efficient  transaction entry, and that reports produced by the systems shall provide  financial data that can be traced directly to the general ledger accounts.
SEC’s period-end financial reporting process for recording transactions,  maintaining account balances, and preparing financial statements and  disclosures are supported to varying degrees by a collection of automated  systems that are not integrated or compatible with its general ledger  system. These automated systems’ lack of integration and compatibility  require that extensive compensating manual and labor-intensive  accounting procedures, involving large spreadsheets and numerous  posting and routine correcting journal entries, dominate SEC’s period-end  financial reporting process. Some of SEC’s subsidiary systems, such as  that for property and equipment and for disgorgements and penalties, do  not share common data elements and common transaction processing  with the general ledger system. Therefore, intermediary information  processing steps, including extensive use of spreadsheets, manipulation of  data, and manual journal entries, are needed to process the information in  SEC’s general ledger. This processing complicates review of the  transactions and greatly increases the risk that the transactions are not  recorded completely, properly, or consistently, ultimately affecting the  reliability of the data presented in the financial statements. Our  identification this year of errors in SEC’s calculation of disgorgement and  penalty accounts receivable, discussed below, illustrates this risk.
The risk to data reliability is further increased because basic controls over  electronic data, such as worksheet and password protection, change  history, and controls over data verification, such as control totals and  record counts, were not consistently used during the data processing  between the source systems and the general ledger. In addition, currently,  SEC’s general ledger has several unconventional posting models and other  limitations that prevent proper recording of certain transactions. As a  result, SEC’s year-end reporting process requires extensive routine  correcting journal entries to correct errors created by incorrectly posted  transactions in its general ledger. We also noted that SEC’s documentation  used to crosswalk individual accounts to the financial statement line items  contained an incorrect routing to a line item on SEC’s Statement of  Budgetary Resources for SEC’s year-end financial statement preparation  process, which caused a material error in SEC’s draft financial statements.  Also, SEC did not have detailed written documentation of its  methodologies and processes for preparing financial statements and  disclosures, increasing the risk of inconsistent and improper reporting and  the risk that disruptions and error may arise when staff turnover occurs.
section_title: Disgorgements and Penalties Accounts Receivable:
paragraphs: As part of its enforcement responsibilities, SEC issues orders and  administers judgments ordering, among other things, disgorgements, civil  monetary penalties, and interest against violators of federal securities  laws. SEC recognizes a receivable when SEC is designated in an order or  a final judgment to collect the assessed disgorgements, penalties, and  interest. At September 30, 2007, the gross amount of disgorgements and  penalties accounts receivable was $330 million, with a corresponding  allowance of $266 million resulting in a net receivable of $64 million.
In our reviews of the interim June 30, 2007, and year-end September 30,  2007, balances of accounts receivable for disgorgements and penalties, we  found errors in SEC’s spreadsheet formulas resulting in overstatements of  these receivable balances for both periods. These errors consisted of  incorrectly changed spreadsheet formulas that affected the final calculated  balances. SEC subsequently detected and corrected the June 30 errors, but  then made different spreadsheet calculation errors in the year-end  balances as of September 30, 2007, which we detected as part of our audit.  SEC made adjustments to correct the errors, which were not material.  However, SEC’s process for calculating its accounts receivable for  disgorgements and penalties presents a high risk that significant errors  could occur and not be detected. The main cause of these errors is the  breakdown this year in the manual controls that were intended to  compensate for the lack of an integrated accounting system for  disgorgements and penalties, as discussed above. Specifically, although  the journal entries posting the amounts to the general ledger were  reviewed, this review did not extend to the preparation of the spreadsheet  SEC used to document the accounts receivable calculation at June 30 and  September 30, 2007, and therefore, was not sufficient to detect significant  spreadsheet formula errors.
section_title: Accounting for Transaction Fee Revenue:
paragraphs: As one of its sources of revenue, SEC collects securities transaction fees  paid by self-regulatory organizations (SRO) to SEC for stock transactions.  SRO transaction fees are payable to the SEC twice a year –in March for the  previous months September through December, and in September for the  previous months January through August. Since the SROs are not required  to report the actual volume of transactions until 10 business days after  each month end, SEC estimates and records an amount receivable for fees  payable by the SROs to SEC for activity during the month of September. At  September 30, 2007, SEC estimated this receivable amount at $100.6  million. Based on information SEC received in mid-October concerning  the actual volume of transactions, the amount of claims receivable at  September 30, 2007, should have been $74.4 million.  In previous years,  SEC made adjustments to reflect the actual volume of transactions;  however, SEC does not have written procedures to help ensure that this  adjustment is made as a routine part of its year-end financial reporting  process.  We proposed, and SEC posted, the necessary audit adjustment to  correct the amount of transaction fee revenue for fiscal year 2007.
Statement on Auditing Standards No.1, Codification of Auditing  Standards and Procedures, which explains the accounting requirements  for subsequent events, requires that events or transactions that existed at  the date of the balance sheet and affect the estimates inherent in the  process of preparing financial statements should be considered for  adjustment to or disclosure in the financial statements through the date  that the financial statements are issued. In addition, the concept of  consistency in financial reporting provides that accounting methods,  including those for determining estimates, once adopted, should be used  consistently from period to period unless there is good cause to change.
section_title: Preparing Financial Statement Disclosures:
paragraphs: In our review of SEC’s year-end draft financial statement disclosures, we  noted numerous errors including misstated amounts, improper break out  of line items, and amounts from fiscal year-end 2006 incorrectly brought  forward as beginning balances for fiscal year 2007. For example, in its  disclosure for Custodial Revenues and Liabilities, SEC improperly  excluded approximately $320 million in collections. In another example,  for its disclosure on Fund Balance with Treasury, SEC misclassified  approximately $90 million into incorrect line items. Also, in its disclosure  for Fiduciary Assets and Liabilities, SEC’s beginning balances for Fund  Balance with Treasury and for Liability for Fiduciary Activity were each  misstated by $8.9 million due to errors in carrying forward ending  balances from September 30, 2006. SEC revised the financial statement  disclosures to correct the errors that we noted. We believe the cause of  these and numerous other errors in the disclosures is due mainly to the  lack of a documented timeline and process for completing the fiscal year  2007 financial statements and disclosures, including review of the  disclosures. In addition, the cumbersome and complicated nature of SEC’s  financial reporting process discussed above did not allow SEC finance  staff sufficient time to carry out thorough and complete reviews of the  disclosures in light of the November 15 reporting deadline.
section_title: Significant Deficiencies
paragraphs: We also identified three control deficiencies that adversely affect SEC’s  ability to meet its internal control objectives. These conditions concern  deficiencies in controls over (1) information security, (2) property and  equipment, and (3) accounting for budgetary resources, which are  summarized below.
subsections: section_title: Information Security
paragraphs: SEC relies extensively on computerized information systems to process,  account for, and report on its financial activities and make payments. To  provide reasonable assurance that financial information and financial  assets are adequately safeguarded from inadvertent or deliberate misuse,  fraudulent use, improper disclosure, or destruction, effective information  security controls are essential. These controls include security  management, access controls, configuration management, physical  security, and contingency planning. Weaknesses in these controls can  impair the accuracy, completeness, and timeliness of information used by  management and increase the potential for undetected material  misstatements in the agency’s financial statements.
During fiscal year 2007, SEC made important progress in mitigating certain  control weaknesses that were previously reported as unresolved at the  time of our prior review. For example, SEC developed a comprehensive  program for monitoring access activities to its computer network  environment, tested and evaluated the effectiveness of controls for the  general ledger system, and documented authorizations for software  modifications. SEC also took corrective action to restrict access to  sensitive files on its servers, change default database accounts that had  known or weak passwords, and apply strong encryption key management  practices for managing secure connections.
Despite this progress, SEC has not consistently implemented certain key  information security controls to effectively safeguard the confidentiality,  integrity, and availability of its financial and sensitive information and  information systems. During this year’s audit, we identified continuing and  new information security weaknesses that increase the risk that (1)  computer resources (programs and data) will not be adequately protected  from unauthorized disclosure, modification, and destruction; (2) access to  facilities by unauthorized individuals will not be adequately controlled;  and (3) computer resources will not be adequately protected and  controlled to ensure the continuity of data processing operations when  unexpected interruptions occur. For example, SEC had not yet mitigated  weaknesses related to malicious code attacks on SEC’s workstations, had  not yet adequately documented access privileges for a major application,  and had not yet implemented an effective intrusion detection system. New  control weaknesses in authorization, boundary protection, configuration  management, and audit and monitoring that we identified this year include  for example, the use of a single, shared user account for posting journal  vouchers in a financial application, inadequate patching of enterprise  databases, and inadequate auditing and monitoring capabilities on its  database servers. Lapses in physical security enabled unauthorized  network access from a publicly accessible location within SEC  Headquarters. In addition, SEC did not have contingency plans for key  desktops that support manual processes such as the preparation of  spreadsheets. These weaknesses existed, in part, because SEC has not yet  fully implemented its information security program.
Collectively, these problems represent a significant deficiency in SEC’s  internal control over information systems and data. Specifically, the  continuing and newly identified weaknesses decreased assurances  regarding the reliability of the data processed by the systems and  increased the risk that unauthorized individuals could gain access to  critical hardware and software and intentionally or inadvertently access,  alter, or delete sensitive data or computer programs. Until SEC  consistently implements all key elements of its information security  program, the information that is processed, stored, and transmitted on its  systems will remain vulnerable, and management will not have sufficient  assurance that financial information and financial assets are adequately  safeguarded from inadvertent or deliberate misuse, fraudulent use,  improper disclosure, or destruction. We will be issuing a separate report  on issues we identified regarding information security concerns at SEC.
section_title: Property and Equipment
paragraphs: SEC’s property and equipment consists of general-purpose equipment  used by the agency; capital improvements made to buildings leased by  SEC for office space; and internal-use software development costs for  projects in development and production. SEC acquired approximately $27  million dollars in property and equipment during fiscal year 2007.
Similar to our last year’s audit, during the course of testing fiscal year 2007  additions, we noted numerous instances of inaccuracies in recorded  acquisition costs and dates for property and equipment purchases, as well  as unrecorded property and equipment purchases, and errors in amounts  capitalized and amortized for internal-use software projects. In addition,  errors were carried forward from the previous year. These systemic errors  did not materially affect the balances reported for property and equipment  or the corresponding depreciation/amortization expense amounts in SEC’s  financial statements for fiscal year 2007; however, these conditions  evidence a significant deficiency in control over the recording of property  and equipment that affects the reliability of its recorded balances for  property and equipment. Specifically, SEC lacks a process that integrates  controls over capitalizing and recording property and equipment  purchases. For example, SEC does not have a formalized, documented  process for comparing quantity and type of item received against the  corresponding order for property purchases. In addition, SEC does not  have sufficient oversight of the recording of acquisition dates and values  of the capitalized property. Further, SEC’s lack of an integrated financial  management system for accounting for property and equipment, as  discussed above, requires compensating procedures, which were not  effective, to ensure that manual calculations, such as those for  depreciation and amortization, are accurate. Until it has a systemic  process that incorporates effective controls over receiving, recording,  capitalizing, and amortizing property and equipment purchases, SEC will  not have sufficient assurance over the accuracy and completeness of its  reported balances for property and equipment.
section_title: Accounting for Budgetary Resources
paragraphs: For fiscal year 2007, SEC incurred $877 million in obligations, which  represents legal liabilities against funds available to SEC to pay for goods  and services ordered. At September 30, 2007, SEC reported that the  amount of budgetary resources obligated for undelivered orders was $255  million, which reflects obligations for goods or services that had not been  delivered or received as of that date. In our testing of undelivered order  transactions for this year’s audit, we identified several concerns over  SEC’s accounting for obligations and undelivered orders. Specifically, we  found numerous instances in which SEC (1) recorded obligations prior to  having documentary evidence of a binding agreement for the goods or  services, (2) recorded invalid undelivered order transactions due to an  incorrect posting configuration in SEC’s general ledger, and (3) made  errors in recording new obligations and deobligations due to the use of  incorrect accounts and by posting incorrect amounts in the general ledger.
The majority of exceptions related to these issues, amounting to  approximately $76 million, were corrected by SEC through adjusting  journal entries. While the remaining uncorrected amounts did not  materially affect the balances on the Statement of Budgetary Resources at  September 30, 2007, ineffective processes that caused these errors  constitute a significant deficiency in SEC’s internal control over recording  and reporting of obligations, and puts SEC at risk that the amounts  recorded in the general ledger and reported on SEC’s Statement of  Budgetary Resources are misstated. Specifically, SEC’s general ledger is  not configured to properly post related entries, thereby resulting in the  need to routinely correct entries. Extensive reviews of the budgetary  transactions, along with significant adjusting journal entries, are needed to  compensate for the system limitations. The errors in recording new  obligations and deobligations that we found in our audit indicate a lack of  effective review over those transactions. Further, SEC does not have  policies or internal controls to prevent recording of obligations that are  not valid. Recording obligations prior to having documentary evidence of a  binding agreement for the goods and services is a violation of the  recording statute, and may result in funds being reserved unnecessarily  and therefore made unavailable for other uses should the agreement not  materialize. In addition, early recording of obligations may result in  charging incorrect fiscal year funds for an agreement executed in a later  fiscal year.
section_title: Compliance with Laws and Regulations
paragraphs: Our tests for compliance with selected provisions of laws and regulations  disclosed no instances of noncompliance that would be reportable under  U.S. generally accepted government auditing standards or OMB audit  guidance. However, the objective of our audit was not to provide an  opinion on overall compliance with laws and regulations. Accordingly, we  do not express such an opinion.
section_title: Consistency of Other Information
paragraphs: SEC’s Management’s Discussion and Analysis and other accompanying  information contain a wide range of data, some of which are not directly  related to the financial statements. We do not express an opinion on this  information. However, we compared this information for consistency with  the financial statements and discussed the methods of measurement and  presentation with SEC officials. Based on this limited work, we found no  material inconsistencies with the financial statements or nonconformance  with OMB guidance. However, because of the internal control weaknesses  noted above, misstatements may occur in related performance  information.
section_title: Objectives, Scope, and Methodology
paragraphs: SEC management is responsible for (1) preparing the financial statements  in conformity with U.S. generally accepted accounting principles; (2)  establishing, maintaining, and assessing internal control to provide  reasonable assurance that the broad control objectives of FMFIA are met;  and (3) complying with applicable laws and regulations.
We are responsible for obtaining reasonable assurance about whether (1)  the financial statements are presented fairly, in all material respects, in  conformity with U.S. generally accepted accounting principles; and (2)  management maintained effective internal control, the objectives of which  are the following:    Financial reporting: Transactions are properly recorded, processed, and  summarized to permit the timely and reliable preparation of financial  statements in conformity with U.S. generally accepted accounting  principles, and assets are safeguarded against loss from unauthorized  acquisition, use, or disposition.
Compliance with applicable laws and regulations: Transactions are  executed in accordance with (1) laws governing the use of budgetary  authority, (2) other laws and regulations that could have a direct and  material effect on the financial statements, and (3) any other laws,  regulations, or governmentwide policies identified by OMB audit guidance.
We are also responsible for (1) testing compliance with selected  provisions of laws and regulations that could have a direct and material  effect on the financial statements and for which OMB audit guidance  requires testing and (2) performing limited procedures with respect to  certain other information appearing in SEC’s Performance and  Accountability Report. In order to fulfill these responsibilities, we    examined, on a test basis, evidence supporting the amounts and  disclosures in the financial statements;   assessed the accounting principles used and significant estimates made by    evaluated the overall presentation of the financial statements;    obtained an understanding of SEC and its operations, including its internal  control related to financial reporting (including safeguarding of assets)  and compliance with laws and regulations (including execution of  transactions in accordance with budget authority);    obtained an understanding of the design of internal controls related to the  existence and completeness assertions relating to performance measures  as reported in Management’s Discussion and Analysis, and determined  whether the internal controls have been placed in operation; tested relevant internal controls over financial reporting and compliance  with applicable laws and regulations, and evaluated the design and  operating effectiveness of internal control;   considered SEC’s process for evaluating and reporting on internal control  and financial management systems under the FMFIA; and tested compliance with selected provisions of the following laws and their  related regulations: the Securities Exchange Act of 1934, as amended;  the Securities Act of 1933, as amended;  the Antideficiency Act;  laws governing the pay and allowance system for SEC employees;  the Prompt Payment Act; and  the Federal Employees’ Retirement System Act of 1986.
We did not evaluate all internal controls relevant to operating objectives as  broadly defined by the FMFIA, such as those controls relevant to  preparing statistical reports and ensuring efficient operations. We limited  our internal control testing to controls over financial reporting and  compliance. Because of inherent limitations in internal control,  misstatements due to error or fraud, losses, or noncompliance may  nevertheless occur and not be detected. We also caution that projecting  our evaluation to future periods is subject to the risk that controls may  become inadequate because of changes in conditions or that the degree of  compliance with controls may deteriorate.
We did not test compliance with all laws and regulations applicable to  SEC. We limited our tests of compliance to those required by OMB audit  guidance and other laws and regulations that had a direct and material  effect on, or that we deemed applicable to, SEC’s financial statements for  the fiscal year ended September 30, 2007. We caution that noncompliance  may occur and not be detected by these tests and that this testing may not  be sufficient for other purposes.
We performed our work in accordance with U.S. generally accepted  government auditing standards and OMB audit guidance.
SEC’s management provided comments on a draft of this report. They are  discussed and evaluated below and are reprinted in appendix III.
section_title: SEC Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, SEC’s Chairman said he was  pleased to receive an unqualified opinion on SEC’s financial statements.   The Chairman discussed SEC’s plans to remediate this material weakness  before the end of fiscal 2008, and to address each of the findings and  recommendations identified during the audit.  The Chairman emphasized  SEC’s commitment to enhance its controls in all operational areas and to  ensure reliability of financial reporting, soundness of operations, and  public confidence in SEC’s mission.
The complete text of SEC’s comments is reprinted in appendix III.
section_title: Appendix I: Management’s Discussion and Analysis
section_title: Appendix II: Financial Statements
section_title: Appendix III: Comments from the Securities and Exchange Commission