Securities And Exchange Commission: Review of Fiscal Year 2003 and 2004 Budget Allocations
Published: 2004-07-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This report responds to a statement in the Conference Report on the Securities and Exchange Commission's (SEC) fiscal year 2004 appropriations directing GAO to study SEC's allocation of its increased funding for fiscal years 2003 and 2004. Historically, SEC has faced high staff turnover rates, long stretches of unfilled staff positions, and growing resource needs. Additionally, the agency has faced significant needs in its information technology area. In response to these trends and several high-profile corporate failures and financial scandals, Congress approved significant increases in SEC's appropriations to help improve oversight and increase public confidence in financial markets. This report builds on several reports GAO has issued on these issues. GAO was asked to review SEC's (1) allocation of its fiscal year 2003 and 2004 funds and (2) use of its information technology funding in fiscal year 2003 and its plan for 2004.
section_title: What GAO Found
paragraphs: Congress addressed SEC's human capital and workload challenges with a significant increase to SEC's appropriations for fiscal year 2003. SEC used over half of that increase to fund over 800 new positions primarily within its financial disclosure, enforcement, and examination areas. Although these allocations appear consistent with legislative directions, they were made without the benefit of an updated agencywide strategic plan, which was not approved until July 9, 2004. Although SEC received more flexible pay and hiring authority, SEC continues to face challenges filling critical vacancies, such as accountants. Officials cite competition from the private sector as a major factor. SEC's information technology (IT) budget increased from $46.6 million in fiscal year 2002 to over $100 million in fiscal year 2003. It increased another 20 percent to $120 million in fiscal year 2004. SEC used most of these large increases for maintenance and infrastructure needs, compared with new technology initiatives. Also, SEC's Office of Inspector General (OIG) issued a report detailing its concerns, which we share, about the decision-making process for IT capital investments. OIG made several recommendations to improve this process, and SEC staff have begun to take actions to address some of them. SEC commented that our review of its activities acknowledged the progress the agency has made and provided additional information about its activities since March.

section_title: Letter
paragraphs: This report responds to a statement in the Conference Report on the  Securities and Exchange Commission’s (SEC) fiscal year 2004  appropriations directing GAO to study SEC’s allocation of funding  increases provided in its fiscal year 2003 and 2004 budgets. As a result of  several high-profile corporate failures, major financial statement  accounting frauds, and mutual fund scandals, Congress increased SEC’s  budget to improve SEC’s oversight of financial markets to help restore  public confidence and protect investors. The Sarbanes-Oxley Act of 2002  (Sarbanes-Oxley) was enacted to protect investors by improving the  accuracy and reliability of corporate disclosures made pursuant to the  securities laws, and for other purposes. Sarbanes-Oxley authorized a  significant increase in SEC’s fiscal year 2003 appropriations to increase  human capital resources and to improve the agency’s technology. In fiscal  year 2003, SEC received a 45 percent increase in its appropriations, and  the act required SEC to efficiently and effectively use these funds.
Our objectives were to review (1) SEC’s allocation of its fiscal year 2003  funds and its plans for allocating funds in fiscal year 2004 and (2) SEC’s  use of its information technology (IT) funding in fiscal year 2003 and its  plans for IT spending in fiscal year 2004. In addressing these objectives, we  obtained and analyzed detailed information from SEC on its budget  allocations and IT decision-making process for fiscal years 2003 and 2004.  We also interviewed SEC officials to obtain their views on SEC’s budget  and IT decision-making processes. We performed limited data reliability  testing of SEC’s budget data by interviewing knowledgeable agency budget  officials and comparing the data with other published budget data. Based  on this analysis, we determined that they were sufficiently reliable for the  purpose of this report. Finally, we relied on relevant GAO and SEC Office  of Inspector General (OIG) reports on SEC’s budget and IT decision- making process. We conducted our work from February to July 2004 in  accordance with generally accepted government auditing standards. A  complete description of our methodology can be found in appendix I.
subsections: section_title: Background
paragraphs: Created by Congress in 1934, SEC’s primary mission is to protect  investors; maintain fair, honest, and efficient securities markets; and  facilitate capital formation. To fund its operations, SEC collects fees that  are deposited into a special SEC appropriations account to be used as  offsetting collections. These fees are charged to (1) public companies for  the registration of stocks and bonds for sale to investors, (2) national  securities exchanges and national securities associations when registered  securities and security futures are sold on or off exchanges through any  member of such an association, and (3) persons filing proxy solicitations  for mergers, consolidations, acquisitions, or sales of a public company’s  assets. In carrying out its mission, the agency has established four major  goals: (1) promote and enforce compliance with federal securities laws,  (2) sustain a flexible and effective regulatory environment, (3) promote  informed investment decision making, and (4) maximize its use of  resources. SEC works to achieve these goals through its various divisions  and offices. GAO has issued a number of reports and testimonies  addressing SEC’s staffing and workload and certain aspects of its human  capital and budget challenges.
subsections: section_title: Organizational Overview
paragraphs: As of September 30, 2003, SEC had 3,208 staff working in four divisions  and 18 offices in Washington, D.C., and in 11 regional and district offices.  Of these, approximately 44 percent were attorneys, 22 percent were  accountants or financial analysts, and 6 percent were investigators or  examiners. The remaining 28 percent included other professional,  technical, administrative, and clerical staff.
SEC oversees the activities of a variety of key market participants. In 2003,  SEC was responsible for overseeing 13 registered exchanges, the over-the- counter market, approximately 70 alternative trading systems, 11  registered clearing agencies, about 6,800 registered broker-dealers  employing over 700,000 registered representatives, almost 8,000 transfer  agents, over 5,000 investment companies, and approximately 8,000  registered investment advisers. In addition, over 17,000 companies that  have issued securities filed annual reports with SEC. SEC’s oversight  includes rule making, surveilling the markets, interpreting laws and  regulations, reviewing corporate filings, processing applications,  conducting inspections and examinations, and determining compliance  with federal securities laws.
section_title: SEC Staffing and Workload Issues
paragraphs: In our previous reports on SEC, we found that SEC faced high staff  turnover, ongoing vacancies, and increasing resource needs. Specifically,  in our September 2001 report, we noted that over 1,000 employees, or  about one-third of SEC staff, left the agency from fiscal years 1998 to 2000,  and that 280 positions remained unfilled in September 2001. In our March  2002 report, we stated that since 1996, SEC’s staff resources had not  grown commensurate with its workload. We noted that SEC tended to  develop its annual budget request based on the previous year’s  appropriation rather than on what it would actually need to fulfill its  mission. The result was that the modest growth in staff resources in the  1990s at SEC was insufficient to manage its workload. In addition, we  reported that additional funding was necessary to meet SEC’s IT needs.  Like the rest of the government, SEC’s challenges in the area of IT  continue to increase, and SEC staff must have the necessary tools to  successfully meet the agency’s increasing demands.
Changes in the securities markets contributed to the increase in SEC’s  workload. U.S. capital markets have experienced substantial growth in the  last two decades. The increased volume of shares traded in the U.S. stock  market in this period and an array of new products and market  participants have led to increasing demands on SEC’s regulatory capacity.  The 1990s also witnessed tremendous growth in the internationalization of  the U.S. securities market. In addition, many more individuals became  investors in the U.S. stock market through buying shares in mutual funds.  This further elevated SEC’s importance as a regulator.
section_title: Congress Takes Action to Address SEC’s Human Capital and Budget Challenges
paragraphs: SEC’s staff issues and a series of corporate failures and accounting  scandals, including the bankruptcies of Enron in December 2001 and  WorldCom in July 2002, caught Congress’s attention and raised significant  concern about SEC’s ability to effectively carry out its mission. Congress  recognized SEC’s challenges and enacted a number of legislative changes  to address them, including  the Investor and Capital Markets Fee Relief Act, which rationalized SEC’s  fee structure and exempted SEC from general federal pay restrictions and  provided the agency with pay parity—the authority necessary to bring  salaries in line with those of other federal financial regulators.
Sarbanes-Oxley, which authorized appropriations of $776 million to the  agency in the fiscal year 2003 budget. SEC increased its initial fiscal year  2003 budget request of $466 million to $769 million in part because of the  level authorized in Sarbanes-Oxley. The Consolidated Appropriations  Resolution, 2003, in which Congress appropriated $716 million to the  agency for fiscal year 2003, directed the additional funding to be used in  certain areas. First, it directed SEC to fund pay parity, which at that time  had not yet been fully implemented. Sarbanes-Oxley also directed that   the new funding be used to fund information technology, security  enhancements, and recovery and mitigation activities in light of the  terrorist attacks of September 11, 2001. In addition, SEC was directed to  fund no fewer than 200 additional professional staff positions to  strengthen existing program areas, and to increase its oversight of auditors  and audit services. Figure 1 shows the change in SEC’s budget between  fiscal years 2002 and 2004. the Accountant, Compliance and Enforcement Staffing Act of 2003, which  provided SEC with relief from competitive hiring requirements for certain  positions. The legislation was intended to enable SEC to expedite the  hiring of accountants, economists, and examiners so that the agency could  more quickly fill new positions, including those created after Sarbanes- Oxley.
section_title: Budget Increases Have Funded New Staff Positions, but Many Remain Unfilled
paragraphs: SEC used much of its fiscal year 2003 increased appropriations to fund  over 842 new staff positions. SEC’s financial disclosure, enforcement, and  examinations areas received most of the newly funded positions. Among  the divisions receiving the largest increases were the Divisions of  Enforcement, Corporation Finance, and the Office of the Chief Accountant  (OCA), which received double-digit increases to their budgets in 2003 and  are expected to receive even greater increases in 2004. In addition, SEC  used part of its fiscal year 2003 appropriations to fund pay parity for  existing staff, which gave the agency additional flexibility to recruit and  retain staff. However, many of these newly funded positions remain  unfilled because SEC continues to face hiring challenges for certain  positions. Officials say that while certain laws have helped speed up the  hiring process, they are facing increased competition from the private  sector.
subsections: section_title: Budgetary Resources Were Focused on New Staff Positions for Financial Disclosure, Enforcement, and Examination Activities
paragraphs: SEC used its increased appropriations between 2002 and 2004 in its  financial disclosure, enforcement, and examination areas primarily to fund  new positions. As shown in table 1, the offices and divisions showing the  largest increases in spending between 2002 and 2003 were the Divisions of  Enforcement and Corporation Finance, regional offices, OCA, and IT.  Between 2003 and 2004, the areas expected to receive the largest increases  in spending are OCA, the Divisions of Corporation Finance and  Enforcement, regional offices, IT, and the Office of Compliance  Inspections and Examinations (OCIE).
As we reported in July 2003, SEC made its allocation decisions without the  benefit of an updated strategic plan. In lieu of using an updated strategic  plan, it appears that a special study of SEC operations has provided a basis  for SEC in determining the need for 842 new positions in 2003. In 2002 the  former Chairman directed SEC staff to conduct an internal study of SEC’s  current operations, workload, resource allocations, methods for assigning  and managing work, and measures of performance, productivity, and  quality of effort. Soon after the current Chairman joined SEC in February  2003, he asked that the division and office heads prepare analyses to  justify their staffing requests. This included the total number of staff  needed to accomplish each division/office’s objectives, the organizational  changes needed to accommodate the new staff being requested, and a  breakdown of the types of staff being requested by profession. In addition,  an SEC official said that the Chairman ultimately approved each division’s  and office’s justification to arrive at the final allocation for the 842 new  positions. Table 2 shows SEC’s final allocation of the 842 new positions  among divisions/offices.
SEC’s staff allocations appear generally consistent with legislative  expectations and what is known about SEC’s current operating  environment. However, because SEC’s staff positions were allocated  without the benefit of an updated strategic plan, it will be difficult for SEC  to assess the appropriateness or effectiveness of the use of its much larger  budget. Since 2002 we have reported that although SEC had a strategic  plan and had periodically adjusted staffing to fulfill basic obligations, the  agency traditionally had not engaged in a systematic re-evaluation of its  programs and activities in light of current and emerging challenges. We  further noted that with a current strategic plan that identifies the agency’s  key mission-related goals and outlines the agency’s priorities, SEC could  better determine and deploy resources needed to fulfill its mission. In  response to our concerns and the significant budget increase in fiscal year  2003, the current SEC chairman instructed SEC staff to draft a new  strategic plan. SEC’s new strategic plan was approved by the commission  on July 9, 2004.
SEC plans to use the majority of its additional staff resources within the  Division of Corporation Finance, OCA, Division of Enforcement, and OCIE  in order to enhance its regulatory and oversight activities.
subsections: section_title: Corporation Finance and OCA
paragraphs: Between 2002 and 2003, Corporation Finance and OCA’s spending  increased 17 percent and 25 percent, respectively, and planned spending is  expected to increase by 39 percent and 55 percent in 2004. Both  Corporation Finance and OCA administer SEC’s full disclosure program.  These programs are responsible for ensuring that investors are provided  with material information from reporting public companies. They also help  to deter fraud and misrepresentation in public offerings, trading, voting,  and tendering of securities. As shown in table 2, Corporation Finance,  which is responsible for reviewing corporate disclosures of public  companies such as initial stock offerings and quarterly financial  statements in order to monitor and enhance compliance with disclosure  and accounting requirements, received funding for 175 new accountants  and attorneys. This increase in the number of staff was due primarily to a  Sarbanes-Oxley requirement for SEC to conduct reviews of reporting  public companies once every three years or approximately one-third of all  reporting public companies per year. According to budget estimate  documents, SEC was able to review only 23 percent of all reporting issuers  in 2003, thus falling short of its mandated goal of 33 percent.
OCA received funding for 20 new positions. OCA is responsible for  establishing and enforcing accounting and auditing policy in order to  enhance transparency, relevance, and reliability of financial reporting and  to improve the professional performance of public company auditors.  According to an SEC official, these new positions would assist with OCA’s  increased responsibility to oversee activities associated with the newly  created Public Company Accounting Oversight Board, which is expected  to be heavily involved in the quality review process and development and  interpretation of auditing standards, among other things.
section_title: Division of Enforcement
paragraphs: Division of Enforcement spending increased 22 percent in 2003 and is  projected to increase an additional 26 percent in 2004. The division  analyzes information from diverse sources that may indicate past or  immediate violations of federal securities laws, investigates possible  violations of federal securities laws, recommends SEC action when  appropriate in federal court or before an administrative law judge, and  negotiates settlements on behalf of SEC. Of the SEC’s 842 new positions,  the division was authorized to hire 83 staff in Washington, D.C., and 111  positions in SEC’s regional and district offices. According to SEC budget  documentation, staffing will increase in the division by approximately 19  percent over 2003 levels in order to help implement Sarbanes-Oxley. The  additional positions will add to the program’s accounting and litigation  efforts, as well as investigative and surveillance activities. Division of  Enforcement officials told us that the division has reorganized staff in its  Office of Chief Counsel by functional lines rather than by geographical  location. The functional lines include investment adviser and mutual  funds, broker-dealers and markets, and corporate accounting. The intent  of this reorganization is to increase the staff’s subject matter expertise and  better detect emerging issues.
section_title: Office of Compliance Inspections and Examinations
paragraphs: Between 2003 and 2004 OCIE’s spending is expected to increase by 47  percent. OCIE is responsible for administering SEC’s nationwide  examination and inspection program for self-regulatory organizations,  broker-dealers, transfer agents, investment companies, and investment  advisers. Similar to the Division of Enforcement, OCIE staff is primarily  located in Washington, D.C., and SEC’s 11 regional and district offices.  OCIE was allocated 42 new positions for Washington, D.C., and  approximately 233 new positions among SEC’s 11 regional and district  offices, for a total of 275 new positions. According to information provided  by SEC, the additional staff would allow SEC to implement a new risk- based inspection program of the riskiest investment advisers and to allow  SEC to have more frequent oversight of internal controls of large broker- dealers, a greater on-site presence, and more frequent inspections of self- regulatory organization surveillance and disciplinary systems.
section_title: Budgetary Resources Were Also Used to Fund Pay Parity
paragraphs: In addition to funding new positions, SEC used part of its increased  appropriations to fund pay parity. Sarbanes-Oxley authorized $102.7  million for increases associated with pay parity. However, SEC officials  said they could not provide the specific amounts that were allocated to  fund pay parity in 2003 for two reasons. First, in May 2002, acting on its  new compensation authority, SEC implemented a new system that  established a pay structure more comparable with other federal financial  regulators. This new pay structure increased base pay for attorneys,  accountants, and examiners to levels similar to those of other federal  financial services regulators. More specifically, the structure of this new  system consists of 20 grade levels, some with 31 steps. This new system  has also provided additional compensation based on performance and has  established new pay categories to compensate staff in supervisory  positions. Second, a large number of employees came on board in 2003  under the new pay structure that had already incorporated pay parity. As a  result, SEC officials said it would be difficult to segregate the funding  amounts associated with the new pay structure and salaries for new  employees from the actual amounts used to fund pay parity.
section_title: SEC Continues to Face Challenges in Hiring for Certain Positions
paragraphs: SEC continues to face agencywide challenges in hiring and retaining  sufficient numbers of quality staff to achieve its mission. As shown in table  3, between September 2003 and March 2004, SEC filled 328 of 782  vacancies, which amounted to a 42 percent decrease in the number of  vacancies within that time. The regional/district offices made the most  progress in hiring, decreasing their vacancies 72 percent by filling 210 out  of 294 vacant positions. The Division of Corporation Finance appears to  face the most difficulty in filling its vacancies, filling only 56 out of the 193  vacant positions between September 2003 and March 2004. According to  an SEC official, Corporation Finance has continued to focus on its hiring  efforts and as of March 31, 2004, the division had 41 pending hires  scheduled to come on board by August 2004, of which 29 were  accountants and the remaining 12 were attorneys. Further, the official said  the division’s goal is to hire as many qualified certified public accountants  as soon as possible, with a goal of having 250 accountants within the  division. The remaining staff will be attorneys and legal staff for support in  providing information to the public, and other functions not requiring an  attorney.
As we reported in July 2003, SEC was able to expedite hiring under the  Accountant, Compliance and Enforcement Staffing Act of 2003. SEC staff  told us that bypassing competitive processes has helped them hire  individuals for accountant, compliance examiner, and economist positions  more quickly. However, officials in the Corporation Finance, Investment  Management, and Enforcement divisions said they still face considerable  difficulty in hiring accountants. This is due to competition from the private  sector—resulting from public companies needing to comply with  Sarbanes-Oxley requirements—as well as from competition with the  Public Company Accounting Oversight Board. An official from the  Division of Corporation Finance told us that they had retained the services  of a national recruiting firm in order to recruit accountants.
In addition, SEC officials explained that operating under a continuing  resolution in fiscal year 2003 and the timing of SEC’s new hiring authority  did not allow much time for recruiting activities before the end of the year.  Given the late appropriation and hiring challenges in 2003, SEC had  difficulties filling its new positions and was unable to spend $120 million  of its increased appropriations during 2003. In the fiscal year 2004  appropriations act, this unobligated balance was appropriated to SEC for  use in 2004. Similarly, SEC budget documents reported that $20 million  would carry over from 2004 into the 2005 budget. According to an SEC  official, the $20 million carryover included in the 2005 budget represents  106 new positions requested for 2005, in anticipation of bringing those new  employees on board in 2005 or subsequent years.
As of June 2004, SEC has yet to staff its new Office of Global Security  Risk. In the Conference Report on the 2004 appropriations legislation, SEC  was directed to establish an Office of Global Security Risk within the  Division of Corporation Finance. This was due in part to concerns that  American investors may be unknowingly investing in companies with ties  to countries that sponsor terrorism and countries linked to human rights  violations. According to language in the Conference Report, a company’s  association with sponsors of terrorism and human rights abuses, no matter  how large or small, can have a material adverse effect on a public  company’s operations, financial condition, earnings, and stock prices. As a  means of protecting American investors’ savings and to disclose these  business relationships to investors, this office is required, among other  things, to (1) establish a process by which the SEC identifies all companies  on U.S. exchanges operating in State Department-designated terrorist- sponsoring states, (2) ensure that all companies sold on U.S. exchanges  operating in State Department-designated terrorist-sponsoring states are  disclosing such activities to investors, and (3) coordinate with other  government agencies to ensure the sharing of relevant information across  the federal government. In addition, SEC was directed to provide Congress  with quarterly reports on the activities of the Office of Global Security  Risk. According to an SEC official, in May 2004 SEC filled the Chief  position for the office. The next steps will be for the Chief to begin the  process of developing plans for the office, including staffing needs.  According to SEC, it plans to provide its first report to the Subcommittee  on Commerce, Justice, State, the Judiciary, and Related Agencies, House  Committee on Appropriations, by late July.
section_title: SEC Allocated Majority of Information Technology Budget to System Maintenance and Infrastructure; Concerns Exist about Investment Decision- Making Process
paragraphs: Sarbanes-Oxley directed SEC to provide additional funding for IT in 2003,  with the general goal of improving operational efficiency. SEC continued  to use most of the additional funding to address hardware and software  maintenance and technology infrastructure needs. The remaining portion  of the agency’s IT resources was used to fund new mission-related  initiatives. With regard to SEC’s decision-making process for IT capital  investment, SEC’s OIG has recently issued a report stating that while SEC  has made progress in establishing an IT investment process that complies  with applicable laws and regulations, and incorporates best practices from  the public and private sectors, the process is not in full compliance with  applicable laws and regulations. Further, the OIG report pointed out that  SEC has not finalized its IT strategic plan.
subsections: section_title: SEC Continues to Allocate the Majority of Its Information Technology Budget to Hardware and Software Maintenance and Technology Infrastructure Needs
paragraphs: We reported in March 2002 that SEC’s IT systems and funding gaps were  contributing to inefficiencies at the agency. SEC officials at the time  stated that SEC’s 2002 IT budget of $46.6 million had been used primarily  for hardware and software maintenance and technology infrastructure  needs, and that additional funding was needed for capital improvements  such as a nationwide network to support the examination and inspection  functions. Similarly, in 2004 officials said they needed to spend most of the  funding to upgrade SEC’s IT infrastructure to support new mission-related  IT programs. Sarbanes-Oxley highlighted the importance of improving  SEC’s technological capabilities by authorizing SEC to increase its IT  budget. As a result, SEC’s 2003 IT budget was increased by over 100  percent, to $100.9 million. In 2004, SEC’s IT budget was increased again to  $120.5 million, or another 20 percent.
SEC’s IT budget is under the purview of both its Office of Information  Technology (OIT) and a separate council of senior staff from the major  program divisions and offices. OIT is responsible for managing costs  associated with ongoing operations and maintenance, application and  infrastructure upgrades, and enhancements to existing systems. SEC’s  Information Officers Council (IOC) and the Information Technology  Capital Planning Committee (ITCPC) manage the remainder of its IT  budget, which consists of new technology initiatives requested by SEC’s  program offices.
With a significant increase in its IT budget, SEC continues to allocate the  majority of these resources to fund hardware and software maintenance  and infrastructure needs. As shown in figure 2, in 2003, about 76 percent,  or $68.2 million, of SEC’s IT budget went to hardware and software  maintenance and infrastructure needs, and a planned 70 percent, or $84.1  million, is budgeted for the same needs in 2004. Approximately 24 percent,  or $21.4 million, of SEC’s IT budget in 2003 was used to fund new IT  initiativesprojects that have the potential to improve the efficiency of  SEC’s operationsand a planned 30 percent, or $36.4 million, is planned  for 2004. In addition, figure 2 also shows that while most of the funding for  new technology initiatives went to mission officessuch as the Division of  Enforcement and OCIE—a notable amount of funding also went to  mission-support offices, such as the Office of Economic Analysis and the  Office of Filings and Information Services. Specifically, in 2003  approximately $14 million went to fund projects in mission offices, and  $7.3 million was used to fund projects in mission-support offices.
Of the $21.4 million of SEC’s IT budget allocated to new technology  initiatives in 2003, SEC funded 40 separate IT projects. As of May 2004,  SEC is scheduled to fund six additional IT projects. A number of these  new initiatives provide for the electronic filing of reports, documents, and  information, which had previously been paper-based. For example, one  project provides for the electronic filing of ownership reports through the  EDGAR (Electronic Data Gathering Analysis and Retrieval) system, a  specific requirement of Sarbanes-Oxley. Other projects provide for the  electronic filing of materials from transfer agents, self-regulatory  organizations, alternative trading systems, and broker-dealers. In addition,  some of the projects are designed to improve SEC’s ability to review and  analyze large amounts of data. For example, one project would establish  an improved framework for the gathering, formatting, and analyzing of  information collected by OCIE. Currently, the gathering and analysis of  information in OCIE is burdened by data collection in a variety of formats.  This makes it difficult and time consuming to combine the data sets into  one in order to conduct analysis.
In addition, SEC continued to fund a number of its multiyear IT initiatives,  including    Electronic Document Management System. Officials stated that the  document management and imaging initiative is currently being piloted in  Division of Enforcement offices in Washington, D.C., Boston, Philadelphia,  New York, and Chicago and that electronic imaging has been completed  for approximately 50 percent of all documents in Washington and 25  percent of all documents in New York. They stated that for the remaining  pilot offices, documents would continue to be reviewed to determine what  should be imaged. The officials noted that the pilot should be completed  by the early fall of 2004.
EDGAR Modernization. SEC has taken a first step toward making EDGAR  a database with more analytical capabilities for end users. SEC officials  stated that within the last year, SEC established the capability for EDGAR  to accept certain data from users in a structured format. According to SEC  officials, SEC’s Chairman established a task force to look into data  tagging, which would allow users to retrieve information from EDGAR in  order to conduct trend analysis. The task force is expected to report by  the end of July 2004 on how to proceed.
Disaster Recovery. SEC officials stated they have made progress in  addressing business continuity planning efforts related to disaster  recovery. Officials stated they have established alternative data centers  and continuity planning sites, have upgraded the network to prevent the  possibility of a single point of failure in the network, and are currently  building a facility to allow senior staff to move off site in the event of a  disaster.
Telecommuting. SEC officials stated that SEC’s capacity for  telecommuting continues to improve across the agency. These officials  stated that due to improved dial-up and wireless connection access, SEC  employees’ remote access to certain software applications has improved  with the deployment of new laptops in the Division of Enforcement  offices.
section_title: SEC’s Office of Inspector General Raised Concerns about SEC’s Information Technology Capital Investment Decision- Making Process
paragraphs: In the summer of 2001, SEC began revising its IT capital investment  decision-making process. The revisions were based on recommendations  in an audit report issued by SEC’s OIG in August 2001 that reviewed SEC’s  IT capital investment decision-making process in order to improve  communication between OIT and SEC staff. Beginning in 2002, SEC  developed a new decision-making process for IT investments, with SEC’s  IOC and ITCPC responsible for managing the portion of SEC’s IT budget  related to new technology initiatives. Specifically, IOC, which includes  program office senior staff familiar with both the business and IT needs  within their programs, receives and evaluates specific IT investment  proposals submitted by SEC’s divisions and program offices. Based on  their review, IOC makes recommendations regarding which projects  should be approved for funding. These recommendations are forwarded to  ITCPC, a more senior council of division directors and program office  heads, for final funding decisions.
Although SEC has taken steps to develop a formal decision-making  process for IT investments, in a 2004 follow-up report, OIG raised  concerns about the current state of this process. According to the OIG  report, OIG evaluated SEC’s compliance with the Clinger-Cohen Act of  1996 (CCA) by applying GAO’s IT Investment Management Framework for  Assessing and Improving Process Maturity (IT IM Maturity Model). In  general, GAO’s framework includes standards for the selection, control,  and evaluation of federal information technology investments, in  accordance with the fundamental IT governance mandates of the CCA.  OIG found that SEC has made progress in establishing an IT investment  process that complies with applicable laws and regulations and  incorporates best practices from the public and private sectors. However,  OIG also identified some concerns. For example, OIG found that SEC’s  process still did not meet the minimum criteria of GAO’s IT IM Maturity  Model because SEC had not assigned specific responsibility or delegated  appropriate authority for establishing a compliant and effective decision- making process in order to strengthen the governance over the process.  Based on this review, OIG concluded, and we generally agree, that the lack  of clearly defined and formally approved IT governance policies, criteria,  and procedures resulted in an undisciplined IT investment decision- making process subject to broad interpretation by SEC management,  which lacked auditable and enforceable standards and controls.
OIG made a number of recommendations to address SEC’s IT investment  decision-making governance issues, including (1) the development of a  work plan for implementing the OIG’s recommendations; (2) formalizing  charters, roles, and responsibilities for the Chief Information Officer  (CIO), IOC, ITCPC, and other relevant IT governance bodies, including  delegating to the CIO sufficient authority to effectively administer, control,  implement, and enforce the IT capital planning responsibilities; (3)  revising the project funding process and associated investment thresholds  and criteria; (4) improving the strategic planning for IT investments, which  includes finalizing an IT specific strategic plan that establishes the  strategic direction for IT capital planning and tactical operations within  SEC and establishing a single agencywide IT control process and structure  for the entire IT budget to select, prioritize, and fund all IT investments to  be managed by IOC and ITCPC; (5) linking IT project planning with SEC’s  enterprise architecture; (6) improving the tracking of IT projects in  progress; and (7) supporting IOC and ITCPC with adequate staff.
SEC has taken steps to implement some of the recommendations  contained in the OIG’s report. According to SEC officials, staff are in the  process of formalizing the charters, roles, and responsibilities for the CIO,  IOC, ITCPC, and other relevant governance bodies by reviewing the  pertinent legislation, Office of Management and Budget requirements, and  other relevant guidance. Further, the SEC Chairman recently delegated to  the CIO the necessary authority to issue and enforce agencywide IT policy  and regulations, and to implement the recommendations in the OIG report.  In addition, SEC officials stated that starting with the 2004 IT budget, SEC  will establish a single agencywide IT control process and structure for the  entire IT budget, managed by IOC and ITCPC, to select, prioritize, and  fund all IT investments.
SEC officials have articulated a preliminary plan to respond to the  remaining OIG recommendations. SEC officials stated that their ability to  respond to the OIG’s recommendation depends on how quickly they can  hire the staff responsible for managing the capital planning process. Most  importantly, the Senior Program Manager position for the project  management/capital planning groupwho will be responsible for seeing  that the OIG’s recommendations are responded tois currently vacant.  Therefore, officials stated that they would most likely be able to address  25 percent to 33 percent of the OIG’s recommendations by the end of fiscal  year 2004.
section_title: Observations
paragraphs: Since Congress increased SEC’s budget to improve the agency’s oversight  of financial markets in fiscal year 2003, SEC has made significant progress  in hiring staff and is continuing its efforts to fill the remaining vacancies.  The number of vacancies appears reasonable, given that SEC had to  contend with competition from the private sector and a continuing  resolution that limited the time SEC had for recruiting. SEC has also taken  steps to improve its information technology by using the increased funding  to augment its budget for technologyand, in turn, upgrade its  infrastructureand by continuing to address the OIG’s concerns about the  agency’s decision-making process on IT spending. Although SEC’s staff  allocations appear to be consistent with Sarbanes-Oxley, these allocations  were made without the benefit of a strategic plan. As we have previously  noted and the SEC Chairman has agreed, a comprehensive strategic plan  could provide SEC management with a basis for determining whether  SEC’s resource level and allocations, as well as its processes and  organizational structure, are tied to the mission and goals of the agency.  Subsequently, SEC completed updating its strategic plan on July 9, 2004.
section_title: Agency Comments and Our Evaluation
paragraphs: SEC provided written comments on a draft of this report that are reprinted  in appendix II. SEC commented that while more work remains, our review  of SEC activities acknowledged the progress the agency has made within a  constrained time frame. As discussed in its letter, the SEC has taken a  number of actions to address some of the issues raised in our report. First,  since March, SEC has made additional progress hiring about 130 new  employees, and approximately 130 others have committed to start with  SEC before the end of the fiscal year. SEC anticipates that by the end of  the fiscal year, it will be able to reduce the vacancy level to its normal  attrition.
Second, we are pleased that the Commission has recently approved the  agency’s strategic plan for fiscal years 2004-2009. This strategic plan could  serve as a basis to guide SEC in using its additional resources effectively  and for its congressional overseers to evaluate SEC’s progress in fulfilling  its mission and meeting its goals. We look forward to reviewing and  commenting on this updated strategic plan as part of our ongoing review  of SEC’s operations.
Third, SEC noted that in the past few months, it has imaged, and made  available electronically, investigatory materials formerly available only in  paper throughout headquarters and regional and district offices. SEC also  acknowledged it is “keenly aware” of the need to respond promptly and  comprehensively to concerns raised by the SEC OIG and GAO and to  ensure that its IT resources are used wisely and effectively. We continue to  believe that leveraging information technology will effectively support  SEC’s activities, and we are encouraged by the agency’s ongoing efforts.
Finally, SEC reiterated the steps it has taken in launching the Office of  Global Security Risk. SEC noted that it plans to provide the first quarterly  report to the Subcommittee on Commerce, Justice, State, the Judiciary,  and Related Agencies, House Committee on Appropriations, by late July.  SEC officials also provided us with some technical comments, which we  incorporated as appropriate.
We are sending copies of this report to the Chairman and Ranking  Minority Member of the Senate Committee on Governmental Affairs; the  Chairman and Ranking Minority Member of the House Committee on  Government Reform; and the Chairman and Ranking Minority Member of  the Subcommittee on Government Efficiency and Financial Management,  House Committee on Government Reform. We are also sending copies to  the Chairman of SEC and will make copies available to others upon  request. The report is also available at no charge on the GAO Web site at  http://www.gao.gov.
Please contact me or Karen C. Tremba at (202) 512-8678 if you or your  staff have any questions concerning this report. Toayoa D. Aldridge, James  Lawrence, David Pittman, and Marc Molino made key contributions to this  report.
section_title: Appendix I: Scope and Methodology
paragraphs: To describe budget and staff allocations, we collected budgetary data for  the major Securities and Exchange Commission (SEC) divisions and  offices from SEC’s Office of the Controller and staffing data for the major  offices and divisions from the SEC payroll system. We also obtained  information from SEC’s annual budget request and internal memos  regarding staff allocations. We interviewed Office of the Executive  Director officials to obtain information on SEC’s process for distributing  positions and corroborated this information using existing GAO work,  including interviews with officials from various SEC divisions and offices.  We performed limited data reliability testing of SEC budget data by  interviewing knowledgeable agency budget officials and comparing the  data with other published budget data. Based on this analysis, we  determined that the data were sufficiently reliable for the purpose of this  report.
To describe SEC’s allocation of funding for information technology (IT),  we analyzed documents from the Information Officers  Council/Information Technology Capital Planning Committee (IOC/ITCPC)  proceedings. The various documents included project requests from  program offices, meeting minutes, project approval memoranda (including  funding amounts), and Office of Information Technology (OIT) budget  documents. We verified IOC/ITCPC information by interviewing OIT  officials in order to corroborate our findings. We relied on SEC’s Office of  Inspector General (OIG) to describe the process for making IT  investments and the related problems identified within this process. In  addition, we reviewed the SEC OIG’s evaluation of SEC’s IT capital  investment decision-making process using GAO’s IT Investment  Management Framework. We also relied on previous GAO work on SEC’s  IT systems.
We conducted our work from February 2004 to July 2004 in accordance  with generally accepted government auditing standards.
section_title: Appendix II: Comments from the Securities and Exchange Commission