Securities And Exchange Commission: Continued Management Attention Would Strengthen Internal Supervisory Controls
Released: 2013-04-18T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Recent high-profile securities frauds have raised questions about the internal controls that SEC has in place to help ensure that staff carry out their work completely and in a manner consistent with applicable policies and procedures. Section 961 of the Dodd-Frank Act directs SEC to annually assess and report on internal supervisory controls for staff performing examinations, corporate financial securities filing reviews, and investigations. The act also requires GAO to review SEC's structure for internal supervisory control applicable to staff working in those offices. This report examines the (1) steps the offices took to develop an internal supervisory control framework; (2) internal supervisory controls each office has implemented; and (3) extent to which the internal supervisory controls have operated as intended. GAO reviewed each office's section 961 assessments and reports; analyzed the offices' internal supervisory control framework; and tested a sample of 60 supervisory controls using random samples and nonprobability selections.

section_title: What GAO Found
paragraphs: After the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) in 2010, the Securities and Exchange Commission's (SEC) Office of Compliance Inspections and Examinations, Division of Corporation Finance, and Division of Enforcement (herein "the offices") established a working group that developed an internal supervisory control framework. Internal supervisory controls include the processes established by management to help ensure that procedures applicable to staff are performed completely, consistent with applicable policies and procedures, and remain current. The overall control framework is generally consistent with federal internal control standards, which includes identifying and assessing risks, identifying and assessing internal controls, and reporting the results of testing to management and Congress.

As part of developing and applying an internal supervisory control framework, the offices each identified internal supervisory controls to mitigate risks that could undermine their ability to consistently and competently carry out their responsibilities. These internal supervisory controls are built into the offices' work processes--that is, the processes they use to carry out examinations, financial securities filing reviews, and investigations--and range from specific supervisory review and approval activities to management reports used to monitor the processes as a whole. For example, within Enforcement, supervisors must review and approve staff recommendations that a tip, complaint, or referral be closed without further investigation. Many of the offices' internal supervisory controls existed prior to the development of SEC's internal supervisory control framework; others were developed through the process of developing the framework.

GAO identified deficiencies in about half of the 60 internal supervisory controls it tested. Specifically, GAO found that for 27 internal supervisory controls (1) the description of the control activity did not accurately reflect policy or practice; (2) documentation demonstrating execution of the control was not complete, clear, or consistent; or (3) the controls lacked clearly defined control activities. These control deficiencies may not prevent management from detecting whether the activities of the offices are conducted completely and in accordance with policy. However, similarities in the nature of deficiencies across all three offices suggest that management attention to the design and operation of internal supervisory controls is warranted. Federal internal control standards state that control activities should enable effective operation and have clear, readily available documentation. The offices have addressed or have been taking steps to address all of the 27 identified deficiencies. Some steps have been taken based on the offices' section 961 assessments. SEC addressed other deficiencies during GAO's review after discussions with GAO detailing the identified deficiency. Not enough time has passed for GAO to assess the effectiveness of these changes. Ensuring that all internal supervisory controls have clearly defined activities and clear, readily available documentation demonstrating execution of the control would provide SEC management with better assurance that policies were being executed as intended and strengthen SEC's internal supervisory control framework.

section_title: What GAO Recommends
paragraphs: To help ensure that controls are properly designed and operating effectively, SEC should make certain that existing internal supervisory controls and any developed in the future have clearly defined activities and clear and readily available documentation demonstrating execution of the activities. SEC agreed with GAO's recommendation.

section_title: Letter
paragraphs: The mission of the Securities and Exchange Commission (SEC) is to  protect investors; maintain fair, orderly, and efficient securities markets;  and facilitate capital formation. To meet its goals, SEC requires public  companies to disclose meaningful financial and other information to the  public, examines firms it regulates, and investigates potential violations of  securities law. SEC typically identifies potential violations of securities law  and brings hundreds of civil enforcement actions against individuals and  companies each year. However, the failure of the agency to detect high- profile cases of fraud in recent years—such as the multi-billion dollar  fraud committed by Bernard Madoff Investment Securities, LLC—has  caused some members of Congress and SEC’s Office of Inspector  General (OIG) to question SEC’s ability to identify and stop financial  fraud. Some of these questions have focused on whether SEC has  adequate internal controls for conducting its work.

With an effective internal control system in place, management can deal  with rapidly changing environments and shifting priorities. Internal  controls also promote efficiency, reduce risk, and help ensure the  reliability of financial statements and compliance with laws and  regulations. To be effective, a system of internal control must incorporate  a series of actions and activities that occur throughout an entity’s  operations and on an ongoing basis. Once in place, internal control  provides reasonable, not absolute, assurance of meeting those  objectives. Within SEC, having an adequate system of internal control  can help the agency achieve its mission of protecting investors and  maintaining fair and orderly markets, and improve accountability for doing  so.

Section 961 of the Dodd-Frank Wall Street Reform and Consumer  Protection Act (Dodd-Frank Act) requires us to review the adequacy and  effectiveness of SEC’s internal supervisory control structure and  procedures applicable to SEC staff who perform examinations of  registered entities, review filings for corporate financial securities, and  conduct enforcement investigations. Such staff are located within SEC’s  Office of Compliance Inspections and Examinations (OCIE), Division of  Corporation Finance, and Division of Enforcement—to which we refer  collectively as the offices. Section 961 does not define “internal  supervisory control.” Therefore, for our report we define internal  supervisory control as the processes management establishes to help  ensure that procedures applicable to staff are performed completely,  consistent with applicable policies and procedures, and remain current.We interpret internal supervisory controls as a subset of an overall  internal control framework, with an emphasis on supervisory review and  oversight of work that SEC staff conduct. This report examines the  steps the offices have taken toward developing an internal  supervisory control framework over the specified programs, internal supervisory controls each office has implemented and how  these controls reflect established internal control standards, and the extent to which the internal supervisory controls have operated as  intended.

To identify the steps each office took to develop an internal supervisory  control framework, we evaluated and analyzed documentation from  OCIE, Corporation Finance, and Enforcement. We interviewed officials  from OCIE, Corporation Finance, and Enforcement about actions taken to  develop an internal supervisory control framework. To describe the  internal supervisory controls that exist as part of the offices’ processes for  conducting complete and consistent examinations, reviews of financial  securities filings, and investigations, we evaluated and analyzed  documentation from OCIE, Corporation Finance, and Enforcement. We  also interviewed officials from these offices about the specific internal  supervisory controls they have in place. To evaluate the extent to which  the internal supervisory controls have operated as intended, we reviewed  the policies, procedures, and stated control objectives of the offices to  determine if selected internal supervisory controls were designed in a  manner capable of achieving their stated objectives and functioned as  intended. We categorized each of the internal supervisory controls for  fiscal year 2011 according to the internal control standard (control  environment, risk assessment, control activities, information and  communication, and monitoring) each best demonstrates and selected a  nonprobability sample of controls from each office based on known  information relating to past internal control failures and high-risk activities.  We supplemented this sample with a random selection of additional  internal supervisory controls from the remaining population. The  methodology used to review each control varied due to the nature of each  control, the availability of control-level data, and the different methods  used to document the control. The results of our review of the design and  functioning of the specified controls are applicable only to the tested  controls for the audited time period and therefore are not generalizable to  all of SEC’s internal supervisory controls. Because our review did not  identify or test every control, it should not be interpreted as an attestation  of the offices’ internal control. Appendix I contains additional information  on our scope and methodology.

We conducted our work from February 2012 to April 2013 in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.
subsections: section_title: Background
paragraphs: To carry out its mission, SEC’s responsibilities are organized into 5  divisions and 23 offices. Of those, OCIE, the Division of Corporation  Finance, and the Division of Enforcement are subject to section 961 of  the Dodd-Frank Act. The roles and responsibilities of these offices are  summarized in table 1.

Section 961 of the Dodd-Frank Act requires SEC to submit a report to  Congress (1) on the assessment of the effectiveness of its internal  supervisory controls and the procedures applicable to staff who perform  examinations, enforcement investigations, and reviews of financial  securities filings; (2) a certification that SEC has adequate internal  supervisory controls to carry out examinations, reviews of financial  securities filings, and investigations; and (3) a summary of the  Comptroller General’s findings on the adequacy and effectiveness of SEC  internal supervisory controls. According to section 961, SEC must submit  these reports no later than 90 days after the end of each fiscal year.

SEC’s first three annual reports—for fiscal years 2010, 2011, and 2012— found no significant deficiencies in internal supervisory controls, and  concluded that the controls were effective. While not subject to section  961, SEC’s Office of the Chief Operating Officer (OCOO) and the Division  of Risk, Strategy, and Financial Innovation provided advice and  assistance to OCIE, Corporation Finance, and Enforcement, in  identifying, establishing, and carrying out internal control policies and  procedures. For example, the Division of Risk, Strategy, and Financial  Innovation advised the offices on developing appropriate statistical  methods for testing controls. The OCOO has also provided guidance and  training on how to implement an internal control process.

In addition to the section 961 requirement, SEC is responsible for  establishing and maintaining effective internal control and financial  management systems that meet the objectives of the Federal Managers’  Financial Integrity Act of 1982 (FMFIA). annually assess and report on the internal controls that protect the  integrity of their programs and whether financial management systems  conform to related requirements. The Office of Management and Budget’s  (OMB) Circular No. A-123, which requires agencies to provide an  assurance statement on the effectiveness of programmatic internal  controls and financial system conformance, provides guidance for  implementing FMFIA. We review SEC’s internal controls for its financial  management systems as part of our annual financial audit of the agency  and therefore these controls are not examined in this report.
subsections: section_title: Internal Control Standards
paragraphs: Pub. L. No. 97-255, 96 Stat. 814 (Sept. 8, 1982). responsible for developing detailed policies and procedures to fit their  agency’s operations. Agencies may implement these standards at an  office level to establish an overall framework for organizing the  development and implementation of internal controls. The standards also  can be implemented to help ensure that specific program activities are  carried out according to adopted policies and procedures. Our standards  are similar to the framework for internal control developed by the  Committee of Sponsoring Organizations of the Treadway Commission  (COSO).

Five interrelated standards establish the minimum level of quality  acceptable for internal control:

Control Environment. Management and employees should establish  and maintain an environment throughout the organization that sets a  positive supportive attitude toward internal control and conscientious  management. A positive control environment is the foundation for all  other standards. It provides the discipline and structure as well as the  climate that influences the quality of an organization’s internal control.  Management’s philosophy and operating style also affect the  environment, including management’s philosophy towards monitoring,  audits, and evaluations.

Risk Assessment. After establishing clear, consistent agency  objectives, management should conduct an assessment of the risks  the agency faces from external and internal sources. Risk assessment  is the identification of risks associated with achieving the agency’s  control objectives and analysis of the potential effects of the risk. Risk  identification methods may include qualitative and quantitative ranking  activities, management discussions, strategic planning, and  consideration of findings from audits and other assessments. Risks  should be analyzed for their possible effect and risk analysis generally  includes estimating a risk’s likelihood of occurrence and its  significance or impact if it were to occur. Because governmental,  economic, regulatory, and operating conditions continually change,  mechanisms should be provided to identify and appropriately deal  with additional risk resulting from such changes.

Control Activities. Control activities—policies and procedures that  help management carry out its directives—help to ensure that actions  are taken to address risks. Control activities are an integral part of an  entity’s planning, implementing, reviewing, and accountability for  stewardship of government resources and achieving effective results.  The control activities should be effective and efficient in accomplishing  the agency’s control objectives.

Information and Communications. Key information should be  recorded and communicated to management and others within the  entity who need it and in a form and within a time frame that enables  them to carry out their internal control and other responsibilities.

Monitoring. Management should assess the quality of internal control  performance over time and ensure that the findings of audits and  other reviews are promptly resolved.

section_title: Existing Internal Supervisory Control Framework Generally Reflects Accepted Standards of Internal Control
paragraphs: As part of their efforts to respond to section 961 requirements, OCIE,  Corporation Finance, and Enforcement put in place an internal  supervisory control framework that generally reflects federal internal  control standards. The framework requires that each office develop a  formal process for identifying and assessing risks, identifying key internal  controls that address those risks, assessing the operating effectiveness of  internal controls, and reporting the results of the testing.

According to staff, although internal controls were in place to oversee  examinations, investigations, and securities filing reviews, the offices had  no formal methods for identifying, documenting, or assessing internal  supervisory controls prior to 2010. Before 2010, the offices annually  assessed and provided assurance statements on the adequacy of their  internal controls to comply with requirements of FMFIA and OMB Circular  No. A-123; however, according to SEC officials, these assessments  generally focused on controls affecting SEC’s financial statements and  information technology. In response to section 961 of the Dodd-Frank  Act, senior officers and staff from OCIE, Corporation Finance, and  Enforcement and the Offices of the Chief Accountant, General Counsel  and Executive Director formed the 961 Working Group (Working Group)  to coordinate the annual assessment and certification. This group also  worked to coordinate the section 961 assessments with agencywide  efforts to comply with FMFIA internal control requirements. The Working  Group included senior-level managers who also were tasked with leading  their office’s 961 annual assessment efforts. In fiscal year 2011, the  Working Group expanded to include OCOO.year 2011 the MorganFranklin consulting firm, has provided assistance to  the offices on certain aspects of SEC’s 961 program.

During our interviews with members of the Working Group, staff  demonstrated knowledge of their respective office’s internal control  framework, known gaps, and efforts to address gaps. Staff discussed  risks to their respective programs and how existing controls addressed  those risks. For example, OCIE staff discussed a key risk of examinations  being conducted in a manner inconsistent with policies and procedures  due to a gap in its processes for organizing and updating policies and  procedures. OCIE staff described the development of the new  governance structure and how it addresses this gap. Division  management and senior officer involvement in the establishment of the  internal supervisory control framework and in-depth understanding of a  program’s internal supervisory control framework, risks, and the design  and implementation of a plan to mitigate risks reflect the control  environment standard, which states that management should establish  and maintain an environment throughout the organization that sets a  positive and supportive attitude toward internal control and conscientious  management.

As they worked to develop the internal supervisory control framework, the  Working Group used GAO’s standards, guidance in OMB Circular No. A- 123, and the Commission’s own internal control guidance to public  companies. To guide the design of the framework and internal  supervisory controls assessment process, the Working Group identified  three key principles—(1) control systems and assessments should be  designed to provide a reasonable assurance of effectiveness, (2)  management should rely on its judgment, and (3) management should  make judgments based on risk and its own knowledge and expertise to  implement an efficient and effective evaluation process. The Working  Group also developed key definitions and criteria to better coordinate the  offices’ approach for determining the scope and required evidence  needed to support management’s evaluation and certification as required  under section 961. For example, the group defined “internal supervisory  control” to assist each office in scoping its assessment and established  criteria for determining if a control evaluation finding rose to the level of a  “deficiency” or “significant deficiency,” which is consistent with generally  accepted government auditing standards. The resulting internal  supervisory control framework generally reflects federal internal control  standards. Specifically, SEC’s internal supervisory control framework  includes the following elements:  Identifying and assessing risks. Under SEC’s framework, each office  must conduct an annual risk assessment. Consistent with the risk  assessment standard of internal control, each office’s risk assessment  includes processes for identifying and assessing key risks. To implement  this process, each office assigned a small group, led by the managing  executive or other senior officer, the task of identifying what they believed  to be the key risks.

GAO/AIMD-00-21.3.1, and OMB, Circular No A-123: Management’s Responsibility for  The Working Group defines a key risk to be a risk that in the office’s informed judgment  carries significant inherent risk to its ability to consistently conduct examinations,  investigations, or reviews with professional competence and integrity. from MorganFranklin in conducting its 961 reviews for fiscal years 2011  and 2012. These small groups then evaluated the “inherent risk”  associated with each key risk based on their judgment of the likelihood of  the risk occurring and the severity of impact if it were to occur. Based on  this evaluation, each risk was assigned a rating. For example, for each  identified risk in fiscal year 2011, Corporation Finance rated the likelihood  of the risk occurring using a three-level system (low, medium, or high). It  similarly rated each identified risk’s impact. The group then used a three- by-three matrix to arrive at an overall risk rating.

Identifying key internal controls that address the risks. For each key  risk, the small groups identified corresponding key controls, including  internal supervisory controls, used to address the risks. For example,  OCIE requires examination reports and workpapers to be reviewed and  approved by management at the end of every examination. This helps to  ensure that applicable rules and regulations are reviewed and  examinations are consistently performed. The key risks and controls are  documented in a risk-assessment tool called a risk and control matrix  and, according to SEC staff, vetted by other managers and senior officials  within each respective office, and approved by each office’s director.  Specific controls implemented by each office are discussed in more detail  later in this report.

Assessing the operating effectiveness of internal controls. In  developing SEC’s framework, the Working Group incorporated the  required 961 annual assessments. Consistent with the internal control  standard for monitoring, the assessments provide the Commission and  management with annual evaluations of the design and operating  effectiveness of each office’s internal supervisory controls. According to  the Working Group, each office has the discretion to determine the  methodology, including level of evidence and frequency, for testing each  control that would provide management with reasonable assurance of the  control’s effectiveness. Furthermore, the Working Group also consulted  with SEC’s Division of Risk, Strategy, and Financial Innovation and used  GAO’s Financial Audit Manual for assistance in determining the  appropriate sample sizes, and the acceptable number of errors for a  particular sample size and for pulling random samples. Each office  designated an assessment team to carry out the testing and took steps to  maintain the objectivity of the testing. For example, Corporation Finance’s  senior assessment team segregated testing duties so that an associate  director would not be involved in selecting samples or testing the work of  the offices that he or she oversees. According to staff, the fiscal year  2011 assessment was the first year for which control testing was  conducted under section 961. On the basis of our review of each office’s  assessment procedures and documentation of assessment findings for  fiscal year 2011, each used accepted methods such as inquiry,  observation, inspection, and direct testing.

In fiscal year 2012, the director of OCR began signing the certification document.

961(c) requires the office director to certify that, among other things, he or  she has evaluated the effectiveness of the internal supervisory controls  during the 90-day period ending on the final day of the fiscal year to which  the report relates and disclosed to the Commission any significant  deficiencies in the design or operation of internal supervisory controls that  could adversely affect the ability of the office to consistently conduct  inspections, investigations, or financial securities filing reviews with  professional competence and integrity. Reporting assessment results  constitutes a significant part of an overall internal control framework and  reflects the information and communication and monitoring components  of internal control standards.

In fiscal year 2012, the Working Group took additional steps to improve  the overall internal supervisory control framework and 961 assessment  processes. Notably, the group adopted a single set of procedures for  conducting the annual assessments for all of the offices. In fiscal year  2011, each office used similar but separate processes for conducting its  assessment. The fiscal year 2012 procedures maintain a risk-assessment  methodology that continues the offices’ focus on identifying key risks, but  differs in that it establishes a common scale for assessing the likelihood  and impact of key risks. The fiscal year 2012 procedures also provide a  common definition of key controls and information on how to identify  them; allow for each office to design an appropriate control evaluation  strategy; provide guidance—developed in consultation with economists  from the Division of Risk, Strategy, and Financial Innovation—for  conducting statistical testing of internal supervisory controls; and  incorporate additional control testing guidance similar to that set forth in  our Financial Audit Manual. Finally, the procedures incorporate guidance  from the offices’ fiscal year 2011 procedures on reporting the results of  the assessments to office or division management, SEC’s Chairman, and  Congress.

In fiscal year 2012, the Working Group also further incorporated staff from  OCOO and provided additional guidance aimed at improving the offices’  risk assessment and control identification. According to OCOO staff, in  fiscal year 2012, they periodically reviewed the offices’ documentation of  risks and controls, consulted with the offices to help address any  challenges or questions, and helped staff use an electronic tool that  assists in the identification of key risks and controls. This tool also  captures control descriptions and data on control evaluation results and  provides information to office management in a standardized format.  Additionally, OCOO staff assisted OCIE and Enforcement with identifying  potential gaps in risks and controls. OCOO staff and MorganFranklin also  provided staff from each of the three offices with additional training on  how to identify and evaluate risks and controls. For example, training  materials outline specific questions to ask when evaluating the design of  new or established controls such as (1) how often the control activity was  completed, (2) how the control was documented, and (3) the purpose of  the documentation. Such training can help to improve future 961  assessments, specifically the evaluation of a control’s design to help  ensure it includes clear and specific implementing procedures. OCOO  plans to increase its support to each office’s risk and control identification  and assessment process.

section_title: Offices’ Work Processes Incorporate Internal Supervisory Controls Designed to Address Identified Risks
paragraphs: As part of developing and applying the internal supervisory control  framework, each office identified internal supervisory controls to address  the risks identified through the risk assessment. These internal  supervisory controls are built into the offices’ work processes—that is, the  processes they use to carry out examinations, filing reviews, and  investigations. The controls are intended to help ensure that objectives  are being met and that the procedures applicable to staff carrying out  these activities are conducted completely and consistently. They range  from supervisory review and approval activities to information regularly  provided to management to monitor the processes as a whole. According  to staff, many of the offices’ internal supervisory controls existed prior to  the development of SEC’s internal supervisory control framework in 2010.  Others were developed through the process of developing the framework.  Our review of each office’s process for conducting examinations, filing  reviews, and investigations found that each included controls generally   As noted earlier, agencies  reflective of the internal control standards.may implement the internal control standards at an office level to  establish an overall framework for organizing the development and  implementation of internal controls and at the program level to help  ensure that specific activities are carried out according to adopted policies  and procedures. Figure 1 shows the relationship between the internal  supervisory control framework and the internal supervisory controls  established by each office at the program level.

OCIE administers SEC’s nationwide examination program. Key risks to  ensuring examinations are conducted in a manner consistent with OCIE  objectives include (1) not effectively or efficiently selecting high-risk  examination candidates and (2) examination findings that are not  generally supported by the workpapers. To address these and other  identified risks, OCIE developed controls that help ensure that high-risk  examination candidates are selected in accordance with OCIE program  goals and that managers perform oversight of examination workpapers to  better ensure that examination findings are generally supported by  workpapers.

OCIE’s recent implementation of a new governance structure, generally  referred to as the National Examination Program (NEP), has the potential  to provide for greater standardization of the examination process and  supervisory controls. Consistent with the standard of control environment,  NEP defines areas of authority and responsibility. For example, under  NEP, senior officers with the title of national associate head each of the  five examination program areas. The national associates are charged  with setting directives and helping ensure consistency across NEP. Under  NEP, OCIE also created a number of committees responsible for carrying   A primary function of the committees is to help  out designated activities.ensure that policies and procedures are formally discussed, approved,  and communicated. Such a committee structure reflects the control  environment standard by clearly delegating authority and responsibility  throughout OCIE. Further, OCIE created an Office of the Managing  Executive responsible for general operational areas and oversight of  internal controls. Assigning responsibility for internal controls to a senior- level manager demonstrates a commitment to internal control and is  consistent with establishing a positive control environment. Finally, OCIE  has been working with SEC University to develop an examiner  certification program based on a job analysis of examiners to identify the  skills needed.ensure all personnel possess and maintain a level of competence that  allows them to accomplish their assigned duties.

In addition to the examination program’s governance structure, OCIE  established a standardized set of policies and procedures for conducting  examinations under NEP. These control activities are a key part of the  framework. Prior to the adoption of standardized policies and procedures,  the processes for conducting and documenting supervisory review of staff  work varied. For example, some regional offices used control sheets to  document staff work and supervisory review, while others indicated  review through management’s review of the examination report. The  standardized policies and procedures outline the examination process  and provide guidance to staff and supervisors for conducting and  reviewing examinations. They also include existing management and  supervisory activities intended to help ensure that examinations are  carried out according to OCIE policies and are consistent with OCIE’s  goals and objectives. Examples of internal supervisory control activities  include the following:

Entity selection. NEP management works with regional offices to  determine registrants targeted for examination. Each year, NEP  management holds several meetings to develop examination program  goals and objectives, including guidance for the selection of  registrants for examination and potential focus areas. To further assist  OCIE management in selecting registrants for examination, OCIE’s  Office of Risk Analysis and Surveillance staff use information from  registration and other required forms, past examinations, and other  sources to help identify regulated entities that likely pose the highest  risk to investors. According to staff, each regional office is provided  this information about the regulated entities in its jurisdiction, including  specific areas of risk that a certain entity may pose. The regional  offices incorporate local information and knowledge and confer with  home office (headquarters) management and national associates on a  semi-annual basis to determine registrants targeted for examination.

Examination scope approval. Supervisors review and approve the  initial scope of the examination and any subsequent modifications to  the scope. After staff conduct the pre-examination research,  procedures require the staff to schedule a pre-examination meeting  with supervisors to discuss the areas that will be included in the scope  of the examination and whether additional expertise or resources are  needed. The staff document the decisions made and submit the  scoping work to the supervisor for approval. Supervisors are expected  to ensure that relevant pre-examination research is completed,  including a review of: previous examinations and deficiencies; tips,  complaints, and referrals; and Division of Enforcement activity. They  also must determine that the proposed scope of the examination is  appropriate and in line with OCIE goals and objectives.

Examination workpaper review. Supervisors review and sign control   OCIE procedures require  sheets (or other examination workpapers).staff to document the steps that were taken during the course of the  examination, methodology used, documents reviewed, and findings  and conclusions for each aspect of the examination in the  workpapers. Supervisors review the key workpapers supporting the  staff’s findings to determine whether the work performed sufficiently  assessed the focus areas in the scoping and planning documents.  Supervisors also must review the evidence provided to determine if it  sufficiently supports the findings and conclusions. Finally, procedures  require that supervisors meet with the examination team after the  information-gathering portion of the examination is substantially  complete to discuss preliminary findings and any challenges  encountered during the examination. In the event that staff discover  facts that may result in an Enforcement referral, those facts should be  brought to the immediate attention of an associate director. Once the  appropriate associate director or national associate determines that  an examination merits a referral to Enforcement, OCIE staff are to  follow NEP procedures for documenting and communicating the  referral to Enforcement.

Examination report approval. An assistant director or higher-level  supervisor approves the nonpublic examination report. After the  examination team completes its examination but before it finalizes its  nonpublic examination report, staff prepare the report and submit it for  approval. Once examination findings are approved, an examination  team will issue an examination summary or other closing letter to the  registrant. Examination managers are responsible for ensuring that  the examination summary letter includes information about any  required response from the registrant and that the letter and report are  properly filed in OCIE’s systems.

Examination closing approval. An examination manager or a  higher-level supervisor approves the closure of an examination. OCIE  policies and procedures consider an examination to be closed after  the assistant director or other authorized supervisor has approved the  examination summary report, staff have sent an examination  summary letter to the entity, and the entity has satisfactorily  responded to the examination summary letter; or, when an  Enforcement referral has been made and no further OCIE staff action  is expected. According to staff, the examination manager or higher- level supervisor determines the sufficiency of an entity’s response.

In addition to the standardized policies and procedures, OCIE also has  been implementing a new examination tracking system, the Tracking and  Reporting Examinations-National Documentation System (TRENDS),  which is intended to improve documentation of staff work and supervisory  reviews and approvals. Consistent with the internal control standard of  control activities, TRENDS is designed to provide OCIE with a means of  clearly documenting significant events in the examination process and  making that documentation readily available for review and reporting  purposes. TRENDS was created in 2011 to capture NEP data and  information, including workpapers, examination scope, deficiencies, audit  techniques, and management approvals. TRENDS replaces manual  methods for maintaining the results of examination work. For example,  TRENDS replaces paper-based scope memorandums and examination  reports with on-line “working scope” and “examination summary”  screens.

In TRENDS, each examination workbook has three phases (prefieldwork,  fieldwork, and postfieldwork). At the completion of the prefieldwork and  postfieldwork phases, examination staff electronically submit the  examination workbook for management approval. Supervisors then can  approve the workbook or return it to the staff for corrections or additional  work. When staff receives a satisfactory registrant response to the  examination summary letter, supervisors then perform a final approval by  closing the examination. These approvals correspond to the internal  supervisory control activities described earlier. TRENDS also contains  built-in workflows and checklists that help ensure staff complete certain  steps before an examination moves to the next phase and automatic  notifications that alert supervisors of pending reviews. TRENDS also  allows staff to search associated or previously closed examinations and  track the status of deficiencies, and will be used to collect examination  program performance information and statistics. began a phased-in implementation of TRENDS. According to OCIE, by  September 30, 2013, all OCIE examination programs will use the system  for newly initiated examinations.

Staff access rights to TRENDS examination information are based on the staff  member’s role in specific examinations. In general, staff only may access examinations to  which they are assigned and work on those portions of the examination to which they  have been assigned. Supervisors can access any examination for which they are  responsible. All staff can open, in a read-only format, any closed examinations in  TRENDS. meeting described above, and where feasible, the examination exit  interview or conference call. According to staff, these meetings further  enable supervisors to obtain the operating information necessary to  determine if an examination team is meeting its objectives.

OCIE also established standing meetings to discuss broader examination  program information. For instance, OCIE holds monthly videoconferences  with staff to provide updates on policies or procedures, share information  on current examination program events and trends, and provide staff with  the opportunity to raise issues with management. In addition, senior  officers in OCIE regional offices and headquarters conduct quarterly  meetings with the assistant directors and exam managers to review all  open examinations, and the NEP senior management meets weekly to  discuss program performance and goal achievement. Furthermore, OCIE  management obtains pertinent information, through monthly performance  reports that are prepared by the Office of the Managing Executive. These  reports contain key performance measures, such as the percentage of  enforcement investigations resulting from examination referrals and the  percentage of firms receiving examination summary letters that take  corrective action in response to all examination findings. Finally, OCIE  management monitors examination information to help ensure the office  meets the statutory requirement that examinations be completed within  the later of 180 days of the end of fieldwork or the date on which the last  document was received from the registrant.

OCIE also implemented a number of controls consistent with federal  internal control standards for monitoring. In addition to the 961 annual  assessments, supervisory oversight of examinations, and management  review of regular reports and the meetings, OCIE hired a senior  specialized examiner to develop a compliance program within its Office of  Chief Counsel. Since then, a compliance group has been formed and  three additional permanent staff positions have been added to the group.  The group periodically tests a random sample of examinations from each  NEP office to evaluate for compliance with documented procedures and  make recommendations for improvement. According to staff, this group is  empowered to select what to evaluate (and when) and reports to the  Chief Counsel. As of March 5, 2013, the Office of Chief Counsel was in  the process of filling a recently created assistant director position to lead  OCIE’s compliance group. Since its creation, the group has completed six  separate evaluations and, according to staff, has two additional  evaluations ongoing.

Moreover, OCIE established policies and procedures for responding to  OCIE recommendations from GAO and SEC OIG audits. According to  OCIE policy, management of the affected area will meet to discuss and  draft a response to GAO and OIG audit findings. The Compliance, Ethics,  and Internal Controls Steering Committee is responsible for reviewing  management’s proposed responses to GAO or OIG recommendations  and other identified deficiencies. The committee discusses the response,  obtains additional information if necessary, and can elect to elevate the  response to OCIE’s Executive Committee, which consists of the director  of the NEP and at least seven members of the NEP’s leadership team— including at least two representatives from headquarters, two from large  regional offices, and three from smaller regional offices, if necessary. All  responses to GAO and OIG recommendations are presented to OCIE’s  director for final approval. According to staff, any audit findings and  recommendations made by OCIE’s compliance unit follow a similar  process. Noncontroversial or lower-level responses to recommendations  may bypass the committees and go directly to the director for approval.
subsections: section_title: Corporation Finance’s Internal Supervisory Controls Are Designed to Help Ensure Financial Securities Filing Reviews Are Conducted Completely and Consistently
paragraphs: Corporation Finance selectively reviews filings made under the Securities  Act of 1933 and Securities and Exchange Act of 1934 to monitor and  enhance compliance with the applicable disclosure and accounting  requirements. Key risks identified by the division to meeting its  objectives include (1) not effectively identifying companies for review in  accordance with regulations or that pose the greatest risk to investors and  (2) not identifying and addressing material noncompliance in reviewing  company disclosures. The division developed key internal supervisory  controls to address these and other risks, including documenting  procedures for determining the level and scope of reviews.

The review program for corporate financial securities filings, which falls  under the Office of Disclosure Operations in Corporation Finance,  includes a number of management efforts and processes designed to  oversee the program’s performance and establish a positive control  environment. division created an organizational structure with clear lines of authority  and reporting. The program consists of 12 assistant director-led offices,  each responsible for filings from one or more sectors of the economy.  Each office includes a number of attorneys and accountants who serve as  first-line supervisors. The program is overseen by senior management  consisting of a deputy director and five associate directors. In addition, in  2011 Corporation Finance created an Office of the Managing Executive  responsible for general operational areas and oversight of internal  controls. Assigning responsibility for internal controls to a senior-level  manager demonstrates a commitment to internal control and is consistent  with establishing a positive control environment.

For the purposes of the 961 assessments, Corporation Finance defines “corporate  financial securities filings” to mean filings containing financial statements and related  disclosures that (1) public companies file with SEC in accordance with the Securities Act,  Exchange Act, and Commission rules and regulations, and (2) fall within the scope of  authority delegated by the Commission to the division.
subsections: section_title: Corporation Finance Internal Supervisory Control Activities
paragraphs: In addition to control environment procedures, the division has  established policies and procedures for conducting filing reviews.  Specifically, the division’s filing review procedures include multiple  internal supervisory controls to help ensure that filing reviews are being  conducted completely and consistently and that the division’s goals and  objectives are being met. Examples of internal supervisory controls that  reflect the control activities standard are described below.

Annual filing review goals. At the start of each fiscal year, division  management develops goals for the filing review program. The goals  include reviewing companies pursuant to section 408 of the  Sarbanes-Oxley Act and internally defined criteria. The division also  aims to conduct financial reviews of the most highly capitalized  companies, reflecting a broad shareholder base, every year. In  addition, division management suggests criteria for selecting other  companies for review and allows broad discretion for assistant  directors to make selections within these parameters. According to  division officials, together these companies account for a substantial  percentage of total market capitalization.

Second-level supervisory review. Once identified for selective  review, a filing enters the review cycle, which generally includes four  phases: screening, examination, closing, and the public posting to  http://www.SEC.gov of SEC comments and responses to them (“filing  review correspondence”). For most filings, a second-level review is  required during each of these phases. For example, in the  examination phase, examiners evaluate the disclosures in the filing  and document their evaluation and any proposed comments on  compliance improvements or material noncompliance with applicable  disclosure or financial statement requirements in an examination  report. Designated second-level review staff then review the  examination reports and proposed comments to confirm that the  comments are consistent with prior comments from the assistant  director’s office, address appropriate issues, reflect the division’s  opinions and interpretations of disclosure and financial statement  requirements, and generally comply with division policies.level reviewers’ findings are documented in a review report.

Corporation Finance created various documents and electronic  databases to record and store filing review data. Recording significant  events in the filing review process and ensuring that documentation is  readily available for review are consistent with the control activities  standard. Generally, documentation for each filing review includes a  screening sheet, an examination report, a review report, and a closing  memorandum. Each document captures information on the filing review  and describes staff members’ participation. For example, the examination  report captures factual information about the company, the filing, the staff  member who performed the filing review, the nature (or type) of the filing,  and any staff comments. The closing memorandum includes a list of the  documents reviewed, the actions taken, when the review was concluded,  and any significant issues identified during the review. The division  maintains five distinct electronic databases to track, conduct, document,  and report on different aspects of its filing review program. For example,  the Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system  is the division’s primary record-keeping system. EDGAR performs automated collection, validation, indexing, acceptance, and forwarding of  submissions by companies and others that voluntarily file or are required  by law to file forms with SEC. Corporation Finance is aware of limitations  within the databases that require some information to be manually  entered or uploaded and that such limitations increase opportunities for  error and misinformation. As a result, division management recently  began conducting periodic audits of access rights and data quality.

Consistent with the internal control standard for information and  communication, the division’s management interacts with supervisors and  staff using standing meetings and memorandums to share information  about the program’s progress towards meeting filing review goals, quality  of staff’s work, and compliance with established policies and procedures.  Also, management regularly receives various standard and ad hoc  reports about program performance. For example, assistant and  associate directors receive weekly updates that provide a real-time  snapshot of the division’s current workload. Division managers also  receive monthly reports that present summary data on review activity and  progress toward meeting goals for number of reviews completed and  timing. Finally, the division provides guidance and other program  information to staff on its intranet site.

In addition to the annual 961 assessment, Corporation Finance has  implemented a number of controls consistent with the monitoring internal  control standard. For example, according to Corporation Finance staff,  their standing meetings are an important aspect of the division’s  monitoring strategy and provide opportunities for senior officers to share  information about resources, potential issues with filing reviews, or  personnel matters within the assistant director offices. For example,  associate directors, assistant directors, and the senior assistant chief  accountants in disclosure operations meet regularly to share information  across the division and discuss trends or issues across filing reviews.  Corporation Finance staff also stated that assistant directors and senior  accountants regularly meet with staff to gather information on what staff  have seen in their filing reviews. Other internal supervisory controls that  demonstrate the monitoring standard include the division’s practices of (1)  releasing its correspondence with companies to the public, which allows  for public scrutiny of its work, and (2) assigning a senior officer to manage  the process of developing and tracking responses to audit  recommendations. Corporation Finance also has efforts under way to  help provide an overarching perspective on the quality of filing reviews.

section_title: Enforcement’s Internal Supervisory Controls Are Designed to Help Ensure Investigations Are Conducted Completely and Consistently
paragraphs: Enforcement is charged with investigating potential violations of the  federal securities laws and litigating SEC’s enforcement actions. As  documented by Enforcement, key risks to the division’s mission include  (1) untimely identification and investigation of potential securities fraud  and (2) failure to bring enforcement actions that could deter potential  violators and protect investors. Enforcement developed internal  supervisory controls to address these and other risks.

In 2009, Enforcement began a review of its investigative process intended  to streamline procedures and maximize resources. Since that time,  Enforcement implemented a number of actions that collectively reflect  Enforcement management’s efforts to establish and manage its overall  performance, in accordance with the internal control standard for control  environment. These actions included the following:  In 2009, Enforcement created the Office of the Managing Executive to  oversee functions such as case-management systems and broader  operational areas such as process improvement and internal controls.  According SEC officials, the new office enables staff to focus on  mission-critical investigative activities.

In 2010, the division established the Office of Market Intelligence  (OMI) to centrally handle tips, complaints, and referrals, known as  TCRs. OMI uses a searchable database (known as the TCR system)  to triage TCRs, and assign or refer potential investigative leads. OMI  has been currently piloting a tool that will add analytics capabilities to  the database to improve staff’s ability to identify high-value TCRs and  to search for trends and patterns.

Also, in 2010, the division reassigned approximately 20 percent of its  staff to nationwide specialized units designed to concentrate on high- priority enforcement areas, including asset management (for example,  hedge funds and investment advisors), market abuse (large-scale  insider trading and market structure issues), structured and new  products (such as derivatives products), Foreign Corrupt Practices Act  violations, and municipal securities and public pensions. The units rely  on the knowledge and expertise of experienced staff to better detect  links and patterns that could suggest wrongdoing.

Finally, Enforcement has been working with SEC University to  develop a curriculum for all levels of staff to increase competency in   investigative skills and knowledge of the division’s high-priority  enforcement areas.

The division maintains procedures that reflect the internal control  standard for control activities and that are intended to help ensure that  investigations are being carried out according to Enforcement’s policies.  Such control activities are designed to occur early in and throughout the  enforcement process.

Supervisory review of TCR recommendations. According to OMI  triage procedures, OMI staff review tips, complaints, and referrals  before entering them into the TCR system, then decide whether a  TCR should be (1) closed because it does not suggest a violation of  securities law, (2) assigned for further review, (3) referred outside of  Enforcement, or (4) assigned for investigation. The division’s control  activities include requirements for all decisions to be reviewed by  management or senior investigative staff. In addition, TCRs that were  closed without becoming an investigation may undergo additional  supervisory review by an OMI attorney, assistant director, or senior- level subject-matter expert, and can be re-opened, if appropriate.

Management discussions and documentation of formal orders of  investigation. Recommendations to pursue a formal order of  investigation are discussed between investigative staff and  management and rely heavily on information from sources such as  the staff’s informal inquiries, publicly available information, informants,  complaints, and whistleblowers. Recommendations that are approved  are documented in a signed memorandum to the Commission’s Office  of the Secretary.

Quarterly meetings for ongoing investigations. In 2010,  Enforcement began conducting quarterly review meetings between  supervisors and senior staff to discuss major milestones, resources,  and other feedback for all open and active investigations. Supervisors  document quarterly reviews by using check sheets.

Supervisory review of resolutions. As investigations are brought to  resolution, assistant directors must review and approve all staff  recommendations to close an investigation. Senior officers approve  and sign off on the final case-closing report. Each closing approval is   documented in a memorandum and recorded in Enforcement’s case  tracking system, called HUB.

Enforcement management relies heavily on information communicated by  staff and internal systems to carry out internal supervisory control  responsibilities. The division has established various practices intended to  help ensure that information is conveyed in a timely, relevant, and reliable  form, in accordance with the accepted internal control standard for  information and communication. For example, staff may access common  information about TCRs and active investigations through the TCR and  HUB systems, which can encourage effective communication among staff  about whether to exercise investigative and enforcement powers. In addition, during quarterly reviews, supervisors are expected to review the  status of all open and active investigations, including information about  target deadlines, potential impediments, and estimated resources.  Weekly senior officer meetings and bimonthly meetings between senior  division leadership and assistant directors enable discussion of key  issues and developments that affect investigations. According to  Enforcement officials, the meetings help ensure investigations stay on  track and have the necessary resources. Finally, staff, supervisors, and  senior division management hold a separate weekly meeting, known as  the “To-be-calendared” meeting to discuss all recommendations to  pursue an enforcement action or settle an enforcement action in litigation.

Enforcement’s procedures for conducting the 961 assessment, in addition  to many of the activities noted above, are consistent with the internal  control standard for monitoring. Monitoring controls help management  oversee and assess the quality of the work of Enforcement staff. For  example, supervisors regularly review information to (1) determine  whether investigations are meeting the division’s strategic goals,  performance goals, and compliance requirements; and (2) monitor staff  performance. The division also complies with SEC’s procedures for  responding to external audit recommendations.

section_title: Common Control Deficiencies Indicate Need for Continued Management Attention to Internal Supervisory Controls
paragraphs: We identified deficiencies in about half of the 60 internal supervisory  controls we tested. Specifically, we reviewed a nongeneralizable sample  of 60 controls—20 controls from each office’s fiscal year 2011 risk and  control matrix—that reflect (1) broad aspects of the offices’ internal  supervisory control structure, and (2) our knowledge of previous internal  control failures or high-risk areas. We found that about half (33 controls)  were effectively designed and generally operating as intended. However,  the other half had deficiencies in design or operating effectiveness.  Specifically, for almost half (27) of the controls in our sample (1)  descriptions of the control activity did not accurately reflect policy or  practice; (2) documentation demonstrating the controls’ execution was not  complete, clear, or consistent; or (3) the controls lacked clearly defined  control activities. These control deficiencies may not prevent  management from detecting whether the activities of the offices are  conducted completely and in accordance with policy. However, the  deficiencies were similar in nature across all three offices and made  testing the controls difficult. Without clearly defined control activities and  consistent, readily accessible documentation, management and others  (including external auditors) may not be able to determine whether the  supervisory controls were being appropriately applied and whether they  were effective in achieving their intended outcomes. The offices have  addressed or have been taking steps to address all the 27 identified  deficiencies. SEC officials identified some of these deficiencies as they  tested the controls during their fiscal year 2011 assessments.control deficiencies in our sample were addressed during our review, after  we had detailed discussions with SEC staff about the deficiencies.

Other  However, not enough time had passed to assess the effectiveness of  these changes.

First, in reviewing these controls we found some that some descriptions  of the control activity did not accurately reflect current policy or practice.  Six controls in our sample were difficult to review because the control  description, as stated in the fiscal year 2011 risk and control matrix, did  not accurately reflect the policy or practice in place during the audit period  (see table 2). For example, one of the controls implemented by  Enforcement stated that OMI was responsible for providing training on  TCR system policies and procedures. However, when questioning  Enforcement officials about this control, the officials said that OMI does  not maintain documentation of TCR training because it is provided on an  informal, as-needed basis and that attendance records are maintained by  a different SEC office. Enforcement updated its fiscal year 2012 risk and  control matrix to reflect the SEC office responsible for implementing the  control. Similarly, an OCIE control described supervisors’ use of control  sheets to conduct the review of examination workpapers; however, we  found that OCIE policy did not require the use of control sheets during the  audit period. As OCIE continues to implement TRENDS, all supervisory  reviews and approvals of examination control sheets or similar  workpapers will be captured electronically. In March 2013, OCIE officials  updated the risk and control matrix to better align the control description  with current policy.

Second, for some controls the documentation demonstrating execution of  the control was not complete, clear, or consistent. For nine controls in our  sample, the underlying documentation to support execution of the control  was inconsistent, unclear, or missing (see table 3). For example,  management reviews of OCIE examination reports were documented in  different ways, conducted by different levels of management, and found in  different locations in the examination file. As of April 2013, OCIE officials  stated that they addressed or were addressing deficiencies in all of these  controls. In another example, Enforcement’s documentation of  supervisory review of case progress on a quarterly basis was not  consistent and in a few instances lacked evidence demonstrating that the  review took place. Specifically, we requested all checksheets from our  audit period, a total of 168, used by supervisors to document their  quarterly case reviews and found that the checksheets were not  maintained in a manner readily available for review.  As a result, we  worked with Enforcement officials to select a sample of 65 checksheets to  review. Upon review, we found that the practices for documenting  supervisory review were inconsistent and made our review challenging.   For example, in some checksheets, supervisors signed the checksheet  and also initialed next to each individual case listed on the checksheet.

On other checksheets, supervisors signed the checksheet and either did  not initial next to individual cases at all or only initialed next to select  cases. Enforcement officials said that communication through standing  meetings with assistant directors and executive management, rather than  supervisory signatures, provided officials with confidence that the  quarterly case reviews were taking place. To increase consistency in how  the quarterly review sheets are executed, Enforcement officials provided  guidance to its senior officers communicating that supervisors must sign  the checksheet and that this signature will indicate that all matters on the  checksheet have been reviewed.

Finally, some controls lacked clearly defined control activities.  Specifically, 12 controls in our sample were difficult to test because they  were not designed to enable the control to operate effectively (see table  4). For example, Corporation Finance’s policy requires a review of all  Securities Act initial public offerings and initial Exchange Act registrations  unless an associate director determines otherwise; however, we found  that the division lacked specific procedures by which an associate director  could indicate and document this decision. And, although decisions to  forgo a second-level review at the screening and examination stages  were made consistently, the documented procedures did not completely  describe when exceptions to the general requirement were acceptable. In  addition, Enforcement did not have a mechanism in place to implement its  control that all policies and procedures are reviewed, updated, and  approved on an annual basis. As of April 2013, all of these deficiencies  were addressed or were being addressed.

section_title: Conclusions
paragraphs: Since the passage of the Dodd-Frank Act, OCIE, Corporation Finance,  and Enforcement have established an internal supervisory control  framework that is generally reflective of federal internal control standards.  The offices’ efforts, including senior-level management and internal  control experts’ involvement in the formation of the 961 Working Group,  demonstrate a deliberate and coordinated approach to designing the  framework. In addition, senior-level management’s involvement in the  annual 961 assessments, as well as our audit, indicate a commitment to  improving internal control.

We found deficiencies in the design or operating effectiveness of about  half of the 60 internal supervisory controls we tested. Specifically, for  these internal supervisory controls, the description of the control activity  did not accurately reflect policy or practice; the documentation  demonstrating execution of the control was not complete, clear, or  consistent; or the control lacked clearly defined control activities. These  control deficiencies may not prevent management from detecting whether  the activities of the offices are conducted completely and in accordance  with policy. However, the similarity in the nature of the deficiencies across  all three offices suggests that management attention to the design and  operation of internal supervisory controls is warranted. Federal internal  control standards state control activities should enable effective operation  and have clear, readily available documentation. The offices have  addressed or have been taking steps to address all the 27 identified  deficiencies. In some cases, the offices began to take corrective action  before or during our audit based on their fiscal year 2011 section 961  assessment findings. Other control deficiencies were addressed during  our review, after we had detailed discussions with SEC staff about the  deficiencies. Because most actions became effective during our audit, not  enough time had passed to test and verify the effectiveness of the actions  SEC has been taking to address the identified deficiencies. Taking steps  to ensure that all controls have clearly defined activities and clear and  readily available documentation demonstrating execution of the activity  would provide SEC management with better assurances that policies  were being executed as intended and strengthen SEC’s internal  supervisory control framework. Furthermore, SEC management and  auditors would be better able to test and assess the effectiveness of a  control, opening the doors to further improvement in individual controls.

section_title: Recommendation for Executive Action
paragraphs: To help ensure that controls are properly designed and operating  effectively, SEC should make certain that existing internal supervisory  controls and any developed in the future have clearly defined activities  and clear and readily available documentation demonstrating execution of  the activities.

section_title: Agency Comments
paragraphs: We provided a draft of this report to SEC for review and comment.  SEC  provided written comments, which are reprinted in appendix II. In its letter,  SEC agreed with our recommendation. SEC also states that GAO  concluded that the agency has established an overall framework to  implement section 961 that meets GAO’s internal control standards.  While we found that OCIE, Corporation Finance, and Enforcement have  established an internal supervisory control framework that is generally  reflective of federal internal control standards, we also found deficiencies  in the design or operating effectiveness of about half of the 60 internal  supervisory controls we tested. The offices have addressed or have been  taking steps to address all of the deficiencies. Further, SEC noted in its  letter that it conducted additional testing on the effectiveness of its  internal supervisory controls for the 90-day period ending September 30,  2012, and did not identify any material weakness or significant  deficiencies. We did not evaluate SEC’s testing of controls for this time  period as part of this report. SEC also provided technical comments on  the draft report, which we incorporated as appropriate.

We are sending copies of this report to SEC, appropriate congressional  committees and members, and other interested parties. The report also is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact  me at (202) 512-8678 or clowersa@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix III.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report focuses on functions performed through the Office of  Compliance and Examination (OCIE), Division of Corporation Finance  (Corporation Finance), and Division of Enforcement (Enforcement) at the  Securities and Exchange Commission (SEC)—to which we refer  collectively as the offices. We examined (1) the steps the offices have  taken toward developing an internal supervisory control framework over  the specified programs, (2) the internal supervisory controls each office  has implemented and how these controls reflect established internal  control standards, and (3) the extent to which the internal supervisory  controls have operated as intended.

To describe the steps each office has taken toward developing an internal  supervisory control framework over the specified programs, we evaluated  and analyzed documentation from (1) fiscal year 2011 assessments that  OCIE, Corporation Finance, and Enforcement completed in accordance  with requirements of section 961 of the Dodd-Frank Wall Street Reform  and Consumer Protection Act; (2) SEC’s reports to Congress; and (3)  documentation related to each office’s fiscal year 2011 testing of internal  supervisory controls. We also reviewed documentation from the 961  Working Group and Office of the Chief Operating Officer, such as training  presentations and documents describing the electronic tool used to  capture risk and control information. We also reviewed previous GAO  reports on other internal control frameworks and GAO’s audits of SEC’s  financial statement and the Federal Managers’ Financial Integrity Act  process. We compared SEC’s internal supervisory control framework with  frameworks set forth in GAO’s Standards for Internal Control in the  Federal Government. We interviewed officials from OCIE, Corporation  Finance, Enforcement, and the Office of the Chief Operating Officer about  actions taken to develop an internal supervisory control framework and  how the framework addresses accepted internal control standards.

To describe the internal supervisory controls that exist as part of the  offices’ processes for conducting complete and consistent examinations,  reviews of financial securities filings, and investigations, we evaluated  and analyzed documentation from OCIE, Corporation Finance, and  Enforcement, including policies and procedures for conducting  examinations, filing reviews, and investigations. We also analyzed the  offices’ fiscal years 2011 and 2012 risk and control matrixes, in which  they identify key risks and controls designed to mitigate those risks.  Furthermore, we observed the information technology systems used to  track and document these activities. We interviewed officials from these  offices about the examination, filing review, and investigation processes;  and the specific internal supervisory controls that each unit has in place.  We also interviewed these officials and MorganFranklin, the consulting  firm hired to help assess the offices’ internal supervisory controls, to  better understand their work processes, internal supervisory controls, and  how each office has been addressing individual internal control  standards. Finally, we obtained staff views on each office’s internal  controls and communication from focus groups of randomly selected  supervisory and nonsupervisory staff from OCIE and Enforcement in the  Fort Worth, Texas; Miami, Florida; and Los Angeles, California regional  offices and headquarters. We obtained similar information from  Corporation Finance supervisory and nonsupervisory staff.

We assessed a nongeneralizable sample of 60 fiscal year 2011 internal  supervisory controls relevant to the conduct of examinations, filing  reviews, and investigations to determine whether they operated as  intended. We identified 135 controls that we categorized according to the  internal control standard (control environment, risk assessment, control  activities, information and communication, and monitoring) each best  demonstrated. We selected a nonprobability sample of 11 OCIE, 10  Corporation Finance, and 11 Enforcement controls to review based on  known information on past internal control failures and high-risk activities.  We supplemented this sample with a random selection of 9 controls from  OCIE and Enforcement and 10 controls from Corporation Finance from  the remaining population, for a total of 20 controls from each office. For  the selected controls, we reviewed the policies, procedures, and stated  control objectives of the offices to determine if selected internal  supervisory controls were designed in a manner capable of achieving  their stated objectives. We also interviewed staff from each office on the  operation of these controls. To review the operational effectiveness of the  selected controls, we directly observed the electronic databases or  spreadsheets described in some controls, obtained documentation or  electronic data to analyze other controls, and compared the evidence with  each control’s description to determine whether the control functioned as  intended. The methodology used to review each control varied due to the  nature of each control, the availability of control-level data, and the  different methods used to document the control. In this report, we present  our findings on controls with deficiencies in tables 2 through 4. The  results of our reviews of the design and functioning of the specified  controls are applicable only to the tested control for the audited time  period and therefore are not generalizable to all of SEC’s internal  supervisory controls. To review the fiscal year 2011 testing conducted by  each office, we reviewed documentation describing the methodologies  used and the results. As our review did not identify or test every control, it  should not be interpreted as an attestation of the offices’ internal control.

We conducted this performance audit from February 2012 to April 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

section_title: Appendix II: Comments from the Securities and Exchange Commission

section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Andrew Pauline (Assistant  Director), Bethany Benitez, Tiffani Humble, Matt Keeler, Kristen Kociolek,  Jonathan Kucskar, Mark Molino, Luann Moy, Mark Ramage, and Barbara  Roesmann made key contributions to this report.


Question-summary annotations: questions: question: What did the SEC do to maintain internal supervisory control after 2010?
answer: After the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) in 2010, the Securities and Exchange Commission's (SEC) Office of Compliance Inspections and Examinations, Division of Corporation Finance, and Division of Enforcement (herein "the offices") established a working group that developed an internal supervisory control framework.
child_questions: question: What is internal supervisory?
answer: Internal supervisory controls include the processes established by management to help ensure that procedures applicable to staff are performed completely, consistent with applicable policies and procedures, and remain current.

question: To what extent is the control framework consistent with federal standards?
answer: The overall control framework is generally consistent with federal internal control standards, which includes identifying and assessing risks, identifying and assessing internal controls, and reporting the results of testing to management and Congress.

questions: question: How did the offices ensure that they can consistently carry out their responsibilities?
answer: As part of developing and applying an internal supervisory control framework, the offices each identified internal supervisory controls to mitigate risks that could undermine their ability to consistently and competently carry out their responsibilities.
child_questions: question: How are these internal supervisory controls implemented in the offices?
answer: These internal supervisory controls are built into the offices' work processes--that is, the processes they use to carry out examinations, financial securities filing reviews, and investigations--and range from specific supervisory review and approval activities to management reports used to monitor the processes as a whole.
child_questions: question: How are the controls built into the system at Enforcement?
answer: For example, within Enforcement, supervisors must review and approve staff recommendations that a tip, complaint, or referral be closed without further investigation.

question: How were these controls developed?
answer: Many of the offices' internal supervisory controls existed prior to the development of SEC's internal supervisory control framework; others were developed through the process of developing the framework.

questions: question: What deficiencies did GAO identify in its tests?
answer: GAO identified deficiencies in about half of the 60 internal supervisory controls it tested. Specifically, GAO found that for 27 internal supervisory controls (1) the description of the control activity did not accurately reflect policy or practice; (2) documentation demonstrating execution of the control was not complete, clear, or consistent; or (3) the controls lacked clearly defined control activities.
child_questions: question: How do these deficiencies affect management?
answer: These control deficiencies may not prevent management from detecting whether the activities of the offices are conducted completely and in accordance with policy.

question: What implications do these findings have for management?
answer: However, similarities in the nature of deficiencies across all three offices suggest that management attention to the design and operation of internal supervisory controls is warranted.

question: What steps have agencies taken to address these deficiencies?
answer: The offices have addressed or have been taking steps to address all of the 27 identified deficiencies. Some steps have been taken based on the offices' section 961 assessments. SEC addressed other deficiencies during GAO's review after discussions with GAO detailing the identified deficiency.
child_questions: question: Why can't GAO assess the effectiveness of these changes?
answer: Not enough time has passed for GAO to assess the effectiveness of these changes.

questions: question: Why have SEC internal controls come under recent scrutiny?
answer: Recent high-profile securities frauds have raised questions about the internal controls that SEC has in place to help ensure that staff carry out their work completely and in a manner consistent with applicable policies and procedures.

question: What does Section 961 of the Dodd-Frank Act mandate regarding the SEC?
answer: Section 961 of the Dodd-Frank Act directs SEC to annually assess and report on internal supervisory controls for staff performing examinations, corporate financial securities filing reviews, and investigations.
child_questions: question: What does it require of GAO?
answer: The act also requires GAO to review SEC's structure for internal supervisory control applicable to staff working in those offices.

question: What does this report cover?
answer: This report examines the (1) steps the offices took to develop an internal supervisory control framework; (2) internal supervisory controls each office has implemented; and (3) extent to which the internal supervisory controls have operated as intended.
child_questions: question: How did GAO collect data for this report?
answer: GAO reviewed each office's section 961 assessments and reports; analyzed the offices' internal supervisory control framework; and tested a sample of 60 supervisory controls using random samples and nonprobability selections.