Securities and Exchange Commission: Systematically Assessing Staff Procedures and Enhancing Control Design Would Strengthen Internal Oversight
Released: 2019-12-19T00:00:00

Letter

Background

The Dodd-Frank Act was enacted to promote the financial stability of the United States by improving accountability and transparency in the financial system and protecting consumers from abusive financial services practices, among other purposes. To help detect and prevent securities misconduct, section 961 of the Dodd-Frank Act promotes complete and consistent performance of SEC staff examinations, investigations and reviews, and appropriate supervision of these activities through internal supervisory controls. SEC has submitted eight annual reports to Congress under section 961, all of which stated that both its internal supervisory controls and its staff procedures were effective for the period under review. In addition, all such reports stated that no significant deficiencies in internal supervisory controls were identified.

Section 961 does not define “internal supervisory control.” SEC has defined internal supervisory controls as the processes established by management to monitor that the procedures applicable to staff (that is, established day-to-day procedures to be followed by the employees within the applicable programs) are consistently being performed according to policy and procedures, and also remain reasonable, adequate, and current.

SEC is the primary regulator of the U.S. securities markets and is responsible for protecting investors, maintaining fair, orderly, and efficient markets, and facilitating capital formation. To fulfill this mission, SEC requires public companies to disclose meaningful financial and other information to the public, examines firms it regulates, and investigates potential violations of the federal securities laws. SEC is organized into five divisions and 24 offices. SEC’s approximately 4,400 staff are located in Washington, D.C., and in 11 regional offices. As discussed previously, four divisions and offices are subject to section 961 of the Dodd-Frank Act (see table 1).

SEC formalized its Section 961 Working Group in 2017. The primary purposes of the Working Group are to enhance the efficiency and effectiveness of SEC’s processes related to section 961 compliance and to enhance coordination and information sharing among the divisions and offices. The Working Group is a staff-level group comprising one or more representatives from each of the four divisions and offices subject to section 961 as well as the Office of the Chief Operating Officer. These staff are responsible for carrying out the Working Group’s responsibilities, which include establishing a common understanding and consistent approach to compliance; creating a means to share information and ideas to improve the efficiency and effectiveness of section 961 compliance activities; discussing best practices to streamline procedures and documentation of internal control testing and reporting; and developing and updating guidance related to implementing section 961.

Federal Internal Control Standards

Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control in federal agencies. Agency management is responsible for adapting the framework for an agency. Furthermore, an agency may use the framework to organize its development and implementation of internal controls and implement its standards throughout the agency or at an office level.

Five interrelated components and associated principles establish requirements for developing and maintaining an effective internal control system:

Control environment: The control environment is the foundation for an internal control system. It provides discipline and structure, which affect the overall quality of internal control. It influences how objectives are defined and control activities are structured. The oversight body and management establish and maintain an environment throughout the entity that sets a positive attitude toward internal control.

Risk assessment: Management assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Management assesses risks the entity faces from external and internal sources.

Control activities: Control activities are the actions management establishes through policies and procedures to achieve objectives and respond to risks in the internal control system, which includes the entity’s information system.

Information and communication: Management uses quality information to support the internal control system. Effective information and communication are vital for an entity to achieve its objectives. Entity management needs access to relevant and reliable communication related to internal and external events.

Monitoring: Internal controls are dynamic and have to be adapted continually to risks and changes an entity faces. Monitoring the internal control system is essential in helping internal control remain aligned with changing objectives, environment, laws, resources, and risks. Internal control monitoring assesses the quality of performance over time and promptly resolves the findings of audits and other reviews. Corrective actions are a necessary complement to control activities to achieve objectives.

To be effective, an agency’s internal control system must incorporate the five components of internal control in an integrated manner throughout its operations and on an ongoing basis. Once in place, internal control provides reasonable, not absolute, assurance of meeting agency objectives. When evaluating the design of internal control, management determines if controls individually and in combination are capable of achieving an objective and addressing related risks.

To the extent a control does not fully achieve an objective or address related risks, it is deficient, and such deficiencies may be associated with a control’s design or operation.

A deficiency in design exists when a control necessary to meet a control objective is missing, or an existing control is not properly designed so that even if the control operated as designed, the control objective would not be met.

A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively.

Federal Managers’ Financial Integrity Act and SEC Assurance Statement

In addition to the requirements under section 961 of the Dodd-Frank Act, SEC must establish and maintain effective internal control and financial management systems that meet the objectives of the Federal Managers’ Financial Integrity Act of 1982 (FMFIA). FMFIA requires agencies to annually assess and report on the internal controls that protect the integrity of their programs and whether financial management systems conform to related requirements. In addition, FMFIA requires agencies to provide an assurance statement regarding the effectiveness of the agency’s internal controls. SEC’s internal controls for financial management systems are not included in this report because they are reported in our annual financial audit of SEC. In addition, all of SEC’s internal controls—including those which constitute internal supervisory controls—are in scope for FMFIA.

SEC’s Framework for Assessing the Effectiveness of Internal Supervisory Controls Reflected Internal Control Standards

In response to section 961 of the Dodd-Frank Act, the Working Group put in place a framework that provides guidance for division and office staff responsible for assessing the effectiveness of internal supervisory controls (control framework). The control framework draws on external sources such as federal internal control standards as well as internal documents such as SEC’s Reference Guide for Compliance with Section 961 of the Dodd-Frank Act, the Risk Management and Internal Control Review Reference Guide from the Office of the Chief Operating Officer, and the charter for the Working Group. These internal documents include definitions, criteria, and other guidance and together compose SEC’s control framework. For example, the control framework includes time frames for when divisions and offices should assess their internal supervisory controls and report findings to Congress (see fig. 1).

SEC’s control framework consists of three phases—risk assessment, internal supervisory control testing, and communication of results—during which division and office staff conduct activities to systematically assess and report on the effectiveness of their internal supervisory controls (see fig. 2 for examples).

Changes to SEC’s Control Framework Included Refining Guidance and Classification of Internal Supervisory Controls

Changes to SEC’s control framework since our last review (which focused on fiscal years 2013–2015) include revisions to key guidance documentation and reclassification of some controls (as nonsupervisory controls). The Working Group revised elements of its control framework documentation since our last review. First, the Working Group streamlined the Reference Guide for Compliance with Section 961 by removing direct guidance—for example, steps staff should take to assess the design and operation of internal supervisory controls—and replaced it with references to the Risk Management and Internal Control Review Reference Guide. Second, the Working Group also updated other information such as the agency’s definition for internal supervisory control. Third, some divisions and offices changed which controls they considered to be internal supervisory controls subject to section 961 assessments. As stated previously, SEC defines internal supervisory controls as the processes established by management to monitor that procedures applicable to staff (the established day-to-day procedures to be followed by the employees within the applicable program) are consistently being performed according to policy and procedures, and also remain reasonable, adequate, and current. Division and Office officials elaborated further, stating they only consider controls that are supervisory in nature and directly related to the consistent and complete execution of examinations of registered entities, enforcement investigation, or reviews of corporate financial securities filings to be internal supervisory controls relevant to section 961.

More specifically, OCIE reduced the number of controls it classified as internal supervisory controls from 40 in fiscal year 2015 to 14 in fiscal year 2018 by reclassifying some controls as nonsupervisory controls and by consolidating others (see table 2). For example, OCIE no longer classifies examination program strategy and selection controls (such as development and dissemination of examination program goals) as internal supervisory controls. Therefore, the controls are no longer assessed under section 961. OCIE officials explained that the strategy and selection of controls are performed by management and related to the selection of registrants for examinations, and not to staff conducting examinations consistently with professional competence and integrity.

Similarly, the number of internal supervisory controls Corporation Finance maintained decreased from 25 in fiscal year 2015 to eight in fiscal year 2018. Corporation Finance officials told us that they determined that certain controls previously considered relevant to section 961 did not represent processes that fall within the core function of reviewing corporate financial securities filings and thus should not be considered internal supervisory controls under section 961. Enforcement maintained 25 internal supervisory controls from fiscal year 2015 to fiscal year 2018, while OCR had 13–14 internal supervisory controls during the same period.

SEC’s Control Framework Reflected Internal Control Standards

As of the end of fiscal year 2018, SEC’s control framework continued to reflect key components of internal control. We compared the framework against federal internal control standards. Specifically, we assessed whether the control framework reflected the five components of internal control—control environment, risk assessment, control activities, information and communication, and monitoring.

We determined that SEC’s control framework included attributes covering each of the components. For example, the framework included oversight structures to monitor the design and operation of division and office internal supervisory controls, assigned responsibilities to division and office staff, incorporated steps for staff to follow to assess risks and test internal supervisory controls, and included mechanisms to correct deficiencies and report findings to internal and external stakeholders (such as Congress). See table 3 for additional examples that illustrate how the control framework reflected relevant standards.

SEC Lacks Policies and Procedures to Systematically Assess the Effectiveness of Staff Procedures

Divisions and offices have not developed written policies and procedures to ensure that they systematically assess the effectiveness of procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. As mentioned previously, the report required under section 961 of the Dodd-Frank Act must include an assessment of the effectiveness of both internal supervisory controls and staff procedures.

Division and office officials told us that they used findings and conclusions from their internal supervisory control assessments to support their conclusions that staff procedures were effective. As discussed earlier, SEC defines internal supervisory controls to include two types of processes used by managers: (1) those used to monitor whether staff follow existing procedures and (2) those used to monitor whether the procedures remain reasonable, adequate, and current.

We found that SEC’s assessments of internal supervisory controls did not directly assess the effectiveness of staff procedures for three primary reasons. First, the controls included in SEC’s assessment generally consist of processes that monitor whether staff follow existing procedures, not processes that monitor whether the procedures remain reasonable, adequate, and current. Second, SEC’s assessments of internal supervisory control focus on evaluating the extent to which managers executed the controls for which they are responsible. Although the controls monitor whether staff follow underlying procedures, the control assessments do not directly address whether those underlying staff procedures are designed to effectively achieve their stated objectives (for example, identifying and mitigating securities misconduct by securities market participants). Lastly, documentation of division and office internal supervisory control assessments did not speak to how division and office staff reached conclusions that procedures applicable to staff were effective.

In addition to findings from internal supervisory control assessments, SEC officials also told us about policies and procedures, compliance testing, and other activities that provide information regarding the effectiveness of staff procedures. Corporation Finance officials further elaborated by stating that there is no single or discrete assessment to test the effectiveness of staff procedures. Rather, the officials explained that the division relies on activities performed throughout the year that contribute to the evaluation of the effectiveness of staff procedures. Examples of activities all or some divisions and offices referenced included the following:

Enforcement, Corporation Finance, OCIE, and OCR officials told us that senior management from each division or office monitor the effectiveness of their programs throughout the year to help assess the effectiveness of staff procedures. Examples of monitoring activities include discussions with staff and subject-matter experts who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. OCR and Corporation Finance provided examples of documentation for these activities.

Enforcement, Corporation Finance, OCIE, and OCR provided documentation that showed they developed review teams, task forces, projects, or initiatives that review specific policies or risks, which can result in updates to procedures.

Corporation Finance, OCIE, and OCR officials told us that they have implemented reviews and redesigns of their policies and procedures through periodic reviews of their respective program manuals.

See table 4 below for additional examples of activities that divisions and offices referenced as assessments of the effectiveness of staff procedures.

The activities mentioned above could provide valuable information for staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings, but they do not represent systematic assessments for the purposes of section 961. In particular, these activities varied between divisions and offices, mostly were implemented on an irregular basis, and were not established through written policies or procedures. In addition, none of the divisions and offices provided documentation linking the results of these, or any other, activities to the conclusions in SEC’s annual reports to Congress under section 961, each of which have stated that SEC’s staff procedures were effective for the period under review. Furthermore, only Corporation Finance officials told us that they discuss the effectiveness of staff procedures with their Director when they present their annual internal supervisory control assessment findings.

As stated previously, the control framework includes an oversight structure, timelines, evaluation criteria, and documentation requirements, and SEC considers its control assessments under the framework to represent assessments of the effectiveness of staff procedures. However, SEC has not developed detailed policies, procedures, or guidance for assessing the effectiveness of staff procedures for the purposes of section 961. For example, the activities that divisions and offices referenced as assessing the effectiveness of staff procedures were not established through written policies for section 961-reporting purposes. And, existing guidance documents such as the Reference Guide for Compliance with Section 961 do not include steps or documentation requirements for assessing staff procedures.

Federal internal control standards state the importance for agency management to establish policies and procedures to achieve objectives. Because divisions and offices lack written policies and procedures for assessing the effectiveness of staff procedures, each uses informal methods and varied processes instead of a systematic approach that document how each division and office reached its conclusions (that staff procedures were effective) in SEC’s annual section 961 report to Congress. Establishing written policies and procedures for systematically assessing the effectiveness of staff procedures would provide SEC with greater assurance that the procedures were effective in the context of section 961 and would help divisions and offices meet objectives.

Selected Controls Were Designed Consistent with Standards, but Some Lacked Directions for Implementing Control Activities

To evaluate the extent to which SEC’s internal supervisory controls met federal internal control standards and SEC guidance, we evaluated a non-generalizable sample of internal supervisory controls. We assessed whether (1) controls were designed to address objectives and respond to risks and (2) control activities were implemented through policies. We discuss below our findings related to the 39 internal supervisory controls that SEC identified as related to section 961. See appendix II for an example of the template we used to evaluate the controls.

All of the Selected Controls Addressed Identified Objectives and Risks

All 39 internal supervisory controls that we evaluated incorporated design elements to achieve SEC’s control objectives and respond to risks that SEC identified. We assessed the overall design of selected internal supervisory controls against four design elements identified in federal internal control standards:

Control activities should respond to identified objectives and risks,

Appropriate types of control activities should be used,

Control activities should be designed at the appropriate levels of the organization (Director, Assistant Director, Branch Chief, etc.), and

Control activity duties should be segregated where practical.

We found that, for the selected controls, each division and office designed control activities to respond to identified objectives and risks by identifying the risks addressed by each control and the control objective (how a control will address the associated risk) in their risk and control matrixes. In their risk and control matrixes, the divisions and offices also have established characteristics identified by relevant standards as important for designing appropriate controls, including the control frequency, control owner, and whether a control is automated or manual, preventive or detective, and key or secondary. To ensure that control activities are designed at the appropriate levels, each division and office identified control owners in their risk and control matrixes and in the control descriptions they identified the job title of staff responsible for executing the controls. Finally, the divisions and offices segregated control duties in cases in which the need for such segregation was apparent. For example, a second review by a higher-level official was included in some controls that required approval decisions. For the results of our control design assessments, see appendix III.

Some Control Activity Descriptions Lacked Sufficient Information for Implementation and Monitoring

Ten of the 39 controls we evaluated lacked key information needed to help ensure execution of the control activities (see table 5). Federal internal control standards state that documentation is required for the effective design, implementation, and operating effectiveness of an entity’s internal control system, including documentation of internal control responsibilities through policies. We assessed SEC’s documented control activities against three key attributes identified in federal internal control standards:

Establishment of procedures to support control execution,

Assignment of responsibility for control execution, and

Establishment of time frames for control execution.

Two or three of the selected controls from each division and office did not incorporate key execution attributes, as seen in table 5. For the results of our control design assessments, see appendix III.

Descriptions for many control activities did not specify procedures to be performed or, in some cases include time frames, but all controls we assessed assigned responsibility for control execution (see table 6). More specifically, 10 of the 39 controls had no requirement to document execution of the control activities. For example, one Enforcement control and two Corporation Finance controls intended to monitor compliance with timeliness metrics did not include a requirement to document whether the control activities had been executed—that managers completed the review of the timeliness reports, noted if any cases were nearing the time frame threshold, or took appropriate actions in response.

In addition, three of the 39 controls we reviewed did not include the control activity attribute of follow-up actions to be taken. For example, the Corporation Finance timeliness controls discussed above also did not establish follow-up actions for cases in which a team or individual neared the timeliness threshold. Follow-up actions could include emailing or calling relevant staff when a timeliness threshold was within a certain number of days of being breached. The divisions and offices did not establish operational procedures for how the control activities would be performed in three of the 39 controls we reviewed. For example, an OCIE control intended to track enrollment and completion of new examiner training lacked underlying procedures for identifying or tracking training progress of new employees.

The divisions and offices did not establish time frames for executing control activities in three of the 39 controls we reviewed. For example, while the Corporation Finance timeliness controls discussed above identified the reports to be reviewed, one of the two controls did not specify when the reports should be reviewed.

By not incorporating key control attributes into their control activities, SEC may not have reasonable assurance that internal supervisory controls are effectively implemented. Some of the controls with weaknesses in one or more of the control attributes lacked documentation of the controls’ execution, which hindered our ability to test whether the controls operated as intended, as discussed in the next section. For example, two of the timeliness controls for Corporation Finance, described above, did not include a documentation requirement, and no documentation of control execution was created. In lieu of reviewing documentation of control execution, for SEC’s assessment of the effectiveness of its internal supervisory controls, the divisions and offices asked supervisors twice a year (by email) whether they had executed this control weekly over the course of the year. Staff from some divisions and offices said the reason that control activity attributes were not included in some of the controls was because policies and procedures had been long established and orally communicated, but not written into the control activities.

Based on Standards for Internal Control in the Federal Government, SEC developed a reference guide to provide guidance for identifying, documenting, and monitoring controls. The reference guide states that internal control activities should be written to describe the actual activities performed to meet the control objective, and at a minimum, identify control procedures and how they are to be executed, establish a documentation requirement for control execution, and assign responsibility and establish time frames for control execution.

Following SEC guidance for developing control activities could help divisions and offices ensure evidence exists of control execution and better enable control monitoring by SEC, and oversight by external parties, such as GAO and the SEC Inspector General. In turn, better control monitoring would help ensure that SEC’s internal supervisory controls are effectively implemented and that procedures necessary to achieve organizational objectives are followed. Furthermore, enhancing control activity descriptions would provide SEC greater assurance that staff have the information necessary to effectively implement the controls.

Assessed Controls Operated or Partially Operated as Intended, but Some Controls Could Not Be Assessed Because of Documentation Weaknesses

We selected 18 of 39 internal supervisory controls across the four divisions and offices to assess whether they operated as intended in fiscal year 2018. (See figure 3 for an overview of how we determined they operated as intended, partially operated as intended, or did not operate as intended.) As an example of how we conducted these assessments, we reviewed one OCIE control that called for manager approval at three points of an examination and additional assistant director approval to close the examination, as described in OCIE’s control documentation. To assess whether this control operated as intended, we selected and reviewed a random, generalizable sample of examinations in OCIE’s internal system to determine whether all of the control’s activities—in this case, management approvals—had been executed.

We could not assess some of the controls we selected because SEC did not provide sufficient documentation to allow us to determine whether the control operated as intended. For example, two of four Corporation Finance controls did not include a documentation requirement for weekly monitoring of staff compliance with internal policy. As a result, documentation did not exist for us to assess whether supervisors executed these control activities throughout the year. For more information on how we determined whether controls were operating as intended, see appendix I.

All of the Controls That Could Be Assessed Operated or Partially Operated as Intended

Of the 15 controls we could assess, 13 operated as intended and two partially operated as intended (see table 7). We could not assess three controls because sufficient documentation was not provided. More specifically, a control documentation requirement was not established for the three controls—as identified through our assessment of the control’s design, described earlier.

We determined that two OCIE controls partially operated as intended. For example, while we found that 20 percent of sampled OCIE examinations were not approved within the designated deadline, all examinations were closed and included all required elements (see table 8).

Some Selected Controls Could Not Be Assessed Because Documentation of Control Execution Did Not Exist

We were unable to assess three of 18 selected controls because the divisions and offices did not provide sufficient documentation on the execution of control activities (see table 9). We found these controls lacked a documentation requirement for control execution in their control activity descriptions and did not produce sufficient documentation, which prevented us from determining whether these controls operated as intended. For example, two of four Corporation Finance controls did not include a requirement to document execution of the control activity— weekly monitoring of staff compliance with internal policy. Because these controls did not produce documentation of weekly monitoring throughout the year as prescribed in the control activity frequency, we did not receive documentation to allow us to assess whether supervisors executed these control activities on a weekly basis or, in some cases, at all. Additionally, we could not assess one selected OCIE control involving tracking of new employee training.

Conclusions

To help detect and prevent securities misconduct, section 961 of the Dodd-Frank Act requires SEC to assess the effectiveness of both its internal supervisory controls and the procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. While SEC has established a framework for systematically assessing the effectiveness of its internal supervisory controls, it has not established a framework for systematically assessing the effectiveness of staff procedures or documenting how SEC reached related conclusions about the procedures in its annual reports to Congress under section 961. Creating written policies and procedures to systematically assess the effectiveness of staff procedures and documenting the results of such assessments would provide SEC with greater assurance that the staff procedures are effective, a key objective of section 961.

Every control we reviewed incorporated design elements to achieve SEC’s control objectives and respond to risks that it identified. However, nine of the 39 controls did not incorporate one or more key attributes that would help ensure execution of the control, including documentation requirements, detailed procedures, identification of follow-up actions, assignment of responsibility for control execution, and time frames for control execution. Following SEC guidance for developing detailed control activities could help divisions and offices ensure evidence of control execution and better enable control monitoring by SEC and external parties, such as GAO and the SEC Inspector General. In turn, better control monitoring would help ensure that SEC’s internal supervisory controls are effective and that procedures necessary to achieve organizational objectives are followed. Furthermore, enhancing control activity descriptions would provide SEC greater assurance that staff have the information necessary to effectively implement the controls.

Recommendations for Executive Action

We are making the following five recommendations to SEC.

The SEC Chair should direct the Directors of the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop written policies and processes to systematically assess the effectiveness of staff procedures (procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings). Examples of elements SEC could include in the policies and processes are the steps necessary to conduct such assessments, including time frames in which the assessments should be performed and reviewed; assignment of responsibilities related to the assessments; requirements for documenting assessments; and steps for staff to take to mitigate and report deficiencies identified as a result of the assessments. (Recommendation 1)

The Director of the Division of Corporation Finance should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 2)

The Director of the Division of Enforcement should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 3)

The Director of the Office of Compliance Inspections and Examinations should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 4)

The Director of the Office of Credit Ratings should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 5)

Agency Comments

We provided a draft of this report to SEC for review and comment. In written comments (reproduced in appendix VI), SEC agreed with our findings and concurred with our recommendations. In addition, SEC provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Chair of SEC, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VII.

Appendix I: Objectives, Scope, and Methodology

This report focuses on activities that fall within the purview of the Division of Corporation Finance (Corporation Finance), Division of Enforcement (Enforcement), Office of Compliance Inspections and Examinations (OCIE), and Office of Credit Ratings (OCR) at the Securities and Exchange Commission (SEC)—to which we refer collectively as the divisions and offices. We examined (1) the extent to which SEC’s internal supervisory control framework during fiscal years 2016–2018 reflected federal internal control standards; (2) how SEC evaluated the effectiveness of staff procedures in fiscal year 2018; (3) the extent to which selected controls in fiscal year 2018 were designed consistent with relevant standards; and (4) the extent to which selected controls operated as intended in fiscal year 2018.

For our first objective, we obtained and reviewed relevant documentation on SEC’s internal supervisory control framework for fiscal years 2016– 2018 and interviewed division and office staff responsible for developing and updating the framework. We then assessed this framework against Standards for Internal Control in the Federal Government and determined the extent to which the framework reflected these standards. Specifically, we assessed the framework against the five components of internal control—control environment, risk assessment, control activities, information and communication, and monitoring—and the 17 principles associated with these components. We compared information on changes SEC made to its internal supervisory control framework with information from our previous review and federal internal control standards to determine the extent to which the framework continued to reflect internal control standards.

For our second objective, we reviewed policies, procedures, and guidance documents (for fiscal year 2018) relating to SEC assessments of the effectiveness of procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. We also interviewed SEC staff to obtain an understanding of the steps and activities that divisions and offices take to assess the effectiveness of staff procedures. We intended to assess how SEC assessed staff procedures to determine the extent to which SEC’s assessments reflected federal internal control standards. However, as discussed in the report, we found SEC did not have a framework for assessing the effectiveness of staff procedures. We therefore examined policies, procedures, and guidance, but did not assess them against the components and principles associated with the federal standards for internal control.

For our third objective, we used the policies, procedures, and control objectives to determine if the design of selected division and office internal supervisory controls in place during fiscal year 2018 was consistent with federal internal control standards and SEC guidance for designing internal controls. We developed an evaluation template and used it to assess selected controls from each division and office by having multiple analysts conduct independent reviews and then reached a final consensus by conducting a joint review with the same analysts. We used Standards for Internal Control in the Federal Government and The Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control – Integrated Framework to develop our template. We also reviewed documents and interviewed staff to obtain a thorough understanding of the internal supervisory controls used to oversee the processes for conducting examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings.

We selected for our review a non-generalizable sample of 53 controls in place during fiscal year 2018—13 controls in Corporation Finance, 15 controls in Enforcement, 11 in OCIE, and 14 in OCR. We grouped these controls into sets because some underlying staff processes had multiple associated controls. In cases in which we selected a control that was part of a set, we would review every control in the associated set. We selected controls and control sets that SEC designated as being associated with processes that have the highest risk or potential impact on achieving stated objectives until we reached our target of 10–15 controls per division or office. Some control sets also contained controls that were not related to section 961. Therefore, to fully assess complete control sets associated with underlying processes, our selection contained some controls that were not related to section 961. However, in this report we only discuss and include analysis for those controls that SEC identified as related to section 961, which comprises 39 controls—eight in Corporation Finance, 10 in Enforcement, eight in OCIE, and 13 in OCR.

For our fourth objective, we developed an evaluation template for each control and conducted independent primary and secondary reviews to reach a final consensus on the operation of each control. The template was created using SEC’s control activities and related policy and procedural documents we received as part of our design assessment. We used the template to determine the extent to which the execution of controls met the design criteria. Depending on the extent to which they met criteria established from control design documents, the selected controls were grouped under one of the following categories: (1) operated as intended, (2) partially operated as intended, (3) did not operate as intended, and (4) could not be assessed because control documentation did not exist due to design weaknesses, was not received, or was not relevant.

Because the nature of controls varied, we evaluated controls by applying the factors below in conjunction with professional judgment. We focused on whether deficiencies would affect the implementation and operation of controls.

For controls that operated as intended, we determined that the divisions and offices provided documentation demonstrating that all control activities were executed for the instances of control implementation we reviewed.

We considered controls to have partially operated as intended if the documentation provided supported that only some control activities were executed or if at least one control activity did not operate as intended, but the overall control was executed for most instances.

We did not identify any controls that did not operate as intended. This determination would have applied to controls for which we received sufficient documentation to assess the control’s operation and for which the divisions and offices did not execute all control activities in most instances.

For controls that we could not assess, we did not receive sufficient documentation that would enable us to make a determination of whether the control was executed or operated as intended. For these controls, we also used the results of our design assessments to determine whether the controls included a documentation requirement that would enable us to assess whether they operated as intended.

We judgmentally selected a non-generalizable sample of 18 controls across all four divisions and offices from the population of 39 internal supervisory controls we reviewed in the third objective. We selected these controls based on factors such as whether they were classified as key to achieving objectives, high-risk, or having high potential impact on achieving stated objectives or likelihood of failure. We then created a generalizable, random sample of cases to review for eight controls, and we reviewed all instances for the remaining controls because they occurred annually or had few instances. In some cases, we conducted on-site testing in which we assessed samples of cases for controls by demonstrations of the divisions and offices’ internal systems.

We conducted this performance audit from October 2018 to December 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Template for GAO’s Assessment of the Internal Supervisory Control Design of the Securities and Exchange Commission

This appendix illustrates the template we used to assess the design of selected controls from each division and office that we reviewed at the Securities and Exchange Commission (SEC). For each control, we reviewed policies, procedures, and control objectives to determine if the design of the selected internal supervisory controls was consistent with federal internal control standards and SEC guidance for designing internal controls.

Appendix III: GAO Testing Results for the Design of Selected Securities and Exchange Commission Controls, Fiscal Year 2018

To assess the extent to which design of the Securities and Exchange Commission’s (SEC) internal supervisory controls was consistent with federal internal control standards and SEC guidance for designing internal controls, we reviewed 39 internal supervisory controls across the four divisions and offices in place during fiscal year 2018. We used the policies, procedures, and control objectives to determine if the controls’ designs were consistent with the standards and guidance.

Appendix IV: Template for GAO’s Assessment of the Operation of Internal Supervisory Controls by the Securities and Exchange Commission

This appendix illustrates the template we used to assess the operation of selected Securities and Exchange Commission internal supervisory controls. For each control, we compared control activity descriptions, including policy and procedure documents to determine whether selected controls operated as intended.

Appendix V: GAO Testing Results for Selected Securities and Exchange Commission Controls, Fiscal Year 2018

As part of our review, we tested 18 internal supervisory controls across four divisions and offices at the Securities and Exchange Commission (SEC) to determine whether they operated as intended. Controls were assessed using SEC’s control activity descriptions, including related policy and procedure documents. For controls that operated as intended, SEC provided documentation demonstrating that all control activities were executed. We considered controls to have partially operated as intended if the documentation supported that only some control activities were executed or if at least one control activity did not operate as intended, but the overall control was executed. We did not identify any controls that did not operate as intended, but this would have applied to controls for which we received sufficient documentation and the divisions and offices did not execute all control activities. Controls that we could not assess lacked sufficient documentation that would have enabled us to determine whether they operated as intended.

Appendix VI: Comments from the Securities and Exchange Commission

Appendix VII: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Kevin Averyt (Assistant Director), Christopher Ross (Analyst in Charge), Aaron A. Colsher, Justin Fisher, Efrain Magallan, Marc Molino, Kirsten Noethen, Barbara Roesmann, and Farrah Stone made key contributions to this report.