Financial Audit: Securities and Exchange Commission's Financial Statements for Fiscal Years 2007 and 2006
Released: 2007-11-16T00:00:00

Letter

Opinion on Financial Statements

SEC’s financial statements, including the accompanying notes, present fairly, in all material respects, in conformity with U.S. generally accepted accounting principles, SEC’s assets, liabilities, net position, net costs, changes in net position, budgetary resources, and custodial activity as of, and for the fiscal years ended, September 30, 2007, and September 30, 2006. However, misstatements may nevertheless occur in other financial information reported by SEC and may not be prevented or detected because of the internal control deficiencies described in this report.

As disclosed in footnote 1.C. to SEC’s financial statements, in fiscal year 2007, SEC changed its method of accounting for user fees collected in excess of current-year appropriations.

Opinion on Internal Control

Because of the material weakness and significant deficiencies in internal control discussed below, SEC did not maintain effective internal control over financial reporting as of September 30, 2007, and thus did not have reasonable assurance that misstatements material in relation to the financial statements would be prevented or detected on a timely basis. Although certain compliance controls should be improved, SEC maintained, in all material respects, effective internal control over compliance with laws and regulations as of September 30, 2007, that provided reasonable assurance that noncompliance with laws and regulations that could have a direct and material effect on the financial statements would be prevented or detected on a timely basis. Our opinion on internal control is based on criteria established under 31 U.S.C. § 3512(c)(d), commonly referred to as the Federal Managers’ Financial Integrity Act (FMFIA) and the Office of Management and Budget (OMB) Circular No. A-123, Management Accountability and Control.

During this year’s audit, we identified significant control deficiencies in SEC’s financial reporting process, which taken collectively, result in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected. Therefore, we considered the combination of the following control deficiencies to collectively constitute a material weakness in SEC’s financial reporting process: period-end financial reporting process, disgorgements and penalties accounts receivable, accounting for transaction fee revenue, and preparing financial statement disclosures.

In addition to the material weakness discussed above, we identified three significant deficiencies in internal control, which although not material weaknesses, represent significant deficiencies in the design or operation of internal control. Although we are considering these issues separately from the material weakness described above, they nevertheless adversely affect SEC’s ability to meet financial reporting and other internal control objectives. These deficiencies concern property and equipment, and accounting for budgetary resources.

In our prior year audit, we reported on weaknesses we identified in the areas of SEC’s (1) recording and reporting of disgorgements and penalties, (2) information systems controls, and (3) property and equipment controls. During fiscal year 2007, SEC improved its controls over the accuracy, timeliness, and completeness of the disgorgement and penalty data and used a much improved database for the initial recording and tracking of these data. However, the processing of these data for financial reporting purposes is still done through a manual process that is prone to error. We found that the internal controls that compensated for the manual processing of the related accounts receivable balances in fiscal year 2006 were not effective in fiscal year 2007. This issue is included in the material weakness in SEC’s financial reporting process for fiscal year 2007.

SEC continues to make progress in resolving the information security weaknesses. Previously identified weaknesses, though, still need to be addressed, along with new weaknesses we found during this year’s audit. Therefore, we consider information security to be a significant deficiency as of September 30, 2007. In addition, we continued to identify the same weaknesses in controls over property and equipment during this year’s audit, and therefore, we considered this area to be a significant deficiency as of September 30, 2007.

Although SEC had one material weakness and three significant control deficiencies in internal control, SEC’s financial statements were fairly stated in all material respects for fiscal years 2007 and 2006. However, the weaknesses in internal control noted above may adversely affect decisions by SEC management that is based, in whole or in part, on information that is inaccurate because of this weakness. In addition, unaudited financial information reported by SEC, including performance information, may also contain misstatements resulting from these weaknesses.

We will be reporting additional details concerning the material weakness and the significant deficiencies separately to SEC management, along with recommendations for corrective actions. We will also be reporting less significant matters involving SEC’s system of internal controls separately to SEC management.

Material Weakness

Financial Reporting Process

During this year’s audit, we found control deficiencies in SEC’s period-end financial reporting process, in its calculation of accounts receivable for disgorgements and penalties, in its accounting for transaction fee revenue, and in preparing its financial statement disclosures. We believe these control deficiencies, collectively, constitute a material weakness.

Period-End Financial Reporting Process:

SEC’s financial management system does not conform to the systems requirements of OMB Circular No. A-127, Financial Management Systems. Specifically, Circular No. A-127 requires that financial management systems be designed to provide for effective and efficient interrelationships between software, hardware, personnel, procedures, controls, and data contained within the systems. Circular No. A-127 further states that financial systems must have common data elements, common transaction processing, consistent internal controls, and efficient transaction entry, and that reports produced by the systems shall provide financial data that can be traced directly to the general ledger accounts.

SEC’s period-end financial reporting process for recording transactions, maintaining account balances, and preparing financial statements and disclosures are supported to varying degrees by a collection of automated systems that are not integrated or compatible with its general ledger system. These automated systems’ lack of integration and compatibility require that extensive compensating manual and labor-intensive accounting procedures, involving large spreadsheets and numerous posting and routine correcting journal entries, dominate SEC’s period-end financial reporting process. Some of SEC’s subsidiary systems, such as that for property and equipment and for disgorgements and penalties, do not share common data elements and common transaction processing with the general ledger system. Therefore, intermediary information processing steps, including extensive use of spreadsheets, manipulation of data, and manual journal entries, are needed to process the information in SEC’s general ledger. This processing complicates review of the transactions and greatly increases the risk that the transactions are not recorded completely, properly, or consistently, ultimately affecting the reliability of the data presented in the financial statements. Our identification this year of errors in SEC’s calculation of disgorgement and penalty accounts receivable, discussed below, illustrates this risk.

The risk to data reliability is further increased because basic controls over electronic data, such as worksheet and password protection, change history, and controls over data verification, such as control totals and record counts, were not consistently used during the data processing between the source systems and the general ledger. In addition, currently, SEC’s general ledger has several unconventional posting models and other limitations that prevent proper recording of certain transactions. As a result, SEC’s year-end reporting process requires extensive routine correcting journal entries to correct errors created by incorrectly posted transactions in its general ledger. We also noted that SEC’s documentation used to crosswalk individual accounts to the financial statement line items contained an incorrect routing to a line item on SEC’s Statement of Budgetary Resources for SEC’s year-end financial statement preparation process, which caused a material error in SEC’s draft financial statements. Also, SEC did not have detailed written documentation of its methodologies and processes for preparing financial statements and disclosures, increasing the risk of inconsistent and improper reporting and the risk that disruptions and error may arise when staff turnover occurs.

Disgorgements and Penalties Accounts Receivable:

As part of its enforcement responsibilities, SEC issues orders and administers judgments ordering, among other things, disgorgements, civil monetary penalties, and interest against violators of federal securities laws. SEC recognizes a receivable when SEC is designated in an order or a final judgment to collect the assessed disgorgements, penalties, and interest. At September 30, 2007, the gross amount of disgorgements and penalties accounts receivable was $330 million, with a corresponding allowance of $266 million resulting in a net receivable of $64 million.

In our reviews of the interim June 30, 2007, and year-end September 30, 2007, balances of accounts receivable for disgorgements and penalties, we found errors in SEC’s spreadsheet formulas resulting in overstatements of these receivable balances for both periods. These errors consisted of incorrectly changed spreadsheet formulas that affected the final calculated balances. SEC subsequently detected and corrected the June 30 errors, but then made different spreadsheet calculation errors in the year-end balances as of September 30, 2007, which we detected as part of our audit. SEC made adjustments to correct the errors, which were not material. However, SEC’s process for calculating its accounts receivable for disgorgements and penalties presents a high risk that significant errors could occur and not be detected. The main cause of these errors is the breakdown this year in the manual controls that were intended to compensate for the lack of an integrated accounting system for disgorgements and penalties, as discussed above. Specifically, although the journal entries posting the amounts to the general ledger were reviewed, this review did not extend to the preparation of the spreadsheet SEC used to document the accounts receivable calculation at June 30 and September 30, 2007, and therefore, was not sufficient to detect significant spreadsheet formula errors.

Accounting for Transaction Fee Revenue:

As one of its sources of revenue, SEC collects securities transaction fees paid by self-regulatory organizations (SRO) to SEC for stock transactions. SRO transaction fees are payable to the SEC twice a year –in March for the previous months September through December, and in September for the previous months January through August. Since the SROs are not required to report the actual volume of transactions until 10 business days after each month end, SEC estimates and records an amount receivable for fees payable by the SROs to SEC for activity during the month of September. At September 30, 2007, SEC estimated this receivable amount at $100.6 million. Based on information SEC received in mid-October concerning the actual volume of transactions, the amount of claims receivable at September 30, 2007, should have been $74.4 million. In previous years, SEC made adjustments to reflect the actual volume of transactions; however, SEC does not have written procedures to help ensure that this adjustment is made as a routine part of its year-end financial reporting process. We proposed, and SEC posted, the necessary audit adjustment to correct the amount of transaction fee revenue for fiscal year 2007.

Statement on Auditing Standards No.1, Codification of Auditing Standards and Procedures, which explains the accounting requirements for subsequent events, requires that events or transactions that existed at the date of the balance sheet and affect the estimates inherent in the process of preparing financial statements should be considered for adjustment to or disclosure in the financial statements through the date that the financial statements are issued. In addition, the concept of consistency in financial reporting provides that accounting methods, including those for determining estimates, once adopted, should be used consistently from period to period unless there is good cause to change.

Preparing Financial Statement Disclosures:

In our review of SEC’s year-end draft financial statement disclosures, we noted numerous errors including misstated amounts, improper break out of line items, and amounts from fiscal year-end 2006 incorrectly brought forward as beginning balances for fiscal year 2007. For example, in its disclosure for Custodial Revenues and Liabilities, SEC improperly excluded approximately $320 million in collections. In another example, for its disclosure on Fund Balance with Treasury, SEC misclassified approximately $90 million into incorrect line items. Also, in its disclosure for Fiduciary Assets and Liabilities, SEC’s beginning balances for Fund Balance with Treasury and for Liability for Fiduciary Activity were each misstated by $8.9 million due to errors in carrying forward ending balances from September 30, 2006. SEC revised the financial statement disclosures to correct the errors that we noted. We believe the cause of these and numerous other errors in the disclosures is due mainly to the lack of a documented timeline and process for completing the fiscal year 2007 financial statements and disclosures, including review of the disclosures. In addition, the cumbersome and complicated nature of SEC’s financial reporting process discussed above did not allow SEC finance staff sufficient time to carry out thorough and complete reviews of the disclosures in light of the November 15 reporting deadline.

Significant Deficiencies

We also identified three control deficiencies that adversely affect SEC’s ability to meet its internal control objectives. These conditions concern deficiencies in controls over (1) information security, (2) property and equipment, and (3) accounting for budgetary resources, which are summarized below.

Information Security

SEC relies extensively on computerized information systems to process, account for, and report on its financial activities and make payments. To provide reasonable assurance that financial information and financial assets are adequately safeguarded from inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction, effective information security controls are essential. These controls include security management, access controls, configuration management, physical security, and contingency planning. Weaknesses in these controls can impair the accuracy, completeness, and timeliness of information used by management and increase the potential for undetected material misstatements in the agency’s financial statements.

During fiscal year 2007, SEC made important progress in mitigating certain control weaknesses that were previously reported as unresolved at the time of our prior review. For example, SEC developed a comprehensive program for monitoring access activities to its computer network environment, tested and evaluated the effectiveness of controls for the general ledger system, and documented authorizations for software modifications. SEC also took corrective action to restrict access to sensitive files on its servers, change default database accounts that had known or weak passwords, and apply strong encryption key management practices for managing secure connections.

Despite this progress, SEC has not consistently implemented certain key information security controls to effectively safeguard the confidentiality, integrity, and availability of its financial and sensitive information and information systems. During this year’s audit, we identified continuing and new information security weaknesses that increase the risk that (1) computer resources (programs and data) will not be adequately protected from unauthorized disclosure, modification, and destruction; (2) access to facilities by unauthorized individuals will not be adequately controlled; and (3) computer resources will not be adequately protected and controlled to ensure the continuity of data processing operations when unexpected interruptions occur. For example, SEC had not yet mitigated weaknesses related to malicious code attacks on SEC’s workstations, had not yet adequately documented access privileges for a major application, and had not yet implemented an effective intrusion detection system. New control weaknesses in authorization, boundary protection, configuration management, and audit and monitoring that we identified this year include for example, the use of a single, shared user account for posting journal vouchers in a financial application, inadequate patching of enterprise databases, and inadequate auditing and monitoring capabilities on its database servers. Lapses in physical security enabled unauthorized network access from a publicly accessible location within SEC Headquarters. In addition, SEC did not have contingency plans for key desktops that support manual processes such as the preparation of spreadsheets. These weaknesses existed, in part, because SEC has not yet fully implemented its information security program.

Collectively, these problems represent a significant deficiency in SEC’s internal control over information systems and data. Specifically, the continuing and newly identified weaknesses decreased assurances regarding the reliability of the data processed by the systems and increased the risk that unauthorized individuals could gain access to critical hardware and software and intentionally or inadvertently access, alter, or delete sensitive data or computer programs. Until SEC consistently implements all key elements of its information security program, the information that is processed, stored, and transmitted on its systems will remain vulnerable, and management will not have sufficient assurance that financial information and financial assets are adequately safeguarded from inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction. We will be issuing a separate report on issues we identified regarding information security concerns at SEC.

Property and Equipment

SEC’s property and equipment consists of general-purpose equipment used by the agency; capital improvements made to buildings leased by SEC for office space; and internal-use software development costs for projects in development and production. SEC acquired approximately $27 million dollars in property and equipment during fiscal year 2007.

Similar to our last year’s audit, during the course of testing fiscal year 2007 additions, we noted numerous instances of inaccuracies in recorded acquisition costs and dates for property and equipment purchases, as well as unrecorded property and equipment purchases, and errors in amounts capitalized and amortized for internal-use software projects. In addition, errors were carried forward from the previous year. These systemic errors did not materially affect the balances reported for property and equipment or the corresponding depreciation/amortization expense amounts in SEC’s financial statements for fiscal year 2007; however, these conditions evidence a significant deficiency in control over the recording of property and equipment that affects the reliability of its recorded balances for property and equipment. Specifically, SEC lacks a process that integrates controls over capitalizing and recording property and equipment purchases. For example, SEC does not have a formalized, documented process for comparing quantity and type of item received against the corresponding order for property purchases. In addition, SEC does not have sufficient oversight of the recording of acquisition dates and values of the capitalized property. Further, SEC’s lack of an integrated financial management system for accounting for property and equipment, as discussed above, requires compensating procedures, which were not effective, to ensure that manual calculations, such as those for depreciation and amortization, are accurate. Until it has a systemic process that incorporates effective controls over receiving, recording, capitalizing, and amortizing property and equipment purchases, SEC will not have sufficient assurance over the accuracy and completeness of its reported balances for property and equipment.

Accounting for Budgetary Resources

For fiscal year 2007, SEC incurred $877 million in obligations, which represents legal liabilities against funds available to SEC to pay for goods and services ordered. At September 30, 2007, SEC reported that the amount of budgetary resources obligated for undelivered orders was $255 million, which reflects obligations for goods or services that had not been delivered or received as of that date. In our testing of undelivered order transactions for this year’s audit, we identified several concerns over SEC’s accounting for obligations and undelivered orders. Specifically, we found numerous instances in which SEC (1) recorded obligations prior to having documentary evidence of a binding agreement for the goods or services, (2) recorded invalid undelivered order transactions due to an incorrect posting configuration in SEC’s general ledger, and (3) made errors in recording new obligations and deobligations due to the use of incorrect accounts and by posting incorrect amounts in the general ledger.

The majority of exceptions related to these issues, amounting to approximately $76 million, were corrected by SEC through adjusting journal entries. While the remaining uncorrected amounts did not materially affect the balances on the Statement of Budgetary Resources at September 30, 2007, ineffective processes that caused these errors constitute a significant deficiency in SEC’s internal control over recording and reporting of obligations, and puts SEC at risk that the amounts recorded in the general ledger and reported on SEC’s Statement of Budgetary Resources are misstated. Specifically, SEC’s general ledger is not configured to properly post related entries, thereby resulting in the need to routinely correct entries. Extensive reviews of the budgetary transactions, along with significant adjusting journal entries, are needed to compensate for the system limitations. The errors in recording new obligations and deobligations that we found in our audit indicate a lack of effective review over those transactions. Further, SEC does not have policies or internal controls to prevent recording of obligations that are not valid. Recording obligations prior to having documentary evidence of a binding agreement for the goods and services is a violation of the recording statute, and may result in funds being reserved unnecessarily and therefore made unavailable for other uses should the agreement not materialize. In addition, early recording of obligations may result in charging incorrect fiscal year funds for an agreement executed in a later fiscal year.

Compliance with Laws and Regulations

Our tests for compliance with selected provisions of laws and regulations disclosed no instances of noncompliance that would be reportable under U.S. generally accepted government auditing standards or OMB audit guidance. However, the objective of our audit was not to provide an opinion on overall compliance with laws and regulations. Accordingly, we do not express such an opinion.

Consistency of Other Information

SEC’s Management’s Discussion and Analysis and other accompanying information contain a wide range of data, some of which are not directly related to the financial statements. We do not express an opinion on this information. However, we compared this information for consistency with the financial statements and discussed the methods of measurement and presentation with SEC officials. Based on this limited work, we found no material inconsistencies with the financial statements or nonconformance with OMB guidance. However, because of the internal control weaknesses noted above, misstatements may occur in related performance information.

Objectives, Scope, and Methodology

SEC management is responsible for (1) preparing the financial statements in conformity with U.S. generally accepted accounting principles; (2) establishing, maintaining, and assessing internal control to provide reasonable assurance that the broad control objectives of FMFIA are met; and (3) complying with applicable laws and regulations.

We are responsible for obtaining reasonable assurance about whether (1) the financial statements are presented fairly, in all material respects, in conformity with U.S. generally accepted accounting principles; and (2) management maintained effective internal control, the objectives of which are the following: Financial reporting: Transactions are properly recorded, processed, and summarized to permit the timely and reliable preparation of financial statements in conformity with U.S. generally accepted accounting principles, and assets are safeguarded against loss from unauthorized acquisition, use, or disposition.

Compliance with applicable laws and regulations: Transactions are executed in accordance with (1) laws governing the use of budgetary authority, (2) other laws and regulations that could have a direct and material effect on the financial statements, and (3) any other laws, regulations, or governmentwide policies identified by OMB audit guidance.

We are also responsible for (1) testing compliance with selected provisions of laws and regulations that could have a direct and material effect on the financial statements and for which OMB audit guidance requires testing and (2) performing limited procedures with respect to certain other information appearing in SEC’s Performance and Accountability Report. In order to fulfill these responsibilities, we examined, on a test basis, evidence supporting the amounts and disclosures in the financial statements; assessed the accounting principles used and significant estimates made by evaluated the overall presentation of the financial statements; obtained an understanding of SEC and its operations, including its internal control related to financial reporting (including safeguarding of assets) and compliance with laws and regulations (including execution of transactions in accordance with budget authority); obtained an understanding of the design of internal controls related to the existence and completeness assertions relating to performance measures as reported in Management’s Discussion and Analysis, and determined whether the internal controls have been placed in operation; tested relevant internal controls over financial reporting and compliance with applicable laws and regulations, and evaluated the design and operating effectiveness of internal control; considered SEC’s process for evaluating and reporting on internal control and financial management systems under the FMFIA; and tested compliance with selected provisions of the following laws and their related regulations: the Securities Exchange Act of 1934, as amended; the Securities Act of 1933, as amended; the Antideficiency Act; laws governing the pay and allowance system for SEC employees; the Prompt Payment Act; and the Federal Employees’ Retirement System Act of 1986.

We did not evaluate all internal controls relevant to operating objectives as broadly defined by the FMFIA, such as those controls relevant to preparing statistical reports and ensuring efficient operations. We limited our internal control testing to controls over financial reporting and compliance. Because of inherent limitations in internal control, misstatements due to error or fraud, losses, or noncompliance may nevertheless occur and not be detected. We also caution that projecting our evaluation to future periods is subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with controls may deteriorate.

We did not test compliance with all laws and regulations applicable to SEC. We limited our tests of compliance to those required by OMB audit guidance and other laws and regulations that had a direct and material effect on, or that we deemed applicable to, SEC’s financial statements for the fiscal year ended September 30, 2007. We caution that noncompliance may occur and not be detected by these tests and that this testing may not be sufficient for other purposes.

We performed our work in accordance with U.S. generally accepted government auditing standards and OMB audit guidance.

SEC’s management provided comments on a draft of this report. They are discussed and evaluated below and are reprinted in appendix III.

SEC Comments and Our Evaluation

In commenting on a draft of this report, SEC’s Chairman said he was pleased to receive an unqualified opinion on SEC’s financial statements. The Chairman discussed SEC’s plans to remediate this material weakness before the end of fiscal 2008, and to address each of the findings and recommendations identified during the audit. The Chairman emphasized SEC’s commitment to enhance its controls in all operational areas and to ensure reliability of financial reporting, soundness of operations, and public confidence in SEC’s mission.

The complete text of SEC’s comments is reprinted in appendix III.

Appendix I: Management’s Discussion and Analysis

Appendix II: Financial Statements

Appendix III: Comments from the Securities and Exchange Commission