SEC is a federal agency responsible for protecting investors, maintaining fair, orderly, and efficient markets, and facilitating capital formation. Among its efforts, SEC requires public companies to disclose meaningful financial and other information to the public, examines firms it regulates, and identifies and investigates potential violations of federal securities laws. Each year, SEC brings hundreds of enforcement actions—including judicial enforcement actions and administrative proceedings—against individuals and companies as a result of its investigations. Examples of actions taken in fiscal year 2018 include charges against a company that allegedly defrauded investors in a Ponzi scheme and charges against a bank for misconduct in its sales practices for certain financial products offered to retail investors. SEC’s responsibilities are divided among five divisions and 24 offices. The Division of Enforcement conducts investigations of potential violations of federal securities laws. Enforcement recommends, when appropriate, that SEC bring enforcement actions, litigates these actions, negotiates settlements on behalf of SEC, and works with other law enforcement agencies to bring criminal cases when warranted. Enforcement is currently led by two co-directors who report to the Chairman. Enforcement staff operate from headquarters in Washington, D.C., and in 11 regional offices. Enforcement maintains a database that tracks enforcement-related activities, including all cases from investigation through litigation, and is the source of statistics used in public reporting (see fig. 1). For tracking purposes, “case” encompasses all stages of a possible enforcement action, beginning either as a matter under inquiry or as an investigation. Some cases advance and become an enforcement action. Enforcement’s database includes all key case data other than data on financial penalties and disgorgements, which SEC’s Office of Financial Management stores and manages. Enforcement’s CMS are responsible for recording key data into the database and conducting quality checks on the data throughout the investigative and litigation processes of a case. There are two groups of CMS: local CMS and national CMS, both of which can be located in SEC regional offices or at SEC headquarters. Local CMS in regional offices report to their regional managers but coordinate with the Enforcement Case Management and Systems Reporting Group. National CMS and local CMS at SEC headquarters report to the Case Management Systems and Reporting Group. National CMS have the responsibility of reviewing and verifying case data input by local CMS. Enforcement has documented procedures for recording and verifying enforcement-related data in its central database. More specifically, the Enforcement database user guide has step-by-step procedures for recording case data and clear descriptions of each data entry field. For example, the guide includes brief descriptions of primary classifications— or categories—used to describe the nature of the enforcement action (such as insider trading or delinquent filing). According to the database user guide and other SEC documentation, local CMS have the primary responsibility for recording most case data used in Enforcement metrics. Local CMS may assist with data recording in the opening of a case as a matter under inquiry or, if it is known the case will advance to the next stage, as an investigation. The user guide also states that local CMS are responsible for recording the advancement of a case from an investigation to an enforcement action. According to the user guide, CMS use information (generally, case documentation) received from the courts or SEC staff responsible for the case to create the action entry in the central database, including the primary classification for the action. CMS also facilitate closing completed cases in the database. Enforcement procedures call for Enforcement staff to perform multiple data reviews for all information in the Enforcement database, according to Enforcement staff and the user guide. According to the user guide, local CMS review the accuracy of key case-related data recorded in the system at certain stages as a case proceeds (see fig. 2). The local CMS add case information by checking any new documentation, such as court filings. In addition to the review by the local CMS, national CMS also are to review newly opened cases, as well as cases that have advanced to an investigation, changed from an investigation to an action, or closed. To do this, national CMS compare information recorded in the system against any primary documents related to the case, such as court documentation. Finally, Enforcement staff told us that they have an informal process whereby a group of attorneys in the Case Management and Systems Reporting Group review all primary classifications for enforcement actions. Enforcement lacks written procedures for generating the Enforcement Annual Report, including for compiling and ensuring the accuracy of the statistics published within. Enforcement staff explained that they follow an informal process to generate the annual report, which includes steps to help ensure reliable reporting and detect and prevent errors (see fig. 3). However, Enforcement was unable to provide documentation of this process or of the implementation of the steps to help ensure accuracy. According to staff, the process for generating the annual report includes selecting what statistics to include and what activities and accomplishments to describe in the report narrative. Specifically, Enforcement staff said that the division’s co-directors hold regular weekly meetings with their staff to discuss management of the division. Staff said program metrics and other measures may be discussed at these meetings, including the types of information and statistics that might be used in the Enforcement Annual Report. According to the staff, at the end of the fiscal year the co-directors determine what information and statistics the division will include in reports. Once decisions have been made about the annual report’s content, Enforcement staff told us a contractor uses software queries of the database to compile statistics for the report based on data parameters defined by Enforcement staff. An Enforcement staff member familiar with the data reviews the queries’ output to verify accuracy, according to Enforcement staff. Staff then add the compiled statistics to the draft annual report. According to staff, the draft report is then sent to the Office of Public Affairs for formatting and publication. Enforcement staff stated that staff familiar with the data perform an additional check to ensure that no data values were mistyped or otherwise edited in the formatting process. Finally, the co-directors of Enforcement are to review the draft report. After they give a final approval, the annual report is published. Control activities such as written procedures help ensure that operational processes are effective and actions are taken to address risks. In particular, federal internal control standards identify documentation— including documentation that demonstrates procedures are being implemented—as a necessary part of an effective internal control system and as a means to help detect and prevent errors. Enforcement staff stated that the division does not have written procedures for generating its annual report or documenting the implementation of review processes because the report is not required by law and is discretionary. The staff said they were confident about the reliability of report data because staff were familiar with enforcement data and the informal processes they currently use to verify accuracy. In contrast, Enforcement uses documented SEC guidelines for reviewing and verifying the data used to support performance metrics in the agency- wide SEC Annual Performance Report. Documenting written procedures for generating both Enforcement’s annual report and the processes it uses to verify published statistics— including documentation that procedures were implemented—would provide Enforcement with greater assurance that staff follow necessary steps to help ensure the reliability and accuracy of reported information. Reliability and accuracy of information are important to maintaining the division’s credibility and public confidence in its efforts. In addition, developing written procedures would better position Enforcement to manage risk associated with staff turnover and help ensure continuity of operations in its public reporting. Since 2009, SEC has made changes to how it reports and presents enforcement or enforcement-related statistics, which are included in a number of reports (see table 1). As previously discussed, we reviewed reports from 2009 through 2018 that included enforcement statistics. More specifically, SEC made the following changes to its public reporting of enforcement statistics, which include the creation of a stand-alone Enforcement Annual Report in 2017. Prior to 2017, Enforcement reported similar statistics in the annual Select SEC and Market Data Report. Definition of enforcement actions. Enforcement staff told us that before 2013, the Select SEC and Market Data Reports changed little from year to year, with the previous year’s report used as a template to create the next one. SEC adjusted its definition of enforcement actions in the 2013 report, and included notes explaining the change and providing what the number of enforcement actions would have been under the previous definition. Presentation of enforcement statistics. Enforcement staff said the Office of the Chief Operating Officer determined changes in presentation (such as the order of enforcement action classifications) in the Select SEC and Market Data Report. In 2015, Enforcement changed how the report presented summary data for enforcement actions. Previously, Enforcement counted enforcement actions as civil actions or administrative proceedings, but the fiscal year 2015 report separately identified and counted the proceedings as stand-alone (initial) or follow-on (after initial action). Enforcement staff said these changes were made possible by better software that allowed for enhanced and expanded presentation of the data. Enforcement Annual Report. As previously mentioned, the Select SEC and Market Data Report was discontinued after the fiscal year 2017 report and the Enforcement Annual Report was first published in November 2017. The annual report included additional data tables of enforcement statistics not previously reported (some comparing statistics to the previous year) and narratives about enforcement priorities and cases. Enforcement staff told us the annual report was created to increase transparency and provide more information and deeper context than previous reporting had. The SEC Division of Enforcement voluntarily issues an annual report that includes statistics and highlights significant enforcement actions and initiatives of the previous fiscal year. Enforcement has documented procedures and has designated staff to input and review enforcement- related data in its case-tracking system. However, the division does not have written procedures for generating its public reporting (currently, the annual report), including for compiling and verifying the report’s statistics, or documenting that procedures were implemented as intended. Written procedures would help Enforcement ensure the reliability and accuracy of reported information, manage risk associated with staff turnover, and promote continuity of operations in its public reporting. The Securities and Exchange Commission’s Co-Directors of Enforcement should develop written procedures for generating Enforcement’s public reports, including procedures for compiling and verifying statistics used in the reports and documenting their implementation. (Recommendation 1) We provided a draft of this report to SEC for review and comment. In written comments (reproduced in appendix I), SEC generally agreed with our findings and concurred with our recommendation. In addition, SEC provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Chairman of the Securities and Exchange Commission, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In addition to the contact named above Kevin Averyt, John Forrester, (Assistant Directors), Jordan Anderson (Analyst in Charge), Tim Bober, Ryan Braun, Marc Molino, Kirsten Noethen, Barbara Roesmann, and Farrah Stone made key contributions to this report.

Summary: Enforcement supports SEC's mission by bringing civil and administrative actions against individuals and entities for fraud, financial and accounting irregularities and misstatements, and other misconduct. According to SEC, these enforcement actions serve as a deterrent against future wrongdoing. Since 2017, Enforcement has published an annual report that provides statistics on its enforcement activities and highlights its priorities for the coming year. GAO was asked to examine SEC reporting of enforcement statistics. This report examines (1) the ways that enforcement statistics reporting changed over the last 10 years, and (2) policies and procedures for recording, reviewing, and reporting enforcement statistics. GAO reviewed SEC's internal policies, procedures, and manuals for recording, verifying, and reporting data. GAO also interviewed SEC officials and reviewed past SEC reports containing enforcement statistics. Since 2009, the Division of Enforcement (Enforcement) in the Securites and Exchange Commision (SEC) has made modifications to its reporting of enforcement statistics, including by releasing a stand-alone annual report beginning in fiscal year 2017. The Enforcement Annual Report included additional data on enforcement statistics not previously reported and narratives about enforcement priorities and cases. Enforcement staff told us the annual report was created to increase transparency and provide more information and deeper context than previous reporting had provided. Enforcement has written procedures for recording and verifying enforcement-related data (including on investigations and enforcement actions) in its central database. However, Enforcement does not have written procedures for generating its public reports (currently, the annual report), including for compiling and verifying the enforcement statistics used in the report. To produce the report, Enforcement staff told GAO that staff and officials hold meetings in which they determine which areas and accomplishments to highlight (see figure). Enforcement was not able to provide documentation demonstrating that the process it currently uses to prepare and review the report was implemented as intended. Developing written procedures for generating Enforcement's public reports and documenting their implementation would provide greater assurance that reported information is reliable and accurate, which is important to maintaining the division's credibility and public confidence in its efforts. GAO recommends that SEC's Co-Directors of Enforcement develop written procedures for generating Enforcement's public reports, including procedures for compiling and verifying statistics used in the reports, and documenting their implementation. SEC agreed with the recommendation.