SROs are responsible for the surveillance of the trading activity on their markets. Market transactions take place on electronic or floor-based platforms. SROs employ electronic surveillance systems to monitor market participants’ compliance with SRO rules and federal securities laws. Electronic surveillance systems are programmed to review trading and other data for aberrational trading patterns or scenarios within defined parameters. Also, SROs review trading as a result of complaints from the public, members, and member firms and as a result of required notifications, such as those concerning offerings. One of the key surveillance systems employed by SROs monitors the markets for insider trading. We discuss SRO surveillance systems and investigatory procedures related to insider trading in more detail in appendix II. SRO staff review alerts generated by the electronic surveillance systems to identify those that warrant further investigation. When SROs find evidence of potential violations of securities laws or SRO rules involving their members, they can conduct disciplinary hearings and impose penalties. These penalties can range from disciplinary letters to the imposition of monetary fines to expulsion from trading and SRO membership. SROs do not have jurisdiction over entities and individuals that are not part of their membership, and, as such, any suspected violations on the part of nonmembers are referred directly to Enforcement. SROs maintain records of their investigations and the resulting disciplinary actions as part of their internal case tracking systems. In addition, as part of their market surveillance efforts, SROs, such as NASD and NYSE, maintain databases with information on individuals and firms associated with suspicious trading activity, such as insider trading. NASD also maintains the Central Registration Depository, the securities industry online registration and licensing database. This database makes complaint and disciplinary information about registered brokers and securities firms available to the public and, in more detailed form, to SEC, other securities regulators, and law enforcement authorities. OCIE administers SEC’s nationwide examination and inspection program. Within OCIE, the Office of Market Oversight primarily focuses on issues related to securities trading activities, with the objective of evaluating whether SRO enforcement programs and procedures are adequate for providing surveillance of the markets, investigating potential violations, and disciplining violators under SRO jurisdiction. OCIE also inspects other SRO regulatory programs, which include, among others, arbitration, listings, sales practice, and financial and operational programs. As part of the latter, OCIE coordinates the compliance inspections of NASD’s district offices, which are responsible for examining broker-dealer members for compliance with SRO rules and federal securities laws. In cases where OCIE discovers potentially egregious violations of federal securities laws or SRO rules during an SRO inspection, it may refer the case to Enforcement, which is responsible for further investigating these potential violations; recommending Commission action when appropriate, either in a federal court or before an administrative law judge (ALJ); and negotiating settlements. SEC’s Market Regulation administers and executes the agency’s programs relating to the structure and operation of the securities markets, which include regulation of SROs and review of their proposed rule changes. SEC has delegated authority to Market Regulation for other aspects of SRO rulemaking as well, including the authority to publish notices of proposed rule changes and to approve proposed rule changes. OCIE conducts both routine and special inspections of SRO regulatory programs as part of its oversight efforts. We found that the SRO inspection process generally includes a planning phase, an on-site review of SRO programs, and a written report to the SRO documenting inspection findings and recommendations that is reviewed and approved by the Commission. OCIE typically staffs inspections with a lead attorney and from 2 to 6 other staff, who also work concurrently on at least 1 other SRO inspection. The number of staff dedicated to SRO inspections has fluctuated in recent years, but as of September 2007 totaled 46. According to OCIE officials, inspections of SRO enforcement programs are intended to assess the design and operation of SRO enforcement programs to determine if they effectively fulfill SRO regulatory responsibilities. As part of these inspections, OCIE takes steps to assess SRO surveillance systems, reviews SRO policies and procedures for investigating potential violations and disciplining violators of rules and laws, and reviews samples of SRO case files to determine whether SRO staff were complying with the policies and procedures. As part of its SRO oversight responsibilities, OCIE conducts both routine and special inspections of SRO regulatory programs. At regular intervals, OCIE conducts routine inspections of key regulatory programs, such as SRO enforcement, arbitration, examination, and listings programs. The inspection cycles are based on the size of the SRO market and the type of regulatory program, with key programs of larger SROs, such as NYSE and NASD, being inspected from every 1 to 2 years, and smaller regional SROs from every 3 to 4 years. Inspection of enforcement programs typically include a review of SRO surveillance programs for identifying potential violations of trading rules or laws, investigating those potential violations, and disciplining those who violate the rule or law. While sometimes OCIE conducts a comprehensive review of these programs, especially at the smaller SROs, often these inspections focus on a specific aspect of the programs, such as fixed income. We discuss OCIE’s process for targeting their routine inspections later in this report. OCIE also conducts special inspections of SRO regulatory programs, as warranted. Special inspections typically originate from a tip or need to follow up on past inspection findings and recommendations. Special inspections also can include sweep inspections, where OCIE probes specific activities of all SROs or a sample of them to identify emerging compliance issues. According to OCIE officials, some aspect of every SRO is generally examined every year through a routine examination of a specific regulatory program or through a special inspection. OCIE’s inspection process for SROs generally includes a planning phase, an on-site review and analysis, and a final inspection report to the SRO (see fig. 1). During inspection planning, OCIE identifies the SRO program to be inspected and assigns staff who conduct initial research on the program, prepare materials for each individual inspection on the basis of the inspection’s focus, and draft a planning memorandum. In preparation for the on-site inspection, OCIE typically sends an initial document request to the SRO, asking for general program information such as organizational charts and copies of SRO policies and procedures or, if OCIE is reviewing a surveillance program, logs of alerts and the resulting investigations. We discuss OCIE’s review of enforcement programs in more detail later in this section. After reviewing the documents provided, staff plan the on-site phase of the inspection, which can include additional requests for specific documents, such as case files, to be made available for review while on- site. OCIE staff typically spends 1 week on-site interviewing SRO staff and reviewing SRO case files and other documentation. After the on-site visit, OCIE staff continue their analysis in the home office; conduct follow-up interviews or request additional documentation, as needed; and begin drafting the inspection report. Staff present their initial inspection findings and recommendations to the SRO in an exit interview and incorporate initial SRO responses into the draft inspection report. Once the report is drafted, staff then circulate it to other interested SEC divisions and offices—such as the Office of General Counsel, Market Regulation, or Enforcement—for their review and comment, and then submit the report to the Commission for review. Following Commission consideration and authorization, staff issue a nonpublic report to the SRO and request that the SRO respond in writing within a specified time frame, typically 30 days. According to OCIE officials, they staff SRO inspections with a lead attorney and from 2 to 6 other staff reporting to an OCIE branch chief. These individuals are typically staffed concurrently on at least 1 other SRO inspection. As shown in table 1, as of September 2007, the SRO inspection group consisted of 46 staff, including 14 managers, 29 examiners, and 3 other support staff. Of the 32 examiners and support staff, 16 are dedicated to market oversight inspections. Table 1 shows that between fiscal years 2002 and 2005, SRO inspection staffing increased from 36 to 62, or 72 percent. OCIE staff said that this increase was largely due to the increase in funding SEC received as a result of the Sarbanes-Oxley Act of 2002. Since then, SRO inspection staffing has declined from 62 to 46, or 26 percent, which OCIE officials attributed to staff attrition and the inability of OCIE to hire replacements during a SEC- wide hiring freeze that occurred from May 2005 to October 2006. OCIE officials stated that despite the decrease in staff numbers, they have continued to conduct routine inspections on schedule, although the inspections may last longer than usual. Also, they said that they have not been able to do as many special inspections as they otherwise would have conducted. OCIE officials told us that the SRO inspection group recently received 6 additional professional staff positions, which it is now in the process of filling. According to OCIE officials, inspections of SRO enforcement programs are intended to assess the design and operation of SRO enforcement programs to determine whether they effectively identify violations, enforce compliance among members, and follow their own procedures. More specifically, OCIE officials said that when inspecting SRO surveillance programs, their objectives are to determine whether (1) the parameters of SRO electronic surveillance systems are appropriately designed to generate exceptions that identify potential instances of noncompliance with SRO rules and federal securities laws and (2) the systems are effectively detecting such activity. When reviewing SRO surveillance systems, OCIE begins by asking the SRO for copies of the exchange rules that it is required to enforce, a description of the coding behind the surveillance systems designed to monitor the markets for compliance with these rules, and logs of the alerts that these systems generated. OCIE staff then review this information to determine whether the system is appropriately designed to identify noncompliance and whether it is functioning as designed. For example, as part of one inspection, OCIE staff found that the parameters of a specific surveillance system were too restrictive, after observing that the system did not generate any alerts over the inspection period. Conversely, OCIE staff said that if in reviewing a surveillance system, the inspection team saw that the system generated 10,000 alerts every quarter, they would follow up with the SRO to determine whether the indications of numerous rule violations were plausible or whether the parameters of the system were set appropriately. Either way, they said that the inspection team would dedicate resources to looking at that system. Similarly, when evaluating SRO programs for investigating potential violations of SRO rules or federal securities laws and disciplining broker- dealer members, OCIE officials stated that their objective is to determine whether (1) SRO policies and procedures are appropriately designed to uncover violations of SRO rules and federal securities laws and to administer the appropriate disciplinary measures and (2) the SRO is complying with these policies and procedures. OCIE staff first request copies of the relevant policies and procedures for investigating surveillance alerts and for disciplining members found to be in violation of SRO rules and federal securities laws. They also ask for lists of the resulting investigations and enforcement actions, including referrals on nonmembers to SEC. OCIE staff then analyze this information to assess the extent to which SRO policies and procedures direct the SRO staff to conduct thorough reviews and investigations and, when applicable, to take appropriate disciplinary action. For example, during a recently completed sweep inspection of SRO surveillance and investigative programs related to insider trading, OCIE evaluated related SRO policies and procedures for reviewing alerts and opening investigations to determine whether they directed staff to coordinate appropriately with other SROs. We discuss the results of this sweep inspection—including a plan that the options SROs submitted to SEC to create a more uniform and coordinated method for the regulation, surveillance, investigation, and detection of insider trading—in appendix II. As part of another inspection we reviewed, OCIE found that an SRO had not yet developed formal procedures for its analysts to review alerts that were generated by a recently implemented surveillance system. OCIE recommended that the SRO develop such procedures. When reviewing SRO enforcement programs, OCIE also assesses whether the SRO is in compliance with its own policies and procedures. To accomplish this objective, OCIE staff select and review case files pertaining to a sample of alerts, investigations, and disciplinary files from the lists that they have asked the SRO to generate. OCIE staff said when reviewing these files, they pay particular attention to the strength of the evidence upon which the SRO analyst relied in determining whether to close an alert or an investigation or to refer the case to SRO enforcement, SEC, or other appropriate regulators. In this way, OCIE staff said they can evaluate whether the SRO is enforcing its rules and federal securities laws consistently among its members and, in the case of certain federal laws such as those prohibiting insider-trading, between members and nonmembers. For example, in one inspection we reviewed, OCIE found that the SRO used its informal disciplinary measures inappropriately when disciplining its members, and recommended that formal disciplinary actions be taken when informal actions had already occurred. OCIE inspections may result in recommendations to SROs that are intended to address any deficiencies identified and to improve SRO effectiveness. OCIE officials said that for SRO enforcement programs, they tend to make recommendations flexible enough to allow SROs to implement them in a manner that best fits their unique business models and surveillance systems. As we have previously discussed, if OCIE finds serious deficiencies at an SRO, it can refer the case to Enforcement. Such referrals are relatively infrequent—between January 1995 and September 2007, SEC brought and settled 10 enforcement actions against SROs (see app. III). According to OCIE officials, recommendation follow-up is primarily the responsibility of the examination team, under the supervision of the assistant director assigned to the inspection. Inspection follow-up begins with evaluating written responses by SROs to the inspection report and obtaining documentation of SRO efforts to address the recommendations, and can continue for several years, depending on the complexity of the recommendation. For example, OCIE officials said that some recommendations, such as those that involve the design and implementation of new information technology, may require continued dialogue with the SRO over several years before the recommendation is fully implemented. OCIE also may follow up on inspection recommendations during a subsequent inspection of the SRO. OCIE officials said that in the event the SRO does not take steps to address a recommendation that staff believe is critical, they can elevate the matter to OCIE management or the Commission, although they said that this happens infrequently. We discuss the tracking of inspection recommendations later in this report. We identified several opportunities for OCIE and Market Regulation to enhance their oversight of SROs by developing formal guidance, leveraging the work of SRO internal audit functions, and enhancing information systems. First, although OCIE has developed a general process for inspecting SRO enforcement programs, it has not developed an examination manual or other formal guidance for examiners to use when conducting inspections, as it has for examinations of other market participants. Such guidance could help OCIE ensure that its inspection procedures and products are subject to uniform standards and quality controls. Second, OCIE has recently expanded the use of the SRO internal and external audit reports while on-site at the SRO; however, OCIE does not leverage this work in the planning process, which could result in duplication of effort and missed opportunities to better target inspection resources. Third, in accordance with SEC policy, Market Regulation regularly inspects SRO IT systems related to market operations for adequate security controls and reviews related to SRO internal audit reports. However, this review does not target SRO enforcement-related databases, which contain investigative and disciplinary information that SROs maintain and upon which other regulators rely. Finally, OCIE currently does not formally track the implementation status of inspection recommendations, which ranged as high as 29 in the inspections that we reviewed. The lack of formal tracking may reduce OCIE’s ability to efficiently and effectively generate and evaluate trend information, such as patterns in the types of deficiencies found or the implementation status of recommendations across SROs, or over time. Our interviews with OCIE officials and reviews of selected inspection workpapers indicated that OCIE examiners typically follow a general process when conducting reviews of SRO enforcement programs. This process begins with examination planning, is followed by data gathering, and ends with reporting. However, OCIE has not developed an examination manual or other formal guidance for its examiners to use when conducting inspections of SRO enforcement programs. According to OCIE officials, because SRO rules and corresponding surveillance systems are unique and constantly evolving, it would be difficult to develop a detailed inspection manual that could be tailored to all SROs and also remain current. These officials said that an examination manual is not necessary to ensure consistency among SRO inspections because the SRO inspection group is a relatively small group within OCIE, and all of the staff are centralized in headquarters. On the other hand, they said that because OCIE’s inspection program for investment companies, investment advisers, and broker- dealers has hundreds of examiners across SEC headquarters and its regional offices who are responsible for examining thousands of firms, OCIE has developed detailed inspection manuals to ensure consistency across examinations of these firms. Similarly, OCIE officials said that they have developed guidelines for SRO examiners conducting oversight inspections of NASD’s district offices because OCIE relies on examination staff in the SEC regional offices to assist them in conducting these inspections. In contrast to OCIE, federal banking regulators, such as the Federal Reserve and OCC, have developed written guidance for the examination of large banks—also highly complex and diverse institutions—that outlines the objectives of the program and describes the processes and functional approaches used to meet those objectives. By not establishing written guidance for conducting inspections of SRO enforcement and other regulatory programs, OCIE may be limiting its ability to ensure that its inspection processes and products are subject to basic quality controls in such areas as examination planning, data collection, and report review. For example, in several of the inspections we reviewed, we did not find evidence of supervisory review, which is a key aspect of inspection quality control. According to OCIE officials, the team leader is expected to review the work of team members. However, without written policies and procedures specifying how and when this review is to be conducted and documented, it is difficult to establish whether the team leaders comply with this quality control. According to inspection standards developed by the IG community, each organization that conducts inspections should develop and implement written policies and procedures for internal controls over its inspection processes to provide reasonable assurance over conformance with organizational policies and procedures. As another example, when conducting inspections of SRO enforcement programs, OCIE officials said that team leaders often require their teams to use data collection instruments, such as checklists, when reviewing SRO files to ensure a consistent and complete review of all of the files selected, particularly when there are inexperienced staff on the team. While potentially an effective means of collecting data, according to OCIE officials, the decision to use these tools is up to the individual team leader, and not all teams employ them. According to IG inspection standards, evidence developed under an effective system of internal controls generally is more reliable than evidence obtained where such controls are lacking. By not establishing standards addressing quality controls in data collection, OCIE’s ability to ensure the consistency and reliability of data collected across its SRO inspection teams may be limited. Furthermore, without written guidelines, new examiners lack a reference tool that could facilitate their orientation in the inspection program. While OCIE employs a risk-based approach to conducting SRO inspections, OCIE’s risk-assessment and inspection planning processes do not incorporate information gathered through SRO internal audits. According to OCIE officials, OCIE tailors inspections of SRO programs (particularly at the two largest SROs) to focus on those areas judged to pose the greatest risk to the SRO or the general market. In determining which areas present the highest risk, OCIE officials said they consider such factors as the amount of time that has passed since a particular area was last inspected, the size of the area, the results of past inspections, and consultations with other SEC offices and divisions. For example, because the enforcement programs at NASD and NYSE encompass hundreds of surveillance systems, OCIE officials said examiners cannot review all systems as part of one inspection. As a result, OCIE officials said examiners first conduct a preliminary analysis of requested documents and focus inspection resources on those systems or areas that are judged to pose the greatest risk. According to OCIE officials, because the regional SROs have smaller programs, OCIE staff typically are able to conduct a more comprehensive review of the entire enforcement program during a single inspection. We previously recommended that OCIE develop and implement a policy requiring examiners to routinely use SRO internal review reports in planning and conducting SRO inspections. Prior to October 2006, OCIE’s practice was to request SRO internal audit reports only when OCIE believed specific problems existed at an SRO. In October 2006, OCIE issued a memorandum broadening the circumstances in which OCIE would request and use these reports. The memorandum directs examiners to request that SROs make all internal audit reports related to the program area under inspection available for the staff’s on-site review, including workpapers or any reviews conducted by any regulatory quality review unit of the SRO or an outside auditor. According to the memorandum, on-site review of these reports may be useful in determining whether the SRO has identified particular areas of concern in a program area and adequately addressed those problems, assessing whether an SRO addressed prior inspection findings and recommendations, and helping staff determine whether they should limit or expand their review of particular issues during an inspection. OCIE staff said that in fiscal year 2008, they also plan to begin reviewing the internal audit functions of SROs, with the goal of determining whether SRO internal audit functions are effective. For example, OCIE officials said that they plan to evaluate whether the internal audit functions are independent of SRO management, conduct thorough reviews of all relevant areas (particularly, regulatory programs), and have sufficient staffing levels. OCIE officials said that as part of their reviews, they also plan to assess the quality and reliability of SRO internal audit reports and assess whether SROs have implemented the recommendations resulting from these reports. OCIE officials told us that they are in the planning phase of this review, and, as such, they have not yet developed written guidance for their examiners in conducting these reviews. While OCIE’s October 2006 memorandum broadened the use of SRO internal audit reports to encompass on-site reviews during inspections, it did not address the use of internal audit reports for planning purposes, as we had recommended. In contrast, the risk assessments of large banks that federal bank examiners conduct during the planning phase are based, in part, on internal audit reports, and examiners may adjust their examination plans to avoid duplication of effort and minimize burden to the bank. For example, according to examination guidance that the Federal Reserve issued, to avoid duplication of effort and burden to the institution, examiners may consider using these workpapers and conclusions to the extent that examiners test the work performed by the internal or external auditors and determine it is reliable. Similarly, examination guidance issued by OCC states that examiners’ assessments of a bank’s audit and control functions help leverage OCC resources, establish the scope of current and future supervisory activities, and assess the quality of risk management. By not considering the work and work products of SRO internal audit functions in its inspection planning process, OCIE examiners may be duplicating SRO efforts, causing regulatory burden, or missing opportunities to direct examination resources to other higher-risk or less- examined program areas. For example, our previous work, which focused on the listing programs of SROs, showed that SRO internal audit functions had examined or were in the process of examining aspects of their listing programs that OCIE had covered in its most recent inspections, and that resulting reports could be useful to OCIE in planning as well as conducting inspections. As OCIE begins to assess the quality of SRO internal audit functions and work products, the opportunity exists for OCIE to further leverage these products in targeting its own inspection efforts. OCIE officials said that as part of their upcoming reviews of SRO internal audit functions, they will assess whether SRO internal audit products may be helpful in assisting them in targeting inspections of particular SRO functions. OCIE could also further leverage the work performed by SRO internal and external auditors to monitor a particular regulatory program between inspections. In our review of OCIE inspections of NASD and NYSE enforcement programs, as many as 8 years passed between inspections of a particular surveillance system and related investigations and disciplinary actions. Moreover, as OCIE officials noted, the recent decline in SRO inspection staff has lengthened the time it takes to complete a routine SRO inspection and limited their ability to conduct additional special inspections. Unless OCIE regularly informed itself of the results of SRO efforts to review these systems, it may not know of emerging or resurgent issues until the next inspection. As we have previously discussed, SROs conduct surveillance of trading activity on their markets; carry out investigations; and bring disciplinary proceedings involving their own members or, when appropriate, make referrals to SEC when the suspicious activity involves nonmembers. However, SEC’s Market Regulation does not obtain information on the security of SRO enforcement-related databases—IT applications for storing data about SRO investigations and disciplinary actions taken against SRO members—when conducting reviews of IT security at SROs. Under SEC’s Automation Review Policy (ARP), Market Regulation conducts on-site reviews of SRO trading systems, information dissemination systems, clearance and settlement systems, and electronic communications networks and makes recommendations for improvements when necessary. Market Regulation also conducts reviews of SRO general and application controls over the collection of fees under section 31 of the Securities Exchange Act of 1934. These are IT systems designated for remitting fees to SEC as part of the section 31 program, which ensures that the data produced by these systems are authorized, and completely and accurately processed and reported. Market Regulation officials said that they do not target enforcement-related databases for specific review, since the ARP policy statement is specifically intended to oversee systems essential to market operations. These officials said that Market Regulation could include a review of the security of enforcement-related databases both in their general assessments of SRO IT infrastructure security within the ARP and in section 31 reviews. They explained that both of these reviews include testing of components and evaluations of general access controls and changes made within SRO organizationwide network structures in their routine reviews of specific IT programs and systems, such as SRO computer operations, security assessments, internal and external audit IT coverage, and systems outage notification procedures and systems change notifications. However, these general assessments by Market Regulation would not necessarily provide SEC with information on potential risks specific to the security of the data contained in enforcement-related databases. NASD and NYSE officials told us that they conduct their own regular internal inspections of security of IT systems, which include reviews of enforcement-related databases. In addition, both SROs contract with external companies that regularly conduct reviews of the security controls of their technology systems. We reviewed several of these internal and external audits, which include reviews of SRO enforcement-related systems and databases conducted from fiscal years 2002 through 2006. These reviews generally concluded that NASD and NYSE have adequate controls in place to protect sensitive enforcement-related data. The internal and external audit reports of NYSE and NASD that we reviewed showed that these reports could be a valuable source of information for Market Regulation on specific risks to enforcement-related databases. Market Regulation officials said that in conducting ARP-related inspections, they review SRO internal and external audit reports related to the infrastructure of SRO IT systems; however, they do not specifically look for information related to the assessment of security of enforcement- related databases. In addition, SEC staff said that although they generally receive all the internal and external audit reports done of SRO systems relating to trading and clearing functions, they may not always receive such reports relating to other systems, including enforcement-related databases, from all SROs. Since SROs, SEC, and other regulators rely on the accuracy and integrity of the data in SRO enforcement-related databases in fulfilling their own regulatory responsibilities, protecting this information from unauthorized access is critical to regulatory efforts. For example, as we discuss later in this report, SEC uses SRO surveillance data in carrying out its own enforcement efforts related to securities trading. Furthermore, SROs are responsible for maintaining complaint and disciplinary data on their members—information that is essential for identifying recidivists. By not periodically obtaining information to ensure that the SRO risk-assessment process and SRO-sponsored audits continue to be included in SRO assessment cycles and that the audits are comprehensive and complete, Market Regulation cannot assess whether SROs have taken the appropriate steps to ensure the security of sensitive enforcement-related information, or the level of risk that a data breach could pose. Although OCIE officials said that they have worked with SROs to address the intent of recent inspection recommendations, we were not able to readily verify the status of the recommendations in the inspections we reviewed because OCIE does not formally track inspection recommendations or the status of their implementation. OCIE officials said that when OCIE management is interested in obtaining an update on the recommendations resulting from an inspection, they consult directly with the examination team assigned to the SRO inspection. OCIE officials also said that they do not consider the lack of a formal tracking system to have affected their ability to manage any follow-up of inspection recommendations because there are relatively few SROs, and OCIE staff is in frequent contact with them. OCIE’s informal methods for tracking inspection recommendations contrast with the expectations set by federal internal control standards for ensuring that management has relevant, reliable, and timely information regarding key agency activities. These standards state that key information on agency operations should be recorded and communicated to management and others within the entity and within a time frame that enables management to carry out its internal control and other responsibilities. Without a formal tracking system, the ability of OCIE management to effectively and efficiently monitor the implementation of SRO inspection recommendations and conduct programwide analyses may be limited. Of the 11 inspections of NASD and NYSE enforcement programs we reviewed, the number of recommendations OCIE made ranged from 4 to 29, with an average of 11. They also ranged in complexity, from asking the SRO to update its policies and procedures to recommending that an SRO implement an entire surveillance program. For example, we observed recommendations calling for, among other things, improving case file documentation, changing the parameters of a surveillance system, implementing an automated tracking system, and improving SRO member education. OCIE officials said that some inspections resulted in as many as 30 or 40 recommendations. Without a formal tracking system, OCIE management must rely on staff’s availability and ability to recall recommendation-related information, which may be reliable when discussing an individual inspection, but may limit OCIE management’s ability to efficiently generate and evaluate trend information, such as patterns in the types of deficiencies found or the implementation status of recommendations across SROs, or over time. Implementing a formal tracking system would not only allow management to more robustly assess the recommendations to SROs and their progress in implementing them, but would allow it to develop performance measures that could assist management in evaluating the effectiveness of its inspection program. According to OCIE and SEC’s OIT officials, OCIE recently began working with OIT to develop a new examination tracking system that will include the capability to track SRO responses and implementation status of OCIE recommendations. OCIE officials said that planned requirements for the system includes a field to enter the recommendation, a field for OCIE inspectors to broadly categorize the status of its implementation, and a text box for inspectors to elaborate on the recommendation and its implementation status. OCIE officials also said that they expect that the system will be able to trace the history of a recommendation. OIT officials told us that they are developing separate software that will allow OCIE to generate management reports using data from the tracking systems as well as other database; however, the requirements for any management reports OCIE would receive have yet to be determined. According to an OCIE official, the recommendation tracking system and reporting capabilities may be an effective way to provide OCIE management with a high-level characterization of implementation status. OCIE officials said that in response to our concerns, they plan to deploy an interim, stand-alone recommendation tracking system that will provide a management report, in the form of a spreadsheet, that contains all open recommendations to SROs resulting from SRO inspections and the current status of SRO efforts to implement them. These officials said that they expect to use this spreadsheet until the previously described OIT projects are implemented in 2008. Enforcement receives advisories and referrals, which undergo multiple stages of review and may lead to opening an investigation, through an electronic system in OMS. After opening investigations, Enforcement further reviews the evidence gathered to decide whether to pursue civil or administrative actions, or both. From fiscal years 2003 to 2006, OMS received an increasing number of advisories and referrals from SROs, such as NYSE and NASD, most of which involved insider trading. However, limited search capabilities of the SRO system and the lack of a link between the SRO and case activity tracking systems have limited Enforcement staff’s ability to electronically search advisory and referral information, monitor unusual market activity, make decisions about opening matters under inquiry (MUI) and investigations, and assess case activities. Upon receipt of SRO information in its Web-based SRO Referral Receipt System (SRO system), OMS makes initial decisions on referrals and forwards selected referral materials to investigative attorneys. After initial reviews by OMS staff, Enforcement may decide to open investigations if it determines evidence garnered during its inquiry period warrants doing so and staff and financial resources are available. If investigation evidence merits, staff may pursue administrative or civil actions and seek remedies, such as cease-and-desist orders and civil monetary penalties. The referral process begins when OMS staff receive SRO advisories and referrals on unusual market activity through a secure Web-based electronic system called the SRO system. SEC officials noted that SRO referrals help SEC identify and respond to unusual market activity by those who are not members of SROs, investigate those suspected of potentially illegal behavior, and take action when the circumstances of cases and evidence are appropriate. OMS branch chiefs, who are responsible for reviewing advisories and referrals, access the SRO system on a weekly basis to review all SRO-submitted advisories and referrals. SRO advisories and referrals usually consist of a short form with basic background information on the suspected unusual market activity by SRO nonmembers that includes the name of the security issuer, date of the unusual activity, and a description of the market activity identified by the SRO. The materials also contain a text attachment, which includes more detailed narrative information, such as a chronology of unusual activity and specific information about issuers and individuals potentially associated with that activity. SEC does not receive information electronically or otherwise on unusual market activity by SRO members or related investigations by SROs of the unusual member activity. After reading advisories and referrals, OMS branch chiefs use SEC’s National Relationship Search Index, an electronic system that connects to and works with a range of other SEC systems, such as the Case Activity Tracking System (CATS), to determine whether existing SEC investigations involve the issuer noted in the SRO advisory or referral. If an investigation already exists that involves the issuer noted in the advisory or referral, the branch chiefs will forward the advisory or referral to the Enforcement attorney conducting that investigation for review and incorporation into his or her case. If Enforcement has not already opened an investigation on a particular issuer, OMS staff store advisories in the SRO system, but do not investigate them because they do not contain information as detailed as that found in referrals in the SRO system. However, SROs may continue their market surveillance efforts on an advisory, further develop information on the unusual market activity, and submit all information later as a referral for potential action by SEC. For referrals, branch chiefs apply criteria—such as (1) the nature of the unusual market activity, (2) the persons involved and their employment positions, (3) the dollar value of the unusual activity in question, (4) potential harm to the financial markets and individual investors, and (5) any other information branch chiefs may have obtained through conversations with SRO staff—to make initial decisions about the merit of forwarding the referrals to Enforcement management and attorneys for possible SEC investigation. Enforcement associate directors review and either approve or disapprove branch chiefs’ recommendations about the referrals. Referrals not recommended by branch chiefs for approval are stored in the SRO system and may be accessed as needed. If approved, OMS branch chiefs open an MUI, a 60-day initial inquiry period, and electronically forward all referral information to SEC headquarters or the appropriate regional office, where investigative attorneys and management have up to 60 days to review all available case information and consider staff and financial resources to decide whether to proceed with a full investigation. Once the MUI has been opened, Enforcement staff assigns the MUI a CATS case number, and staff use CATS to track all components of the case until it is closed. Figure 2 outlines SEC’s process and average time frames for receiving, processing, and investigating unusual market activity identified by SROs. Enforcement staff at headquarters or the regional offices use criteria that are similar to those used by OMS staff during their initial review, but also consider the level of financial resources available for investigations and the availability of Enforcement staff to determine whether to close the MUI or open an investigation. If Enforcement staff do not open an investigation, the MUI is closed in CATS and staff document the reason(s) for closure, which may include insufficient evidence, resource limitations, or a newly opened case being merged with an existing case. If the Enforcement Division develops evidence it deems sufficient for moving forward, SEC may institute civil or administrative enforcement actions, or both. When determining how to proceed, Enforcement staff consider such factors as the seriousness of the wrongdoing, the technical nature of the matter under investigation, and the type of sanction or relief sought. When the misconduct warrants it, SEC will bring both types of proceedings. With civil actions, SEC files a complaint with a federal district court that describes the misconduct, identifies the laws and rules violated, and identifies the sanction or remedial action that is sought. For example, SEC often seeks civil monetary penalties and the return of illegal profits, known as disgorgement. The courts also may bar or suspend an individual from serving as a corporate officer or director (see fig. 2). SEC can seek a variety of sanctions through administrative enforcement proceedings as well. An ALJ, who is independent of SEC, presides over a hearing and considers the evidence presented by the Enforcement staff as well as any evidence submitted by the subject of the proceeding. Following the hearing, the ALJ issues an initial decision, which contains a recommended sanction. Administrative sanctions or outcomes include cease-and-desist orders, suspension or revocation of broker-dealer and investment adviser registration, censures, bars from association with certain persons or entities in the securities industry, payment of civil monetary penalties, and return of illegal profits. Both Enforcement staff and the defendant may appeal all or any portion of the initial decision to SEC Commissioners, who may affirm the decision of the ALJ, reverse the decision, or remand it for additional hearings. An SRO may also agree to undertake other remedial actions in a settlement agreement with SEC. Once civil or administrative proceedings have concluded and all outcomes are finalized, SEC closes the investigation and terminates the case in CATS. Figure 2 also provides data on the durations involved with referral and investigation processes and shows that stages of the process—from SRO identification of unusual market activity to the closure of investigations— vary in their duration. We analyzed data SEC provided from its referral and case tracking systems from fiscal years 2003 to 2006. For those cases for which the data had open and close dates for the investigation stage of the process, it took an average of 726 days or almost 2 years from the point that SROs identify unusual market activity and send SEC referrals to the time that SEC completely investigates and concludes cases. Of this total time, it took, on average, 192 days for the first three steps in the process, which include SROs identifying unusual market activity and referring it to SEC and SEC opening an MUI to conduct its initial inquiry on referrals. It took, on average, another 534 days for SEC to investigate that unusual market activity; institute administrative or civil enforcement proceedings; administer outcomes, such as issuing and collecting fines; and completely close investigations. Data we reviewed from SEC’s SRO system and CATS showed that the number of advisories, referrals, and investigations significantly increased from fiscal years 2003 through 2006. More specifically, advisories increased from 5 in fiscal year 2003 to 190 in fiscal year 2006 and totaled 390 for the period. Of the 4-year total, 354, or 91 percent, were insider trading advisories, and an additional 3 percent involved market manipulation issues. Data from SEC’s SRO system on 1,640 referrals showed that the number of referrals SEC received from SROs grew from 438 in fiscal year 2003 to 514 in fiscal year 2006, an increase of 17 percent. Of the total number of referrals, almost 80 percent involved suspected insider trading activities. In addition, NYSE and NASD submitted 1,095, or almost 70 percent, of the total number of referrals. SEC and SRO officials attributed the increase to more merger and acquisition activity in the marketplace. Data SEC provided to us from its case tracking system showed a corresponding increase in the number of investigations SEC opened from SRO referrals over the same period. The number of investigations rose from 82 in fiscal year 2003 to 208 in fiscal year 2006, an increase of 154 percent. Case actions, which follow SEC’s determination of whether to file a case as an administrative proceeding or a civil action, also increased. The number of case actions rose from 2 in fiscal year 2003 to 29 in fiscal year 2006. SEC actions result in case outcomes such as permanent injunctions, preliminary injunctions, restraining orders, administrative proceeding orders, and emergency actions. These case outcomes rose from 3 in fiscal year 2003 to 82 in fiscal year 2006. Case outcomes also may include “relief,” such as disgorgement, payment of prejudgment interest and other monetary penalties, asset freezes, and officer and director bans. For example, in 2003, NYSE referred unusual market activity to SEC after suspecting potential insider trading activity. After opening an MUI and investigating the activity, the case resulted in an administrative proceeding and a civil action. The case resulted in a range of outcomes against 6 individuals. The administrative proceeding specifically resulted in an order barring individuals alleged in the case from associating with one another on trading. The civil action resulted in permanent injunctions to stop the suspected use of material, nonpublic information and in financial penalties that included disgorgement. Figure 3 illustrates the upward trend in the numbers of advisories, referrals, MUIs, investigations, case actions, and case outcomes for the period we reviewed. The figure also shows that more than three quarters of the referrals were made for insider trading. Market manipulation and “other” activity, including activity associated with issuer reporting and financial disclosure and initial securities offerings, constituted the other major categories of referrals. Appendix IV provides additional data on these trends by fiscal year. SEC’s SRO system featured limited capability to electronically search information on advisories and referrals and may limit Enforcement staff’s ability to efficiently monitor unusual market activity, make subsequent decisions about opening MUIs and investigations, and manage the SRO advisory and referral process. As we have previously discussed, federal internal control standards state that management needs relevant, reliable, and timely communications relating to internal and external events. In addition, these standards state that the information should be distributed in a form and time frame that permits management and others who need it to perform their duties efficiently. SEC developed the SRO system to receive and store advisory and referral information from SROs and enable SEC staff to make initial decisions about which SRO-identified market activities to investigate. The system primarily receives information on unusual market activity based on SRO surveillance of trades among stock issuers. This information includes the name of the security issuer; the date of the unusual activity; and a description of the type of activity, among other data. The SRO system also stores narrative attachments, which the SROs provide to SEC, that contain additional information about individuals or entities, such as investment advisers or hedge funds, associated with unusual market activity. While the system allows OMS staff to search by issuer, the narrative information cannot be easily searched in the system; instead, the attachments must be individually opened and read. An Enforcement branch chief noted that narrative information can help establish patterns of behavior that are critical when SEC tries to investigate potentially fraudulent activity, such as market manipulation and insider trading. Furthermore, only OMS branch chiefs have access to the SRO system, so attorneys who need that information have to consult with OMS branch chiefs or contact SRO staff directly, rather than access that information electronically. In addition, since the referral receipt and case tracking systems are not linked, management is unable to readily assess the efficiency and effectiveness of the referral and investigation processes. For example, SEC is unable to extract information from a single source on how long it takes both SROs and SEC to work through different stages of cases over time, from referral receipt (SRO system) to opening MUIs and conducting investigations (case tracking system). SEC headquarters and regional office officials noted that receiving information in a timely manner is critical to the investigative steps of assembling the facts of the case and collecting evidence on those potentially involved with unusual market activity. To obtain this information and customized reports and statistics on Enforcement operations, division officials said they must submit requests to SEC’s OIT and then wait for OIT staff to respond to the request. As noted in our 2007 report on Enforcement Division operations, these requests may take several days to 1 week to complete. Having recognized system limitations, SEC officials have undertaken efforts to make improvements to CATS by developing a new case information management system called the Hub. However, these planned improvements do not address limitations of the SRO system and do not include expanded linkages between the SRO system and CATS. SEC’s oversight of SRO enforcement programs has produced positive outcomes. For example, in response to an OCIE recommendation, SROs in the options market have developed a new surveillance authority, which is intended to improve coordination among SROs in monitoring the markets for insider trading and investigating any resulting alerts. The equities markets are expected to soon follow with a similar plan. SEC, through its Enforcement Division, has worked with SROs to detect and respond to potential securities laws violations. Between fiscal years 2003 and 2006, SEC responded to an increasing number of SRO referrals—a large percentage of which are related to insider trading—with an increasing number of investigations and enforcement actions. SEC has started to incorporate the results of SRO internal audits into its on-site inspections, which helps to leverage resources. In addition, the agency plans to expand its oversight of SRO functions to include reviews of the internal audit function—with an emphasis on independence, staffing levels, and scope of coverage. Such reviews could help ensure that SROs are effectively assessing risks, instituting appropriate controls, and carrying out their responsibilities. However, several opportunities exist to enhance the efforts used by SEC to oversee SROs and, particularly, their enforcement programs. Specifically, OCIE examiners are conducting inspections of SRO enforcement programs without formal guidance. Although our review of a sample of inspections found that examiners have developed a methodology for reviewing SRO enforcement programs, the lack of written guidance—which establishes minimum standards and quality controls—could limit OCIE’s ability to provide reasonable assurances that its inspection processes and products are subject to basic quality controls in such areas as examination planning, data collection, and report review. Moreover, the lack of formal guidance could result in individual inspection teams creating data collection and other examination tools that otherwise would be centralized and more efficiently shared across inspection teams. Furthermore, OCIE’s recent internal guidance on the use of SRO internal audit-related reports does not address the use of these reports for risk- assessment and inspection planning purposes, as we have previously recommended. We continue to believe that the use of these reports when conducting risk assessments and determining the scope of an upcoming inspection could allow OCIE to better leverage its inspection resources, especially if OCIE determines that the reports produced by SRO internal audit functions are reliable. As OCIE officials noted, they plan to begin assessing SRO internal audit functions in 2008, including the quality and reliability of their work products, although they have not yet developed guidance for inspection staff on conducting these reviews. By not considering the work and work products of the SRO internal audit function in its inspection planning process, OCIE may be duplicating SRO efforts and not maximizing the use of its limited resources. OCIE also may be missing an opportunity to better monitor the effectiveness of the SRO regulatory programs (including enforcement programs) between inspections. SEC also has an opportunity to leverage the work of SRO internal audit functions in its assessment of information security at SROs. Since ARP Policy Statements specifically are intended to oversee systems essential to market operations, Market Regulation officials do not target enforcement- related databases for specific review. Although SROs have assessed the security controls of these databases, Market Regulation officials have little knowledge of the content or comprehensiveness of these audits. As a result, Market Regulation cannot determine whether SROs have taken the appropriate steps to ensure the security of this sensitive information. Market Regulation could facilitate this evaluation by making certain that enforcement-related databases continue to be periodically reviewed by SROs, and that these reviews are comprehensive and complete. Both OCIE and Enforcement could benefit from improvements to information technology systems when overseeing SROs. OCIE currently lacks a system that tracks the status of inspection recommendations. OCIE officials told us that a new examination tracking database is in development that will allow OCIE to track the implementation of inspection recommendations as well as software that will allow OCIE to generate management reports from this database. By ensuring these system capabilities, OCIE management could improve its ability to monitor the implementation of OCIE recommendations, and begin developing measures for assessing the effectiveness of its program. Finally, while SEC has responded to a significant increase in SRO referrals between fiscal years 2003 and 2006, Enforcement’s systems for receiving referrals and tracking the resulting investigations have limited capabilities for searching and analyzing information related to these referrals. Enforcement is currently working to address some limitations in its case tracking system; however, this effort does not include making improvements to the separate system used to receive and manage SRO referrals. By including system improvements to allow electronic access to all of the information contained in advisories and referrals submitted by SROs, generate management reports, and provide links to the case tracking system, Enforcement could enhance its ability to efficiently and effectively manage SRO advisories and referrals and conduct analyses that could contribute to improved SEC planning, operations, and oversight. To enhance SEC oversight of SROs, we recommend that the SEC Chairman take the following three actions: establish a written framework for conducting inspections of SRO enforcement programs to help ensure a reliable and consistent source of information on SRO inspection processes, minimum standards, and quality controls; and, as part of this framework, broaden current guidance to SRO inspection staff on the use of SRO internal audit reports to direct examiners to consider the extent to which they will rely on reports and reviews of internal and external audit and other risk- management systems when planning SRO inspections; ensure that Market Regulation makes certain that SROs include in their periodic risk assessment of their IT systems a review of the security of their enforcement-related databases, and that Market Regulation reviews the comprehensiveness and completeness of the related SRO- sponsored audits of their enforcement-related databases; and as part of the agency’s ongoing efforts to improve information ensure that any software developed for tracking SRO inspections includes the ability to track and report SRO responses to and implementation status of OCIE inspections recommendations and consider system improvements that would allow Enforcement staff to electronically access and search all information in advisories and referrals submitted by SROs and generate reports that would facilitate monitoring and analysis of trend information and case activities. We requested comments on a draft of this report from SEC. SEC provided written comments on the draft, which we have reprinted in appendix V. SEC also provided technical comments on a draft of the report, which were incorporated in this report as appropriate. In its written comments, SEC agreed with our recommendations. SEC noted that OCIE will provide SRO inspectors with written guidance on its risk-scoping techniques and compiled summary of inspection practices. In addition, OCIE plans to assess the quality and reliability of SRO internal audit programs and determine whether, and the degree to which, inspections can be risk- focused on the basis of SRO internal audit work. SEC also noted that it is developing a database to track the status of SRO inspection recommendations and provide management reports and that this enhancement should create additional efficiencies for inspection planning purposes. SEC’s Market Regulation will implement our recommendation to ensure that enforcement-related databases continue to be periodically reviewed by SRO internal audit programs, and that these reviews are comprehensive and complete. Furthermore, Enforcement plans to consider recommended system improvements to more effectively manage the advisory and referral processes. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its date. At that time, we will send copies of this report to interested congressional committees and the Chairman of the Senate Committee on Finance. We will also send a copy to the Chairman of the Securities and Exchange Commission. We will also make copies available to others upon request. The report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions regarding this report, please contact me at (202) 512-8678 or hillmanr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VI. To discuss the overall structure of the Securities and Exchange Commission’s (SEC) inspection program—more specifically, its approach to inspections of self-regulatory organizations’ (SRO) surveillance, investigative, and enforcement programs (enforcement programs)—we reviewed and analyzed documentation of all 11 inspections that SEC’s Office of Compliance Inspections and Examinations (OCIE) completed from March 2002 through January 2007 of enforcement programs related to the former NASD and the New York Stock Exchange (NYSE). We also reviewed and analyzed an OCIE memorandum to the Commission describing the SRO inspection process, staffing data provided by OCIE, and our prior work. Furthermore, we observed a demonstration of various information technology systems that NASD used to monitor the markets and track investigations and disciplinary actions. Finally, we reviewed and summarized the enforcement actions brought by SEC against SROs from 1995 to 2007. We also conducted interviews with staff from OCIE, NASD, and NYSE. To evaluate certain aspects of SEC’s inspection program, including guidance and planning, the use of SRO internal audit products, and the tracking of inspection recommendations, we reviewed OCIE inspection guidance related to the review of NASD district offices and SRO internal audit reports, guidance for bank examiners from the Board of Governors of the Federal Reserve System and the Office of the Comptroller of the Currency, inspection guidelines developed by the inspectors general, and our prior work. In addition, we reviewed SEC guidance for conducting reviews of SRO information technology (IT) related to market trading operations and regulatory fee remittance, and NASD and NYSE internal and external audits of IT security. Furthermore, we reviewed internal control standards for the federal government and conducted interviews with officials from OCIE and SEC’s Division of Enforcement (Enforcement) on their respective procedures for ensuring that SROs implement inspection recommendations and remedial actions required as part of enforcement actions. We also conducted interviews with staff from OCIE, SEC’s Division of Market Regulation and Office of Information Technology, NASD, and NYSE. To describe the SRO referral process and recent trends in referral numbers and related SEC investigations, and evaluate SEC’s information system for advisories and referrals, we observed a demonstration from Enforcement staff on the capabilities of their IT systems, analyzed data from SEC’s SRO Referral Receipt System (SRO system) and Case Activity Tracking System (CATS), and interviewed Enforcement, NASD, and NYSE staff to determine how SEC manages the processes for receiving SRO referrals and conducting subsequent investigations. In particular, to understand trends in SRO advisories, referrals, and subsequent SEC investigations, we requested and analyzed data from SEC’s referral and case tracking systems from fiscal years 2003 through 2006. We analyzed the data to provide descriptive information on the number of SEC’s advisories, referrals, matters under inquiry (MUI), investigations, actions, and case outcomes during the period. We also analyzed these data by manually merging records from the SRO system and CATS to obtain descriptive data on the amount of time it takes SROs to identify unusual market activity and convey that information to SEC, as well as how long it takes SEC to respond by opening MUIs and investigations and achieving case outcomes. We inquired about checks SEC performs on the data and deemed the data reliable for the purposes of addressing our objectives. When calculating the average duration of stages to process SRO referrals, we distinguished between case stages that featured both open and close dates and those that were open or active as of the date we received data from SEC, and we reported duration information accordingly. In addition, to calculate case stage durations, we consulted with SEC and SRO staff to distinguish between initial and updated referrals and performed duration calculations using initial referrals only to avoid double counting that could skew the average duration results. We performed our work in Washington, D.C.; New York, New York; and Rockville, Maryland, between September 2006 and September 2007 in accordance with generally accepted government auditing standards. SRO surveillance, investigative, and disciplinary programs are designed to enforce SRO rules and federal securities laws related to insider trading— the buying or selling of a security by someone who has access to material, nonpublic information about the security—and are subject to SEC oversight through periodic inspections by OCIE. In January 2007, OCIE completed a sweep inspection (a probe of specific activities across all or a sample of SROs) of SRO enforcement programs related to insider trading. As a result of OCIE’s inspection, the options SROs submitted a plan to SEC to create a more uniform and coordinated method for surveillance and investigation of insider trading in the options markets, and the equities SROs indicated their intent to submit a similar plan. From fiscal years 2003 through 2006, SEC significantly increased the number of investigations that related to insider trading. SROs employ enforcement programs to enforce SRO rules and federal securities laws related to insider trading. Insider trading is illegal because any trading that is based on this information is unfair to investors who do not have access to the information. When persons buy or sell securities on the basis of information not generally available to the public, investor confidence in market fairness can be eroded. Information that could be exploited for personal gain by insiders include such things as advance knowledge of mergers or acquisitions, development of a new drug or product, or earnings announcements. While company insiders (e.g., directors and senior executives) may be the most likely individuals to possess material, nonpublic information, others outside of the company also may gain access to the information and use it for their personal gain. For example, employees at a copy store who discovered material, nonpublic information while making presentation booklets for a firm could commit insider trading if they traded on that information prior to it being made public. To detect insider trading, SROs have established electronic surveillance systems that monitor their markets for aberrational movements in a stock’s price or volume of shares traded, among other things, and generate alerts if a stock’s price or volume of shares traded moves outside of set parameters. These systems link trade activity data to news and research about corporate transactions (such as mergers, acquisitions, or earnings announcements); public databases of listed company officers and directors; and other internal and external sources of information to detect possible insider trading. For example, the NASD Securities Observation News Analysis and Regulation system combines trade activity on NASDAQ, the American Stock Exchange, and the over-the-counter markets with news stories and other external sources of information to detect potential instances of insider trading and other potential violations of federal securities laws or NASD rules. SRO staff review the thousands of alerts generated by the electronic surveillance systems annually to identify those that are most likely to involve insider trading or fraud and warrant further investigation. In conducting reviews of these alerts, SRO staff consider such factors as the materiality of news, the existence of any previous news announcements, and the profit potential. If, in reviewing the trading associated with the alert, SRO staff determines there is a strong likelihood of insider trading, they can expand this review to a full investigation. In the course of a full investigation, SROs gather information from their member broker-dealers and the issuer of the traded stock to determine whether there is any relationship between those individuals who traded the stock and those individuals who had advance knowledge of the transaction or event. For example, SRO staff will typically request from their member broker-dealers the names of individuals and organizations that traded in advance of a corporate transaction or event, a process known as bluesheeting. These data are then cross-referenced with information the SRO staff obtain from the issuer of the stock, including a chronology of the events leading up to the corporate transaction or event and the names of individuals who had knowledge of inside information. SROs have created technology-based tools to assist in the identification of potential repeat offenders. For example, SROs can compare their blue sheets to a database called the Unusual Activity File (UAF), which includes data on suspicious trading activity identified by all SROs that are part of the Intermarket Surveillance Group, to help identify persons or entities that have been flagged in prior referrals or cases related to insider trading, fraud, or market manipulation. Some SROs have also developed other databases for their internal use. For example, NASD developed a database similar to the UAF for suspicious trading activity it has identified. NYSE also has developed a database of individuals who are affiliated with entities that it considers at high risk for insider trading. When SROs find evidence of insider trading involving their members, they can conduct disciplinary hearings and impose penalties ranging from disciplinary letters to fines to expulsion from trading and SRO membership. Because SROs do not have jurisdiction over entities and individuals that are not part of their membership, they refer suspicious trading on the part of nonmembers directly to Enforcement. Although Enforcement staff do not have direct access to SRO surveillance data or recidivist databases like the UAF, several staff told us they are able to obtain any needed information from the SRO analysts who made the referrals. Data we reviewed from NASD and NYSE between fiscal years 2003 and 2006 showed that the SROs referred significantly more nonmembers to SEC for suspected insider trading than they referred members internally to their own Enforcement staff. According to SRO staff, this may be because the majority of the entities and individuals who trade on the basis of material, nonpublic information do so as a result of connections to the issuers of the stocks traded, rather than the investment advisor role that would involve member firms and their employees. Another possible explanation, according to SRO staff, is that the individual registered persons (SRO members) typically conceal their misconduct by trading in nominee accounts or secretly sharing in the profits generated by nonregistered persons involved in the scheme. As a result, they said that concealed member misconduct is often exposed through evidence developed by SEC using its broader jurisdictional tools after the SRO has referred a nonmember to SEC. For example, they said that SEC can expose the concealed member misconduct by fully investigating the nonregistered person’s activities through documents such as telephone and bank records obtained by subpoena. SEC also has the ability to issue subpoenas to nonmembers to appear for investigative testimony. OCIE assesses the effectiveness of SRO regulatory programs, including enforcement programs, through periodic inspections. OCIE officials said that when evaluating SRO enforcement programs related to insider trading, their objective is to assess whether the parameters of the surveillance systems are appropriately set to detect abnormal movements in a stocks’ price or volume and generate an alert, the extent to which SRO policies and procedures direct the SRO staff to conduct thorough reviews of alerts and resulting investigations, and the extent to which SRO analysts comply with these policies and procedures and apply them consistently. OCIE staff said that when reviewing case files, one of their priorities is to assess the evidence upon which the SRO analyst relied when deciding to terminate the review of an alert or investigation. For example, they said that they will assess whether the analyst selected an appropriate period to review trading records (because suspicious trades may have occurred several days or weeks prior to the material news announcement), whether the analyst reviewed the UAF and internal databases for evidence of recidivism, and whether the analyst appropriately reviewed any other stocks or entities related to the trading alert. OCIE officials said that in light of the recent increase in merger and acquisition activity and the increased potential for insider trading, SROs are making greater efforts to detect attempts of individuals or firms to benefit on both sides of a merger or acquisition. For example, they said that where previously it was common for one SRO analyst to investigate any alerts generated from the movement of the target firm and for a different analyst to investigate any alerts generated from the movement of the acquiring firm—making it difficult to identify an account or individual that may have traded on both sides of the acquisition—SRO policies now generally require one analyst to review and investigate both stocks involved in a merger or acquisition. Generally speaking, mergers and acquisitions present opportunities for insider trading because the acquiring company generally must pay more per share than the current price, causing the target firm’s stock price to increase. In this case, an individual with knowledge of an upcoming acquisition could purchase the target’s stock prior to the announcement and then sell for a gain the stock after the announcement at the higher price. An individual also could sell any holdings or sell short the stock of the acquiring firm if the individual believed that the acquiring firm’s stock price would decrease after the announcement. Finally, an individual could attempt to buy the target firm and sell (or short sell) the acquiring firm in an attempt to benefit on both sides of an acquisition. In January 2007, OCIE completed sweep inspections of surveillance and investigatory programs related to insider trading at 10 SROs. As a result of its inspections, OCIE identified opportunities for improved coordination and standardization among SROs in monitoring and investigating possible insider trading. OCIE found that because each SRO at the time maintained its own surveillance systems, the variances in the system parameters could result in the possibility that stock or option movements might generate an alert at one SRO but not another. Furthermore, OCIE found that because each SRO was responsible for monitoring every stock that traded on its market, the SROs were duplicating the initial screening of alerts. As a result of OCIE’s then ongoing inspection, the options SROs submitted a plan to SEC to create a more uniform and coordinated method for the regulation, surveillance, investigation, and detection of insider trading in the options markets. SEC approved the plan, called Options Regulatory Surveillance Authority (ORSA), in June 2006. The plan allows the options SROs to delegate part or all of the responsibility of conducting insider trading surveillance and investigations for all options trades to one or more SROs, with individual SROs remaining responsible for the regulation of their respective markets and retaining responsibility to bring disciplinary proceedings as appropriate. ORSA has currently delegated this surveillance and investigative responsibility to the Chicago Board Options Exchange. The ORSA plan also provides for the establishment of a policy committee that is responsible for overseeing the operation of the plan and for making all relevant policy decisions, including reviewing and approving surveillance standards and other parameters to be used by the SRO performing the surveillance and investigative functions under the plan. The committee also will establish guidelines for generating, reviewing, and closing insider trading alerts; specific and detailed instructions on how analysts should review alerts; and instructions on closing procedures, including proper documentation and rationale for closing an alert. OCIE officials stated that they have met regularly with the options SROs to monitor the implementation of the plan and the development of related policies and procedures. According to the Commission, the ORSA plan should allow the options exchanges to more efficiently implement surveillance programs for the detection of insider trading, while eliminating redundant effort. As a result, OCIE officials believe the plan will promote more effective regulation and surveillance. According to OCIE officials, the equities SROs are currently drafting a similar plan for coordinating insider trading surveillance in equities markets. However, instead of designating one SRO to conduct all insider trading-related surveillance, OCIE officials said that the current draft proposal would require each listing market, or its designee, to conduct insider trading surveillance for its listed issues, regardless of where trading in the security occurred. This includes reviewing alerts, pursuing investigations, and resolving cases through referrals (to SEC) or disciplinary action. OCIE officials said that the equities SROs anticipate voting on a proposed plan at the October 2007 Intermarket Surveillance Group meeting and to submit the plan to SEC by the end of 2007. Pursuant to sections 19 and 21 of the Securities Exchange Act of 1934, SEC may bring enforcement actions against an SRO either in federal court or through an administrative proceeding if it has found that an SRO has violated or is unable to comply with the provisions of the act and related rules and regulations, or if it has failed to enforce member compliance with SRO rules without reasonable justification or excuse. The act authorizes SEC to seek a variety of sanctions in an administrative proceeding, including the revocation of SRO registration, issuance a cease-and-desist order, or censure. An SRO may also agree to undertake other remedial actions in a settlement agreement with SEC. In addition to the remedies available in administrative enforcement action, a district court in a civil enforcement action may impose civil monetary penalties and has discretion to fashion such other equitable remedy it deems appropriate under the circumstances. Tables 2 through 11 summarize the 10 civil enforcement actions SEC brought against SROs from January 1995 through September 2007. For this report, we have included only those findings and terms of settlement related to SRO surveillance, investigative, or disciplinary programs (enforcement programs). As such, these summaries do not necessarily identify all findings and terms of the settlement agreements. Tables 12 to 22 include analyses of data from fiscal years 2003 to 2006 provided by SEC from its SRO system and CATS. This appendix provides specific analyses on the number and types of advisories; referrals; matters under inquiry (MUI); investigations; case actions; and case outcomes, by fiscal year and SRO. It also describes reasons that SEC closed MUIs and provides data on average and median investigation durations, by type of investigation. In addition to the contact named above, Karen Tremba (Assistant Director), Nina Horowitz, Stefanie Jonkman, Matthew Keeler, Marc Molino, Omyra Ramsingh, Barbara Roesmann, and Steve Ruszczyk made key contributions to this report.

Summary: Self-regulatory organizations (SRO) are exchanges and associations that operate and govern the markets, and that are subject to oversight by the Securities and Exchange Commission (SEC). Among other things, SROs monitor the markets, investigate and discipline members involved in improper trading, and make referrals to SEC regarding suspicious trades by nonmembers. For industry self-regulation to function effectively, SEC must ensure that SROs are fulfilling their regulatory responsibilities. This report (1) discusses the structure of SEC's inspection program for SROs, (2) evaluates certain aspects of SEC's inspection program, and (3) describes the SRO referral process and evaluates SEC's information system for receiving SRO referrals. To address these objectives, GAO reviewed SEC inspection workpapers, analyzed SEC data on SRO referrals and related investigations, and interviewed SEC and SRO officials. To help ensure that SROs are fulfilling their regulatory responsibilities, SEC's Office of Compliance Inspections and Examinations (OCIE) conducts routine and special inspections of SRO regulatory programs. OCIE conducts routine inspections of key programs every 1 to 4 years, inspecting larger SROs more frequently, and conducts special inspections (which arise from tips or the need to follow up on prior recommendations or enforcement actions) as warranted. More specifically, OCIE's inspections of SRO surveillance, investigative, and disciplinary programs (enforcement programs) involve evaluating the parameters of surveillance systems, reviewing the adequacy of policies and procedures for handling the resulting alerts and investigations, and reviewing case files to determine whether SRO staff are complying with its policies and procedures. GAO identified several opportunities for SEC to enhance its oversight of SROs through its inspection program. First, although examiners have developed processes for inspecting SRO enforcement programs, OCIE has not documented these processes or established written policies relating to internal controls over these processes, such as supervisory review or standards for data collection. Such documentation could strengthen OCIE's ability to provide reasonable assurances that its inspection processes and products are subject to key quality controls. Second, OCIE officials said that they focus inspections of SRO enforcement programs on areas judged to be high risk. However, this risk-assessment process does not leverage the reviews that SRO internal and external auditors performed, which could result in duplication of SRO efforts or missed opportunities to direct examination resources to other higher-risk or less-examined programs. OCIE officials told us that they plan to begin assessing SRO internal audit functions in 2008, including the quality of their work products, which would allow OCIE to assess the usefulness of these products for targeting its inspections. Finally, OCIE currently does not formally track the implementation status of SRO inspection recommendations; rather, management consults with staff to obtain such information as needed. Without formal tracking, OCIE's ability to efficiently and effectively generate and evaluate trend information, such as patterns in the types of deficiencies found or the implementation status of recommendations across SROs, or over time, may be limited. SEC's Division of Enforcement uses an electronic system to receive referrals of potential violations from SROs. These referrals undergo multiple stages of review and may lead Enforcement to open an investigation. From fiscal years 2003 to 2006, SEC received an increasing number of advisories and referrals from SROs, many of which involved insider trading. However, SEC's referral receipt and case tracking systems do not allow Enforcement staff to electronically search all advisory and referral information, which may limit SEC's ability to monitor unusual market activity, make decisions about opening investigations, and allow management to assess case activities, among other things.