The credit rating industry is highly concentrated. As of April 2015, there were 10 registered NRSROs. In fiscal year 2013, the 3 largest NRSROs accounted for 95 percent of the year’s total reported NRSRO revenue and as of December 2014, they issued 96 percent of all outstanding ratings. These 3 firms also employed 88 percent of the approximately 4,500 credit rating analysts who work at NRSROs (see table 1). Other firms that do not describe themselves as rating agencies and firms that are not registered with SEC also conduct credit rating-type analyses. According to SEC, the agency does not collect data on this group of firms. A credit rating is an assessment of the creditworthiness of an obligor as an entity or with respect to specific securities or money market instruments. These assessments reflect a variety of quantitative and qualitative factors that vary based on sector and NRSRO. To determine an appropriate rating, analysts use publicly available information and market and economic data, and may hold discussions and obtain nonpublic information from the issuer. Commonly, analysts then present their proposed rating to a ratings committee in their agency, and the committee discusses and evaluates the data before voting on a decision. The decision of the ratings committee then is communicated to the issuer seeking the rating and a final rating is issued. Issuers seek credit ratings to improve the marketability or pricing of their securities or to satisfy investors, lenders, or counterparties. Institutional investors may use credit ratings as one of several inputs to internal credit assessments and investment analyses, or to facilitate the trading of securities. Broker-dealers also use ratings to recommend and sell securities to clients or determine acceptable counterparties and collateral levels for outstanding credit exposures. An NRSRO can be registered in one or more of five classes of credit ratings: (1) financial institutions, brokers, or dealers; (2) insurance companies; (3) corporate issuers; (4) issuers of asset-backed securities; and (5) issuers of government securities, municipal securities, or securities issued by a foreign government. Five NRSROs are registered with SEC to rate in five classes, while others are registered in fewer. Since the early 2000s, Congress has taken measures to reform the credit rating industry. In 2006, Congress passed the Credit Rating Agency Reform Act, to improve ratings quality by fostering accountability, transparency, and competition in the credit rating industry. The Credit Rating Agency Reform Act added section 15E to the Exchange Act, which established SEC oversight over NRSROs. Section 15E also requires SEC to conduct examinations at least annually of each NRSRO to monitor compliance with statutory and regulatory requirements. Each examination must include a review of areas including, among other things, whether the NRSRO conducts business in accordance with its policies, procedures, and methodologies, as well as the management of conflicts of interest by and internal supervisory controls of the NRSRO. The performance of the three largest NRSROs in rating subprime residential mortgage-backed securities (RMBS) and related securities renewed questions about the accuracy of their credit ratings generally, the integrity of the ratings process, and investor reliance on NRSRO ratings for investment decisions. Since the 2007–2009 financial crisis, the United States has put in place additional regulation of credit rating agencies. The Dodd-Frank Act required that SEC establish the Office of Credit Ratings (OCR) to administer SEC rules with respect to the practices NRSROs use in determining credit ratings. SEC established the office in June 2012; OCR has since assumed responsibility for oversight activities, such as the annual examinations of NRSROs to assess their compliance with SEC rules. The Dodd-Frank Act also required SEC to issue regulations imposing new requirements on NRSROs related to qualification standards for credit rating analysts. SEC issued new rules, which became effective in June 2015, containing the following requirements: Each NRSRO must establish, maintain, enforce, and document standards of training, experience, and competence for its credit analysts. In the required standards, each NRSRO must include a requirement for periodic testing of its credit analysts on their knowledge of the NRSRO’s procedures and methodologies used to determine credit ratings. The standards also must include a requirement that at least one individual with an “appropriate level of experience in performing credit analysis, but not less than 3 years” participates in the determination of a credit rating. These standards apply to all individuals who participate in the determination of credit ratings, including individuals at NRSROs and credit rating affiliates located in other countries. Before SEC issued the new rules, there were no regulatory requirements for training and testing of credit rating analysts in the United States. Regulatory requirements also exist internationally for credit rating agencies. For example, in 2009, the European Union (EU) established rules for credit rating agencies in the EU. These rules include basic requirements that all staff involved in the ratings process have appropriate knowledge and experience to complete their assigned duties, but do not specify training and competence standards for analysts or require testing. Similar to OCR in the United States, the European Commission established the European Securities and Markets Authority—the EU financial regulatory institution and European Supervisory Authority—in January 2011 to provide exclusive registration and supervision of credit rating agencies in the EU. In 2008, the leaders of the Group of 20 (G20) pledged to strengthen oversight of credit rating agencies. Specifically, as part of the G20 declaration at its November 2008 summit, regulators were charged with taking steps to ensure that credit rating agencies met IOSCO—an international standard-setting body for the securities sector—standards, avoided conflicts of interest, and had the right incentives and appropriate oversight to enable them to provide unbiased information and assessments. Subsequently, several countries’ regulators took additional steps to increase oversight of these agencies. For example, regulatory authorities in Hong Kong, Singapore, and Saudi Arabia established licensing regimes for credit rating analysts. Many credit rating agencies around the world voluntarily comply with IOSCO’s Code of Conduct Fundamentals for Credit Rating Agencies (Code). The Code includes standards about implementing and enforcing procedures for methodologies analysts must use, ethical practices they should follow, and conflicts of interest they should avoid. Additionally, a March 2015 revision includes a new provision that analysts undergo formal ongoing training at reasonably timed intervals, including education on the agency’s code of conduct, methodologies, and on policies and laws that govern the agency. Most NRSROs voluntarily comply with and adhere to a code of conduct that is consistent with some or all of the IOSCO Code. Generally, independent professional organizations are established to help protect the integrity of a specific profession and provide safeguards for stakeholders, such as investors, and the public. Professional organizations are membership-based. The specific responsibilities of professional organizations may evolve over time, but the primary responsibilities of these organizations generally include the following: educating members, which often includes promoting knowledge sharing among members and engaging in research related to the profession; developing standards to govern the profession (including codes of overseeing member compliance with the standards; registering or providing certification or examination for members in the profession, or both; and engaging in public education, outreach, or (in some cases) advocacy about the profession. Key elements of these organizations vary depending on the type and purpose of the organization, including membership requirements (mandatory versus voluntary and institutional versus individual), funding, and the role of government. In addition, professional organizations take various measures to safeguard their independence, including consideration of the composition of their governing board and their funding source. Views varied on the merits of a professional organization for credit rating analysts of nationally recognized statistical rating organizations, but most concluded it was too early to tell if one was needed. Professional organizations, including a professional organization for credit rating analysts, can improve the reputation of the industry where the professionals work, promote collaboration and sharing to enhance quality, and supplement existing oversight. However, all analysts with whom we spoke as well as representatives of NRSROs; a few experts and stakeholders (including academics, investors, advocacy groups, and international regulators); and SEC officials told us that such an organization for credit rating analysts could duplicate existing professional standards, codes of ethical conduct, and oversight of credit rating analysts. More importantly, in light of SEC’s new standards to help ensure the training, experience, and competence of credit rating analysts, some representatives and a few analysts and experts and stakeholders said that it was too early to determine what role a professional organization would play, or whether a professional organization was needed at all. Professional organizations can help to improve an industry’s reputation, enhance quality, and supplement existing regulatory oversight. Improved reputation. According to some professional organization representatives with whom we spoke, professional organizations can increase the public’s trust in an industry by developing shared professional standards and oversight processes to help ensure the quality of the work. For example, shared standards can help define a minimum baseline for skills that professionals need, promote ethical behaviors in the profession, and provide a process for identifying and removing bad actors. A few analysts and one NRSRO representative explained that a professional organization for credit rating analysts could improve the reputation of NRSROs and credit rating analysts. Enhanced quality. Professional organizations facilitate sharing and collaboration among professionals to enhance the quality of the work they perform. Specifically, a few representatives of professional organizations, analysts, and experts and stakeholders told us that one advantage of an organization would be the forum it could provide for professionals to network and share and develop best practices or standards. In addition, most NRSRO representatives and all analysts with whom we spoke told us that analysts usually learn the skills necessary to issue ratings from internal training programs and on-the- job experience. According to a few experts and stakeholders, an analyst, and one NRSRO representative, an organization could be beneficial for all credit rating analysts, regardless of employer, because they would receive similar information and training that could play a quality control function. Supplemented oversight. According to a few representatives of existing professional organizations and one NRSRO representative, a professional organization has the potential to enhance or supplement existing oversight. For example, a professional organization can fill in gaps in regulatory oversight by providing more detailed rules than regulatory agencies can provide. Representatives of one professional organization also could provide more robust oversight programs than regulatory agencies, and can sometimes carry out responsibilities faster. However, analysts, NRSRO representatives, and experts and stakeholders told us that these benefits would be unlikely to result from an organization for credit rating analysts. Specifically, all analysts and NRSRO representatives and a few experts said that creating a professional organization for credit rating analysts employed by NRSROs could duplicate existing structures and organizations rather than enhance or supplement those structures. Some NRSRO representatives and analysts explained that certain SEC rules apply to credit rating analysts, including rules prohibiting conflicts of interest, and SEC may oversee certain activities of credit rating analysts through its oversight of NRSROs—two of the key activities associated with a professional organization. A few NRSRO representatives added that SEC examines NRSROs annually to ensure adherence to SEC rules. For example, during the 2014 examinations, SEC staff reviewed each NRSRO’s ethics policy and procedures, as well as a sample of each NRSRO’s employee In certifications or monitoring activities concerning their code of ethics.addition, some NRSRO representatives and a few analysts told us the IOSCO Code includes professional standards applicable to credit rating analysts and 8 of the 10 NRSROs cite the IOSCO Code in their codes of ethical conduct. Finally, according to some analysts with whom we spoke, many analysts belong to professional organizations, such as AICPA, CFA Institute, or industry groups, that provide the services of a professional organization (education, development and oversight of professional standards, certification, and public outreach and advocacy).all analysts and representatives of NRSROs and a few experts and stakeholders told us that a professional organization for credit rating analysts might duplicate existing standards and oversight. In addition, other NRSRO representatives and some experts and stakeholders told us that it was unclear whether, or how, the organization would address some of the well-known and widely reported issues that have harmed the reputation of NRSROs. For example, representatives from one expert organization explained that ratings downgrades in 2008 and 2009 (during the financial crisis) hurt the reputation of rating agencies and that investigations and enforcement actions, such as Standard & Poor’s $1.375 billion settlement associated with their misrepresenting the true credit risks of securities they rated during 2004-2007, had not helped to restore investors’ confidence. and a few experts and stakeholders, said that concerns about the accuracy and quality of credit ratings were not due to incompetent or poorly trained analysts. They noted that in their opinion, other issues in the industry, such as concerns about industry concentration, are more They stated that a professional organization established to relevant. See Securities and Exchange Commission, Summary Report of Issues Identified in the Commission Staff’s Examinations of Select Credit Rating Agencies (Washington, D.C.: July 2008); and Senate Permanent Subcommittee on Investigations, Wall Street and the Financial Crisis: Anatomy of a Financial Collapse, 112th Cong., 1st sess. (Washington, D.C., Apr. 13, 2011). In February 2015, Standard & Poor’s and its parent company McGraw Hill Financial, Inc. entered into a $1.375 billion settlement with the Department of Justice, 19 states, and the District of Columbia for charges related to misrepresenting the true credit risk of securities they rated during 2004–2007. They also settled for $125 million with the California Public Employees Retirement System at the same time for similar charges. In addition, in January 2015 they settled for $58 million with SEC and $19 million with the New York Attorney General’s office and the Massachusetts Attorney General’s office for charges involving fraudulent misconduct in ratings, particularly of certain commercial mortgage-backed securities. develop and oversee standards for analysts may be unable to deal with these issues at this time. As a result, a few experts questioned how well a professional organization would improve the industry’s reputation or enhance the quality of ratings. Finally, some NRSRO representatives, a few experts and analysts, and SEC officials said that it was too early to determine whether a professional organization might add to or complement the quality or oversight of analysts’ work, particularly in light of SEC’s new requirements designed to enhance the standards of training, experience, and competence for credit rating analysts at NRSROs. As we stated earlier, the new rules, which became effective in June 2015, require NRSROs to ensure that analysts meet additional quality standards to produce accurate ratings and are periodically tested on their knowledge of the NRSRO’s credit rating process. Additionally, SEC’s new rules address certain policies and procedures with respect to the methodologies used to determine credit ratings, conflicts of interest with respect to sales and marketing considerations, and certain actions when a review conducted by an NRSRO determines that a conflict of interest relating to post- NRSRO employment influenced a credit rating. They explained that SEC’s new rules address some of the services that one can expect from a professional organization (such as training and certification), and therefore it seemed appropriate to first determine if there were specific gaps that a professional organization might be able to fill at a later date. Some NRSRO representatives with whom we spoke said that they have made changes to their training and testing requirements in response to these new requirements. Some NRSRO representatives and one expert commented that, because of these recent changes, SEC should first evaluate whether the actions taken by NRSROs meet the new requirements. In addition, SEC previously noted that regulations affecting financial markets should be reviewed and revised as necessary to ensure the regulations continue to fulfill SEC's mission. Retrospective analyses can help agencies evaluate how existing regulations work in practice. Moreover, retrospective analyses can provide SEC the opportunity to assess how well the new regulations have achieved their policy goals. According to most analysts and representatives of NRSROs, and some experts and stakeholders, creating and operating a professional organization for credit rating analysts might be challenging. For example, some noted that it might be difficult to clearly define the organization’s purpose at this time because of new SEC requirements, which became effective in June 2015, for NRSROs to put standards and testing requirements into place for analysts. Similarly, others said that a relatively small membership base could make obtaining adequate funding difficult and the organization could struggle to define meaningful standards because of the potentially limited applicability of common standards across NRSROs. In light of these challenges, some analysts and experts and a few representatives of NRSROs identified other ways to develop and oversee professional standards for credit rating analysts, such as enhancing SEC oversight, engaging a third party to credential all analysts on minimum standards, or creating an organization with a broader membership base. Creating and operating any professional organization requires identifying the organization’s purpose, funding, organizational structure, and core activities. Most analysts and representatives of NRSROs and some experts and stakeholders (including academics, investors, advocacy groups, and international regulators) told us that putting these components in place for an organization for NRSRO credit rating analysts could be challenging. Creating and operating any professional organization requires a clear mission, purpose, and identification of the value the organization would bring its members, their industry, and the public. According to some NRSRO representatives, experts, and a few analysts, defining a clear purpose and mission for an organization for credit rating analysts would be difficult at this time because of the new SEC regulations. According to some representatives of existing professional organizations, clearly defining the purpose of an organization helps ensure that it will be viewed as a credible actor—able to effectively influence the behavior of members and industry. They noted that most professional organizations arise out of a specific public policy need, problem, or other precipitating event that a core group of professionals wants to address. Understanding the specific motivation for creating the organization can help orient the organization and define its value to its members. However, some NRSRO representatives and experts told us that because SEC’s rules for NRSROs to implement standards for their credit rating analysts were newly effective, it would be difficult at this time to effectively identify potential gaps in the training, credentialing, or oversight of credit rating analysts that a new organization would be designed to address. As we noted earlier, effective June 2015, each NRSRO must establish, maintain, enforce, and document standards of the training, experience, and competence for its credit rating analysts. According to most NRSRO representatives, they are in the process of making changes to their training and testing activities in response to these rules, including introducing new mandatory training programs, developing formal periodic testing regimes, and expanding support for analysts pursuing credentials from existing professional organizations. As a result, some of them questioned the role and potential value-added of creating a professional organization at this time. Professional organizations require funding to cover operational expenses and provide member services, such as the development and oversight of professional standards. Some representatives of NRSROs and existing professional organizations, experts, and analysts with whom we spoke stated that the relatively small population of credit rating analysts—as of December 2014, NRSROs employed approximately 4,500 analysts— suggests it might be challenging to obtain adequate funding to create and operate the organization, at least initially. Generally, member dues partially fund organizations. As shown in figure 2, of the six existing professional organizations we reviewed, in 2014, membership dues provided from 3 to 60 percent of revenue, with annual dues ranging from Organizations also receive revenue from $125 to $425 for members.other sources, including fees for services, examinations, conferences, education programs, and publications; fines or other disciplinary actions; and assessments on certain transactions, such as the assessment collected by MSRB on the trading and underwriting activities of municipal securities dealers. With regard to revenue from examinations and education programs, however, a few representatives of existing professional organizations noted that it might take several years for a new organization, such as one created for credit rating analysts, to receive sufficient revenue from these activities. One source of funding for an organization representing credit rating analysts could be from NRSROs themselves, but the views of NRSRO representatives and experts were mixed on the potential advantages and disadvantages of such an approach. A few representatives of NRSROs and some experts stated that an organization funded by NRSROs would be vulnerable to having its core activities, including the development and oversight of professional standards, influenced by NRSROs. They noted that this influence risked undercutting the organization’s independence from NRSROs and weakening its ability to act as a safeguard for investor and public interests—one of the noted responsibilities of a professional organization. In contrast, a few representatives of NRSROs and experts stated that NRSRO involvement in the organization would be an advantage because it would help ensure that the organization would have NRSRO support and acceptance to facilitate incorporation of the organization’s standards into analysts’ work. One expert noted that the NRSRO, as the employer, could be best placed to confirm that its credit rating analyst employees adhered to the organization’s standards. As an alternative to receiving direct funding from NRSROs, the organization could be partly funded through transactions fees paid to NRSROs. For example, FINRA and MSRB both receive funds directly from member Of the six organizations we reviewed, firms for certain transactions.MSRB is closest in size—it has approximately 3,300 members—to what would be the likely size of an organization representing credit rating analysts. In 2014, membership fees accounted for only 4 percent of its total revenue, whereas underwriting and trading fees accounted for more than 80 percent of revenue. The MSRB’s reliance on additional funding sources, including transaction fees, may serve as a model for funding a like-size organization. To identify the issues to consider in developing the organizational structure for a professional organization, we identified three models that could provide the basis for the creation and operation of a professional organization for credit rating analysts. For additional discussion of our methodology, see appendix I, and for additional discussion of the organizations we considered in developing our models, see appendix II. number of credit rating analysts employed by each NRSRO, could create challenges for developing an organizational structure that helps ensure equitable representation of all members, in particular those members employed by smaller NRSROs. For instance, consideration should be given to whether membership is mandatory or voluntary and whether the organization’s authority comes from the government or the public and industry (for additional discussion of various organizational structures, see app. II). In addition, successful professional organizations require personnel—whether paid staff, contractors, or volunteers—with experience leading and managing professional organizations and the technical knowledge and leadership to help ensure the organization’s relevance. As we noted earlier, the three largest NRSROs employ 88 percent of credit rating analysts. Some NRSRO representatives, analysts, and experts commented that this might require an organization to take additional steps to ensure it considers the experience and needs of members from both larger and smaller NRSROs in determining its organizational structure and personnel decisions. According to most representatives of existing professional organizations, a number of steps can be taken to safeguard an organization’s independence from dominance by certain elements in an industry. For example, an organization can help balance members’ interests through the composition of its board. Several existing professional organizations have nonindustry representation on the board and MSRB officials noted the Dodd-Frank Act modified MSRB’s board structure to require the majority of the board members be independent public representatives.representative of one professional organization explained that seeking stakeholder input or allowing for public comment before announcing new policies or rules also could help ensure that a variety of views and experiences were taken into account. Another representative of a professional organization noted that the organization requires professionals who volunteer to participate in the organization’s activities— such as the development or oversight of standards or the development of educational and testing programs—to attest that they will engage with the professional organization independently of their engagement with their employer. Creating and operating any professional organization requires developing core activities and services, such as professional standards, education and training curricula, certification tests, and structures to oversee member compliance. According to most analysts and NRSRO representatives, the proprietary methodologies used to conduct ratings and the specialization of credit rating analysts’ knowledge might make developing a meaningful credential or set of professional standards challenging. According to representatives from existing professional organizations, developing these services is a time- and labor-intensive process that requires extensive stakeholder involvement and buy-in. However, most NRSRO representatives and some analysts with whom we spoke noted that opportunities to share information about credit rating activities to develop those standards could be limited due to concerns about safeguarding confidential information and proprietary ratings methodologies. In addition, they explained that conducting ratings is highly technical, varies greatly depending on the specific asset class and the types of ratings being provided in that class, and relies on the individual NRSRO’s methodology. For example, the Department of the Treasury (Treasury) recently led an exercise that found the ratings results diverged widely among six credit rating agencies that conducted hypothetical ratings of identical pools of mortgage loans. A few NRSRO representatives noted that they had individually identified core knowledge, including information on financial market operations that their analysts needed to know. This core knowledge could provide the basis for an examination or credentialing process or the development of professional standards, but the extent to which it would promote higher quality ratings was unclear. For example, most credit rating analysts with whom we spoke noted that this core knowledge was a valuable foundation for conducting ratings, but producing ratings also required specialized knowledge and experience. As a result, some NRSRO representatives and analysts stated that a relatively limited set of standardized knowledge or activities was applicable across all NRSROs or asset classes. According to representatives of existing professional organizations, one approach to bridging differences among actors in a profession is to develop principle-based standards, rather than rules. Principle-based standards provide a broad framework on the types of behavior and approaches to certain activities expected of members. For example, the AICPA Code of Professional Conduct identifies specific principles to guide certified public accountants’ activities, including the responsibility to conduct work with integrity and in the public interest. Under a principle- based approach, individual professionals are expected to apply the principles to assess the unique factors and circumstances that arise during their work. However, these standards may stop short of providing specific details on acceptable actions or activities. Representatives of existing professional organizations noted that the types of standards used by an organization evolve over time and that an organization’s standards can be a combination of principles and rules. In light of the challenges and other concerns with creating a professional organization for analysts, which we discussed earlier, some experts and analysts with whom we met and a few NRSRO representatives identified alternative approaches that could be used to establish and oversee standards and a code of conduct, as the following examples illustrate. Expand SEC oversight. SEC could expand its oversight of analysts by defining minimum experience or knowledge requirements for analysts or requiring all analysts to pass an examination before conducting ratings. One expert and SEC officials noted that SEC might require additional resources to implement any additional activities or requirements. Engage a third party. A third party (such as an existing professional organization, a private business, or a taskforce of regulatory and other experts) could be engaged to develop and communicate professional standards for credit rating analysts and oversee application of the standards. Some experts noted this approach might be more efficient than creating a new organization because it could leverage existing resources and mitigate concerns about larger NRSROs dominating an organization. SEC considered public comments regarding this type of approach after proposing its new rule for the training and testing of credit rating analysts, but did not adopt this approach because it did not allow NRSROs sufficient flexibility to design standards tailored to their business model, size, and methodologies. Broaden the potential member base. According to some analysts, an organization with a broader membership base (all credit analysts, not just those that determine credit ratings) would have a larger potential membership base and could provide services, such as a credential, which were valued outside of the credit rating profession. Representatives of one NRSRO noted that this might be developed within an existing organization, such as CFA Institute. However, as we noted earlier, a few analysts and some NRSRO representatives and experts did not see a need for a professional organization and some analysts and NRSRO representatives and one expert did not identify any alternative structures to establish or oversee standards and a code of conduct for credit rating analysts. We provided a draft of this report to SEC for review and comment. In addition, we provided a draft of the organizational profiles and assessments to the existing professional organizations for review. SEC staff as well as representatives from each organization provided technical comments, which we have included, as appropriate. We are sending copies of this report to the appropriate congressional committees and members, SEC, and other interested parties. This report will also be available at no charge on our website at http://www.gao.gov. Should you or your staff have questions concerning this report, please contact me at (202) 512-8678 or sciremj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. Section 939E of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) required us to study the feasibility and merits of creating an independent professional organization for rating analysts employed by nationally recognized statistical rating organizations (NRSRO) that would be responsible for establishing independent standards for governing the profession of rating analysts, establishing a code of ethical conduct, and overseeing the profession of rating analysts. This report describes views on (1) the potential merits of and need for a professional organization for credit rating analysts; and (2) identified components of and challenges associated with creating and operating such an organization, and possible alternatives for establishing and overseeing professional standards and a code of ethical conduct. To address both objectives, we conducted a literature review. We used Internet search techniques and keyword search terms to identify available information about the credit rating industry, including the definition of a credit rating; number and nature of companies that serve as credit rating agencies, or NRSROs; and relevant laws and regulations, including the Securities and Exchange Commission’s (SEC) recent rules requiring NRSROs to establish standards of training, experience, and competence for rating analysts. We also identified sources describing the founding, development, and assessment of professional organizations (or associations) and professional designations. From research databases such as ProQuest and LexisNexis, we obtained information from publicly available documents, such as financial reports, journals, trade publications, periodicals, studies, white papers, and aggregated databases relevant to professional organizations and the credit rating industry. To address the first objective, we collected and analyzed information on existing organizations that develop and oversee professional standards and codes of conduct, including the American Institute of Certified Public Accountants (AICPA); American Society of Association Executives (ASAE); CFA Institute; Financial Industry Regulatory Authority (FINRA); Institute of Internal Auditors (IIA); Municipal Securities Rulemaking Board (MSRB); and the Public Company Accounting Oversight Board (PCAOB). We interviewed representatives of these organizations to obtain information on the merits of creating a professional organization, in general, as well as the potential merits of creating an independent professional organization for credit rating analysts. We also obtained available information on the advantages and disadvantages of a professional organization, why such organizations are generally formed (the perceived need, pertaining to the specific industry, profession, or the public), as well as the need for professional standards and codes of conduct for members. We obtained information from transcripts of SEC’s roundtable on credit ratings held on May, 14, 2013, in which participants, including NRSROs, international regulators, academics, and other industry experts, discussed ethics training and possible certification requirements for credit rating analysts. We also obtained information from comments submitted in response to SEC’s 2011 proposed rules to enhance oversight of NRSROs. We obtained and analyzed information on existing NRSRO professional standards and codes of conduct, including information on each NRSRO’s Code of Conduct/Ethics submitted to SEC as part of their annual certification on “Form NRSRO” for calendar year 2014 (the most recent filings to date). We also analyzed the International Organization of Securities Commissions (IOSCO) Code of Conduct Fundamentals for Credit Rating Agencies as well as SEC’s new rule requiring NRSROs to establish standards for training, experience, and competence of credit rating analysts. Additionally, we reviewed the 2014 Summary Report of Commission Staff’s Examinations of Each Nationally Recognized Statistical Rating Organization and the 2014 Annual Report to Congress on Nationally Recognized Statistical Rating Organizations for reported information on NRSRO professional standards and codes of conduct. To address the second objective, we held semi-structured interviews with representatives of the professional organizations we identified, and reviewed their websites and publicly available documents. We obtained and analyzed information on the operational structure and approaches used to provide services to members including the organizations’ membership requirements, funding channel, government role, and source of authority. We also obtained information on the resources and actions needed to create and operate a professional organization for credit rating analysts and possible organizations that could serve as models for such an organization. We used the information we obtained through interviews and the results of our literature review to develop a working definition of an independent professional organization and identify three potential models of a professional organization for credit rating analysts (see fig. 3, app. II). We defined an independent professional organization as a membership-based organization that is established to help protect the integrity of the profession, provide safeguards for investors and the general public, and take steps to safeguard independence through the composition of a governing board. To ensure the validity of our results, we provided our definition and models to the existing organizations for comment and adjusted our results based on their input. We also obtained information on other structures or instruments (regulatory or otherwise) that could be used to establish standards and a code of ethical conduct for governing and overseeing the profession. For example, we obtained and analyzed information on international regulatory organizations in four jurisdictions (Hong Kong, Saudi Arabia, Singapore, and Turkey) identified by SEC as having established various structures for oversight, such as direct registration and licensure for credit rating analysts and related professional standards and codes of conduct for the profession. To gather a diverse set of perspectives, we interviewed SEC officials; NRSRO representatives; industry experts and stakeholders—including investors, academics, representatives of credit rating and analysis firms not registered with SEC, representatives of the Software and Information Industry Association, representatives of a research institute, and officials with the European Securities and Markets Authority and IOSCO—and leadership or governing bodies of existing professional organizations.We obtained their views about (1) the advantages and disadvantages (for regulators, credit rating agencies, rating analysts, investors, and the public) of creating a professional organization for credit rating analysts, and (2) how a professional organization would fit within the existing structure of regulation and oversight of credit rating agencies and credit rating analysts. We also obtained their views on the nature and common characteristics of professional organizations, including organizational structure, relationship to members, and regulatory body (such as SEC); professional certifications for members; resources and actions needed to create and operate a professional organization for rating analysts; organizations that could serve as an appropriate model in evaluating the feasibility and merits of a professional organization for rating analysts; and how and to what extent professional organizations develop and oversee professional standards and a code of ethical conduct for members. We also obtained their views on the potential challenges involved in creating and operating an organization, such as obtaining funding, attracting and retaining membership, developing professional standards and a code of ethical conduct, and overseeing rating analysts. We obtained their views on the need for an independent professional organization for credit rating analysts; the circumstances under which analysts and other stakeholders would use the services of such an organization; and how, or whether, an independent professional organization for credit rating analysts would address some of the current challenges facing the credit rating industry. We used a modified Delphi approach to identify and confirm the most important issues for each objective. In doing so, we conducted an initial round of interviews with officials in SEC’s Office of Credit Ratings, representatives of select NRSROs and professional organizations, and select industry experts to discuss the information collected through our literature search. In our second round of interviews, we held semi- structured interviews with senior management from all NRSROs, and select industry experts and stakeholders to obtain a depth of understanding and a variety of perspectives, as well as to corroborate the information obtained in the research and initial interviews. The criteria for selecting these interviewees consisted of factors such as participation in prior SEC events, including roundtables; recommendations from GAO stakeholders, industry experts, and other external stakeholders; participation in prior congressional hearings or industry conferences; appearance in our literature reviews and Internet searches; and bibliographies of relevant papers and studies where they were mentioned. Finally, to ensure that we obtained the perspectives of credit rating analysts in particular, we conducted a series of 11 focus groups with approximately 100 credit rating analysts, at 6 of the 10 NRSROs. We judgmentally selected 6 of the 10 NRSROs based on the size of the firm (number of ratings performed and number of analyst staff) to ensure a mix of large, medium, and small firms were represented. At five of these firms, we held two separate focus groups—one with analysts and one with supervisory analysts (analyst staff with supervisory responsibilities). We contacted NRSROs to request data to identify and select a judgmental sample of analysts. To promote widespread NRSRO participation, we generally provided three options to NRSROs for identifying analysts for selection to participate in our focus group discussions: (1) provide a complete list of all analysts; (2) provide names of 25 analysts and 25 supervisory analysts; (3) identify and self-select approximately 8-12 analysts. Additionally, we requested that the NRSROs provide information on analysts’ years of service with the organization, credit rating specialization, geographic location. We tailored our requests to account for the number of analyst staff. For example, for the smaller NRSROs (60 or fewer analyst staff), we requested that they provide a complete list of all analysts. After receiving the information from NRSROs, we selected from 8 to 15 analysts to participate in the focus groups. (We allowed at least two analysts to serve as alternates, if necessary.) We selected credit rating analysts to obtain a range of years of experience, job title, and class of ratings for which they participated in credit rating determinations. We grouped each list by class of ratings and ordered the groups by years of experience. We verified the total number of analysts and supervisory analyst names provided, divided the total number by 15 to come up with a selection number (the “nth” number), and selected every nth name to participate in the focus groups. In addition, to ensure that every asset class represented had a participant in the focus group, where necessary, we selected alternates with similar titles, years of service, and credit rating specialization. We also selected fewer than 8-15 analysts at the smaller NRSROs. For example, one In one case, we slightly NRSRO had less than 10 supervisory analysts.adjusted our methodology to accommodate one NRSRO management’s request that they be able to select alternate analysts to participate in the focus groups, if alternates were needed. The management noted that they needed some flexibility in the event that any analysts we selected were unable to participate due to vacation, training, or other scheduling conflicts. In facilitating each focus group, we focused our discussions on the following topics: current training received and any certifications held by credit rating analysts; extent to which credit rating analysts currently have access to the services typically offered by a professional organization, such as education, professional standards and a code of ethical conduct for governing the profession, professional certification or license, oversight, and public education, outreach, or advocacy; extent to which there is a need for a professional organization for credit rating analysts and any potential challenges in operating an organization for analysts; potential advantages and disadvantages of creating a professional organization for credit rating analysts based on the three models we developed; and feasibility of developing and overseeing professional standards for credit rating analysts. Based on records of these discussions, we analyzed the content to define overall themes and develop our findings. We also used the results from the focus groups to corroborate information we obtained in our interviews on the merits and need for an independent professional organization for analysts; potential requirements for creating and operating a professional organization; associated challenges; and potential alternatives to creating a professional organization. These results led to our synopsis of the feasibility and merits of a professional organization for credit rating analysts. Throughout this report, we use certain qualifiers when describing results from focus groups and interview participants, such as “few,” “some,” and “most.” We define few as a small number such as two or three; some as at least four or more; and most as the majority or nearly all. While the information we collected from the focus groups provided context on the issues discussed, it was not generalizable to the entire population of credit rating analysts. We conducted this performance audit from October 2014 through July 2015, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. As part of our analysis for this report, we identified three models for professional organizations, profiled existing organizations, and reviewed how they delivered services (see app. I). In the following sections, we discuss three models for professional organizations and how membership, funding, regulatory role, and organizational authority is structured, operated, or obtained in each model; profile six professional organizations, which are the State Bar of California, Financial Industry Regulatory Authority (FINRA), Municipal Securities Rulemaking Board (MSRB), American Institute of Certified Public Accountants (AICPA), CFA Institute, and Institute of Internal Auditors (IIA); and discuss how the six organizations deliver education and other services to members. The models we identified vary in key aspects—whether membership is mandatory or voluntary, individual members or employers register and pay dues, government has a direct oversight role or not, and what the sources of authority or legitimacy are for the organization (see fig.3). Mandatory or voluntary membership. Under models I and II, all members of a profession must join in order to practice that profession. If a professional organization for credit rating analysts had mandatory membership, all credit rating analysts employed by NRSROs would be required to join. In model III, membership is voluntary and professionals who elect to join agree to meet any membership requirements, such as specific education or work experience. If a professional organization for credit rating analysts were voluntary, all credit rating analysts (including those analysts not employed by NRSROs) could join if they met the requirements. Individual or employer registration and funding of membership. Models I and III rely on individual members to register directly with the organization and pay dues. In model II, employers register the members and pay dues. For example, FINRA and MSRB use employer-based membership systems. Government role and source of authority. In models I and II, a regulatory or judicial body has a direct role in some aspects of the organization’s operations (for example, approving rules or overseeing supervisory actions). In these models, the organization receives its authority directly from government. In model III, government has no direct role, instead. The organization’s authority derives from public or industry recognition of the legitimacy of the organization’s activities. These profiles of the six organizations we reviewed further illustrate how the organizations function in practice and can provide insight about membership structures and requirements, funding sources, and any government oversight role. We obtained the information from publicly available documents (including financial reports and the organizations’ websites) and, where noted, from interviews with representatives of the organizations. We have not independently verified the information. The State Bar of California is charged with regulating the legal profession, formulating and elevating education and professional standards, raising the quality of legal services, advancing the science of jurisprudence, and aiding in the improvement of the administration of justice. Membership. Mandatory—the State Bar of California licenses attorneys to practice law in the State of California. As of April 2015, the State Bar reported it had approximately 253,000 licensees, of which more than 183,000 were active. Registration. To receive a license, individual attorneys must pass the California Bar Examination and pay their annual membership fees to the state bar. The 2015 membership fee was $430 for active members. Funding. The State Bar had $138 million in operating revenue in 2014, of which 60 percent came from membership fees and donations. Examination application fees, grants, and seminars provided additional funding. Government role. The State Bar is a public corporation within the judicial branch. The primary purpose of the State Bar is to serve as the administrative adjunct to the California Supreme Court in all matters pertaining to the admission, discipline, and regulation of California lawyers. Source of authority. The State Bar was created by the state legislature in 1927. FINRA is responsible for writing and enforcing rules governing the activities of broker-dealer firms and their registered individuals, including examining firms for compliance with those rules, fostering market transparency, and educating investors. Membership. Mandatory—all professionals associated with a broker- dealer (registered individuals) must register with FINRA.2015, FINRA reported more than 637,000 registered individuals. Registration. The broker-dealer firm registers the individual employee with FINRA and pays a $100 initial registration fee. The individual applicant applying for registration also must pass a qualifying test to ensure a minimum level of understanding of and expertise on financial markets, the securities industry, and regulatory structure. Firms also pay an annual fee of $175-$195 for each member. Funding. FINRA had total revenue in fiscal year 2014 of $970 million. Of this amount, 15 percent came from fees paid by broker-dealers based on the number of registered individuals employed by firms. The principal sources of revenue were regulatory activities and assessments, fines, contract services, and dispute resolution. Government role. The Securities and Exchange Commission (SEC) reviews and approves all of FINRA’s proposed rules and monitors and inspects FINRA’s regulatory activities. Source of authority. FINRA is a self-regulatory organization whose function as a national securities association was authorized under the Securities Exchange Act and approved by SEC in July 2007. MSRB is responsible for writing the rules that regulate the broker-dealers and municipal advisory firms that underwrite, sell, and trade municipal securities and provide municipal advisory services—with the goals of protecting investors and issuers and promoting a fair and efficient marketplace. MSRB also provides guidance to FINRA, SEC, and bank regulators in the oversight of compliance with MSRB rules. Membership. Mandatory—all professionals associated with municipal advisory firms must be registered with SEC and meet MSRB’s qualification requirements before engaging in any transaction. According to the MSRB, there were approximately 3,300 associated professionals in fiscal year 2014. Registration. Each municipal advisory firm pays a $300 annual membership fee for each associated professional and all the firm’s professionals must pass a qualification examination. Funding. MSRB had total revenue of $32 million in fiscal year 2014, less than 5 percent of which came from fees that municipal advisory firms paid for each associated professional. Principal sources of revenue include fees on transactions, underwriting, and technology. Government role. MSRB is required by statute to conduct rule- making in certain areas and SEC reviews and provides final approval of MSRB rules. Source of authority. MSRB is a congressionally chartered, self- regulatory organization subject to oversight by SEC. Its rules have the force and effect of federal law. AICPA represents the certified public accountant profession in relation to rule-making and standard-setting. It serves as an advocate before legislative bodies, public interest groups, and professional organizations; sets ethical standards for the profession; sets U.S. auditing standards for private companies, nonprofit organizations, and federal, state, and local governments; develops and grades the Uniform Certified Public Accountant Examination; and monitors and enforces compliance with technical and ethical standards. Membership. Voluntary—individuals who meet AICPA’s qualifications can apply for membership. In 2014, AICPA reported it had approximately 365,000 voting members. Registration. As a voting member, the applicant must pass the Uniform Certified Public Accountant Examination; obtain 150 semester hours of education at an accredited college or university; agree to abide by AICPA’s bylaws and code of professional conduct; obtain a valid and unrevoked certified public accountant certificate and, for applicants in public practice, be enroll in the AICPA Peer Review Program. In addition, members must pay annual dues. The regular membership fee for 2014-2015 ranged from $235 to $425, depending on the individual’s role and industry. Funding. AICPA had operating revenue of $235 million in fiscal year 2014. Membership dues generated approximately 53 percent of revenue. Conferences, publications, examination activities, and other sources provided additional revenue. Government role. According to a representative from AICPA, federal and state officials have no direct role in the organization, but participate in certain AICPA committees.disciplined members to state boards of accountancy for follow-up. In addition, AICPA refers Source of authority. The organization was founded in 1887. According to an AICPA representative, the organization derives its authority from transparent processes that engage many stakeholders (including members, government, and industry) to help develop professional standards and programs. The CFA Institute promotes ethical standards, education, and professional excellence for investment professionals (including financial analysts, investment managers, and securities analysts). It develops and administers examinations, encourages research and other educational programs in investment decision making, develops and enforces standards of professional conduct and a code of ethics, and raises public awareness of the principles and practices of investment decision making. Membership. Voluntary—individuals who meet the Institute’s qualifications can apply for membership. In 2014, CFA Institute reported it had approximately 120,000 regular members. Registration. Regular members must hold a bachelor’s degree from an accredited institution or have equivalent education or work experience, pass Level I of the CFA examination, have 48 months of appropriate professional work experience in investment decision making, provide professional references, agree to the Member’s Agreement and Professional Conduct Statement, and pay annual dues. The dues were $275 in 2015 for regular members. Funding. CFA Institute had $241 million in operating revenue in fiscal year 2014. Approximately 14 percent of revenue was generated primarily from membership dues, but also included advertising. Certification programs and conferences were the principle sources of revenue. Government role. According to CFA Institute representatives, regulators have no direct role in the organization. Source of authority. Financial analysts founded the Institute’s predecessor organization in 1947. According to CFA Institute representatives, the organization derives its authority from the recognition of the value of its education and certificate programs. IIA is the professional organization for internal auditors and provides professional education and development opportunities to its members, standards of practice, research on internal auditing, and advocacy and education about internal audit professionals and best practices in internal auditing. Membership. Voluntary—individuals who meet IIA’s qualifications can apply for membership. As of May 2015, IIA reported it had approximately 180,000 members, of which roughly 66,000 were based in the United States. Registration. Applicants agree to apply and uphold the code of ethics and applicable International Standards for the Professional Practice of Internal Auditing. Individual members pay annual dues that range from $125 to $265, depending on the member’s employer. Funding. In 2014, IIA and its related entities reported total revenue of approximately $50 million. IIA officials reported that membership dues generated approximately 27 percent of revenue. The certification process, seminars, and conferences generated additional funds. Government role. Government officials have no direct role in the organization. Source of authority. According to IIA representatives, the organization derives its authority from its membership’s oversight of the development and execution of internal processes to help ensure the quality and integrity of its activities and products, including its professional standards and code of conduct. The specific responsibilities of professional organizations may evolve over time, but their primary responsibilities generally encompass five areas: 1. educating members, which often includes promoting knowledge sharing among members and engaging in research related to the profession; 2. developing standards to govern the profession (including codes of 3. overseeing member compliance with the standards; 4. registering or providing certification or examination for members in the profession, or both; and 5. engaging in public education, outreach, or (in some cases) advocacy about the profession. According to representatives of the six organizations we reviewed, members’ priorities and needs, available funding, and other mandates help determine what services organizations provide and how they deliver the services. Education. The organizations offered a range of educational programs. All six offered training or educational opportunities through conferences, online or web-based courses, events, or lectures. For example, MSRB holds periodic education and training events to provide information on market topics, regulatory and compliance issues, and use of MSRB’s systems. Other organizations, such as CFA Institute, develop and administer a curriculum for their examination processes. Finally, as of May 2015, three organizations (AICPA, FINRA, and the State Bar of California) required members to receive a certain number of periodic continuing education hours to maintain membership. Standard development. All the organizations had or were establishing professional standards, in particular rules or requirements for ethical conduct. According to representatives of professional organizations, the organizations need to consider the extent to which they utilize principle- based standards—broad guidance about the behavior expected of members—rather than rule-based guidance that details specific requirements or prohibitions. According to one representative, the extent of the organization’s resources and information about members’ activities helps determine the type of standards it might adopt. For instance, members tend to ask for more detailed rules and guidance if they must undergo rigorous enforcement or inspections for their certifications or jobs. Principle-based standards may be more appropriate when organizations have limited resources and access to information on members. Finally, representatives of one organization noted that organizations also need to educate members about standards to help members understand the standards and implement them in challenging situations. Overseeing standards. Approaches for overseeing member compliance with professional standards varied depending on the authority provided to organizations. Organizations with mandatory membership that derived their authority from regulators or legislation tended to have robust examination and inspection processes. For instance, the State Bar of California reviews formal allegations of misconduct and determines any disciplinary actions. FINRA and MSRB engage in formal supervisory review of members.rely on voluntary compliance with the standards, such as periodic reaffirmation of compliance and voluntary reporting. Two voluntary organizations (AICPA and CFA Institute) have an additional investigative process that can be used when the organization receives specific complaints or regulators issue disciplinary actions against members. Organizations with voluntary membership tend to According to representatives of some voluntary organizations, staff or members can investigate alleged violations of standards and may recommend disciplinary actions or refer the case to government authorities. One representative of an organization noted that voluntary organizations could have trouble accessing information for investigations that members or their employers considered proprietary or confidential. Registering or certifying members. All six organizations have certain requirements for members—based on years or type of education or professional experience, agreement to adhere to standards or rules of professional conduct, or payment of annual dues. In addition, all the organizations offer a required or voluntary examination. For example, CFA Institute, FINRA, MSRB, and the State Bar of California require members to pass an examination to become a member. Other professional organizations, including IIA, offer members the opportunity to pass an examination to receive a voluntary credential. One organization, AICPA, did not register public accountants or certify them in the profession; however, it develops and administers the Uniform Certified Public Accountant Examination that most states require for licensing. Public education, outreach, or advocacy. The organizations have used differing approaches to communicating information with the public about the industries or professions. All six have public websites, make speakers available, or produce information to increase public awareness of their industries. AICPA, CFA Institute, and IIA also engage in advocacy to educate and influence key stakeholders, such as federal and state officials, about policies and issues that affect the profession. For example, CFA Institute publishes policy briefs and analysis on issues affecting investors, including corporate governance and market structure. In addition to the contact named above, Angela Nicole Clowers (Director), Debra Johnson (Assistant Director), Michelle Bowsky (analyst-in-charge), William R. Chatlos, Farrah Graham, Patricia MacWilliams, Patricia Moye, Barbara Roesmann, Bridgette Savino, and Jena Sinkfield made key contributions to this report. JoAnna Berry, James Dalkin, Joseph O’Neill, and Frank Todisco also contributed to this report.

Summary: The 2007–2009 financial crisis renewed concerns about the integrity of the credit rating industry. The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) imposed new requirements on NRSROs and required SEC to implement regulations for training, experience, and competence of credit rating analysts. The Dodd-Frank Act also included a provision for GAO to conduct a study on the merits and feasibility of creating a professional organization for rating analysts employed by NRSROs. This report describes views on (1) the potential merits of and need for a professional organization for credit rating analysts, and (2) any challenges associated with creating and operating such an organization. For this report, GAO reviewed SEC documentation and academic literature; held focus groups with approximately 100 credit rating analysts from different-sized firms who had a range of experience and skills; and interviewed SEC staff, representatives from all 10 NRSROs, and experts and stakeholders (including, academics, investors, advocacy groups, and international regulators). GAO also analyzed the structure and activities of six professional organizations that develop and oversee professional standards and a code of conduct, and interviewed representatives of the organizations. Views varied on the merits of a professional organization for credit rating analysts of nationally recognized statistical rating organizations (NRSRO), but some concluded it was too early to tell if one was needed, in part because of new Securities and Exchange Commission (SEC) requirements on NRSROs to establish standards for their analysts. The analysts, representatives of NRSROs and existing professional organizations, and experts and stakeholders (including academics, investors, advocacy groups, and international regulators) with whom GAO spoke said the merits of such an organization included improving the industry's reputation, enhancing the quality of work done by the professionals, and supplementing existing oversight. However, some said creating such an organization could duplicate existing standards, codes of conduct, or the services provided by other professional organizations. Some said that establishing a professional organization without evaluating the effectiveness of SEC's new regulations (which became effective in June 2015) would be premature. These rules require each NRSRO to establish training, experience, and competence standards to ensure analysts produce accurate ratings and to periodically test analysts' knowledge of the NRSRO's procedures and methodologies. Thus, some held the view that it was too early to determine in what areas a professional organization might add value—that is, add to or complement (rather than duplicate) standards, codes of conduct, training, or oversight—or if one was needed at all. Creating and operating a professional organization for NRSRO credit rating analysts would not be without certain challenges. According to most analysts and representatives of NRSROs and some experts and stakeholders, the challenges primarily would relate to achieving the following aims: Clearly delineated purpose . Delineating the mission or purposes of an organization would be difficult at the present time because the effects of the new SEC regulations were unknown. Adequate funding. Obtaining sufficient funding through membership fees also might be difficult because of the relatively small population of analysts (about 4,500 as of 2014) to provide the fees. Balanced representation. Creating an organizational structure that would provide equitable representation for all members, including from smaller NRSROs, could be challenging because of industry concentration (88 percent of analysts work for 3 of the 10 NRSROs). Meaningful activities. Developing core activities and services, including professional standards, education and training curricula, certification tests, and structures to oversee member compliance could be challenging because of differences in NRSRO methodologies, concerns about sharing confidential information, and analyst specialization in specific rating classes (such as insurance or asset-backed securities).