Created by Congress in 1934, SEC’s primary mission is to protect investors; maintain fair, honest, and efficient securities markets; and facilitate capital formation. To fund its operations, SEC collects fees that are deposited into a special SEC appropriations account to be used as offsetting collections. These fees are charged to (1) public companies for the registration of stocks and bonds for sale to investors, (2) national securities exchanges and national securities associations when registered securities and security futures are sold on or off exchanges through any member of such an association, and (3) persons filing proxy solicitations for mergers, consolidations, acquisitions, or sales of a public company’s assets. In carrying out its mission, the agency has established four major goals: (1) promote and enforce compliance with federal securities laws, (2) sustain a flexible and effective regulatory environment, (3) promote informed investment decision making, and (4) maximize its use of resources. SEC works to achieve these goals through its various divisions and offices. GAO has issued a number of reports and testimonies addressing SEC’s staffing and workload and certain aspects of its human capital and budget challenges. As of September 30, 2003, SEC had 3,208 staff working in four divisions and 18 offices in Washington, D.C., and in 11 regional and district offices. Of these, approximately 44 percent were attorneys, 22 percent were accountants or financial analysts, and 6 percent were investigators or examiners. The remaining 28 percent included other professional, technical, administrative, and clerical staff. SEC oversees the activities of a variety of key market participants. In 2003, SEC was responsible for overseeing 13 registered exchanges, the over-the- counter market, approximately 70 alternative trading systems, 11 registered clearing agencies, about 6,800 registered broker-dealers employing over 700,000 registered representatives, almost 8,000 transfer agents, over 5,000 investment companies, and approximately 8,000 registered investment advisers. In addition, over 17,000 companies that have issued securities filed annual reports with SEC. SEC’s oversight includes rule making, surveilling the markets, interpreting laws and regulations, reviewing corporate filings, processing applications, conducting inspections and examinations, and determining compliance with federal securities laws. In our previous reports on SEC, we found that SEC faced high staff turnover, ongoing vacancies, and increasing resource needs. Specifically, in our September 2001 report, we noted that over 1,000 employees, or about one-third of SEC staff, left the agency from fiscal years 1998 to 2000, and that 280 positions remained unfilled in September 2001. In our March 2002 report, we stated that since 1996, SEC’s staff resources had not grown commensurate with its workload. We noted that SEC tended to develop its annual budget request based on the previous year’s appropriation rather than on what it would actually need to fulfill its mission. The result was that the modest growth in staff resources in the 1990s at SEC was insufficient to manage its workload. In addition, we reported that additional funding was necessary to meet SEC’s IT needs. Like the rest of the government, SEC’s challenges in the area of IT continue to increase, and SEC staff must have the necessary tools to successfully meet the agency’s increasing demands. Changes in the securities markets contributed to the increase in SEC’s workload. U.S. capital markets have experienced substantial growth in the last two decades. The increased volume of shares traded in the U.S. stock market in this period and an array of new products and market participants have led to increasing demands on SEC’s regulatory capacity. The 1990s also witnessed tremendous growth in the internationalization of the U.S. securities market. In addition, many more individuals became investors in the U.S. stock market through buying shares in mutual funds. This further elevated SEC’s importance as a regulator. SEC’s staff issues and a series of corporate failures and accounting scandals, including the bankruptcies of Enron in December 2001 and WorldCom in July 2002, caught Congress’s attention and raised significant concern about SEC’s ability to effectively carry out its mission. Congress recognized SEC’s challenges and enacted a number of legislative changes to address them, including the Investor and Capital Markets Fee Relief Act, which rationalized SEC’s fee structure and exempted SEC from general federal pay restrictions and provided the agency with pay parity—the authority necessary to bring salaries in line with those of other federal financial regulators. Sarbanes-Oxley, which authorized appropriations of $776 million to the agency in the fiscal year 2003 budget. SEC increased its initial fiscal year 2003 budget request of $466 million to $769 million in part because of the level authorized in Sarbanes-Oxley. The Consolidated Appropriations Resolution, 2003, in which Congress appropriated $716 million to the agency for fiscal year 2003, directed the additional funding to be used in certain areas. First, it directed SEC to fund pay parity, which at that time had not yet been fully implemented. Sarbanes-Oxley also directed that the new funding be used to fund information technology, security enhancements, and recovery and mitigation activities in light of the terrorist attacks of September 11, 2001. In addition, SEC was directed to fund no fewer than 200 additional professional staff positions to strengthen existing program areas, and to increase its oversight of auditors and audit services. Figure 1 shows the change in SEC’s budget between fiscal years 2002 and 2004. the Accountant, Compliance and Enforcement Staffing Act of 2003, which provided SEC with relief from competitive hiring requirements for certain positions. The legislation was intended to enable SEC to expedite the hiring of accountants, economists, and examiners so that the agency could more quickly fill new positions, including those created after Sarbanes- Oxley. SEC used much of its fiscal year 2003 increased appropriations to fund over 842 new staff positions. SEC’s financial disclosure, enforcement, and examinations areas received most of the newly funded positions. Among the divisions receiving the largest increases were the Divisions of Enforcement, Corporation Finance, and the Office of the Chief Accountant (OCA), which received double-digit increases to their budgets in 2003 and are expected to receive even greater increases in 2004. In addition, SEC used part of its fiscal year 2003 appropriations to fund pay parity for existing staff, which gave the agency additional flexibility to recruit and retain staff. However, many of these newly funded positions remain unfilled because SEC continues to face hiring challenges for certain positions. Officials say that while certain laws have helped speed up the hiring process, they are facing increased competition from the private sector. SEC used its increased appropriations between 2002 and 2004 in its financial disclosure, enforcement, and examination areas primarily to fund new positions. As shown in table 1, the offices and divisions showing the largest increases in spending between 2002 and 2003 were the Divisions of Enforcement and Corporation Finance, regional offices, OCA, and IT. Between 2003 and 2004, the areas expected to receive the largest increases in spending are OCA, the Divisions of Corporation Finance and Enforcement, regional offices, IT, and the Office of Compliance Inspections and Examinations (OCIE). As we reported in July 2003, SEC made its allocation decisions without the benefit of an updated strategic plan. In lieu of using an updated strategic plan, it appears that a special study of SEC operations has provided a basis for SEC in determining the need for 842 new positions in 2003. In 2002 the former Chairman directed SEC staff to conduct an internal study of SEC’s current operations, workload, resource allocations, methods for assigning and managing work, and measures of performance, productivity, and quality of effort. Soon after the current Chairman joined SEC in February 2003, he asked that the division and office heads prepare analyses to justify their staffing requests. This included the total number of staff needed to accomplish each division/office’s objectives, the organizational changes needed to accommodate the new staff being requested, and a breakdown of the types of staff being requested by profession. In addition, an SEC official said that the Chairman ultimately approved each division’s and office’s justification to arrive at the final allocation for the 842 new positions. Table 2 shows SEC’s final allocation of the 842 new positions among divisions/offices. SEC’s staff allocations appear generally consistent with legislative expectations and what is known about SEC’s current operating environment. However, because SEC’s staff positions were allocated without the benefit of an updated strategic plan, it will be difficult for SEC to assess the appropriateness or effectiveness of the use of its much larger budget. Since 2002 we have reported that although SEC had a strategic plan and had periodically adjusted staffing to fulfill basic obligations, the agency traditionally had not engaged in a systematic re-evaluation of its programs and activities in light of current and emerging challenges. We further noted that with a current strategic plan that identifies the agency’s key mission-related goals and outlines the agency’s priorities, SEC could better determine and deploy resources needed to fulfill its mission. In response to our concerns and the significant budget increase in fiscal year 2003, the current SEC chairman instructed SEC staff to draft a new strategic plan. SEC’s new strategic plan was approved by the commission on July 9, 2004. SEC plans to use the majority of its additional staff resources within the Division of Corporation Finance, OCA, Division of Enforcement, and OCIE in order to enhance its regulatory and oversight activities. Between 2002 and 2003, Corporation Finance and OCA’s spending increased 17 percent and 25 percent, respectively, and planned spending is expected to increase by 39 percent and 55 percent in 2004. Both Corporation Finance and OCA administer SEC’s full disclosure program. These programs are responsible for ensuring that investors are provided with material information from reporting public companies. They also help to deter fraud and misrepresentation in public offerings, trading, voting, and tendering of securities. As shown in table 2, Corporation Finance, which is responsible for reviewing corporate disclosures of public companies such as initial stock offerings and quarterly financial statements in order to monitor and enhance compliance with disclosure and accounting requirements, received funding for 175 new accountants and attorneys. This increase in the number of staff was due primarily to a Sarbanes-Oxley requirement for SEC to conduct reviews of reporting public companies once every three years or approximately one-third of all reporting public companies per year. According to budget estimate documents, SEC was able to review only 23 percent of all reporting issuers in 2003, thus falling short of its mandated goal of 33 percent. OCA received funding for 20 new positions. OCA is responsible for establishing and enforcing accounting and auditing policy in order to enhance transparency, relevance, and reliability of financial reporting and to improve the professional performance of public company auditors. According to an SEC official, these new positions would assist with OCA’s increased responsibility to oversee activities associated with the newly created Public Company Accounting Oversight Board, which is expected to be heavily involved in the quality review process and development and interpretation of auditing standards, among other things. Division of Enforcement spending increased 22 percent in 2003 and is projected to increase an additional 26 percent in 2004. The division analyzes information from diverse sources that may indicate past or immediate violations of federal securities laws, investigates possible violations of federal securities laws, recommends SEC action when appropriate in federal court or before an administrative law judge, and negotiates settlements on behalf of SEC. Of the SEC’s 842 new positions, the division was authorized to hire 83 staff in Washington, D.C., and 111 positions in SEC’s regional and district offices. According to SEC budget documentation, staffing will increase in the division by approximately 19 percent over 2003 levels in order to help implement Sarbanes-Oxley. The additional positions will add to the program’s accounting and litigation efforts, as well as investigative and surveillance activities. Division of Enforcement officials told us that the division has reorganized staff in its Office of Chief Counsel by functional lines rather than by geographical location. The functional lines include investment adviser and mutual funds, broker-dealers and markets, and corporate accounting. The intent of this reorganization is to increase the staff’s subject matter expertise and better detect emerging issues. Between 2003 and 2004 OCIE’s spending is expected to increase by 47 percent. OCIE is responsible for administering SEC’s nationwide examination and inspection program for self-regulatory organizations, broker-dealers, transfer agents, investment companies, and investment advisers. Similar to the Division of Enforcement, OCIE staff is primarily located in Washington, D.C., and SEC’s 11 regional and district offices. OCIE was allocated 42 new positions for Washington, D.C., and approximately 233 new positions among SEC’s 11 regional and district offices, for a total of 275 new positions. According to information provided by SEC, the additional staff would allow SEC to implement a new risk- based inspection program of the riskiest investment advisers and to allow SEC to have more frequent oversight of internal controls of large broker- dealers, a greater on-site presence, and more frequent inspections of self- regulatory organization surveillance and disciplinary systems. In addition to funding new positions, SEC used part of its increased appropriations to fund pay parity. Sarbanes-Oxley authorized $102.7 million for increases associated with pay parity. However, SEC officials said they could not provide the specific amounts that were allocated to fund pay parity in 2003 for two reasons. First, in May 2002, acting on its new compensation authority, SEC implemented a new system that established a pay structure more comparable with other federal financial regulators. This new pay structure increased base pay for attorneys, accountants, and examiners to levels similar to those of other federal financial services regulators. More specifically, the structure of this new system consists of 20 grade levels, some with 31 steps. This new system has also provided additional compensation based on performance and has established new pay categories to compensate staff in supervisory positions. Second, a large number of employees came on board in 2003 under the new pay structure that had already incorporated pay parity. As a result, SEC officials said it would be difficult to segregate the funding amounts associated with the new pay structure and salaries for new employees from the actual amounts used to fund pay parity. SEC continues to face agencywide challenges in hiring and retaining sufficient numbers of quality staff to achieve its mission. As shown in table 3, between September 2003 and March 2004, SEC filled 328 of 782 vacancies, which amounted to a 42 percent decrease in the number of vacancies within that time. The regional/district offices made the most progress in hiring, decreasing their vacancies 72 percent by filling 210 out of 294 vacant positions. The Division of Corporation Finance appears to face the most difficulty in filling its vacancies, filling only 56 out of the 193 vacant positions between September 2003 and March 2004. According to an SEC official, Corporation Finance has continued to focus on its hiring efforts and as of March 31, 2004, the division had 41 pending hires scheduled to come on board by August 2004, of which 29 were accountants and the remaining 12 were attorneys. Further, the official said the division’s goal is to hire as many qualified certified public accountants as soon as possible, with a goal of having 250 accountants within the division. The remaining staff will be attorneys and legal staff for support in providing information to the public, and other functions not requiring an attorney. As we reported in July 2003, SEC was able to expedite hiring under the Accountant, Compliance and Enforcement Staffing Act of 2003. SEC staff told us that bypassing competitive processes has helped them hire individuals for accountant, compliance examiner, and economist positions more quickly. However, officials in the Corporation Finance, Investment Management, and Enforcement divisions said they still face considerable difficulty in hiring accountants. This is due to competition from the private sector—resulting from public companies needing to comply with Sarbanes-Oxley requirements—as well as from competition with the Public Company Accounting Oversight Board. An official from the Division of Corporation Finance told us that they had retained the services of a national recruiting firm in order to recruit accountants. In addition, SEC officials explained that operating under a continuing resolution in fiscal year 2003 and the timing of SEC’s new hiring authority did not allow much time for recruiting activities before the end of the year. Given the late appropriation and hiring challenges in 2003, SEC had difficulties filling its new positions and was unable to spend $120 million of its increased appropriations during 2003. In the fiscal year 2004 appropriations act, this unobligated balance was appropriated to SEC for use in 2004. Similarly, SEC budget documents reported that $20 million would carry over from 2004 into the 2005 budget. According to an SEC official, the $20 million carryover included in the 2005 budget represents 106 new positions requested for 2005, in anticipation of bringing those new employees on board in 2005 or subsequent years. As of June 2004, SEC has yet to staff its new Office of Global Security Risk. In the Conference Report on the 2004 appropriations legislation, SEC was directed to establish an Office of Global Security Risk within the Division of Corporation Finance. This was due in part to concerns that American investors may be unknowingly investing in companies with ties to countries that sponsor terrorism and countries linked to human rights violations. According to language in the Conference Report, a company’s association with sponsors of terrorism and human rights abuses, no matter how large or small, can have a material adverse effect on a public company’s operations, financial condition, earnings, and stock prices. As a means of protecting American investors’ savings and to disclose these business relationships to investors, this office is required, among other things, to (1) establish a process by which the SEC identifies all companies on U.S. exchanges operating in State Department-designated terrorist- sponsoring states, (2) ensure that all companies sold on U.S. exchanges operating in State Department-designated terrorist-sponsoring states are disclosing such activities to investors, and (3) coordinate with other government agencies to ensure the sharing of relevant information across the federal government. In addition, SEC was directed to provide Congress with quarterly reports on the activities of the Office of Global Security Risk. According to an SEC official, in May 2004 SEC filled the Chief position for the office. The next steps will be for the Chief to begin the process of developing plans for the office, including staffing needs. According to SEC, it plans to provide its first report to the Subcommittee on Commerce, Justice, State, the Judiciary, and Related Agencies, House Committee on Appropriations, by late July. Sarbanes-Oxley directed SEC to provide additional funding for IT in 2003, with the general goal of improving operational efficiency. SEC continued to use most of the additional funding to address hardware and software maintenance and technology infrastructure needs. The remaining portion of the agency’s IT resources was used to fund new mission-related initiatives. With regard to SEC’s decision-making process for IT capital investment, SEC’s OIG has recently issued a report stating that while SEC has made progress in establishing an IT investment process that complies with applicable laws and regulations, and incorporates best practices from the public and private sectors, the process is not in full compliance with applicable laws and regulations. Further, the OIG report pointed out that SEC has not finalized its IT strategic plan. We reported in March 2002 that SEC’s IT systems and funding gaps were contributing to inefficiencies at the agency. SEC officials at the time stated that SEC’s 2002 IT budget of $46.6 million had been used primarily for hardware and software maintenance and technology infrastructure needs, and that additional funding was needed for capital improvements such as a nationwide network to support the examination and inspection functions. Similarly, in 2004 officials said they needed to spend most of the funding to upgrade SEC’s IT infrastructure to support new mission-related IT programs. Sarbanes-Oxley highlighted the importance of improving SEC’s technological capabilities by authorizing SEC to increase its IT budget. As a result, SEC’s 2003 IT budget was increased by over 100 percent, to $100.9 million. In 2004, SEC’s IT budget was increased again to $120.5 million, or another 20 percent. SEC’s IT budget is under the purview of both its Office of Information Technology (OIT) and a separate council of senior staff from the major program divisions and offices. OIT is responsible for managing costs associated with ongoing operations and maintenance, application and infrastructure upgrades, and enhancements to existing systems. SEC’s Information Officers Council (IOC) and the Information Technology Capital Planning Committee (ITCPC) manage the remainder of its IT budget, which consists of new technology initiatives requested by SEC’s program offices. With a significant increase in its IT budget, SEC continues to allocate the majority of these resources to fund hardware and software maintenance and infrastructure needs. As shown in figure 2, in 2003, about 76 percent, or $68.2 million, of SEC’s IT budget went to hardware and software maintenance and infrastructure needs, and a planned 70 percent, or $84.1 million, is budgeted for the same needs in 2004. Approximately 24 percent, or $21.4 million, of SEC’s IT budget in 2003 was used to fund new IT initiativesprojects that have the potential to improve the efficiency of SEC’s operationsand a planned 30 percent, or $36.4 million, is planned for 2004. In addition, figure 2 also shows that while most of the funding for new technology initiatives went to mission officessuch as the Division of Enforcement and OCIE—a notable amount of funding also went to mission-support offices, such as the Office of Economic Analysis and the Office of Filings and Information Services. Specifically, in 2003 approximately $14 million went to fund projects in mission offices, and $7.3 million was used to fund projects in mission-support offices. Of the $21.4 million of SEC’s IT budget allocated to new technology initiatives in 2003, SEC funded 40 separate IT projects. As of May 2004, SEC is scheduled to fund six additional IT projects. A number of these new initiatives provide for the electronic filing of reports, documents, and information, which had previously been paper-based. For example, one project provides for the electronic filing of ownership reports through the EDGAR (Electronic Data Gathering Analysis and Retrieval) system, a specific requirement of Sarbanes-Oxley. Other projects provide for the electronic filing of materials from transfer agents, self-regulatory organizations, alternative trading systems, and broker-dealers. In addition, some of the projects are designed to improve SEC’s ability to review and analyze large amounts of data. For example, one project would establish an improved framework for the gathering, formatting, and analyzing of information collected by OCIE. Currently, the gathering and analysis of information in OCIE is burdened by data collection in a variety of formats. This makes it difficult and time consuming to combine the data sets into one in order to conduct analysis. In addition, SEC continued to fund a number of its multiyear IT initiatives, including Electronic Document Management System. Officials stated that the document management and imaging initiative is currently being piloted in Division of Enforcement offices in Washington, D.C., Boston, Philadelphia, New York, and Chicago and that electronic imaging has been completed for approximately 50 percent of all documents in Washington and 25 percent of all documents in New York. They stated that for the remaining pilot offices, documents would continue to be reviewed to determine what should be imaged. The officials noted that the pilot should be completed by the early fall of 2004. EDGAR Modernization. SEC has taken a first step toward making EDGAR a database with more analytical capabilities for end users. SEC officials stated that within the last year, SEC established the capability for EDGAR to accept certain data from users in a structured format. According to SEC officials, SEC’s Chairman established a task force to look into data tagging, which would allow users to retrieve information from EDGAR in order to conduct trend analysis. The task force is expected to report by the end of July 2004 on how to proceed. Disaster Recovery. SEC officials stated they have made progress in addressing business continuity planning efforts related to disaster recovery. Officials stated they have established alternative data centers and continuity planning sites, have upgraded the network to prevent the possibility of a single point of failure in the network, and are currently building a facility to allow senior staff to move off site in the event of a disaster. Telecommuting. SEC officials stated that SEC’s capacity for telecommuting continues to improve across the agency. These officials stated that due to improved dial-up and wireless connection access, SEC employees’ remote access to certain software applications has improved with the deployment of new laptops in the Division of Enforcement offices. In the summer of 2001, SEC began revising its IT capital investment decision-making process. The revisions were based on recommendations in an audit report issued by SEC’s OIG in August 2001 that reviewed SEC’s IT capital investment decision-making process in order to improve communication between OIT and SEC staff. Beginning in 2002, SEC developed a new decision-making process for IT investments, with SEC’s IOC and ITCPC responsible for managing the portion of SEC’s IT budget related to new technology initiatives. Specifically, IOC, which includes program office senior staff familiar with both the business and IT needs within their programs, receives and evaluates specific IT investment proposals submitted by SEC’s divisions and program offices. Based on their review, IOC makes recommendations regarding which projects should be approved for funding. These recommendations are forwarded to ITCPC, a more senior council of division directors and program office heads, for final funding decisions. Although SEC has taken steps to develop a formal decision-making process for IT investments, in a 2004 follow-up report, OIG raised concerns about the current state of this process. According to the OIG report, OIG evaluated SEC’s compliance with the Clinger-Cohen Act of 1996 (CCA) by applying GAO’s IT Investment Management Framework for Assessing and Improving Process Maturity (IT IM Maturity Model). In general, GAO’s framework includes standards for the selection, control, and evaluation of federal information technology investments, in accordance with the fundamental IT governance mandates of the CCA. OIG found that SEC has made progress in establishing an IT investment process that complies with applicable laws and regulations and incorporates best practices from the public and private sectors. However, OIG also identified some concerns. For example, OIG found that SEC’s process still did not meet the minimum criteria of GAO’s IT IM Maturity Model because SEC had not assigned specific responsibility or delegated appropriate authority for establishing a compliant and effective decision- making process in order to strengthen the governance over the process. Based on this review, OIG concluded, and we generally agree, that the lack of clearly defined and formally approved IT governance policies, criteria, and procedures resulted in an undisciplined IT investment decision- making process subject to broad interpretation by SEC management, which lacked auditable and enforceable standards and controls. OIG made a number of recommendations to address SEC’s IT investment decision-making governance issues, including (1) the development of a work plan for implementing the OIG’s recommendations; (2) formalizing charters, roles, and responsibilities for the Chief Information Officer (CIO), IOC, ITCPC, and other relevant IT governance bodies, including delegating to the CIO sufficient authority to effectively administer, control, implement, and enforce the IT capital planning responsibilities; (3) revising the project funding process and associated investment thresholds and criteria; (4) improving the strategic planning for IT investments, which includes finalizing an IT specific strategic plan that establishes the strategic direction for IT capital planning and tactical operations within SEC and establishing a single agencywide IT control process and structure for the entire IT budget to select, prioritize, and fund all IT investments to be managed by IOC and ITCPC; (5) linking IT project planning with SEC’s enterprise architecture; (6) improving the tracking of IT projects in progress; and (7) supporting IOC and ITCPC with adequate staff. SEC has taken steps to implement some of the recommendations contained in the OIG’s report. According to SEC officials, staff are in the process of formalizing the charters, roles, and responsibilities for the CIO, IOC, ITCPC, and other relevant governance bodies by reviewing the pertinent legislation, Office of Management and Budget requirements, and other relevant guidance. Further, the SEC Chairman recently delegated to the CIO the necessary authority to issue and enforce agencywide IT policy and regulations, and to implement the recommendations in the OIG report. In addition, SEC officials stated that starting with the 2004 IT budget, SEC will establish a single agencywide IT control process and structure for the entire IT budget, managed by IOC and ITCPC, to select, prioritize, and fund all IT investments. SEC officials have articulated a preliminary plan to respond to the remaining OIG recommendations. SEC officials stated that their ability to respond to the OIG’s recommendation depends on how quickly they can hire the staff responsible for managing the capital planning process. Most importantly, the Senior Program Manager position for the project management/capital planning groupwho will be responsible for seeing that the OIG’s recommendations are responded tois currently vacant. Therefore, officials stated that they would most likely be able to address 25 percent to 33 percent of the OIG’s recommendations by the end of fiscal year 2004. Since Congress increased SEC’s budget to improve the agency’s oversight of financial markets in fiscal year 2003, SEC has made significant progress in hiring staff and is continuing its efforts to fill the remaining vacancies. The number of vacancies appears reasonable, given that SEC had to contend with competition from the private sector and a continuing resolution that limited the time SEC had for recruiting. SEC has also taken steps to improve its information technology by using the increased funding to augment its budget for technologyand, in turn, upgrade its infrastructureand by continuing to address the OIG’s concerns about the agency’s decision-making process on IT spending. Although SEC’s staff allocations appear to be consistent with Sarbanes-Oxley, these allocations were made without the benefit of a strategic plan. As we have previously noted and the SEC Chairman has agreed, a comprehensive strategic plan could provide SEC management with a basis for determining whether SEC’s resource level and allocations, as well as its processes and organizational structure, are tied to the mission and goals of the agency. Subsequently, SEC completed updating its strategic plan on July 9, 2004. SEC provided written comments on a draft of this report that are reprinted in appendix II. SEC commented that while more work remains, our review of SEC activities acknowledged the progress the agency has made within a constrained time frame. As discussed in its letter, the SEC has taken a number of actions to address some of the issues raised in our report. First, since March, SEC has made additional progress hiring about 130 new employees, and approximately 130 others have committed to start with SEC before the end of the fiscal year. SEC anticipates that by the end of the fiscal year, it will be able to reduce the vacancy level to its normal attrition. Second, we are pleased that the Commission has recently approved the agency’s strategic plan for fiscal years 2004-2009. This strategic plan could serve as a basis to guide SEC in using its additional resources effectively and for its congressional overseers to evaluate SEC’s progress in fulfilling its mission and meeting its goals. We look forward to reviewing and commenting on this updated strategic plan as part of our ongoing review of SEC’s operations. Third, SEC noted that in the past few months, it has imaged, and made available electronically, investigatory materials formerly available only in paper throughout headquarters and regional and district offices. SEC also acknowledged it is “keenly aware” of the need to respond promptly and comprehensively to concerns raised by the SEC OIG and GAO and to ensure that its IT resources are used wisely and effectively. We continue to believe that leveraging information technology will effectively support SEC’s activities, and we are encouraged by the agency’s ongoing efforts. Finally, SEC reiterated the steps it has taken in launching the Office of Global Security Risk. SEC noted that it plans to provide the first quarterly report to the Subcommittee on Commerce, Justice, State, the Judiciary, and Related Agencies, House Committee on Appropriations, by late July. SEC officials also provided us with some technical comments, which we incorporated as appropriate. We are sending copies of this report to the Chairman and Ranking Minority Member of the Senate Committee on Governmental Affairs; the Chairman and Ranking Minority Member of the House Committee on Government Reform; and the Chairman and Ranking Minority Member of the Subcommittee on Government Efficiency and Financial Management, House Committee on Government Reform. We are also sending copies to the Chairman of SEC and will make copies available to others upon request. The report is also available at no charge on the GAO Web site at http://www.gao.gov. Please contact me or Karen C. Tremba at (202) 512-8678 if you or your staff have any questions concerning this report. Toayoa D. Aldridge, James Lawrence, David Pittman, and Marc Molino made key contributions to this report. To describe budget and staff allocations, we collected budgetary data for the major Securities and Exchange Commission (SEC) divisions and offices from SEC’s Office of the Controller and staffing data for the major offices and divisions from the SEC payroll system. We also obtained information from SEC’s annual budget request and internal memos regarding staff allocations. We interviewed Office of the Executive Director officials to obtain information on SEC’s process for distributing positions and corroborated this information using existing GAO work, including interviews with officials from various SEC divisions and offices. We performed limited data reliability testing of SEC budget data by interviewing knowledgeable agency budget officials and comparing the data with other published budget data. Based on this analysis, we determined that the data were sufficiently reliable for the purpose of this report. To describe SEC’s allocation of funding for information technology (IT), we analyzed documents from the Information Officers Council/Information Technology Capital Planning Committee (IOC/ITCPC) proceedings. The various documents included project requests from program offices, meeting minutes, project approval memoranda (including funding amounts), and Office of Information Technology (OIT) budget documents. We verified IOC/ITCPC information by interviewing OIT officials in order to corroborate our findings. We relied on SEC’s Office of Inspector General (OIG) to describe the process for making IT investments and the related problems identified within this process. In addition, we reviewed the SEC OIG’s evaluation of SEC’s IT capital investment decision-making process using GAO’s IT Investment Management Framework. We also relied on previous GAO work on SEC’s IT systems. We conducted our work from February 2004 to July 2004 in accordance with generally accepted government auditing standards.

Summary: This report responds to a statement in the Conference Report on the Securities and Exchange Commission's (SEC) fiscal year 2004 appropriations directing GAO to study SEC's allocation of its increased funding for fiscal years 2003 and 2004. Historically, SEC has faced high staff turnover rates, long stretches of unfilled staff positions, and growing resource needs. Additionally, the agency has faced significant needs in its information technology area. In response to these trends and several high-profile corporate failures and financial scandals, Congress approved significant increases in SEC's appropriations to help improve oversight and increase public confidence in financial markets. This report builds on several reports GAO has issued on these issues. GAO was asked to review SEC's (1) allocation of its fiscal year 2003 and 2004 funds and (2) use of its information technology funding in fiscal year 2003 and its plan for 2004. Congress addressed SEC's human capital and workload challenges with a significant increase to SEC's appropriations for fiscal year 2003. SEC used over half of that increase to fund over 800 new positions primarily within its financial disclosure, enforcement, and examination areas. Although these allocations appear consistent with legislative directions, they were made without the benefit of an updated agencywide strategic plan, which was not approved until July 9, 2004. Although SEC received more flexible pay and hiring authority, SEC continues to face challenges filling critical vacancies, such as accountants. Officials cite competition from the private sector as a major factor. SEC's information technology (IT) budget increased from $46.6 million in fiscal year 2002 to over $100 million in fiscal year 2003. It increased another 20 percent to $120 million in fiscal year 2004. SEC used most of these large increases for maintenance and infrastructure needs, compared with new technology initiatives. Also, SEC's Office of Inspector General (OIG) issued a report detailing its concerns, which we share, about the decision-making process for IT capital investments. OIG made several recommendations to improve this process, and SEC staff have begun to take actions to address some of them. SEC commented that our review of its activities acknowledged the progress the agency has made and provided additional information about its activities since March.