SEC is an independent agency created in 1934 to protect investors; maintain fair, honest, and efficient securities markets; and facilitate capital formation. SEC has a five-member Commission that comprises the Chairman and four commissioners, who are appointed by the President and confirmed by the Senate. The Commission oversees SEC’s operations and provides final approval of SEC’s interpretation of federal securities laws, proposals of new or amended rules to govern securities markets, and enforcement activities. To accomplish its mission, SEC has established four strategic goals: (1) enforce compliance with federal securities laws, (2) promote healthy capital markets through an effective and flexible regulatory environment, (3) foster informed investment decision-making, and (4) maximize the use of SEC resources. Enforcement and the agency’s Office of Compliance Inspections and Examinations (OCIE) share responsibility for implementing SEC’s compliance goal. According to SEC’s 2008 Annual Report, in fiscal year 2008, more than half of SEC’s resources—a total of 2,340 full-time equivalent positions, and more than $595 million—were dedicated to programs to enforce securities laws. In 2002, Congress passed the Sarbanes-Oxley Act of 2002 (Sarbanes- Oxley), following high-profile corporate failures and accounting scandals, and in response to resulting demands that public companies be held more accountable for information reported to investors. The act, which addressed concerns involving corporate governance, auditor independence, and regulation and oversight of the accounting profession, also provided additional resources to SEC. Subsequently, Congress appropriated $716 million for SEC in fiscal year 2003, an increase of 45 percent over its fiscal year 2002 budget. SEC was directed to use this increase both to add personnel and acquire new information technology to increase its effectiveness. Enforcement staff conduct investigations through informal inquiry, interviewing witnesses, examining brokerage records, reviewing trading data, and other methods. At the request of Enforcement staff, the Commission may issue a “formal order of investigation,” which allows the division’s staff to compel witnesses by subpoena to testify and produce books, records, and other documents. Following an investigation, SEC staff present their findings to the Commission for its review, recommending Commission action either in a federal court or before an administrative law judge. On finding that a defendant has violated securities laws, the court or the administrative law judge can issue a judgment ordering remedies, such as civil monetary penalties and disgorgement. In many cases, the Commission and the party charged decide to settle a matter without trial. In these instances, Enforcement staff negotiates settlements on behalf of the Commission. Each year, Enforcement brings hundreds of civil enforcement actions against individuals and companies accused of violating securities laws. The mix and types of actions vary from year to year, based upon market conditions and changes in financial instruments being used. In general, violations could include financial and accounting fraud, insider trading, market manipulation, providing false or misleading information about securities and the companies that issue them, selling securities without proper registration, and violating the broker-dealer responsibility to treat customers fairly. Enforcement personnel are located in SEC’s headquarters in Washington, D.C., and the agency’s 11 regional offices. Enforcement staff located in headquarters include the director and two deputy directors, five investigative groups, or Offices of Associate Directors, and internal support groups (Office of Chief Counsel, Office of Chief Accountant, the trial unit, Office of Collections and Distributions, market surveillance, and Office of Internet Enforcement). An associate director heads each Office of Associate Director and has one or more assistant directors. Branch chiefs report to assistant directors and supervise the work of investigative attorneys assigned to individual investigations, with review and support provided by division management. SEC regional office staff typically are divided between Enforcement and OCIE personnel. Enforcement units in the regional offices have Office of Associate Director structures similar to those in headquarters and report to the Director of Enforcement in Washington, D.C. In 2007, we made four recommendations designed to strengthen Enforcement’s management of its operations, which focused on: Establishing written procedures for reviewing and approving new investigations. We said that establishing such guidance would help focus the review of investigations, reinforce the consistency of those reviews, and assist in communicating new policies to the staff. Establishing written procedures for entering data into the new investigation management information system called the Hub, and establishing a control process for assessing reliability of data in the system. We said that without written guidance and establishment of independent and regular reviews of the accuracy of Hub data, Enforcement was not well-positioned to get reliable program information, and that the system’s capacity to aid management of the investigation process might be limited. Closing inactive investigations. We said that leaving investigations open indefinitely compromises management’s ability to effectively manage its portfolio of cases, and has potentially negative consequences for individuals and companies that are no longer under investigation. Improving management of the Fair Funds program. We noted that because SEC had not yet staffed or defined the roles and responsibilities of a new office being established to administer the Fair Fund program, it was not possible to determine the extent to which the office may better facilitate the distribution of funds to investors harmed by securities fraud and other violations. We also said that in the meantime, the division had not taken other steps to allow it to develop a better perspective on reasonableness of Fair Fund program expenses. SEC has implemented several aspects of these recommendations, but more work is needed for full implementation of the recommendation on the Fair Funds program as it relates to the organizational structure of the new Office of Collections and Distributions. In 2007, we reported that under a largely decentralized approach for approving new investigations, Enforcement was not always able to ensure efficient resource allocation or maintain quality control in the investigative process. Enforcement has now developed written procedures for review and approval of new investigations, which are included in a recently completed enforcement manual. The procedures address various steps in the investigative process, such as handling tips, referrals, and complaints; opening a Matter Under Inquiry, which can be a preliminary step toward opening a full investigation; and opening a full investigation. According to the procedures, the primary consideration for opening an investigation should be whether the inquiry has the potential to substantively and effectively address the potentially improper conduct at issue. Other key factors are the magnitude or nature of the violation, the size of the victim group, and the amount of potential or actual losses to investors. In 2007, we reported that Enforcement planned to start using the Hub system by late in the year. An initial phase of the Hub was planned to provide an ability to interact with the division’s system for tracking Matters Under Inquiry, investigations, and enforcement actions—the Case Activity Tracking System (CATS)—which contains information on these actions. In a second phase, SEC planned to replace CATS and expected the project to be completed in fiscal year 2009. Enforcement management reports that the initial phase is complete. The Hub, as currently implemented, is an interface into CATS, and is intended to provide a management information tool for viewing information stored in CATS. The need arises because CATS was designed to be an information repository, not a system for querying and displaying data. Using the Hub, Enforcement staff can now generate various reports on enforcement activity. For example, the Hub can produce a report of an investigative attorney’s roster of current cases, containing items such as general case information, status, or other case information. Other reports allow queries by case type, and searching for cases by time period. In response to our recommendation that Enforcement provide guidance on the use of the Hub, the division has developed a user manual, and Enforcement management said that staff have had access to training and various demonstrations of the Hub’s capabilities. In connection with the Hub guidance, we recommended that the then- Chairman direct Enforcement to establish a control process for assessing the reliability of data in the Hub system. To the extent that the Hub relies on CATS information, there are already some processes for monitoring entry of information, because the CATS system, which Enforcement officials call their system of record, has controls on data entered into the system. This includes use of case management specialists, whose specific duties include entry of case information. According to Enforcement management, under the current implementation of the Hub, investigative staff are responsible for entering quarterly, narrative-style case updates into the system. Specifically, staff attorneys are to enter this narrative data into the Hub as part of quarterly case reviews that management conducts, plus other Hub-only information not kept in CATS. Enforcement management told us the formal control on entry of this data is that all staff are aware of the management reviews and that the Hub user guide directs that information should be updated at least quarterly. They said that ultimately, it is a manager’s responsibility to make sure the information indeed gets into the Hub system. The officials said that if the narrative case updates are not entered into the system on a timely basis as directed, this information, which is not quantitative data used to track items such as dollar amounts or caseload, is considered to be a low-risk area that will not compromise overall system quality. In 2007, we reported that Enforcement officials characterized CATS as severely limited and virtually unusable as a management tool. In addition, Enforcement officials said that obtaining technical support for CATS could be difficult because the system is proprietary, and the company that created it is no longer in business. According to Enforcement officials, CATS’ deficiencies resulted from the fact that the system was hastily designed to prepare for expected year 2000 technical challenges. As part of this study, Enforcement officials told us that following the departure of an information technology contractor on the Hub project, the division has chosen to reevaluate the entire effort to replace CATS. They told us that the most likely scenario for implementation of a CATS replacement is now 2011 and that availability of funding will be a key factor. The officials told us they are considering whether to add new capabilities to the new system, in order to allow production of information that is unavailable in the current CATS/Hub implementation without time-consuming custom programming. Examples of such capabilities include annual tallies of penalties and disgorgements by type of case, and data on length of time for cases to reach certain milestones in the enforcement action process. In addition to information on individual cases, such aggregate information could be useful to Enforcement as a management tool. In particular, the officials told us they are examining the replacement project from the standpoint of achieving efficiencies in design, development, and financial system integration, including cost reductions related to training and internal controls. This will improve the division’s ability to capture and produce management information, the officials said. Finally, we recommended in 2007 that Enforcement consider developing expedited procedures for closing investigations that had not resulted in enforcement actions and were no longer being actively pursued. We found that Enforcement was not addressing inactive cases where documentation required to close a matter had not been completed. The new Enforcement manual encourages staff to close investigations when it becomes apparent that no enforcement action will be recommended. According to SEC’s fiscal year 2008 Performance and Accountability Report, the division closed 1,355 cases in fiscal year 2008—its highest annual total, according to Enforcement management—compared to 374 in fiscal year 2007, a 262 percent increase. Officials attributed this to the new guidance, new quarterly reports that list investigations that are 5 or more years old, and periodic conference calls and meetings to discuss closings and case status. Under the Fair Fund program, SEC can combine penalties and disgorgements ordered in an enforcement action and distribute the proceeds to harmed investors. In 2007, we recommended implementing a plan for improving Fair Fund management, to include: (1) staffing a new central Fair Fund office, defining its roles and responsibilities, and establishing written procedures; and (2) ensuring the consistency of, and analyzing, final accounting reports on completed Fair Fund plans. We found that Enforcement’s management of the Fair Fund program may have contributed to delays in distributing funds to harmed investors and that the division lacked data necessary for effective program oversight. In February 2008, SEC announced creation of OCD, to handle disgorgements and Fair Fund activity, plus other collection and distribution functions, such as collection of delinquent penalties or disgorgements that are not part of Fair Fund plans, and investment of funds received. As of October 2008, 23 of 25 full-time positions earmarked for OCD had been staffed. As we concluded our review, efforts were continuing to formulate policies and procedures for the office, in areas such as conflict-of-interest and ethics rules, as well as guidance for selection of consultants, distribution agents, and others who assist with distributions. OCD was envisioned as having agencywide responsibilities, but to date, has handled collections for the headquarters office in Washington and the Boston regional office only. For other offices, OCD advises on collections and distributions, and Enforcement staff remain responsible for collections and distributions in their respective offices. Furthermore, our review identified questions about the efficiency and effectiveness of a dual reporting structure established for OCD. According to GAO internal control standards, optimal organizational structure focuses on a management framework for planning, directing and controlling operations to achieve agency objectives. The structure should clearly define key areas of authority and responsibility, and establish appropriate lines of reporting. Similarly, SEC’s strategic plan calls for examining whether positions are deployed effectively, and exploring how to improve organizational structure. According to interviews and documentation we reviewed, the OCD director reports to SEC’s executive director, who reports to the SEC Chairman. OCD has a deputy director. But the deputy director—to whom all but two OCD staff ultimately report—has a direct report relationship to both the OCD director and the Director of Enforcement. Thus, a dual reporting arrangement has been established: A small portion of OCD reports directly to one superior (the OCD director), while nearly all of the office reports to a deputy whose supervisory chain also leads to a different superior outside OCD (the Enforcement director). This bifurcated reporting leads to a situation where, as the OCD director said, most staff ostensibly in his office are in fact within the organizational structure of a different division. Meanwhile, the OCD deputy director believes that the director must seek her permission to draw upon resources that would seem to lie under the OCD director’s control, but in practice do not. The deputy director typically decides when it is appropriate to advise the director on significant matters, but takes primary direction from the Enforcement director, who has no formal link to the OCD director. According to a senior Enforcement manager, this structure was the product of an arrangement between the then-Chairman and the then- Director of Enforcement. This arrangement raises questions about potential effect on unit performance and SEC’s goal of prompt distribution of funds to harmed investors. The result of this structure, according to both the OCD director and deputy director, and former Enforcement officials, has been twofold: confusion within the office and among Enforcement staff at large about who is responsible for what duties; and delay, as additional meetings and deliberations among a larger group of parties are required to consider issues and reconcile viewpoints. For example, the OCD director said that when seeking to implement ideas for OCD, he must schedule additional rounds of meetings in order to seek consensus among divisions. Similarly, the OCD deputy director said that when differences of opinion have arisen on plans the OCD director wanted to pursue, she has sought direction from Enforcement management. Also, the deputy director said that there has been confusion among OCD staff reporting to her on what issues are appropriate for the attention of the OCD director. Both OCD officials, and others, told us the arrangement is unsatisfactory. Finally, in response to our recommendation that SEC implement a plan for ensuring the consistency and analysis of final accounting reports for completed Fair Fund plans, Enforcement staff, with the assistance of the agency’s Office of Financial Management, have created templates to standardize reporting of final accounting for completed distributions and Fair Fund plans. SEC uses outside consultants for Fair Fund duties, such as identifying investors harmed in a particular case, or making payments to investors. The nature of such duties may vary by case type. We said that without a standardized reporting process, Enforcement could not examine the reasonableness of Fair Fund administrative expenses. With creation of the templates, SEC has taken a step toward collecting information to examine administrative costs. As of our review, the new reports are not yet integrated with Phoenix, a system that is linked manually with the agency’s financial management system. According to Enforcement officials, the change in information technology contractor is the chief reason. Enforcement management recognizes the need to complete integrating the new reports with Phoenix and is taking steps to address it. Overall Enforcement resources and case activity generally have been level in recent years, but the number of front-line investigative staff has fallen. Enforcement management and investigative attorneys told us that resource challenges hinder the ability to bring cases. They cited weaknesses in administrative and paralegal support, information technology support, and specialized services and expertise; and delays in workflow due to the division’s supervisory review of investigations. After Sarbanes-Oxley increased SEC’s appropriations authorization, Enforcement resources grew as well. As shown in figure 1, Enforcement staffing increased following enactment of the legislation in 2002, before subsequently declining. In fiscal year 2008, staffing increased, but remained below the post-Sarbanes-Oxley peak. Total Enforcement staffing has declined 4.4 percent, from a peak of 1,169 positions in fiscal year 2005 to 1,117 positions for fiscal year 2008. Within Enforcement, investigative attorneys, who are the cornerstone of SEC’s enforcement efforts, account for the largest number of positions— about 54 percent of all non-supervisory positions. They are followed by staff accountants (10.5 percent) and trial attorneys (10.3 percent.) Compared to the division overall, investigative staffing has experienced a greater decline. While total Enforcement staffing is down 4.4 percent from its peak, the number of non-supervisory investigative attorneys has declined 11.5 percent, from a peak of 566 in fiscal year 2004 to 501 for fiscal year 2008. Enforcement management attributed this greater decline to several factors: staff attorneys were promoted into management during a hiring freeze, which left their former positions vacant; investigative positions were diverted to other functions; and non-attorney support staff had fewer opportunities to move to other positions outside the agency. Enforcement’s budget, as shown in table 1, has followed the same general pattern—increasing post-Sarbanes-Oxley, then falling, and turning back up. Adjusted for inflation, the fiscal year 2008 amount is down 8.2 percent from the fiscal year 2005 peak. In addition to the number of positions Enforcement has, staff turnover and experience are also factors important to the effectiveness of division operations. In each of these areas, Enforcement has shown improvements in recent years. As shown in figure 2, Enforcement staff turnover has been declining generally, and for investigative and trial attorneys in particular. As turnover has decreased, the experience level of front-line attorneys has increased. The majority of Enforcement’s non-supervisory attorney workforce has 10 years of experience or less. As shown in figure 3, the distribution of experience within this category has undergone a reversal in recent years. The portion with 0 to less than 3 years of experience has declined by about half, while the portion with 3 to less than 10 years of experience has increased by about 55 percent. The segment of the Enforcement workforce with 10 to less than 15 years worth of experience, while small overall, has also grown recently, by about 14 percent. Enforcement management welcomed these trends in turnover and experience, but believed that they were the product of a weaker private sector job market for attorneys. They felt that had market conditions been better recently, with more job opportunities in the private sector, departures would have been greater, which would depress the experience level. They also said that longer tenures create a corollary problem, because opportunities for advancement may be more limited with staff remaining longer. Because Enforcement pursues actions against alleged securities law violators, and the entire population of such violators is unknown, there is no metric, such as volume of trading or number of public company filings, for directly measuring the division’s workload or results achieved. As a result, Enforcement officials said they focus on two process-oriented performance indicators to track the division’s activities: number of investigations opened annually, and number of enforcement actions filed annually. By these indicators, Enforcement activity has generally been level in recent years. Meanwhile, Enforcement’s case backlog has declined somewhat, as the division has made case closings a greater priority (see fig. 4). Senior Enforcement officials said the staff has cleared a previous backlog of cases ready to be closed. Some investigative attorneys and others with whom we spoke said such case tallies can present an incomplete view of Enforcement activity. They said that gross tallies do not indicate the relative significance or magnitude of cases, and are vulnerable to manipulation. For example, a major enforcement case involving significant violations or market practices would be reported in the statistics with the same weight as a matter more administrative in nature, such as failure to make required filings with the agency. In interviews and small group meetings, Enforcement management and investigative attorneys agreed that resource challenges have affected their ability to bring enforcement actions. In general, Enforcement management told us the current level of resources has not prevented the division from addressing any major program area, as the division continues to bring cases across a range of securities violations (see fig. 5). This is in line with an agency goal to avoid over-concentrating in any particular area. However, management and staff said that more resources were desirable, especially in the areas of professional, information technology, and support staff. Current and former Enforcement management told us that the division has gained new resources recently, but these new positions generally were dedicated to specific areas, such as micro-cap fraud or financial restatements, and particular areas within Enforcement, including OCD, the Office of Internet Enforcement, and the PAUSE program, in which the agency compiles information on securities solicitations by unregistered entities. As a result, some investigative attorneys as well as Enforcement management told us that current staffing levels mean some worthwhile leads cannot be pursued, and some cases are closed without action earlier than they otherwise would have been. One Enforcement manager told us that the division did not have enough resources to pursue many leads involving offering fraud and market manipulation and that, once investigations began, some were closed for insufficient resources. Too few investigative attorneys also affect the ability to pursue some referrals from the Financial Industry Regulatory Authority (FINRA) and OCIE. One attorney told us of closing several cases that were promising, but which could not be pursued for lack of resources. A former Enforcement manager told us of difficulty finding investigative staff to be assigned to cases, including cases related to sub-prime mortgages. More specifically, investigative attorneys with whom we spoke cited a number of resource challenges that have undercut their efforts, causing significant delays in bringing cases, reducing the number of cases that can be brought, and potentially undermining the quality of cases. Enforcement management concurred with the staff’s observations in these areas. Investigative attorneys with whom we spoke concurred that having little or no administrative or paralegal support causes them to spend considerable time on non-legal duties such as copying, filing, document scanning, preparing exhibits, making travel arrangements, soliciting bids for court reporters, and logging and processing documents submitted by respondents. For example, one attorney told us such duties can take from 2 to 3 hours daily. Another, who joined the agency from private practice, said that investigative attorneys can spend up to half their time on tasks handled by support staff in their previous position. One attorney told us of plans to spend a day assembling document storage boxes. Because there is insufficient in-house copying capability, confidential documents sometimes are sent to non-secure outside copy shops. Frequent equipment breakdowns mean attorneys must search for working copiers and scanners, a number of attorneys told us. Because investigative attorneys must handle incoming documents, correspondence and documents often stack up, unprocessed. In addition, we have reported previously on the lack of support staff. One attorney told us that one effect of the lack of support is that Enforcement staff must rely on representations from defense counsel in conducting investigations, because they have not had enough resources to undertake research independently. Similarly, a former Enforcement manager told us that while it can be good policy to rely on companies to produce information, resource constraints mean this reliance sometimes reaches undesirable levels—for example, in identifying documents that are key to a case. A number of investigative attorneys said information technology support of enforcement actions is inefficient and outdated. Enforcement’s Concordance system for managing documents is a particular area of concern. Some attorneys told us it takes weeks, or even months, for case records to be sent to headquarters and loaded onto the system to become available for use. Meanwhile, the system lacks useful functions that are available to the private sector, such as certain search features or the ability to reconstruct chains of e-mail communication. Some attorneys said searches in the system fail to identify information known to be present, probably due to poor quality scanning of documents initially. A securities defense attorney told us it is not uncommon for Enforcement attorneys to call, asking to be directed to information of interest in records the defense already has produced, because the staff cannot search for the information themselves. The defense attorney said that this could limit Enforcement’s analysis of issues. While downloading of information from computer hard drives has become a basic evidentiary technique, some investigative attorneys told us there can be lengthy delays for information technology support staff to retrieve the contents from hard drives obtained during an investigation. For example, one attorney told us about a case in active litigation in which Enforcement had to seek an extension of time for discovery because after 6 months, only two of a number of hard drives had been downloaded. Some investigative attorneys also said that the division is at a disadvantage in testimony transcription. They said that, while systems used by private parties allow for real-time transcription of testimony, Enforcement uses an antiquated taping system, in which sessions are recorded and transcribed later. The transcripts frequently come back with errors, such as misidentified parties. Some investigative attorneys suggested that Enforcement would benefit from a divisionwide system for sharing information, such as litigation documents or legal analyses. The attorneys with whom we spoke said that such a system, found in private law firms, would allow attorneys developing cases to be more productive by taking advantage of work already done by others. Enforcement also cannot access information maintained by OCIE. One attorney told us that OCIE information would be useful because when investigating a company, attorneys would like to know of results from any previous inspections. A number of Enforcement attorneys told us they often cannot get access to specialized services that would aid in case development, such as forensic accounting, and that the division lacks expertise in some subject areas involved in recent financial markets turmoil. According to some attorneys, while the agency has accountants on staff, demand for their time outstrips availability. For example, one attorney told us that twice in recent months, a request for an accountant to be assigned to cases under investigation, including one involving sub-prime mortgages, was ignored. Another told us of handling accounting work alone, after being unable to obtain accounting support. Similarly, some attorneys felt that in-house expertise in a range of areas was inadequate. These include complex trading, government securities, collateralized debt obligations, credit default swaps, sub-prime bonds, and collateralized mortgage obligations. One attorney told us of a situation where an investigation was put on hold for several months because staff with trading expertise were unavailable. Several attorneys said that another significant shortcoming is that the investigative staff does not have access to real-time trading information. Such information can be pivotal to bringing certain cases, such as “pump and dump” schemes where promoters use high-pressure tactics to hype a stock, before subsequently unloading their holdings. Currently, when attorneys need such information, they manually query hundreds of broker- dealers, a process that initially produces only incomplete records. Or, they might request data from a regulated entity such as FINRA. Attorneys told us that it can take weeks or longer to obtain the necessary information. Investigative attorneys also strongly agreed that the process for supervisory review of enforcement cases is burdensome and unnecessarily redundant, and thus not a good use of resources. They said that the amount of time devoted to review significantly reduces the time available for investigations. Under Commission procedures, enforcement actions are undertaken after investigative staff present a matter for consideration to the Commission. This is done by means of an “action memorandum.” Such memorandums, which can be lengthy and detailed, provide information including the facts and circumstances of a case, alleged violations of securities laws, legal analysis, and recommendations. Subject to individual circumstances, action memorandums generally go through multiple levels of review: Regional director (for regional offices); Senior Enforcement management, other relevant divisions of the agency, and Office of General Counsel; “To-be-calendared” review (for additional review by senior Enforcement management in advance of Commission meeting); and Pre-calendar review immediately before Commission meeting. Investigative attorneys with whom we spoke noted that an action memorandum can be subject to review and revision numerous times as it moves through this process. Enforcement also requires other memorandums, such as a 6-month status report after cases are opened, or when an investigating attorney proposes sending a “Wells notice,” which is a formal notice to a party that Enforcement is considering recommending, or intends to recommend, that the Commission file an action or proceeding against them. Some attorneys estimated that they spend as much as a third to 40 percent of their time on the internal review process, thus making it harder to meet the division’s emphasis on bringing cases on a timely basis. A number of attorneys told us that the effect of the intensive review process is to create a culture of risk aversion, an atmosphere of fear or insecurity, or incentives to drop cases or narrow their scope. They provided several personal examples. In one instance, an attorney closed a case rather than go through a review with another division. Indeed, according to a number of attorneys, there is a perception that other divisions have become too influential in effectively controlling Enforcement activities. In two other cases, charges were dropped or reduced because the matters had taken so long that people were unable to recall earlier considerations of evidence. In another situation, it took 2-½ months to prepare a paragraph requesting permission to send a Wells notice; in another case, staff prepared multiple drafts of a Wells memo over 3 years before finally closing the case because it was so old. Finally, one investigative attorney told us that a company under investigation offered to pay whatever penalty amount Enforcement asked; 5 months later, the matter still remained open, with an action memorandum in its tenth draft. Some attorneys noted that such delays may encourage violators. The resource issues identified by Enforcement investigative attorneys and management—including deployment of resources, adequacy of investigative staff support, availability of expertise and specialized services, and questions about the burden of the division’s internal review process—stand to affect SEC’s ability to bring enforcement actions on a timely, efficient, and effective basis. Delays in bringing enforcement actions, for example, affect not only cases immediately at hand, but also investigative work foregone in the meantime. Similarly, any unavailability of specialized expertise can potentially affect the quality or scope of an enforcement action. These resource issues reflect a combination of the level of agency appropriations and management decisions about deployment of available resources. For example, senior division management told us that overall, Enforcement needs to add more than 100 professional positions in order to return to post-Sarbanes-Oxley peak staffing, as well as an equal number of support staff positions. Under the agency’s budgeting practice, the division is granted authority to hire to fill a specified number of positions. Under this “slot” system, the agency has traditionally favored allocating positions to professional staff over support staff. Another management decision that has affected investigative capability has been the decision to dedicate resources to specified tasks, as opposed to general investigative duties. Both SEC strategic goals and GAO internal control standards call for making efficient and effective use of resources a priority. One SEC strategic goal is for the agency to be efficient and well-managed through investment in human capital and new technology—in particular, by keeping pace with technological innovation—and through enhancement of internal controls. Overall, the agency’s strategic plan calls for targeting resources strategically, examining whether positions are deployed effectively, and exploring how to improve program design and organizational structure. GAO internal control standards place effectiveness and efficiency of operations as a key objective of internal control. Senior Enforcement managers said that they have begun an initiative to address some of the concerns identified above. These include study of: The internal case review process, including reviews that take place within Enforcement and in other divisions. Enforcement management said that over time, as new steps have been added to the review process, it has become unwieldy, and that this review aims to identify streamlining measures. The handling of incoming referrals. Investigative tips and referrals now come from seven sources, and Enforcement is examining how to track their assignment and ultimate outcomes. Methods to develop and prospect for investigative leads, based on the risk presented by a practice or situation. Based on documentation we reviewed, this effort is focused on process. However, as noted, our review indicated that concerns about the burdensome review process have created organizational culture issues as well. For an individual case, a number of factors can affect the amount of a penalty or disgorgement that Enforcement staff seek in an enforcement action. On an annual basis, penalty and disgorgement amounts may vary according to the mix of cases concluded in a particular period. In 2006 and 2007, the Commission adopted two corporate penalty polices that focus on economic benefit derived through wrongdoing and the effect a penalty might have on shareholders, as well as giving the Commission earlier involvement in the penalty determination process. Overall, penalties and disgorgements ordered have declined significantly since the 2005-2006 period. Numerous factors affect penalty and disgorgement amounts, which may vary widely from case to case. Penalties are generally punitive, and are to have a deterrent effect. In determining a recommended penalty amount, Enforcement staff consider such factors as the nature of the case, egregiousness of the conduct, degree to which a respondent has cooperated during an investigation, remedial actions taken, and ability to pay. For example, in October 2007, Nortel Networks Corp. agreed to pay a $35 million penalty to settle an action for accounting fraud in which the company allegedly inflated revenues to meet performance targets. When the sanction was announced, a Commission official said the fraud was “long-running, intentional and pervasive.” But the Commission acknowledged in settling the matter the company’s cooperation and remedial efforts, which included an independent investigation that uncovered improper accounting; replacement of senior management; and several restatements of financial results. In another case, in June 2004, Gemstar-TV Guide International, Inc., agreed to pay a $10 million penalty in connection with alleged overstating of its revenues. The Commission in assessing the penalty amount considered the severity of the misconduct, Gemstar’s initial failure to cooperate or undertake remedial actions, as well as later cooperation and remediation after a change in senior management and restructuring of its corporate governance. Prior cases have also served as a guide for determining penalties. Disgorgement is intended to recover ill-gotten gains realized or losses avoided through a defendant’s illegal actions. For example, in July 2008, the former head of an Enron Corp. division agreed to pay $30 million in disgorgement and interest, after the Commission charged him with illegally selling Enron stock on the basis of nonpublic information. SEC alleged the former executive avoided substantial losses by selling shares before the company’s stock price later collapsed in the fall of 2001. In another example, in May 2007, Morgan Stanley & Co. agreed to pay $5.9 million in disgorgement after the Commission alleged the company recognized revenue when it improperly priced, and delayed execution of, certain retail orders for securities. Setting aside the effect of any policy change, the total amount of penalties and disgorgement that the Commission seeks on an annual basis also can vary according to the type and magnitude of cases concluded in a given period. For example, from 2003 through 2005, when penalty amounts were comparatively high, a small number of cases with large penalties accounted for a disproportionate share of the total. In fiscal year 2003, approximately $950 million in penalties were imposed. Of that amount, nearly 80 percent came from a single case—a $750 million penalty ordered against WorldCom, Inc., for alleged fraud. Similarly, in fiscal year 2005, the peak year for penalties, $1.6 billion in fines were imposed, with three alleged accounting fraud cases—Qwest Communications International, Inc.; Time Warner, Inc.; and HealthSouth Corp.—accounting for $650 million, or about 40 percent of the total. Additionally, certain types of cases are more or less likely to produce penalties or disgorgements. As an example, Enforcement management cited financial fraud cases, which comprised nearly one-third of Enforcement’s cases brought in fiscal year 2007, as actions less likely to result in disgorgement orders. According to the officials, if a company experiences a large loss in the market value of its stock as a result of a financial fraud, this does not amount to an ill-gotten gain in the traditional sense. In addition, even if disgorgement was to be based on such a loss in market value, the amounts involved in financial fraud cases could be so large—reaching billions of dollars—as to be prohibitive. Another example where amounts have been constrained is penalties for stock options backdating, where the Commission effectively set a ceiling on such cases, Enforcement management told us. According to senior Enforcement officials and former commissioners , the Commission agreed that stock options backdating provides a benefit to a corporation, but views differed on quantifying the size of the benefit. The effective ceiling was established after one company was judged to have committed the worst violation, and its penalty became the upper bound for assessing penalties in other backdating cases. Because penalty and disgorgement amounts can vary in these ways, a number of observers, including current and former Enforcement staff, cautioned against relying on penalties levied in a single year, or year-to- year changes, as conclusive measures of the division’s performance or attitude toward enforcement actions. Two recently adopted policies have provided overall guidance for determining the appropriateness and size of corporate penalties for individual enforcement actions. Below, we describe the features and basis of these policies. In the next section, we address the effects of the policies. The Commission announced its January 2006 policy in conjunction with the settlement of two corporate enforcement actions. The Commission said the policy stems from “the fundamental principle that corporate penalties are an essential part of an aggressive and comprehensive program to enforce the federal securities laws, and that the availability of a corporate penalty, as one of a range of remedies, contributes to the Commission’s ability to achieve an appropriate level of deterrence through its decision in a particular case.” The policy established nine factors for evaluating imposition of corporate penalties, but said two were of primary importance: Direct benefit to the corporation. The Commission said that if a corporation has received a direct and material benefit from the offense, such as through reduced expenses or increased revenues, a corporate penalty is more appropriate. The weakest case for a corporate penalty is when shareholders are the principal victims of the securities law violation. Additional harm to shareholders. The Commission said a corporate penalty risks hurting shareholders who have committed no violation but may bear the burden of the penalty. Thus, the ability to use a penalty to compensate injured shareholders supports a corporate penalty, but if the penalty will unfairly injure investors, the corporation, or others, that weighs against the penalty. In announcing the policy, the Commission emphasized what it said was a need to provide “clarity, consistency, and predictability” when exercising its penalty authority. The Commission acknowledged differing views among commissioners on when a corporate penalty was appropriate, but said that the commissioners had approved the policy unanimously, in particular the two primary factors. The first of the two primary factors—direct benefit to the corporation— focuses attention on economic analysis to determine what benefit, if any, a company may have obtained from its conduct. According to management of SEC’s Office of Economic Analysis (OEA), the facts and circumstances of a particular situation generally dictate the analytical approach used to consider corporate benefit. One widely used technique that OEA employs is an “event study,” which considers changes in stock price upon disclosure of violations and subsequent corrective events. The event study method, which addresses both materiality and magnitude of the potential inflation in securities prices, is generally accepted and considered to be robust because it uses marketplace reaction to gauge the significance of information. Overall, the officials told us that estimating benefit is not a precise process. Therefore, for a given case, OEA communicates any additional factors that should be considered in calculating an issuer benefit. Sometimes, OEA considers submissions from defendants as part of its analyses when defendants provide analysis of issuer benefit. The nature of a corporate benefit can vary. For example, a company can benefit if a fraud, such as overstatement of earnings, results in an inflated stock price, and the company then either issues stock or makes an acquisition using stock. In such cases, the corporation realizes a benefit because it realizes a higher price in issuing the stock, or it makes the acquisition using stock with a fraudulently inflated value. The second of the two primary factors—additional harm to shareholders— addresses whether shareholders who were harmed by a drop in stock price after initial disclosure of a violation effectively would be penalized again through a corporate penalty, according to some former commissioners. One key element of analysis of this issue involves shareholder turnover over time. According to Enforcement management, turnover and impact of penalties can be considered in different ways. They explained that ordinary turnover means that a company’s collection of shareholders at the time a violation is committed or disclosed likely will not be the same group at the time any penalty is subsequently assessed. If there is little turnover, the shareholder population when a penalty is levied will be close to what the population was at the time a violation was disclosed. But if there is a great deal of turnover, then to the extent a penalty hurts shareholders, the impact is diminished because many current shareholders would not have held stock at the time the violation was disclosed. On the other hand, more recent shareholders would not have received any benefit from the initial fraud. OEA officials told us they approach the shareholder harm analysis by considering current shareholders, and trying to estimate how many might have benefited from the company’s fraud and how many did not. OEA officials said that although attaining precise results is difficult, the office uses data on shares held by institutions to conduct its analysis. For shareholders who bought after a fraud, or SEC investigation, was disclosed, a complicating factor is the degree to which that information is priced into the cost of shares. OEA believes that expected penalties are reflected in stock prices; therefore, those buying after such disclosures are purchasing at a lower price. OEA officials told us that the precision of the analysis could be improved by considering holdings of non-institutional shareholders, but that would be costly and time-consuming. OEA estimates that doing so for a single case would require four people working 6 months. Given the effort, this would provide only a marginal benefit of questionable cost. The then-Chairman announced the April 2007 policy, also known as the “pilot program,” in a speech at a conference. The policy, now discontinued, required Enforcement staff, when contemplating a corporate penalty, to obtain Commission approval of a penalty range before settlement discussions could begin. Cases that subsequently were settled within the range specified by the Commission were eligible for approval on an expedited basis. At the same time the Commission provided the settlement range, it also granted Enforcement staff authority to sue. According to Enforcement management, there was no written documentation for this policy beyond the text of the Chairman’s speech. As announced by the Chairman, the policy applied to any corporate penalty case; however, as put into practice by Enforcement, it was applied to a subset of corporate penalty cases, namely financial fraud cases only. According to Enforcement staff and former commissioners with whom we spoke, and as stated in the Chairman’s speech, the purpose of the pilot program was to: Provide earlier Commission involvement in the penalty process. Previously, Enforcement staff would present to the Commission a proposed settlement that already had been fully negotiated with a respondent. Some commissioners, facing a choice of accepting a settlement as presented or rejecting it and forcing the staff to go back to the defendant, wanted to have more involvement earlier in the process. Strengthen Enforcement staff’s negotiating position. Obtaining pre- approval of a penalty range would put Enforcement staff in the “strongest negotiating position” because the Commission had reviewed outcomes before settlement offers were made. In addition, the staff’s position in settlement negotiations would be strengthened by the authority to sue that accompanied approval of the settlement range. Maintain consistency, accountability, and due process. The Commission’s review would ensure consistency and fairness in applying the January 2006 policy on corporate penalties. The policy provides accountability because it is the commissioners who are responsible for the decisions, and it offered due process protection to defendants by providing Commission review of evidence of alleged misconduct. At the time of our review, eight cases had been settled in accordance with the policy. Our comparison of the penalty range recommended by Enforcement staff with the range approved by the Commission showed that those ranges were similar in most cases. Specifically, In five of the eight cases, the Commission approved the staff’s recommended penalty range, and the staff obtained settlements within those ranges. In two cases, the Commission approved a range that overlapped with, but was lower than, the range recommended by the staff. The penalty ultimately obtained was within the staff’s original recommended range. In one case, the Commission approved a penalty range that was lower than that requested by the staff. The Commission approved a lower bound of the range that was 10 percent of the staff’s recommended amount, and an upper bound that was 25 percent of the staff’s recommendation. The staff then obtained a settlement within the lower, Commission-approved range. This summary reflects ultimate dispositions and does not necessarily reflect actions or discussions that may have taken place prior to final consideration. For example, in one case involving a technology defendant, the Commission, in adopting a settlement range, concurred with a staff recommendation. But an earlier staff recommendation for a settlement range had an upper limit about 40 percent higher than that eventually approved. In February 2009, the current Chairman announced that this policy was being discontinued. The Chairman said that the change was designed to expedite enforcement efforts and that at a time when SEC needs to be deterring corporate wrongdoing, the policy sent the wrong message. She said that according to Enforcement staff, the policy caused significant delays, discouraged staff from arguing for penalties in cases that might deserve a penalty, and sometimes resulted in reductions in the size of penalties imposed. (A full discussion of the effects of the 2006 and 2007 corporate penalty policies appears in the following section.) Since fiscal years 2005 and 2006, total annual penalty and disgorgement amounts have declined, as shown in figure 6. While both penalties and disgorgements have fallen in recent years, penalties have been declining at an accelerating rate, falling 39 percent in fiscal year 2006, another 48 percent in fiscal year 2007, and then 49 percent in fiscal year 2008. Also, penalties have declined in the aggregate by a greater amount than disgorgements. In particular, penalties have fallen 84 percent, from a peak of $1.59 billion in fiscal year 2005 to $256 million in fiscal year 2008. Disgorgements fell 68 percent, from a fiscal year 2006 peak of $2.4 billion to $774.2 million in fiscal year 2008. Compared to fiscal year 2006, SEC brought more corporate penalty cases in fiscal 2007, but for smaller amounts. In 2007, SEC brought 10 cases, compared to 6 in 2006. Four of the six cases in 2006 resulted in penalties of $50 million or more, with the two largest, AIG and Fannie Mae, totaling $100 million and $400 million, respectively. By contrast, in the fiscal year 2007 cases, only two issuers, MBIA, Inc., and Freddie Mac, were assessed penalties of at least $50 million. In addition to corporate penalties, enforcement actions also can result in penalties against individuals. For example, in April 2007, Apple, Inc.’s former chief financial officer was ordered to pay a $150,000 penalty for failure to ensure accurate reporting of executive compensation, in a case stemming from stock options backdating. Also in 2007, two individuals agreed to pay $175,000 in penalties for an alleged scheme that defrauded a number of savings banks and their depositors in connection with the banks’ conversion from mutual to stock ownership. While there has been some variation, the distribution of enforcement actions by type of case has generally been consistent in recent years. Enforcement management said that the division has met its goal that a single category of cases not account for more than 40 percent of all actions. Enforcement management, investigative attorneys, and others concurred that the 2006 and 2007 policies on corporate penalties, as applied, have had the effect of significantly delaying cases, and producing fewer and smaller corporate penalties. Our review also shows that in adopting and implementing the policies, the Commission did not act in concert with agency strategic goals calling for broad communication with, and involvement of, the staff. According to Enforcement management, investigative attorneys, and others, the 2006 and 2007 corporate penalty policies, as applied, have had a number of effects. They have led to less vigorous pursuit of corporate penalties, may have made penalties less punitive in nature, and could have compromised the quality of settlements. Investigative attorneys have also been concerned that at the same time, it became more difficult to obtain formal orders of investigation, which compel witnesses by subpoena to testify and produce books, records, and other documents. We queried six other commission-style federal regulatory agencies and found only one with a policy similar to the Commission’s 2007 policy on pre-approval of settlement ranges. On their face, the 2006 and 2007 penalty policies are neutral, in that they neither encourage nor discourage corporate penalties. However, Enforcement management and many investigative attorneys and others said that Commission handling of cases under the policies both transmitted a message that corporate penalties were highly disfavored and caused there to be fewer and smaller corporate penalties. Case delay was one of two major factors accounting for the belief many expressed that corporate penalties have been disfavored. Under the 2006 policy, to recommend a corporate penalty, investigative attorneys conduct an analysis based on the policy’s nine factors. A number of attorneys told us that this can be time-consuming, especially when evaluating a corporate benefit, as required under one of the two main factors. In such cases, as described above, OEA becomes involved, and this can add months to the process. Meanwhile, attorneys said that under the 2007 policy, the process of bringing a case could come to a halt for long periods, when investigative attorneys were required to seek Commission approval of a settlement range, before undertaking settlement negotiations. Furthermore, the time between recommendations for penalties reaching the Commission and the Commission acting upon them could be lengthy. According to a former commissioner, many cases involving corporate penalties stalled because of different views among commissioners. For example, an attorney told us that a company confessed and was willing to pay the penalty sought, but it still took more than 6 months to complete the settlement because the commissioners lacked consensus. Another attorney told us that a company agreed to a settlement, announced it publicly, and escrowed money for the payment, but the matter took a year to win Commission approval. One attorney cited a case that went on and off the Commission’s meeting agenda eight times. A former commissioner said that even when Enforcement staff tried to make recommendations according to the terms of the policies, there were lengthy delays when cases reached the Commission. In addition to delay, the attorneys also cited perceived Commission antipathy toward such penalties as contributing to their belief that corporate penalties have been disfavored. For example, several Enforcement attorneys told us that even when they presented cases in which a corporation had agreed to pay a penalty, the Commission might lower or eliminate the amount. One attorney described a case in which a company proposed a settlement with a higher penalty than was approved by the Commission, which required the attorney to return to the company and explain that the Commission wanted a lower amount. Another described a case in which the Commission halved a proposed penalty. Yet another described having conducted the required nine-factor analysis, and arriving at a proposed penalty range of $10 million to $35 million, but having the Commission reduce it to $5 million to $15 million. We did not independently review details of these cases. According to a number of Enforcement attorneys and division managers, experiences like these caused an anti-penalty message to be transmitted, with the result that investigative attorneys began avoiding recommendations for corporate penalties. For example, a former Enforcement manager told us that some investigative attorneys concluded it was not worth seeking a corporate penalty and that the Commission did not follow terms of its own policy. A current Enforcement manager characterized the situation as investigative attorneys “following the path of least resistance” and not recommending penalties. Some investigative staff with whom we spoke said that in principle, the policies made sense. For example, one Enforcement manager told us that in the abstract, the factors announced in the 2006 policy were reasonable. One investigative attorney said that having guidelines is useful and another commented that the 2006 policy was a laudable effort to bring consensus to a philosophically divided commission. But as applied, according to Enforcement management and a strong consensus of investigative attorneys with whom we spoke, the ultimate outcome of the polices has been fewer and smaller corporate penalties. For example, when the question of whether to seek a corporate penalty is a close one, the staff will default to avoiding the penalty. Or, if investigative staff decides to seek a penalty, they will change their focus from pursuing what they otherwise would recommend as most appropriate to tailoring recommendations to what they believe the Commission will find acceptable. As described by one attorney, investigative staff sought to identify the “maximum minimum amount” the Commission will approve. In one case, an attorney told us that a company offered to pay $1 million to settle a case, but the attorney chose to recommend no penalty because they did not believe the Commission would approve the company offer. Likewise, an Enforcement manager described having encouraged dropping penalties from a case for fear the matter would not otherwise be cleared for consideration by the Commission. For these reasons, according to many investigative attorneys, the penalty policies contributed to an adversarial relationship between Enforcement and the Commission, where some investigative attorneys came to see the Commission as less of an ally in bringing enforcement actions, and more of a barrier. For example, one attorney told us that it was widely felt that Enforcement was barred from doing its job. Another said the policies represented Commission attempts to make it more difficult for Enforcement to do its job. Others told us the Commission was an obstacle or not supportive. Moreover, according to an Enforcement manager, the factor in the 2006 penalty policy that anchors penalties to benefits derived by the corporation serves to bar a corporate penalty in a significant number of cases, or likewise limit the scope of many cases. For instance, if a company committed fraud to inflate its stock price, that, by itself, would not qualify for a penalty, because the company would have derived no calculable benefit. Yet, the manager said, companies benefit in several ways from having a higher stock price—such as by having a better reputation, being in a better position to offer stock option compensation to executives, and being able to obtain financing at lower cost. Enforcement officials told us that given the effects of the penalty policies, a $10 million penalty today might have been $50 million to $60 million before adoption of the policies. In discussing how the Commission considers corporate penalty recommendations by the investigative staff, Enforcement management and some staff cited one case to us as providing what they characterized as a striking example of the Commission reducing a proposed penalty of significant size to zero, which went as follows: In initial settlement discussions, a corporate penalty of several tens of millions of dollars was considered against a financial institution defendant. The case was the first of its type, involving several billion dollars in investor losses. After further discussion, the case was presented to the Commission, with the defendant offering to settle by paying a penalty one-half the amount initially discussed, plus disgorgement of several million dollars. In justifying the proposed remedies, Enforcement staff said the defendant ignored repeated, highly suspicious signs of fraud and that a lack of previous cases in this area underscored need for action. Next, the Commission rejected the settlement as agreed by Enforcement staff and the corporate defendant. Although rejecting the settlement, the Commission authorized the staff to negotiate further with the defendant, but under different legal reasoning. Under this different approach, a corporate penalty was precluded. Enforcement staff resubmitted the matter to the Commission and the settlement ultimately won approval, but with no penalty and a reduction of about 80 percent in the disgorgement amount. We did not independently review the complete details of this case or the appropriateness of the actions of either the staff or the Commission. Enforcement management told us they concurred in these observations about the effect of the application of the penalty policies. Although the Commission never directed that there be fewer, or smaller, penalties, the officials said that has been the practical effect because Commission handling of cases made obtaining corporate penalties more difficult. Over time, the officials said they struggled with implementation and were unable to provide guidance to the staff, because they saw the Commission’s application of the penalty factors as inconsistent. Furthermore, the widely held view within Enforcement was that the unstated purpose of the 2006 policy was to scale back corporate penalties. On the contrary, a former commissioner said that the 2006 and 2007 policies have not accounted for declining amounts of penalties and disgorgement, nor for less vigorous pursuit of corporate penalties. Instead, the former commissioner said the issue facing Enforcement has been quality of management. The former commissioner added that Enforcement staff has not been properly managed to bring a sufficient range of cases on a timely basis. In addition, Commission actions have not discouraged the staff from seeking corporate penalties. To the extent penalties are down, it may be due to the staff electing on its own to retreat from penalties. Another former commissioner said that, although some Commission actions may have caused Enforcement to feel constrained or that its authority was diminished, it was nevertheless important to understand that the division worked at the direction of the Commission, not as an independent entity. Furthermore, a number of investigative attorneys and others told us that the policies, as applied, also have discouraged pursuit of more complicated cases, those based on novel legal reasoning, or those with industrywide implications, in favor of those seen as more routine or more likely to win Commission approval. For example, one attorney said there has been relatively more focus on modest cases like small Ponzi schemes, insider trading, and day trading, because such cases were thought to stand a better chance of winning Commission approval, compared to more difficult and time-consuming cases like financial fraud. Likewise, one Enforcement manager said that the Commission signaled that it did not favor cases involving industrywide practices. The manager added that the preferred approach for handling industrywide issues was not through enforcement actions, but instead through the rule-making process. Current and former Enforcement management and a number of investigative attorneys and others expressed concern that the penalty policies may have the effect of changing the nature of penalties, as well as potentially compromising the quality of settlements. As noted earlier, penalties punish violators and are intended to deter misconduct. But according to current and former Enforcement management and some investigative attorneys, by conditioning corporate penalties in significant part on whether a corporation has benefited from improper practices, penalties effectively become less punitive and more like disgorgement. In relying on corporate benefit, the penalty policies have the effect of disconnecting penalties from egregiousness of conduct, one Enforcement manager told us. For example, one investigative attorney described a case in which a respondent, based on conduct at issue, would have paid two or three times the amount ultimately levied. But it was not possible to recommend such a sanction, the attorney said, because a benefit could not be quantified in support of the amount. A former Enforcement manager emphasized that the purpose of a penalty is not to recover wrongful gains, but instead to deter conduct. Thus, corporate benefit should not matter in determining a penalty. Yet under the current approach, Enforcement officials acknowledged that there could be flagrant misconduct, but no penalty, if corporate benefit cannot be identified through economic analysis. One issue with quality of settlement involves the now-discontinued 2007 policy that required pre-approval of a settlement range, and whether the Commission, when setting the range, made fully informed decisions. Several current and former officials told us that the question arises because settlement discussions themselves often reveal relevant information about conduct at issue. However, under the 2007 policy, the Commission set the penalty range before the settlement negotiations took place. Thus, those officials noted, the Commission acted without the benefit of information that would surface in the settlement talks; the settlement range set by the Commission would not reflect what would be learned later, after settlement discussions had taken place. Another quality-of-settlement issue stems from what several investigative attorneys said has been an additional outcome of the corporate penalty policies: Reduced cooperation by the subjects of enforcement investigations. For instance, one attorney told us that a company said it would not settle a matter because it did not believe the Commission would approve a penalty. Another said they believed defense counsels less often recommended that companies approach the agency voluntarily if they suspected securities law violations may have occurred. Similarly, another said that corporations have been less willing to turn over individuals for sanction. A number of investigative attorneys told us that because the policies, as applied, created a perception that SEC has retreated on penalties, defendants or potential violators have become more confident or emboldened. Enforcement concludes most of its cases by settlement, so to the extent incentives for cooperation are reduced, settlements could be affected. At the same time the penalty policies were being implemented, it also became more difficult to obtain orders formally authorizing investigations, a number of attorneys said. Some of Enforcement’s case investigations take place with subjects providing information on a voluntary basis. However, formal orders of investigation compel witnesses by subpoena to testify and produce books, records, and other documents. The Commission must approve such orders. The previous Chairman recently highlighted the significance of these orders, saying that, in the Madoff investor fraud matter, investigative staff never sought a formal order of investigation, and that such an order would have facilitated a more probing investigation. Investigative attorneys with whom we spoke said that obtaining approval of a formal order, once routine, lately had become more difficult and time- consuming, which delayed investigations. They said that it could take months to obtain Commission approval. One attorney said it took about 5 months and several rounds of comments on a supporting memorandum before a request seeking a formal order in a Ponzi scheme investigation was set for Commission consideration. As shown in table 2, SEC statistics show fewer formal orders have been approved in recent years, with the number down 14 percent since fiscal year 2005. In February 2009, the new Chairman announced policy changes designed to expedite issuance of formal orders. She said that she had directed a return to a previous policy, where commissioners can approve formal orders one after another in sequence, without a meeting; or, where appropriate, a single Commissioner acting as a duty officer can approve an order. As part of our review, we queried six other commission-style federal regulatory agencies, to determine whether they have policies similar to the former 2007 policy on pre-approval of a settlement range. These agencies were the Federal Communications Commission, the Nuclear Regulatory Commission, the Federal Energy Regulatory Commission, the Consumer Product Safety Commission, the Commodity Futures Trading Commission and the Equal Employment Opportunity Commission. Only one, the Federal Energy Regulatory Commission, reported having a similar policy. Under that agency’s procedures, in seeking to resolve a case, the staff requests settlement authority from the commission, and in that request, seeks authority to negotiate within a range of potential penalties or disgorgement. The policy is new, having been issued in May 2008, and has not been reviewed since then. Our review identified questions about the effectiveness of communication between the Commission and Enforcement in adopting and implementing the recent corporate penalty policies. In particular, the Enforcement division, which is responsible for implementing the policies, had only limited input into their development. Furthermore, questions and confusion arose about the policies after they were enacted. According to Enforcement management, the broad Enforcement staff had no input into creation of either the 2006 or 2007 penalty policies. Senior division management did have input into the 2006 policy, but no input into the 2007 policy. Enforcement management said that the process for creating the 2006 policy was designed to be closed and without broad staff input. Using consideration of two pending enforcement actions as a vehicle for discussion, commissioners, the agency general counsel, and the Enforcement director met in a series of executive sessions over several months in late 2005. Senior management told us their understanding was the Commission’s desire for a closed process reflected several factors, including a contentious topic, concern that anxiety over the issue could be directed at staff if they participated, or concern that commissioners might be less than candid with staff present or might posture for their benefit. In the case of the 2007 policy, the Commission presented a completed policy to Enforcement without division input, according to Enforcement management. The genesis of the policy came when the then-Chairman raised the issue of establishing penalty ranges for cases. Following that, Enforcement management suggested using an upcoming case as a trial run for setting a penalty range. But according to Enforcement management, for reasons unknown, no such trial (as Enforcement understood it; i.e., a one-case trial run) took place, and the Commission then summarily presented the policy to the division. In addition, although the 2007 policy, with its pre-approval requirement, had a material effect on the process by which enforcement actions are brought, there was no written guidance or documentation for its implementation. Also, although the policy was set up as a pilot program, there was no scheduled conclusion date or any identified process for evaluating its effectiveness. According to agency records, the Commission has increasingly met in executive session when considering division recommendations for enforcement actions. Commission meetings to approve enforcement actions are closed to the public, but ordinarily, any division staff may attend. At executive sessions, however, the Commission restricts attendance in two ways: (1) to only those involved in a case; or (2) even further, to only the Director of Enforcement, and the agency general counsel and secretary, thus excluding staff who worked on a case. Agency records show that of the days the Commission met to vote on enforcement actions in 2008, it held an executive session 40 percent of the time—a rate that has tripled since 2005. However, that 40 percent is roughly equal to the frequency at which executive sessions were held in 2003 and 2004. Similarly, investigative attorneys and current and former Enforcement management told us that the Commission increasingly made a practice of removing enforcement cases scheduled for consideration from its meeting calendar with little or no notice, and often only a short time before meetings were scheduled. Enforcement management’s understanding of this practice is that the then-Chairman removed cases for which he believed there was insufficient support for a recommended action. We were unable to examine the nature of removed cases because Enforcement does not compile such data. But Enforcement management said that such cases generally included those considered controversial. Both SEC strategic goals and GAO internal control standards emphasize the importance of communication and its link to organizational effectiveness. SEC’s strategic plan states that success requires a team approach and commitment to the “highest standards” of trust, cooperation, and communication throughout the agency, and that an agency goal is to formulate and communicate policy proactively. GAO internal control standards provide that effective communication should occur in a broad sense, with information flowing down, across, and up an organization. Similarly, a best practices approach for policy development includes incorporating the first-hand knowledge and insights of employees, and making employees stakeholders in developing strategies for achieving organizational success. Employee involvement likewise creates an opportunity to increase employees’ understanding and acceptance of organizational goals and objectives, and gain buy-in for new polices and procedures. The limited organizational communication in the adoption and implementation of the penalty policies is not in accord with these standards. According to Enforcement management and many investigative attorneys and others, all these developments and their effect on communication among significant constituencies within the agency created frustration and confusion. One senior division manager noted that the closed process of policy development angered people and handicapped the staff’s subsequent efforts to apply the policies. Indeed, several investigative attorneys cited uncertainty about when to apply the policies. Likewise, some commented that the inability of the staff to see Commission deliberation of cases hindered the staff’s ability to understand how to implement the policies. For example, some attorneys told us that investigative staff struggled to understand and apply the 2006 policy, because its nine factors could be interpreted in different ways, and even in contradiction to one another. At the same time, a former commissioner questioned whether the policy was sufficiently explained to the staff, and whether the staff was properly applying the factors for analysis. SEC has implemented aspects of a number of our 2007 recommendations. Among other actions, Enforcement management has developed procedures for using the Hub system, and the Hub can now produce various management reports. Our review did, however, identify concerns that OCD’s organizational structure could affect its efficiency and effectiveness. SEC has identified prompt distribution of Fair Funds to harmed investors as a goal, which was a key reason OCD was established. SEC has partially addressed our previous recommendation by initially staffing the office and beginning to create policies and procedures. Dual reporting relationships are not unusual. However, the division of authority within OCD has raised questions about the effect the office’s structure may have on its performance. As noted earlier, neither of the two principal officials believe the current structure is optimal. The problems cited— confusion about duties and delays in progressing toward objectives— stand to affect the agency goal of prompt distribution of funds to harmed investors. Furthermore, any ineffectiveness or inefficiency within OCD stands to affect enforcement efforts in general, because OCD is intended to assume greater responsibility across the agency for execution of Fair Fund plans created as part of enforcement actions. To the extent that investigative staff are responsible for a smaller portion of Fair Fund plan execution, because OCD has assumed those duties, the staff will be more able to concentrate on their primary tasks of investigating violations and bringing enforcement actions. In recent years, Enforcement has experienced a decline in investigative staff, but continues to face an open-ended mandate to protect investors and enforce the federal securities laws. Its ability to deploy resources efficiently and effectively is thus of critical importance to accomplishing SEC’s mission, especially in today’s environment of economic and financial market turmoil and volatility. Our review has identified two key resource challenges that could hamper Enforcement’s ability to bring cases: the level of administrative and technical support provided to investigative attorneys, and the process for division review and approval of enforcement actions against alleged violators. Inadequate administrative and paralegal services, specialized services and subject matter expertise, and information technology support can delay the completion of a case or affect its quality and scope. Similarly, although Enforcement should take due care in exercising its authority and discretion in bringing an enforcement action, a burdensome internal review process can undermine efficient use of investigative resources. As noted in SEC’s strategic plan, making effective and efficient use of resources is a priority. While Enforcement management has moved to address some of these resource concerns, the effort may benefit from a focus that includes both process and organizational culture issues. The Commission adopted two corporate penalty policies in 2006 and 2007 that, respectively, affirmed corporate penalties as an essential part of an “aggressive and comprehensive program” to enforce the federal securities laws, and attempted to provide earlier Commission involvement in the settling of cases. Yet these policies, as applied, appear to have had a number of effects at odds with SEC goals or objectives. In particular, investigative attorneys reported that they have not sought corporate penalties because of perceived difficulties in winning Commission approval of such sanctions. Also, during both the adoption and implementation of these policies, the Commission has restricted communication, curtailing Enforcement management and staff input and insight into policies that management and staff are responsible for executing. Furthermore, while SEC goals call for the “highest standards” of trust and cooperation, a number of investigative attorneys told us the policies have caused them to see the Commission in an adversarial light. To the extent that communication has been a factor in the post-adoption effects cited by Enforcement management, investigative attorneys, and others, the Commission has forgone an opportunity to improve organizational effectiveness. Enforcement cannot detect and prosecute all violations. Thus, its success in enforcing the securities laws, deterring violations, and protecting investors rests on its ability to create and implement the most effective policies. For these reasons, the division and its enforcement efforts could benefit from better communication with the staff affected by policy changes. To help ensure that SEC is effectively and efficiently using its resources in bringing enforcement actions, and that its enforcement policies are working effectively, we recommend that the SEC Chairman take the following four actions: 1. To help ensure effective and efficient operation of the Office of Collections and Distributions, consider an alternative organizational structure and reporting relationship for the office, to address the organizational concerns identified. 2. As part of ongoing efforts to explore the more effective use of resources, and to streamline internal review of cases and investigations, expand Enforcement’s current examination of its methods to include the level and mix of resources available to investigative staff in the areas of administrative and paralegal support, specialized services and expertise, and information technology support; and include in the examination an evaluation of the impact of the case review process on organizational culture factors such as risk aversion and incentives to drop or narrow the scope of cases. 3. Examine the effects of the 2006 corporate penalty policy to determine whether the policy is achieving its stated goals and any other effects the policy may have had in adoption or implementation. 4. In light of the effects we have reported involving adoption and implementation of the 2006 and 2007 corporate penalty policies, take steps to ensure that the Commission, in creating, monitoring, and evaluating its policies, follows the agency strategic goal and other best practices for communication with, and involvement of, the staff affected by such changes. We provided a draft of this report to the Chairman of SEC for her review and comment, and we received written comments that are reprinted in appendix II. In these comments, the Chairman agreed with our recommendations and said officials are taking steps to implement them. The Chairman said senior officials will immediately evaluate alternative organizational structures for the Office of Collections and Distributions, in order to effectively collect ill-gotten gains and penalties and to distribute funds to harmed investors. Also, the Chairman said SEC’s new Enforcement director will conduct a comprehensive review of Enforcement’s investigation processes and its organizational culture. She said the review will focus on ways to make more effective use of current resources and to identify the best use of any additional funding. Further, the Chairman said senior officials will review whether the Commission’s 2006 corporate penalty policy is achieving its intended goals, and will report back to her with findings and recommendations. Finally, the Chairman agreed that SEC should take steps to ensure that the Commission better involve, and communicate with, Enforcement staff in managing the enforcement program. She said no improvement to SEC’s enforcement program can be successful without deep involvement of Enforcement staff and clear communication to the staff of the Commission’s goals and expectations. SEC also provided technical comments, which we have incorporated as appropriate. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its date. At that time, we will send copies of this report to interested congressional committees, the Ranking Member of the Senate Committee on Banking, Housing, and Urban Affairs, the Ranking Member of the Senate Subcommittee on Securities, Insurance, and Investment, and others. We will also send a copy to the Chairman of the SEC. The report will be available at no charge on the GAO Web site at www.gao.gov. If you or your staff have any questions regarding this report, please contact me at (202) 512-8678 or williamso@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. To address our first objective—evaluating the Securities and Exchange Commission (SEC) Division of Enforcement’s (Enforcement) progress made in implementing our August 2007 recommendations—we reviewed relevant SEC and Enforcement documentation, including a report by the SEC Office of Inspector General on the Hub investigation management information system, the division’s Enforcement Manual, a user manual created for the Hub system, the agency’s fiscal year 2009 Congressional Justification, and documents detailing the organization and activities of SEC’s Office of Collections and Distributions (OCD). We also reviewed SEC’s strategic plan, federal internal control standards, and prior GAO reports on SEC and Enforcement processes and operations, including information technology systems and the Fair Fund program. We interviewed Enforcement management, former Enforcement management, the principal managers of OCD, and Office of Inspector General personnel. To address our second objective—the extent to which Enforcement has an appropriate mix of resources—we obtained data from SEC on Enforcement personnel and staffing levels, the division’s budget, number of enforcement cases opened annually, number of enforcement actions brought annually, case backlog, and distribution of types of enforcement actions filed. We also reviewed SEC’s strategic plan, its fiscal year 2009 Congressional Justification, annual Performance and Accountability reports, the division’s Enforcement Manual, annual Select SEC and Market Data reports, federal internal control standards, prior GAO work on SEC human capital issues, the Sarbanes-Oxley Act of 2002, and other Enforcement program documentation. We interviewed Enforcement management, former Enforcement management, former SEC commissioners and chairmen, private sector securities attorneys, academics, and others. We conducted 11 small group meetings with approximately 80 Enforcement investigative attorneys and branch chiefs in three regional offices of varying size—Chicago, San Francisco, and New York—plus SEC headquarters in Washington, D.C. Using agency data, we identified and invited participants to these meetings by random selection, and a GAO research contractor assisted us in conducting the sessions. While we spoke to a variety of Enforcement staff in small group meetings, the comments we received are not necessarily representative of the beliefs of all staff. To address our third objective—factors influencing the amount of penalties and disgorgements, and the total amount of these remedies in recent years—we obtained data from SEC on total annual amounts ordered in penalties and disgorgements, and corporate penalties ordered in individual cases. We also reviewed SEC news and litigation releases on enforcement actions filed, annual Performance and Accountability reports, and terms of the corporate penalty policies implemented in 2006 and 2007. Our focus was application of the policies, not the reasonableness or scope of their terms. For the 2007 policy, we reviewed penalty history for a number of cases: corporate penalty amounts as initially proposed by Enforcement staff; penalty ranges as approved by the Commission; and penalty amounts as cases were ultimately resolved. We also interviewed sources as indicated for our second objective, plus officials from SEC’s Office of Economic Analysis. To address our fourth objective—the adoption, implementation, and effects of the recent corporate penalty policies—we reviewed decision memorandums, in draft and final form, for a number of enforcement actions involving corporate penalties. We reviewed these memorandums for such matters as facts of a case, violations alleged, and penalties proposed and approved, but did not examine them in order to determine appropriateness of any particular action by either Enforcement staff or the Commission. We obtained SEC statistics on formal orders of investigation granted, and data on Commission consideration of enforcement actions in executive session. We reviewed terms of the 2006 and 2007 corporate penalty policies, SEC’s strategic plan, federal internal control standards, and previous GAO work detailing best practices for policy development. We queried a number of other commission-style federal regulatory agencies: the Federal Communications Commission, the Nuclear Regulatory Commission, the Federal Energy Regulatory Commission, the Consumer Product Safety Commission, the Commodity Futures Trading Commission, and the Equal Employment Opportunity Commission. We also interviewed sources as indicated for our third objective. We undertook this performance audit from August 2008 to February 2009, in accordance with generally accepted government auditing standards. These standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusion based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Karen Tremba, Assistant Director; Anthony Paras; Carl Ramirez; Linda Rego; Barbara Roesmann; and Christopher Schmitt made significant contributions to this report.

Summary: The Securities and Exchange Commission's (SEC) Division of Enforcement (Enforcement) plays a key role in meeting the agency's mission to protect investors and maintain fair and orderly markets. In recent years, Enforcement has brought cases yielding record civil penalties, but questions have been raised about its capacity to manage its resources and fulfill its law enforcement and investor protection responsibilities. GAO was asked to evaluate, among other issues, (1) SEC's progress toward implementing GAO's 2007 recommendations; (2) the extent to which Enforcement has an appropriate mix of resources dedicated to achieving its objectives; and (3) the adoption, implementation, and effects of recent penalty policies. GAO analyzed information on resources, enforcement actions, and penalties; and interviewed current and former SEC officials and staff, and others. SEC has fully implemented three of GAO's four 2007 recommendations. GAO recommended SEC establish procedures for approving new investigations and for operating its new investigation management information system called the Hub; consider procedures for closing inactive cases; and improve management of the Fair Funds program, which returns funds to harmed investors. Enforcement has developed the procedures for new investigations and for operating the Hub, and made case closings a higher priority. SEC has also staffed a new Office of Collections and Distributions (OCD), which is responsible in part for administering the Fair Funds program. However, OCD has a dual reporting structure in which most of the staff report to Enforcement, not the OCD director. According to OCD management, this structure has slowed work and confused staff. SEC strategic goals and GAO internal control standards call for making efficient and effective use of resources a priority. SEC's strategic plan also calls for improving program design and organizational structures. Recent overall Enforcement resources and activities have been relatively level, but the number of investigative attorneys has decreased 11.5 percent over fiscal years 2004 through 2008. Enforcement management said resource levels have allowed them to continue to bring cases across a range of violations, but both management and staff said resource challenges have delayed cases, reduced the number of cases that can be brought, and potentially undermined the quality of some cases. Specifically, investigative attorneys cited the low level of administrative, paralegal, and information technology support, and unavailability of specialized services and expertise, as challenges to bringing actions. Also, Enforcement staff said a burdensome system for internal case review has slowed cases and created a risk-averse culture. SEC's strategic plan calls for targeting resources strategically, examining whether positions are deployed effectively, and improving program design and organizational structure. Enforcement management has begun examining ways to streamline case review, but the focus is process-oriented and does not give consideration to assessing organizational culture issues. Enforcement management, investigative attorneys, and others agreed that two recent corporate penalty polices--on factors for imposing penalties, and Commission pre-approval of a settlement range--have delayed cases and produced fewer, smaller penalties. GAO also identified other concerns, including the perception that SEC had "retreated" on penalties, and made it more difficult for investigative staff to obtain "formal orders of investigation," which allow issuance of subpoenas for testimony and records. Our review also showed that in adopting and implementing the penalty policies, the Commission did not act in concert with agency strategic goals calling for broad communication with, and involvement of, the staff. In particular, Enforcement had limited input into the policies the division would be responsible for implementing. As a result, Enforcement attorneys reported frustration and uncertainty in application of the penalty policies.