The Office of Compliance Inspections and Examinations (OCIE) administers SEC’s nationwide examination and inspection program for registered SROs, broker-dealers, transfer agents, clearing agencies, investment companies, and investment advisers. OCIE conducts examinations and inspections to improve compliance, prevent fraud, monitor risk, and inform policy. Individual groups in OCIE have oversight responsibility for the various registered entities. The FINRA and Securities Industry Oversight (FSIO) program within OCIE performs examinations of FINRA and the Municipal Securities Rulemaking Board, an SRO that regulates the municipal bond market. As part of its FINRA oversight activities, FSIO conducts four types of reviews that may involve Section 964 areas. Program inspections are reviews of FINRA operations and program areas (for example, FINRA’s review of applications by broker-dealers seeking to become members). Oversight examinations are single, stand-alone examinations of specific examinations that FINRA conducts of its member firms. FSIO initiates an oversight examination when its examinations of a broker- dealer find deficiencies FSIO believes should have been identified by FINRA in its own examination of the broker-dealer. Thematic oversight examinations are a series of oversight examinations that evaluate FINRA’s review of a particular regulatory area across a number of its member firms. Tips, complaints, and referrals are allegations or statements of concern about possible violations of securities laws or risky conduct received by SEC. FSIO reviews FINRA-related tips, complaints, and referrals by evaluating facts and circumstances and conducting background research. The reviews may result in FINRA-related inspections or examinations or may be used for inspection planning purposes. To help identify the FINRA programs and topics that it will review, FSIO uses a risk-based approach that includes an annual assessment of high- risk areas and consideration of the areas specified in Section 964. According to SEC staff, FSIO also conducts ongoing monitoring of FINRA’s activities through reviews of information provided by FINRA and meetings with FINRA officials. Generally accepted government auditing standards define performance audits as those that provide findings or conclusions based on an evaluation of sufficient, appropriate evidence against criteria. Performance audit objectives can include assessments of program effectiveness, economy, and efficiency; internal control; compliance; and prospective analyses. SEC’s examinations of SROs share many of the attributes of performance audits, including their objectives. For example, examinations (including inspections) of FINRA enable FSIO staff to evaluate compliance with applicable laws and regulations; FINRA rules, regulations, or by-laws; or both. Although SEC is not required to follow the auditing standards when examining SROs, these standards and guidance provide a framework for conducting high-quality reviews that can serve as useful criteria in evaluating a regulatory agency’s examination or inspection programs. Areas of generally accepted government auditing standards relevant to SRO examinations include independence, competence, quality control and assurance, planning, supervision, evidence, documentation, and reporting: Independence refers to the audit organization and individual auditor’s need to be independent and include documentation proving independence. Competence refers to the extent to which audit staff collectively should possess adequate professional competence and technical knowledge, skills, and expertise. Quality control and assurance refers to a system of quality control that an organization should establish that is designed to provide the organization with reasonable assurance that its personnel comply with professional standards and legal requirements. Planning includes creating a written audit plan for each audit. Supervision requirements include sufficient guidance and direction to the staff assigned to the audit to address the audit objectives and follow applicable requirements, while staying informed about significant problems encountered, reviewing the work performed, and providing effective on-the-job training. Evidence refers to sufficient, appropriate evidence to provide a reasonable basis for the auditor’s findings and conclusions. Audit documentation requirements state that auditors must prepare documentation related to planning, conducting, and reporting for each audit. Finally, communication of the results entails auditors issuing audit reports. Since fiscal year 2015, SEC examinations related to FINRA included reviews of all areas identified in Section 964. We determined that FSIO completed at least one examination covering each of the Section 964 areas since fiscal year 2015 (see table 1). In total, FSIO began or completed 61 examinations (program inspections, oversight examinations, and thematic oversight examinations) related to FINRA programs and operations in that period. Some examinations evaluated other aspects of FINRA’s programs and operations (those not specifically identified in Section 964), such as market surveillance and restitution for harmed investors. FSIO examinations either focused on a single Section 964 area or considered multiple areas. Some examinations focused specifically on a single Section 964 area. For example, in 2017 FSIO reviewed FINRA’s arbitration program, which provides retail investors a venue for resolving disputes with their brokers. Other examinations considered one or more of the areas as part of a broader scope. For instance, a program inspection completed in 2016 touched on FINRA’s arbitration services, cooperation with state securities regulators, transparency, and other topics. Another program inspection involved governance, policies on former employees, and other topics. FSIO examinations most frequently covered FINRA examinations (41 of 61). Nearly all of the oversight examinations reviewed at least some aspect of FINRA examinations. In two cases, the oversight examinations also covered another area—review of advertising by FINRA members. We found that OCIE policies and procedures used for examining FINRA since fiscal year 2015 generally were consistent with the requirements of generally accepted government auditing standards. SEC uses an examination manual to conduct its SRO examinations. We previously found that OCIE policies and procedures (including the prior version of the manual) generally were consistent with the requirements of the auditing standards that we determined were most relevant to assessing examination policies and procedures: independence, competence, quality control and assurance, planning, supervision, evidence, documentation, and reporting. We compared the current and prior versions of the examination manual. More specifically, we selected requirements for planning, prefieldwork scoping, and communicating findings from the current manual and compared those with similar sections in the prior version of the manual. We found that the new version includes the same material as the prior version while also incorporating additional guidance in certain areas. The planning section of the current version includes two additional requirements on the inclusion of non-National Examination Program staff. The communicating findings section of the current version included two additional requirements related to extensions of time to respond to disposition letters. Two of the four additional requirements were generally consistent with government auditing standards, and the remaining two additional requirements were minor adjustments that did not materially change the requirements. Therefore, we deemed the selected sections of the current version of the manual to also be consistent with the auditing standards. OCIE (and from 2016, FSIO) program inspections of FINRA governance in fiscal years 2015–2017 were consistent with internal examination guidance. OCIE identified five inspections in that period that related to FINRA governance. Each of the inspections focused on one of the following areas: (1) code of conduct, (2) executive and employee compensation practices, (3) investment portfolio, (4) compliance resource provider program, and (5) the funding mechanism for its regulatory services agreement. FINRA’s code of conduct imposes restrictions on employees’ investments and requires financial disclosures that are uniquely related to its role as a securities regulator. The code also outlines FINRA’s ethical commitments and expectations and provides guidance on what employees must do to meet them. FINRA’s executive and employee compensation practices consist of salary and incentive compensation determined by FINRA’s Management Compensation Committee using operational, strategic, and financial factors, in addition to individual performance. FINRA’s investment portfolio is governed by a policy based on the degree of risk appropriate for FINRA assets, as applied by its board to its investment objectives. In the compliance resource provider program, FINRA worked with organizations to offer firms compliance-related products and services at a discounted price or with additional features. According to FINRA staff, this program was discontinued in May 2017 and replaced with FINRA’s Compliance Vendor Directory. FINRA’s regulatory service agreements are designed to provide market surveillance, financial surveillance, examinations, investigations, and disciplinary services to other entities, including the New York Stock Exchange LLC and the Chicago Board Options Exchange. For our review, we judgmentally selected the most relevant requirements from the section of the examination manual related to planning inspections and the most relevant requirements from the section of the manual related to communicating inspection findings to determine if OCIE conducted the inspections in accordance with its guidance. The planning section covers planning examinations and prefieldwork scoping and requires the examination team to discuss the results of background research and determine an appropriate scope for the examination as early as possible. The communicating findings section requires entities to be provided with timely and concise communications on the results. It also discusses how examination staff should take further actions for those findings that could involve notifications to other regulators. We reviewed relevant inspection-related documentation (including scope memorandums, disposition letters, emails, and information extracted from an examination database) and compared them against the selected requirements to determine if the guidance was followed. We tallied our results with a scorecard methodology (see fig. 1). We found that all five inspections we reviewed met all requirements applicable to that particular inspection. For example, across all the inspections, OCIE examiners held prefieldwork meetings and documented and received approval for the scope of the examinations. Additionally, all five inspections met the required 180-day completion deadline and closed the inspection with a disposition letter. In cases in which requirements were not applicable, the reasons generally were that a triggering event had not occurred and no further action was needed. For instance, the scope was not modified in any of the inspections, so the requirement for approval of such modifications did not apply. Furthermore, none of the inspections included non-National Examination Program staff (such as personnel from SEC’s Enforcement Division), and so requirements surrounding participation by those groups did not apply. We provided a draft of this report to SEC for their review and comment. In its comment letter, which is reprinted in appendix II, SEC concurred with our findings and appreciated our attention to the issues discussed in the report. SEC also provided technical comments on the draft report, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Securities and Exchange Commission, the Financial Industry Regulatory Authority, Inc., and other interested parties. In addition, this report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. This report (1) determines if the Securities and Exchange Commission’s (SEC) oversight of the Financial Industry Regulatory Authority, Inc.’s (FINRA) operations and programs since fiscal year 2015 included the 10 areas specified in Section 964 of the Dodd–Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), (2) evaluates the extent to which selected SEC internal guidance on conducting examinations of FINRA follows generally accepted government auditing standards, and (3) evaluates the extent to which examinations of FINRA’s governance practices followed SEC’s internal guidance. To assess whether oversight of FINRA by SEC’s Office of Compliance Inspections and Examinations (OCIE) included the Section 964 areas, we requested and reviewed documentation for all examinations since fiscal year 2015 (from October 2014 through April 2018) that OCIE staff identified as relating to Section 964 areas. We use the term “examination” to include program inspections, two types of oversight examinations, and oversight activities stemming from tips and referrals. The documentation included scope memorandums, deficiency letters, and closing letters to the file for OCIE examinations. We evaluated whether the documentation indicated that an examination’s scope and findings covered one or more Section 964 areas or included other areas related to FINRA oversight that were not specified in Section 964. To determine the extent to which OCIE’s internal guidance on conducting examinations of FINRA followed generally accepted government auditing standards, we compared SEC’s examination manual against generally accepted auditing standards. We reviewed selected sections of the current version of the manual and the earlier version. We judgmentally selected the two sections that most directly related to our focus on self- regulatory organization (SRO) inspections, which focused on preparing for examinations and communicating examination findings. Other areas of the examination manual that were not relevant focused on administration and organizational issues. We relied on our work that found that the earlier version of the manual followed the auditing standards and also interviewed pertinent staff within OCIE to discuss the guidance and why it did or did not include certain elements. We analyzed any differences between the versions to determine whether changes or additions in the current version of the manual also followed auditing standards. In addition, we interviewed FINRA staff to gain a general understanding of how OCIE staff work with them to conduct examinations. To determine the extent to which OCIE’s program inspections of FINRA’s governance in fiscal years 2015–2017 followed OCIE’s internal guidance, we used a scorecard methodology to compare inspections of FINRA’s governance with the examination manual and draft updates. We only reviewed the extent to which examinations followed specified guidelines and did not evaluate the analysis, findings, or disposition of the examinations. We created a checklist of relevant elements from the examination manual by judgmentally selecting 6 requirements from the planning inspections section of the manual and 11 requirements from the communicating findings section of the manual that were most applicable to our focus on the actual SRO inspection process. Other requirements that we deemed less relevant include examinations of exempt reporting advisers and the process for approving examination documents. The planning section of the manual covers planning examinations and prefieldwork scoping and requires the examination team to discuss the results of background research and determine an appropriate scope for the examination as early as possible. The communication of examination findings section requires entities to be provided with timely and concise communications on the results. It also discusses how examination staff should take further actions for those findings that could involve notifications to other regulators. We then reviewed different types of inspection-related documentation to determine whether the guidance was followed. For instance, we assessed certain inspection requirements, such as compliance with changing the scope of the inspection, based on formal written documentation such as scope memorandums and disposition letters. We assessed other requirements (such as whether prefieldwork team meetings were held) based on informal documentation, such as email appointments. We also relied on other internal documentation, which included the examination tracking database, which is used to certify compliance with a requirement to complete an inspection within 180 days from the completion of audit work. Two analysts then independently compared the elements against documentation for the five OCIE inspections to determine the extent to which the inspections documented the requirements outlined in the examination manual. Analysts assigned a rating of “yes” if the element was found in the inspection materials we reviewed, “no” if there was no mention of the element in the inspection materials we reviewed, “partially” if the element was not fully addressed in the inspection materials we reviewed, and “n/a” if the element was not applicable to the inspection. We also interviewed pertinent staff within OCIE to discuss the guidance and why it did or did not include certain elements. We conducted this performance audit from November 2017 to July 2018 in accordance with generally accepted government auditing standards. These standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Karen Tremba (Assistant Director), Jon D. Menaster (Analyst in Charge), Kevin Averyt, Farrah Graham, Marc Molino, Akiko Ohnuma, Barbara Roesmann, and Jessica Sandler made key contributions to this report.

Summary: The securities industry is generally regulated by a combination of federal and industry oversight. FINRA, a self-regulatory organization, is responsible for regulating securities firms doing business with the public in the United States. SEC oversees FINRA's operations and programs. Section 964 of the Dodd-Frank Act includes a provision for GAO, following an initial report, to triennially review and report on aspects of SEC's oversight of FINRA. GAO issued its first report in May 2012 ( GAO-12-625 ) and its second report in April 2015 ( GAO-15-376 ). This report (1) determines if SEC's oversight of FINRA included the 10 areas specified in Section 964 of the Dodd-Frank Act and (2) evaluates the extent to which selected SEC internal guidance for examinations of FINRA follows generally accepted government auditing standards and the extent to which SEC's examinations of FINRA's governance practices followed SEC internal guidance. GAO reviewed all SEC examinations relating to a Section 964 area completed since fiscal year 2015 (including five that were governance-related), reviewed certain SEC procedures used to examine self-regulatory organizations against Government Auditing Standards , and compared completed inspections against SEC guidance. GAO also interviewed SEC and FINRA staff. Since fiscal year 2015, Securities and Exchange Commission (SEC) examinations of the Financial Industry Regulatory Authority, Inc. (FINRA) covered each of the 10 areas specified in Section 964 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), such as governance, funding, and transparency. The most commonly covered area was FINRA examinations of its members. Selected SEC guidance used to examine FINRA, including requirements for planning, prefieldwork scoping, and communicating findings, was consistent with generally accepted government auditing standards, and SEC inspections of FINRA were consistent with SEC's guidance. The five governance-related inspections of FINRA that GAO reviewed were consistent with SEC guidance for planning examinations and communicating findings (see fig.). Not all the requirements were applicable (because in certain instances completion of one requirement eliminated the need to satisfy others). GAO is not making any recommendations. SEC agreed with GAO's findings.