SROs are responsible for the surveillance of the trading activity on their markets. Market transactions take place on electronic or floor-based platforms. SROs employ electronic surveillance systems to monitor market participants’ compliance with SRO rules and federal securities laws. Electronic surveillance systems are programmed to review trading and other data for aberrational trading patterns or scenarios within defined parameters. Also, SROs review trading as a result of complaints from the public, members, and member firms and as a result of required notifications, such as those concerning offerings. One of the key surveillance systems employed by SROs monitors the markets for insider trading. We discuss SRO surveillance systems and investigatory procedures related to insider trading in more detail in appendix II. SRO staff review alerts generated by the electronic surveillance systems to identify those that warrant further investigation. When SROs find evidence of potential violations of securities laws or SRO rules involving their members, they can conduct disciplinary hearings and impose penalties. These penalties can range from disciplinary letters to the imposition of monetary fines to expulsion from trading and SRO membership. SROs do not have jurisdiction over entities and individuals that are not part of their membership, and, as such, any suspected violations on the part of nonmembers are referred directly to Enforcement. SROs maintain records of their investigations and the resulting disciplinary actions as part of their internal case tracking systems. In addition, as part of their market surveillance efforts, SROs, such as NASD and NYSE, maintain databases with information on individuals and firms associated with suspicious trading activity, such as insider trading. NASD also maintains the Central Registration Depository, the securities industry online registration and licensing database. This database makes complaint and disciplinary information about registered brokers and securities firms available to the public and, in more detailed form, to SEC, other securities regulators, and law enforcement authorities. OCIE administers SEC’s nationwide examination and inspection program. Within OCIE, the Office of Market Oversight primarily focuses on issues related to securities trading activities, with the objective of evaluating whether SRO enforcement programs and procedures are adequate for providing surveillance of the markets, investigating potential violations, and disciplining violators under SRO jurisdiction. OCIE also inspects other SRO regulatory programs, which include, among others, arbitration, listings, sales practice, and financial and operational programs. As part of the latter, OCIE coordinates the compliance inspections of NASD’s district offices, which are responsible for examining broker-dealer members for compliance with SRO rules and federal securities laws. In cases where OCIE discovers potentially egregious violations of federal securities laws or SRO rules during an SRO inspection, it may refer the case to Enforcement, which is responsible for further investigating these potential violations; recommending Commission action when appropriate, either in a federal court or before an administrative law judge (ALJ); and negotiating settlements. SEC’s Market Regulation administers and executes the agency’s programs relating to the structure and operation of the securities markets, which include regulation of SROs and review of their proposed rule changes. SEC has delegated authority to Market Regulation for other aspects of SRO rulemaking as well, including the authority to publish notices of proposed rule changes and to approve proposed rule changes. OCIE conducts both routine and special inspections of SRO regulatory programs as part of its oversight efforts. We found that the SRO inspection process generally includes a planning phase, an on-site review of SRO programs, and a written report to the SRO documenting inspection findings and recommendations that is reviewed and approved by the Commission. OCIE typically staffs inspections with a lead attorney and from 2 to 6 other staff, who also work concurrently on at least 1 other SRO inspection. The number of staff dedicated to SRO inspections has fluctuated in recent years, but as of September 2007 totaled 46. According to OCIE officials, inspections of SRO enforcement programs are intended to assess the design and operation of SRO enforcement programs to determine if they effectively fulfill SRO regulatory responsibilities. As part of these inspections, OCIE takes steps to assess SRO surveillance systems, reviews SRO policies and procedures for investigating potential violations and disciplining violators of rules and laws, and reviews samples of SRO case files to determine whether SRO staff were complying with the policies and procedures. As part of its SRO oversight responsibilities, OCIE conducts both routine and special inspections of SRO regulatory programs. At regular intervals, OCIE conducts routine inspections of key regulatory programs, such as SRO enforcement, arbitration, examination, and listings programs. The inspection cycles are based on the size of the SRO market and the type of regulatory program, with key programs of larger SROs, such as NYSE and NASD, being inspected from every 1 to 2 years, and smaller regional SROs from every 3 to 4 years. Inspection of enforcement programs typically include a review of SRO surveillance programs for identifying potential violations of trading rules or laws, investigating those potential violations, and disciplining those who violate the rule or law. While sometimes OCIE conducts a comprehensive review of these programs, especially at the smaller SROs, often these inspections focus on a specific aspect of the programs, such as fixed income. We discuss OCIE’s process for targeting their routine inspections later in this report. OCIE also conducts special inspections of SRO regulatory programs, as warranted. Special inspections typically originate from a tip or need to follow up on past inspection findings and recommendations. Special inspections also can include sweep inspections, where OCIE probes specific activities of all SROs or a sample of them to identify emerging compliance issues. According to OCIE officials, some aspect of every SRO is generally examined every year through a routine examination of a specific regulatory program or through a special inspection. OCIE’s inspection process for SROs generally includes a planning phase, an on-site review and analysis, and a final inspection report to the SRO (see fig. 1). During inspection planning, OCIE identifies the SRO program to be inspected and assigns staff who conduct initial research on the program, prepare materials for each individual inspection on the basis of the inspection’s focus, and draft a planning memorandum. In preparation for the on-site inspection, OCIE typically sends an initial document request to the SRO, asking for general program information such as organizational charts and copies of SRO policies and procedures or, if OCIE is reviewing a surveillance program, logs of alerts and the resulting investigations. We discuss OCIE’s review of enforcement programs in more detail later in this section. After reviewing the documents provided, staff plan the on-site phase of the inspection, which can include additional requests for specific documents, such as case files, to be made available for review while on- site. OCIE staff typically spends 1 week on-site interviewing SRO staff and reviewing SRO case files and other documentation. After the on-site visit, OCIE staff continue their analysis in the home office; conduct follow-up interviews or request additional documentation, as needed; and begin drafting the inspection report. Staff present their initial inspection findings and recommendations to the SRO in an exit interview and incorporate initial SRO responses into the draft inspection report. Once the report is drafted, staff then circulate it to other interested SEC divisions and offices—such as the Office of General Counsel, Market Regulation, or Enforcement—for their review and comment, and then submit the report to the Commission for review. Following Commission consideration and authorization, staff issue a nonpublic report to the SRO and request that the SRO respond in writing within a specified time frame, typically 30 days. According to OCIE officials, they staff SRO inspections with a lead attorney and from 2 to 6 other staff reporting to an OCIE branch chief. These individuals are typically staffed concurrently on at least 1 other SRO inspection. As shown in table 1, as of September 2007, the SRO inspection group consisted of 46 staff, including 14 managers, 29 examiners, and 3 other support staff. Of the 32 examiners and support staff, 16 are dedicated to market oversight inspections. Table 1 shows that between fiscal years 2002 and 2005, SRO inspection staffing increased from 36 to 62, or 72 percent. OCIE staff said that this increase was largely due to the increase in funding SEC received as a result of the Sarbanes-Oxley Act of 2002. Since then, SRO inspection staffing has declined from 62 to 46, or 26 percent, which OCIE officials attributed to staff attrition and the inability of OCIE to hire replacements during a SEC- wide hiring freeze that occurred from May 2005 to October 2006. OCIE officials stated that despite the decrease in staff numbers, they have continued to conduct routine inspections on schedule, although the inspections may last longer than usual. Also, they said that they have not been able to do as many special inspections as they otherwise would have conducted. OCIE officials told us that the SRO inspection group recently received 6 additional professional staff positions, which it is now in the process of filling. According to OCIE officials, inspections of SRO enforcement programs are intended to assess the design and operation of SRO enforcement programs to determine whether they effectively identify violations, enforce compliance among members, and follow their own procedures. More specifically, OCIE officials said that when inspecting SRO surveillance programs, their objectives are to determine whether (1) the parameters of SRO electronic surveillance systems are appropriately designed to generate exceptions that identify potential instances of noncompliance with SRO rules and federal securities laws and (2) the systems are effectively detecting such activity. When reviewing SRO surveillance systems, OCIE begins by asking the SRO for copies of the exchange rules that it is required to enforce, a description of the coding behind the surveillance systems designed to monitor the markets for compliance with these rules, and logs of the alerts that these systems generated.