The Exchange Act provides SEC with broad authority over the securities industry, including the power to register, regulate, and oversee participants in securities markets. Section 15A of the Exchange Act established a system of SEC registration for national securities associations and includes general criteria that a national securities association must satisfy in order to be registered and to maintain its registration. These criteria include that the association must be so organized and have the capacity to carry out the purposes of the Exchange Act and to enforce compliance by its members and persons associated with its members with the rules and regulations of the Exchange Act and the rules of the association. Section 19 of the Exchange Act outlines the registration, responsibilities, and oversight of SROs, including the review and approval or disapproval of SRO rules, and includes registered securities associations in the definition of “self- regulatory organization.” One key aspect of SEC’s oversight of FINRA, a registered national securities association, is the authority provided to SEC under Section 17 of the Exchange Act to require, by rule, FINRA to make, and keep such records as SEC prescribes as necessary and appropriate and to make all records of FINRA available to SEC for examination. SEC oversees SROs primarily through the review of SRO rules, which is delegated to and coordinated by the Division of Trading and Markets (Trading and Markets) and through inspections led by OCIE. Specifically, Trading and Markets takes the lead role in SEC’s review and subsequent approval or disapproval of SRO proposed rules and proposed changes to existing rules, including those submitted by FINRA, based on findings that a rule or rule change is consistent with the Exchange Act and the rules and regulations thereunder applicable to the SRO. OCIE administers SEC’s nationwide examination and inspection program for registered SROs, broker-dealers, transfer agents, clearing agencies, investment companies, and investment advisers. OCIE conducts examinations and inspections to improve compliance, prevent fraud, monitor risk, and inform policy. Individual groups in OCIE have oversight responsibility for the various registered entities (see fig. 1). Market Oversight in OCIE oversees 18 exchanges and four other entities, including FINRA, primarily through inspections and monitoring of SRO programs and operations. As of March 1, 2015, 34 OCIE employees were assigned to Market Oversight. In our 2012 report on the extent to which SEC conducted oversight of the areas listed in Section 964 of the Dodd-Frank Act, we found that oversight varied and that OCIE was moving from routine, or cycle-based inspections—inspections that occur at regular intervals of time—to a more risk-based approach. With the transition to a more risk-based inspection process, OCIE officials stated that they were focusing resources on the most critical and high-risk areas for oversight of FINRA and other SROs. At the time of our report, OCIE was analyzing information it collected on FINRA’s regulatory programs and operations (including Section 964 areas) and planned to implement its enhanced risk-based oversight of FINRA later in 2012. We also found that OCIE’s approach to developing and implementing a risk-based approach to oversight of FINRA did not follow all the components of a risk-management framework identified in our prior work. We recommended that OCIE follow all components of a risk-management framework as it developed its approach. SEC generally agreed with our recommendation and has taken some steps to further incorporate the components into its risk-based approach, such as its risk-assessment process described later in this report. Our risk-management framework for federal oversight efforts has five components (described as follows and shown in fig. 2). Strategic goals, objectives, and constraints identification: identifying the strategic goals that an agency is trying to achieve and the steps needed to attain those goals, including determining limitations or constraints that can affect the desired outcomes. Risk assessment: identifying the key aspects of potential risk. Alternatives evaluation: considering measures to reduce the identified risks. Management selection: management selecting where resources and investments will be made based on selecting the appropriate alternatives for reducing risks. Implementation and monitoring: applying and monitoring the selected alternatives for reducing risk to help ensure ongoing effectiveness, including the implementation of new policies, procedures, and controls and how these procedures are documented and maintained. We developed the framework based on criteria that include GAO best practices, OMB circulars, Standards for Internal Control in the Federal Government, and the Government Performance and Results Act of 1993 (GPRA). The risk-management framework is designed to be applied at various organizational levels, including that of a program. Risk management is a widely endorsed strategy for helping managers to make decisions about allocating finite resources and take actions under conditions of uncertainty. The process of risk management provides the rigor and structure necessary to identify and select among alternative risk responses (the cumulative effect of which is intended to reduce risk). Risk management interrelates to an entity’s governance, performance management, and internal controls. Other federal financial regulators, such as the Federal Reserve and FHFA, also employ a risk-based approach to oversight and examinations. Under a risk-based approach, those activities judged to pose the highest risk are to receive the most scrutiny by examiners. As we have reported in the past, regulators face a number of challenges in implementing a risk-based approach. One key challenge, inherent in the design of a risk-based approach, is how to identify the aspects of an entity on which the examiner’s attention should be concentrated. Another is ensuring that examiners’ risk assessments are not overly influenced by the regulated entity’s risk-management systems on which they, at least in part, rely. Since our 2012 report, Market Oversight has made further progress in transitioning its FINRA oversight program to a risk-based approach, including assessing the risk of various FINRA programs and using the assessment results to inform its oversight activities. However, the oversight program continues to lack elements of certain components of GAO’s risk-management framework, namely setting specific performance goals and measures, establishing procedures for certain elements of its process, and conducting assessments of internal risks. Market Oversight uses an annual risk assessment to make the initial determinations on which FINRA programs and operations will receive oversight and of what type of oversight, such as inspections and monitoring. Potential programs and operations that receive scrutiny include, for example, market regulation programs, enforcement programs, and areas listed under Section 964 of the Dodd-Frank Act. Under a risk- based approach, the programs and operations judged to pose the greatest risk generally receive the most scrutiny. For example, a program or operation deemed high-risk might receive an inspection, while a low- risk program or operation might receive monitoring. According to Market Oversight’s guidelines for assessing FINRA program risks, the annual FINRA risk assessment encompasses (1) risk identification and analysis, (2) control environment assessment, and (3) risk-level determination (see fig. 3). As risks are identified and assessed, Market Oversight documents its risk-level determinations and oversight recommendations in a risk- assessment document. Staff and management then work together to develop the annual inspection plan. According to Market Oversight staff, in developing the inspection plan, they review a variety of information, including the FINRA risk-assessment document; obtain input from Market Oversight management, other SEC offices and divisions, and the Commission; and consider Market Oversight’s available resources. The inspection plan documents the SRO programs and operations, including FINRA programs and operations, that Market Oversight plans to inspect that year. The associate director of Market Oversight approves the inspection plan and discusses the plan with OCIE senior management. Other oversight determinations, such as monitoring, are documented on the risk-assessment document. Throughout the year, Market Oversight staff and management determine necessary adjustments to planned FINRA oversight activities based on information they collect. Staff stated that if, for example, FINRA’s enforcement program was not included in the original inspection plan, but staff later observed a change in the pattern or trend of new FINRA enforcement cases, staff and management might determine it necessary to inspect FINRA’s enforcement program. The information that Market Oversight collects throughout the year could include findings from Market Oversight’s inspections, FINRA internal audit reports, tips, complaints, and referrals, and news stories. Market Oversight’s oversight activities of FINRA for fiscal year 2014 generally corresponded with planned oversight activities. As shown in figure 4, Market Oversight initially identified 12 areas for oversight in 2014. During the course of the year, they added two FINRA areas for inspection and determined not to conduct inspections of three FINRA areas that were in the original inspection plan. Market Oversight added the two FINRA areas for inspection based on information that it had collected during its monitoring of these two areas. According to Market Oversight staff, two of the three FINRA areas were removed from the inspection plan because insufficient time had elapsed since FINRA initiated the program to start an inspection in fiscal year 2014. The third planned inspection was moved to fiscal year 2015 because Market Oversight was obtaining additional input from the Commission during 2014. Market Oversight’s risk-assessment process is generally similar to the risk-assessment component outlined in our risk-management framework as well as the risk-assessment processes of other federal financial regulators. For example, the Federal Reserve and FHFA require examiners to identify the regulated entity’s risks, review and assess the controls that the entity has in place to mitigate those risks, and determine the level of risk that cannot be mitigated with existing controls.