; and (ii) the amount of IT spending in proportion to each regulator’s total spending; (B) examining the quality and effectiveness of the Commission’s IT contracting; (C) determining if the Commission’s data and cybersecurity systems and procedures are sufficient; and (D) examining any recent Commission IT or data events, such as breaches or hacks, that may have compromised the Commission’s IT infrastructure or exposed a vulnerability; and (2) provide to the Commission, the Committee on Financial Services of the House of Representatives, and the Committee on Banking, Housing, and Urban Affairs of the Senate a report containing— (A) all findings and determinations made in conducting the audit; and (B) recommendations for steps that can be taken to improve the Commission’s IT infrastructure. IV Review the Expansion of Government 401. Periodic review of final rules required Section 4 of the Securities Exchange Act of 1934 ( 15 U.S.C. 78d ), as amended by section 201, is further amended by adding at the end the following: (m) Periodic review of final rules required (1) In general With respect to a final rule issued by the Commission, the Commission shall review such rule not later than 5 years after the date on which such final rule is issued, and every 5 years thereafter, to determine if any revision (including a rescission) to the rule is necessary or appropriate— (A) to facilitate capital formation; (B) to maintain fair and orderly markets