We also found that OCIE’s approach to developing  and implementing a risk-based approach to oversight of FINRA did not  follow all the components of a risk-management framework identified in  our prior work. SEC  generally agreed with our recommendation and has taken some steps to  further incorporate the components into its risk-based approach, such as  its risk-assessment process described later in this report. Risk  management interrelates to an entity’s governance, performance  management, and internal controls. FINRA Oversight Program Lacks Elements of an Effective Risk- Management Framework

Since our 2012 report, Market Oversight has made further progress in  transitioning its FINRA oversight program to a risk-based approach,  including assessing the risk of various FINRA programs and using the  assessment results to inform its oversight activities. As risks are identified and assessed, Market Oversight documents its  risk-level determinations and oversight recommendations in a risk- assessment document. However, as discussed earlier, our 2012  report described the components of our risk-management framework and  recommended that as Market Oversight developed its risk-based  approach, it should follow all components of a risk-management  framework. Furthermore, OCIE created and filled, within Market Oversight, the  position of Senior Special Counsel-FINRA and New Markets to monitor  FINRA generally and coordinate its FINRA oversight activities. OCIE also has transitioned its FINRA district office inspections to a risk- focused model and centralized responsibility for the inspections in Market  Oversight. According to Market Oversight  documents, in making recommendations to management as to which  FINRA district offices to inspect in the most recent round of inspections,  staff reviewed information and data requested from FINRA regarding  general organization, regulatory operations, enforcement program,  cooperation with state securities regulators, and internal auditing of  FINRA’s 15 district offices, among others. Market Oversight documents also show that staff analyzed a variety of  information in making their recommendations, such as the number of  cause examinations and enforcement matters, the number of branch  offices, and the number of high-risk firms in a district office’s jurisdiction. Planning

Government Auditing Standards require a written audit plan for each  audit. As a result, they considered this method to be  generally consistent with the guidelines. SEC has taken steps to enhance its oversight of FINRA, which  include completing inspections of all 10 Section 964 areas, incorporating  oversight of these areas into inspections of other FINRA programs and  operations, and conducting risk assessments to inform its oversight  activities. Recommendations for Executive Action

To improve SEC’s FINRA oversight program, the SEC Chair should direct  the appropriate offices and divisions to incorporate additional risk- management practices by taking several actions, including: establishing specific performance goals for the program and  performance measures and related targets to assess Market  Oversight’s progress in meeting those goals;  formalizing documentation of procedures, including procedures for  making changes to the annual planned oversight activities and  decision-making rationales; and modifying existing risk-assessment procedures to require an  assessment of internal risks to successfully meeting the FINRA  oversight program’s goals and objectives. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) assess the Securities and Exchanges  Commission’s (SEC) implementation of its risk-based approach for  overseeing the Financial Industry Regulatory Authority (FINRA), (2)  review oversight of FINRA operations and programs, and (3) assess  recent inspections of areas listed in Section 964 of the Dodd-Frank Wall  Street Reform and Consumer Protection Act (Dodd-Frank Act). We also reviewed procedures for FINRA  district office inspections and memorandums for district office selection. Finally, we interviewed FINRA  officials to obtain general information on SEC’s oversight of FINRA. To assess OCIE’s oversight of FINRA programs and operations listed  under Section 964 of the Dodd-Frank Act, we analyzed OCIE policies and  procedures (for conducting inspections of self-regulatory organizations)  that guided the inspections of the FINRA programs and operations listed  in Section 964 (Section 964 area inspections) to determine if they were  consistent with Government Auditing Standards.
Why GAO Did This Study

The securities industry is generally regulated by a combination of federal and industry regulation and oversight. FINRA, a self-regulatory organization, is responsible for regulating securities firms doing business with the public in the United States. SEC oversees FINRA's operations and programs.
Section 964 of the Dodd-Frank Act mandates GAO to triennially review and report on aspects of SEC's oversight of FINRA. GAO issued its first report in May 2012 ( GAO-12-625 ). This report (1) assesses SEC's implementation of a risk-based framework for overseeing FINRA; (2) reviews SEC oversight activities of FINRA operations; and (3) assesses recent inspections of areas listed in Section 964.
GAO reviewed and compared SEC documentation on its risk-based oversight with generally accepted risk-management frameworks, and performance management and internal control standards. GAO analyzed SEC inspection procedures for self-regulatory organizations and inspections of four Section 964 areas, against Government Auditing Standards . GAO selected the four inspections partly based on SEC's FINRA risk assessment and frequency of SEC oversight. GAO also interviewed SEC and FINRA officials.

What GAO Found

Since GAO reported in May 2012, the Securities and Exchange Commission (SEC) has incorporated elements of a risk-management framework into its oversight program of the Financial Industry Regulatory Authority (FINRA). For example, SEC has developed and implemented procedures for identifying and assessing FINRA program risks, which then inform its annual oversight plan and activities for FINRA. In 2012, GAO found that SEC's approach to developing a risk-based approach to oversight of FINRA did not incorporate all the components of a risk-management framework. GAO recommended that SEC follow all components of a risk-management framework. While SEC has taken some actions, this report found that SEC's risk-based oversight program could be more robust and consistent with risk-management and federal internal control standards. Specifically, SEC has yet to
develop specific performance goals and measures, with corresponding targets to monitor its progress toward the goal of enhancing FINRA oversight;
formalize procedures for documenting its oversight determinations, such as selecting FINRA areas for inspections and any changes made to planned oversight activities; and
Complementary to its implementation of risk-assessment procedures to assist in selecting FINRA programs and operations for oversight, SEC also has taken a number of other steps to enhance its oversight of FINRA. One such step was creating and filling the position of Senior Special Counsel-FINRA and New Markets to work with SEC management in coordinating FINRA oversight activities and reviewing information to inform the risk assessment. Another step was the transition of its FINRA district office inspections, which evaluate various FINRA regulatory programs, from a set schedule (or cycle-based) model to a risk-focused model. Under this risk-focused model, staff analyze information and data, such as the number of high-risk firms in a district, to identify risks and make recommendations for which offices to inspect. A third step SEC took was revising its process for assessing FINRA's broker-dealer examinations to inform its assessment of FINRA program risks.
SEC also recently completed inspections of each of the areas listed in Section 964 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), such as governance and executive compensation. The inspections GAO reviewed were conducted in a manner generally consistent with Government Auditing Standards and the information gathered was further used to inform SEC's FINRA risk assessment. GAO did not validate the findings of the Section 964 area inspections it selected for review.

What GAO Recommends

SEC should establish specific performance goals and measures, enhance documentation of oversight determinations and changes, and conduct an assessment of internal risks. In response, SEC described the actions they plan to take.