One of the key  surveillance systems employed by SROs monitors the markets for insider  trading. OCIE administers SEC’s nationwide examination and inspection program. As part of these  inspections, OCIE takes steps to assess SRO surveillance systems, reviews  SRO policies and procedures for investigating potential violations and  disciplining violators of rules and laws, and reviews samples of SRO case  files to determine whether SRO staff were complying with the policies and  procedures. We discuss OCIE’s process for targeting  their routine inspections later in this report. OCIE also conducts special  inspections of SRO regulatory programs, as warranted. Special inspections  typically originate from a tip or need to follow up on past inspection  findings and recommendations. 1). Finally, OCIE  currently does not formally track the implementation status of inspection  recommendations, which ranged as high as 29 in the inspections that we  reviewed. By not establishing written  guidance for conducting inspections of SRO enforcement and other  regulatory programs, OCIE may be limiting its ability to ensure that its  inspection processes and products are subject to basic quality controls in  such areas as examination planning, data collection, and report review. By not considering the work and work products of SRO internal audit  functions in its inspection planning process, OCIE examiners may be  duplicating SRO efforts, causing regulatory burden, or missing  opportunities to direct examination resources to other higher-risk or less- examined program areas. Without a formal tracking system, OCIE  management must rely on staff’s availability and ability to recall  recommendation-related information, which may be reliable when  discussing an individual inspection, but may limit OCIE management’s  ability to efficiently generate and evaluate trend information, such as  patterns in the types of deficiencies found or the implementation status of  recommendations across SROs, or over time. These officials said that they expect to use this  spreadsheet until the previously described OIT projects are implemented in  2008. SRO Advisories and Referrals Have Increased, as Have Related SEC Investigations and Enforcement Actions, but Information Systems for Advisories and Referrals Have Limitations

Enforcement receives advisories and referrals, which undergo multiple  stages of review and may lead to opening an investigation, through an  electronic system in OMS. From fiscal years 2003 to 2006, OMS  received an increasing number of advisories and referrals from SROs, such  as NYSE and NASD, most of which involved insider trading. 2). Recommendations for Executive Action

To enhance SEC oversight of SROs, we recommend that the SEC Chairman  take the following three actions:  establish a written framework for conducting inspections of SRO  enforcement programs to help ensure a reliable and consistent source of  information on SRO inspection processes, minimum standards, and  quality controls; and, as part of this framework, broaden current  guidance to SRO inspection staff on the use of SRO internal audit  reports to direct examiners to consider the extent to which they will rely  on reports and reviews of internal and external audit and other risk- management systems when planning SRO inspections;  ensure that Market Regulation makes certain that SROs include in their  periodic risk assessment of their IT systems a review of the security of  their enforcement-related databases, and that Market Regulation  reviews the comprehensiveness and completeness of the related SRO- sponsored audits of their enforcement-related databases; and  as part of the agency’s ongoing efforts to improve information   ensure that any software developed for tracking SRO inspections  includes the ability to track and report SRO responses to and  implementation status of OCIE inspections recommendations and   consider system improvements that would allow Enforcement staff  to electronically access and search all information in advisories and  referrals submitted by SROs and generate reports that would  facilitate monitoring and analysis of trend information and case  activities. Scope and Methodology

To discuss the overall structure of the Securities and Exchange  Commission’s (SEC) inspection program—more specifically, its approach  to inspections of self-regulatory organizations’ (SRO) surveillance,  investigative, and enforcement programs (enforcement programs)—we  reviewed and analyzed documentation of all 11 inspections that SEC’s  Office of Compliance Inspections and Examinations (OCIE) completed  from March 2002 through January 2007 of enforcement programs related to  the former NASD and the New York Stock Exchange (NYSE). To describe the SRO referral process and recent trends in referral numbers  and related SEC investigations, and evaluate SEC’s information system for  advisories and referrals, we observed a demonstration from Enforcement  staff on the capabilities of their IT systems, analyzed data from SEC’s SRO  Referral Receipt System (SRO system) and Case Activity Tracking System  (CATS), and interviewed Enforcement, NASD, and NYSE staff to determine  how SEC manages the processes for receiving SRO referrals and  conducting subsequent investigations.
Why GAO Did This Study

Self-regulatory organizations (SRO) are exchanges and associations that operate and govern the markets, and that are subject to oversight by the Securities and Exchange Commission (SEC). Among other things, SROs monitor the markets, investigate and discipline members involved in improper trading, and make referrals to SEC regarding suspicious trades by nonmembers. For industry self-regulation to function effectively, SEC must ensure that SROs are fulfilling their regulatory responsibilities. This report (1) discusses the structure of SEC's inspection program for SROs, (2) evaluates certain aspects of SEC's inspection program, and (3) describes the SRO referral process and evaluates SEC's information system for receiving SRO referrals. To address these objectives, GAO reviewed SEC inspection workpapers, analyzed SEC data on SRO referrals and related investigations, and interviewed SEC and SRO officials.

What GAO Found

To help ensure that SROs are fulfilling their regulatory responsibilities, SEC's Office of Compliance Inspections and Examinations (OCIE) conducts routine and special inspections of SRO regulatory programs. OCIE conducts routine inspections of key programs every 1 to 4 years, inspecting larger SROs more frequently, and conducts special inspections (which arise from tips or the need to follow up on prior recommendations or enforcement actions) as warranted. More specifically, OCIE's inspections of SRO surveillance, investigative, and disciplinary programs (enforcement programs) involve evaluating the parameters of surveillance systems, reviewing the adequacy of policies and procedures for handling the resulting alerts and investigations, and reviewing case files to determine whether SRO staff are complying with its policies and procedures. GAO identified several opportunities for SEC to enhance its oversight of SROs through its inspection program. First, although examiners have developed processes for inspecting SRO enforcement programs, OCIE has not documented these processes or established written policies relating to internal controls over these processes, such as supervisory review or standards for data collection. Such documentation could strengthen OCIE's ability to provide reasonable assurances that its inspection processes and products are subject to key quality controls. Second, OCIE officials said that they focus inspections of SRO enforcement programs on areas judged to be high risk. However, this risk-assessment process does not leverage the reviews that SRO internal and external auditors performed, which could result in duplication of SRO efforts or missed opportunities to direct examination resources to other higher-risk or less-examined programs. OCIE officials told us that they plan to begin assessing SRO internal audit functions in 2008, including the quality of their work products, which would allow OCIE to assess the usefulness of these products for targeting its inspections. Finally, OCIE currently does not formally track the implementation status of SRO inspection recommendations; rather, management consults with staff to obtain such information as needed. Without formal tracking, OCIE's ability to efficiently and effectively generate and evaluate trend information, such as patterns in the types of deficiencies found or the implementation status of recommendations across SROs, or over time, may be limited. SEC's Division of Enforcement uses an electronic system to receive referrals of potential violations from SROs. These referrals undergo multiple stages of review and may lead Enforcement to open an investigation. From fiscal years 2003 to 2006, SEC received an increasing number of advisories and referrals from SROs, many of which involved insider trading. However, SEC's referral receipt and case tracking systems do not allow Enforcement staff to electronically search all advisory and referral information, which may limit SEC's ability to monitor unusual market activity, make decisions about opening investigations, and allow management to assess case activities, among other things.