Opinion on Internal Control

Because of the material weakness and significant deficiencies in internal  control discussed below, SEC did not maintain effective internal control  over financial reporting as of September 30, 2007, and thus did not have  reasonable assurance that misstatements material in relation to the  financial statements would be prevented or detected on a timely basis. Although certain compliance controls should be improved, SEC  maintained, in all material respects, effective internal control over  compliance with laws and regulations as of September 30, 2007, that  provided reasonable assurance that noncompliance with laws and  regulations that could have a direct and material effect on the financial  statements would be prevented or detected on a timely basis. In our prior year audit, we reported on weaknesses we identified in the  areas of SEC’s (1) recording and reporting of disgorgements and penalties,  (2) information systems controls, and (3) property and equipment  controls. During fiscal year 2007, SEC improved its controls over the  accuracy, timeliness, and completeness of the disgorgement and penalty  data and used a much improved database for the initial recording and  tracking of these data. However, the processing of these data for financial  reporting purposes is still done through a manual process that is prone to  error. We found that the internal controls that compensated for the  manual processing of the related accounts receivable balances in fiscal  year 2006 were not effective in fiscal year 2007. This issue is included in  the material weakness in SEC’s financial reporting process for fiscal year  2007. Therefore, we consider information security to be a significant deficiency  as of September 30, 2007. In addition, we continued to identify the same  weaknesses in controls over property and equipment during this year’s  audit, and therefore, we considered this area to be a significant deficiency  as of September 30, 2007. Although SEC had one material weakness and three significant control  deficiencies in internal control, SEC’s financial statements were fairly  stated in all material respects for fiscal years 2007 and 2006. Material Weakness

		Financial Reporting Process

During this year’s audit, we found control deficiencies in SEC’s period-end  financial reporting process, in its calculation of accounts receivable for  disgorgements and penalties, in its accounting for transaction fee revenue,  and in preparing its financial statement disclosures. In order to fulfill these responsibilities, we    examined, on a test basis, evidence supporting the amounts and  disclosures in the financial statements;   assessed the accounting principles used and significant estimates made by    evaluated the overall presentation of the financial statements;    obtained an understanding of SEC and its operations, including its internal  control related to financial reporting (including safeguarding of assets)  and compliance with laws and regulations (including execution of  transactions in accordance with budget authority);    obtained an understanding of the design of internal controls related to the  existence and completeness assertions relating to performance measures  as reported in Management’s Discussion and Analysis, and determined  whether the internal controls have been placed in operation; tested relevant internal controls over financial reporting and compliance  with applicable laws and regulations, and evaluated the design and  operating effectiveness of internal control;   considered SEC’s process for evaluating and reporting on internal control  and financial management systems under the FMFIA; and tested compliance with selected provisions of the following laws and their  related regulations: the Securities Exchange Act of 1934, as amended;  the Securities Act of 1933, as amended;  the Antideficiency Act;  laws governing the pay and allowance system for SEC employees;  the Prompt Payment Act; and  the Federal Employees’ Retirement System Act of 1986. SEC’s management provided comments on a draft of this report. The Chairman emphasized  SEC’s commitment to enhance its controls in all operational areas and to  ensure reliability of financial reporting, soundness of operations, and  public confidence in SEC’s mission.
Why GAO Did This Study

Established in 1934 to enforce the securities laws and protect investors, the Securities and Exchange Commission (SEC) plays an important role in maintaining the integrity of the U.S. securities markets. Pursuant to the Accountability of Tax Dollars Act of 2002, SEC is required to prepare and submit to Congress and the Office of Management and Budget audited financial statements. GAO agreed, under its audit authority, to perform the audit of SEC's financial statements. GAO's audit was done to determine whether, in all material respects, (1) SEC's fiscal year 2007 financial statements were reliable and (2) SEC's management maintained effective internal control over financial reporting and compliance with laws and regulations. GAO also tested SEC's compliance with certain laws and regulations.

What GAO Found

In GAO's opinion, SEC's fiscal year 2007 and 2006 financial statements were fairly presented in all material respects. However, because of a material weakness in internal control over SEC's financial reporting process, in GAO's opinion, SEC did not have effective internal control over financial reporting as of September 30, 2007. Recommendations for corrective action will be included in a separate report. Although certain compliance controls should be improved, SEC did maintain in all material respects effective internal control over compliance with laws and regulations material in relation to the financial statements as of September 30, 2007. In addition, GAO did not find reportable instances of noncompliance with the laws and regulations it tested. In its 2006 report, GAO reported on weaknesses in the areas of SEC's (1) recording and reporting of disgorgements and penalties, (2) information systems controls, and (3) property and equipment controls. During fiscal year 2007, SEC improved its controls over the accuracy, timeliness, and completeness of the disgorgement and penalty data and used a much improved database for the initial recording and tracking of these data. However, the processing of these data for financial reporting purposes is still done through a manual process that is prone to error. GAO found that the internal controls that compensated for the manual processing of the related accounts receivable balances in fiscal year 2006 were not effective in fiscal year 2007. This issue is included in the material weakness in SEC's financial reporting process for fiscal year 2007. Other control deficiencies included in this material weakness concern SEC's period-end closing process, accounting for transaction fee revenue, and preparation of financial statement disclosures. GAO also identified three significant deficiencies in internal control during fiscal year 2007. Although SEC has taken steps to strengthen its information security, some of the weaknesses identified in GAO's previous audit persisted and GAO found new weaknesses during this year's audit. Therefore, GAO is reporting information security as a significant deficiency as of September 30, 2007. In addition, GAO continued to identify the same weaknesses in controls over property and equipment and therefore considers this area a significant deficiency as of September 30, 2007. GAO also identified a new significant deficiency concerning SEC's accounting for budgetary transactions. In commenting on a draft of this report, SEC's Chairman emphasized SEC's commitment to enhance its controls in all operational areas and to ensure reliability of financial reporting, soundness of operations, and public confidence in SEC's mission.