	Audit Results

In our audit of the fiscal year 2004 financial statements for SEC, we found  the financial statements as of and for the fiscal year ended September  30, 2004, including the accompanying notes, are presented fairly, in all  material respects, in conformity with U.S. generally accepted  accounting principles;  SEC did not have effective internal control over financial reporting  (including safeguarding of assets), but had effective control over  compliance with laws and regulations that could have a material effect  on the financial statements as of September 30, 2004; and  no reportable noncompliance with laws and regulations we tested. We issued an unqualified, or clean, opinion on the SEC’s financial  statements. This means that the financial statements and accompanying  notes present fairly, in all material respects, SEC’s financial position as of  September 30, 2004, and, as well, certain other financial information that  the statements must provide: net cost, changes in net position, budgetary  resources, financing, and custodial activities for the year then ended. We found three material weaknesses in internal control and thus issued an  adverse opinion on internal control—stating that SEC management did not  maintain effective internal control over financial reporting and the  safeguarding of assets as of September 30, 2004. This conclusion on SEC’s internal controls did  not affect our opinion on SEC’s financial statements. This is because during  the audit process SEC made the adjustments identified during the audit as  necessary for the fair presentation of its financial statements. We also found that SEC maintained, in  all material respects, effective internal control over compliance. SEC’s lack of formalized processes, documented procedures, and quality  assurance checks, significantly delayed the reporting of fiscal year 2004  financial results, consumed significant staff resources, caused audit  inefficiencies, and resulted in higher financial statement preparation and  audit costs. GAO’s Standards for Internal Control in the Federal Government  requires that controls over the financial statement preparation process be  designed to provide reasonable assurance regarding the reliability of the  balances and disclosures reported in the financial statements and related  notes in conformity with generally accepted accounting principles,  including the maintenance of detailed support that accurately and fairly  reflect the transactions making up the balances in the financial statements  and disclosures. SEC’s difficulties in the area of financial statement preparation are  exacerbated because SEC’s financial management system is not set up to  generate the user reports needed to perform analyses of accounts and  activity on a real-time basis leading to SEC’s staff-intensive and time- consuming efforts to prepare financial statements. Office of Management and  Budget Circular No. Thus, our  auditors performed additional testing over SEC’s financial statement  balances related to penalties and disgorgements. To address internal control weaknesses over disgorgements and penalties,  we recommended that SEC 1. implement a system that is integrated with the accounting system or  that provides the necessary input to the accounting system to facilitate  timely, accurate, and efficient recording and reporting of disgorgement  and penalty activity; 2. review the disgorgement and penalty judgments and subsequent  activities documented in each case file by defendant to determine  whether individual amounts recorded in the case-tracking system are  accurate and reliable;  3. implement controls so that the ongoing activity involving  disgorgements and penalties is properly, accurately, and timely  recorded in the case-tracking system and the accounting system;  4. strengthen coordination, communication, and data flow among staff of  SEC’s Division of Enforcement and Office of Financial Management  who share responsibility for recording and maintaining disgorgement  and penalty data; and 5. develop and implement written policies covering the procedures,  documentation, systems, and responsible personnel involved in  recording and reporting disgorgement and penalty financial  information. SEC agrees with our findings in this area and has begun efforts to  strengthen internal controls. Our review of SEC’s  information system general controls found that the commission did not  effectively implement controls to protect the integrity, confidentiality, and  availability of its financial and sensitive information. SEC did not have a comprehensive monitoring program for routine  review, audit, or monitoring of system user-access activities. In its fiscal year 2004 FISMA report, SEC’s OIG reported that the  commission had several weaknesses in information security and was not  substantially in compliance with information security requirements  contained in FISMA.
Why GAO Did This Study

Pursuant to the Accountability for Tax Dollars Act of 2002, the Securities and Exchange Commission (SEC) is required to prepare and submit to Congress and the Office of Management and Budget audited financial statements. GAO agreed, under its audit authority, to perform the initial audit of SEC's financial statements. GAO's audit was done to determine whether, in all material respects, (1) SEC's fiscal year 2004 financial statements were reliable, (2) SEC's management maintained effective internal control over financial reporting and compliance with laws and regulations, and (3) SEC's management complied with applicable laws and regulations. Established in 1934 to enforce the securities laws and protect investors, the SEC plays an important role in maintaining the integrity of the U.S. securities markets. GAO was asked by the Chairman of the Senate Subcommittee on Federal Financial Management, Government Information, and International Security, Committee on Homeland Security and Governmental Affairs, to present the results of its May 26, 2005, report, Financial Audit: Securities and Exchange Commission's Financial Statements for Fiscal Year 2004 (GAO-05-244).

What GAO Found

The SEC's first ever financial audit was performed by GAO for fiscal year 2004. In reporting on the results of the audit, GAO issued an unqualified, or clean, opinion on the financial statements of the SEC. This means that SEC's financial statements presented fairly, in all material respects, its financial position as of September 30, 2004, and the results of operations for the year then ended. However, because of material internal control weaknesses in the areas of preparing financial statements and related disclosures, recording and reporting disgorgements and penalties, and information security, GAO issued an adverse opinion on internal controls, concluding that SEC did not maintain effective internal control over financial reporting as of September 30, 2004. However, SEC did maintain, in all material respects, effective internal control over compliance with laws and regulations material in relation to the financial statements as of September 30, 2004. In addition, GAO did not find reportable instances of noncompliance with laws and regulations it tested. It is important to remember that GAO's opinions on SEC's financial statements and internal controls reflect a point in time. SEC prepared its first complete set of financial statements for fiscal year 2004 and made significant progress during the year in building a financial reporting structure for preparing financial statements for audit. However, GAO identified inadequate controls over SEC's financial statement preparation process including a lack of sufficient documented policies and procedures, support, and quality assurance reviews, increasing the risk that SEC management will not have reasonable assurance that the balances presented in the financial statements and related disclosures are supported by SEC's underlying accounting records. In addition, GAO identified inadequate controls over SEC's disgorgements and civil penalties activities, increasing the risk that such activities will not be completely, accurately, and properly recorded and reported for management's use in its decision making. GAO also found that SEC has not effectively implemented information system controls to protect the integrity, confidentiality, and availability of its financial and sensitive data, increasing the risk of unauthorized disclosure, modification, or loss of the data, possibly without detection. The risks created by these information security weaknesses are compounded because the SEC does not have a comprehensive monitoring program to identify unusual or suspicious access activities. SEC agreed with our findings and is currently working to improve controls in all these areas.