Of those, OCIE, the Division of Corporation  Finance, and the Division of Enforcement are subject to section 961 of  the Dodd-Frank Act. Section 961 of the Dodd-Frank Act requires SEC to submit a report to  Congress (1) on the assessment of the effectiveness of its internal  supervisory controls and the procedures applicable to staff who perform  examinations, enforcement investigations, and reviews of financial  securities filings; (2) a certification that SEC has adequate internal  supervisory controls to carry out examinations, reviews of financial  securities filings, and investigations; and (3) a summary of the  Comptroller General’s findings on the adequacy and effectiveness of SEC  internal supervisory controls. responsible for developing detailed policies and procedures to fit their  agency’s operations. Specifically, SEC’s internal supervisory control framework  includes the following elements:  Identifying and assessing risks. This helps to  ensure that applicable rules and regulations are reviewed and  examinations are consistently performed. Offices’ Work Processes Incorporate Internal Supervisory Controls Designed to Address Identified Risks

As part of developing and applying the internal supervisory control  framework, each office identified internal supervisory controls to address  the risks identified through the risk assessment. These internal  supervisory controls are built into the offices’ work processes—that is, the  processes they use to carry out examinations, filing reviews, and  investigations. The controls are intended to help ensure that objectives  are being met and that the procedures applicable to staff carrying out  these activities are conducted completely and consistently. They range  from supervisory review and approval activities to information regularly  provided to management to monitor the processes as a whole. According  to staff, many of the offices’ internal supervisory controls existed prior to  the development of SEC’s internal supervisory control framework in 2010. Others were developed through the process of developing the framework. Annual filing review goals. These control deficiencies may not prevent  management from detecting whether the activities of the offices are  conducted completely and in accordance with policy. The offices have  addressed or have been taking steps to address all the 27 identified  deficiencies. Other  However, not enough time had passed to assess the effectiveness of  these changes. Specifically, for  these internal supervisory controls, the description of the control activity  did not accurately reflect policy or practice; the documentation  demonstrating execution of the control was not complete, clear, or  consistent; or the control lacked clearly defined control activities. However, the similarity in the nature of the deficiencies across  all three offices suggests that management attention to the design and  operation of internal supervisory controls is warranted. Federal internal  control standards state control activities should enable effective operation  and have clear, readily available documentation. Taking steps  to ensure that all controls have clearly defined activities and clear and  readily available documentation demonstrating execution of the activity  would provide SEC management with better assurances that policies  were being executed as intended and strengthen SEC’s internal  supervisory control framework. Recommendation for Executive Action

To help ensure that controls are properly designed and operating  effectively, SEC should make certain that existing internal supervisory  controls and any developed in the future have clearly defined activities  and clear and readily available documentation demonstrating execution of  the activities. In its letter,  SEC agreed with our recommendation. While we found that OCIE, Corporation Finance, and Enforcement have  established an internal supervisory control framework that is generally  reflective of federal internal control standards, we also found deficiencies  in the design or operating effectiveness of about half of the 60 internal  supervisory controls we tested. We examined (1) the steps the offices have  taken toward developing an internal supervisory control framework over  the specified programs, (2) the internal supervisory controls each office  has implemented and how these controls reflect established internal  control standards, and (3) the extent to which the internal supervisory  controls have operated as intended. To describe the steps each office has taken toward developing an internal  supervisory control framework over the specified programs, we evaluated  and analyzed documentation from (1) fiscal year 2011 assessments that  OCIE, Corporation Finance, and Enforcement completed in accordance  with requirements of section 961 of the Dodd-Frank Wall Street Reform  and Consumer Protection Act; (2) SEC’s reports to Congress; and (3)  documentation related to each office’s fiscal year 2011 testing of internal  supervisory controls.
Why GAO Did This Study

Recent high-profile securities frauds have raised questions about the internal controls that SEC has in place to help ensure that staff carry out their work completely and in a manner consistent with applicable policies and procedures. Section 961 of the Dodd-Frank Act directs SEC to annually assess and report on internal supervisory controls for staff performing examinations, corporate financial securities filing reviews, and investigations. The act also requires GAO to review SEC's structure for internal supervisory control applicable to staff working in those offices. This report examines the (1) steps the offices took to develop an internal supervisory control framework; (2) internal supervisory controls each office has implemented; and (3) extent to which the internal supervisory controls have operated as intended. GAO reviewed each office's section 961 assessments and reports; analyzed the offices' internal supervisory control framework; and tested a sample of 60 supervisory controls using random samples and nonprobability selections.

What GAO Found

After the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) in 2010, the Securities and Exchange Commission's (SEC) Office of Compliance Inspections and Examinations, Division of Corporation Finance, and Division of Enforcement (herein "the offices") established a working group that developed an internal supervisory control framework. Internal supervisory controls include the processes established by management to help ensure that procedures applicable to staff are performed completely, consistent with applicable policies and procedures, and remain current. The overall control framework is generally consistent with federal internal control standards, which includes identifying and assessing risks, identifying and assessing internal controls, and reporting the results of testing to management and Congress.
As part of developing and applying an internal supervisory control framework, the offices each identified internal supervisory controls to mitigate risks that could undermine their ability to consistently and competently carry out their responsibilities. These internal supervisory controls are built into the offices' work processes--that is, the processes they use to carry out examinations, financial securities filing reviews, and investigations--and range from specific supervisory review and approval activities to management reports used to monitor the processes as a whole. For example, within Enforcement, supervisors must review and approve staff recommendations that a tip, complaint, or referral be closed without further investigation. Many of the offices' internal supervisory controls existed prior to the development of SEC's internal supervisory control framework; others were developed through the process of developing the framework.
GAO identified deficiencies in about half of the 60 internal supervisory controls it tested. Specifically, GAO found that for 27 internal supervisory controls (1) the description of the control activity did not accurately reflect policy or practice; (2) documentation demonstrating execution of the control was not complete, clear, or consistent; or (3) the controls lacked clearly defined control activities. These control deficiencies may not prevent management from detecting whether the activities of the offices are conducted completely and in accordance with policy. However, similarities in the nature of deficiencies across all three offices suggest that management attention to the design and operation of internal supervisory controls is warranted. Federal internal control standards state that control activities should enable effective operation and have clear, readily available documentation. The offices have addressed or have been taking steps to address all of the 27 identified deficiencies. Some steps have been taken based on the offices' section 961 assessments. SEC addressed other deficiencies during GAO's review after discussions with GAO detailing the identified deficiency. Not enough time has passed for GAO to assess the effectiveness of these changes. Ensuring that all internal supervisory controls have clearly defined activities and clear, readily available documentation demonstrating execution of the control would provide SEC management with better assurance that policies were being executed as intended and strengthen SEC's internal supervisory control framework.

What GAO Recommends

To help ensure that controls are properly designed and operating effectively, SEC should make certain that existing internal supervisory controls and any developed in the future have clearly defined activities and clear and readily available documentation demonstrating execution of the activities. SEC agreed with GAO's recommendation.