	Background

SEC introduced its ARP program in 1989 because of capacity and other problems in the exchanges’ and clearing organizations’ information systems. Since the ARP program was created, exchanges, clearing organizations, and the systems that link the stock and options markets have continued to periodically experience capacity-related problems or other disruptions. Scope and Methodology

To determine the adequacy and completeness of the criteria SEC uses to conduct capacity and security oversight, we compared the criteria with guidance issued by other financial regulators and organizations that have developed standards for auditing information systems, including the information security manual we developed for use by federal agencies.We also used a list of criteria we developed based on the procedures recommended in a publication written by experts in the field of capacity planning for information systems  and on the findings from our prior reports or testimonies that address automation issues in the securities markets. SEC Inspections of SROs Address Key Issues but Are Less Frequent Than SEC Staff Prefer

We found that, for the most part, SEC’s on-site inspections addressed key capacity and security issues. Most Independent Reviews Are Now Done By Internal Auditors Using a Risk- Based Approach

In the 1989 policy statement announcing the ARP program, SEC called for annual independent reviews of SROs that would cover capacity planning, security, and other areas. SEC staff told us that at that time, SEC proposed that external organizations perform these independent reviews. However, the program was not established under SEC’s rule making process. If SROs were required by SEC rule to provide SEC with notifications of significant changes to their automated systems, then the failure to have procedures in place for ensuring that notices of systems modifications are provided to SEC would likely demonstrate a weakness in the SRO’s internal controls. Appendix I: Comments From the Securities and Exchange Commission

The following are GAO’s comments on the Securities and Exchange Commission’s letter dated July 18, 2001.
Why GAO Did This Study

Capacity problems and other disruptions at the securities and options exchanges have caused processing delays within the U.S. securities markets in recent years. These exchanges and clearing organizations have also been concerned about unwarranted access by hackers and other unauthorized users. To address these issues, the securities and Exchange Commission (SEC) created its automation review policy program in 1989. The program calls for the exchanges and clearing organizations that act as self-regulatory organizations to voluntarily follow SEC guidance and submit to oversight of their information systems. The program includes two key policy statements that provide voluntary guidelines to these organizations, periodic on-site inspections by SEC staff, and independent reviews of systems by internal auditors or external organizations. In addition, self-regulatory organizations are expected to provide SEC with reports of system outages and notices of system modifications. This report reviews SEC's effectiveness in its oversight roles.

What GAO Found

GAO found that the program reasonably ensures that self-regulatory organizations address capacity, security, and other information systems issues. However, SEC could improve its program oversight by consolidating criteria used by program staff into a comprehensive guide. Overall, SEC's inspections addressed the key areas of program guidance and often contained substantive recommendations designed to improve the organizations' procedures.