Stock Markets:

Information Vendors Need SEC Oversight to Control Automation Risks

IMTEC-92-16: Published: Jan 29, 1992. Publicly Released: Jan 29, 1992.

Additional Materials:

Contact:

Howard G. Rhile, Jr
(202) 512-6418
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

GAO reviewed the: (1) adequacy of controls in place to protect against automation risks at seven information dissemination vendors that transmit stock data to investors; and (2) Securities and Exchange Commission's (SEC) involvement in assessing such operations.

GAO found that: (1) all seven information dissemination vendors' computer facilities were unnecessarily vulnerable to automation risks; (2) such risks could obstruct the correct processing of data and the responsiveness, security, and continuity of the vendor's critical stock market operations; (3) the weaknesses uncovered increased concerns that vendors have not adequately controlled automation risks; and (4) because of resource limitations, SEC has focused its attention on other segments of the stock market.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: SEC is: (1) establishing and maintaining a list of all information dissemination vendors; and (2) informing them of SEC oversight (automation review) responsibilities. Major vendors have already been contacted.

    Recommendation: Because of the importance of maintaining the flow of vital information between stock markets and investors, SEC should identify all information dissemination vendors and inform them of the Commission's oversight responsibilities.

    Agency Affected: United States Securities and Exchange Commission

  2. Status: Closed - Implemented

    Comments: SEC is meeting with vendors to discuss the possibility of developing policies to address automation risk. SEC intends to work with industry to develop common understandings concerning the business practices necessary to assess and control automation risks in securities information dissemination systems.

    Recommendation: Because of the importance of maintaining the flow of vital information between stock markets and investors, SEC should inform such vendors of the policies they should follow to address automation risk, including controls to ensure the correct processing of data and responsive, secure, and continuous operation.

    Agency Affected: United States Securities and Exchange Commission

  3. Status: Closed - Implemented

    Comments: SEC intends to work with the vendor community to expand its capacity to identify systems disruptions and assess their impact on investors. SEC already monitors and assesses the impact of systems disruptions at major vendors.

    Recommendation: Because of the importance of maintaining the flow of vital information between stock markets and investors, SEC should determine whether vendors' automation practices are having an adverse effect on the investment community. This could be accomplished by such steps as analyzing the effect of system failures and potential system failures on investors and assessing whether investors view vendors' security weaknesses as posing a substantial risk to them.

    Agency Affected: United States Securities and Exchange Commission

  4. Status: Closed - Implemented

    Comments: SEC intends to decide whether further oversight actions are needed, once it has implemented the GAO recommendations. SEC has recently decided to substantially increase the size of the technical staff in the Office of Automation and International Markets. This expansion is intended to address SEC automation oversight responsibilities.

    Recommendation: Upon completion of these actions, SEC should decide whether further oversight actions should be taken.

    Agency Affected: United States Securities and Exchange Commission

 

Explore the full database of GAO's Open Recommendations »

Jul 25, 2016

Jul 5, 2016

May 6, 2016

Apr 21, 2016

Apr 18, 2016

Apr 12, 2016

Mar 28, 2016

Mar 8, 2016

Feb 16, 2016

Jan 27, 2016

Looking for more? Browse all our products here