Material Internal Control Issues Reported in SEC's Fiscal Year 2004 Financial Statement Audit Report

In our fiscal year 2004 audit of the Securities and Exchange Commission's (SEC) financial statements, we identified that SEC's case-tracking system used to record and track information on disgorgements and penalties was not effectively designed for financial reporting purposes and not integrated with the general ledger. As a result, SEC staff performed extensive and time-consuming manual procedures to compile quarterly subsidiary ledgers to update the accounting system for disgorgement and penalty balances and transactions, thereby inhibiting timely reporting and increasing the risk of reporting inaccurate amounts. In our July 2005 report to SEC management concerning this weakness, we recommended that SEC implement a case-tracking system that is integrated with the accounting system or that provides the necessary input to the accounting system to facilitate timely, accurate, and efficient recording and reporting of disgorgement and penalty activity. In response to our recommendation, SEC replaced the financial portion of its existing case tracking system in February 2007 and implemented an integrated accounts receivable sub-ledger in July 2008. In addition to this implementation, SEC developed and implemented in July 2008, control procedures to reconcile the disgorgement and penalty financial information in the case-tracking system and the accounts receivable sub-ledger on a monthly basis. The implementation of an integrated system along with the new reconciliation procedures has significantly improved the timeliness, accuracy, and efficiency over the reporting and recording of disgorgement and penalty activity.

As part of its enforcement responsibilities, SEC issues and administers judgments ordering, among other things, disgorgements, civil monetary penalties, and interest against violators of federal securities laws. These transactions involve material amounts of collections, and the recording and reporting of fiduciary and custodial liability balances on the financial statements. As part of GAO's FY 2004 and 2005 audits of SEC's financial statements, we found material control deficiencies in SEC's process for recording and reporting disgorgements and penalties and made several recommendations to correct these deficiencies. Our audit testing during fiscal year 2006 noted significant management oversight and efforts to address these material internal control deficiencies taken during FY 2006 such that we no longer considered the deficiencies to be material. Specifically, in response to our recommendations, SEC finalized policies and procedures for reporting disgorgement and penalty activity; improved reconciliations of disgorgement and penalty transactions; established an internal audit function within the Division of Enforcement; and had better and more timely coordination between the two key SEC units responsible for reporting and recording disgorgements and penalties. Of particular note was a comprehensive initiative SEC undertook during the year in response to our recommendation to review and verify all of the outstanding disgorgement and penalty debts. Through this project, SEC identified and corrected numerous errors in the database used to record and report disgorgements and penalties. These errors involved amounts due, judgment and due dates, the payees, and status of the cases. This project also identified steps needed with respect to collecting or terminating the debts. Based on these improvements in SEC's internal controls, SEC's balances on its financial statements for disgorgement and penalty financial data are more reliable. In addition, SEC management has more reliable information from which to manage this significant activity.

As part of its enforcement responsibilities, SEC issues and administers judgments ordering, among other things, disgorgements, civil monetary penalties, and interest against violators of federal securities laws. These transactions involve material amounts of collections, and the recording and reporting of fiduciary and custodial liability balances on the financial statements. As part of GAO's FY 2004 and 2005 audits of SEC's financial statements, we found material control deficiencies in SEC's process for recording and reporting disgorgements and penalties and made several recommendations to correct these deficiencies. Our audit testing during fiscal year 2006 noted significant management oversight and efforts to address these material internal control deficiencies taken during FY 2006 such that we no longer considered the deficiencies to be material. Specifically, in response to our recommendations, SEC finalized policies and procedures for reporting disgorgement and penalty activity; improved reconciliations of disgorgement and penalty transactions; established an internal audit function within the Division of Enforcement; and had better and more timely coordination between the two key SEC units responsible for reporting and recording disgorgements and penalties. Of particular note was a comprehensive initiative SEC undertook during the year in response to our recommendation to review and verify all of the outstanding disgorgement and penalty debts. Through this project, SEC identified and corrected numerous errors in the database used to record and report disgorgements and penalties. These errors involved amounts due, judgment and due dates, the payees, and status of the cases. This project also identified steps needed with respect to collecting or terminating the debts. Based on these improvements in SEC's internal controls, SEC's balances on its financial statements for disgorgement and penalty financial data are more reliable. In addition, SEC management has more reliable information from which to manage this significant activity.

As part of its enforcement responsibilities, SEC issues and administers judgments ordering, among other things, disgorgements, civil monetary penalties, and interest against violators of federal securities laws. These transactions involve material amounts of collections, and the recording and reporting of fiduciary and custodial liability balances on the financial statements. As part of GAO's FY 2004 and 2005 audits of SEC's financial statements, we found material control deficiencies in SEC's process for recording and reporting disgorgements and penalties and made several recommendations to correct these deficiencies. Our audit testing during fiscal year 2006 noted significant management oversight and efforts to address these material internal control deficiencies taken during FY 2006 such that we no longer considered the deficiencies to be material. Specifically, in response to our recommendations, SEC finalized policies and procedures for reporting disgorgement and penalty activity; improved reconciliations of disgorgement and penalty transactions; established an internal audit function within the Division of Enforcement; and had better and more timely coordination between the two key SEC units responsible for reporting and recording disgorgements and penalties. Of particular note was a comprehensive initiative SEC undertook during the year in response to our recommendation to review and verify all of the outstanding disgorgement and penalty debts. Through this project, SEC identified and corrected numerous errors in the database used to record and report disgorgements and penalties. These errors involved amounts due, judgment and due dates, the payees, and status of the cases. This project also identified steps needed with respect to collecting or terminating the debts. Based on these improvements in SEC's internal controls, SEC's balances on its financial statements for disgorgement and penalty financial data are more reliable. In addition, SEC management has more reliable information from which to manage this significant activity.

As part of its enforcement responsibilities, SEC issues and administers judgments ordering, among other things, disgorgements, civil monetary penalties, and interest against violators of federal securities laws. These transactions involve material amounts of collections, and the recording and reporting of fiduciary and custodial liability balances on the financial statements. As part of GAO's FY 2004 and 2005 audits of SEC's financial statements, we found material control deficiencies in SEC's process for recording and reporting disgorgements and penalties and made several recommendations to correct these deficiencies. Our audit testing during fiscal year 2006 noted significant management oversight and efforts to address these material internal control deficiencies taken during FY 2006 such that we no longer considered the deficiencies to be material. Specifically, in response to our recommendations, SEC finalized policies and procedures for reporting disgorgement and penalty activity; improved reconciliations of disgorgement and penalty transactions; established an internal audit function within the Division of Enforcement; and had better and more timely coordination between the two key SEC units responsible for reporting and recording disgorgements and penalties. Of particular note was a comprehensive initiative SEC undertook during the year in response to our recommendation to review and verify all of the outstanding disgorgement and penalty debts. Through this project, SEC identified and corrected numerous errors in the database used to record and report disgorgements and penalties. These errors involved amounts due, judgment and due dates, the payees, and status of the cases. This project also identified steps needed with respect to collecting or terminating the debts. Based on these improvements in SEC's internal controls, SEC's balances on its financial statements for disgorgement and penalty financial data are more reliable. In addition, SEC management has more reliable information from which to manage this significant activity.

As part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found that SEC had neither formalized processes or documentation showing the procedures, systems, analysis of accounts, and personnel involved in developing key balances and preparing the financial statements and related disclosures, nor the related quality control and review procedures. The lack of processes and documented procedures had a significant negative impact on SEC's ability to report its fiscal year 2004 financial results. We recommended that the SEC develop written policies and procedures that provide sufficient guidance for the year-end closing of the general ledger as well as the preparation and analysis of quarterly and annual financial statements. In response to our recommendation, SEC developed and implemented policies and procedures, as of September 2006, for preparing the financial statement and related disclosures. Our testing indicated that these policies and procedures have been implemented. Having a financial statement preparation process with documented policies and procedures provided reasonable assurance to SEC management that the balances presented in the financial statements and related disclosures are supported by SEC's underlying accounting records, and greatly improved controls over the preparation and review of its FY 2006 financial statements.

As part of GAO's FY 2004 SEC Financial Statement Audit, we found SEC did not have a process or documentation showing the personnel involved in developing key balances, preparing the financial statements and related disclosures, and performing the related quality control and review procedures. The lack of defined roles and responsibilities contributed to material misstatements in SEC's draft 2004 financial statements and delayed the reporting of SEC's fiscal year 2004 financial results. Accordingly, we recommended SEC establish clearly defined roles and responsibilities for the staff involved in financial reporting and the preparation of interim and year-end financial statements as well as those performing specific review functions. In response to our recommendation, SEC developed Financial Statements Preparation Guidance, dated August 2005, that, among other things, established roles and responsibilities for staff involved in the financial reporting and quality review process. The guidance provided a discipline that greatly helped SEC in preparing and reviewing financial statements in FY 2005.

As part of GAO's FY 2004 SEC Financial Statement Audit, we found SEC did not have documentation providing an explanation or a crosswalk between the financial statements and the source systems, general ledger accounts, account queries, and account analysis. The lack of such documentation or crosswalk had a significant negative impact on SEC's ability to produce its FY 2004 financial statements. We recommended the SEC prepare a crosswalk between the financial statements and the source systems, general ledger accounts, and the various account queries and analysis that make up the key balances in the financial statements. As of September 2006, SEC addressed our recommendation by preparing such a crosswalk. The crosswalk greatly improved the support for SEC's financial statement balances and contributed to SEC's overall improvements in controls over financial statement preparation and reporting such that this issue was no longer considered a material weakness.

As part of GAO's FY 2004 SEC Financial Statement Audit, we found SEC did not maintain a subsidiary ledger for certain activity, such as customer deposit amounts pertaining to filing fees and delivered and undelivered orders transactions. Not having subsidiary ledgers resulted in audit inefficiencies and consumed significant SEC staff resources. We recommended the SEC maintain subsidiary records or ledgers for all significant accounts and disclosures so that the amounts presented in the financial statements and footnotes can be supported by the collective transactions making up the balances. Accordingly, as of September 2006, the SEC established subsidiary ledgers for all account activity and developed a matrix that summarizes the subsidiary ledgers being maintained. These schedules greatly facilitated the FY 2006 audit.

As part of GAO's FY 2004 SEC Financial Statement Audit, GAO found SEC did not perform reconciliations of subsidiary and summary account balances for certain financial statement line items, such as for the customer deposit liability relating to filing fees and the associated earned filing fee revenue, the accounts receivable related to exchange fees and the related amount of earned exchange fee revenue, and the budgetary accounts related to undelivered and delivered orders, thus requiring SEC staff to create supporting detail for balances after the fact in order to reconcile support to general ledger balances. We recommended the SEC perform monthly reconciliations of subsidiary records and summary account balances. As of September 2006, SEC prepared a matrix listing its significant reconciliations and frequency. The reconciliations improved SEC's accountability and support for several of its significant account balances. In addition, as of September 2005, SEC completed documentation and implementation of the written policies and procedures for the filing fee revenue reconciliation.

As part of GAO's FY 2004 SEC Financial Statement Audit, we found SEC's process for preparing year end financial statements was staff-intensive and time-consuming and necessitated significant manual processes to determine account balances. The lack of a "formal closing" at an interim date increased the level of accounting activity and analysis required at year-end and contributed to SEC's delay in reporting FY 2004 financial results. Accordingly, we recommended SEC consider a "formal closing" of all accounts at an interim date(s), which would reduce the level of accounting activity and analysis required at year end. The formal closing should entail ensuring that all transactions are recorded in the proper period through month's end. In response to our recommendation, SEC prepared quarterly financial statements beginning in fiscal year 2006, including performing a formal closing of the accounts. SEC began preparing monthly financial statements during the fourth quarter of fiscal year 2007. As a result of SEC's actions on our recommendations, it has improved the year-end closing process by preparing monthly closings during the year.

As part of GAO's FY 2004 SEC Financial Statement audit, we found SEC did not maintain a formal listing of common closing and adjusting entries necessary for preparing financial statements. The lack of such a listing had a negative impact on SEC's ability to produce FY 2004 financial statements. Accordingly, we recommended that SEC develop a listing of common closing and adjusting entries used in the general ledger closing process to facilitate the preparation of financial statements. In response to our recommendation, as of September 2005, SEC implemented a journal voucher log master file that collected common closing and adjusting entries in a formal listing. The listing greatly improved SEC's internal controls over financial reporting.

As part of GAO's FY 2004 SEC Financial Statement Audit, we did not find evidence of supervisory review of journal entries posted to the general ledger and financial statements, including closing entries. The lack of supervisory review contributed to material errors in SEC's financial statements and significant delays in reporting FY 2004 financial statements. Accordingly, we recommended SEC require supervisory review for all entries posted to the general ledger and financial statements, including closing entries. In response to our recommendation, SEC developed and implemented procedures, as of September 2006, to document such reviews, significantly improving controls over journal entries and reducing the risk of errors.

As part of GAO's FY 2004 SEC Financial Statement Audit, we found SEC did not have a process or documentation establishing key dates and responsibilities for critical phases in the financial preparation and review process. The lack of established milestones and responsibilities for preparing and reviewing the financial statements significantly delayed the reporting of SEC's fiscal year 2004 financial results, and resulted in higher financial statement preparation and audit costs. Accordingly, we recommended SEC establish milestones for preparing and reviewing the financial statements by setting dates for critical phases such as closing the general ledger; preparing financial statements, footnotes, and the performance and accountability report; and performing specific quality control review procedures. In response to our recommendation, SEC prepared and implemented a financial statement preparation plan as of September 2006. The financial statement preparation plan provided a discipline that greatly helped SEC in preparing and reviewing financial statements and in meeting the audit deadline.

As part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found SEC had difficulty in compiling the financial statements and accompanying notes, significantly delaying the reporting of SEC's fiscal year 2004 financial results and requiring heroic efforts to meet the FY 2005 reporting deadline. Accordingly, we recommended SEC utilize established tools (i.e., checklists and implementation guides) available for assistance in compiling and reviewing financial statements. In response to our recommendation, as of September 2006, SEC began using external checklists in the preparation and review of its FY 2006 financial statements and footnotes, enhancing the statements' compliance with accounting standards and reducing the amount of revisions and adjustments to the financial statements and notes during the audit process.

As part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found SEC did not maintain documentation supporting all information included in the financial statements and footnotes. The lack of detailed documentation supporting financial statements and footnotes required SEC to provide extensive explanation of account activity and in some cases re-creation of documents thus contributing to the delays in the reporting of SEC's fiscal year 2004 financial results and consuming significant SEC resources. We recommended SEC maintain documentation supporting all information included in the financial statements and footnotes. Based on our recommendation, as of September 2006, SEC began maintaining sufficient detailed documentation supporting all information included in the financial statements and footnotes. This improvement resulted in documentation being readily available for examination and review and facilitated tracing transactions from authorization and initiation, through its processing.

As a part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found SEC's Office of Financial Management (OFM) operated with a staffing shortage both in terms of number and expertise. In addition, SEC's OFM operated without finalized written policies and procedures over its financial reporting process. In addition, we found that SEC lacked senior financial management personnel involvement in developing key balances and in preparing and reviewing the financial statements and disclosures. This contributed to the significant delays and multiple significant revisions in reporting financial results. We recommended SEC formalize and place into operation a senior management council or committee to oversee financial reporting activities; provide advice; and regularly review the agency's financial information, operations, and policies. Based on our recommendation, beginning in FY 2006, to take advantage of available in-house expertise, SEC established and formalized a senior financial management review committee (FMOC) to establish financial reporting policies, internal controls, and business practices, as well as to oversee and review the preparation of financial statements and footnotes. This committee was instrumental in addressing internal control weaknesses and improving the financial reporting process.

This recommendation was superseded by a subsequent GAO recommendation.