Financial Market Preparedness: Improvements Made, but More Action Needed to Prepare for Wide-Scale Disasters

We have recommended in several past reports (GAO-03-251, GAO-03-414, and GAO-04-984) that SEC fully analyze the readiness of the securities markets to recover from major disruptions and continue trading activities. In conducting work for the most recent follow-on report to those engagements, SEC staff told us that they have considered how a wide range of disaster scenarios would affect the securities markets in consultation with the other federal agencies and local emergency management officials in New York and Chicago. Furthermore, they have conducted an analysis of the major firms to ascertain their willingness and ability to continue to trade in the event of a wide-scale disruption. This analysis was done in conjunction with compliance reviews related to recently issued market-wide business continuity guidance. SEC staff told us that the examined firms all expressed a commitment to continue to operate and have allocated substantial resources to enhance their resilience sufficiently to permit them to trade. Lastly, SEC has developed an expanded examination module to obtain more detailed information on firms' business continuity capabilities related to trading activities. SEC staff have made this part of the existing examination guidance for the SEC examiners and told us that they expect to use this expanded guidance in the applicable broker-dealer examinations beginning with the 2007 cycle. Based on the work discussed above, SEC staff believe that market participants have increased their resilience since September 11 and that sufficient numbers of firms and staff likely would be able to operate from various locations to allow U.S. markets to resume trading when appropriate.

Since we made this recommendation, staff from SEC's Market Regulation Division provided us with a timeline by which they took and planned to take various actions to present a rule for Commission approval that will make adherence to the ARP program mandatory for affected organizations, as we previously recommended. Events that have occurred on this timeline include the original drafting of the rule, revision of the draft rule to make it more of a prudential-style rule, and and its submission to SEC's Office of General Counsel in October 2007. Since then, the staff have responded with changes per OGC comments, including submitting a revised version of the draft rule to their OGC again in June 2008. As of July 2008, the division's staff have advised us that they will encourage their counsel's office to complete its review and submit the rule for commission approval.

The SEC Automation Review Program, which oversees information technology and operational issues at exchanges and markets, has hired two additional staff with MBAs with concentrations in Management Information Systems and work experience in IT and is in the process of hiring one additional MBA with a concentration in Management Information Systems.

SEC staff considered the alignment of the ARP program and recently reorganized it to combine it with staff that perform market surveillance activities. In response to our recommendation, SEC said that as part of its strategic planning process, it will continue to assess the proper placement of ARP within the organization.