Internal Control: Improvements Needed in SEC's Accounting and Financial Reporting Procedures

As part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found SEC's Office of Financial Management operated with a staffing shortage, both in terms of number and expertise, increasing the risk and difficulty in meeting financial reporting deadlines and in improving internal control over financial reporting. Based on our recommendation to increase staff in the Office of Financial Management with the collective knowledge, skills, and experience necessary to achieve effective implementation of internal control over the financial statement preparation and reporting process, SEC has, as of September 2006, added and replaced key staff with individuals who have expertise in governmental financial reporting. This increase in qualified staff facilitated SEC's ability to meet financial reporting dates more easily during FY 2006 and contributed to its ability to improve internal controls over financial reporting to such an extent that internal controls over financial statement preparation and reporting was no longer considered a material weakness.

As part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found that SEC did not have current comprehensive policies and procedures to address the accounting and controls for some of its significant financial activities, such as disgorgement and penalty activity, investment activity, and fiduciary liability amounts. Accordingly, based on our recommendation, SEC finalized formal, written policies and procedures as of September 2006, governing all significant accounting activity and related internal control, including the basic documentation, audit trails, and reviews needed for the related transactions. These written policies and procedures should result in more consistent treatment of this activity, better and more reliable documentation and support for the transactions, and overall improvement in internal controls over financial reporting.

As a part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found SEC's Office of Financial Management (OFM) operated with a staffing shortage both in terms of number and expertise. In addition, SEC's OFM operated without finalized written policies and procedures over its financial reporting process. In addition, we found that SEC lacked senior financial management personnel involvement in developing key balances and in preparing and reviewing the financial statements and disclosures. This contributed to the significant delays and multiple significant revisions in reporting financial results. We recommended SEC formalize and place into operation a senior management council or committee to oversee financial reporting activities; provide advice; and regularly review the agency's financial information, operations, and policies. Based on our recommendation, beginning in FY 2006, to take advantage of available in-house expertise, SEC established and formalized a senior financial management review committee (FMOC) to establish financial reporting policies, internal controls, and business practices, as well as to oversee and review the preparation of financial statements and footnotes. This committee was instrumental in addressing internal control weaknesses and improving the financial reporting process.

As part of GAO's FY 2005 SEC Financial Statement Audit, we found SEC's interim quarterly financial statements did not reflect the proper cutoff period for certain significant activity, such as disgorgement and penalty receivables. This was primarily attributable to the lack of an integrated system for recording disgorgement and penalty activity, which resulted in SEC having to perform extensive, time-consuming, manual calculations to arrive at the related end-of-quarter receivable amounts. SEC's practice of preparing footnote disclosures only with its September 30 financial statements increased the amount of preparation, review, and audit work necessary at year-end, increasing the risk that SEC may not meet its financial reporting deadlines. Accordingly, we recommended SEC determine cutoff dates for significant account balances that are both appropriate and practical to facilitate interim financial reporting and meeting year end financial reporting deadlines. In response to our recommendation, SEC changed the cutoff dates for subsidiary data to coincide with financial statement dates during fiscal year 2007. These actions have improved the timeliness of the detail used to establish financial statement balances by using appropriate cut-off dates.

As part of GAO's FY 2004 and 2005 SEC Financial Statement Audit, we found SEC prepared footnote disclosures only with its September 30 financial statements. The lack of interim footnote disclosures increased the amount of preparation, review, and audit work necessary at year-end, and increased the risk that SEC's disclosures may not be complete, accurate, and in accordance with standards. Based on our recommendation, as of September 2006, SEC now prepares interim footnote disclosures with updated information based on events and transactions that occur during the interim periods. For FY 2006, the preparation of the interim footnotes greatly enhanced the efficiency and effectiveness of SEC's financial reporting process as well as the audit process and contributed to SEC's ability to meet its financial reporting deadline.

In fiscal year 2005, the Securities and Exchange Commission (SEC) conducted a comprehensive review to identify and correct financial data inaccuracies in its disgorgement and penalty case-tracking system. During our fiscal year 2005 audit, we identified additional errors in disgorgement and penalty data beyond those identified and corrected by SEC. Specifically, we found: instances of errors and misstatements in the recorded gross accounts receivable balance and the related allowance for loss; inconsistent treatment in recording judgment and interest amounts, terminated debts, waivers, and amounts paid by defendants; and cases that were incorrectly recorded in the case-tracking system as being payable to SEC. In our April 2006 report to SEC management concerning these weaknesses, we recommended that SEC develop, document, and implement comprehensive policies, procedures, and controls over disgorgement and penalty transactions. In response to our recommendation and in concurrence with a new overall system implementation in July 2008, SEC developed written procedures to document the accounting and tracking of disgorgement and penalty receivables which included procedures for the validation and reconciliation of data recorded in the subsidiary ledger. These procedures, if fully and effectively implemented, should enable SEC to significantly improve its controls over disgorgement and penalties transactions and help ensure that the subsidiary ledger is accurate and complete.

In our fiscal year 2005 audit of the Securities and Exchange Commission's (SEC) financial statements, we identified errors and inconsistent treatment in recording terminated debts and waivers as a result of SEC's lack of formal policies and procedures to guide communication and coordination between SEC's Office of Financial Management and its Division of Enforcement. Such coordination is important because these organizations are responsible for portions of disgorgement and penalty activity. Specifically, through our testing of approved terminations, we noted that several case files lacked adequate documentation evidencing approval of terminations and instances in which waivers or terminations of the debts had been approved by the Commission but not recorded. In our April 2006 report to SEC management concerning this weakness, we recommended that SEC develop and implement comprehensive written policies, procedures, and controls over disgorgement and penalty transactions that include the type of documentation and procedures to be followed to properly to record the termination or waiver of a debt and the proper notification and communication for approved terminations and waivers, such that management has assurance that only valid and approved terminations are recorded. In response to our recommendation and in concurrence with a new overall system implementation in July 2008, SEC developed written procedures to document the accounting and tracking of disgorgement and penalty receivables which included supporting evidence requirements for recording amounts waived and terminated. During our fiscal year 2008 audit, we verified that these new procedures, if effectively implemented, should enable SEC to significantly improve its controls over the recording of terminations and waivers.

In our fiscal year 2005 audit of the Securities and Exchange Commission's (SEC) financial statements, we identified significant inconsistencies between related data in the database SEC uses to track its enforcement activities and its subsidiary ledger for fiduciary balances, which was manually compiled quarterly, from information in its enforcement database. These inconsistencies were the result of SEC's lack of comprehensive policies, procedures, and controls to ensure proper recording of cash collections and disbursements of disgorgement and penalties. Such accurate records are critical to SEC ensuring that individual case balances are reliable in preparing for distribution of funds to harmed investors with respect to disgorgement and penalty transactions. We recommended that SEC develop, document in writing, and implement comprehensive policies, procedures, and controls over disgorgement and penalty transactions that include the recording of activity by case for fiduciary balances, including monthly reconciliations and management review, to ensure that balances by case are accurate. In response to our recommendation, SEC implemented a subsidiary module in June 2008, which provided for recording of enforcement activity and tracking of related collection and disbursement activity to be recorded in the general ledger on a case-by-case basis. In addition, in fiscal year 2009, SEC implemented weekly, monthly, and quarterly reconciliation procedures to ensure the accuracy of account balances in the general ledger with related information in its case tracking system. These system enhancements and reconciliation procedures significantly improved internal control over SEC's accounting for, and financial reporting on, its fiduciary balances at the individual case level. If fully and effectively implemented, these additional controls should better enable SEC to prepare for funds distribution to harmed investors.

In our fiscal year 2005 audit of the Securities and Exchange Commission's (SEC) financial statements, we found that SEC did not have a comprehensive policy concerning the initiation, recording, and monitoring of transaction activity associated with investment accounts. Our testing of investment transactions found errors and omissions in SEC's investment case tracking system. As a result, we identified differences in investment balances between SEC's own records and those for the same transactions maintained by the Bureau of Public Debt. It is critical that SEC maintain effective internal control over its fiduciary balances, including invested amounts, so that it has adequate assurance that balances by case are accurate in preparation for distribution of funds to harmed investors. We recommended that SEC develop, document in writing, and implement comprehensive policies, procedures, and controls over disgorgement and penalty transactions that include the initiation, recording and monitoring of investments, including monthly reconciliations of investment activity, to provide assurance that these fiduciary amounts are accurate and complete. In response to our recommendation, SEC issued guidance in fiscal year 2009, which describes the procedures to be performed to properly complete and reconcile investment transactions. These new procedures significantly improved SEC's process for ensuring investment transactions and related balances in the fiduciary accounts are accurate and complete. If fully and effectively implemented, these new procedures should better enable SEC to manage and accurately distribute the funds to harmed investors.

In our fiscal year 2005 audit of the Securities and Exchange Commission's (SEC) financial statements, we found that Contracting Officer's Technical Representatives (COTRs) were not carrying out all assigned responsibilities identified in the SEC's regulations. In several cases, there was no evidence that COTRs had carried out required invoice reviews, including reviews to ensure that invoices were paid at rates or prices exceeding those stipulated in the corresponding contract. We also found a number of instances in which invoices were not approved within 5 days as required by SEC Regulation SECR-10-15, and cases in which improper invoices were not always returned to vendors in a timely manner. Such deficiencies in timely invoice review may result in SEC incurring unnecessary prompt payment penalties. We recommended that SEC clarify guidance regarding policies and procedures (consistent with SECR10-8 and SECR10-15) regarding COTR's required actions to help ensure existing policies and procedures are being followed consistently. In response to our recommendation, in fiscal year 2009, SEC provided additional training to COTRs on their responsibilities, updated SECR10-15 concerning COTRs responsibilities, and posted the updated guidance on the SEC intranet. If fully and effectively implemented, these additional controls should help SEC reduce the risk of paying erroneous or improper invoices, and should reduce the risk of paying unnecessary interest penalties resulting from untimely COTR review.

In our fiscal year 2005 audit of the Securities and Exchange Commission's (SEC) financial statements, we found several errors in amounts charged to filers that were not detected and corrected through SEC's existing review procedures. Specifically, we identified errors in 10 of the 167 filings we reviewed. These errors in fee calculations resulted in both under and over-statements of the revenue and related liability balances presented on the financial statements. We recommended that SEC take action to help ensure that its policy on recalculating fee-bearing filing amounts is consistently followed. In response, SEC amended its procedures for recalculating filing fee amounts to clearly document and describe the required procedures. Our review of filing fee revenue transactions in fiscal year 2009 did not identify any errors in calculated filing fee amounts. As a result, we concluded that the amended procedures SEC implemented significantly improved its controls for ensuring the consistent and accurate recalculations of filing fees, thereby reducing the risk of erroneous charges to filers and misstatement of SEC revenue and related liability balances in its financial statements.

In our fiscal year 2005 audit of the Securities and Exchange Commission's (SEC) financial statements, we noted several instances in which SEC personnel did not document their review of fee bearing filing fee recalculations. Lacking such review documentation, SEC management's ability to obtain assurance that controls are being consistently followed to ensure that financial transactions are recorded properly and accurately is impaired. We recommended that SEC management take action to help ensure that the recalculation of the required filing fees is clearly documented. In response to our recommendation, SEC amended its policy for recalculating filing fee rates to require documented sign-offs of the initial verifier and a secondary reviewer. As a result, SEC significantly improved supervisory accountability for the review procedures they performed and the accuracy and reliability of filing fees recorded and reported in SEC?s accounting records and financial statements, respectively. Our review of filing fee recalculations in fiscal year 2009 did not identify any exceptions.

Under the Prompt Payment Act SEC must calculate a late interest penalty on invoices not paid by the due date (5 C.F.R. 1315.10(a)). As part of GAO's FY 2005 SEC Financial Statement audit, we identified seven instances in which SEC incorrectly calculated the interest penalty for late payments. SEC's incorrect interest calculations were attributable to using the wrong date for SEC's receipt of a proper invoice, which caused an incorrect determination of the payment due date after which interest was due. Accordingly, we recommended that SEC incorporate a review of the invoice receipt date as part of its daily review of Momentum (SEC's general ledger) invoice entries. As a result of our recommendation, Office of Financial Management (OFM) supervisors met with staff during FY 2006 to review the importance of the Prompt Payment Act and related SEC procedures which included a review of the related Momentum entries, and followed up with an e-mail message to reinforce these procedures. Our 2006 audit testing verified that proper invoice receipt dates are being consistently entered into Momentum, resulting in accurate interest calculations.

As part of GAO's FY 2005 SEC Financial Statement Audit, we identified seven instances in which SEC incorrectly calculated the interest penalty for late payments under the Prompt Payment Act. Under the Prompt Payment Act and its implementing regulations, an agency's payment due date for paying an invoice without incurring an interest penalty is generally 30 days after the agency's receipt of a proper invoice (5 C.F.R. Sec. 1315.4(f), (g)). If the agency does not pay a proper invoice by the payment due date, the agency is to calculate a late interest penalty from the day after the payment due date until the payment is made (5 C.F.R. Sec. 1315.10(a)). SEC's incorrect interest calculations were attributable to using the wrong date for SEC's receipt of the invoice, particularly when an improper invoice was initially received, which caused an incorrect determination of the payment due date after which interest was due. Accordingly, we recommended that SEC take action to help ensure that the policy requiring timely return of improper invoices to the vendor to allow for timely payment is followed. In response to our recommendation, SEC has updated the accounts payable procedures to require improper invoices to be returned to vendors within 7 days. SEC also requires the proper tracking of the returned invoice by tracking the "Date Returned to Vendor" and "Date Returned Back from the Vendor" in the financial management system. As a result, SEC's actions have improved accountability in the accounts payable processes.