Management Report: Improvements Needed in SEC's Internal Controls and Accounting Procedures

In our fiscal year 2008 audit of the Securities and Exchange Commission's (SEC) financial statements, we identified issues related to SEC's implementation of its policies for processing personnel actions and certification of employees' time cards. Specifically, we found that a Standard Form-50 (SF-50), Notification of Personnel Action, was not approved until 5 weeks after the effective separation date. Without adequate controls over the processing of separation actions, SEC is at risk that erroneous payroll expenses will be incurred. We also found numerous instances in which the SF-50s did not include the signature of the authorizing official. Specifically, we found that 42 percent of the SF-50s we reviewed did not include the signature of the Director of the Office of Human Resources. Consequently, without proper approval of personnel actions, SEC is at risk of processing unauthorized payroll actions. In April 2009, we recommended that SEC develop procedures for implementing management's policy on the authorization and validation of personnel actions and the timely processing of such actions. In response to our recommendation, during fiscal year 2011, SEC's Office of Human Resources formally issued its Personnel Action Processing procedures as an internal SEC Regulation, SECR 6-3. Sections G.2 and G.3 of SECR 6-3 set out required steps for the review of personnel actions for their authorization, to confirm that actions were taken appropriately, and to ensure that actions were processed timely. As a result of these actions, SEC management has significantly reduced the risk of unauthorized or erroneous payroll actions.

In our fiscal year 2008 audit of the Securities and Exchange Commission's (SEC) financial statements, we found that SEC lacked detailed written procedures for several of its accounting processes that precede closing the general ledger and generation of the financial statements. The absence of procedures for preparing the financial statements inhibits management's ability to ensure the continuity of key accounting procedures and timely and reliable financial reporting in the event of turnover of employees who carry out current unwritten pre-closing accounting processes. In April 2009, we recommended that SEC develop and implement a desktop procedures manual that provides detailed written instructions for performing each key accounting process preceding the general ledger closing process; the associated internal control to be followed for each step, as applicable; and the manner for documenting compliance with these controls. In response to our recommendation, in fiscal year 2010, SEC updated standard operating procedures (SOP) with more detailed written procedures for performing several of its key accounting processes preceding the general ledger closing process and developed SOPs for its remaining undocumented processes, including an overview to link the key tasks to the detailed SOPs that support their completion and made these centrally available in an internal website. For example, SEC developed and implemented six SOPs with detailed procedures for its key activities relating to various aspects of its Treasury Management operations. As a result of the updated and more complete documentation of its key accounting procedures, financial reporting controls for ensuring the timely and accurate preparation of the financial statements are more transparent and the risk of work disruption from employee turnover is significantly reduced.

In our fiscal year 2008 audit of the Securities and Exchange Commission's (SEC) financial statements, we found instances in which SEC employee time cards were improperly certified by lower-level employees. This occurred because SEC's time and attendance system was not configured to prevent lower-level employees from approving higher-level employees' time cards. We concluded that without proper certification of time cards, SEC was at increased risk that unauthorized payroll actions could be processed. In April 2009, we recommended that SEC configure its time and attendance system to preclude lower-level employees from approving higher-level employees' time cards. In response to our recommendation, during fiscal year 2012, SEC's Office of Human Resources formally issued and implemented its Time and Attendance Processing procedures to ensure that, when appropriate, lower-level employees have been formally delegated authority to certify higher-level employees' time cards. As a result of these improvements, SEC management has significantly reduced the risk of unauthorized payroll actions.

As part of its financial reporting environment, the Securities and Exchange Commission (SEC) uses manual journal voucher (JV) entries for recording transactions and making, correcting, or adjusting entries. Through our testing of manual accounting entries in our fiscal year 2008 financial audit, we noted many instances of undocumented or ineffective supervisory review of accounting entries. Specifically, we identified 32 instances in which individual entries lacked documentation of supervisory review and approval, and 2 instances in which the documentation supporting the accounting entry contained errors. These instances evidenced the lack of a thorough and complete review process and increased the risk that errors in manual accounting entries would not be detected and corrected in a timely manner. In our April 2, 2009, letter to SEC management communicating this weakness, we recommended that SEC develop and implement procedures for the preparation and review of accounting entries to include descriptions of the steps to be performed and the documentation required for supervisory-level review of all supporting documentation. In response to our recommendation, in fiscal year 2011 , SEC developed and implemented procedures for the preparation of JV entries which directed that manual accounting entries should not be recorded in the general ledger system without all required approvals being obtained and established that it was the reviewer's responsibility for ensuring the accuracy of the adjustment. Through our testing of JVs during our fiscal year 2011 audit, we identified that each entry within our sample was accurately prepared and contained evidence of supervisory-level review. As a result of these procedures, SEC has significantly improved its controls pertaining to the recording of manual accounting entries, thereby reducing the risk of material misstatement in the financial statements.

The Securities and Exchange Commission (SEC) collects securities transaction fees from self-regulatory organizations (SRO) pursuant to Section 31 of the Securities and Exchange Act of 1934. SEC calculates the fees due and bills SROs based on monthly reported transaction volume. SEC's Office of Financial Management (OFM) has responsibility for invoicing Section 31 fees, calculating the Section 31 revenue accrual, recording the related accounts receivable, and processing collections. SEC's Office of Compliance Inspections and Examinations (OCIE) performs annual inspections to include the manner in which covered SROs and clearing agencies comply with their obligations under Section 31. In our fiscal year 2008 audit of SEC's financial statements, we noted that OCIE's inspection results revealed approximately $16 million in underreported Section 31 fees; however, because SEC's written guidance for recording Section 31 fees did not include procedures for OFM review and consideration of OCIE's inspection results this amount was not recorded by OFM as an SEC accounts receivable at September 30, 2008. In April 2009, we recommended the SEC develop and implement procedures for the review and consideration of OCIE inspection results as part of its process for recording Section 31 fees. In response to our recommendation, in fiscal year 2009, SEC developed and implemented procedures for OFM review and consideration of OCIE inspection results as a component of its process for recording Section 31 fees. As a result, if these revised procedures are fully and effectively implemented, internal control over the accuracy and completeness of Section 31 fees should be significantly improved. In our fiscal year 2009 audit, we determined OFM appropriately used the OCIE inspection reports to determine the need for adjustments for Section 31 revenue and receivables at year-end.

The Securities and Exchange Commission (SEC), used manually processed journal voucher (JV) transactions to record correcting and adjusting entries in its general ledger system. In fiscal year 2008, SEC upgraded its general ledger system and enhanced the use of standard vouchers (SV) as an additional mechanism for recording manual transactions in the general ledger. SV entries are generally prepared for manual transactions that are recurring in nature. JV entries are free-form manual entries for one-time, ad hoc transactions. Our review of manually processed transactions found that SEC was using SVs and JVs for the same purpose. We also noted that SEC had not prepared written guidance describing the appropriate use of SV or JV entries. Consequently, we found instances in which SEC's internal controls over manual transactions were not effective. In April 2009, we recommended that SEC develop and implement written procedures providing guidance for when to appropriately use JV or SV entries. In response to our recommendation, in fiscal year 2009, SEC updated its property & equipment desktop procedures to include a description on the use of SV transactions. In addition, SEC implemented a standard operating procedure related to SV creation and modification which discourages the use of JV entries in circumstances where a predefined SV entry is available. This written guidance provided clarification on the intent and appropriate circumstances for using the two transaction types, thereby increasing management's assurance that its financial transactions are recorded as intended. As a result, SEC has improved its internal control over financial reporting and mitigated the possibility that erroneous manual transactions will occur.

In our fiscal year 2008 audit of the Securities and Exchange Commission's (SEC) financial statements, we found that SEC did not properly account for and report fees from the public for providing information under the Freedom of Information Act (FOIA) as exchange revenues. Specifically, U.S. generally accepted accounting principles (GAAP) and federal financial reporting require federal agencies to report such fees as exchange revenues on the Statement of Net Cost . Instead SEC recorded such activity as custodial revenue in its Statement of Custodial Activity. In April 2009, we recommended that SEC develop and implement procedures to account for and report the receipt of FOIA fees in accordance with GAAP and federal financial reporting requirements. In response to our recommendation, in FY 2009, SEC evaluated its treatment of FOIA fees and revised its accounting and reporting methodology to comply with federal accounting standards. As a result, SEC now reports FOIA collections in accordance with federal requirements on the Statement of Net Cost. If fully and effectively implemented, these reporting changes should bring SEC into compliance with GAAP and result in more accurate financial reporting.

As part of its enforcement responsibilities, the Securities and Exchange Commission (SEC) orders and administers judgments ordering disgorgement and civil monetary penalties against violators of federal securities laws. During fiscal year 2008, SEC changed its method of financial statement presentation for the receipt, accounting, and disposition of all disgorgement-related assets, which represented $3.1 billion at September 30, 2008. As a result of this reporting change, we noted that SEC had eliminated a disclosure provided in previous years' financial reporting concerning the source and disposition of SEC's disgorgement and penalty activities, thereby inhibiting the comparability of financial reporting over time. In April 2009, we recommended that SEC develop procedures for including appropriate financial statement disclosure of the source and disposition of SEC's disgorgement and penalty activities. In response to our recommendation, SEC updated its fiscal year 2010 financial reporting to include a disclosure describing the disposition of disgorgement and penalty activities. This disclosure in its year-end financial statements significantly enhanced the comparability of disgorgement and penalty transactions reported in SEC's year-to-year financial statements.

During fiscal year 2008, the Securities and Exchange Commission (SEC) implemented a new property and equipment subsidiary ledger system and corresponding policies and procedures for documenting property and equipment transactions. Our testing of property and equipment acquisitions processed under this new system found that SEC's controls over the receipt and acceptance of assets were not operating effectively, which caused errors in recording property and equipment purchases. Contributing to these errors was the lack of employee training on how to record property and equipment purchase transactions using the new system. In April 2009, we recommended that SEC provide training for all appropriate employees on entering and processing transactions related to property and equipment purchases in the new property and equipment system. In response to our recommendation, in fiscal year 2009, SEC held training seminars with responsible personnel to cover the processing for entering property plant and equipment transactions into the general ledger. As a result of these training sessions, SEC has improved the likelihood that property and equipment transactions will be completely, consistently, and accurately recorded in the general ledger thereby increasing the reliability of property and equipment-related information presented on its financial statements.

As part of its enforcement responsibilities, the Securities and Exchange Commission (SEC) orders and administers judgments ordering among other things, disgorgements, and civil monetary penalties against violators of federal securities laws. At September 30, 2008, SEC reported a gross receivable balance of $434 million with an offsetting allowance of $346 million for disgorgement and penalties receivable. During fiscal year 2008 audit, we identified an error in SEC's calculation of its allowance for loss on uncollectible disgorgement and penalty receivables. Specifically, our review found that SEC's Office of Financial Management did not apply the collectability percentage developed by the Division of Enforcement (Enforcement) in calculating the net realizable value for one of its largest debtors. In our April 2, 2009, report to SEC management communicating this weakness, we recommended that SEC develop and implement procedures specifying how the collectability assessments provided by Enforcement will be used by the Office of Financial Management, to include documentation requirements for instances in which an allowance amount other than Enforcement's assessment is recorded. In response to our recommendation, in May 2011, SEC developed and established new procedures concerning the calculation and assessment of the allowance for loss on disgorgement and penalty accounts receivable . Under these procedures, management defined the loss calculation as being largely dependent upon the collectability percentages provided by Enforcement and prescribed that all instances in which the adjustments were made to the collectability percentages provided by Enforcement, should be documented and only made after direct consultation with Enforcement personnel. As a result of these added controls and documentation requirements, SEC has significantly improved its controls over its estimation procedures pertaining to its allowance for loss on disgorgement and penalty receivables thereby reducing the risk of material misstatement resulting from errors in its calculation.

During fiscal year 2008, the Securities and Exchange Commission (SEC) implemented a new property and equipment subsidiary ledger system and corresponding policies and procedures documentation for recording property and equipment transactions. Our testing of property and equipment acquisitions processed under this new system found that the controls over the receipt and acceptance of assets were not operating effectively, which caused errors in SEC's recording of new property and equipment purchases. Contributing to these errors was a lack of oversight of the new accounting processes for property and equipment purchases using the new system. In April 2009, we recommended that SEC develop and implement procedures for performing and documenting oversight and review processes over property and equipment transactions. In response to our recommendation, in fiscal year 2009, SEC developed oversight review procedures intended to prevent and detect any misstatement of property and equipment transactions. These procedures included internal controls to (1) identify assets received but not recorded in the general ledger; (2) identify property and equipment items erroneously expensed; and (3) reconcile assets within the subsidiary system to the general ledger. As a result of these improved oversight control procedures, SEC has increased its assurance that property and equipment transactions will be completely, consistently, and accurately recorded in the general ledger thereby increasing the reliability of property and equipment-related information presented on its financial statements.

As part of its enforcement responsibilities, the Securities and Exchange Commission (SEC) orders and administers judgments ordering disgorgement and civil monetary penalties against violators of federal securities laws. At September 30, 2008, SEC reported a gross receivable balance of $434 million with an offsetting allowance of $346 million for disgorgement and penalties receivable. During fiscal year 2008, we identified issues concerning the reasonableness of SEC's methodology for establishing its allowance for loss on uncollectible disgorgement and penalty receivables. Historically, SEC has calculated its allowance amounts using a two tiered approach, applying separate collectability calculations; one for its 25 largest debt holders and a separate historic percentage rate to all other debtor accounts. Our review of these allowance calculations identified instances in which allowance amounts fluctuated widely between fiscal quarters. We determined that the extent of this fluctuation undermined the reasonableness of SEC's allowance methodology. In April 2009, we recommended that SEC reevaluate the reasonableness of the methodology used for calculating the allowance for loss on disgorgement and penalty accounts receivable. In response to our recommendation, in fiscal year 2009, SEC performed an evaluation of its existing allowance methodology and implemented procedural changes that require the collectability analysis to consistently provide coverage for 90-percent of all disgorgement and penalty receivable balances. In addition, SEC's modified methodology now requires the consistent treatment of debtor accounts once they are subjected to the top debtor analysis, regardless of the 90-percent threshold. These revisions provide a significant improvement to the consistency in allowance calculations and overall reasonableness of the estimated amounts, and thereby should increase the consistency and reliability of SEC's reported receivable balance.

In our fiscal year 2008 audit of the Securities and Exchange Commission's (SEC) financial statements, we identified many instances of inaccurate amounts capitalized for internal-use software projects resulted from SEC's reliance on manual spreadsheets to calculate the time federal employees spent working on internal use software projects. Specifically, our review of capitalized software additions at June 30, 2008, found that for 8 of 10 software projects we tested, SEC utilized an incorrect salary rate when capitalizing the related federal employee costs. Collectively, these calculation errors resulted in an overstatement of fixed assets by approximately $2.3 million. In April 2009, we recommended that SEC develop and implement automated procedures to assure the use of correct federal employee salary rates related to capitalized software through the use of project codes in SEC's time and attendance system. In response to our recommendation, in fiscal year 2009, SEC implemented procedures for the use of project codes within its time and attendance system to capture the employee costs related to internally developed software projects. As a result, SEC has improved internal control over the accuracy of capitalized software costs and mitigated the possibility that an improper salary rate will be used. If fully and effectively implemented, these new procedures should result in more accurate financial reporting of fixed assets.

The Securities and Exchange Commission (SEC) receives checks for the payment of disgorgement and penalties as well as for other activities. In our fiscal year 2008 audit of the SEC's financial statements, we noted the SEC did not have sufficient safeguarding procedures over checks received, making checks susceptible to misappropriation. Specifically, during our audit, we noted that the mail room was unsecured, the mail bins were not adequately safeguarded, and mail to be delivered to SEC's Office of Financial Management (OFM), which is the recipient of all checks made payable to the SEC, was not placed in a locked bag. In April 2009, we recommended that SEC develop and implement improved safeguarding procedures within SEC's Operations Center for checks received or establish a lockbox for the submission of checks to OFM and instruct defendants to mail checks to the lockbox. In response to our recommendation, in fiscal year 2010, SEC developed and established new safeguarding procedures for checks received by OFM at the SEC Operations Center. Through our observations during our fiscal year 2010 audit, we found that SEC had implemented a locked mailbox for all correspondence to OFM and designated that at least two people must be present when OFM's mail is opened. As a result of these procedures, SEC has significantly improved its physical controls over cash collections, thereby reducing the risk of misappropriation of cash assets.

The Securities and Exchange Commission (SEC) periodically reviews unliquidated obligations to deobligate funds no longer needed so that budgetary resources can be used to fund other activities or obligations during the time frame that those funds are available. In our fiscal year 2008 audit of SEC, we found that deobligation transactions (downward adjustments to undelivered orders) lacked documentary evidence of review and approval, thereby increasing the risk that erroneous or improper postings are recorded in the general ledger. In April 2009, we recommended that SEC develop and implement formal operating procedures for monitoring undelivered orders to include guidance for documenting review and approval of downward adjustment transactions. In response to our recommendation, in fiscal year 2009, SEC implemented detailed procedures for the periodic review of undelivered order transactions which included documentation requirements and management certifications for downward adjustment transactions. As a result of these improved documented review requirements, SEC management has enhanced its ability to monitor downward adjustment transactions and provided greater assurance that only valid adjustments to unliquidated obligations are recorded.

As part of its enforcement responsibilities, the Securities and Exchange Commission (SEC) orders and administers judgments ordering disgorgement and civil monetary penalties against violators of federal securities laws. During fiscal year 2008, SEC implemented a new system module to integrate accounts receivable transactions for disgorgement and penalties with the general ledger. However, SEC did not provide training on the new system, particularly with respect to using the system to properly record disgorgement and penalty transactions. Through our testing of transactions recorded in this new system, we noted instances in which transaction information was not entered consistently, thereby necessitating a time-consuming and labor-intensive reconciliation process to correct for errors. In April 2009, we recommended that SEC provide training to staff on the proper use of the new system module and the proper procedures for recording disgorgement and penalty transactions in its general ledger system. In response to our recommendation, in fiscal year 2009, SEC provided a training course to staff responsible for disgorgement transactions on how to properly enter accounts receivable transactions into the general ledger. These actions, if fully and effectively implemented, should increase management's assurance that disgorgement and penalty transactions are recorded completely and accurately.

Offsetting collections are amounts that the Securities and Exchange Commission (SEC) receives from business-like transactions with the public (e.g., fees for filing registration statements), which SEC is authorized to credit (offset against) to appropriations accounts for future obligations. However, SEC may use funds from this account only as authorized by Congress and made available by OMB apportionment. Revenue collected in excess of appropriated amounts is restricted from use by SEC. For fiscal year 2008, SEC reported approximately $986 million in offsetting collections. In fiscal year 2007, SEC changed its method of accounting for user fees collected in excess of current-year appropriations. However, we found that SEC had not yet implemented a corresponding reconfiguration of its system to post offsetting collection transactions in accordance with its accounting change. Transaction entries recorded when offsetting collections were received in excess of appropriated amounts resulted in overstating SEC's total budgetary resources and amounts available for obligation until adjusted at the end of each month. In April 2009, we recommended that SEC correct general ledger transaction posting configurations to properly record offsetting collections in accordance with the change in SEC's method of accounting for user fees collected in excess of current-year appropriations. In response to our recommendation the SEC reviewed the general ledger posting logic in June 2009 and made revisions, as necessary. Our subsequent review in fiscal year 2010 of SEC's automated posting for offsetting collections subsequent to the correction date identified that the postings were in compliance with written documentation and the U.S. Standard General Ledger. As a result of these actions, SEC has enhanced its accounting for budgetary transactions and thereby reduced the risk that the amounts recorded in the general ledger and reported on SEC's Statement of Budgetary Resources are misstated. Moreover, SEC has mitigated the risk of Anti-deficiency Act violations by eliminating the erroneous posting of collections in excess of its current budget authority.

As part of its enforcement responsibilities, the Securities and Exchange Commission (SEC) orders and administers judgments ordering disgorgement and civil monetary penalties against violators of federal securities laws. During fiscal year 2008, SEC implemented a new system module to integrate accounts receivable transactions for disgorgement and penalties with the general ledger. Through our testing of transactions recorded in this new system, we noted errors in disgorgement and penalties receivable transaction information that were not detected, thereby necessitating time-consuming and labor-intensive reconciliations of data on accounts receivable transactions in the general ledger and source data. In April 2009, we recommended that SEC modify existing guidance to provide for a timely and documented supervisory review of all disgorgement and penalty transactions entered in the general ledger to ensure that transactions are entered completely and accurately. In response to our recommendation, in fiscal year 2009, SEC implemented a detailed procedures guide intended to ensure that disgorgement and penalty transactions are recorded completely and accurately within the general ledger including weekly reconciliation procedures between the general ledger and source data. These actions, if fully and effectively implemented, should provide timely assurance that disgorgement and penalty transactions are recorded completely and accurately.

In our fiscal year 2008 audit of the Securities and Exchange Commission's (SEC) financial statements, we found that SEC's written guidance for funds management did not include a complete and accurate set of accounting entries necessary to account for offsetting collections and the return of appropriated funds to the U.S. Treasury. The lack of complete and accurate written guidance for these postings can lead to inconsistencies and errors in accounting for offsetting collections against SEC's appropriated amounts, including possible Anti-deficiency Act violations due to the erroneous posting of collections in excess of its current budget authority. In fiscal year 2008, SEC recorded approximately $983.7 million in adjusting entries to correct transaction errors resulting from incorrect posting configurations for offsetting collections. In April 2009, we recommended that SEC update the written guidance for funds management to include correct accounting entries and use of correct general ledger accounts for recording offsetting collections transactions. In response to our recommendation, in fiscal year 2009, SEC updated its process documentation guidance to reflect all necessary transaction entries and related proper general ledger accounting. As a result of this revised documentation, SEC has increased its assurance that offsetting collections are consistently and accurately recorded. Moreover, SEC has mitigated the risk of Anti-deficiency Act violations.