Recommendation: The SEC Chair should direct the Directors of the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop written policies and processes to systematically assess the effectiveness of staff procedures (procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings). Examples of elements SEC could include in the policies and processes are the steps necessary to conduct such assessments, including time frames in which the assessments should be performed and reviewed; assignment of responsibilities related to the assessments; requirements for documenting assessments; and steps for staff to take to mitigate and report deficiencies identified as a result of the assessments. (Recommendation 1)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: As of May 2020, SEC updated its Reference Guide for Compliance with Section 961 of the Dodd-Frank Act to require the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop and maintain written policies and processes for conducting systematic assessments of the effectiveness of procedures applicable to the staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. The added requirement for each division and office to develop policies and processes is a positive step toward addressing this recommendation. However, until the divisions and offices establish such policies and processes, this recommendation remains open. SEC staff stated that the divisions and offices are currently working on developing their individual frameworks for assessing staff procedures and will likely be done by the end of fiscal year 2020. We will continue to monitor these efforts.

Recommendation: The Director of the Division of Corporation Finance should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 2)

Agency: United States Securities and Exchange Commission: Division of Corporation Finance
Status: Open

Comments: As of May 2020, SEC staff said that the Division of Corporation Finance is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Division of Corporation Finance provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Division of Enforcement should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 3)

Agency: United States Securities and Exchange Commission: Division of Enforcement
Status: Open

Comments: As of May 2020, SEC staff said that the Division of Enforcement is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Division of Enforcement provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Office of Compliance Inspections and Examinations should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 4)

Agency: United States Securities and Exchange Commission: Office of Compliance Inspections and Examinations
Status: Open

Comments: As of May 2020, SEC staff said that the Office of Compliance Inspections and Examinations is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Office of Compliance Inspections and Examinations provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Office of Credit Ratings should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 5)

Agency: United States Securities and Exchange Commission: Office of Credit Ratings
Status: Open

Comments: As of May 2020, SEC staff said that the Office of Credit Ratings is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Office of Credit Ratings provides documentation showing the implementation of responsive actions.