Recommendation: The SEC Chair should direct the Directors of the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop written policies and processes to systematically assess the effectiveness of staff procedures (procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings). Examples of elements SEC could include in the policies and processes are the steps necessary to conduct such assessments, including time frames in which the assessments should be performed and reviewed; assignment of responsibilities related to the assessments; requirements for documenting assessments; and steps for staff to take to mitigate and report deficiencies identified as a result of the assessments. (Recommendation 1)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: As of May 2020, SEC updated its Reference Guide for Compliance with Section 961 of the Dodd-Frank Act to require the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop and maintain written policies and processes for conducting systematic assessments of the effectiveness of procedures applicable to the staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. The added requirement for each division and office to develop policies and processes is a positive step toward addressing this recommendation. However, until the divisions and offices establish such policies and processes, this recommendation remains open. SEC staff stated that the divisions and offices are currently working on developing their individual frameworks for assessing staff procedures and will likely be done by the end of fiscal year 2020. We will continue to monitor these efforts.

Recommendation: The Director of the Division of Corporation Finance should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 2)

Agency: United States Securities and Exchange Commission: Division of Corporation Finance
Status: Open

Comments: As of May 2020, SEC staff said that the Division of Corporation Finance is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Division of Corporation Finance provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Division of Enforcement should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 3)

Agency: United States Securities and Exchange Commission: Division of Enforcement
Status: Open

Comments: As of May 2020, SEC staff said that the Division of Enforcement is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Division of Enforcement provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Office of Compliance Inspections and Examinations should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 4)

Agency: United States Securities and Exchange Commission: Office of Compliance Inspections and Examinations
Status: Open

Comments: As of May 2020, SEC staff said that the Office of Compliance Inspections and Examinations is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Office of Compliance Inspections and Examinations provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Office of Credit Ratings should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 5)

Agency: United States Securities and Exchange Commission: Office of Credit Ratings
Status: Open

Comments: As of May 2020, SEC staff said that the Office of Credit Ratings is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Office of Credit Ratings provides documentation showing the implementation of responsive actions.

Recommendation: The Chair of the Securities and Exchange Commission should direct the Chief Operating Officer to develop and implement safeguards to better ensure transparency and fairness in SEC's new performance incentive bonus program. Such safeguards could include multiple levels of review of performance ratings and pay decisions and publishing aggregate data on the results of the performance cycle that allow employees to compare results across various groups within the agency while protecting the confidentiality of individual ratings and pay decisions. (Recommendation 1)

Agency: United States Securities and Exchange Commission
Status: Open
Priority recommendation

Comments: SEC stated that it concurred with, and plans to implement, our recommendation. In August 2020, SEC officials stated that they were continuing to design the performance incentive bonus program's framework and in the process of acquiring consultative services to assist in validating that its design, communication strategy, and operating practices reflect leading practice and support achieving desired outcomes. We will continue to monitor SEC's progress in ensuring transparency and fairness in its performance incentive bonus program.

Recommendation: The Securities and Exchange Commission's Co-Directors of Enforcement should develop written procedures for generating Enforcement's public reports, including procedures for compiling and verifying statistics used in the reports and documenting their implementation. (Recommendation 1)

Agency: United States Securities and Exchange Commission: Division of Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: SEC should publicly disclose its section 610 reviews, or summaries of the reviews, with the basis for any conclusions. Such disclosure could include publishing results in the Federal Register or on the agency's website. (Recommendation 10)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: In March 2019, SEC provided us with supplemental policies and procedures it developed for compliance with the Regulatory Flexibility Act (RFA), including section 610 reviews. The procedures require staff to publish on SEC's website a notice that section 610 reviews have been completed and, if the agency plans any further actions, a published RFA agenda would so indicate. Although these notices communicate with interested entities about the status of ongoing as well as completed section 610 reviews, they will not include any details about the basis for SEC's conclusions during the review. Therefore, they do not full implement GAO's recommendation, which remains open.

Recommendation: The Chairman of the Securities and Exchange Commission should ensure that the Commission's Chief Information Officer identifies the agency's future telecommunications needs, areas for optimization, and the costs and benefits of new technology; completes a strategic analysis of the commission's telecommunications requirements; and incorporates the identified requirements into transition planning. (Recommendation 12)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: The Securities and Exchange Commission (SEC) concurred with our recommendation. SEC stated that it plans to establish an EIS planning team comprised of key IT personnel from across the agency to identify, among other things, future needs and areas for improvement, so that SEC can incorporate the results into its transition planning. However, SEC has not yet provided documentation demonstrating that it has completed these efforts. We will continue to monitor SEC's progress implementing this recommendation.

Recommendation: The Chairman of the Securities and Exchange Commission should ensure that the Commission's Chief Information Officer identifies roles and responsibilities related to the management of assets and human capital and legal expertise for the transition; includes key local and regional officials in SEC's transition communications plan; and completes efforts to use configuration and change management processes in the transition. (Recommendation 13)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: The Securities and Exchange Commission (SEC) concurred with our recommendation and stated that it plans to document the roles and responsibilities of key EIS transition team members across the agency. The agency also plans to develop a transition communications plan that includes configuration and change management practices. However, SEC has not yet provided documentation demonstrating that it has completed these efforts. We will continue to monitor SEC's progress implementing this recommendation.

Recommendation: The Chairman of the Securities and Exchange Commission should ensure that the Commission's Chief Information Officer identifies the resources needed for the full transition, justifies requests for transition resources, identifies staff resources needed for the full transition, and completes efforts to analyze training needs for staff assisting with the transition. (Recommendation 14)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: In response to our recommendation, the Securities and Exchange Commission (SEC) provided a high-level budget estimate for the transition. However, it was unclear what costs were included in this estimate and the agency did not provide documentation that justified the costs identified. In addition, SEC has not yet provided an analysis of the staff resources it needs for the transition, nor an analysis of the training needs for the staff assisting with the transition. We will continue to monitor SEC's efforts to implement this recommendation.

Recommendation: The Chairman of the Securities and Exchange Commission should ensure that the Commission's Chief Information Officer completes efforts to demonstrate that the commission's transition goals and measures align with its mission, identifies transition risks related to critical systems and continuity of operations, and identifies mission-critical priorities in SEC's transition timeline. (Recommendation 15)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: The Securities and Exchange Commission (SEC) has demonstrated that its transition goals and measures align with its mission. In addition, the commission has identified transition risks related to continuity of operations. However, SEC has not yet identified transition risks related to its critical systems, nor identified mission-critical priorities in its transition timeline. We will continue to monitor SEC's progress on these efforts.

Recommendation: To help SEC address identified personnel management challenges, and to help enhance the credibility of its performance management system, the Chairman of SEC should direct the COO and OHR to conduct periodic validations (with staff input) of the performance management system and make changes, as appropriate, based on these validations.

Agency: United States Securities and Exchange Commission
Status: Open
Priority recommendation

Comments: SEC management and the union agreed in November 2018 to implement a new performance management system and a new incentive bonus program in 2020. According to SEC officials, SEC plans to work with OPM to validate the new performance management system by conducting focus groups with staff at the midpoint of the 2020 appraisal period and surveying staff on the new system at the conclusion of the 2020 appraisal period. These plans are consistent with our 2013 recommendation that SEC should conduct periodic validations of its performance management system. In August 2020, SEC reported that it began implementation of the new 2-tier performance management program and will complete the annual rating cycle in December 2020, with feedback and appraisal closeout activities occurring in early calendar year 2021. According to SEC, OPM will assess the new program after calendar year 2020 performance cycle activities are completed. We will continue to monitor SEC's progress in validating the new performance management system.

Recommendation: To address the current information gap in Regulation SHO for prime brokerage arrangements and mitigate the impact of any unintended consequences caused by SEC rules, as well as ensure consistent implementation of SEC rules by the industry, the Chairman of the Securities and Exchange Commission should finalize, in an expedited manner upon finalization of the temporary rule, the revised 1994 Prime Broker Letter.

Agency: United States Securities and Exchange Commission
Status: Open

Comments: As of June 4, 2019, the revised Prime Broker letter has not been finalized. Staff from the Reg SHO team in SEC's Trading and Markets division stated that they have regularly and continuously asked the industry for comments on the Prime Broker Letter without receiving any real progress. Their most recent request for comments was emailed to industry counsel on May 22, 2019. Industry counsel acknowledged the request but have yet to provide comments.