2022 Report and Certification of Internal Supervisory Controls

2022 Report and Certification of Internal Supervisory Controls

Introduction

Section 961 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the

“Act”) requires that not later than 90 days after the end of each fiscal year, the Securities and

Exchange Commission (“SEC” or “Commission”) shall report to the U.S. Senate Committee

on Banking, Housing, and Urban Affairs and the U.S. House Committee on Financial

Services on the conduct by the Commission of enforcement investigations, reviews of

corporate financial securities filings, and examinations of registered entities. 1 This report is

being submitted for the Commission's fiscal year ending September 30, 2022.

Background

The SEC’s mission is to protect investors; maintain fair, orderly, and efficient markets; and

facilitate capital formation. Although the SEC’s functional responsibilities are organized

among six divisions and 24 offices, the scope of the activities covered in Section 961 fall

principally under the purview of: the Division of Enforcement (“Enforcement”), the

Division of Corporation Finance (“Corporation Finance”), the Division of Examinations

(“EXAMS”), 2 and the Office of Credit Ratings (“OCR”). 3 Therefore, in the context of this

report, references to “the Commission’s internal supervisory controls” or “internal

supervisory controls of the Commission” relate to the relevant internal supervisory controls

of Enforcement, Corporation Finance, EXAMS, and OCR.

Enforcement is principally responsible for assisting the Commission in executing its law

enforcement function by, among other things, conducting investigations of potential

securities law violations; recommending in appropriate circumstances that the Commission

institute civil actions in federal court or before an administrative law judge; and prosecuting

cases on behalf of the Commission. Corporation Finance is principally responsible for

selectively reviewing disclosure documents that securities issuers (other than investment

companies) file with the Commission. Through Corporation Finance’s review process, the

Division provides comments where it believes filers can improve or enhance their

compliance with the disclosure requirements of the federal securities laws. EXAMS

principally administers the examination program for SEC-registered entities including,

among others, self-regulatory organizations, broker-dealers, transfer agents, clearing

agencies, municipal advisors, investment companies, and investment advisers. EXAMS

conducts examinations to improve compliance with the securities laws, prevent fraud,

1

References to “examinations” within this report refer to both examinations and inspections conducted by either the

Division of Examinations or the Office of Credit Ratings.

2

In December 2020, the Office of Compliance Inspections and Examinations was renamed the Division of Examinations.

3

OCR was created in June 2012 and assumed from the Office of Compliance Inspections and Examinations the responsibility

for conducting examinations of entities that are registered as nationally recognized statistical rating organizations (NRSROs).

Consequently, OCR, as a successor office to EXAMS, is required to provide a certification under Section 961(c)(1).

Page 1

monitor risks, and inform policy. Finally, OCR is responsible for conducting examinations

and monitoring the activities of nationally recognized statistical rating organizations to

assess and promote compliance with statutory and Commission requirements.

This report describes the scope and methodology used to evaluate the internal supervisory

controls and relevant procedures applicable to the Enforcement, Corporation Finance,

EXAMS, and OCR staff who perform enforcement investigations, reviews of corporate

financial securities filings, and examinations of registered entities. Furthermore, the report

describes the assessments performed and whether any significant deficiencies in the internal

supervisory controls under Section 961 have been identified by the evaluation to exist as of

the end of the fiscal year. The report also includes a description of the inherent limitations of

procedures applicable to staff, internal supervisory controls, and the evaluation process.

Finally, the report includes the Certification of Supervisory Controls that is required by the

Act and a summary of the Comptroller General’s review pursuant to Section 961(e) of the

Act.

Internal Supervisory Controls and Procedures Applicable to Staff

Section 96l(b)(l) of the Act requires the assessment of both the Commission’s internal

supervisory controls and procedures applicable to the Commission staff who perform

enforcement investigations (i.e., Enforcement), reviews of corporate financial securities

filings (i.e., Corporation Finance), and examinations of registered entities (i.e., EXAMS and

OCR). The terms “internal supervisory controls” and “procedures applicable to staff” are not

defined in the Act. Consistent with the scope of Section 961(b)(1)(B), “procedures

applicable to staff” refer to the established “day-to-day” procedures to be followed by the

employees performing examinations, investigations, and reviews. “Internal supervisory

controls” refer to those actions established by Enforcement, Corporation Finance, EXAMS, and

OCR to monitor that the procedures applicable to staff are consistently being performed

according to policy and procedures, and also remain reasonable, adequate and current. This

definition of “internal supervisory controls” is linked to procedures applicable to the staff.

Therefore, for purposes of this report and certification, internal supervisory controls are those

that are supervisory in nature and directly related to the consistent and complete execution

of activities within the scope of Section 961(b)(1)(B): investigations, reviews, and

examinations. The evaluations of internal supervisory controls and procedures applicable to

staff covered by this report for the Commission’s fiscal year ending September 30, 2022

represent the 13th time such evaluations have been conducted pursuant to the requirements

of Section 961 of the Act.

Scope and Methodology

The Directors 4 of Enforcement, Corporation Finance, EXAMS, and OCR, each with the

assistance of his or her supervisory staff and other office or division personnel, evaluated the

4

References to “Directors” in this report include any Acting Directors as permitted by Section 961(d) of the Act. Any

Acting Directors are identified on the last page of Exhibit A to this report.

Page 2

effectiveness of internal supervisory controls and relevant procedures applicable to staff.

Consistent with Section 961(c)(2)(C), the internal supervisory control assessment

encompassed controls in place during the final quarter of the fiscal year ending on

September 30, 2022 and the evaluation of the effectiveness of those controls encompassed

the 90-day period ending on the final day of the fiscal year. Upon completion of the

evaluation, each Director signed a certification concerning the adequacy of the

Commission’s internal supervisory controls with respect to his or her office or division.

Assessments of the effectiveness of the relevant procedures applicable to the staff were

conducted throughout the year as part of on-going monitoring activities, specific procedure

assessments, or through other assessments. The conclusion regarding the effectiveness of those

procedures was made as of the end of the fiscal year.

To facilitate an effective, efficient, and consistent approach to the evaluations, the agency

established a working group consisting of staff from Enforcement, Corporation Finance,

EXAMS, OCR, and the Office of the Chief Risk Officer. The working group met and

communicated regularly to discuss the execution of each division’s or office’s assessment

and to ensure a consistent methodology for conducting the Section 961 assessment

corresponding with relevant government-wide internal controls standards and guidance.

Enforcement, Corporation Finance, EXAMS, and OCR engaged in a “top-down, risk-based”

consideration of their functional responsibilities, focusing on assessing their respective

objectives of consistently conducting investigations, reviews of corporate financial

securities filings, or examinations in accordance with adopted policies and procedures. This

approach involved identifying risks to achieving such objectives, determining whether

controls exist (or should exist) to address those risks, and evaluating the design and

operating effectiveness of the controls included in the evaluation. The procedures for

collecting information to evaluate the effectiveness of internal supervisory controls

consisted principally of interviews, observation, process walkthroughs, inspection of

documents, self-assessments, and through the application of judgment, as appropriate. The

approach of Enforcement, Corporation Finance, EXAMS, and OCR in assessing the

effectiveness of the procedures applicable to the staff who perform enforcement investigations,

reviews of corporate financial securities filings, and examinations of registered entities generally

involved identifying the relevant procedures applicable to the staff, determining the objective of

those procedures, and assessing whether those procedures effectively achieve the identified

objectives.

In addition, relevant members of the working group reviewed and considered background

material that included the review of the internal supervisory controls pursuant to the

requirements of Section 961 of the Act, the Federal Managers’ Financial Integrity Act

(“FMFIA”) assurance statements for fiscal year 2022, and recent Office of Inspector

General (“OIG”) and Government Accountability Office (“GAO”) findings.

Finally, Enforcement, Corporation Finance, EXAMS, and OCR reviewed any deficiencies

identified in the design or operation of internal supervisory controls to determine whether

such deficiencies were considered significant, either individually or in the aggregate.

Page 3

Enforcement, Corporation Finance, EXAMS, and OCR provided summary information for

such determination and for the evaluation as a whole to the respective office or division

Director in order to support the relevant effectiveness conclusions and the assertions within

the certification.

The SEC will continue to enhance the approach taken in 2022 to improve the effectiveness

and efficiency of the efforts going forward. The results of GAO’s reviews under Section

96l(e) of the Act may also result in adjustments to the process in future years.

Inherent Limitations

All control systems, including internal supervisory controls, are subject to inherent

limitations. No matter how well-conceived and operated, an internal control system cannot

provide absolute assurance regarding the achievement of objectives, nor can an evaluation

of an internal control system or procedures applicable to staff provide absolute assurance

that significant deficiencies will be identified. Also, projections of any evaluation of

effectiveness to future periods are subject to the risk that internal supervisory controls may

become inadequate because of changes in conditions, or that the degree of compliance with

the policies or procedures may deteriorate.

Because of the nature, including breadth, of the Commission’s investigation, review of

corporate financial securities filings, and examination functions, as well as limitations on

resources, management and staff must exercise judgment in conducting enforcement

investigations, reviews of corporate financial securities filings, and examinations of

registered entities. As such, staff procedures are inherently designed to allow for the

application of judgment in decision-making. There may be instances where judgments made

in good faith are in hindsight deemed inappropriate. Despite the limitations described

above, the evaluations of the Commission’s internal supervisory controls and procedures

applicable to staff are designed to provide a reasonable and justifiable basis for the

conclusions expressed in this report.

Certification and Reporting

Section 96l(c)(2)(D) requires each respective Director of Enforcement, Corporation Finance,

EXAMS, and any successor offices (i.e., OCR) to certify that he or she has disclosed to the

Commission any significant deficiencies in the design or operation of internal supervisory

controls that could adversely affect the ability of the applicable division or office to

consistently conduct enforcement investigations, reviews of corporate financial securities

filings, or examinations of registered entities with professional competence and integrity.

Under the terms of Reorganization Plan No. 10 of 1950, the executive and administrative

functions of the Commission are transferred to the Chair of the Commission, including,

among other functions, the appointment and supervision of personnel employed under the

Page 4

Commission.5 Accordingly, the Director of each respective division or office should make

any required disclosures to the Chair of the Commission. To make this clear, the attached

certification states that the respective Directors have “disclosed to the Chair of the

Commission any significant deficiencies in the design or operation of internal supervisory

controls.” A copy of this report is also being provided to each Commissioner.

As part of the evaluation process described above, the respective Enforcement, Corporation

Finance, EXAMS, and OCR assessment teams evaluated their findings to determine whether

any deficiencies in the design or operation of internal supervisory controls existed as of the

end of the fiscal year. For any such deficiencies, the severity was evaluated to determine

whether any, either individually or in the aggregate, constituted a significant deficiency.

For purposes of making the determinations described above, a “significant deficiency”

meriting the attention by the Chair of the Commission, is any deficiency, or combination of

deficiencies, in internal supervisory controls that inhibits the respective office or division

from achieving the overall goals established by senior management for consistently

conducting enforcement investigations, reviews of corporate financial securities filings, or

examinations of registered entities with professional competence and integrity.

Summary of FY 2022 Assessment Results

Following the process and methodology described above, Enforcement, Corporation

Finance, EXAMS, and OCR evaluated the effectiveness of the applicable internal

supervisory controls and staff procedures with respect to the fiscal year ending September

30, 2022. Based on the results of these evaluations, the internal supervisory controls with

respect to Enforcement investigations, Corporation Finance reviews of corporate financial

securities filings, and EXAMS and OCR examinations of registered entities were effective

for the 90-day period ending on the final day of the fiscal year ending on September 30,

2022. No significant deficiencies in the internal supervisory controls with respect to

Enforcement investigations, Corporation Finance reviews of corporate financial securities

filings, and EXAMS and OCR examinations of registered entities were identified. In

addition, the procedures applicable to the Enforcement, Corporation Finance, EXAMS, and

OCR staff who perform enforcement investigations, reviews of corporate financial securities

filings, and examinations of registered entities, respectively, were effective as of the end of

the fiscal year.

Certification of Internal Supervisory Controls

See Exhibit A - Section 961(c)(2) Certification

5 15 F.R. 3175, 64 Stat. 1265. Section l(a).

Page 5

Summary of Reviews by the GAO

Section 96l(e) of the Act requires a triennial review by the Comptroller General of the

United States of the adequacy and effectiveness of the Commission's internal supervisory

control structure and procedures. Section 961(b)(3) of the Act requires this report to contain

a summary of the GAO's review. The SEC staff appreciates the benefit of these regular

GAO reviews, which have enabled the SEC to improve its internal supervisory control

systems and procedures over the past decade:

•

In April 2013, the GAO completed its first triennial review under Section 961(e).

This report (GAO-13-314) contained one recommendation for SEC action, which the

SEC implemented. The GAO considers this recommendation closed, indicating on

its website that it found in a subsequent review that the “SEC has improved the

design, operation, and documentation of its internal supervisory controls since the

issuance of GAO-13-314.”

•

In October 2016, the GAO completed its second triennial review. This report (GAO-1716) contained one recommendation for SEC action, which the SEC implemented. The

GAO considers this recommendation closed, indicating on its web site that the actions

taken by the SEC were a “critical step to streamline their 961 supervisory control

documentation, and increase the operating efficiency and effectiveness within and across

the divisions and offices.”

•

In December 2019, the GAO completed its third triennial review. This report (GAO20-115) contained five recommendations for SEC action, which the SEC

implemented. In September 2021, the GAO updated its website to indicate that all

five recommendations have been implemented and are now closed.

The GAO recently completed its fourth triennial review. The GAO’s report (GAO-23105465, November 18, 2022) found that (1) the SEC in FY 2021 generally conducted risk

assessments and established internal supervisory controls in accordance with applicable

guidance and (2) the SEC’s framework for assessing the effectiveness of internal

supervisory controls generally was consistent with federal internal control standards. While

the GAO also found that the SEC’s plans for assessing the effectiveness of staff procedures

generally were consistent with internal control standards and implemented accordingly, the

GAO recommended that Enforcement take action to document its work performed and

results in the memorandum used to inform the division director about the staff procedures

assessment. The GAO also recommended that Enforcement, Corporation Finance, EXAMS,

and OCR enhance their guidance for assessing staff procedures to address the use of

program data and require review of their program manuals on a periodic and comprehensive

basis. The SEC concurred with the GAO’s findings and is taking action to implement the

recommendations.

Page 6

Exhibit A

SECTION 961(c)(2) CERTIFICATION

Pursuant to the requirements of Section 961(c)(2) of the Dodd-Frank Wall Street Reform and

Consumer Protection Act, I hereby certify that:

1.

I am directly responsible for establishing and maintaining the internal supervisory

controls of the division or office of which I am the head.

2.

I am knowledgeable about the internal supervisory controls of the division or office

of which I am the head.

3.

I have evaluated the effectiveness during the 90-day period ending on the final day of

the fiscal year ended September 30, 2022 of the internal supervisory controls relevant

to section 961 of the division or office of which I am the head.

4.

I have disclosed to the Chair of the Commission any significant deficiencies in the

design or operation of internal supervisory controls identified as a result of the

evaluation described above that could adversely affect the ability to consistently

conduct with professional competence and integrity, respectively:

(a)

Enforcement investigations by the Division of Enforcement;

(b)

Reviews of corporate financial securities filings by the Division of

Corporation Finance; or

(c)

Examinations of registered entities by the Division of Examinations and the

Office of Credit Ratings.

This certification concerning the adequacy of the Commission’s internal supervisory controls

relevant to Section 961 is based on the review described in the accompanying report of the

internal supervisory controls and procedures applicable to the staff who perform the duties

described above within the division or office of which I am the head and is accurate to the best of

my knowledge and belief. This review was performed with the assistance of my supervisory

staff and other personnel within my division or office.

Page 7