Section 961 of the Dodd-Frank Act directs SEC to annually assess and report on internal supervisory controls for staff performing examinations, corporate financial securities filing reviews, and investigations. The act also requires the Government Accountability Office (GAO) to review SEC's structure for internal supervisory control applicable to staff working in those offices.
The GAO recently completed the review and released the findings. The report examining the steps the offices took to develop an internal supervisory control framework; internal supervisory controls each office has implemented; and the extent to which the internal supervisory controls have operated as intended.
GAO reviewed each office's section 961 assessments and reports; analyzed the offices' internal supervisory control framework; and tested a sample of 60 supervisory controls using random samples and nonprobability selections.
GAO identified deficiencies in about half of the 60 internal supervisory controls it tested. Specifically, GAO found that for 27 internal supervisory controls (1) the description of the control activity did not accurately reflect policy or practice; (2) documentation demonstrating execution of the control was not complete, clear, or consistent; or (3) the controls lacked clearly defined control activities. These control deficiencies may not prevent management from detecting whether the activities of the offices are conducted completely and in accordance with policy. However, similarities in the nature of deficiencies across all three offices suggest that management attention to the design and operation of internal supervisory controls is warranted.
The GAO recommended in order to help ensure that controls are properly designed and operating effectively, SEC should make certain that existing internal supervisory controls and any developed in the future have clearly defined activities and clear and readily available documentation demonstrating execution of the activities.