This is the accessible text file for GAO report number GAO-11-348R 
entitled 'Management Report: Improvements Needed in SEC's Internal 
Controls and Accounting Procedures' which was released on March 29, 
2011. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

GAO-11-348R: 

United States Government Accountability Office: 
Washington, DC 20548: 

March 29, 2011: 

The Honorable Mary L. Schapiro:
Chairman:
U.S. Securities and Exchange Commission: 

Subject: Management Report: Improvements Needed in SEC's Internal 
Controls and Accounting Procedures: 

Dear Ms. Schapiro: 

On November 15, 2010, we issued our opinion on the U. S. Securities 
and Exchange Commission's (SEC) fiscal years 2010 and 2009 financial 
statements. We also issued our opinion on the effectiveness of SEC's 
internal controls over financial reporting as of September 30, 2010, 
and our evaluation of SEC's compliance with selected provisions of 
laws and regulations during fiscal year 2010.[Footnote 1] In that 
report we identified material weaknesses in SEC's controls. 

The purpose of this report is to present (1) more detailed information 
and our recommendations related to the material weaknesses we reported 
and discussed in our opinion report;[Footnote 2] (2) less significant 
internal control issues we identified during our fiscal year 2010 
audit of SEC's internal controls and accounting procedures, along with 
our related recommended corrective actions; (3) summary information on 
the status of the recommendations reported as open in our March 31, 
2010, management report[Footnote 3] (see enclosure I), and (4) the 
status of the security weaknesses in information systems controls at 
SEC that we identified in public and "Limited Official Use Only" 
reports issued in 2005 through 2009,[Footnote 4] that were unresolved 
at the time of our March 31, 2010, management report[Footnote 5] (see 
enclosure II). 

Results in Brief: 

As part of our audit of SEC's fiscal years 2010 and 2009 financial 
statements, we identified two material weaknesses[Footnote 6] in 
internal control as of September 30, 2010.[Footnote 7] These material 
weaknesses concern SEC's (1) information systems controls and (2) 
controls over financial reporting and accounting processes. The 
material weakness we identified over information systems, including 
continuing deficiencies reported in prior audits, spanned both SEC's 
general support system and all key SEC financial reporting 
applications. The material weakness in financial reporting and 
accounting processes we identified encompassed deficiencies in five 
areas of SEC's operations and related reporting: 

* financial reporting process, 

* budgetary resources, 

* registrant deposits, 

* disgorgement and penalties, and: 

* required supplementary information. 

These material weaknesses may adversely affect the accuracy and 
completeness of information used and reported by SEC's management. We 
are making a total of 30 new recommendations to address these material 
weaknesses. 

We also identified other internal control issues that, although not 
considered material weaknesses or significant control deficiencies, 
warrant SEC management's consideration. These issues concern: 

* proper and timely approvals of disbursements, 

* review of service providers' auditor reports, and: 

* controls over travel transaction documentation. 

We are making a total of 3 new recommendations related to these less 
significant control deficiencies. 

We are also providing summary information on the status of SEC's 
actions to address the recommendations from our prior audits as of the 
conclusion of our fiscal year 2010 audit. Specifically, as summarized 
in enclosure I, by the end of our fiscal year 2010 audit, we found SEC 
took action to fully address 17 of the 50 recommendations from our 
prior audits that were open at the time of our March 31, 2010, 
management report.[Footnote 8] 

Lastly, we are providing summary information on the status of SEC's 
actions to address previously reported information system security 
weaknesses. Specifically, as shown in the table 1 of enclosure II, as 
of the end of fiscal year 2010, we found SEC took action to address 18 
of the 22 security weaknesses in information systems controls that 
were open at the time of our March 31, 2010, management report. 
[Footnote 9] 

In providing written comments on a draft of this report, the SEC 
Chairman stated that remediation of the agency's two material 
weaknesses is a top priority for SEC. The Chairman stated that SEC is 
taking a number of steps to address the material weaknesses this 
fiscal year; however, putting SEC's internal controls on a solid 
footing over the long term primarily requires significant investment 
in SEC's financial systems. The Chairman also stated that the 
centerpiece of SEC's remediation strategy is to migrate its core 
financial system and transaction processing to a Federal Shared 
Service Provider. SEC also provided technical comments which we 
incorporated as appropriate. We will evaluate SEC's actions, 
strategies, and plans as part of our fiscal year 2011 audit. SEC's 
written comments are reprinted in enclosure IVII. 

Scope and Methodology: 

As part of our audit of SEC's fiscal years 2010 and 2009 financial 
statements, we evaluated SEC's internal controls over financial 
reporting and tested its compliance with selected provisions of laws 
and regulations. We designed our audit procedures to test relevant 
controls over financial reporting, including those designed to provide 
reasonable assurance that transactions are properly recorded, 
processed, and summarized to permit the preparation of financial 
statements in conformity with U.S. generally accepted accounting 
principles, and that assets are safeguarded against loss from 
unauthorized acquisition, use, or disposition. As part of our audit, 
we considered and evaluated the work performed and conclusions reached 
by SEC management in its internal control assessment.[Footnote 10] 
Further details on our scope and methodology are included in our 
November 2010 report on our audits of SEC's fiscal years 2010 and 2009 
financial statements and are summarized in enclosure IVII. 

We conducted our audit of SEC's fiscal year 2010 and 2009 financial 
statements in accordance with U.S. generally accepted government 
auditing standards. We believe our audit provided a reasonable basis 
for conclusions in this report. 

Material Weaknesses over Information Systems, and Financial Reporting 
and Accounting Processes: 

During our fiscal year 2010 audit of SEC's controls over financial 
reporting, we identified two material weaknesses in internal control 
as of September 30, 2010. These material weaknesses concerned SEC's 
controls over (1) information systems and (2) financial reporting and 
accounting processes. Our findings related to each of these material 
weaknesses are discussed in the following sections, along with our 
recommended actions to address these weaknesses. 

Material Weakness over Information Systems Controls: 

During fiscal year 2010, we found SEC had pervasive deficiencies in 
the design and operation of its information security and other system 
controls that spanned its general support system and all key financial 
reporting applications. These deficiencies were in the areas of (1) 
security management, (2) access controls, (3) configuration 
management, (4) segregation of duties, and (5) contingency planning. 
Many of these deficiencies were continuing deficiencies identified 
during our prior audits. 

A material weakness in information systems increases the potential for 
undetected material misstatements in SEC's financial statements and 
inadvertent or deliberate misuse, fraudulent use, improper disclosure, 
or destruction of its financial information and assets. Our conclusion 
that the information system control deficiencies we identified 
represent a material weakness is consistent with SEC's own 2010 
attestation on the effectiveness of internal controls.[Footnote 11] 
That is, SEC management's self-assessment identified information 
system control deficiencies in all key financial reporting 
applications and the general support system across all SEC's 
information system control areas. Many deficiencies SEC identified 
were similar to prior year GAO reported issues. For example, 
consistent with SEC's 2010 findings, GAO has previously reported that: 

* Controls were not adequate to ensure that an effective security 
audit log and monitoring capability have been implemented. 

* Users' system access to a key financial application were not 
periodically (at least annually) recertified to ensure their access 
remains appropriate. 

* System administrators had full access into a major financial 
application and the function of the system administration and security 
monitoring was not separated. 

* SEC did not ensure timely remediation of identified vulnerabilities 
on a key financial application. 

* Controls were not effective to ensure that SEC followed 
implementation procedures and processes of the enterprise 
configuration management plan in order to effectively support the 
change management life cycle of its general support systems. 

We continue to reaffirm our recommendations related to each of these 
previously reported weaknesses that SEC has not fully addressed. 
Because GAO did not report new deficiencies relating to access 
controls and configuration management in fiscal year 2010, 
deficiencies in these areas are not discussed further in this report. 
The following paragraphs provide additional details concerning 
deficiencies we identified in fiscal year 2010 in the areas of 
security management, segregation of duties, and contingency planning. 

Security Management: 

We identified weaknesses in SEC's security management controls over 
key financial reporting systems. In this regard, we found that SEC did 
not adequately: 

* implement all elements of an entitywide information security program 
consistent with Federal Information Security Management Act 
(FISMA)[Footnote 12] requirements and National Institute of Standards 
and Technology (NIST) guidance ; 

* remediate information system deficiencies timely consistent with SEC 
policy; or: 

* monitor system security audit logs. 

Consistent with our findings, SEC management's 2010 self-assessment 
identified security management issues as part of its internal control 
evaluation over information system controls. For example, SEC 
identified that not all elements of an entitywide information security 
program plan were in place for the general support system (GSS), such 
as a vulnerability scanning process and information security metrics 
and reporting. 

Additionally, SEC management's 2010 self assessment found SEC did not 
monitor system security audit logs for its system used by SEC's budget 
office for the original entry of all budget information. Further, SEC 
did not resolve in a timely manner open issues on the Plan of Action 
and Milestones (POA&M) pertaining to its GSS and also missed its 
target completion dates. 

These control weaknesses jeopardize the confidentiality, availability, 
and integrity of automated information processed by SEC's financial 
reporting systems and increase the risk of material misstatement in 
financial reporting. 

Recommendations for Executive Action: 

In addition to completing actions that address the outstanding 
previously reported information system security-related weaknesses, we 
recommend that the Chairman direct the Chief Operating Officer (COO) 
and Chief Information Officer (CIO) to take the following specific 
actions: 

1. Establish a mechanism to ensure current procedures for implementing 
all elements of an entitywide information security program for GSS are 
followed, consistent with FISMA requirements and NIST guidance. 

2. Establish a mechanism to ensure current procedures to ensure timely 
follow up on outstanding GSS POA&M items are followed, consistent with 
SEC policy. 

3. Establish a mechanism to ensure current procedures for audit 
logging and audit log monitoring activities are followed for all 
financial systems. 

Segregation of Duties: 

The NIST Special Publication 800-53, Recommended Security Controls for 
Federal Information Systems and Organizations, provides that federal 
entities should establish appropriate divisions of responsibility and 
separate duties as appropriate to eliminate conflicts of interest in 
the assigned duties of individuals, and information systems access 
authorizations. NIST also provides that entities should develop, 
disseminate, and periodically review and update, as appropriate: (1) a 
formal, documented, personnel security policy that addresses purpose, 
scope, roles, responsibilities, coordination among organizational 
entities, and compliance; and (2) formal, documented procedures to 
facilitate the implementation of the personnel security policy and 
associated personnel security controls. 

However, we found SEC did not always adequately segregate computer- 
related duties and functions. For example, we found that a human 
resource manager had access to both the reviewer and validator 
(timekeeper) functions in SEC's time and attendance system. Without 
appropriate enforcement of segregation of duties, personnel with 
inappropriate access to accounts unrelated to their duties and job 
requirements could jeopardize data integrity. 

Recommendations for Executive Action: 

4. We recommend that the Chairman direct the COO and CIO to take the 
following specific actions: 

Establish a mechanism to ensure current procedures to periodically 
review the information system access and roles of all SEC personnel 
for suitability and compliance with authorized security forms are 
followed, consistent with SEC policy. 

Contingency Planning: 

SEC policy requires each major application (MA) and GSS to be covered 
by a business impact analysis (BIA). The BIA is an essential component 
of the SEC business continuity management program. The BIA links 
specific system components with the critical services they provide, 
identifying the consequences that disruption of the system's 
availability would have on the SEC mission. Further, NIST guidance on 
contingency planning[Footnote 13] provides that entities should 
consider the proximity of geographic distance from the organization's 
primary site to the alternate storage site and the probability of the 
alternate storage site being affected by the same disaster as the 
organization's primary site. 

However, we found that SEC did not (1) perform a required BIA for the 
GSS or (2) conduct a cost analysis relative to the geographic 
separation of the primary Operations Center (OPC) and backup Alternate 
Data Center (ADC). Not performing a BIA on GSS, increases SEC's risk 
that critical operations continuity issues related to GSS will not be 
addressed in the event of a disaster. Further, because of the 
proximity of OPC and the ADC, both locations are potentially at risk 
in the event of a major disaster. SEC management has not conducted an 
analysis of the cost and benefits of relocating the ADC to a different 
geographical area in comparison to the cost of recreating data if a 
major disaster compromised data at both locations. 

Recommendations for Executive Action: 

We recommend that the Chairman direct the COO and CIO to take the 
following specific actions: 

5. Perform and document a BIA for the GSS in accordance with SEC 
policy. 

6. Conduct an analysis of the cost and benefits of relocating the ADC 
to a different geographical area in comparison with the cost of 
recreating data if a major disaster compromised data at both OPC and 
ADC locations. 

Material Weakness over Financial Reporting and Accounting Processes: 

During fiscal year 2010, we also identified deficiencies in internal 
control in five areas, which collectively comprised a material 
weakness over financial reporting and accounting processes. 
Specifically, as discussed in more detail in the following paragraphs, 
we found weaknesses in SEC's (1) financial reporting process, (2) 
budgetary resources, (3) registrant deposits, (4) disgorgement and 
penalties, and (5) required supplementary information. Some of these 
weaknesses were continuing deficiencies identified in our prior year 
audits. These continuing deficiencies and the newly identified 
deficiencies this year resulted in SEC not always identifying and 
correcting errors or omissions in its accounting records and financial 
reports. These financial reporting and accounting control weaknesses 
are particularly important because, as a result of the serious 
deficiencies in information system controls discussed previously, SEC 
was unable to rely on automated controls in its general ledger system 
or any of its key financial reporting applications to reliably account 
for and report on the results of its financial activities. Our 
findings in this area are consistent with SEC's fiscal year 2010 
attestation on the effectiveness of internal controls.[Footnote 14] 

Financial Reporting Process: 

Standards for Internal Control in the Federal Government[Footnote 15] 
provides that internal control is not one event, but a series of 
actions and activities that occur throughout an entity's operations 
and on an ongoing basis. In addition, management should establish 
control activities to ensure that all transactions are completely and 
accurately recorded. Such activities may be applied in a computerized 
information system environment or through manual processes. 

SEC carried out its financial reporting during fiscal year 2010 using 
numerous spreadsheets, databases, manual workarounds, and data 
handling that relied on significant analysis, reconciliation, and 
review to calculate amounts for the general ledger transaction 
postings. In general, these manual processes were resource intensive 
and prone to error, and coupled with the significant amount of data 
involved, increased the risk of materially misstated account balances 
in the general ledger. During 2010, we found SEC's financial reporting 
procedures were not always effective at ensuring the completeness and 
accuracy of the financial data obtained from the application systems 
or at detecting any errors or omissions in financial reporting 
activities. For example, our 2010 audit found: 

* SEC's procedures to prepare monthly financial statements and trial 
balance reports used transaction journals extracted from the general 
ledger (GL), the GL Summary file. During this year's audit, we found 
that a version of the GL Summary file was made available to and used 
by personnel for their calculation and preparation of manual 
adjustments even though over 57,000 records were missing from the 
file. Key users were eventually notified of the corrupted file and 
able to re-perform previously completed work using the corrected GL 
Summary file. However, until SEC establishes continuous controls over 
the completeness of the GL Summary file, SEC is at increased risk of 
material misstatement in financial reporting. 

* SEC did not accurately and completely capture all of the appropriate 
accounts payable activity, resulting in an understatement of the 
accounts payable balance during certain months of the year. According 
to SEC's accounts payable policy, [Footnote 16] and in accordance with 
Statement of Federal Financial Accounting Standards (SFFAS) No. 5, 
[Footnote 17] accounts payable accruals should be made for items when 
a good or service has been received but not yet paid. As we have 
reported in previous years,[Footnote 18] SEC's personnel manually 
extracted unliquidated obligations data from the general ledger and 
performed queries on the resulting file to calculate the monthly 
accounts payable accrual entry. However, we found that SEC's 
spreadsheet queries did not capture all appropriate organization codes 
for its accrual entries in March and April 2010, which understated 
payable accruals for those months. In addition, in its June 2010 
accrual estimate, SEC's accrual process did not consider nearly $3 
million in unpaid invoices for which the related goods or services had 
been received and accepted. In each case, the invoices were entered 
into the general ledger system for tracking purposes, but were 
erroneously excluded from the data extracts used to calculate the 
accounts payable liability. These errors were not identified through 
SEC's spreadsheet control checks. Further, the resulting 
understatements were not detected by the supervisory review and 
approval of the entries that posted to the general ledger. 

* SEC management's monthly review of its manual accounts receivable 
calculations related to its securities transaction revenue[Footnote 
19] did not identify that SEC staff were using the wrong fee rate in 
the calculations for April, May, and June. Specifically, we noted that 
management's review was designed to ensure that the fee rate 
calculations were accurate but did not provide for assessing the 
propriety of data (e.g., fee rate) used in the calculation. As a 
result, SEC's initial calculation of its securities transaction 
revenue receivable balance as of June 30, 2010, was understated by $54 
million. 

* Several of SEC's key spreadsheets used for its financial disclosures 
contained errors, which were not detected by supervisory reviews. For 
example, we found errors in SEC's spreadsheet used for calculating 
future lease payments, which resulted in a $40 million understatement 
of lease payments disclosed in the draft notes accompanying the 
financial statements, and errors in its formula for calculating gross 
cost with the public, which resulted in a $21 million misstatement in 
the draft notes. 

* SEC's accounting process over its investment of disgorgements and 
penalties collections in U.S. Treasury securities with the Bureau of 
Public Debt (BPD) was not effective at ensuring the accuracy and 
validity of recorded investment balances. Specifically, in 2010, SEC 
did not record investment purchase and withdrawal transactions in the 
general ledger as the transaction requests were submitted to BPD or 
utilize internal data when recording investment activity in the 
general ledger. Rather, SEC recorded monthly adjustments to its 
investment balance utilizing reports provided by BPD, without 
reconciling the investment activity to the related purchase and 
withdrawal transactions. Consequently, SEC's monthly adjustment did 
not identify an investment withdrawal transaction that was erroneously 
processed by BPD as an investment purchase. We also found that SEC was 
improperly using BPD reports in its calculation of interest 
receivable. Consequently, SEC's interest receivable balances were 
misstated for a majority of the fiscal year. 

* SEC's review procedures over journal vouchers (JV) transactions were 
not operating effectively to assure the accuracy and validity of JVs 
entered into the general ledger. SEC used JVs for recording 
transactions, corrections, and adjustments into its general ledger 
system. Monthly, responsible preparers copy and paste JV transaction 
data into a consolidated spreadsheet, the JV Log, for processing into 
the general ledger. Under SEC's process for ensuring the accuracy of 
JV entries processed into the general ledger, a senior accountant is 
to review the totals for each set of JVs within the batch file to 
verify that the data was entered appropriately. However, we found this 
control was not being implemented. 

* SEC's unliquidated obligation review process did not identify 
inaccuracies in the Open Obligations Review Reports relied on to 
certify the accuracy of recorded SEC obligations. To support the 
accuracy of obligated balances presented on SEC's Statement of 
Budgetary Resources (SBR), SEC requires all divisions and offices to 
periodically review and certify all unliquidated obligations meeting 
certain aging criteria. In fiscal year 2010, SEC developed a report 
within its general ledger system, the Open Obligations Review Report, 
and decentralized responsibility for oversight of the review process 
to the various divisions and offices. Specifically, under the revised 
process, [Footnote 20] personnel from the various offices are to 
generate the Open Obligations Review Report for their organization 
code and use this report to certify the accuracy of obligations that 
fall under their authority. However, we found the Open Obligations 
Review Reports used by the various offices in conducting their reviews 
were not reliable as a result of systemic errors in the report's 
logic. This breakdown in controls over the completeness of reports 
used in this process by the various offices inhibits SEC management's 
ability to effectively manage unliquidated obligations and increases 
the risk of misstatement in obligated balances presented in the 
financial statements. 

Recommendations for Executive Action: 

To address the deficiencies in internal control over the financial 
reporting and accounting processes we reaffirm our open recommendation 
from our prior audits related to the development of useful reports 
within SEC's general ledger system. In addition, we recommend that the 
Chairman direct the COO and Chief Financial Officer (CFO) take the 
following specific actions: 

7. Augment policies and procedures to ensure the completeness of the 
GL Summary file used to prepare monthly trial balance reports, 
including procedures for identifying and notifying management and key 
users of any errors or omissions detected in the report. 

8. Augment existing control procedures over the GL Summary file by 
requiring documented approval by SEC management before making the file 
available to key users to calculate manual adjustments. 

9. Develop and implement procedures over the preparation of the 
monthly accounts payable accrual calculation and entry to provide 
assurance that all organization codes are included in the calculation. 

10. Augment procedures over the preparation of the monthly accounts 
payable accrual entry to provide for identification of all instances 
in which a good or service has been received and accepted but has not 
yet been paid prior to month-end. 

11. Augment policies and procedures concerning SEC's monthly review 
and recalculation of securities transaction fee assessments to include 
procedures to ensure that the appropriate fee rate is used in the 
calculation of accounts receivable. 

12. Augment policies and procedures concerning supervisory review of 
key spreadsheets used for financial disclosures to provide assurance 
that calculations within the spreadsheets are accurate. 

13. Develop and implement policies and procedures to record investment 
activity in the general ledger using investment purchase and 
withdrawal requests submitted to BPD. 

14. Develop and implement policies and procedures to reconcile 
investment balances reported by BPD to SEC records of investment 
purchase and withdrawal transactions processed during the reporting 
period. 

15. Develop and implement policies and procedures to reconcile SEC's 
calculated interest receivable to interest receivable amounts reported 
by BPD. 

16. Augment existing control procedures over the processing of JV 
transactions to provide assurance that JVs processed into the general 
ledger reflect transactions approved by management. Such procedures 
should provide for accurate JV transaction posting at the account, 
fund, organization, and budget object class level. 

17. Develop and implement reconciliation, validation, and analytical 
procedures to ensure the reliability of the Open Obligations Review 
Reports used by the various SEC divisions and offices in their review 
of unliquidated obligations. 

Budgetary Resources: 

During our fiscal year 2010 audit, we continued to find the same types 
of deficiencies in SEC's accounting for obligations[Footnote 21] and 
related budgetary transactions that we have reported in prior years. 
Specifically, we continued to find that budgetary transactions (1) 
were not always recorded within prescribed time frames; (2) did not 
follow U.S. Standard General Ledger (USSGL) posting configurations; 
and (3) were not always supported by valid documentation. These 
control deficiencies increase the risk of processing errors and 
misstatements related to budgetary activities in SEC's SBR. SEC has 
not yet fully addressed three of our prior recommendations in this 
area. The following paragraphs present an overview of our fiscal year 
2010 audit findings related to SEC's accounting for budgetary 
resources and our related recommendations. 

Timely Recording of Budgetary Transactions: 

In accordance with OMB Circular No. A-11, Preparation, Submission, and 
Execution of the Budget, an obligation is incurred when an agency 
places an order, signs a contract, awards a grant, purchases a 
service, or takes other actions that require the government to make 
payments. An obligation is a legally binding agreement that will 
result in outlays, immediately or in the future.[Footnote 22] 
According to the circular, downward adjustments[Footnote 23] to 
previously incurred obligations should be recorded when there is 
documentary evidence that the price is reduced. In addition, Standards 
for Internal Control in the Federal Government provides that 
transactions should be promptly recorded to maintain their relevance 
and value to management in controlling operations and making decisions. 

SEC did not have adequate controls for timely recording of budgetary 
transactions. Such controls are critical to ensure that obligations do 
not exceed budget authority and that any excess budget authority is 
made available to meet SEC's other operational needs. For example, we 
found: 

* Seven of 20 miscellaneous purchase order documents (MO) we tested 
were recorded as obligations in the general ledger system after the 
period of performance had begun. In one instance, the obligation was 
recorded after the period of performance had expired. Unlike other 
obligations, MOs do not require prior recording of purchase 
requisitions for reserving funds for obligations. However, SEC 
officials informed us that their undocumented practice was to record 
MOs on the same day they were approved for obligation to preclude over-
obligation of funds, which could result in Antideficiency Act 
violations.[Footnote 24] The delays in recording obligations were due 
to inadequate procedures necessary to ensure the timely recording of 
obligations, including the lack of specified back-up procedures to be 
followed when responsible employees are unable to perform their 
assigned responsibilities due to illness or other reasons, and lack of 
effective coordination procedures with other SEC offices to ensure 
timely submission of obligating documents to the Office of Financial 
Management (OFM) for processing. 

* Seven of the 10 deobligation transactions that we reviewed were 
approved during SEC's April 30, 2010, unliquidated obligations review 
process but were not deobligated as of June 30, 2010. Similarly, our 
review of recorded downward adjustment transactions found two 
instances in which the downward adjustment to a purchase contract was 
not recorded in the same accounting period in which they were approved 
for deobligation. As a result of these delays in recording of 
deobligations, ending obligations reported in SEC's SBR at September 
30, 2010, was overstated by about $6.4 million. In our view, the 
delayed recording of deobligations resulted from conflicting SEC 
regulations and transaction processing guidance. Specifically, SEC's 
process for reviewing unliquidated obligations for deobligation 
provides that transactions are to be reviewed at the individual 
contract line item level to determine whether a contract line item 
should remain open or be deobligated. In contrast, SEC's business 
process guidance provides that a deobligation is to be recorded based 
on closing out the contract for all contract lines. This may take a 
significant amount of time to complete because of the amount of review 
required on each contract to determine whether the contract should be 
closed out. 

* Twenty travel obligations we tested did not have their voucher 
submitted within the five business days allotted by Federal Travel 
Regulation (FTR). Although SEC's procedures for travel[Footnote 25] 
provide that--consistent with the FTR--the traveler is to complete a 
travel voucher for the actual cost of the trip within 5 days after 
travel has occurred,[Footnote 26] SEC did not have related control 
procedures detailing steps required to ensure liquidation and/or 
deobligation of remaining travel obligations after the completion of 
the travel itself. Our testing found that between 4 to 16 months had 
elapsed from the time travel was completed until the deobligations 
were recorded in the general ledger. Further, our testing of 
unliquidated obligations at June 30, 2010, found that six of the eight 
travel obligations we reviewed were not liquidated upon completion of 
the travel. These and other travel obligations we reviewed included 
amounts for several SEC officials who had not worked at the agency for 
a year or longer. 

Recommendations for Executive Action: 

To help address the deficiency in control over the recording of MOs, 
we reaffirm the recommendation from our prior audit to require an 
approved purchase requisition before certifying fund availability. In 
addition, we recommend that the Chairman direct the COO and CFO take 
the following specific actions: 

18. Augment existing policies and procedures for recording obligations 
to include, at a minimum: 

a. back-up procedures for the recording of obligations in the event 
that responsible employees are unable to perform their assigned 
duties; and: 

b. controls designed to ensure that SEC offices submit obligating 
documents to OFM for processing as obligations are incurred. 

19. Augment guidance in SEC's Unliquidated Obligation Review Process 
to provide, at a minimum: 

a. clarifying and communicating the responsibilities for recording 
deobligations; and: 

b. clarifying when to deobligate unliquidated obligations with no 
recent activity for financial reporting purposes and for contract 
close-out purposes for completed contracts to be consistent with 
applicable federal financial reporting guidance and OMB Circular No. A-
11, Preparation, Submission, and Execution of the Budget. 

20. Develop and implement documented control procedures to ensure 
liquidation and/or deobligation of remaining travel obligations after 
the completion of the travel. 

Posting Configuration Limitations: 

The Treasury Financial Manual (TFM) provides guidance on accounting 
for transactions and events to be followed by all federal entities, 
including a basic framework for organizing transactions and 
consistently accounting for financial events. Standards for Internal 
Control in the Federal Government provides that control activities 
should be established to ensure that all transactions are completely 
and accurately recorded. 

As we reported in November 2010 on the results of our SEC financial 
audit,[Footnote 27] we continued to find posting configuration errors 
in SEC's general ledger system related to recorded budgetary 
transactions. Twenty-one of the 50 downward adjustment transactions we 
tested did not follow valid posting models prescribed in Treasury's 
guidance. The initial erroneous transaction postings were recorded in 
October 2009. Based on our findings, the related correcting entries to 
reduce affected balances to appropriate amounts were recorded in 
December 2009. For the 9-month period ended June 30, 2010, SEC posted 
$39 million of adjustments to correct for these posting limitations. 
Until correcting entries were recorded, certain balances in the 
interim SBR were significantly misstated. 

Recommendation for Executive Action: 

We recommend that the Chairman direct the COO and CFO to take the 
following specific action: 

21. Until such time that SEC is able to correct configuration 
limitations of its general ledger system, implement procedures to 
prepare and post correcting budgetary transactions prior to the close 
of the monthly accounting period. 

Supporting Documentation and Authorization for the Recording of 
Obligations: 

Standards for Internal Control in the Federal Government provide that 
all transactions and other significant events need to be clearly 
documented and that the documentation should be readily available for 
examination to provide evidence of execution of these activities. 

As we reported in November 2010, [Footnote 28] our fiscal year 2010 
audit found that obligations were not always supported by 
documentation evidencing approval by an authorized individual. For 
example, SEC recorded three MOs which were not supported by valid 
obligating documents. In each instance, the obligation documents used 
for recording the transactions did not include any evidence that the 
responsible organization approved the recorded obligations. For 
example, OFM's budget analyst approved several aggregated credit card 
requests as a valid obligation without confirmation from the 
responsible SEC office to verify the acceptance of the charges. We 
also found one obligation, related to training, which did not reflect 
any supervisory approval on the obligation document. Without adequate 
documented approval from the responsible office, it is unclear to what 
extent the recorded obligation represented valid obligations as 
defined by OMB Circular No. A-11. 

Recommendation for Executive Action: 

We recommend that the Chairman direct the COO and CFO to take the 
following specific action: 

22. Augment existing policies and procedures to provide for supporting 
documentation for MOs consistent with applicable guidance provided in 
OMB Circular No. A-11. 

Registrant Deposits: 

Registrant deposits represent collections from registrants for 
securities registration, tender offer, merger, and other fees (filing 
fees). SEC records filing fee collections in a registrant deposit 
liability account until earned by SEC from a future filing. These 
collections, when earned, provide the resources SEC uses to fund its 
own operations. Section 202.3a(e) of Title 17, U.S. Code of Federal 
Regulations, provides that funds held in any filing fee account in 
which there has not been a deposit, withdrawal or other adjustment for 
more than 180 calendar days (dormant accounts) will be returned to the 
account holder, and account statements will not be sent again until a 
deposit, withdrawal, or other adjustment is made with respect to the 
account. SEC's fiscal policy for the processing of registrant deposits 
requires a review of registrant account balances over $1,000 prior to 
issuance of a refund. 

During our fiscal year 2010 audit, we continued to find the same 
problems in SEC's controls over the registrant deposit liability 
account that we reported in fiscal year 2009. Specifically, similar to 
our 2009 findings, we noted that SEC reported over $25 million in 
deposit accounts that were dormant for 180 calendar days, or more as 
of September 30, 2010, but were not returned to registrants as 
required by federal regulations. Our audit also identified amounts in 
the registrant deposit liability account that SEC earned in prior 
years and therefore should have been recognized as revenue in those 
years. 

In addition, our testing of filing fees transactions in fiscal year 
2010 found that SEC's procedures to recalculate and verify that the 
correct registrant fee was recognized as revenue was not consistently 
applied. Specifically, for 48 of the 53 filing fee transactions we 
reviewed, SEC did not verify that the correct registrant fee was 
collected. In one instance, SEC's review did identify an incorrect 
registrant fee submission but did not take the necessary steps to 
follow through to properly recognize $3.2 million in revenue 
pertaining to this submission until approximately 6 months after the 
error was discovered, and only after being notified by the filer upon 
the filer's review of its account statement. 

SEC management has not yet fully implemented our fiscal year 2009 
recommendations to address the significant deficiency in controls over 
the registrant deposit liability account. SEC updated its policy for 
the registrant deposit liability accounts to raise account balance 
thresholds to perform a review of accounts dormant for more than 180 
days. SEC also hired contractors in 2010 to research and verify 
registrants' contact information for the dormant accounts to ensure 
delivery of refunds. However, without dedicating additional resources 
to conducting the labor-intensive reviews of dormant accounts, SEC's 
efforts to reduce the backlog of dormant accounts are likely to be 
limited. For example, in fiscal year 2009 the backlog was $27 million. 
Even after the contractor's assistance, SEC reported the backlog was 
$25 million as of the end of fiscal year 2010. In addition, the 
resource constraints hinder the verification procedures to determine 
that filing fee transactions are properly recognized. Until SEC 
allocates sufficient resources to timely review the registrant deposit 
accounts and verify the filing fee transactions, SEC is at risk of 
misstating cash and liability balances for amounts that should have 
been refunded and misstating revenue for amounts that have been earned 
but not recorded. As a result, SEC's ability to effectively comply 
with applicable federal regulations on dormant accounts[Footnote 29] 
is still significantly impaired. 

Recommendations for Executive Action: 

To address the significant deficiency in control over the registrant 
deposit liability account, we reaffirm our open recommendations from 
prior audits regarding (1) the allocation of resources to resolve 
registrants' deposit liability balances, (2) development and 
implementation of controls to ensure registrant filings and deposits 
are consistently matched on an ongoing basis, and (3) development and 
implementation of procedures to facilitate oversight of registrant 
deposit accounts. 

Disgorgement and Penalties: 

As part of its enforcement responsibilities, SEC issues orders and 
administers judgments ordering, among other things, disgorgement, 
civil monetary penalties, and interest against violators of federal 
securities laws.[Footnote 30] SEC recognizes a receivable when SEC is 
designated in an order or a final judgment to collect the assessed 
disgorgement, penalties, and interest. At September 30, 2010, the 
gross amount of disgorgement and penalties accounts receivable SEC 
reported was $657 million, with a corresponding allowance of $575 
million. 

During our audit of SEC's fiscal year 2010 financial statements, we 
identified a significant deficiency concerning SEC's accounting for 
disgorgement and penalty transactions. Specifically, we found errors 
resulting from the inaccurate or untimely processing of disgorgement 
and penalty receivables, collections, and distributions transactions. 
Although most errors did not materially affect the balances reported 
or were subsequently detected and corrected, such errors present a 
risk that significant errors could occur and not be detected. 
Contributing to these errors is the (1) ineffective communication and 
coordination between SEC staff responsible for various portions of 
disgorgement and penalty activity and (2) lack of comprehensive 
policies and procedures to effectively address all accounting events 
associated with disgorgement and penalty activities. To compensate for 
these issues, SEC performs multiple labor-intensive reconciliations 
and reviews between source information and data maintained in the 
various case management and financial systems. 

Currently, SEC records and tracks information on disgorgement and 
penalties through a case-management system. The Division of 
Enforcement is responsible for entering and maintaining receivable 
data into that system. However, as we reported in fiscal year 2007, 
[Footnote 31] the case-management system is not designed for financial 
reporting purposes and is not integrated with the general ledger. To 
compensate for limitations in the system, SEC implemented an accounts 
receivable module within its general ledger system in fiscal year 2008 
and established guidance for entering disgorgement and penalties 
transaction information into the general ledger. Under the revised 
procedures, OFM uses weekly data extracts from the case-management 
system to record disgorgement and penalties receivable transactions in 
its general ledger. These data extracts include new and updated 
disgorgement receivable information that was recorded in the case- 
management system since the last data extract was run for OFM. Through 
our review of disgorgement and penalty transactions during fiscal year 
2010, we found that such procedures did not address all accounting 
events related to disgorgement and penalties to allow for the 
consistent and accurate recording of disgorgement and penalty 
transactions in the general ledger. Specifically, SEC did not have 
clear formalized policy, communication, and coordination procedures 
between its Office of Financial Management and its Division of 
Enforcement, both of which are responsible for various portions of 
disgorgement and penalty activity. For example: 

* SEC's procedures for entering disgorgement and penalty accounts 
receivable transactions into its general ledger system did not provide 
effective controls over the accuracy of financial data. All 
disgorgement and penalty transactions entered into the case-management 
system by Enforcement staff were to undergo three levels of management 
review to ensure the accuracy of disgorgement and penalty data. 
[Footnote 32] However, we found that the extracts used by OFM staff to 
record receivable transactions in the general ledger included 
transactions that had not undergone Enforcement's review procedures, 
which were not required to be completed within the reporting period. 
Consequently, any corrections to receivables identified through 
Enforcement's review process resulted in correcting entries being 
posted in the general ledger system, thereby inhibiting the accuracy 
of SEC's receivable balances at any given point in time and increasing 
the risk that a financial reporting misstatement may occur and not be 
identified. Eight of 31 receivable transactions we tested were 
corrections or required additional corrections processed to adjust for 
erroneous postings. In one instance, we found that a correcting entry 
was recorded before reversal of the original posting, which resulted 
in receivable transactions being double counted for a period of time. 

* SEC procedures did not require posting a receivable transaction into 
the case-management system or general ledger when a court order is 
made initiating the transfer of monies remaining after a distribution 
has occurred to the SEC (transfer orders). Such transactions could be 
significant. For example, we identified a $58 million transfer order 
that was erroneously omitted from SEC's disgorgement receivable 
balances. The lack of established procedures specifying steps required 
to account for transfer orders increases the risk that SEC's 
receivable balances could be understated at any given point. 

* OFM did not have procedures requiring periodic calculation and 
accrual of amounts of post-judgment interest collectible on district 
court judgments. According to the judgments establishing these 
receivables, defendants were to pay statutorily required post-judgment 
interest on any delinquent amounts.[Footnote 33] As of June 30, 2010, 
we found that approximately $464 million in post-judgment interest 
receivable was designated as delinquent. Due to a system limitation in 
Enforcement's case-management system and OFM's reliance on such data 
to update related records in the general ledger, post-judgment 
interest is not recorded until amounts are collected. As a result, 
SEC's accounts receivable balance as of September 30, 2010, is 
understated for post-judgment interest. Further, the related footnote 
disclosure was omitted from the financial statements. According to 
SFFAS No. 1, Accounting for Selected Assets and Liabilities, and OFM 
Reference Guide Chapter 08-01: Investment and Disgorgement Management, 
a receivable should be recognized when a federal entity establishes a 
specifically identifiable, legally enforceable claim to cash through 
its established assessment processes to the extent the amount is 
measurable or an amount can be reasonably estimated. Moreover, until 
the interest payment requirement is officially waived by the 
government entity or the related debt is written off, interest accrued 
on uncollectible accounts receivable should be disclosed. 

* SEC's standard operating procedure for recording check collections 
is to record the collection in the general ledger after SEC receives 
confirmation from the bank that the check was deposited. However, bank 
deposits could take several days from the date the check was initially 
received by SEC. Further, SEC does not have a compensating procedure 
to ensure that checks received at, or close to, the end of an 
accounting period are recorded in the proper period. We identified 
unrecorded checks at both interim and year-end. For example, we found 
checks totaling about $2.8 million that were received at or close to 
year-end but not recorded in the general ledger until fiscal year 
2011, that resulted in misstatements and miscalculations of SEC's 
allowance for loss until corrected. 

* SEC's Liability for Disgorgement and Penalties line item represents 
cash, accounts receivables, and investments that are pending 
distribution to a harmed investor or to the general fund of the U.S. 
Treasury. The line item is made up of two general ledger accounts 
(GLAC): (1) 2990, Other Liabilities without Related Budgetary 
Obligations, and (2) GLAC 2400, Deposit Suspense Liability-Non Fed. In 
accordance with the USSGL, SEC uses GLAC 2400 to temporarily account 
for disgorgement and penalty transactions that are awaiting 
disposition or reclassification, such as cash receipts for which SEC 
has not recorded a related receivable. As of September 30, 2010, SEC 
reported balances for GLAC 2400 of $123 million. However, we found the 
balance included amounts that have already been disbursed and 
therefore is significantly overstated. Specifically, as of September 
30, 2010, $102 million of amounts reported in GLAC 2400 had been 
transferred to Treasury by year-end. This overstatement of reported 
balances is attributed to SEC's posting models which recorded the $102 
million in disbursements to the general fund of the U.S. Treasury by 
reducing related balances in GLAC 2990 rather than account 2400. As a 
result, management was unable to readily identify the amount of 
disgorgement and penalty collections pending disposition or 
reclassification. 

Standards for Internal Control in the Federal Government require that 
agencies establish controls to ensure that transactions are recorded 
in a complete, accurate, and timely manner. Management is responsible 
for developing detailed policies, procedures, and practices to fit the 
agency's operations and to ensure that they are built into and are an 
integral part of operations to meet the agency's objectives. Moreover, 
the standards provide that internal control should be clearly 
documented through management directives, administrative policies, or 
operating manuals and the documentation should be readily available 
for examination. Not having clear, comprehensive policies and 
procedures increases the risk that disgorgement and penalty 
transactions will not be completely, accurately, timely, and 
consistently recorded and reported and impedes SEC management's 
ability to effectively oversee operations. 

Recommendations for Executive Action: 

We recommend that the Chairman direct the COO and CFO, in coordination 
with the Director of Enforcement as applicable, to take the following 
actions: 

23. Augment current procedures to require that Enforcement's reviews 
of disgorgement and penalty data in the case-management system be 
completed prior to closing the accounting period. 

24. Develop and implement policies and procedures to identify and post 
receivable transactions for court orders initiating the transfer of 
monies to the SEC after a distribution has occurred in accordance with 
generally accepted accounting principles. 

25. Develop and implement policies and procedures to calculate and 
accrue for post-judgment interest amounts collectible prior to closing 
the accounting period in accordance with generally accepted accounting 
principles. 

26. Develop and implement procedures to provide for footnote 
disclosures concerning post-judgment interest amounts accrued on 
uncollectible accounts receivable in accordance with generally 
accepted accounting principles. 

27. Establish and implement procedures for recording all check 
collections in the general ledger in the same fiscal period they are 
received in accordance with generally accepted accounting principles. 

28. Revise existing posting configurations to account for amounts 
disbursed from SEC's Deposit Suspense Liability accounts in accordance 
with the USSGL. 

29. Until posting configurations for amounts disbursed from SEC's 
Deposit Suspense Liability accounts are corrected, establish and 
implement interim procedures to evaluate balances residing in SEC's 
Deposit Suspense Liability accounts and adjust related accounts for 
amounts that have already been disbursed prior to the close of each 
accounting period. 

Required Supplementary Information: 

OMB Circular No. A-136, Financial Reporting Requirements (Revised 
Sept. 29, 2010), provides that the annual financial statements of a 
reporting entity include the basic statements, related notes and 
required supplementary information (RSI). In accordance with this 
circular--which represents generally accepted accounting principles 
(GAAP) for federal reporting entities--reporting entities should 
present disaggregated budgetary information for each of their major 
budget accounts presented in the SBR as RSI. The major accounts and 
the aggregate of small budget accounts should, in total, agree with 
the amounts reported on the face of the SBR. 

Our fiscal year 2010 audit found that SEC management's review of the 
draft annual financial statements did not detect the omission of the 
RSI required under OMB Circular No. A-136. Specifically, SEC omitted 
$452 million in disaggregated SBR financial information related to the 
Investor Protection Fund (IPF).[Footnote 34] Consequently, SEC's draft 
financial statements were not in compliance with GAAP. After we 
brought our findings to SEC managements's attention, SEC took action 
to provide the required supplementary information in its September 30, 
2010, financial report. 

Recommendation for Executive Action: 

We recommend that the Chairman direct the COO and CFO to take the 
following specific action: 

30. Augment procedures concerning SEC's review of its financial 
statements to specify review steps necessary to ensure that all 
applicable financial statements, related notes, and required 
supplementary information required under OMB Circular No. A-136 are 
presented. 

Other Less Significant Control Issues: 

In addition to the recommended actions related to the two material 
deficiencies weaknesses we identified in our opinion report, we also 
identified less significant deficiencies warranting management's 
attention. The following sections present each of these less 
significant deficiencies identified in our fiscal year 2010 audit and 
our related recommendations for corrective action. 

Proper and Timely Approvals of Disbursements: 

In accordance with SEC's Administrative Regulation (SECR) 10-15, 
Contract Administration Positions (August 12, 2009), a Contracting 
Officer's Technical Representative (COTR) or an Inspection and 
Acceptance Official (IAO) shall be appointed by a Contracting Officer, 
at the Contracting Officer's discretion, to assist in monitoring the 
contractor's progress in fulfilling the technical requirements 
specified in the contract. Among other responsibilities, the COTR and 
IAO are to review and submit approved invoices or vouchers to OFM 
within the time required to avoid Prompt Payment Act penalties and 
interest payments[Footnote 35] and to maintain copies of their 
appointment/designation letters. 

Our fiscal year 2010 audit found that invoices are not always approved 
by a properly-designated COTR or IAO in accordance with SEC 
regulations. Specifically, during our testing of non-payroll 
disbursements through June 30, 2010, we noted that 37 of 67 
disbursements tested were not supported by an invoice approved by a 
COTR/IAO or other designated person. Of these items, 22 disbursements 
were approved by individuals who were not contracting officers and 
were without approved appointment letters to support their designation 
as the COTR or IAO for the contract to which the disbursement was 
associated. Further, 15 disbursements--all lease payments--were 
approved by either a Project Manager (PM) or non-Contracting Officer 
(CO). Although SEC officials told us that lease payments can be 
approved by a PM or non-CO, SEC did not provide any documentation 
authorizing them to approve these invoices as of June 30, 2010. 
Additionally, we noted one other disbursement that was approved by an 
individual prior to the date that individual was appointed as the COTR 
for that contract. Moreover, through our testing of non-payroll 
disbursements and consistent with our prior findings in this area as 
part of our previous years' audits, we continued to find instances in 
which SEC did not process invoices for payments in accordance with the 
time lines designated in the Prompt Payment Act. For example: 

* 21 disbursements were not approved within the 5 business days 
allotted for return to OFM to assure the timely processing of the 
payment. Of those, 6 resulted in Prompt Payment Interest being paid to 
the vendor. 

* 2 disbursements which were returned timely to OFM by the invoice 
approver, were not processed for payment until after the due date, 
resulting in Prompt Payment Interest being paid to the vendor. 

* 1 invoice was misrouted to an incorrect department for approval, 
thereby resulting in delayed approval and Prompt Payment Interest 
being paid to the vendor. 

Although SEC Administrative Regulation (SECR) 10-15, establishes 
responsibilities for COTRs and IAOs, including the documentation and 
tracking of invoices from the time of receipt until the payment is 
issued, such procedures were not consistently implemented in fiscal 
year 2010. Until such controls are operating as intended, SEC will 
likely continue to use a significant amount of resources paying 
interest penalty charges and continue to be in violation of SEC's own 
internal regulations and OMB guidance. 

Recommendation for Executive Action: 

We reaffirm our prior recommendation that SEC investigate the causes 
of late payments and develop and implement any necessary corrective 
action. We also recommend that the Chairman direct the COO and CFO to 
take the following specific action: 

31. Establish a mechanism to monitor compliance with the documentation 
requirements under SEC regulations to ensure proper, consistent 
approval of invoices by COTRs, IAOs, and other designated persons and 
retention of their appointment letters, if applicable. 

Review of Service Providers' Auditor Reports: 

A significant portion of SEC's payroll processing relies on the 
Department of the Interior (DOI) National Business Center (NBC), a 
payroll service provider. As such, SEC places significant reliance on 
reports generated by NBC to determine whether its payroll 
disbursements are complete, valid, accurate, and timely. 

NBC contracted with an independent auditor to perform an audit of 
controls related to its personnel and payroll operations under 
Statement on Auditing Standards (SAS) No. 70, Service Organizations. 
SAS No. 70 provides authoritative guidance for service organizations 
to disclose their control activities and processes to their customers 
and their customers' auditors in a uniform reporting format. The 
issuance of a service auditor's report prepared in accordance with SAS 
No. 70 signifies that a service organization has had its control 
objectives and control activities examined by an independent 
accounting and auditing firm. The service auditor's report includes 
valuable information regarding the service organization's controls and 
the effectiveness of those controls. 

In accordance with OMB Circular No. A-123, agency management should 
review the scope of the SAS No. 70 report in the context of their 
overall internal control assessment and take timely and effective 
actions to address any deficiencies identified. 

However, our review of SEC's SAS No. 70 review process, found that SEC 
did not include steps requiring the review and consideration of the 
SAS No. 70 report in terms of whether SEC has compensating controls in 
place to address any open exceptions in the report that affect SEC's 
payroll processing. As a result, SEC's assurance that controls relied 
upon in processing its payroll transactions are operating as intended 
is impaired. 

Recommendation for Executive Action: 

We reaffirm our prior recommendation that SEC establish procedures to 
comprehensively identify and assess risk related to SEC's payroll- 
related activities, including risk associated with user controls 
identified by its payroll service provider in SAS No. 70 reports. We 
also recommend that the Chairman direct the COO and CFO to take the 
following specific action: 

32. Establish and implement procedures requiring review of the payroll 
service provider SAS No. 70 report to include consideration of whether 
compensating controls are needed to address any open exceptions in the 
report that affect SEC's payroll processing. 

Inadequate Controls over Travel Transaction Documentation: 

During our fiscal year 2010 audit, we observed that SEC did not 
require, and consequently did not maintain adequate supporting 
documentation for several travel-related disbursement transactions in 
accordance with federal travel regulations. For example, we found that 
SEC did not require transportation receipts, that is, ticket and/or 
boarding passes, to be submitted prior to payment of transportation 
charges through its central billing account (CBA). Moreover, SEC did 
not establish a business process for ensuring that the approved travel 
was actually taken. We identified one instance in which SEC could not 
provide documentation to support that a previously billed and 
disbursed travel payment was refunded to SEC upon cancellation of the 
travel authorization. 

According to the Federal Travel Regulation (41 C.F.R § 301-52.4), 
travelers must substantiate their claimed travel expenses by providing 
a lodging receipt and a receipt for every authorized expense over $75, 
or provide a reason acceptable to the agency explaining why the 
traveler was unable to furnish the necessary receipt(s). Further, 
pursuant to the Federal Travel Regulation (41 C.F.R. § 301-11.25), 
hard copy receipts should be submitted with the electronic travel 
claim in accordance with the agency's policies, to support a claimed 
travel expense. 

SEC did not have procedures detailing the steps and documentation 
required to effectively control and monitor travel expenses paid 
through the CBA, including required procedures for ensuring receipt of 
refunds for travel/tickets that were previously billed and paid but 
subsequently canceled. Lacking such procedures increases SEC's risk of 
fraud or misuse of government resources. Such conditions also impair 
SEC's ability to ensure the validity of travel expenses reported in 
SEC's financial statements. 

Recommendation for Executive Action: 

We recommend that the Chairman direct the COO and CFO to take the 
following specific action: 

33. Develop and implement policies and procedures detailing the steps 
and documentation required to effectively control and monitor travel 
expenses paid through the central billing account, including steps 
required to ensure documented receipt of refunds or credits for 
travel/tickets that were previously paid for by SEC but subsequently 
canceled. 

This report contains recommendations to you. The head of a federal 
agency is required by 31 U.S.C. § 720 to submit a written statement on 
actions taken on the recommendations to the Senate Committee on 
Homeland Security and Governmental Affairs and the House Committee on 
Oversight and Government Reform not later than 60 days from the date 
of this report. A written statement also must be sent to the House and 
Senate Committees on Appropriations with your agency's first request 
for appropriations made more than 60 days after the date of this 
report. 

This report is intended for use by SEC management. We are sending 
copies of this report to the Chairman and Ranking Members of the 
Senate Committee on Banking, Housing, and Urban Affairs; the Senate 
Committee on Homeland Security and Governmental Affairs; the House 
Committee on Financial Services; and the House Committee on Oversight 
and Government Reform. We are also sending copies to the Secretary of 
the Treasury, the Director of the Office of Management and Budget, and 
other interested parties. In addition, this report is available at no 
charge on GAO's Web site at [hyperlink, http://www.gao.gov]. 

We acknowledge and appreciate the cooperation and assistance provided 
by SEC management and staff during our audit of SEC's fiscal years 
2010 and 2009 financial statements. If you have any questions about 
this report or need assistance in addressing these issues, please 
contact me at (202) 512-3133 or dalkinj@gao.gov. 

Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this report. 

Sincerely yours, 

Signed by: 

James R. Dalkin:
Director: 

Financial Management and Assurance: 

Enclosures - 4: 

[End of section] 

Enclosure I: Status of Recommendations from Prior Audits Reported as
Open in GAO’s 2009 Management Report: 

This enclosure presents the status of the 50 recommendations reported 
as open in GAO's March 31, 2010, management report. The weaknesses are 
grouped according to the deficiency area. 

Table 1: Status of Recommendations from Prior Audits Reported as Open 
in GAO's 2009 Management Report at the end of GAO's Audit of SEC's 
Fiscal Year 2010 Financial Statements. 

Disgorgement and penalties: 

Audit area: 1. 
Develop and implement improved safeguarding procedures within SEC's 
Operations Center for checks received or establish a lockbox for the 
submission of checks to OFM and instruct defendants to mail checks to 
the lockbox. 
Year initially reported: 2009; 
Status of corrective action: Completed. 

Audit area: 2. 
Reconfigure the disgorgements and penalty accounts receivable module 
to enable production of an accounts receivable aging report. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 3. 
Develop and implement an automated solution that will eliminate the 
manual process of reentering disgorgement and penalties data from 
Phoenix into the general ledger system accounts receivable module. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 4. 
Develop and implement an automated sub-ledger that interfaces with the 
general ledger for investment and disgorgement and penalty liability 
transaction activity. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 5. 
Until SEC is able to establish and implement procedures for fully 
integrating its detailed investment and disgorgement liability 
activity into its general ledger, establish and implement procedures 
for documenting data reliability checks at the enforcement case level 
for data extracted from non-integrated subsidiary systems to include 
appropriate supervisory reviews. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Financial statement preparation and reporting: 

Audit area: 6. 
Develop and implement a desktop procedures manual that provides 
detailed instructions for performing each key accounting process 
preceding the general ledger closing process; 
the associated internal control to be followed for each step, as 
applicable; and the manner for documenting compliance with these 
controls. 
Year initially reported: 2009; 
Status of corrective action: Completed. 

Audit area: 7. 
Reconfigure the general ledger system to produce reports necessary to 
both prepare the financial statements and support managing operations, 
such as a consolidated trial balance report and undelivered order 
aging report, respectively, on an ongoing basis. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 8. 
In coordination with the DOI's National Business Center (NBC), 
establish and implement a cost effective procedure for accurately 
recording student loan payments and employee awards in the general 
ledger. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 9. 
Establish and implement procedures for performing a comprehensive 
review of all posting configurations and recurring correcting journal 
entries to identify and address any additional departures from 
Treasury's prescribed posting models. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 10. 
Develop and implement policies and procedures to identify, evaluate, 
and account for contingencies related to any litigation, claims, and 
assessments against SEC as part of the routine preparation of 
financial statements in conformity with generally accepted accounting 
principles. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 11. 
Develop and implement control and verification procedures to ensure 
all of SEC's contingency and intragovernmental liability transactions 
comply with SEC's Accounts Payable Accrual As-Is Process documentation. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 12. 
Revise the SV Creation and Modification process document to clearly 
define the purpose and use of SV transactions; 
the process for entering SV transactions into the general ledger 
system, including the performance and documentation of supervisory 
review; and monitoring procedures to ensure that SV transactions post 
to the general ledger system as intended. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 13. 
Develop and implement procedures to provide for a review of all 
transactions resulting in prior period corrections, including filing 
fee revenue and property and equipment transactions, and to quantify 
the cumulative effect of known and likely prior period corrections in 
the current fiscal year. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 14. 
Develop and implement a standardized financial statement closing 
schedule with cutoff dates for key month-end accounting transactions 
that should be completed prior to the closing of an accounting period. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 15. 
Develop and implement control procedures to ensure prior period 
accrual accounting entries are reversed in the following accounting 
period and current period accrual accounting entries are recorded 
prior to the accounting period closing date. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 16. 
Develop and implement policies and procedures to ensure that only 
designated senior staff and management (such as branch chief level and 
above) have the authority to reopen previous accounting periods. Such 
procedures should provide for (a) documenting the required protocols 
to follow for requesting to reopen a closed accounting period and 
approval of such request, (b) specifying required documentation for 
situations that caused a closed accounting period to be reopened, and 
(c) as applicable, documenting any corrective actions that were taken 
to preclude such circumstances from reoccurring. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 17. 
Develop and implement a process for reliably preparing accurate pro 
forma financial statements and updating the notes that accompany 
financial statements prior to year-end, preferably with the third 
quarter reporting. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 18. 
Augment current procedures to provide specific steps for ensuring the 
consistency of related information reported in the MD&A and the 
financial statements and related notes. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Property and equipment: 

Audit area: 19. 
Reconfigure the property and equipment module to enable production of 
a property register report. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 20. 
Establish and implement procedures to properly record property and 
equipment receipt transactions using capitalizable project and budget 
object class codes within the general ledger system. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Controls over fund balance with Treasury (FBWT): 

Audit area: 21. 
Develop and implement procedures for timely performing, reviewing, and 
documenting reconciliation of SEC's FBWT accounts with balances 
reported by Treasury. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 22. 
Develop and implement procedures for timely resolving any identified 
differences in FBWT activity reported by Treasury and FBWT activity 
recorded by SEC. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Risk assessment and monitoring processes: 

Audit area: 23. 
Reevaluate the risk assessment and monitoring processes to ensure they 
consider all key elements of SEC's financial reporting control 
environment, including information systems and service providers. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 24. 
Establish and implement procedures for performing and documenting risk 
assessment and monitoring processes in a timely manner throughout the 
year, based on the frequency and sensitivity of certain control 
activities. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 25. 
As part of the risk assessment process, document the evaluation of the 
design effectiveness of key controls. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 26. 
Enhance risk assessment and mitigation control procedures to include 
maintaining a list of any internally identified control breakdowns 
that occur during the year, documenting an evaluation of financial 
reporting impact as a result of any such control breakdown, and any 
corrective actions taken. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 27. 
Establish and implement procedures to monitor and update policy and 
procedure documents in a timely manner to ensure key risks and 
corresponding controls are documented for each key process. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Registrant deposits: 

Audit area: 28. 
Design and implement controls to ensure registrant filings and 
deposits are consistently matched timely on an ongoing basis. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 29. 
Allocate sufficient resources to fully resolve current registrants' 
deposits liability balances in accordance with SEC policy and with 
federal regulations. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 30. 
Develop and implement procedures to include the use of periodic (i.e., 
weekly and monthly) system generated reports to facilitate oversight 
of registrant deposits accounts, such as developing and using 
exception reports of registrant account activity. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Controls over payroll processing and reporting: 

Audit area: 31. 
Update the time and attendance system to establish preset active 
activity and project codes for all activities used by SEC in its 
process for allocating gross costs to program costs by the strategic 
goals presented in its Statement of Net Cost. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 32. 
Modify existing policy and procedures to require all employees to 
report labor hours using preset activity and project codes within the 
time and attendance system and establish and implement applicable 
controls to ensure compliance. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 33. 
Revise and implement procedures over the preparation of the Statement 
of Net Cost to utilize actual data reported by employees on their 
biweekly time and attendance reports. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 34. 
Establish and implement procedures for documenting evidence of 
monitoring of time card certifications and include procedures to 
document any identified exceptions. 
Year initially reported: 2008; 
Status of corrective action: In progress. 

Audit area: 35. 
Develop procedures for implementing management's policy on the 
authorization and validation of personnel actions and the timely 
processing of such actions. 
Year initially reported: 2009; 
Status of corrective action: In progress. 

Audit area: 36. 
Establish procedures to comprehensively identify and assess risk 
related to SEC's payroll-related control activities, including risk 
associated with user controls identified by its payroll service 
provider in SAS No. 70 reports. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 37. 
Develop and implement written procedures that (a) standardize required 
documentation related to resolution of NBC's biweekly payroll 
exception reports and (b) extend the retention period for supporting 
documentation long enough to facilitate internal and external audit or 
review, such as a period of 18 months after payment. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 38. 
Develop and implement controls over access rights in the time and 
attendance system to prevent or timely correct any excessive access in 
the system. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Accounting for budgetary resources: 

Audit area: 39. 
Correct general ledger system configurations to properly account for 
upward and downward adjustments of prior years' undelivered orders in 
accordance with the U.S. Standard General Ledger. 
Year initially reported: 2008; 
Status of corrective action: In progress. 

Audit area: 40. 
Clarify administrative control of funds guidance and document the 
responsibilities of the staff performing obligation-related activities 
with regard to recording obligations in accordance with the recording 
statute. 
Year initially reported: 2008; 
Status of corrective action: Completed. 

Audit area: 41. 
Establish and implement controls to ensure that SEC staff adheres to 
existing policies and procedures to prevent violations of the 
recording statute. 
Year initially reported: 2008; 
Status of corrective action: In progress. 

Audit area: 42. 
Strengthen existing control procedures for recording miscellaneous 
purchase order documents by requiring an approved purchase requisition 
before certifying fund availability. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Information system security controls: 

Audit area: 43. 
Reevaluate existing automated information system security controls in 
light of the risks identified in SEC's October 2009 certification and 
accreditation procedures for the general ledger system and supporting 
processes. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Audit area: 44. 
Establish and implement appropriate controls to mitigate any 
additional risks that were identified as a result of this reevaluation. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Controls over non-payroll disbursement and accrual transactions: 

Audit area: 45. 
Develop or update and implement policies and procedures for 
reconciling any SEC intragovernmental expense and payable amounts 
reported by GSA to internal SEC data records prior to recording an 
accrual in SEC's general ledger for financial statement reporting. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 46. 
Investigate the causes of late payments and any interest penalties 
incurred and develop and implement any necessary corrective actions. 
Year initially reported: 2010; 
Table 1: Status of Recommendations from Prior Audits Reported as Open 
Status of corrective action: In progress. 

Audit area: 47. 
Develop and implement procedures to provide for appropriately 
documented COTR review of all vendor invoices prior to payment in 
compliance with SEC regulation. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Audit area: 48. 
Establish and implement procedures to provide periodic training to 
COTRs and project managers regarding their responsibilities for 
reviewing and approving invoices. 
Year initially reported: 2010; 
Status of corrective action: Completed. 

Security over sensitive employee information: 

Audit area: 49. 
Review current usage of social security numbers as a personal 
identifier for federal employees in agency systems and programs and 
establish and implement alternative procedures to eliminate any such 
usage. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Policies and procedures documentation: 

Audit area: 50. 
Finalize the policies and procedures for the procurement and purchases 
and Section 31 revenue processing to include incorporating any changes 
needed to resolve all recommendations or deficiencies identified 
during the development of these draft documents. 
Year initially reported: 2010; 
Status of corrective action: In progress. 

Source: GAO analysis of SEC data. 

[End of table] 

[End of section] 

Enclosure II: Status of Previously Reported Information Technology
Weaknesses: 

This enclosure presents the status of the 22 information technology 
weaknesses in information system controls at SEC that we identified in 
public and "Limited Official Use Only" reports issued in 2005, 2007, 
2008, and 2009 that were reported as open in GAO's March 31, 2010, 
management report. The weaknesses are grouped according to control 
areas--access controls, configuration management, and security 
management--specified by our Federal Information System Controls Audit 
Manual. 

Table 2: Status of Previously Reported Information Technology 
Weaknesses Reported as Open in GAO's 2009 Management Report at the end 
of GAO's Audit of SEC's Fiscal Year 2010 Financial Statements.: 

Access controls: 

Control area: Identification and authentication: 

1. SEC did not always enforce strong password settings on its 
enterprise database servers; 
Year initially reported: 2008; 
Action completed. 

Control area: Authorization: 

2. SEC did not adequately document access privileges for the EDGAR 
application; 
Year initially reported: 2007; 
Action completed. 

3. SEC did not properly document or maintain approval of user access 
privileges to the Momentum system; 
Year initially reported: 2009; 
Action completed. 

4. SEC did not adequately restrict user privileges to two of its 
database systems; 
Year initially reported: 2009; 
Action completed. 

5. SEC did not sufficiently restrict remote access to the EDGAR and 
Fee Momentum database servers; 
Year initially reported: 2009; 
Action completed. 

6. SEC did not sufficiently prevent users from running long reports 
during critical times of the day, thus monopolizing database system 
resources; 
Year initially reported: 2009; 
Action completed. 

Control area: Cryptography: 

7. SEC did not always provide approved, secure transmission of data 
over its network; 
Year initially reported: 2008; 
Action in progress. 

Control area: Audit and Monitoring: 

8. SEC did not always produce, review, and document reviews of 
Momentum security reports in a timely manner; 
Year initially reported: 2008; 
Action completed. 

9. SEC did not keep an adequate audit trail record of user activities 
in the enterprise database environment; 
Year initially reported: 2008; 
Action completed. 

Control area: Segregation of duties: 

10. SEC did not adequately segregate computer-related duties and 
functions; 
Year initially reported: 2009; 
Action completed. 

11. SEC did not always adequately separate network management traffic 
from general network traffic; 
Year initially reported: 2009; 
Action completed. 

Control area: Configuration management: 

12. SEC did not effectively implement patch management on certain Unix 
servers. 
Year initially reported: 2005; 
Action completed. 

13. SEC lacked procedures to periodically review application code to 
ensure that only authorized changes were made to production; 
Year initially reported: 2005; 
Action completed. 

14. SEC did not always protect its major enterprise database 
applications from command injection attacks; 
Year initially reported: 2008; 
Action completed. 

15. SEC did not consistently apply patches or upgrade its database 
servers to the current software versions to support the processing of 
financial data; 
Year initially reported: 2009; 
Action completed. 

16. SEC did not adequately document the test plans associated with the 
Momentum scripts; 
Year initially reported: 2009; 
Action completed. 

17. SEC did not adequately document or approve changes to the 
requirements, design, and scripts associated with the upgrade to 
Momentum; 
Year initially reported: 2009; 
Action in progress. 

18. SEC did not establish or maintain a configuration baseline for 
Momentum; 
Year initially reported: 2009; 
Action completed. 

19. SEC did not periodically conduct configuration audits to verify 
and validate the extent to which the actual configuration items for 
the Momentum upgrade reflect the required physical and functional 
characteristics specified by requirements; 
Year initially reported: 2009; 
Action in progress. 

20. SEC did not have a detailed configuration management plan 
associated with the Momentum upgrade; 
Year initially reported: 2009; 
Action completed. 

21. SEC did not adequately implement tools to manage configuration 
items for the Momentum upgrade; 
Year initially reported: 2009; 
Action in progress. 

Control area: Security Management: 

22. SEC did not certify and accredit a key intermediary subsystem that 
supports the production of its financial statements; 
Year initially reported: 2009; 
Action completed. 

Source: GAO analysis of SEC data. 

[End of table] 

[End of section] 

Enclosure III: Comments from the Securities and Exchange Commission: 

United States: 
Securities And Exchange Commission: 
The Chairman: 
Washington, D.C. 20549: 

March 17, 2011: 

Mr. James R. Dalkin: 
Director: 
Financial Management and Assurance: 
United States Government Accountability Office: 
441 G Street, N.W. 
Washington. DC 20548: 

Dear Mr. Dalkin: 

Thank you for the opportunity to respond to the draft report entitled 
Management Report: Improvements Needed in SEC's Internal Controls and 
Accounting Procedures (GAO-11-348R). The report contains a number of 
helpful recommendations to strengthen the SEC's internal controls over 
financial reporting. 

Remediation of the agency's two material weaknesses (one with regard 
to information systems and the other concerning financial reporting 
and accounting processes) is a top priority for the SEC. Under the 
leadership of our Chief Operating Officer, Chief Financial Officer, 
Chief Information Officer, and new Chief Accounting Officer, the 
agency has launched a series of initiatives to address the agency's 
deficiencies in internal control. 

As you know, these two material weaknesses both are closely connected 
to gaps in the security and the functionality of our financial 
systems. Although we are taking a number of steps to address these 
gaps this fiscal year, we believe that putting our internal controls 
on a solid footing over the long term primarily requires significant 
investment in our financial systems. That is why the centerpiece of 
our remediation strategy is to migrate our core financial system and 
transaction processing to a Federal Shared Service Provider, the 
Department of Transportation's Enterprise Services Center (ESC). 
Through this initiative, the SEC will fill gaps in the functionality 
of the current system, eliminate many manual processes that are 
inherently prone to error, and enhance financial and management 
reporting. The SEC has now signed an Interagency Agreement with the 
Department of Transportation for the implementation of the new system, 
with a cutover planned for April 2012. 

While the SEC focuses attention and resources on ensuring a successful 
system migration, the agency also is working this fiscal year on a 
number of steps aimed to address deficiencies identified in your 
report. These efforts include: 

* Updating security patches on SEC systems, strengthening user access 
controls, and remediating self-identified security deficiencies;
•	Enhancing the agency's internal control monitoring program; 

* Conducting a comprehensive assessment of the spreadsheets and 
databases used by the agency, and tightening controls over those 
applications based on risk; 

* Strengthening our process for de-obligating funds from completed 
contracts, and ensuring we incorporate appropriate accounting 
adjustments for these amounts; 

* Reevaluating our processes for reviewing filing fees paid by 
registrants, and reducing our backlog of inactive registrant deposit 
accounts; 

* Tightening controls over the recording of subsequent orders, post-
judgment interest, and deposits in transit related to disgorgements 
and penalties; 

* Instituting a number of reforms to our processes for handling 
miscellaneous obligating documents; and; 

* Performing an assessment to ensure that the SEC's financial 
statements and notes comply with all relevant requirements, including 
with respect to items like Required Supplementary Information. 

The SEC is committed to investing the time and resources to put its 
internal controls over financial reporting on a strong, sustainable 
path, so that these material weaknesses are eliminated and do not 
recur. I look forward to continuing to work with you in the coming 
months as these efforts unfold. 

If you have any questions, please do not hesitate to contact Kenneth 
A. Johnson, the SEC's Chief Financial Officer, at (202) 551-4306. 

Sincerely, 

Signed by: 

Mary L. Schapiro: 
Chairman: 

[End of section] 

Enclosure IV: Summary of Audit Scope and Methodology: 

To fulfill our responsibilities as auditor of the financial statements 
of the Securities and Exchange Commission (SEC), we did the following: 
[Footnote 36] 

* Examined, on a test basis, evidence supporting the amounts and 
disclosures in the financial statements; 

* Assessed the accounting principles used and significant estimates 
made by SEC management; 

* Evaluated the overall presentation of the financial statements; 

* Obtained an understanding of SEC and its operations, including its 
internal control over financial reporting; 

* Considered SEC's process for evaluating and reporting on internal 
control over financial reporting that SEC is required to perform by 31 
U.S.C. § 3512(c), (d), commonly known as the Federal Managers' 
Financial Integrity Act of 1982; and section 963, Annual Financial 
Controls Audit, of the Dodd-Frank Wall Street Reform and Consumer 
Protection Act; 

* Assessed the risk that a material misstatement exists in the 
financial statements and the risk that a material weakness exists in 
internal control over financial reporting; 

* Evaluated the design and operating effectiveness of internal control 
over financial reporting based on the assessed risk; 

* Tested relevant internal control over financial reporting; and: 

* Tested compliance with selected provisions of the following laws and 
regulations: the Securities Exchange Act of 1934, as amended; the 
Securities Act of 1933, as amended; the Antideficiency Act; laws 
governing the pay and allowance system for SEC employees; the Debt 
Collection Improvement Act; the Prompt Payment Act; the Federal 
Employees' Retirement System Act of 1986; the Financial Services and 
General Government Appropriations Act, 2010; and the Dodd-Frank Wall 
Street Reform and Consumer Protection Act. 

We requested comments on a draft of this report from the SEC Chairman. 
We received written comments from SEC and summarized the comments in 
our report. 

We conducted our audit of SEC's fiscal years 2010 and 2009 financial 
statements in accordance with U.S. generally accepted government 
auditing standards. We believe our audit provided a reasonable basis 
for our conclusions in this report. 

[End of section] 

Footnotes: 

[1] GAO, Financial Audit: Securities And Exchange Commission's 
Financial Statements For Fiscal Years 20100 and 2009, [hyperlink, 
http://www.gao.gov/products/GAO-11-202] (Washington, D.C.: Nov. 15, 
2010). 

[2] The Material Weaknesses And Their Underlying Deficiencies Are 
Detailed In [hyperlink, http://www.gao.gov/products/GAO-11-202], 
Appendix I: Material Weaknesses. 

[3] GAO, Management Report: Improvements Needed In Sec's Internal 
Controls And Accounting Procedures, [hyperlink, 
http://www.gao.gov/products/GAO-10-443R] (Washington, D.C.: Mar. 31, 
2010). 

[4] [GAO, Information Security: Securities And Exchange Commission 
Needs To Address Weak Controls Over Financial And Sensitive Data, 
[hyperlink, http://www.gao.gov/products/GAO-05-262] (Washington, D.C.: 
Mar. 23, 2005); Limited Official Use Only Information Security: 
Securities And Exchange Commission Needs To Address Weak Controls Over 
Financial And Sensitive Data, [hyperlink, 
http://www.gao.gov/products/GAO-05-263SU] (Washington, D.C.: Mar. 23, 
2005); Information Security: Securities And Exchange Commission Needs 
To Continue To Improve Its Program, [hyperlink, 
http://www.gao.gov/products/GAO-06-408] (Washington, D.C.: Mar. 
31,)2006); Limited Official Use Only Information Security: Securities 
And Exchange Commission Needs To Continue To Improve Its Program, 
[hyperlink, http://www.gao.gov/products/GAO-06-407SU] (Washington, 
D.C.: Mar. 31, 2006); Information Security: Sustained Progress Needed 
To Strengthen Controls At The Securities And Exchange Commission, 
[hyperlink, http://www.gao.gov/products/GAO-07-256] (Washington, D.C.: 
Mar. 27, 2007) Limited Official Use Only Information Security: 
Sustained Progress Needed to Strengthen Controls At The Securities And 
Exchange Commission, [hyperlink, 
http://www.gao.gov/products/GAO-07-257SU] (Washington, D.C.: Mar. 
27,M2007); Information Security: SEC Needs To Continue To Improve Its 
Program, [hyperlink, http://www.gao.gov/products/GAO-08-280] 
(Washington, D.C.: Feb. 29, 2008); Limited Official Use Only 
Information Security: SEC Needs To Continue To Improve Its Program, 
[hyperlink, http://www.gao.gov/products/GAO-08-279SU] (Washington, 
D.C.: Feb. 29, 2008); Information Security: Securities And Exchange 
Commission Needs To Consistently Implement Effective Controls, 
[hyperlink, http://www.gao.gov/products/GAO-09-203] (Washington, D.C.: 
Mar. 16, 2009); Limited Official Use Only Information Security: 
Securities And Exchange Commission Needs To Consistently Implement 
Effective Controls, [hyperlink, http://www.gao.gov/products/GAO-09-
204SU] (Washington, D.C.: Mar. 16, 2009). Washington, D.C.: Mar. 16, 
2009). 

[5] [hyperlink, http://www.gao.gov/products/GAO-10-443R]. 

[6] A material weakness is a deficiency or combination of deficiencies 
in internal control, such that, there is a reasonable possibility that 
a material misstatement of the entity's financial statements will not 
be prevented, or detected and corrected on a timely basis. 

[7] [hyperlink, http://www.gao.gov/products/GAO-11-202]. 

[8] [hyperlink, http://www.gao.gov/products/GAO-10-443R]. 

[9] [hyperlink, http://www.gao.gov/products/GAO-10-443R]. 

[10] OMB Circular no. A-123 defines management responsibility for 
internal control in federal agencies and establishes requirements for 
documenting, testing, and making an assessment on internal controls. 

[11] [hyperlink, http://www.gao.gov/products/GAO-11-202]. 

[12] FISMA was enacted as Title III, E-Government Act of 2002, Pub L. 
No. 107-347, 116 Stat. 2946 (Dec. 17, 2002) and the FISMA requirements 
for agencywide information security programs are codified at 44 U.S.C. 
§ 3544(b). 

[13] NIST Special Publication 800-34, Rev.1, Contingency Planning 
Guide For Federal Information Systems, NISTT SP - 800-34 Rev 1 (May 
2010). 

[14] As we reported in GAO-11-202, this year SEC performed this 
attestation under section 963 of the Dodd-Frank Wall Street Reform and 
Consumer Protection Act, Pub. L. No. 111-203, § 963(a), 124 Stat. 
1376, 1910 (July 21,12010) (codified at 15 U.S.C. § 78d-8). 

[15] GAO, Standards For Internal Control In The Federal Government, 
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] 
(Washington, D.C.: November 1999). 

[16] Office Of Financial Management (OFM) Reference Guide Chapter 02-
01, Accounts Payable: Accrual Process. 

[17] SFFAS No. 5, Accounting For Liabilities Of The Federal 
Government, states that a liability for federal accounting purposes is 
a probable future outflow or other sacrifice of resources as a result 
of past transactions or events. 

[18] [hyperlink, http://www.gao.gov/products/GAO-10-443R]. 

[19] SEC collects securities transaction fees paid by self-regulatory 
organizations (SRO) to SEC for stock transactions. SEC calculates the 
fees due and bills the SROs based on actual transaction volume 
reported on a monthly basis by SROs to SEC and fee rates established 
by SEC's Division Of Risk, Strategy, And Financial Innovation. 

[20] OFM Reference Guide Chapter 12-2, Unliquidated Obligation Review 
Process, defines obligations with no recent activity as individual 
lines of an obligation (i.e., a task order) that has had no activity 
for 120 days for current budget fiscal year obligations (BFY) or 60 
days for prior BFY obligations. 

[21] An obligation is a definite commitment that creates a legal 
liability of the government for the payment of goods and services 
ordered or received, or a legal duty on the part of the United States 
that could mature into a legal liability by virtue of actions on the 
part of the other party beyond the control of the United States. 

[22] The standards for the proper reporting of obligations are found 
in 31 U.S.C. § 1501(a), which are summarized in the definition for 
"obligation" in GAO, A Glossary Of Terms Used In The Federal Budget 
Process, [hyperlink, http://www.gao.gov/products/GAO-05-734SP], at 70 
(Washington, D.C.: September 2005). 

[23] Downward adjustment refers to an agency's cancellation or 
deobligation of previously incurred obligations. 

[24] Antideficiency Act, codified, in part, at 31 U.S.C. § 1341(a). 

[25] OFM reference guide chapter 14-03 Travel: Travel Payments Process 
Document. 

[26] According to the Federal Travel Regulation (FTR), unless the 
agency administratively requires employees to submit travel claims 
within a shorter time frame, travel claims must be submitted within 5 
working days after completion of the trip or period of travel. See 
FTR, 41 C.F.R. § 301-52.7. 

[27] [hyperlink, http://www.gao.gov/products/GAO-11-202]. 

[28] [hyperlink, http://www.gao.gov/products/GAO-11-202]. 

[29] 17 C.F.R. § 202.3A(E) (Return Of Funds From Inactive Accounts). 

[30] A disgorgement is the repayment of illegally gained profits (or 
avoided losses) for distribution to harmed investors whenever 
feasible. A penalty is a monetary payment from a violator of 
securities law that SEC obtains pursuant to statutory authority. A 
penalty is fundamentally a punitive measure, although penalties 
occasionally can be used to compensate harmed investors. 

[31] GAO Financial Audit: SEC's Financial Statements For Fiscal Years 
2007 And 2006, [hyperlink, http://www.gao.gov/products/GAO-08-1677] 
(Washington, D.C.: Nov. 16, 2007). 

[32] Standards For Internal Control In The Federal Government provide 
that an agency's control activities should be established to ensure 
that all transactions are completely and accurately recorded. 

[33] Under 28 U.S.C. § 1961, post-judgment interest is available on 
federal money judgments recovered in a district court whether or not 
affirmatively sought in litigation. Such interest shall be calculated 
from the date of the entry of the judgment, at a rate equal to the 
weekly average 1-year constant maturity treasury yield for the 
calendar week preceding the date of the judgment, and shall be 
compounded annually. 

[34] In fiscal year 2010, the Dodd-Frank Wall Street Reform And 
Consumer Protection Act established the new investor protection fund, 
which resulted in the need for a new treasury account symbol in SEC's 
fund accounting structure to account for activities of the SEC 
investor protection fund. The Investor Protection Fund (Fund) provides 
funding for a whistleblower award program, in which SEC makes award 
payments from the fund to eligible people who provide original 
information to SEC that leads to SEC's successful enforcement of a 
judicial or administrative action in which monetary sanctions 
exceeding $1 million are imposed. The Dodd-Frank Act requires an 
annual report to Congress, including a complete set of audited 
financial statements. See Dodd-Frank Act, Pub. L. no. 111-203, § 
922(a), 124 Stat. 1376, 1844 (July 21, 2010) (codified at 15 U.S.C. § 
78u-6(g)). 

[35] The Prompt Payment Act, 31 U.S.C. § 3902(A), is codified, as 
amended, at 31 U.S.C. Ch. 39, and OMB has prescribed implementing 
regulations, which are codified, as amended, at 5 C.F.R. Pt. 1315. OMB 
implementing regulations on determining the due date generally provide 
that the required payment date is (a) the date payment is due under 
the contract for the item of property or service provided; or (b) 30 
days after a proper invoicer for the amount due is received if a 
specific payment date is not established by contract. 5 C.F.R. § 
1315.4(g). 

[36] For a further, more detailed explanation of our audit scope and 
methodology, see the discussion in our related financial audit report 
[hyperlink, http://www.gao.gov/products/GAO-11-202]. 

[37] For a further, more detailed explanation of our audit scope and 
methodology, see the discussion in our related financial audit report 
[hyperlink, http://www.gao.gov/products/GAO-11-202]. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: