Background SEC Examinations of  FINRA The Office of Compliance Inspections and Examinations (OCIE)  administers SEC’s nationwide examination and inspection program for  registered SROs, broker-dealers, transfer agents, clearing agencies,  investment companies, and investment advisers. OCIE conducts  examinations and inspections to improve compliance, prevent fraud,  monitor risk, and inform policy. Individual groups in OCIE have oversight  responsibility for the various registered entities. The FINRA and  Securities Industry Oversight (FSIO) program within OCIE performs  examinations of FINRA and the Municipal Securities Rulemaking Board,  an SRO that regulates the municipal bond market. As part of its FINRA oversight activities, FSIO conducts four types of  reviews that may involve Section 964 areas. Program inspections are reviews of FINRA operations and program  areas (for example, FINRA’s review of applications by broker-dealers  seeking to become members). Oversight examinations are single, stand-alone examinations of  specific examinations that FINRA conducts of its member firms. FSIO  initiates an oversight examination when its examinations of a broker- dealer find deficiencies FSIO believes should have been identified by  FINRA in its own examination of the broker-dealer. Thematic oversight examinations are a series of oversight  examinations that evaluate FINRA’s review of a particular regulatory  area across a number of its member firms. Tips, complaints, and referrals are allegations or statements of  concern about possible violations of securities laws or risky conduct  received by SEC. FSIO reviews FINRA-related tips, complaints, and  referrals by evaluating facts and circumstances and conducting  background research. The reviews may result in FINRA-related  inspections or examinations or may be used for inspection planning  purposes. To help identify the FINRA programs and topics that it will review, FSIO  uses a risk-based approach that includes an annual assessment of high- risk areas and consideration of the areas specified in Section 964.  According to SEC staff, FSIO also conducts ongoing monitoring of  FINRA’s activities through reviews of information provided by FINRA and  meetings with FINRA officials. Standards Useful for  Assessing Examination  Policies and Procedures Generally accepted government auditing standards define performance  audits as those that provide findings or conclusions based on an  evaluation of sufficient, appropriate evidence against criteria.  Performance audit objectives can include assessments of program  effectiveness, economy, and efficiency; internal control; compliance; and  prospective analyses. SEC’s examinations of SROs share many of the attributes of performance  audits, including their objectives. For example, examinations (including  inspections) of FINRA enable FSIO staff to evaluate compliance with  applicable laws and regulations; FINRA rules, regulations, or by-laws; or  both. Although SEC is not required to follow the auditing standards when  examining SROs, these standards and guidance provide a framework for  conducting high-quality reviews that can serve as useful criteria in  evaluating a regulatory agency’s examination or inspection programs. Areas of generally accepted government auditing standards relevant to  SRO examinations include independence, competence, quality control  and assurance, planning, supervision, evidence, documentation, and  reporting:  Independence refers to the audit organization and individual auditor’s  need to be independent and include documentation proving  independence. Competence refers to the extent to which audit staff collectively  should possess adequate professional competence and technical  knowledge, skills, and expertise. Quality control and assurance refers to a system of quality control that  an organization should establish that is designed to provide the  organization with reasonable assurance that its personnel comply with  professional standards and legal requirements. Planning includes creating a written audit plan for each audit. Supervision requirements include sufficient guidance and direction to  the staff assigned to the audit to address the audit objectives and  follow applicable requirements, while staying informed about  significant problems encountered, reviewing the work performed, and  providing effective on-the-job training. Evidence refers to sufficient, appropriate evidence to provide a  reasonable basis for the auditor’s findings and conclusions. Audit documentation requirements state that auditors must prepare  documentation related to planning, conducting, and reporting for each  audit. Finally, communication of the results entails auditors issuing audit  reports. SEC’s FINRA  Oversight Activities  Covered Key Areas  Identified in the Dodd- Frank Act Since fiscal year 2015, SEC examinations related to FINRA included  reviews of all areas identified in Section 964. We determined that FSIO  completed at least one examination covering each of the Section 964  areas since fiscal year 2015 (see table 1). In total, FSIO began or  completed 61 examinations (program inspections, oversight  examinations, and thematic oversight examinations) related to FINRA  programs and operations in that period. Some examinations evaluated  other aspects of FINRA’s programs and operations (those not specifically  identified in Section 964), such as market surveillance and restitution for  harmed investors. FSIO examinations either focused on a single Section 964 area or  considered multiple areas. Some examinations focused specifically on a single Section 964 area. For example, in 2017 FSIO reviewed FINRA’s arbitration program,  which provides retail investors a venue for resolving disputes with  their brokers. Other examinations considered one or more of the areas as part of a  broader scope. For instance, a program inspection completed in 2016  touched on FINRA’s arbitration services, cooperation with state  securities regulators, transparency, and other topics. Another program  inspection involved governance, policies on former employees, and  other topics. FSIO examinations most frequently covered FINRA examinations (41  of 61). Nearly all of the oversight examinations reviewed at least some  aspect of FINRA examinations. In two cases, the oversight  examinations also covered another area—review of advertising by  FINRA members. Selected Guidance  Used for FINRA  Governance  Inspections Generally  Was Consistent with  Relevant Auditing  Standards We found that OCIE policies and procedures used for examining FINRA  since fiscal year 2015 generally were consistent with the requirements of  generally accepted government auditing standards. SEC uses an  examination manual to conduct its SRO examinations. We previously  found that OCIE policies and procedures (including the prior version of  the manual) generally were consistent with the requirements of the  auditing standards that we determined were most relevant to assessing  examination policies and procedures: independence, competence, quality  control and assurance, planning, supervision, evidence, documentation,  and reporting. We compared the current and prior versions of the examination manual.  More specifically, we selected requirements for planning, prefieldwork  scoping, and communicating findings from the current manual and  compared those with similar sections in the prior version of the manual.  We found that the new version includes the same material as the prior  version while also incorporating additional guidance in certain areas. The  planning section of the current version includes two additional  requirements on the inclusion of non-National Examination Program  staff. The communicating findings section of the current version  included two additional requirements related to extensions of time to  respond to disposition letters. Two of the four additional requirements  were generally consistent with government auditing standards, and the  remaining two additional requirements were minor adjustments that did  not materially change the requirements. Therefore, we deemed the  selected sections of the current version of the manual to also be  consistent with the auditing standards. Inspections of FINRA  Governance Were  Consistent with SEC  Internal Guidance OCIE (and from 2016, FSIO) program inspections of FINRA governance  in fiscal years 2015–2017 were consistent with internal examination  guidance. OCIE identified five inspections in that period that related to  FINRA governance. Each of the inspections focused on one of the  following areas: (1) code of conduct, (2) executive and employee  compensation practices, (3) investment portfolio, (4) compliance resource  provider program, and (5) the funding mechanism for its regulatory  services agreement. FINRA’s code of conduct imposes restrictions on employees’  investments and requires financial disclosures that are uniquely  related to its role as a securities regulator. The code also outlines  FINRA’s ethical commitments and expectations and provides  guidance on what employees must do to meet them. FINRA’s executive and employee compensation practices consist of  salary and incentive compensation determined by FINRA’s  Management Compensation Committee using operational, strategic,  and financial factors, in addition to individual performance. FINRA’s investment portfolio is governed by a policy based on the  degree of risk appropriate for FINRA assets, as applied by its board to  its investment objectives. In the compliance resource provider program, FINRA worked with  organizations to offer firms compliance-related products and services  at a discounted price or with additional features. According to FINRA  staff, this program was discontinued in May 2017 and replaced with  FINRA’s Compliance Vendor Directory. FINRA’s regulatory service agreements are designed to provide  market surveillance, financial surveillance, examinations,  investigations, and disciplinary services to other entities, including the  New York Stock Exchange LLC and the Chicago Board Options  Exchange. For our review, we judgmentally selected the most relevant requirements  from the section of the examination manual related to planning  inspections and the most relevant requirements from the section of the manual related to communicating inspection findings to determine if OCIE  conducted the inspections in accordance with its guidance. The planning section covers planning examinations and prefieldwork  scoping and requires the examination team to discuss the results of  background research and determine an appropriate scope for the  examination as early as possible. The communicating findings section requires entities to be provided  with timely and concise communications on the results. It also  discusses how examination staff should take further actions for those  findings that could involve notifications to other regulators. We reviewed relevant inspection-related documentation (including scope  memorandums, disposition letters, emails, and information extracted from  an examination database) and compared them against the selected  requirements to determine if the guidance was followed. We tallied our  results with a scorecard methodology (see fig. 1). We found that all five inspections we reviewed met all requirements  applicable to that particular inspection. For example, across all the  inspections, OCIE examiners held prefieldwork meetings and  documented and received approval for the scope of the examinations.  Additionally, all five inspections met the required 180-day completion  deadline and closed the inspection with a disposition letter. In cases in  which requirements were not applicable, the reasons generally were that  a triggering event had not occurred and no further action was needed. For  instance, the scope was not modified in any of the inspections, so the  requirement for approval of such modifications did not apply.  Furthermore, none of the inspections included non-National Examination  Program staff (such as personnel from SEC’s Enforcement Division), and  so requirements surrounding participation by those groups did not apply. Agency Comments We provided a draft of this report to SEC for their review and comment. In  its comment letter, which is reprinted in appendix II, SEC concurred with  our findings and appreciated our attention to the issues discussed in the  report. SEC also provided technical comments on the draft report, which  we incorporated as appropriate. We are sending copies of this report to the appropriate congressional  committees, the Securities and Exchange Commission, the Financial  Industry Regulatory Authority, Inc., and other interested parties. In  addition, this report is available at no charge on the GAO website at  http://www.gao.gov. If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or clementsm@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III. Appendix I: Objectives, Scope, and  Methodology This report (1) determines if the Securities and Exchange Commission’s  (SEC) oversight of the Financial Industry Regulatory Authority, Inc.’s  (FINRA) operations and programs since fiscal year 2015 included the 10  areas specified in Section 964 of the Dodd–Frank Wall Street Reform and  Consumer Protection Act (Dodd-Frank Act), (2) evaluates the extent to  which selected SEC internal guidance on conducting examinations of  FINRA follows generally accepted government auditing standards, and  (3) evaluates the extent to which examinations of FINRA’s governance  practices followed SEC’s internal guidance. To assess whether oversight of FINRA by SEC’s Office of Compliance  Inspections and Examinations (OCIE) included the Section 964 areas, we  requested and reviewed documentation for all examinations since fiscal  year 2015 (from October 2014 through April 2018) that OCIE staff  identified as relating to Section 964 areas. We use the term  “examination” to include program inspections, two types of oversight  examinations, and oversight activities stemming from tips and referrals.  The documentation included scope memorandums, deficiency letters, and  closing letters to the file for OCIE examinations. We evaluated whether  the documentation indicated that an examination’s scope and findings  covered one or more Section 964 areas or included other areas related to  FINRA oversight that were not specified in Section 964. To determine the extent to which OCIE’s internal guidance on conducting  examinations of FINRA followed generally accepted government auditing  standards, we compared SEC’s examination manual against generally  accepted auditing standards. We reviewed selected sections of the  current version of the manual and the earlier version. We judgmentally  selected the two sections that most directly related to our focus on self- regulatory organization (SRO) inspections, which focused on preparing  for examinations and communicating examination findings. Other areas of  the examination manual that were not relevant focused on administration  and organizational issues. We relied on our work that found that the  earlier version of the manual followed the auditing standards and also  interviewed pertinent staff within OCIE to discuss the guidance and why it  did or did not include certain elements. We analyzed any differences  between the versions to determine whether changes or additions in the  current version of the manual also followed auditing standards. In  addition, we interviewed FINRA staff to gain a general understanding of  how OCIE staff work with them to conduct examinations. To determine the extent to which OCIE’s program inspections of FINRA’s  governance in fiscal years 2015–2017 followed OCIE’s internal guidance,  we used a scorecard methodology to compare inspections of FINRA’s  governance with the examination manual and draft updates. We only  reviewed the extent to which examinations followed specified guidelines  and did not evaluate the analysis, findings, or disposition of the  examinations. We created a checklist of relevant elements from the  examination manual by judgmentally selecting 6 requirements from the  planning inspections section of the manual and 11 requirements from the  communicating findings section of the manual that were most applicable  to our focus on the actual SRO inspection process. Other requirements  that we deemed less relevant include examinations of exempt reporting  advisers and the process for approving examination documents. The planning section of the manual covers planning examinations and  prefieldwork scoping and requires the examination team to discuss  the results of background research and determine an appropriate  scope for the examination as early as possible. The communication of examination findings section requires entities  to be provided with timely and concise communications on the results.  It also discusses how examination staff should take further actions for  those findings that could involve notifications to other regulators. We then reviewed different types of inspection-related documentation to  determine whether the guidance was followed. For instance, we assessed  certain inspection requirements, such as compliance with changing the  scope of the inspection, based on formal written documentation such as  scope memorandums and disposition letters. We assessed other  requirements (such as whether prefieldwork team meetings were held)  based on informal documentation, such as email appointments. We also  relied on other internal documentation, which included the examination  tracking database, which is used to certify compliance with a requirement  to complete an inspection within 180 days from the completion of audit  work. Two analysts then independently compared the elements against  documentation for the five OCIE inspections to determine the extent to  which the inspections documented the requirements outlined in the  examination manual. Analysts assigned a rating of “yes” if the element  was found in the inspection materials we reviewed, “no” if there was no  mention of the element in the inspection materials we reviewed, “partially”  if the element was not fully addressed in the inspection materials we  reviewed, and “n/a” if the element was not applicable to the inspection.  We also interviewed pertinent staff within OCIE to discuss the guidance  and why it did or did not include certain elements. We conducted this performance audit from November 2017 to July 2018  in accordance with generally accepted government auditing standards.  These standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix II: Comments from the Securities  and Exchange Commission Appendix III: GAO Contact and Staff  Acknowledgments GAO Contact Staff  Acknowledgments In addition to the contact named above, Karen Tremba (Assistant  Director), Jon D. Menaster (Analyst in Charge), Kevin Averyt, Farrah  Graham, Marc Molino, Akiko Ohnuma, Barbara Roesmann, and Jessica  Sandler made key contributions to this report.
The securities industry is generally regulated by a combination of federal and industry oversight. FINRA, a self-regulatory organization, is responsible for regulating securities firms doing business with the public in the United States. SEC oversees FINRA's operations and programs. Section 964 of the Dodd-Frank Act includes a provision for GAO, following an initial report, to triennially review and report on aspects of SEC's oversight of FINRA. GAO issued its first report in May 2012 ( GAO-12-625 ) and its second report in April 2015 ( GAO-15-376 ). This report (1) determines if SEC's oversight of FINRA included the 10 areas specified in Section 964 of the Dodd-Frank Act and (2) evaluates the extent to which selected SEC internal guidance for examinations of FINRA follows generally accepted government auditing standards and the extent to which SEC's examinations of FINRA's governance practices followed SEC internal guidance. GAO reviewed all SEC examinations relating to a Section 964 area completed since fiscal year 2015 (including five that were governance-related), reviewed certain SEC procedures used to examine self-regulatory organizations against Government Auditing Standards , and compared completed inspections against SEC guidance. GAO also interviewed SEC and FINRA staff. Since fiscal year 2015, Securities and Exchange Commission (SEC) examinations of the Financial Industry Regulatory Authority, Inc. (FINRA) covered each of the 10 areas specified in Section 964 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), such as governance, funding, and transparency. The most commonly covered area was FINRA examinations of its members. Selected SEC guidance used to examine FINRA, including requirements for planning, prefieldwork scoping, and communicating findings, was consistent with generally accepted government auditing standards, and SEC inspections of FINRA were consistent with SEC's guidance. The five governance-related inspections of FINRA that GAO reviewed were consistent with SEC guidance for planning examinations and communicating findings (see fig.). Not all the requirements were applicable (because in certain instances completion of one requirement eliminated the need to satisfy others).