Financial Audit: Securities and Exchange Commission's Financial
Statements for Fiscal Year 2004 (26-MAY-05, GAO-05-244).
Established in 1934 to enforce the securities laws and protect
investors, the Securities and Exchange Commission (SEC) plays an
important role in maintaining the integrity of the U.S.
securities markets. Pursuant to the Accountability for Tax
Dollars Act of 2002, the SEC is required to prepare and submit to
Congress and the Office of Management and Budget audited
financial statements. GAO agreed, under its audit authority, to
perform the initial audit of SEC's financial statements. GAO's
audit was done to determine whether, in all material respects,
(1) SEC's fiscal year 2004 financial statements were reliable,
(2) SEC's management maintained effective internal control over
financial reporting and compliance with laws and regulations, and
(3) SEC's management complied with applicable laws and
regulations.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-05-244
ACCNO: A25177
TITLE: Financial Audit: Securities and Exchange Commission's
Financial Statements for Fiscal Year 2004
DATE: 05/26/2005
SUBJECT: Accounting standards
Auditing standards
Financial management
Financial records
Financial statement audits
Financial statements
Internal controls
Reports management
Accountability
Reporting requirements
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-05-244
United States Government Accountability Office
May 2005
FINANCIAL AUDIT
Securities and Exchange Commission's Financial Statements for Fiscal Year 2004
a
GAO-05-244
May 2005
FINANCIAL AUDIT
Securities and Exchange Commission's Financial Statements for Fiscal Year 2004
[IMG]
What GAO Found
In GAO's opinion, SEC's fiscal year 2004 financial statements were fairly
presented in all material respects. However, because of material internal
control weaknesses in the areas of recording and reporting disgorgements
and penalties, preparing financial statements and related disclosures, and
information security, in GAO's opinion, SEC did not maintain effective
internal control over financial reporting as of September 30, 2004. SEC
did maintain in all material respects effective internal control over
compliance with laws and regulations material in relation to the financial
statements as of September 30, 2004. In addition, GAO did not find
reportable instances of noncompliance with laws and regulations it tested.
SEC prepared its first complete set of financial statements for fiscal
year 2004 and made significant progress during the year in building a
financial reporting structure for preparing financial statements for
audit. However, GAO identified inadequate controls over SEC's
disgorgements and civil penalties activities, increasing the risk that
such activities will not be completely, accurately, and properly recorded
and reported for management's use in its decision making. In addition, GAO
identified inadequate controls over SEC's financial statement preparation
process including a lack of sufficient documented policies and procedures,
support, and quality assurance reviews, increasing the risk that SEC
management will not have reasonable assurance that the balances presented
in the financial statements and related disclosures are supported by SEC's
underlying accounting records.
GAO also found that SEC has not effectively implemented information system
controls to protect the integrity, confidentiality, and availability of
its financial and sensitive data, increasing the risk of unauthorized
disclosure, modification, or loss of the data, possibly without detection.
The risks created by these information security weaknesses are compounded
because the SEC does not have a comprehensive monitoring program to
identify unusual or suspicious access activities.
SEC is currently working to improve controls in all these areas.
United States Government Accountability Office
Contents
Letter 1
Auditor's Report 3
Opinion on Financial Statements 3
Opinion on Internal Control 4
Material Weaknesses 4
Compliance with Laws and Regulations 9
Consistency of Other Information 9
Objectives, Scope, and Methodology 9
SEC Comments and Our Evaluation 12
Management's Discussion and Analysis
Financial Statements 62
Balance Sheet 62
Statement of Net Cost 63
Statement of Changes in Net Position 64
Statement of Budgetary Resources 65
Statement of Financing 66
Statement of Custodial Activity 67
Notes to the Financial Statements 68
Required Supplemental Information
Appendix
Appendix I: Comments from the Securities and Exchange Commission 89
Abbreviations
FISMA Federal Information Security Management Act
FMFIA Federal Managers' Financial Integrity Act
OMB Office of Management and Budget
SEC Securities and Exchange Commission
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
Comptroller General of the United States
United States Government Accountability Office Washington, D.C. 20548
May 26, 2005
The Honorable William H. Donaldson
Chairman
U.S. Securities and Exchange Commission
Dear Mr. Donaldson:
This report presents our opinion on whether the financial statements of
the
Securities and Exchange Commission (SEC) are presented fairly for the
fiscal year ended September 30, 2004. This report also presents (1) our
opinion on the effectiveness of SEC's internal control over financial
reporting and compliance as of September 30, 2004, (2) our evaluation of
SEC's compliance with selected laws and regulations during 2004, and
(3) weaknesses in financial reporting controls detected during our 2004
audit.
The Accountability of Tax Dollars Act of 2002 requires that SEC prepare
and submit to Congress and the Office of Management and Budget (OMB)
audited financial statements. Fiscal year 2004 was the first year SEC
prepared its first complete set of financial statements. GAO agreed, under
its audit authority, to perform the initial audit of SEC's financial
statements.
GAO conducted this audit in accordance with U.S. generally accepted
government auditing standards and OMB audit guidance. The
accomplishment of the first-ever audit of SEC's financial statements was
made possible by the tremendous dedication of time and effort from both
SEC management and staff.
We are sending copies of this report to the Chairman and Ranking Minority
Members of the Senate Committee on Banking, Housing, and Urban Affairs;
the Senate Committee on Homeland Security and Governmental Affairs;
the House Committee on Financial Services; and the House Committee on
Government Reform. We are also sending copies to the Secretary of the
Treasury, the Director of the Office of Management and Budget, and other
interested parties. In addition, this report will be available at no
charge on
the GAO Web site at http://www.gao.gov.
This report was prepared under the direction of Jeanette M. Franzel,
Director, Financial Management and Assurance, who can be reached at (202)
512-9406 or [email protected]. If I can be of further assistance, please
call me at (202) 512-5500.
Sincerely yours,
David M. Walker Comptroller General of the United States
Comptroller General of the United States
United States Government Accountability Office Washington, D.C. 20548
To the Chairman of the U.S. Securities and Exchange Commission
In our audit of the U.S. Securities and Exchange Commission (SEC) for
fiscal year 2004, we found
o the financial statements as of and for the fiscal year ended September
30, 2004, including the accompanying notes, are presented fairly, in all
material respects, in conformity with U.S. generally accepted accounting
principles;
o SEC did not have effective internal control over financial reporting
(including safeguarding of assets), but had effective control over
compliance with laws and regulations that could have a material effect on
the financial statements as of September 30, 2004; and
o no reportable noncompliance with laws and regulations we tested.
The following sections discuss in more detail (1) these conclusions as
well as our conclusions on Management's Discussion and Analysis and other
supplementary information and (2) the objectives, scope, and methodology
of our audit.
Opinion on Financial Statements
The SEC's balance sheet as of September 30, 2004, and its related
statements of net cost, changes in net position, budgetary resources,
financing, and custodial activity, with accompanying notes for the fiscal
year then ended, are presented fairly, in all material respects, in
conformity with U.S. generally accepted accounting principles.
However, misstatements may nevertheless occur in other financial
information reported by SEC as a result of the internal control weaknesses
described in this report.
Opinion on Internal Control
SEC prepared its first complete set of financial statements for fiscal
year 2004 and made significant progress during the year in building a
financial reporting structure for preparing financial statements for
audit. However, because of the material weaknesses in internal control
discussed below, in our opinion, SEC did not maintain effective internal
control over financial reporting (including safeguarding of assets) as of
September 30, 2004. Consequently, SEC's internal control did not reduce to
a relatively low level the risk that misstatements material to the
financial statements may occur and not be detected on a timely basis by
employees in the normal course of performing their assigned functions. We
did find that SEC maintained in all material respects effective internal
control over compliance with laws and regulations that could have a direct
and material effect on the financial statements as of September 30, 2004.1
The material weaknesses in internal control noted above may adversely
affect unaudited information used by SEC for decision making.
Despite the specific issues with internal control, SEC was able to
prepare, in part through tremendous dedication of time and effort from SEC
staff, financial statements that were fairly stated in all material
respects for fiscal year 2004.
Material Weaknesses The material weaknesses we have identified and discuss
in this report relate to SEC's internal control over (1) recording and
reporting of disgorgements and penalties, (2) information security, and
(3) preparing financial statements and the related disclosures. These
material weaknesses were considered in determining the nature, timing, and
extent of audit tests applied in our audit of SEC's fiscal year 2004
financial statements, and our opinion on internal control does not affect
our opinion dated February 11, 2005, on these financial statements. The
details surrounding these weaknesses are being reported separately to SEC
management, along with recommendations for corrective actions. Less
significant matters involving SEC's system of internal controls and its
operations will also be reported to SEC separately.
1 Our opinion on internal control is based on criteria established under
31 U.S.C. S: 3512 (c), (d), commonly referred to as the Federal Managers'
Financial Integrity Act (FMFIA) and the Office of Management and Budget
(OMB) Circular A-123, revised June 21, 1995, Management Accountability and
Control.
Disgorgements and Penalties
As part of its enforcement responsibilities, SEC issues and administers
judgments ordering, among other things, disgorgements, civil monetary
penalties, and interest against violators of federal securities laws.
These transactions involve material amounts of collections and reported
fiduciary and custodial liability balances on the financial statements.
Since fiscal year 2003, SEC has made significant progress towards
documenting financial information concerning moneys owed and paid in
connection with disgorgement and penalty enforcement actions.2 SEC's work
in this area, which continued during fiscal year 2004, includes a process
of upgrading its disgorgements and penalties database to allow for
accurate, timely, and proper reporting of disgorgements and penalties
data, and entering financial data on over 12,000 parties in SEC
enforcement issues. SEC's progress in addressing data reliability concerns
over disgorgements and penalties data is encouraging, and it should
continue to work to assure that data are accurate, timely, and properly
reported.
In August 2004, SEC's Office of Financial Management assumed
responsibility for entering and maintaining financial data on
disgorgements and penalties, and making the necessary calculations and
adjustments for the preparation of its financial statements. To compensate
for limitations in the disgorgements and penalties database, SEC staff
performed extensive manual procedures to compile quarterly subsidiary
ledgers to update the accounting system for disgorgement-and
penalty-related balances and activity. While SEC had a draft policy
covering certain aspects of accounting for disgorgements and penalties,
the policy was not comprehensive and did not include the process and
controls for determining the amounts to be recorded and for reviewing the
disgorgement and penalty financial information and related accounting
entries. Not having comprehensive policies and controls increases the risk
that disgorgement and penalty transactions will not be completely,
accurately, and consistently recorded and reported.
Although we were able to obtain sufficient audit support for the estimated
net amounts receivable from disgorgements and penalties, we found errors
in the recorded balances for the related gross accounts receivable and
allowance for loss. Specifically, we noted errors and inconsistent
treatment in recording judgment and interest amounts, terminated debts,
and
2 Material weaknesses and system nonconformance issues concerning data
integrity and financial reporting for disgorgements and penalties are
reported in SEC's FMFIA reports for fiscal years 2002, 2003, and 2004.
collection fees imposed by Treasury. In most cases, these errors and
inconsistencies were offsetting; however, such errors raise concern about
the controls over the reliability of the gross accounts receivable and
related allowance amounts reported in footnote 3 to the financial
statements.
Establishing controls over the recording of disgorgement and penalty
activity, if properly designed and implemented, should provide reasonable
assurance that disgorgement and penalty transactions are recorded in a
complete, accurate, and timely manner for management's use in decision
making and tracking of operations, and to facilitate the preparation of
financial statements and related disclosures. The process should also
include maintaining supporting documentation that, in reasonable detail,
accurately reflects the transactions that are recorded, and evidences
supervisory review.
Information Security SEC relies extensively on computerized information
systems to process, account for, and report on its financial activities.
GAO's Standards for Internal Control in the Federal Government3 provide an
overall framework for establishing and maintaining internal control,
including a discussion of general control activities that apply to
information systems. As part of the financial statement audit, we assessed
the effectiveness of SEC's information system general controls. Effective
information system general controls are essential to providing reasonable
assurance that financial information is adequately protected from
inadvertent or deliberate misuse, fraudulent use, improper disclosure, or
destruction. These controls include entitywide computer security
management, access controls, system software, application development and
change control, segregation of duties, and service continuity controls.
3 GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
During fiscal year 2004, numerous information security control weaknesses
existed at SEC.4 Specifically, SEC had not consistently implemented
effective electronic access controls, including user accounts and
passwords, access rights and permissions, network security, or audit and
monitoring of security-relevant events to limit and detect access to its
critical financial and sensitive systems. In addition, weaknesses in other
information security controls, including physical security, segregation of
computer functions, application change controls, and service continuity,
further increase the risk to SEC's information systems. As a result,
sensitive data-including payroll and financial transactions, personnel
data, regulatory, and other mission critical information-were at increased
risk of unauthorized disclosure, modification, or loss, possibly without
being detected. Thus, SEC did not have adequate assurance that users only
had access needed to perform their assigned duties and its network was
sufficiently protected from unauthorized users. The risks created by these
weaknesses are compounded because SEC does not have a comprehensive
monitoring program to identify unusual or suspicious access activities.
The details surrounding these weaknesses were reported separately to SEC
management, along with recommendations for corrective actions.5
A key reason for SEC's information security control weaknesses is that SEC
has not fully developed and implemented a comprehensive security
management program to provide reasonable assurance that effective controls
are established and maintained and that information security receives
significant management attention. An effective program would include
issuing guidance and implementing procedures for assessing risks,
establishing policies and related controls, raising awareness of
prevailing risks and mitigating controls, evaluating the effectiveness of
established controls, and using the results of management's evaluation to
continuously improve controls. While SEC has taken some actions to improve
security management, including establishing a central security management
function and appointing a senior information security officer to manage
the overall security management program, it still needs to take additional
steps
4 In its fiscal year 2004 report pursuant to the Federal Information
Security Management Act (FISMA), SEC's Office of Inspector General
reported that SEC was not substantially in compliance with FISMA
requirements that are intended to strengthen information security. Also,
SEC has reported problems with its information security program as a
material weakness in its FMFIA report since 2002.
5 GAO, Information Security: Securities and Exchange Commission Needs to
Address Weak Controls Over Financial and Sensitive Data, GAO-05-262
(Washington, D.C.: March 2005).
to address all key elements of an information security management program.
Such a program is critical to provide SEC with a solid foundation for
resolving existing information security problems and continuously managing
information security risks.
Financial Statement Preparation Process
For fiscal year 2004, SEC did not have documentation showing the
procedures, systems, analysis of accounts, and personnel involved in
developing key balances and preparing the financial statements and related
disclosures, or the related quality control and review procedures. SEC's
opening balances for its fiscal year 2004 financial statements contained
material misstatements, some of which also affected the fiscal year 2004
reported operating results. SEC posted the necessary audit adjustments and
produced financial statements for fiscal year 2004 that were fairly
presented in all material respects. However, summarized documentation
supporting the financial statement preparation process and the development
of related balances is needed to provide structure and discipline to the
process and the related quality control procedures. In addition, SEC's
process for preparing its fiscal year 2004 financial statements was
manually intensive, time consuming, and did not include documentation of
quality control procedures. For certain financial statement line items and
disclosures, the detailed support for the balances and underlying
transactions was not readily available and was difficult to retrieve.
Finally, comprehensive accounting policies and procedures for several
major areas were still in draft or needed to be developed.
Controls over the financial statement preparation process should be
designed to provide reasonable assurance regarding the reliability of the
balances and disclosures reported in the financial statements and related
notes in conformity with generally accepted accounting principles,
including the maintenance of detailed support that accurately and fairly
reflects the transactions making up the balances in the financial
statements and disclosures. GAO's Standards for Internal Control in the
Federal Government6 provide an overall framework for establishing and
maintaining internal control, including a discussion of control
activities, management review, and documentation of processes and
transactions. A financial statement preparation process with documented
policies and procedures, support, and quality assurance reviews, if
properly designed
6 GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
and implemented, should provide SEC management with reasonable assurance
that the balances presented in the financial statements and related
disclosures are supported by SEC's underlying accounting records. We
believe SEC can use the lessons learned from the fiscal year 2004
financial reporting and audit processes to formalize and further improve
its process for developing and reviewing the figures needed to compile and
prepare its year-end and quarterly financial statements.
Compliance with Laws Our tests of compliance with selected provisions of
laws and regulations related to financial reporting disclosed no instances
of noncompliance that
and Regulations are reportable under U.S. generally accepted government
auditing standards or OMB audit guidance. However, our objective was not
to provide an opinion on compliance with laws and regulations.
Accordingly, we do not express such an opinion.
Consistency of Other Information
SEC's Management's Discussion and Analysis, required supplementary
information, and other accompanying information contain a wide range of
data, some of which are not directly related to the financial statements.
We did not audit and do not express an opinion on this information.
However, we compared this information for consistency with the financial
statements and discussed the methods of measurement and presentation with
SEC officials. Based on this limited work, we found no material
inconsistencies with the financial statements or nonconformance with OMB
guidance.
Objectives, Scope, and Methodology
SEC management is responsible for (1) preparing the financial statements
in conformity with U.S. generally accepted accounting principles; (2)
establishing, maintaining, and assessing internal control to provide
reasonable assurance that the broad control objectives of the Federal
Managers' Financial Integrity Act (FMFIA) are met; and (3) complying with
applicable laws and regulations.
We are responsible for obtaining reasonable assurance about whether (1)
the financial statements are presented fairly, in all material respects,
in conformity with U.S. generally accepted accounting principles; and (2)
management maintained effective internal control that provides reasonable,
but not absolute, assurance the following objectives are met:
o Financial reporting: Transactions are properly recorded, processed, and
summarized to permit the timely and reliable preparation of financial
statements in conformity with U.S. generally accepted accounting
principles, and assets are safeguarded against loss from unauthorized
acquisition, use, or disposition.
o Compliance with applicable laws and regulations: Transactions are
executed in accordance with (1) laws governing the use of budgetary
authority, (2) other laws and regulations that could have a direct and
material effect on the financial statements, and (3) any other laws,
regulations, or governmentwide policies identified by OMB audit guidance.
We are also responsible for (1) testing compliance with selected
provisions of laws and regulations that could have a direct and material
effect on the financial statements and for which OMB audit guidance
requires testing, and (2) performing limited procedures with respect to
certain other information appearing in SEC's Performance and
Accountability Report. In order to fulfill these responsibilities, we
o examined, on a test basis, evidence supporting the amounts and
disclosures in the financial statements;
o assessed the accounting principles used and significant estimates made
by SEC management;
o evaluated the overall presentation of the financial statements;
o obtained an understanding of internal control related to financial
reporting (including safeguarding of assets) and compliance with laws and
regulations (including execution of transactions in accordance with budget
authority);
o obtained an understanding of the recording, processing, and summarizing
of performance measures as reported in Management's Discussion and
Analysis;
o tested relevant internal controls over financial reporting and
compliance with applicable laws and regulations, and evaluated the design
and operating effectiveness of internal control;
o considered SEC's process for evaluating and reporting on internal
control and financial management systems under the FMFIA; and
o tested compliance, and related internal controls over compliance, with
selected provisions of the following laws and their related regulations:
o the Securities Exchange Act of 1934, as amended;
o the Securities Act of 1933, as amended;
o the Antideficiency Act;
o laws governing the pay and allowance system for SEC employees; and
o the Prompt Payment Act.
We did not evaluate all internal controls relevant to operating objectives
as broadly defined by the FMFIA, such as those controls relevant to
preparing statistical reports and ensuring efficient operations. We
limited our internal control testing to controls over financial reporting
and compliance. Because of inherent limitations in internal control,
misstatements due to error or fraud, losses, or noncompliance may
nevertheless occur and not be detected. We also caution that projecting
our evaluation to future periods is subject to the risk that controls may
become inadequate because of changes in conditions or that the degree of
compliance with controls may deteriorate.
We did not test compliance with all laws and regulations applicable to
SEC. We limited our tests of compliance to those required by OMB audit
guidance and other laws and regulations that had a direct and material
effect on, or that we deemed applicable to, SEC's financial statements for
the fiscal year ended September 30, 2004. We caution that noncompliance
may occur and not be detected by these tests and that such testing may not
be sufficient for other purposes.
We performed our work in accordance with U.S. generally accepted
government auditing standards and OMB audit guidance.
SEC Comments and Our Evaluation
In commenting on a draft of this report, SEC was pleased to receive an
unqualified opinion on SEC's first-ever financial statements. SEC also
acknowledged the material weaknesses in internal control and stated it is
moving aggressively to address and resolve the weaknesses. SEC indicated
that by June 2006, it will implement corrective actions for information
technology security weaknesses and that weaknesses related to
disgorgements and penalties should also be resolved by fiscal year 2006.
To address the material weakness pertaining to preparation of financial
statements, SEC plans to hire additional staff, formalize policies and
procedures for preparing and reviewing financial statements, and establish
a formal audit committee to engage in financial reporting issues.
The complete text of SEC's response is included in appendix I.
David M. Walker Comptroller General of the United States
February 11, 2005
Management's Discussion and Analysis
MANAGEMENT'S DISCUSSION AND ANALYSIS 5
Vision
The Securities and Exchange Commission aims to be the standard against which
federal agencies are measured. The SEC will strengthen the integrity and
soundness of U.S. securities markets for the benefit of investors and other
market participants, and conduct its work in a manner that is as sophisticated,
flexible, and dynamic as the securities markets it regulates.
6
MANAGEMENT'S DISCUSSION AND ANALYSIS
MANAGEMENT'S DISCUSSION AND ANALYSIS 7
8
MANAGEMENT'S DISCUSSION AND ANALYSIS
To enforce compliance with federal securities laws. The Commission The SEC
updated its
seeks to detect potential problems or issues in the securities markets
early four agency-wide goals to
and prevent violations of federal securities laws. If violations occur,
the
SEC alerts investors to possible wrongdoing and takes prompt action to
achieve desired outcomes,
halt and sanction the misconduct. along with its vision,
mission, and values, as To sustain an effective and flexible regulatory
environment.
Federal securities laws seek to promote fair, orderly, and competitive
part of its new strategic
markets that protect investors from undisclosed risk while fostering plan
for FY 2004 through
innovation and market access. The Commission's role is to establish a FY
2009.
regulatory environment that both protects investors and permits
competition to flourish.
To encourage and promote informed investment decisionmaking.
An educated investor ultimately provides the best defense against fraud
and costly mistakes. The SEC works to promote informed investment
decisions through two main approaches-reviewing disclosures to help ensure
clear, complete, and truthful information is provided to the investing
public, and implementing a variety of investor education initiatives.
To maximize the use of SEC resources. An efficient, well-managed,
proactive SEC is critical for protecting investors and the markets. As
such, the Commission concentrates on enhancing organizational
effectiveness, investing in its human capital, as well as new
technologies, and strengthening internal controls.
MANAGEMENT'S DISCUSSION AND ANALYSIS 9
The SEC is an independent federal agency that is headed by a bipartisan
five-member commission, comprised of the Chairman and four Commissioners
who are appointed by the President and confirmed by the U.S. Senate. The
SEC operates under the authority of federal laws, including the Securities
Act of 1933, the Securities Exchange Act of 1934, the Investment Company
Act of 1940, the Investment Advisers Act of 1940, and the Sarbanes-Oxley
Act of 2002 (Sarbanes-Oxley Act), among others.
At the end of FY 2004, the SEC had more than 4,000 permanent and more than
70 temporary staff positions. The SEC is organized into four divisions and
21 offices, with its headquarters in Washington, D.C. In addition, the
Commission maintains 11 regional and district offices throughout the
country. The SEC's organization chart is presented in Figure 1.1.
10 MANAGEMENT'S DISCUSSION AND ANALYSIS
Under Chairman Donaldson's leadership, in FY 2004 the SEC achieved a great
deal on a variety of
fronts. These accomplishments can be grouped into five major themes, which
are discussed below.
The SEC's major performance indicators also are displayed where
appropriate. Because many of the
measures are new, prior year data may be limited or unavailable.
Implemented the Sarbanes-Oxley Act and Improved Disclosures to Investors