SEC Finds Flaws in Credit Rating Agencies

For example, at one of the smaller NRSROs, the SEC says an analyst participated in determining or approving the ratings of two issuers in which that analyst owned securities.

The SEC staff recommended that this NRSRO enhance its securities ownership policies and procedures, including establishing policies and procedures for the review of a prior rating where a conflict of interest is discovered and for securities divestiture – as this NRSRO did not have policies and procedures in place.

The SEC also found that all three of the larger NRSROs and two of the smaller NRSROs did not have sufficient policies and procedures or controls related to IT or cybersecurity.

The report states, "IT and cybersecurity are increasingly significant components of an NRSRO's internal control structure … They also often affect an NRSRO's capacity to publish accurate ratings in a timely fashion."

The staff recommended that the two smaller NRSROs establish or enhance written IT and cybersecurity policies and procedures and internal controls, and enhance their IT testing and responses to IT-related tests.

In addition, the SEC also found that all three of the larger NRSROs had weaknesses in their IT policies and procedures concerning personnel's access to information that is confidential or otherwise restricted. The Staff recommended that all three of the larger NRSROs enhance their internal controls governing access to IT networks, systems, applications, and file shares.

The SEC also found improvements in several areas. Since the SEC's last report, NRSROs have enhanced their compliance resources, monitoring, and culture, as well as improving its board of directors or governing committee oversight.

The SEC also found that NRSRO's document retention in general had gotten better, as did these agencies' documentation and resources for criteria and model validation.

— Check out Under the Hood: What You Need to Know About Bonds, Pt. 1: Types and Ratings on ThinkAdvisor.