New England Biz Law Update
Securities and Exchange Commission examinations are crucial to the agency’s efforts to enforce the federal securities laws. The mere threat of an SEC examination, particularly in the current regulatory climate, provides a strong incentive for investment advisers and investment companies (e.g., mutual funds) in Massachusetts and beyond to create and maintain a culture of compliance.
The following questions and answers are intended to provide investment advisers and investment companies – and their legal counsel – with a basic understanding of the SEC’s examination process, as well as practical guidance in preparing for an examination.
How does the SEC conduct examinations?
The SEC conducts examinations through its Office of Compliance Inspections and Examinations. The OCIE examinations are designed to prevent and detect compliance problems, and discover weaknesses in firms’ internal controls that may lead to violations of the federal securities laws.
Recently, the OCIE has implemented a more proactive, “risk-based” examination approach designed to identify emerging compliance problems before they become severe or systemic.
What companies are subject to OCIE examinations?
The OCIE examines registered investment advisers, investment companies, self-regulatory organizations (SROs), broker-dealers, transfer agents and clearing agencies. The examinations may be conducted at any time and can last from weeks to months.
Additionally, the OCIE may perform such “reasonable” examinations as “it deems necessary or appropriate in the public interest or for the protection of investors.”
What are the primary types of OCIE examinations?
The three primary types of examinations are “routine,” “cause” and “sweep” examinations. Routine examinations are conducted according to a cycle that is based upon a firm’s perceived risk, and focus on industry areas that have been identified as posing the greatest compliance risks generally. At some point in time, most registered investment advisers and registered investment companies will be subject to a routine examination. The OCIE generally contacts a firm a few days or weeks prior to beginning a routine examination.
Cause examinations usually arise out of investor complaints, tips, press coverage regarding inappropriate conduct at a firm, or matters reported by the firm to the SEC. These examinations may be unannounced and conducted on a “surprise” basis. Typically, if a firm receives adverse media attention pertaining to its business practices, there is a strong likelihood that the OCIE will commence an examination for cause.
Sweep or risk-focused examinations are focused on important regulatory issues rather than firm-specific issues. Also known as “theme” examinations, sweep examinations gather discrete information about the extent, scope and danger of emerging risks across an industry. By contrast, “mini-sweep” examinations focus on fewer firms and allow the OCIE to gather information more quickly.
In fiscal year 2004, the OCIE performed 1,543 investment adviser examinations, of which approximately 55 percent were routine and 45 percent were either for cause or risk-focused. During this same period, the OCIE completed 690 examinations of investment companies, of which approximately 13 percent were routine and 87 percent were either for cause or were risk-focused. See The SEC Speaks in 2005, at 845-46 (2005).
The SEC’s Division of Enforcement, which conducts investigations into possible violations of the federal securities laws and prosecutes the SEC’s civil suits, has recently been actively involved in sweep examinations.
What is the OCIE’s “risk-based approach” to examinations?
The OCIE has shifted away from the “one-size-fits-all” examination approach to one emphasizing risk-targeted examinations and increased surveillance, particularly of larger fund complexes and high-risk firms. This means that a firm may be subject to more than one exam at the same time.
Recent targeted sweep examinations have included a number of Massachusetts-based advisers and fund complexes, and have focused on market timing, late trading, revenue sharing, administration fees and trade payments, to name a few.
What areas are the OCIE likely to focus on during an examination?
The OCIE will most likely examine a firm’s culture of compliance and the adequacy of its written policies and procedures. Specifically, the OCIE may evaluate a firm’s attempt to educate employees about their legal and fiduciary obligations, and search for evidence of compliance testing and monitoring.
Recently, the OCIE has been examining conflicts of interest (including valuation, trade allocations and personal trading), the adequacy of resources directed to compliance, e-mails (all) of certain senior management and business continuity plans.
What steps should a firm take upon receipt of an examination notice?
Senior management should immediately be informed of the receipt of an examination notice. Management should immediately appoint a knowledgeable and responsible employee (i.e., the chief compliance officer or CCO) to act as the primary liaison with the OCIE examiners during the examination. The employee should be responsible for coordinating the production of information to the examiners, reviewing important documents, and keeping a record of the OCIE examiners’ requests. In an abundance of caution, management should appoint another employee to assist the primary liaison.
Firm employees should be notified of the impending OCIE examination. The notification should stress the confidential nature of the OCIE examination and include a directive that employees should not delete or destroy any documents that have been (or will be) created in the normal course of business.
What happens when the OCIE examiners arrive for the on-site visit?
Upon arrival, the OCIE examiners typically request an entrance interview with a firm’s senior management, which sets the tone and focus of the examination. If the OCIE examiners do not make such request, a firm should request an interview to, at a minimum, ascertain the examination’s primary scope, determine the type of examination (i.e., routine, cause), and educate the OCIE examiners about the firm’s business.
In addition, an entrance interview will provide the firm an opportunity to determine whether the examination team includes staff from the SEC’s Division of Enforcement, and if so, whether Division of Enforcement’s presence is simply for educational purposes or for something more serious.
For on-site examinations, an area (typically a conference room) should be carefully selected in which the OCIE examiners will conduct the examination. The area should be a controlled room with restricted access, and be located away from any area in which the OCIE examiners could observe communications among the firm’s employees or documents not intended for their viewing.
Ideally, the location of the room should be close to the primary (or secondary) liaison’s office or legal department. The OCIE examiners should not be allowed to wander around unsupervised or be given open access to copy machines. A firm employee should be responsible for making copies of documents that the OCIE examiners request, and should keep a record of the documents produced to the OCIE examiners. The record will help the firm gauge the substantive areas in which the OCIE examiners are interested.
How do the OCIE examiners request information from a firm?
The OCIE examiners typically request information via the following methods:
Document requests. The OCIE examiners usually provide an initial document request that lists firm records (including e-mails) that the OCIE examiners would like to review. The request is often provided in advance of an examination to allow firms sufficient time to gather documents. Some OCIE examiners’ document requests are extremely broad; if so, firms should attempt to narrow the scope of request and/or propose a rolling document production to the examiners. If a modification of the request is agreed to orally, there should be a written record in the file memorializing the conversation.
Once the firm has carefully reviewed the document request, it should notify key employees who will be responsible for responding to the request and require daily updates on the status of the document production. Firms should maintain at least one copy of documents produced to the OCIE examiners.
In addition, subsequent examiners’ document requests should be reduced to writing. A useful method to accomplish this is to prepare a document request form for the OCIE examiners to complete during their review and submit to the primary liaison.
Importantly, before any document is produced to the examiners, it must be reviewed for responsiveness and privilege. Privileged documents should be identified in a privilege log produced to the OCIE examiners.
Further, if responsive documents are not otherwise public, firms should consider requesting confidential treatment of the documents in accordance with SEC Rule 83, 17 C.F.R. ��.83 (which provides a procedure by which entities submitting information may request that it be withheld when requested under the Freedom of Information Act).
Interviews. The OCIE examiners may request to interview senior management and compliance personnel on various topics during their on-site visit or may have questions on any topic that require personnel to be available. Prior to any interview, a firm’s CCO, in-house and/or outside counsel should meet with the employee to explain the examination process, offer guidance on what to expect and how to respond, and stress that an employee should at all times be honest, calm, polite and cooperative.
The CCO, in-house and/or outside counsel should also attend all interviews of firm employees. This will enable the firm to determine the focus of the examination, assess any issues or preliminary findings of the OCIE examiners and consider taking prompt remedial action during the pendency of the examination.
Demonstrations. On occasion, the OCIE examiners request demonstrations of a firm’s computer systems. Firms should have an experienced employee walk the OCIE examiners through such demonstration, and should not provide unrestricted access for the OCIE examiners to the firm’s computer network.
Importantly, if a serious issue or deficiency has been raised by the OCIE examiners, it is prudent to consult with outside counsel (preferably an attorney with SEC experience) to obtain advice on how to properly respond to the issue.
How do the OCIE examiners conclude the examination?
At the close of an exam, the OCIE examiners generally conduct a preliminary exit interview or exit conference call to clarify information, address any perceived deficiencies, and facilitate quick implementation of remedial actions by a firm.
Firms should make clear that they desire an exit interview at the commencement of the OCIE examination. If nothing else, the exit interview will help a firm clarify any OCIE requests, discuss any outstanding issues and obtain a general sense of the content of the contemplated deficiency letter. It also provides an opportunity to informally convey to the examiners the firm’s position on a contested issue prior to the conclusion of the examination.
What are the possible outcomes of an OCIE examination?
After completion of an examination, there are three possible outcomes, which are not mutually exclusive.
First, the OCIE examiners may issue a letter indicating that there are no deficiencies that were identified during the examination process. This result is rare.
Next, the OCIE examiners may issue a deficiency letter describing the alleged deficiencies, which may include violations of laws and rules and/or internal control weaknesses. Historically, the majority of examinations have resulted in the issuance of a deficiency letter. The OCIE’s goal is to provide a firm with a deficiency letter within 90 days of completing an examination. A firm is supposed to respond in writing within 30 days.
Any deficiency letter should be reviewed by, at a minimum, a firm’s senior management, CCO, in-house and outside counsel. A detailed response letter identifying the corrective actions should be drafted as soon as possible and distributed to key personnel for review.
Importantly, if the SEC’s Division of Enforcement is conducting a parallel investigation into the firm, the firm needs to consider carefully wording its response letter to prevent statements contained therein from being viewed as de facto admissions by the Division of Enforcement.
Additionally, a firm should feel free to contact the OCIE examiners to discuss any serious alleged violations, to seek clarification regarding a particular issue, or to request an extension to respond to the deficiency letter.
Avoiding a referral to the Division of Enforcement, the final possible outcome, is of utmost importance. Of the 1,543 investment adviser examinations completed in SEC fiscal year 2004, 160 or more than 10 percent resulted in referrals to enforcement staff, and of the 690 investment company examinations in 2004, approximately 120 or 17 percent resulted in enforcement referrals. See The SEC Speaks in 2005, at 845-47 (2005). Surprisingly, of the 735 broker-dealer examinations completed in SEC fiscal year 2004, approximately 27 percent were referred to the SEC’s enforcement staff. Id. at p. 848.
In many respects, the manner in which a firm responds to a deficiency letter and implements corrective measures determines whether an issue is referred to enforcement. Of course, once a referral is made to enforcement, the potential adverse consequences to a firm increase dramatically.
How can a firm best prepare for an examination?
Be aware of areas of increased focus by the SEC because the OCIE is constantly shifting its examination priorities.
However, the OCIE will continue to scrutinize firms’ adherence to Rule 204(6)-7 under the Investment Advisers Act of 1940 (Advisers Act), and Rule 38a-1 under the Investment Company Act of 1940, which require registered investment advisers and registered investment companies to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and federal securities laws, respectively.
Specifically, advisers should, as appropriate, adopt policies and procedures regarding portfolio management processes, trading practices, proprietary trading, employee personal trading, disclosures to investors, clients and regulators, safeguarding client assets, the creation and maintenance of required records, marketing advisory services, valuation and fee assessment processes, safeguards for privacy protection and business continuity plans.
Additionally, investment companies are expected to have policies and procedures concerning the pricing of portfolio securities and fund shares, processing fund shares, identification of affiliated persons, protection of nonpublic information, compliance with fund governance requirements and market timing.
Moreover, all firms should keep abreast of “hot” areas of review by the OCIE and ensure that these areas are adequately monitored and, if problematic, are corrected.
Ensure all required records are maintained. Firms must know what records are required to be maintained and how and where such records are maintained. A useful tool is a comprehensive recordkeeping matrix that identifies these elements.
Conduct mock SEC examinations. Proactive firms can simulate an OCIE examination by obtaining copies of recent OCIE document requests and hiring a law firm or third-party compliance consultant to conduct a mock examination. The mock examination can help a firm identify and address any deficiencies in compliance, record-keeping and internal controls before the OCIE examiners come knocking.
