April 11, 2000

The Honorable David M. Walker
Comptroller General
U.S. General Accounting Office
441 G Street, N.W.
Washington, D.C. 20548

Dear Mr. Walker:

In May 1991, GAO reported that the New York, American, Midwest, Pacific, and Philadelphia Stock Exchanges, and the National Association of Securities Dealers, all had made improvements to increase the capacities of their automated systems used to facilitate order routing and trade execution. (See Stock Market Automation: Exchanges Have Increased Systems’ Capacities Since the 1987 Market Crash (GAO/IMTEC-91-37, May 1991).) Recent press reports, e.g., "Nasdaq’s Delays During Record Trading Day Raise Concerns of Computer Systems’ Capability," Wall Street Journal, Thursday, April 6, 2000, indicate that volatile trading sessions and heavy volume are straining the Nasdaq Stock Market’s computer systems. Critics contend that this may be hampering the ability of broker-dealers to perform best and efficient trade executions. A question also arises as to whether gaps exist in the SEC’s oversight program.

Accordingly, I am writing to request that GAO audit the system capacities of the major market systems and the SEC’s oversight of market automation, including strategic technology planning. As part of that job, please update GAO’s previous work on these issues, including SEC and market progress in implementing GAO’s recommendations in the following previous reports.

In Financial Markets: Stronger System Controls and Oversight Needed to Prevent NASD Computer Outages (GAO/AIMD-95-22, December 1994), GAO recommended that the SEC’s chairman ensure that NASD:

• expands testing processes for its market systems to better detect problems;
• performs a thorough assessment of its existing systems environment to identify weaknesses;
• avoids implementing software changes on potentially volatile trading days;
• corrects weaknesses in its contingency and disaster recovery plan and backup data processing facility; and
• regularly schedules and conducts audits of its market systems.

In addition, GAO recommended that SEC’s chairman (1) reach agreement with securities markets on the frequency of independent reviews, (2) determine SEC inspection frequency needed to ensure adequate oversight of market systems and facilities, and (3) follow up on systems auditors’ recommendations and ensure that the recommendations are adequately resolved. Given that the gaps in SEC oversight are attributable in part to a lack of technical staff, GAO recommended that the chairman should also determine the number of staff needed to adequately oversee the rapid growth of market automation and report this information to the SEC’s congressional appropriations and authorization committees in time for consideration in next year’s budget. Have all these actions been taken and to what effect? What more needs to be done?

In Financial Markets: Computer Security Controls at Five Stock Exchanges (GAO/IMTEC-91-56, August 1991), GAO’s review of six stock markets found that they all had controls in place to mitigate many of the risks associated with automation, but GAO also found that five stock exchanges were vulnerable to 68 systems security and other control weaknesses in 10 functional areas. GAO recommended that the exchanges take corrective action to mitigate the weaknesses found in its review. Have these actions been taken? What more needs to be done?

In Financial Markets: Active Oversight of Market Automation by SEC and CFTC Needed (GAO/IMTEC-91-21, April 1991), GAO reported that, in response to past recommendations that SEC establish the capability to assess the efficient and safe use of market automation, the SEC stated that it was not necessary or cost-effective to employ substantial staff resources to conduct independent technical assessments. Instead, SEC tasked its Office of Automation and International Markets (OAIM) to oversee voluntary system reviews performed by self-regulatory organizations’ internal or external auditors. GAO said that OAIM was staffed by four attorneys and had one vacant position, designated for a computer specialist, and had taken actions to oversee market automation without the technical position being filled. GAO called these actions "steps in the right direction." However, GAO warned:

"without the technical expertise to establish policies and oversee the steps taken by market entities to control automation’s risks, the SEC will be unable to (1) assess the adequacy of independent audits and (2) provide needed assurances as to the integrity of automated systems used by our nation’s securities markets."

Accordingly, GAO recommended that the SEC more aggressively establish the technical oversight capabilities to control the risks associated with automation. GAO said that such capabilities should include the needed technical expertise to establish policies governing the development and operation of market systems and to perform and oversee technical reviews of automated trading and post-trading systems. GAO also recommended that the SEC provide a timetable for developing its technical capabilities to the agency’s congressional oversight committees. Has the SEC sufficiently improved its technical oversight capabilities or do gaps still remain?

Thank you for your cooperation and attention to this important matter.

Sincerely,

JOHN D. DINGELL
RANKING MEMBER

Enclosure

cc: The Honorable Tom Bliley, Chairman
Committee on Commerce

The Honorable Michael Oxley, Chairman
Subcommittee on Finance and Hazardous Materials

The Honorable Edolphus Towns, Ranking Member
Subcommittee on Finance and Hazardous Materials

The Honorable Arthur Levitt, Jr., Chairman
Securities and Exchange Commission