The Securities and Exchange Commission’s (SEC) Inspector General (IG) said the Division of Corporation Finance (CorpFin) should improve its documentation and guidance for selecting public company filings for review.
The Sarbanes-Oxley Act of 2002 requires the SEC to review disclosures of reporting companies—currently numbering more than 7,400—at least once every three years or more often based on risk assessment. CorpFin’s Disclosure Review Program (DRP) examines filings to identify those that do not comply with the SEC’s disclosure requirements or are materially deficient. When problems are identified, the staff issues comment letters to affected companies requesting corrections.
Proper documentation of DRP’s selection and scoping processes is crucial for investor protection as it promotes transparency and ensures risk-based decision-making that enables effective oversight, IG’s Office of Audits said in a report, published late August 2025.
“Yet, in fiscal years 2023 and 2024, it was often unclear why DRP staff selected companies for elective annual report reviews and how staff decided to scope both required and elective reviews,” the report stated.
For instance, the audit found that DRP documented the scope of annual report reviews for only about 40% of the 43 reviews assessed by IG.
The documented scoping information varied and referenced different sections of CorpFin policy to explain how staff determined what would be included in each review.
“Staff documented information inconsistently due to a lack of comprehensive guidance in selecting annual reports for elective review and documenting the scope for both required and elective reviews,” IG explained.
In addition, the IG audit found that CorpFin’s draft internal guidance did not address five of the six risk factors the SEC must consider when selecting companies to review.
Section 408(b) of Sarbanes-Oxley lists the following six factors that the commission should consider for scheduling reviews:
- (1) issuers that have issued material restatements of financial results;
- (2) issuers that experience significant volatility in their stock price as compared to other issuers;
- (3) issuers with the largest market capitalization;
- (4) emerging companies with disparities in price to earning ratios;
- (5) issuers whose operations significantly affect any material sector of the economy; and
- (6) any other factors that the commission may consider relevant.
The OIG report also noted that changes in the DRP workforce may result in a loss of institutional knowledge, and potential new rules regarding crypto assets and other issues may create additional disclosure requirements requiring staff attention.
“Improved documentation and guidance related to key DRP selection and scoping decisions can help management face these challenges and ensure the DRP uses a risk-based process to make the best use of its limited resources,” the report said.
Most of the nearly 300 employees in DRP are accountants or attorneys with specialized knowledge. The program is organized in nine industry offices and three support offices, including an office focused on risk and strategy. Each year, DRP staff compiles lists of public companies required for review or eligible for elective annual report reviews.
At a minimum, DRP accountants assess company compliance with accounting standards and disclosure requirements by reviewing company financial statements and related disclosures from the most recently filed annual report and subsequently filed periodic and current reports. In limited cases, DRP accountants and attorneys conduct full reviews of annual reports by considering the entirety of a company’s disclosure rather than just the financial statements and supporting information.
In particular, the IG recommended that DRP management:
- Require that important information about how annual reports are selected for elective review and scoped, including any relevant risk factors, be documented, among other actions.
- Coordinate with the SEC’s Office of the General Counsel to finalize Section 408 guidance, including a description of all six factors to be considered and an interpretation of the minimum review period mandate.
- Consider developing a plan that prioritizes DRP goals and requirements in the event of significant staffing decreases and/or significant workload increases.
In a letter attached to the report, CorpFin said that it concurs with the IG’s recommendations and will take steps to address matters presented in the report.
“While we do not believe that the observations underpinning the recommendations indicated any material issues with the overall effectiveness of the Division’s existing controls or procedures, we recognize the importance of continuous improvement in meeting evolving challenges and expectations,” CorpFin’s letter notes.
Take your tax and accounting research to the next level with Checkpoint Edge and CoCounsel. Get instant access to AI-assisted research, expert-approved answers, and cutting-edge tools like Advisory Maps and State Charts. Try it today and transform the way you work! Subscribe now and discover a smarter way to find answers.
