Summary

rotiduA etatS ainrofilaC S T I D U A E T A T S F O U A E R U B Department of Corporations: It Needs Stronger Oversight of Its Operations and More Efficient Processing of License Applications and Complaints January 2007 2005-123 The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the Bureau of State Audits at the following address: California State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, California 95814 (916) 445-0255 or TTY (916) 445-0033 OR This report is also available on the World Wide Web http://www.bsa.ca.gov The California State Auditor is pleased to announce the availability of an on-line subscription service. For information on how to subscribe, please contact the Information Technology Unit at (916) 445-0255, ext. 456, or visit our Web site at www.bsa.ca.gov Alternate format reports available upon request. Permission is granted to reproduce reports. C S A ALIFORNIA TATE UDITOR ELAINE M. HOWLE DOUG CORDINER STATE AUDITOR CHIEF DEPUTY STATE AUDITOR January 30, 2007 2005-123 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As requested by the Joint Legislative Audit Committee, the Bureau of State Audits presents its audit report concerning the operations of the Department of Corporations (Corporations) to ensure that it is effectively fulfilling its responsibilities. This report concludes that because Corporations has performed only limited analyses of its fees and assessments during the last six years, it has consistently overcharged for some activities and undercharged for others. The accumulated excess revenues may result in a violation of state law that takes effect on June 30, 2007, which requires Corporations to limit the reserve it maintains in the State Corporations Fund to 25 percent of annual expenditures. In addition, although Corporations has taken important steps in strategic planning for its operations, its efforts are undercut by inaccurate statistical information about its actual performance. Moreover, we found that Corporations does not always process applications within the time limits set by state law. Although Corporations is responsible for some of the delays in processing applications, other factors outside of its control also contribute to lengthy processing times. Also, although there is no legal requirement dictating the length of time Corporations has to resolve complaints, we found examples of unnecessary delays in a sample of complaints that increased the length of the process. Further, the three primary information systems Corporations uses for complaint-related data are unreliable for determining certain critical information because the systems contain too many blank fields, duplicate records, and errors. Finally, Corporations has not conducted many of its required examinations of certain licensees within the last four years. Respectfully submitted, ELAINE M. HOWLE State Auditor BUREAU OF STATE AUDITS 555 Capitol Mall, Suite 300, Sacramento, California 95814 Telephone: (916) 445-0255 Fax: (916) 327-0019 www.bsa.ca.gov ConTenTS Summary 1 Introduction 7 Chapter 1 The Department of Corporations Has Not Adequately Monitored or Evaluated Its Activities 19 Recommendations 32 Chapter 2 Weaknesses in Its Processing of License Applications and Complaints Reduce the Department of Corporations’ Effectiveness 35 Recommendations 53 Response to the Audit Business, Transportation and Housing Agency, Department of Corporations 57 SUMMARY ReSulTS in BRief The Department of Corporations (Corporations), within the Business, Transportation and Housing Agency, is responsible for licensing and regulating the securities and financial services industries, including businesses such Audit Highlights . . . as securities brokers and dealers, investment and financial planners, and certain fiduciaries and lenders. As part of these Our review of the responsibilities, Corporations issues and renews licenses, Department of Corporations’ examines and investigates licensees, and collects periodic (Corporations) operations assessments from certain licensees. Corporations is supported revealed the following: solely by the fees and assessments it collects. Although it also  Corporations’ current fee conducts investigations into alleged violations of the laws structure results in certain over which it has jurisdiction, Corporations has typically been licensees subsidizing the administrative costs required to transfer any fines and penalties it collects to the for others. For example, State’s General Fund. revenues from securities fees have exceeded the We found that since 2001, Corporations has not analyzed related service costs by $22.2 million over the last the licensing and examination fees it charges businesses to seven years. determine whether the fees matched its costs of providing the related services. As a result, it has consistently overcharged  Corporations has taken important steps in for some activities and undercharged for others. For example, strategic planning for revenues from securities fees have exceeded the related service its operations, however, costs for six of the last seven fiscal years, resulting in excess these efforts are undercut revenues of $22.2 million from these fees during that time. by inaccurate statistical information about its Corporations has also generated excess revenues from three of actual performance the other business activities it regulates. Overall, excess revenues as reported in its from these three activities have totaled $2.8 million over the monthly and quarterly last seven fiscal years. In contrast, the revenues generated from performance reports. fees for nine other business activities have not been enough to  Corporations does cover the service costs, falling short by a total of $21 million not always process over the last seven fiscal years. For example, the fees charged applications within the time limits set by to process applications for businesses providing investment state law. In fact, for advice have not been high enough to cover Corporations’ costs applications submitted of providing these services, falling short by $8.2 million during between January 2004 this time. In effect, the excess revenues generated from some and May 2006, the average processing time types of fees allow Corporations to offset the funding shortfalls exceeded the time allowed for the services it provides for other applicants. Some of the fees by law for many of the collected by Corporations, such as licensing fees, are generally application types we reviewed. set by statute and thus cannot be raised without a change in the law. However, state law has given Corporations the authority to continued on next page . . . set certain fees below the statutory amount. California State Auditor Report 2005-123 1  Although there is no Similarly, Corporations has not recently updated its billing rates legal requirement for audits and examinations. Our audit found that Corporations’ dictating the length of Financial Services Division would have generated more than time Corporations has $1 million in additional revenues from examinations during to resolve complaints, we found examples of the period from January 1, 2004, through May 23, 2006, had it unneccessary delays in a revised its billing rates to reflect its increased employee costs for sample of complaints we examiners. reviewed.  Corporations has three Any excess revenues not used by Corporations to fund its primary information operations and not transferred or loaned to other funds systems for capturing accumulate in the State Corporations Fund. These accumulated complaint related data; however, none of them are excess revenues may result in a violation of a state law that reliable for determining takes effect on June 30, 2007, which requires Corporations the number, type, and to limit the reserve it maintains in the fund to 25 percent of status of its complaints because the systems annual expenditures, or approximately $8 million by that contain too many blank date. Corporations stated that its reserve was $13.1 million on fields, duplicate records, June 30, 2006; however, this amount does not take into account and errors. a loan to the General Fund of $18.5 million, $6 million of  Corporations did which Corporations’ financial management chief expects to be not conduct required paid back in fiscal year 2006–07. If Corporations does receive examinations of at least the $6 million loan repayment in fiscal year 2006–07, it would 170 licensed escrow offices and 899 licensed have to spend $11.1 million more than it collects in that year finance lenders within its in order to reduce the State Corporations Fund to the statutory four-year goal. maximum. Given that Corporations has not changed any of its fees and had excess revenues totaling $3.2 million in fiscal year 2005–06, that does not seem to be a reasonable expectation. Corporations has taken important steps in strategic planning for its operations, seeking to identify its strengths and weaknesses, eliminate inefficiencies, and increase productivity. It is also in the process of implementing a program-level action plan. However, these efforts are undercut by inaccurate statistical information about its actual performance as reported in its monthly and quarterly performance reports. Such errors, if they are significant, may direct Corporations’ attention away from important issues needing improvement or toward lesser issues at the expense of areas of greater concern. The inefficient methods used to compile the performance reports also consume time that could instead be used to complete the tasks the reports are measuring. The performance report for the quarter ending September 30, 2006, indicates that Corporations has fallen short of most of its goals. In addition, because it does not gather sufficient data and does not always identify benchmark goals for its performance measures, the effectiveness of Corporations’ Education and 2 California State Auditor Report 2005-123 Outreach Unit (outreach unit) is uncertain. For example, the outreach unit does not collect data for four of the 12 performance measures it has identified for its Seniors Against Investment Fraud Program. Further, of the eight performance measures for which it does collect data, it has established benchmarks for only two. Without sufficient data and benchmarks, it is impossible for Corporations to effectively assess the value of its efforts. Similarly, Corporations did not have any goals for its Troops Against Predatory Scams Investor Education Project. Corporations does not always process applications within the time limits set by state law. In fact, for applications submitted between January 2004 and May 2006, the average processing time exceeded the time intended by law for many of the application types we reviewed. Although Corporations is responsible for some of the delays in processing license applications, other factors outside of its control also contribute to lengthy processing times. For instance, applicants frequently submit incomplete applications that require Corporations to issue deficiency notices. In fact, we found several instances in which Corporations had to send applicants multiple deficiency notices before it obtained the information needed to rule the applications complete. Furthermore, applicants do not always respond promptly to the deficiency notices. Delays in processing are detrimental to the applicants because they prevent applicants from conducting business. Corporations also did not always resolve complaints related to securities regulation and financial services as quickly as it could have. Although there is no legal requirement dictating the length of time Corporations has to resolve complaints, our review of 20 complaints related to securities regulation identified four complaints in which unnecessary delays increased the length of the process. In one instance, the Securities Regulation Division did not begin its investigation until 277 days after the complaint was received. We found similar unnecessary delays in Corporations’ handling of our sample of 20 financial services complaints. When Corporations does not investigate complaints promptly, its ability to protect consumers from fraudulent activities is compromised. Furthermore, the information systems used by Corporations to track complaints are unreliable because they contain a large number of blank fields, duplicate entries, and inaccuracies. Fields commonly left blank include the date a complaint was California State Auditor Report 2005-123 3 received, the date the case was opened, the type of law involved, and the name of the staff member assigned to the complaint. In addition, one system listed an incorrect status for many of the complaints we reviewed. Consequently, it is difficult, if not impossible, for management to use these systems as tools for assessing some of Corporations’ activities. Corporations’ Enforcement and Education Division (enforcement division) also did not always identify a reason for rejecting complaints, and for the cases for which it did identify a reason, it did not always fully document its rationale. Because the enforcement division cannot fully investigate every complaint it receives, due to its workload and budget constraints, its policy is to occasionally reject some lower-priority complaints, such as complaints involving out-of-state complainants or those involving a limited number of investors. However, to ensure that the process of rejecting complaints is consistent and fair, the enforcement division should carefully document its rationale for doing so in each case. Corporations has recently modified its procedure for handling complaints. In addition to developing formal policies for rejecting and referring complaints, it has centralized the intake of all complaints into a new complaint team. Corporations believes that this new process will allow it to respond immediately to complaints and prepare each complaint for referral to the appropriate division. Because Corporations initiated this process near the end of our field work, we were unable to test whether it will correct any of the weaknesses we identified. However, it appears that the process contains good business practices. Finally, contrary to law, Corporations has not conducted at least 170 (37 percent) of its required examinations of escrow office licensees within the last four years. In addition, it has yet to conduct examinations for 899 (35 percent) of eligible finance lender licensees within its four-year goal. According to Corporations’ action plan, its examinations have the potential to detect violations of the law and unsafe, unsound, or abusive practices and serve to deter potential wrongdoing. Thus, having a significant examination backlog could leave consumers less well protected.  California State Auditor Report 2005-123 ReCommendATionS To strengthen its operational oversight, Corporations should seek legislative authority allowing it to set fees by regulation. This legislative authority should require that Corporations annually assess its fee rates and establish fees that are reasonably related to its cost of providing the services supported by its fees. Corporations should also factor in the amount of any excess reserves when conducting its annual assessment. To improve the efficiency and effectiveness of its system for collecting actual performance measure information, Corporations should do the following: • Consider assessing the need for new automated data systems or determining whether its current systems are capable of collecting the necessary information. • Ensure the accuracy and completeness of the information in its automated systems by requiring staff to enter the information and requiring supervisors to review it periodically. For data not currently available in automated format, Corporations should develop stronger procedures to ensure that staff accurately report and supervisors review the information. Corporations should consider calculating and reporting performance measures quarterly, rather than monthly, until it has a more efficient data collection system. To ensure that it has identified all necessary performance measures and appropriately focused its current performance measures, Corporations should continue to assess the reasons for performance deficiencies and add or adjust performance measures as needed. To ensure that the outreach unit can effectively measure its success, Corporations should ensure that it collects all of the necessary data and establishes reasonable benchmarks. To ensure that all applications are reviewed promptly and sufficiently, Corporations should do the following: • Continue to monitor the progress of applications through the review and approval process to identify any that have stalled, and investigate the reason for the delay. California State Auditor Report 2005-123 5 • Follow up with applicants that do not promptly respond to deficiency notices. • Assess whether it needs additional staff to process applications. • Maintain all necessary data in its information management systems so that it can effectively calculate the number of days it takes to process applications. To improve the efficiency of its complaint-handling process, Corporations should do the following: • Develop procedures to track the progress of complaints to ensure that they continue to move through the process without unnecessary delay. • Monitor its newly established complaint-referral process and develop procedures, if necessary, to decrease the length of time it takes to refer cases to the appropriate division. • Review its existing complaint records and eliminate duplicates and correct any inaccurate fields. Further, Corporations should maintain accurate and complete data to ensure that the information systems can be used more effectively as management tools. Corporations should develop a plan to conduct examinations of licensees in accordance with state law and its own internal policy. AgenCy CommenTS Corporations did not have any substantial disagreements to our report and found the recommendations to be useful. The Business, Transportation and Housing Agency concurred with Corporations and stated that the report should prove to be a useful blueprint for Corporations’ recently appointed commissioner. n  California State Auditor Report 2005-123 inTRodUCTion BACkgRound The Department of Corporations (Corporations) is the State’s investment and financing authority. Led by a commissioner who is appointed by the governor, Corporations is responsible for licensing and regulating a variety of businesses that represent a significant part of California’s economy, including securities brokers and dealers, investment and financial planners, and certain lenders. As part of its responsibilities, Corporations reviews and screens persons or entities applying for licenses to conduct business in the securities and financial services industries. Once licensed, these persons and entities are subject to examination by Corporations as a condition of licensure and to ensure compliance with applicable laws. Moreover, Corporations may respond to and investigate complaints of violations of relevant laws. Figure 1 shows the organizational structure of Corporations. figuRe 1 department of Corporations organization Chart Commissioner Consumer Chief Deputy Services Office Commissioner (Call Center) Enforcement Financial Securities Office of Office of Office of and Education Services Regulation Management Law and Public Affairs Division Division Division and Budget Legislation Operating Divisions Source: Department of Corporations. Corporations functions as a special fund agency that is supported by revenues it collects from applications and other fees, assessments, reimbursable audits, examinations, and investigations. It deposits the revenues it receives into the State Corporations Fund, which consists of 13 subfunds. Seven of California State Auditor Report 2005-123  these subfunds are related to securities regulation laws and six are related to financial services laws. Its fiscal year 2006–07 budget is $31.7 million and, as shown in Figure 2, Corporations has 248 employees statewide serving in a variety of capacities. It has branches in Los Angeles, Sacramento, San Francisco, and San Diego. figuRe 2 Staffing by division as of november 200 Enforcement and Education Division—41 (17%) Other*—95 (38%) Securities Regulation Division— 43 (17%) Financial Services Division—69 (28%) Source: Department of Corporations’ filled positions as of November 16, 2006. * The Other category includes the Commissioner’s Office, Office of Public Affairs, Office of Consumer Services (Call Center), Office of Law and Legislation, and the Office of Management and Budget. Corporations’ overall mission is to ensure an efficient and accessible financial services marketplace in California, to educate the public about the risks and rewards involved in investing and finance, and to enforce California’s financial services laws to protect the public from fraud. To accomplish this mission, Corporations has three operating divisions: the Securities Regulation Division (securities division), the Financial Services Division (financial division), and the Enforcement and Education Division (enforcement division). Although the enforcement division enforces all investment and financial laws administered by Corporations, the securities and the financial divisions are each responsible for a unique set of business activities. Table 1 shows these activities and the applicable laws that govern the two divisions’ responsibilities.  California State Auditor Report 2005-123 TABle 1 Responsibilities of the department of Corporations’ financial Services and Securities Regulation divisions law Business Type Corporations’ Responsibilities financial Services division Escrow Law Real estate services License and regulate independent escrow companies. California Deferred Deposit Payday lending License and regulate deferred deposit originators Transaction Law (payday lenders). California Finance Lenders Law Consumer and commercial finance License and regulate finance lenders and brokers lending making or brokering consumer or commercial loans. California Residential Mortgage Residential mortgage lending License and regulate mortgage lenders and servicers. Lending Act and services Check Sellers, Bill Payers and Financial intermediary License/register and regulate companies and Proraters Law individuals who sell checks, cash checks, or pay bills on behalf of others. Securities Regulation division Corporate Securities Law Investment services License and regulate investment advisers and broker- dealers; review and approve any offer or authority to sell securities. Franchise Investment Law Sale of franchises Review and approve any offer or authority to sell franchises. Sources: Auditor prepared from information obtained from Department of Corporations’ Web site and applicable laws. Securities division The securities division is responsible for qualifying the offer and sale of securities and for licensing and regulating broker-dealers, broker-dealer agents, and investment advisers, pursuant to the Corporate Securities Law of 1968. In addition, the securities division qualifies certain outstanding securities for secondary market transactions (shares of a public company that are available to be traded publicly) and administers the Franchise Investment Law, under which the offer and sale of franchises are registered. To ensure that the persons and entities licensed under these laws are acting responsibly, the securities division also conducts periodic examinations of business activities and investigates complaints filed against the persons and entities it licenses. If it finds that enforcement action is warranted, it refers the matter to the enforcement division for appropriate administrative, civil, or criminal action. California State Auditor Report 2005-123  financial division The financial division is responsible for licensing, regulating, and examining commercial and consumer financial institutions. Toward that end, it administers California’s laws with respect to commercial and consumer finance, residential mortgage lenders, independent third-party escrows (a neutral party that assures that no funds or property changes hands until all instructions have been carried to completion), check sellers, bill payers, and deferred deposit transactions (payday loans). In addition, the financial division is responsible for handling all complaints related to the laws it administers and, similar to the securities division, for forwarding those complaints to the enforcement division if action is warranted. However, the financial division works to resolve most of its complaints through correspondence between the complainant and the licensee. enforcement division The enforcement division enforces all investment and financial laws administered by Corporations through administrative and civil actions and by providing support to criminal prosecutions. It can take a number of enforcement actions, such as issuing administrative orders to stop violations of the law (desist and refrain orders); denying, censuring, suspending, or revoking a license; censuring, suspending, or barring individuals from participating in a regulated industry; taking civil injunctive actions; or appointing a receiver over a company. It also has the authority to obtain equitable remedies, including rescission, restitution, and penalties, against violators. Figure 3 shows the types of enforcement actions taken by Corporations in the 267 actions it reported taking between January 1, 2006, and September 30, 2006. Within the enforcement division, the Education and Outreach Unit (outreach unit) provides education services designed to help protect Californians from becoming victims of investment and financial fraud. The outreach unit has two primary consumer protection programs, Seniors Against Investment Fraud (seniors program) and Troops Against Predatory Scams Investor Education Project (troops program), which are designed to educate senior citizens and military personnel, respectively, about investment fraud and how to protect their finances from predatory schemes. For the seniors program, Corporations contracts with local retired senior volunteer programs to deliver presentations and distribute educational material. These 10 California State Auditor Report 2005-123 contractors are responsible for providing Corporations with information regarding attendance at the seminars and the amount of materials they distribute to the public. figuRe 3 Summary of the Types of enforcement Actions Taken from January 1, 200 Through September 30, 200 Other actions—13 (5%) Application denial—12 (4%) Bar from employment in industry—16 (6%) Desist and refrain License revocation—19 (7%) order—112 (42%) Civil action—19 (7%) Monetary penalty or award—34 (13%) Criminal action—42 (16%) Source: Department of Corporations’ monthly performance metrics report (unaudited). Supporting offices Within Corporations Supporting Corporations’ three primary divisions are the Office of Law and Legislation, which is responsible for legislation, legal opinions, and rulemaking, among other things; the Office of Management and Budget, which is responsible for providing information technology, financial management, human resources, and business operation services; and the Office of Public Affairs, which is responsible for coordinating all of Corporations’ internal and external communications. Corporations’ Strategic Plan Corporations recently revised its draft strategic plan (strategic plan) for fiscal year 2006–07. The strategic plan establishes departmentwide goals (listed in the text box on the following page), principles, values, and basic performance measures and identifies its strengths, weaknesses, opportunities, challenges, California State Auditor Report 2005-123 11 and key issues. Responding to new technology, for instance, is identified both as a key issue and department of Corporations’ Strategic Plan goals as an opportunity for improving efficiency in its licensing and registration processes. The strategic 1. Increase the public’s awareness and plan also takes initial steps to identify action plans understanding of Corporations’ mission. for responding to each of Corporations’ four goals 2. Establish a leadership role in influencing national and establishes target completion dates for the and state public policy and industry standards. proposed actions. 3. Increase staff effectiveness and improve responsiveness to Corporations’ licensees and the public. The program-level action plan incorporates 4. Improve Corporations’ efficiency, effectiveness, comments received from an agency expert and accountability to its licensees and the review panel and links closely to the strategic public. plan, providing more specific steps that Source: Department of Corporations’ Revised Draft Corporations should take, as well as the Strategic Plan, May 2006. anticipated benefits of each step, the persons responsible for implementing each step, and the resources required. For example, one of the action steps involves speeding up the handling of the financial division’s applications and consists of a series of tasks, such as meeting with key personnel involved with various stages of application processing, reviewing existing procedures, documenting any proposed changes, and, finally, implementing the new procedures. Corporations anticipates substantial completion on more than 20 of the program-level action plan’s projects by February 2007, with completion of certain other projects to follow. However, as its acting chief deputy commissioner has indicated, performance- based management involves continuous improvement, and Corporations anticipates that it will make other changes to meet performance targets and address changes in its business environment. To determine the effect of the action steps proposed in the program-level action plan, and to identify additional changes needed in the future, Corporations plans to analyze its actual operational results, as summarized in its monthly and quarterly performance reports, comparing these results to targets it has established for each of more than 60 performance measures. Corporations began collecting information on these performance measures in July 2005. The performance reports relate to the program-level action plan but focus on specific measures of effectiveness. 12 California State Auditor Report 2005-123 SCoPe And meThodology The Joint Legislative Audit Committee (audit committee) asked the Bureau of State Audits to review the operations of Corporations to ensure that it is effectively fulfilling its responsibilities. Generally speaking, we were asked to evaluate Corporations’ progress toward meeting the goals and performance measures outlined in its strategic plan as well as its progress toward implementing any changes needed to fulfill its goals effectively. We were also asked to review Corporations’ workload studies and fee analyses to determine the extent to which Corporations has implemented any recommendations from these efforts. Furthermore, the audit committee requested that we evaluate Corporations’ education and outreach efforts in achieving its goals. We were also asked to evaluate Corporations’ licensing policies and practices to determine if they are efficient, protect consumers, and prevent fraudulent applications from being processed. The audit committee requested that we review a sample of each type of license issued to determine whether the policies are applied consistently and to determine the length of time it takes to issue a license. It also asked that we assess Corporations’ policies and practices related to the monitoring of licensees, including the number and frequency of licensee examinations that are conducted and the effectiveness of the examinations. Finally, we were asked to identify the number of complaints Corporations receives annually and to evaluate its policies and practices for handling complaints, including its process for monitoring the ongoing investigation of complaints, the types of enforcement actions taken, Corporations’ ability to enforce actions taken as a result of complaints, and Corporations’ criteria for deciding to reject a complaint or to turn it over to another enforcement agency. To determine whether Corporations complies with the various laws and regulations governing its activities, we examined its policies and procedures and reviewed relevant portions of the California Financial Code, the California Corporations Code, and sections of the California Code of Regulations. To determine whether any laws hamper Corporations’ ability to fulfill its mission and its actions when state or federal law is vague, we reviewed laws, rules, and regulations relevant to the issues and interviewed key Corporations’ personnel. Our work did not disclose any laws that hamper Corporations’ ability to fulfill its mission. California State Auditor Report 2005-123 13 To determine whether Corporations has conducted fee analyses and implemented recommendations based on them, we reviewed its policies and procedures and analyzed its financial statements, including the underlying supporting documentation for the State Corporations Fund and its subfunds, for fiscal years 1999–2000 through 2005–06. We also reviewed Corporations most recent fee analysis conducted in 2001. To determine whether Corporations is establishing goals and monitoring performance measurements, we reviewed three of its key documents: (1) the Business Strategic Plan (revised as of May 2006), (2) the Program-Level Action Plan (action plan), and (3) monthly and quarterly performance reports. Additionally, we reviewed Corporations’ progress toward accomplishing a sample of action steps outlined in its action plan. We also reviewed Corporations’ monthly and quarterly performance reports to evaluate Corporations’ progress toward meeting its goals and the process it uses to prepare the reports. We traced monthly totals to supporting documentation and recomputed Corporations’ quarterly results. Because our testing found that some of the data in the reports are inaccurate, we have concerns regarding whether the reports are reliable for the purpose of analyzing Corporations’ performance. To evaluate the effectiveness of Corporations’ education and outreach efforts, we reviewed Corporations’ process for establishing goals and collecting performance-related data for two of its primary programs, seniors program and the troops program. To determine whether Corporations’ licensing policies and practices are efficient and effective and protect consumers against fraud, we reviewed the relevant laws, rules, and regulations. In addition, we reviewed a sample of license applications for six license types. We determined whether the licenses were processed promptly and identified reasons for any delays. Additionally, we identified the reasons for deficient applications to assess whether the requirements were overly burdensome or complicated, thus increasing the likelihood that applicants may submit incomplete or inaccurate applications. We also assessed whether the application screening process included reasonable steps to help prevent fraud. Furthermore, we obtained data from Corporations’ electronic information systems used to track seven application types it processes. The U.S. Government Accountability Office (GAO), 1 California State Auditor Report 2005-123 whose standards we follow, requires us to assess the reliability of computer-processed data. Based on our tests, we found the data to be reliable for the purpose of computing the average number of days it took to process finance lender applications, deferred deposit lender applications, and mortgage banker applications for main branches. However, we determined the data relating to broker-dealers and state investment advisers to be of undetermined reliability for this purpose. This is because applications for broker-dealers and state investment advisers are submitted to a national organization instead of to Corporations. Therefore, we were not able to verify the date the applications were received. Further, we determined that the data relating to securities are not reliable for the purpose of calculating the average number of days it took to process applications, since the data for application approval dates were not fully populated. However, when we removed the records with blank approval dates, we determined that the data were reliable for the purpose of computing the average number of days it took to process the securities applications. For franchise and escrow office applications, we were unable to rely on the system data to compute the average number of days to process these applications. Consequently, we based our conclusions on a sample of applications. To determine how well Corporations handles consumer complaints, we reviewed its policies and procedures. We also reviewed a sample of complaints related to both securities regulation and financial services. Among other things, we determined how long Corporations took to resolve these complaints, identified whether there were any unnecessary delays, and reviewed the outcome of Corporations’ investigations. We also reviewed a sample of complaints rejected by Corporations’ enforcement division without investigation to ensure that its rationale was well documented. In addition, we obtained electronic data from Corporations’ data systems used to track complaints. We performed analyses on several data fields to ascertain the reliability of the data, in accordance with the GAO’s standards for assessing the reliability of computer-processed data. Based on our review, we found that some of the data contained in the Corporations Customer Service System and the Customer Relationship Management System are unreliable for the purposes of tracking the number of complaints, the length of time to process complaints, and the staff assigned to particular complaint cases because the necessary data fields contained too many blank, erroneous, and duplicate California State Auditor Report 2005-123 15 records. Thus, we did not use these data to draw conclusions in these areas. However, we did determine the length of time it took to process a sample of complaints. To determine the types of enforcement actions available to Corporations and its ability to enforce orders resulting from investigations, we interviewed personnel and reviewed its policies and procedures. We also reviewed Corporations’ policies and procedures for monitoring individuals and businesses that have been issued desist and refrain orders. In addition, we obtained electronic data from Corporations’ data system used to track enforcement orders, called the Enforcement Case Management System (ECMS). We found the ECMS to be unreliable for the purposes of tracking the number and types of enforcement actions contained in the system. Thus, we did not draw conclusions from these data. Instead, we summarized the number of enforcement actions Corporations reported in its monthly performance reports for the period January 1, 2006, through September 30, 2006. To determine how Corporations decides whether an investigation should be turned over to an enforcement agency or needs the court’s assistance in enforcing an order, we reviewed its policies and procedures. Corporations does not formally track the number of cases it refers to enforcement agencies, nor the number of times it has requested the court’s assistance during the last five years. Additionally, the deputy commissioner of the enforcement division stated that it does not formally track the number of times local district attorneys have refused cases because of the dollar amounts involved. To assess the effectiveness of Corporations’ examinations of licensees, we reviewed its policies and procedures. We also reviewed a sample of examinations to determine whether Corporations promptly and adequately followed up on the deficiencies it identified. Further, we obtained data from Corporations’ electronic information system used to track examinations conducted by its financial division. We performed analyses of the data in accordance with the GAO’s standards for reliability of computer-processed data. Based on our review, we found these data to be reliable for the purpose of calculating the number and percentage of active California finance lender and mortgage banker licenses that received examinations in accordance with time frames established in statute or internal policies. However, we were not able to verify the population of active escrow licenses, since Corporations did not retain 1 California State Auditor Report 2005-123 all of the supporting documentation for licenses marked as surrendered. Therefore, we determined the data relating to escrow licenses to be of undetermined reliability for this purpose. Additionally, we found the data to be reliable for the purpose of determining the total number of hours billed for California finance lender, mortgage banker, and escrow routine examinations completed between January 1, 2004, and May 23, 2006. We then determined whether Corporations was conducting examinations in accordance with time frames established in statute or internal policies. To determine whether Corporations sufficiently plans for its staffing needs, we reviewed recent budget change proposals requesting additional staff and reviewed the recent workload studies it conducted. With the exception of staffing needs for the financial division’s examiners, Corporations was not able to provide us with any formal workload studies done in the past five years. Consequently, we were not able to evaluate whether current staffing levels were sufficient. Moreover, according to the deputy commissioner of the enforcement division, as of January 2, 2007, Corporations did not have any investigator positions filled; however, he stated that it has made conditional offers to three investigators and is awaiting the background and psychological clearance for them. Corporations expects to hire these investigators in late January or early February 2007. In the meantime, investigations have been performed by a combination of examiners, attorneys, and outside contractors. n California State Auditor Report 2005-123 1 Blank page inserted for reproduction purposes only. 1 California State Auditor Report 2005-123 ChApTeR 1 The Department of Corporations Has Not Adequately Monitored or Evaluated Its Activities ChAPTeR SummARy During the last six years, the Department of Corporations (Corporations) has not analyzed the fees it charges businesses to ensure that the fees reflect the cost of providing a given service. As a result, it overcharges for some activities and undercharges for others. Although it has some authority to set fees below the statutory maximum for certain businesses, the only way Corporations can increase fees above the statutory maximum is to have the law changed. Excess revenues Corporations has accumulated in the State Corporations Fund may result in a violation of a state law that takes effect on June 30, 2007, requiring Corporations to limit the amount of reserves it maintains in the fund. Although Corporations has taken important steps in strategic planning for its operations by establishing a framework to identify its strengths and weaknesses, these efforts are undercut by inaccurate statistical information about its actual performance, as well as by the inefficient methods it uses to compile that information for its performance reports. In addition, the performance report for the quarter ending September 30, 2006, indicates that Corporations has fallen short of most of its goals. Moreover, the efforts of Corporations’ Education and Outreach Unit (outreach unit) to measure its performance in meeting the objectives of its two primary programs, Seniors Against Investment Fraud (seniors program) and Troops Against Predatory Scams Investor Education Project (troops program), need improvement. Without sufficient data and measurable goals, we question whether Corporations can effectively determine the success of its efforts. California State Auditor Report 2005-123 1 The feeS CoRPoRATionS ColleCTS ReSulT in An ineQuiTABle diSTRiBuTion of ChARgeS Among liCenSeeS And An eXCeSSiVe fund ReSeRVe In establishing fees to charge licensees, Corporations must take into account two basic goals: the need for individual fees to cover Corporations’ related administrative costs and the need to limit the size of the fund reserve. Its current fee structure does not accomplish either goal. Corporations overcharges for some fees and undercharges for others. Moreover, the overcharging is so excessive that the amounts collected not only cover the costs of administration for the undercharged fees, but also have contributed to the accumulation of a large fund reserve. New legislation requires Corporations to limit the size of its reserve to 25 percent of expenditures by June 30, 2007. We believe Corporations is unlikely to meet that goal. Corporations is Supported by Various fees and Charges for examinations it Conducts Corporations, which does not receive support from the State’s General Fund, supports its operations through revenues earned from fees charged for processing applications1 for notices, registration certificates, permits, and the initial issuance and renewal of licenses.2 (Refer to Table 1 on page 9 of the Introduction for a description of the business activities regulated by Corporations.) It deposits these fees in the State Corporations Fund. Corporations also earns revenues through annual assessments levied on businesses conducting certain types of activities. It generates additional revenues by charging for its regulatory examinations of certain existing licensees. The fees vary in amount depending on the type of filing and the nature of the service performed. For example, Corporations charges a $200 fee for processing an application to engage in the business of making consumer or commercial loans and an hourly rate of $75.93 for conducting examinations. Finally, Corporations collects fines and penalties assessed for violations of various state laws. However, for several years budget language required most fines and penalty revenues to be transferred to the General Fund and thus, they were not used to fund Corporations’ operations. 1 Businesses submit specific documents with Corporations to apply for permits and licenses, renew licenses, register franchises, and notify it of the sale of securities. We will refer to these filings as applications throughout this report. 2 Depending on the type of filing, Corporations issues registration certificates, permits, or licenses and approves notices. However, for the purpose of this report, these documents will generically be referred to as licenses. 20 California State Auditor Report 2005-123 Current law limits Corporations’ Ability to Change its fees Fees for the licenses processed by Corporations are generally set by statute. Although Corporations has limited authority to set fees below the statutory maximum for businesses dealing with certain securities transactions, offering investment advice, and acting as broker-dealers, the only way it can increase fees above the statutory cap is to seek a change in the law. According to the financial management chief, Corporations conducts the statutorily required annual review of certain fees, but during the past five fiscal years, it has not needed any fee increase because of the significant fund reserve it has accumulated. However, the financial management chief also pointed out that with changes in the reserve, Corporations would have to review and adjust fees on a regular cycle that has not yet been determined. Without a periodic review to ensure that each fee supports its related activities, Corporations runs the risk of overcharging for some fees and undercharging for others. According to the financial management chief, Corporations has not prepared an analysis of all its fees since 2001. This analysis resulted in a reduction in filing fees in January 2002 that affected only businesses raising capital through the sale of securities. However, since this analysis, the cost of the services Corporations provides has changed. As a result, the revenues Corporations generates from some of its fees are not in balance with the cost of the related services. Corporations overcharges for Some Activities but undercharges for others Corporations’ current fee structure results in certain licensees subsidizing the administrative costs for others. For example, Revenues from securities revenues from securities fees have exceeded the related service fees have exceeded the costs for six of the last seven fiscal years. The amount of excess related service costs for revenues from these fees ranged from $750,000 to $9.1 million six of the last seven fiscal and totaled $22.2 million during this time. Although not as years, resulting in excess significant as the excess revenues earned from securities fees, revenues of $22.2 million over the last seven fiscal years, Corporations has also earned during this time. excess revenues from three of the other business activities it regulates. The excess revenues from these three business activities totaled $2.8 million, with most of the excess collected in fiscal years 2004–05 and 2005–06. California State Auditor Report 2005-123 21 By contrast the service costs for the nine remaining business activities Corporations regulates have exceeded the revenues generated from their respective fees by $21 million over the last seven fiscal years. For example, service costs related to processing applications for businesses providing investment advice have exceeded the revenues generated from the fees charged for these services by $8.2 million during this time. These amounts do not include immaterial transactions or revenues from related fines and penalties because of their erratic nature and because for several years Corporations was required to transfer some of these funds to the General Fund and were therefore not available to support Corporations’ operations. Table 2 shows the net gain (loss) for each business activity for the last seven fiscal years. TABle 2 net gain (loss) for the State Corporations fund Activities by fiscal year (in Thousands of dollars) Business Activity 1–2000 2000–01 2001–02 2002–03 2003–0 200–05 2005–0 Totals Corporate securities $(419) $9,063 $1,538 $ 750 $2,315 $ 4,098 $ 4,865 $ 22,210 Broker-dealers 487 471 (185) (765) 100 (2,079) (795) (2,766) Investment advisers (599) (876) (740) (1,004) (1,616) (1,321) (2,092) (8,248) Agent monitoring (190) (276) (253) (250) (287) 1,355 1,465 1,564 California Commodities Law (200) 101 (58) (59) (36) (96) (228) (576) Franchise Investment Program 182 100 (153) (187) (1,166) (1,738) (1,583) (4,545) Capital Access Law 0 0 0 (6) (10) (3) (1) (20) Check sellers, bill payers, and proraters 0 0 0 0 0 (29) (220) (249) Consumer credit counselors 0 0 0 (46) (92) (16) (28) (182) Deferred Deposit Transaction Law 0 0 0 0 1,058 (1,677) (191) (810) Escrow Law (14) (582) (461) 277 (178) 551 996 589 California finance lenders 562 (95) (542) (546) (744) (976) (1,263) (3,604) Mortgage bankers (121) (176) (356) (443) 517 270 970 661 Source: Department of Corporations’ unaudited financial reports. Note: Net gain (loss) excludes revenues from fines and penalties and immaterial transactions. 22 California State Auditor Report 2005-123 Similarly, Corporations is undercharging for the audits and examinations it conducts because it has not recently updated its billing rates. Specifically, according to the financial management chief, the hourly rate it charges for most audits and examinations was implemented in 2001 and has not been modified since. However, employee costs have increased significantly since that time. For example, the State’s cash contributions for benefits for state employees has increased from 16 percent of employees’ gross pay in fiscal year 2000–01 to 34.1 percent in fiscal year 2005–06. Similarly, state employees’ salary levels increased approximately 9.2 percent between fiscal years 2000–01 and 2003–04. As shown in Table 3 on the following page, Corporations would have generated more than $1 million in additional revenues from examinations completed by its Financial Services Division (financial division) during the period from January 1, 2004, through May 23, 2006, had it revised its billing rates to cover costs. Our calculation includes only the hours charged by financial services examiners and does not adjust for likely increases in overhead costs. The deputy commissioner of the financial division noted that assessments for each law area are calculated based on the amount of funds needed to cover expenses for the program. She further stated that an increase in examination revenues might result in a decrease in the annual amounts assessed to certain licensees. On the other hand, if the expenditures for a particular business activity exceed the revenues for that activity in a given year, even with the increase in examination fees, a decrease in the assessment might not be warranted. Therefore, Corporations would have to continually monitor the fiscal activity for each law type to determine what, if any, adjustments would be necessary. The State Corporations fund Reserve Will likely exceed the legal limit The overcharging of certain licensees has not only covered the undercharges for other services but also has contributed to the buildup of a large reserve in the State Corporations Fund. We anticipate that this reserve will exceed statutory limits at the end of the current fiscal year. California State Auditor Report 2005-123 23 TABle 3 Revenues earned from financial Services’ examinations using Corporations’ Billing Rates Versus Auditor-Calculated Rates Revenue using Auditor- Revenue hours Billed Corporations’ Corporations’ Calculated using Auditor- Period for examiners hourly Rate Rate hourly Rate* Calculated Rate difference January 1, 2004 to June 30, 2004 6,788.00 $75.93 $ 515,413 $97.84 $ 664,138 $ 148,725 July 1, 2004 to June 30, 2005 23,874.25 75.93 1,812,772 97.84 2,335,857 523,085 July 1, 2005 to May 23, 2006 15,150.25 75.93 1,150,358 97.84 1,482,300 331,942 Totals 5,12.50 $3,,53 $,2,25 $1,003,52 Sources: The Department of Corporations’ examination data were used for the hours billed and hourly rate. The State Administrative Manual was used for the costs of benefits and the Department of Personnel Administration data were used for salary increases. * Does not include any changes in overhead costs. Governmental agencies may be allowed to maintain a reserve to ensure that a sufficient cash flow exists should unforeseen circumstances arise. In fact, current California law requires Corporations to have a “prudent” reserve, which, effective June 30, 2007, limits the reserve to 25 percent of its annual expenditures. Assuming that Corporations’ budgeted expenditures for fiscal year 2007–08 are approximately the same as its current budgeted expenditures, this law will limit the reserve to roughly $8 million. As of June 30, 2006, Corporations reported its reserve to be $13.1 million, or $5.1 million more than the projected limit. (Although we have reviewed some of its financial information, we have not audited Corporations’ financial reports and are providing the reserve balance as Corporations reported it.) The $13.1 million takes into account fines and penalties Corporations collected for fiscal years 1999–2000 through 2005–06. It also takes into account the transfers of some fines and penalties to the General Fund for fiscal years 2002–03, 2003–04, and 2004–05, having the effect of reducing the reserve. However, it does not take into account an $18.5 million receivable for a loan to the General Fund. To the extent that the State intends to repay the loan, Corporations should also consider the loan to be a resource that, in effect, increases the reserve. The State has already signaled its intent to repay the loan at least partially. The loan was originally $20 million in fiscal year 2002–03, of which $1.5 million 2 California State Auditor Report 2005-123 has been repaid. Further, according to Corporations’ financial management chief, the State is scheduled to repay an additional $6 million of the loan in fiscal year 2006–07. Thus, at a time when the law requires Corporations to reduce its reserve, the loan repayment would increase the balance in the State Corporations Fund. To reduce the reserve by $5.1 million from its June 30, 2006, Corporations will have reported balance and by another $6 million for the loan to collect $11.1 million repayment, Corporations would have to collect $11.1 million less than it spends in less than it spends in fiscal year 2006–07. Given that fiscal year 2006–07 to Corporations has not changed its fees for fiscal year 2006–07 reduce its reserve to the and has reported excess revenues, which included fines and statutory limit. penalties, totaling $3.2 million for fiscal year 2005–06, we do not believe a reduction of this magnitude is likely to occur based on fees alone. When we questioned Corporations about this issue, the deputy commissioner of the Office of Management and Budget stated that Corporations would develop a plan to address the excess reserve. CoRPoRATionS hAS mAde A good START on iTS STRATegiC PlAnning BuT needS BeTTeR infoRmATion ABouT iTS ACTuAl PeRfoRmAnCe As we indicated in the Introduction, Corporations has taken important steps in strategic planning for its operations, establishing a framework to identify its strengths and weaknesses with the goal of eliminating inefficiencies and increasing productivity through an examination of its current policies and procedures. According to its acting chief deputy commissioner, these efforts are part of an initiative that all departments in the Business, Transportation and Housing Agency have participated in since early 2004. Corporations’ own efforts include creating three interrelated documents—a strategic plan; a program-level action plan, which is a direct product of the agencywide initiative; and periodic statistical performance reports—designed to establish its goals and measure its effectiveness in meeting those goals. However, the performance reports indicate that Corporations has fallen short of most of its goals. In addition, the effectiveness of its strategic planning effort is undercut by inaccurate statistical information about its actual performance as well as by the cumbersome methods used to compile that information for the performance reports. California State Auditor Report 2005-123 25 Corporations’ Performance Reports indicate That it often does not meet its goals, but it has identified Some Reasons for These Results Although we have concerns about the reliability of the information in its performance reports, Corporations itself has reported overall performance that is far below its expectations. For the quarter ending September 30, 2006, for example, it did not meet its benchmark goals for eight of 10 critical measures. (The text box lists the 10 critical measures.) Although it Corporations’ 10 Critical measures reported some improvement in five of these critical 1. Percentage of the financial division’s applications measures when compared to the same period in initially reviewed prior to the applicable deadline. 2005, it was still far short of its stated benchmark 2. Percentage of Broker Dealer/Investment Adviser goals for three of these five measures. In addition, (BDIA) applications processed prior to the its reported performance for the remaining five applicable deadline. critical measures deteriorated over the same 3. Percentage of the Securities Regulation period, three of them significantly. For example, Division’s (excluding BDIA) applications processed prior to deadline. according to the quarterly reports, the percentage 4. Percentage of all complaints reviewed for of applications that the financial division initially completeness within 15 days of receipt. reviewed within its deadline declined significantly, 5. Number of enforcement actions by the from nearly 75 percent reported in the third Enforcement and Education Division. quarter of 2005 to less than 46 percent in the 6. Number of examinations completed by the same quarter of 2006. The benchmark goal for this financial division. measure is 100 percent. Corporations noted that 7. Number of BDIA examinations completed. the third-quarter 2006 figure for this performance 8. Number of Education and Outreach events. measure showed improvement over the quarter 9. Number of outreach unit packets distributed. ending June 30, 2006, for the processing of finance 10. Percentage of calls answered by the call center lender applications, which it indicated are typically within 30 seconds. the majority of the financial division’s applications. However, in the quarter ended March 31, 2006, Source: Department of Corporations’ monthly for the same measure, Corporations reported performance metrics reports (unaudited). that only 47 percent were completed on time, making it difficult to draw conclusions about performance trends. As we noted in the Introduction, Corporations has not yet fully implemented many of the action steps it established in its program-level action plan, and therefore it is not possible to reach any conclusions about the effectiveness of these steps. In addition, in response to questions we raised about its lack of improvement in certain areas, Corporations’ acting chief deputy commissioner identified certain causes of unsatisfactory performance. For example, he observed that progress for the financial division was dependent on rule changes that must be made in accordance with the rulemaking process, requiring additional time. The rulemaking process typically involves the 2 California State Auditor Report 2005-123 following activities: researching problems with existing law and practice; soliciting initial input from interested stakeholders; drafting the rulemaking documents including the text of rules, the statement of reasons, and the public notice; publishing the notice for public comment; providing a 45-day public comment period; providing an opportunity for public hearing; responding to public comments; revising the text of rules to address public comments; making the revised text available for public comment for 15 additional days (for every revised version); finalizing the responses to comments and the final text; submitting to the Office of Administrative Law for a 30-day review period; and filing with the secretary of state where the rule becomes effective 30 days later. Further, the acting chief deputy commissioner stated that the number of applications for the financial division continues to increase significantly, and the reported performance information does not take this increase into account. The Securities Regulation Division (securities division), he noted, had both new staff and position vacancies that affected its performance. Similarly, for the Enforcement and Education Division (enforcement division), the acting chief deputy commissioner stated that the division generally met its goals but reported deficiencies from April to August 2006 in meeting deadlines to review all complaints for completeness within 15 days. In this instance, he explained that the cause was delays in processing of the complaints, which slowed referrals to the enforcement division. As we discuss in Chapter 2, Corporations recently modified its process of handling complaints, which it believes will address this and other weaknesses. The acting chief deputy commissioner also explained that a significant reported decline in the productivity of the outreach unit since 2004 was due to faulty and inaccurate baseline data, which he stated is currently being corrected. Corporations’ Actual Performance information is unreliable in Some instances, and the Process for Compiling the information is Time Consuming For its strategic planning to be effective and focused on the appropriate problem areas, Corporations must have reliable Corporations’ system information about its actual performance in each area. However, for compiling actual its system for compiling actual performance information is performance information not always accurate, formalized, or consistent. Our testing is not always accurate, of the performance reports themselves indicates that some formalized, or consistent. information is not accurate. Thus, Corporations’ identification of areas requiring improvement may be faulty, undercutting the effectiveness of its efforts. California State Auditor Report 2005-123 2 To determine the reliability of the actual performance information contained in the September 2006 quarterly report, we reviewed selected data for each of the 10 critical performance measures. We found errors in the manual compilation of three of the 10 measures. For instance, Corporations reported that the percentage of other securities regulation applications actually processed on time was 96.5 percent, but we calculated it to be 89.5 percent. Although this relatively small difference might not change Corporations’ assessment of the need for change in the area, it does illustrate the need for more accurate reporting. Similarly, our determination of the percentage of calls answered in the call center within 30 seconds (55.6 percent) differed from Corporations’ calculation (60.4 percent). In addition to the erroneous baseline information discovered for the outreach unit discussed earlier, certain other data used for the reports appear suspect. For example, the securities division overstated a part of a performance measure related to corporate finance data by 11 percent in the September 2006 performance report. Corporations manually generates a form for each securities application reviewed. However, when we reviewed the forms for September 2006 we found that some were internally inconsistent and that Corporations had reported incorrect information. For 18 of the 179 manual forms we reviewed, Corporations reported certain actions as being taken on time even though according to the form they were not. Consequently, if the errors are corrected, it would reduce Corporations’ reported success rate. The securities division’s lead attorney agreed with our observation, stating that the problem had been identified previously and that steps had been taken to ensure that responses would be reported accurately in the future. Currently, the information Corporations’ systems for collecting its actual performance used to produce the information are also cause for some concern, because of performance reports inefficiencies and the potential for errors. Depending on comes from a variety of the performance measure, Corporations uses both manual sources, such as forms, and automated systems to collect the information, and it data system queries, then manually compiles that information for summary in a spreadsheets maintained performance report. An automated system, with all necessary by team leaders, and information accurately reported, would be more efficient other documents that and reliable. Currently, the information used to produce the may or may not be reports comes from a variety of sources, such as forms, data reviewed for accuracy. system queries, spreadsheets maintained by team leaders, and other documents that may or may not be reviewed for 2 California State Auditor Report 2005-123 accuracy. We found one instance in which staff used informal notes, rather than standard time sheets, to report the time worked on applications. Each month, certain Corporations’ staff must generate statistics by performing time-consuming manual calculations and then must input the results into a separate form for the report. According to its officials, this process is necessary because certain functions lack an adequate automatic data reporting system that can generate a report to assess Corporations’ performance in meeting its strategic objectives. For example, Corporations cannot generate monthly performance information for the processing of its securities regulation applications using its data system alone. Instead, each month staff must derive this information by manually sorting through a month’s worth of summary sheets for 12 different types of applications and then manually aggregate the information from each summary sheet in the detail and format called for in the performance report. Staff also manually determine the median, minimum, and maximum number of days they took to approve or deny securities regulation applications. Corporations uses a similar process to compute some of its other performance measures. Automating the system would improve efficiency, but the data entered into the automated system must also be complete and accurate. However, as we discussed earlier, we have concerns about the reliability of some of the data in Corporations’ automated system. For example, one of the performance measures the financial division reported for September 2006 was the percentage of complaints it reviewed for completeness within 15 days of receipt. Because the financial division reopens some cases using a different case number, it counts those complaints more than once, and it also does not fully account for the total length of time taken to review the complaints. This practice causes Corporations to overstate the number of complaints reviewed and to understate the review time. When performance reports contain errors, their usefulness as a management tool for decision makers is diminished. In fact, if the errors are significant, they may direct Corporations’ attention away from important issues needing improvement or toward lesser issues at the expense of areas of greater concern. In addition, because of the inefficiencies in the current reporting system, the amount of time spent compiling data for its monthly reports detracts from Corporations’ efforts to complete the tasks it is measuring. California State Auditor Report 2005-123 2 The effeCTiVeneSS of CoRPoRATionS’ ouTReACh uniT iS unCeRTAin Corporations does not collect enough data or identify sufficient goals to effectively assess its education and outreach efforts. The outreach unit provides programs and resources designed to protect California consumers from becoming victims of investment and financial fraud. One of Performance measures for the the outreach unit’s primary programs is its seniors Seniors Program program, which is designed to educate senior citizens about investment fraud and how to protect 1. Number of partnering agencies and senior their finances from predatory schemes. groups participating in the program. 2. Number of executed contracts in place with each retired seniors volunteer program or In its budget change proposal for fiscal year similar organization. 2005–06, Corporations requested $400,000 in 3. Number of enlisted seniors program volunteers ongoing permanent funding for the seniors by geographical area. program (and received $225,000). The proposal 4. Number of publications disseminated. identified 12 performance measures intended to 5. Number of training kits given to volunteers. aid Corporations in evaluating the achievement 6. Number of presentations given. of the objectives of the seniors program. (See the text box for a list of these measures.) However, 7. Number of seniors attending meetings; conferences; and who request information Corporations does not collect data for four of through telephone, electronic mail, or postal these measures. Specifically, when it sought mail. funding for the program in fiscal year 2005–06, 8. Number of advertisements, training bulletins Corporations stated that it planned to track disseminated, and media reports. the number of seniors program volunteers by 9. Statistical data compiled from other agencies and seniors program volunteers. geographical area (measure 3); it had not done so as of December 2006. The director of the outreach 10. Statistical and other data compiled by the seniors program. unit stated that outside vendors provide many 11. Statistical data collected from incoming of the program’s services and maintain the potential victim profiles. data. Recognizing the importance of having the 12. Number of legal cases filed and the outcomes. data, the director stated that Corporations will track information on this metric in the future by having its vendors report the data to it by Source: Department of Corporations’ budget change proposal for fiscal year 2005–06. fiscal year 2007–08. Finally, Corporations does not track any data for three other performance measures (measures 9 through 11) because, according to the director, the measures are not clear. Although Corporations developed the measures, the director stated that it has not made any formal attempts to clarify them. Further, although Corporations collects data for eight of the 12 performance measures, it measures its effectiveness for only two—the number of publications disseminated and the number of presentations given—by comparing them to established goals. The director of the outreach unit stated that 30 California State Auditor Report 2005-123 the primary reason for not measuring its performance on all of the measures was that Corporations has not developed goals for most of the measures. Corporations indicated in its budget change proposal that funding for the program serves to protect a vulnerable segment of the public from unscrupulous investment transactions that can leave victims in financial ruin. However, without sufficient data and relevant benchmarks, it is impossible for Corporations to effectively assess its overall performance in protecting senior citizens from investment fraud. Moreover, Corporations has not developed any formal goals to effectively measure the success of its other primary program— the troops program. The troops program was funded by an 18-month grant from the Investor Protection Trust (IPT)—a nonprofit organization that provides investor education—from January 2, 2005, to June 30, 2006, Performance measures Required in the amount of $150,000. Corporations is in the under the Troops Program process of requesting additional grant funds to extend the program through December 31, 2008. 1. The number of education packets distributed. The initial grant was intended to educate military 2. The number of attendees at on-base personnel stationed on every one of California’s presentations. military installations about how to identify and 3. The number of inquiries and complaints received by Corporations’ call center. avoid inappropriate, harmful, and fraudulent investment and financial products. The grant 4. The number of complaints resolved. requirements specified that Corporations must 5. The number of inquiries resolved. collect data and report the results to the IPT on 6. The number of complaints forwarded to seven performance metrics. (See the text box Corporations’ enforcement division. for a list of these metrics.) However, although 7. The number of calls referred to other appropriate agencies for further actions. Corporations collected the required information, according to the director of the outreach unit, Source: Department of Corporations’ Revised Draft it has not established any formal benchmarks Strategic Plan, May 2006. to measure the data against to gauge whether or not its efforts were successful. For example, in its November 30, 2006, progress report, Corporations reported that the number of educational packets distributed as of October 31, 2006, was 3,410 and that the number of attendees at on-base presentations was 2,025. However, collecting data without having formal benchmarks to compare these numbers to does not allow Corporations to assess whether the program is achieving the desired results. The director of the outreach unit stated that Corporations faced significant barriers as it attempted to implement the troops program. For example, the director stated that despite California State Auditor Report 2005-123 31 initial efforts to develop partnerships between Corporations and various military entities, gaining traction took longer than originally anticipated. However, the director stated that, going into 2007, certain partnerships (such as with the Navy and the Marines) are gathering momentum. Specifically, the director stated that Corporations has already scheduled on-base presentations at six different military installations in the first quarter of 2007. He indicated that the commissioner of Corporations now serves as co-chair of the Governor’s State Military Financial Protection Task Force, which was established in August 2006 by executive order to, among other things, develop proposals for legislation that address the unique issues facing men and women in the military based in California. The commissioner’s appointment to the task force, he stated, has helped the troops program gain exposure to military decision makers in California. According to the IPT, the troops program was intended to serve as a model for other states on how to leverage the dollars and the impact of the Investor Education Fund. 3 Nevertheless, unless Corporations develops clear expectations of the desired results of the troops program, we question whether it can effectively assess whether its efforts are successful. ReCommendATionS To strengthen its operational oversight, Corporations should seek legislative authority allowing it to set fees by regulation. This legislative authority should require that Corporations annually assess its fee rates and establish fees that are reasonably related to its cost of providing the services supported by its fees. Corporations should also factor in the amount of any excess reserves when conducting its annual assessment. To improve the efficiency and effectiveness of its system for collecting actual performance measure information, Corporations should do the following: • Consider assessing the need for new automated data systems or determining whether its current systems are capable of collecting the necessary information. 3 The Investor Education Fund is overseen by the Investor Protection Trust and includes a portion of the penalties, profits, and payments required under a settlement of enforcement actions involving conflicts of interest between the research and investment banking operations of the nation’s top 10 investment firms. According to the Investor Protection Trust, $27.5 million is to be paid to state securities regulators for investor education purposes. 32 California State Auditor Report 2005-123 • Ensure the accuracy and completeness of the information in its automated systems by requiring staff to enter the information and requiring supervisors to review it periodically. For data not currently available in automated format, Corporations should develop stronger procedures to ensure that staff accurately report and supervisors review the information. To make better use of staff time, Corporations should consider calculating and reporting performance measures quarterly, rather than monthly, until it has a more efficient data collection system. To ensure that it has identified all necessary performance measures and appropriately focused its current performance measures, Corporations should continue to assess the reasons for performance deficiencies and add or adjust performance measures as needed. For example, inefficiencies in the call center apparently caused the enforcement division to appear slow in responding to complaints. Adding a performance measure of the call center’s timeliness in reporting complaints to the enforcement division would immediately pinpoint the cause for delays. To ensure that the outreach unit can effectively measure its success, Corporations should ensure that it collects all of the necessary data and establishes reasonable benchmarks. n California State Auditor Report 2005-123 33 Blank page inserted for reproduction purposes only. 3 California State Auditor Report 2005-123 ChApTeR 2 Weaknesses in Its Processing of License Applications and Complaints Reduce the Department of Corporations’ Effectiveness ChAPTeR SummARy The Department of Corporations (Corporations) did not promptly process some of the applications we reviewed, exceeding the time limit set by state law in 10 instances for 35 applications in our sample. However, while Corporations is responsible for the delays in processing some license applications, other factors outside of its control also contribute to lengthy processing times. For instance, applicants frequently submit incomplete applications that require Corporations to issue deficiency notices. In fact, we found several instances in which Corporations had to send applicants multiple deficiency notices before it obtained the information needed to rule the applications complete. Furthermore, applicants do not always respond promptly to the deficiency notices. Delays in processing are detrimental to the applicants because they prevent them from conducting business. In addition, Corporations did not always resolve complaints related to securities regulation and financial services as quickly as it could have. Corporations’ Enforcement and Education Division (enforcement division) also did not always identify a reason for rejecting complaints, and for the cases for which it did identify a reason, it did not always fully document its rationale. Furthermore, the information systems used by Corporations to track complaints are unreliable because they contain a large number of blank fields, duplicate entries, and inaccuracies. Consequently, it is difficult, if not impossible, for management to use these systems as a tool for assessing some of its activities. Contrary to law, Corporations has not conducted 37 percent of its required examinations of escrow office licensees within the last four years. In addition, it has yet to conduct examinations for 35 percent of eligible finance lender licensees within its four-year goal. According to Corporations’ program-level action plan, its examinations have the potential for detecting violations California State Auditor Report 2005-123 35 of the law and unsafe, unsound, or abusive practices and serve to deter potential wrongdoing. Thus, having a significant examination backlog could leave consumers less well protected. SeVeRAl fACToRS hAVe ConTRiBuTed To delAyS in PRoCeSSing APPliCATionS Corporations does not always process applications within the time limits set by state law. Of the 35 applications we reviewed, Corporations did not we noted 10 instances where Corporations did not comply with comply with statutory the statutory time frame for processing applications. However, time frames for we also found that incomplete documentation submitted by processing applications applicants increased the time it took to process some of these in 10 instances. applications. In addition, the application system data related to corporate securities and franchises contain omissions and inaccuracies, hampering Corporations’ ability to compile accurate performance statistics. licenses Are not issued Promptly Because of delays in Processing Applications State law requires Corporations to assess the completeness of applications and notify applicants in writing of any deficiencies in the applications within specific time frames, depending on the type of application. Once an application is considered complete, Corporations is required to either issue a license or reject the application, also within a specified time period. For example, for escrow office applications for main branches, the law gives Corporations 45 days to find an application complete or issue a deficiency notice. Once this type of application is considered complete, Corporations must issue or deny the license within 30 days. Any delays in the process hinder Corporations’ ability to ensure that the applications are processed within the mandated time. More importantly, delays potentially create a hardship for the applicant because they prevent the applicant from commencing business activities. Applications are not always processed expeditiously, resulting in delays in the approval of applications and in the issuance of licenses, registration certificates, permits, and notices.4 As shown in Table 4, it took longer than the law intended to process many of the applications types we reviewed. For example, it took an average of 206 days to process 177 California Residential 4 Depending on the type of application, Corporations issues registration certificates, permits, or licenses and approves notices. However, for the purpose of this report, these documents will generically be referred to as licenses. 3 California State Auditor Report 2005-123 Mortgage Lender Act (mortgage lender) license applications received during the period January 1, 2004, to May 23, 2006, 86 days longer than the maximum time intended by the law. TABle  Processing Times of licenses issued from January 1, 200, to may 23, 200 number of Actual Processing Times* (in days) number of days Allowed Application Type filings by law low high Average Residential mortgage lenders Main 177 120 53 558 206 deferred deposit lenders† Long form 161 105 18 254 85 Short form 578 35 4 201 44 escrow offices‡ Main 30 75 20 368 125 Branch 30 75 49 417 134 finance lenders Long form 2,359 105 6 1,060 143 Short form 1,883 35 6 948 92 State investment Advisers 996 60 4 482 85 Broker-dealers 647 70 1 373 54 Securities § Coordination 401 50 1 519 57 Permit 722 60 1 610 32 Transfer of securities 235 40 2 163 10 franchises‡ ll Renewal 17 40 3 92 23 Registration 13 70 2 145 52 Source: Department of Corporations’ application data. * The number of days was calculated based on the date an application was received to the date a license was issued. † These applications were submitted from January 1, 2005, through May 23, 2006. ‡ For these applications, we used a sample to determine the processing times because the data in the information systems were incomplete or unreliable for this purpose. § We determined the processing times only for the applications that had a final action date entered in the system. ll These applications were submitted from January 1, 2004, through May 25, 2006. Before deciding whether an applicant will be granted a license, the Securities Regulation Division (securities division) or the Financial Services Division (financial division) review California State Auditor Report 2005-123 3 the application to ensure that all required information and documentation has been provided. Although required to do so by law, Corporations has elected not to notify the applicant once an application is considered complete. Rather, it continues processing the application in order to decide whether or not to approve the issuance of a license. An application may be rejected for a variety of reasons, including negative information obtained during background checks of key individuals listed on the application or fiscal concerns about the applicant. When it finds that an application is incomplete, Corporations, in accordance with state law, sends a deficiency notice to the applicant identifying the additional information or documentation that it needs before it can continue processing the application. Because the average time to process many applications exceeded the intended limit, we reviewed a sample of 35 applications. If we identified delays in processing any of these applications, we investigated further to determine the cause of the delays. Our testing indicated that Corporations did not conclude on the completeness or deficiency of an application within the required time frame for eight of the 35 applications. The number of days by which the processing of these applications exceeded the statutory requirements ranged from two to 97. In one instance, Corporations did not even begin reviewing the application for deficiencies or completeness until more than two and one half months after it was received. In another instance, it took more than three and one half months to begin its review. According to the deputy commissioner of the financial division, these delays generally occurred because of a backlog resulting from a large increase in the number of applications submitted in recent years and the complexities involved in some applications, requiring a more extensive review. California law generally requires entities or individuals conducting business governed by Corporations to be licensed Delays in processing or qualified before commencing business. Because businesses applications may increase cannot legally operate or consummate transactions before the likelihood that receiving Corporations’ approval, it is imperative that such businesses will conduct applications be approved or denied promptly. Delays could unlicensed financial result in entities being unable to conduct business. They transactions. may also increase the likelihood that businesses will conduct unlicensed financial transactions. As we discussed previously, after it has determined that an application is complete, Corporations must issue or deny the license within a time frame specified by law. However, we 3 California State Auditor Report 2005-123 identified instances in which Corporations did not issue licenses for complete applications within the required time frame. Specifically, it did not issue a license within the required time frame for two of the 35 applications we reviewed that were considered complete. In one instance, Corporations issued a license 114 days after it considered the application to be complete. This exceeded the statutory time frame by 54 days. Applicants frequently Submit incomplete Applications License applicants do not always provide the required information when submitting applications. Corporations considers such applications to be deficient until the necessary information is provided. This problem, which we determined to be fairly common, results in delays in processing license applications and issuing licenses and ultimately prevents the applicant from legally conducting business activities. Based on the applications we reviewed, some common reasons that applications are determined to be deficient are the submission of invalid financial statements, a failure to have certain documents notarized, or a failure to submit all of the required documents. Although application requirements can be somewhat daunting, these reasons do not appear to indicate that the requirements are overly complex. Corporations sends additional notices of deficiency to applicants that continue to submit insufficient information or documentation required to complete the applications. When an applicant submits an incomplete application, Corporations issues a deficiency notice identifying the Corporations issued additional documentation or information that must be deficiency notices because submitted before it can finish processing the application. of incomplete applications Corporations issued deficiency notices for 32 (91 percent) of for 32 (91 percent) of the 35 applications we reviewed. For example, we reviewed the 35 applications we 10 finance lender applications and five applications each for reviewed. escrow office, investment adviser, and mortgage lender and found that Corporations had issued at least one deficiency notice for each application. Incomplete applications further delay the process because the law allows Corporations additional time to review the information that is requested in the deficiency notice. Specifically, according to our legal counsel, if the law allows Corporations 45 days to find an application complete or issue a deficiency notice and within that period Corporations requests additional information using such a notice, it is allowed California State Auditor Report 2005-123 3 another 45 days to review the additional information once it is received. Therefore, in our example, it is permissible by law for Corporations to take 90 days or more to find the application complete. Moreover, Corporations is granted an extra 45 days for each additional deficiency notice that it issues to an applicant, a situation we found in 16 of the 32 applications for which Corporations issued deficiency notices. Finally, applicants do not always promptly correct identified deficiencies. Specifically, for 17 of the 32 applications that Corporations found deficient, the applicant took more than 20 days after the deficiency notice was sent out to submit the requested documentation. Deficiencies in applications and delays in correcting them create additional work for Corporations staff and can substantially delay the issuance of licenses. Corporations does not have Complete data for Some of its license Applications Corporations uses the Financial Services Division Application System to maintain data related to pending escrow office applications. However, once per month data related to all escrow office applications that were approved, denied, or that are no longer pending for more than one year are deleted from the system. Consequently, we were not able to use the system to determine the number of escrow office licenses processed during our audit period or to calculate the number of days it took to process them. More importantly, without complete information being maintained in the system, Corporations staff cannot perform these calculations beyond the last 12 months using their system either. After we brought this matter to Corporations’ attention, the deputy commissioner of the financial division stated that Corporations implemented a new automated procedure that would maintain data for escrow office applications indefinitely. Corporations maintains another system, Cal-EASI, to capture application information related to corporate securities and franchises. However, when we analyzed the data in the system as of May 23, 2006, we found that for about 7 percent of the records for corporate securities and franchises, the field showing the application approval date was blank. Without knowing when these applications were approved, Corporations cannot use the system to calculate processing times. In addition, we found that the system does not accurately capture the type of franchise application recorded. Franchise applications are typically of two types—either a registration, which 0 California State Auditor Report 2005-123 is the application used the first time an individual applies, or a franchise renewal, which is used to renew franchisees’ registrations. However, in three of the 30 franchise application records we reviewed, the data recorded in the system incorrectly identified franchise renewal applications as franchise registrations, and in one instance a franchise registration was identified as a renewal. This amounts to a 13 percent error rate, hampering Corporations’ ability to use the system to accurately determine the number of franchise registrations or renewals it processes. CoRPoRATionS iS WoRking To imPRoVe iTS hAndling of ComPlAinTS Responding to complaints promptly is critical to protecting investors from fraud. Corporations did not always resolve complaints related to securities regulation and financial services as quickly as it could have. Further, the information systems Corporations uses for complaint tracking are unreliable because they contain too many blank fields, duplicates, and inaccuracies. Finally, the enforcement division did not have a process for documenting its reasons for rejecting complaints or referring them to other entities when it believed it had no jurisdiction. However, Corporations has recently developed formal policies for handling these matters and, in addition, has revised its complaint-handling procedures to centralize the intake of complaints. Although we were unable to determine whether the new process will correct the weaknesses we found, it appears to contain good business practices for handling complaints. unnecessary delays Sometimes occur in Corporations’ Process for Resolving Complaints The method Corporations uses to resolve complaints differs depending on the number of victims involved, the severity of the violations, whether criminal activity has occurred, and the actions Corporations must take. For example, if Corporations finds improper activity relating to securities regulation, it can use a combination of administrative authority and civil actions to resolve complaints. It may also work in cooperation with law enforcement to bring action against a violator if it suspects criminal activity. Responding quickly to consumer complaints is essential because doing so may reduce further loss of money and can improve the probability of restitution. California State Auditor Report 2005-123 1 Either the securities division or the enforcement division typically handles complaints related to securities regulation. Of the 20 complaints related to securities regulation we reviewed that were closed between May 20, 2005, and July 18, 2006, nine were referred to the securities division. It took the securities division an average of 312 days, ranging from 55 to 531 days, to resolve these nine complaints. The remaining 11 complaints related to securities regulation were referred to the enforcement division and took an average of 170 days to resolve, ranging from 20 days to 383 days. The time Corporations takes to resolve complaints is contingent The securities division did on many factors. For instance, the complexity of the case, the not begin its investigation availability of staff, and the time it takes for complainants to of one complaint until respond to Corporations’ inquiries all may contribute to the 277 days after the length of the process. Moreover, there is no legal requirement complaint was received. dictating the length of time Corporations has to resolve In another instance, the complaints. Thus, we expected the number of days Corporations enforcement division took to resolve securities regulation complaints to vary took 176 days to refer depending upon the circumstances of each case. Nonetheless, a complaint to the during our review, we identified four complaints in which securities division for unnecessary delays increased the length of the process. For further action, during example, the securities division did not begin its investigation of which time nothing was one complaint until 277 days after the complaint was received. done to address the In another instance, the enforcement division took 176 days complainant’s concerns. to refer a complaint to the securities division for further action, during which time nothing was done to address the complainant’s concerns. Corporations’ management could not explain these delays. Moreover, we reviewed a sample of 20 complaints related to financial services that were closed between November 29, 2004, and August 8, 2006. We found that Corporations took between 35 and 232 days to close these complaints, averaging 106 days. Unlike its process for handling complaints related to securities regulation, Corporations handles financial services complaints by sending letters to licensees requesting them to respond in writing to the complaint allegations within 15 days. Delays can occur if the licensee does not respond within the 15-day time frame. However, we found some instances in which unnecessary delays on Corporations’ part increased the length of the process. For example, in four of the 20 complaints we reviewed, Corporations took between 34 and 210 days to send letters to the complainants notifying them that it had begun its review, exceeding its 30-day goal. In two of the four cases, Corporations’ staff did not forward the complaints to its 2 California State Auditor Report 2005-123 financial division for handling for 28 and 38 days, respectively. However, Corporations’ staff forwarded the two remaining cases in less than six days. Corporations also sometimes takes longer than necessary to close financial services complaints once the licensees respond to the financial division. Of the 20 complaints we reviewed, nine took between 32 and 94 days to be resolved by the financial division—longer than its 30-day goal. According to the deputy commissioner of the financial division, these complaints might have been resolved upon receipt of the licensees’ responses but not formally closed in the system. The deputy commissioner stated that the financial division did not review the responses promptly because it reviews complaints on a first-in first-out basis. Thus, although a licensee may have provided a full response to the financial division, the information would not be reviewed until the financial division’s staff had finished reviewing the responses to other complaints that were submitted previously. Finally, Corporations does not adequately document its basis for resolving complaints received by the financial division. We expected to find evidence of the examiners’ analyses of the circumstances surrounding the complaint and a determination that the information provided by the licensee adequately addressed the issues. However, the documentation prepared by the examiners was limited to a brief statement on a complaint form, indicating whether the licensees’ response was sufficient. In addition, the financial division does not send complainants closing correspondence notifying them of the resulting actions. Without documentation in the file detailing any actions taken, it is difficult to determine whether the licensee’s actions, if any, addressed the issue to the satisfaction of all parties. infoRmATion SySTemS ConTAining dATA RegARding ComPlAinTS ARe unReliABle Although it has three information systems for tracking complaint data, Corporations undercuts these efforts by failing to ensure that any of the three systems contain reliable data. Thus, it cannot use these information systems to accurately determine the number, type, and status of complaints it handles and, as a result, cannot use these systems as effective management tools. Table 5 on the following page shows Corporations’ complaint data systems and the types of problems we encountered with each. California State Auditor Report 2005-123 3 TABle 5 Problems Associated With the department of Corporations’ Complaint data Systems duplicate Blank data Complaint missing data System fields errors Records Cases Corporations’ Customer Service • • • System (CCSS) Customer Relationship • • • Management (CRM) system Enforcement Case Not Tested • Not Tested • Management System (ECMS) Percentage of Cases in Which the field Was left Blank name date date date of Staff eCmS System Received Assigned opened law Type Assigned number CCSS 0 30% 9% 24% 23% * CRM 9.5% 25 68 50 75 98% Sources: CCSS for complaints received from August 2, 2004, through April 17, 2006; CRM system for complaints received from January 16, 2005, through July 21, 2006; ECMS as of October 25, 2006. * CCSS does not contain a data field to capture the ECMS number. Several of the critical data fields in Corporations’ Customer Relationship Management (CRM) system and Corporations’ Customer Service System (CCSS) were often left blank, limiting the usefulness of these systems as management tools. For example, the fields needed to calculate complaint processing times, such as date received, date assigned, and date opened, were blank 9.5 percent, 25 percent, and 68 percent of the time, respectively, for the CRM system. Consequently, these fields cannot be used to determine where a complaint is in the resolution process or to monitor and evaluate complaint- processing times. In addition, we found that the field identifying the specific law a complaint was related to was left blank for more than 24 percent of the 2,876 complaint records in the  California State Auditor Report 2005-123 CCSS and for 50 percent of the 2,461 complaint records in the CRM system.5 Without this information, Corporations cannot determine how many complaints it receives about alleged violations of various laws and cannot effectively identify problem areas or adjust its workforce to handle them. Further, as shown in Table 5, the fields identifying the name of the staff person assigned to a particular complaint case and the date it was assigned were often left blank in both the CCSS and CRM system. As a result, the systems cannot be used to monitor and evaluate staff progress or to ensure that the workload is distributed in a manner that facilitates efficient and prompt processing. Finally, one of the fields in the CRM system that Corporations could use to identify cases investigated by the enforcement division—the Enforcement Case Management System (ECMS) number—was rarely used; specifically, this field was left blank in almost 98 percent of the records. Consequently, the complaint cases that are being investigated by the enforcement division are not traceable using the CRM system. Moreover, we found several types of data entry errors in Corporations’ complaint systems. For example, the CRM system did not reflect the correct status for many of the complaints we reviewed. The status field can be used to indicate the disposition of a particular case, such as closed, in progress, or referred. However, the CRM system listed an incorrect status for 13 of the 20 complaints we reviewed. In each of these cases, the CRM Corporations cannot system indicated that the case was still in progress, even though rely on the Customer all of them had been closed. Thus, Corporations cannot rely Relationship Management on the system to determine the number of complaints still in System to determine the progress, completed, or referred to another division. We also number of complaints still found that the CRM system did not reflect the correct date in progress, completed, received for eight of the 20 complaints we reviewed. Specifically, or referred to another the date entered into the CRM system as the date received did division. not agree with the supporting documentation for four of these complaints, and it was left blank for the others. Similarly, we found data entry errors for the field intended to capture the date a complaint was received in three of the 20 complaints we reviewed in the CCSS. In addition, six of the 34 enforcement actions we tested in the ECMS reflected an incorrect date for when the action occurred, limiting the usefulness of the system as a management tool. 5 The population of complaint records for the CCSS and CRM system is based on records identified in the systems as complaints from August 2, 2004, through April 17, 2006, and January 16, 2005, through July 21, 2006, respectively. California State Auditor Report 2005-123 5 In addition, the CCSS and CRM system contain an unknown number of duplicate complaint records, making it appear Two of Corporations’ that Corporations is responsible for more complaints than it information systems has actually received. Consequently, we could not determine contain an unknown the actual number of complaints Corporations has received. number of duplicate According to a Corporations staff services analyst, both the CCSS complaint records. Thus, and the CRM system contain duplicate complaint records, in we could not determine part because of the faulty transfer of data from Corporations’ the actual number of predecessor systems to its current systems. Duplicate records also complaints Corporations occurred because Corporations’ staff created multiple records has received. for the same complaint. For example, complainants sometimes sent multiple letters or made more than one telephone call— sometimes anonymously—for the same complaint. However, Corporations’ staff could not always ascertain that these letters or telephone calls related to the same complaint. Therefore, instead of entering the information into one complaint record, staff created multiple complaint records for the same complaint. Finally, we found that the ECMS did not have a record for 13 of the 34 (38 percent) enforcement actions, such as desist and refrain orders, denials of licenses, and revocations, that we tested. In addition, the enforcement division failed to enter into the ECMS nine of the 27 rejected complaints we tested. Once again, because the ECMS does not reflect all of the complaints the enforcement division is responsible for, the system cannot be used to determine the number of complaints it has received and processed. Further, without all of the enforcement actions entered in the system, ECMS cannot be used to determine the number of enforcement actions taken by Corporations. The enforcement division’s Process for Rejecting Complaints or Referring Them to other entities needs improvement It is the general policy of the enforcement division to investigate all appropriate complaints. However, due to budget constraints, some lower-priority complaints may occasionally be closed without action. For example, the enforcement division may reject complaints filed by out-of-state complainants without investigating the merits of the allegation. We agree that the enforcement division may not be able to fully investigate every complaint it receives and, therefore, it must make decisions on certain cases based on, among other things, its current workload and the risk associated with  California State Auditor Report 2005-123 each particular case. Further, not every complaint involves a violation of the law. Nevertheless, because its policy is to occasionally reject some “lower-priority” complaints, we would expect the enforcement division to at least perform an analysis that supports its conclusion that a complaint is a low priority and to document the result. For example, if the enforcement division determines that the primary reason for rejecting a case that it otherwise could have investigated is that the licensee in question has a limited number of investors, we would expect to see documentation identifying the number of investors, their total investment in the entity, an assessment of the Documenting the likelihood that they may lose all or part of their investment, rationale for rejecting and an analysis detailing why this case does not warrant an cases would help to investigation. Documenting the rationale for rejecting cases ensure that Corporations’ would help to ensure that Corporations’ process of handling process of handling complaints is consistent and fair. Furthermore, we believe that complaints is consistent it also would provide a basis to justify Corporations’ decisions and fair. should they be challenged in court or, more importantly, should the entity it chose not to investigate later be found guilty of malfeasance. We reviewed 27 complaints that were rejected by the enforcement division to determine whether it adequately documented its decisions. We found that it sufficiently documented its reason for rejecting only seven of the 27 cases and did not adequately document its basis for rejecting the remaining 20 cases. Specifically, it failed to give any reason for rejecting four of the 20 complaints and thus cannot demonstrate that it exercised due diligence with those cases. Although the enforcement division identified generic reasons for rejecting the remaining 16 complaints, it did not always fully describe how it made its decision. For example, the enforcement division rejected five of the 16 complaints because the complainant lived in another state. According to the deputy commissioner of the enforcement division, complaints may be rejected for this reason when the enforcement division’s caseload is full. However, none of the case files for these five rejected complaints included an assessment that connected the enforcement division’s caseload to the complainant’s state of residence. An assertion by Corporations that the complainant lives in another state does not lead to the conclusion that the enforcement division’s caseload was full at the time or, more importantly, that the case represented little or no risk of financial loss to the complainant and thus was a low priority. For one complaint, California State Auditor Report 2005-123  which was referred to Corporations by the Securities and Exchange Commission (SEC), the enforcement division noted that the complainant had invested $140,000 in the company in question. With the exception of an e-mail indicating that the complaint was originally referred to the SEC by the United States Postal Inspector, the only other information contained in the file is a notation stating that it “appears investor is out of state (Michigan). No further information received.” Furthermore, the notation was made in August 2006, after we brought this matter to the enforcement division’s attention. This was almost a year after Corporations initially received the complaint. The enforcement division rejected four of the 16 complaints because they involved a limited number of investors. Here again, the enforcement division could not provide evidence to support its conclusions. For example, in October 2005, the enforcement division rejected one case with limited investors that involved a company allegedly operating without a license. The case notes indicated that there was insufficient evidence to validate the complaint and stated that this fact, along with other priorities, necessitated closing the case. However, according to the case notes, the insufficient evidence resulted because the company failed to respond to letters sent by Corporations in July and August 2005, requesting information about the company’s activities. Moreover, documentation obtained from the complaint file indicated that a similar complaint had been made about the same company in 2003. According to a July 2003 memorandum prepared by a Corporations’ senior counsel, the company “may be, or may have been operating as an unlicensed broker-dealer.” The senior counsel concluded that current staffing did not warrant further investigation of the matter at that time. However, the senior counsel also stated that Corporations should keep track of the activities of one of the principals of the company. This individual was also identified in the letters sent by Corporations in July and August 2005 as a result of the more recent complaint. We found no evidence in the file that Corporations had established that a limited number of investors were associated with this case. Given this information, we do not believe the enforcement division sufficiently documented its reasons for rejecting the complaint. In response to our questions about this case, the deputy commissioner stated that the matter was not pursued the second time because Corporations did not have any investor complaints—the complaint it had was from a tip—and there was insufficient information to determine whether unlicensed  California State Auditor Report 2005-123 activities were involved. Nevertheless, we do not believe that complaints involving a limited number of investors should be dismissed unless the enforcement division can demonstrate that it has done sufficient research to determine that the likelihood that the complaint is valid is remote, or that the risk of financial loss is minimal. The enforcement division rejected an additional five cases because it believed it had no jurisdiction. However, it did not document what entity had jurisdiction over any of the five complaints or make any referrals. According to the deputy commissioner of the enforcement division, it erred by not The deputy commissioner referring one of the five cases to the appropriate entity. He of the enforcement also stated that three of the cases were under the jurisdiction division stated that three of either the Office of the Attorney General or local district of the cases were under attorneys; however, he did not believe they would have been the jurisdiction of either interested in pursuing the cases, so the enforcement division the Office of the Attorney did not attempt to refer the cases to them. We believe, however, General or local district that Corporations should at least have contacted the Office of attorneys; however, the the Attorney General or the local district attorneys to discuss the enforcement division did matters and should have documented its efforts, rather than not attempt to refer the assuming that the other agencies would refuse to investigate cases to them. the cases. If the other entities chose not to pursue the cases, Corporations would at least have performed its due diligence. The enforcement division indicated that the remaining case was originally reported to the police. Thus, although not documented in the file, no referral by Corporations appears to have been necessary. The remaining two cases were rejected because the enforcement division determined that there was no evidence of fraud. However, as with the other rejected complaints, the enforcement division could not provide documentation showing how it had reached these conclusions. We believe that it is good business practice for Corporations to document the decisions and actions it takes when rejecting complaint cases to ensure consistency and fairness in its complaint-handling process. During the period of our testing, the deputy commissioner of the enforcement division stated that Corporations did not have a formal policy for documenting its rationale when it decided to reject complaints or refer them to other entities. He further stated that to his knowledge, Corporations does not have a statutory responsibility to identify an appropriate entity when it determines that a complaint falls outside of its jurisdiction. Despite the lack of a statutory responsibility, the California State Auditor Report 2005-123  deputy commissioner stated that helping complainants find an appropriate entity to handle their complaints is a good business practice. After our conversations with the deputy commissioner, Corporations developed formal policies for rejecting and referring complaints. Under the new policy, complaints will be rejected without investigation only with approval from the deputy commissioner. If a rejection is warranted, the deputy commissioner will choose a selection from the menu of generic reasons in the ECMS for closing a case, include a short description of the reason for the closure, and send a letter to the complainant notifying him or her that the matter has been closed. Similarly, the new policy for referring cases to other entities requires the deputy commissioner to review the complaint. If it is determined that Corporations does not have jurisdiction, the deputy commissioner will close the case with a note in the ECMS explaining why it lacks jurisdiction and will identify the government agency to which the case was referred. Further, Corporations will send a letter to the complainant stating that the complaint has been sent to the entity with jurisdiction over the matter. Corporations has Recently modified its Complaint-handling Procedures Corporations recently revised its process for handling complaints, centralizing the intake of all complaints it receives and formalizing other steps in the process. The new process will require Corporations’ call center staff to enter the complaint information into the CRM system and forward the complaint to a newly organized complaint team comprising examiners and legal counsel. The complaint team will make a determination as to whether the complaint involves a securities regulation, a financial services license, or another type of complaint potentially falling within the enforcement division’s Corporations believes jurisdiction. The complaint team will also acknowledge all that this new process complaints immediately by letter or phone call. will allow it to respond immediately Corporations believes that this new process will allow it to to complaints and respond immediately to complaints and prepare each complaint prepare each complaint for referral to the appropriate division. It also believes that for referral to the the process will allow for equal treatment of all complaints it appropriate division. receives. However, because Corporations initiated this process near the end of our fieldwork, we were unable to test whether it will correct any of the weaknesses we identified. Nevertheless, 50 California State Auditor Report 2005-123 it appears that the process contains good business practices for handling complaints and, if followed, should help to improve Corporations’ complaint handling. CoRPoRATionS fAiled To PeRfoRm ReQuiRed eXAminATionS of Some liCenSeeS Corporations did not conduct examinations of many of its escrow licensees within the time frames required by law. Additionally, Corporations did not conduct examinations of its licensed finance lenders as frequently as required by its internal policy. Consequently, Corporations’ ability to protect consumers against potential fraudulent lending and financing scams was weakened. An examination involves a formal inspection of a licensee to ensure compliance with statutes and regulations. According to Corporations’ program-level action plan, these examinations serve to detect violations of the law and unsafe, unsound, or abusive business practices and deter potential wrongdoing. Further, the examinations give Corporations insight into changes and evolving developments in the investment and financial services industries, which it regulates. When Corporations fails to conduct the necessary examinations of its licensees, its ability to protect consumers from potential violations of the law, including fraud, is lessened. The California Financial Code requires Corporations to conduct examinations of licensed escrow offices and mortgage lenders at least once every four years. In addition, although not required by law, Corporations has established a goal for examining every licensed finance lender at least once every four years. However, We found that at least as shown in Table 6 on the following page, Corporations did 170 licensed escrow not conduct examinations of many escrow offices and finance offices and 899 licensed lenders within the last four years. Specifically, we found that finance lenders have at least 170 licensed escrow offices and 899 licensed finance not had a required lenders—representing 37 percent and 35 percent, respectively, examination for at least of all such licensees that required examinations—have not had four years. an examination for at least four years. Corporations was more effective with its examinations of mortgage lenders; only two licensed mortgage lenders—less than 2 percent—did not receive the required examination within at least the last four years. California State Auditor Report 2005-123 51 TABle  financial Services examinations not Conducted Within the Required Time frame number of licensees not examined Total number of Within a -year Percent of Type of Business licensees* Time frame licensees Escrow 458 170 37.1% California Finance Lenders† 2,552 899 35.2 California Residential Mortgage Lenders 148 2 1.4 Source: Department of Corporations’ Financial Services Division Application System as of May 23, 2006. * Total represents entities that had been licensed for at least four years as of May 23, 2006. † This time frame is not mandated, but is a Department of Corporations’ policy. When we asked Corporations why it had fallen behind in completing the examinations for the licensed escrow offices and finance lenders, the deputy commissioner of the financial division stated that the financial division does not have sufficient staff and that over the past few years it has had to shift several of the examiners’ priorities to focus on training new staff and processing applications. According to the deputy commissioner, the examinations of mortgage lenders have occurred within the four-year time frame because there are enough staff to perform those examinations. For fiscal year 2005–06, Corporations requested and received nearly $1.5 million in a budget change proposal to fund 16 additional examiner positions—including seven that were limited-term positions—to meet statutorily mandated exam cycles and to provide an adequate level of industry regulation and consumer protection against fraudulent lending and financing scams in California. The budget change proposal also indicated that “failure to maintain a reasonable exam schedule leaves consumers at risk from unscrupulous individuals and companies.” However, according to the deputy commissioner, as of December 2006, there has been no measurable reduction in the backlog of examinations, despite filling some of the authorized positions. The deputy commissioner also stated that it would take time to train the new staff. Finally, the deputy commissioner indicated that even with the new staff, 52 California State Auditor Report 2005-123 it is unclear whether Corporations can perform the required examinations because of the increasing number of licensees to regulate. Corporations also lacks clear guidance for conducting examinations and following up on the deficiencies it identifies. For example, it does not have any policies or procedures on the time frames within which examiners must follow up on licensees’ responses to deficiencies identified during an examination. In a sample of 20 examinations performed by the financial division, Corporations’ examiners identified a total of 112 deficiencies related to 17 of the examinations; the remaining three did not identify any deficiencies. The identified deficiencies included improper charges, unauthorized disbursements from accounts, and altered checks. When we followed up on six of the 17 examinations that identified deficiencies, we found that in four cases the examiners took between 79 days and 187 days to provide a response to the licensees after they had responded to the deficiencies. We expected Corporations to have established response time frames to ensure the prompt resolution of any deficiencies. However, when we brought this to Corporations’ attention, the deputy commissioner stated that the division does not have written guidance on the time frames for following up on deficiencies; she indicated, however, that 45 days is a reasonable goal. The deputy commissioner also stated that staff had been more focused on conducting the mandated examinations they had not yet performed and indicated that when the examiners were out in the field conducting those examinations, they might not have been aware that other licensees’ responses were waiting for them in the office, causing some of the delays in Corporations’ response. Nonetheless, without such guidance and preestablished response time frames, Corporations cannot ensure that its examiners follow up consistently and promptly to ensure that deficiencies are corrected. ReCommendATionS To ensure that all applications are reviewed promptly and sufficiently, Corporations should do the following: • Continue to monitor the progress of applications through the review and approval process to identify any that have stalled, and investigate the reason for the delay. California State Auditor Report 2005-123 53 • Follow the law in notifying applicants once their applications are complete. • Follow up with applicants that do not promptly respond to deficiency notices. • Assess whether it needs additional staff to process applications. • Maintain all necessary data in its information management systems so that it can effectively calculate the number of days it takes to process applications. To improve the efficiency of its complaint-handling process, Corporations should do the following: • Develop procedures to track the progress of complaints to ensure that they continue to move through the process without unnecessary delay. • Monitor its newly established complaint-referral process and develop procedures, if necessary, to decrease the length of time it takes to refer cases to the appropriate division. • Review its existing complaint records and eliminate duplicates and correct any inaccurate fields. Further, Corporations should maintain accurate and complete data to ensure that the information systems can be used more effectively as management tools. Corporations should develop a plan to conduct examinations of licensees in accordance with state law and its own internal policy. Further, Corporations should establish clear guidance and response time frames for following up on deficiencies identified in examinations. 5 California State Auditor Report 2005-123 We conducted this review under the authority vested in the California State Auditor by Section 8543 et seq. of the California Government Code and according to generally accepted government auditing standards. We limited our review to those areas specified in the audit scope section of this report. Respectfully submitted, ELAINE M. HOWLE State Auditor Date: January 30, 2007 Staff: Steven A. Cummins, CPA, Audit Principal Bryan B. Beyer Michelle Baur, CISA Kim Buchanan Julianna N. Field Ly Huynh Ben Ward California State Auditor Report 2005-123 55 Blank page inserted for reproduction purposes only. 5 California State Auditor Report 2005-123 Agency’s comments provided as text only. Business, Transportation and Housing Agency 980 9th Street, Suite 2450 Sacramento, CA 95814-2719 January 12, 2007 Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, CA 95814 Dear Ms. Howle: Attached is the Department of Corporations (Department) response to your draft audit report, Department of Corporations: It Needs Stronger Oversight of Its Operations and More Efficient Processing of License Applications and Complaints (#2005-123). Thank you for allowing the Department and the Business, Transportation and Housing Agency (Agency) the opportunity to respond to the report. As noted in its response, the Department has no substantial disagreements with the findings and finds the recommendations to be useful. The Agency concurs, and further notes that the report should prove to be a useful blueprint for recently appointed Corporations Commissioner Preston DuFauchard as he strives to achieve greater effectiveness and efficiency in the Department. As indicated in your report, the Department’s strategic planning and performance measurement development efforts are part of the Agency Performance Improvement Initiative, wherein a primary goal is to transition all departments to performance-based management. Research indicates that an endeavor of this magnitude usually takes five to seven years. Therefore, as the Department is in the relatively early stages of such an undertaking, the Agency fully anticipated that part of its continuing work would include refinement of performance measures, development of benchmarks and improvement of systems designed to capture, analyze and report performance data. Toward that end, the Agency very much appreciates your recognition of the Department’s efforts and your recommendations for further improvement. If you need additional information regarding either the Department’s or the Agency’s response, please do not hesitate to contact me, or Michael Tritz, Agency Deputy Secretary for Audits and Performance Improvement, at (916) 324-7517. Sincerely, (Signed by: Barry R. Sedlik) BARRY R. SEDLIK Acting Secretary Attachment California State Auditor Report 2005-123 5 Department of Corporations 1515 K Street, Suite 200 Sacramento, CA 95814-4052 January 12, 2007 Barry R. Sedlik Acting Secretary Business, Transportation and Housing Agency 980 9th Street, Suite 2450 Sacramento, CA 95814-2719 Dear Secretary Sedlik: I am pleased to submit this response to the draft audit report from the Bureau of State Audits (BSA) entitled “Department of Corporations: It Needs Stronger Oversight of Its Operations and More Efficient Processing of License Applications and Complaints.” BSA prepared this report regarding certain operations of the Department of Corporations (Department) pursuant to a request of the Joint Legislative Audit Committee. After discussing the draft report with the Department’s Executive Staff we conclude that we have no substantial disagreements, and find the recommendations to be useful. The Department has already begun to make many positive changes in its operations. We appreciate the fact that the draft report acknowledges some of these improvements. In addition, we have started to assess ways to implement some of the additional recommendations. For example, consistent with the recommendation to consider the need for a new technology system for data collection and management, we have met with other State departments and agencies to assess whether existing platforms can be adapted to meet the Department’s needs. If the Department decides to implement such a system, the anticipated costs of its design and roll out may well provide part of a plan to reduce the excess fund balances to meet the new statutory levels. Similarly, we have recognized the need to re-examine and adjust certain performance measures in the Department’s program-level action plans. The Department created these plans as a result of the Business Transportation and Housing Agency’s initiative to have the Department implement a performance-based management system. Some objectives or benchmarks identified in the plans stem from historical data, and are not adjusted to account for present increases in workload. Certain other measures result from untested data. Regardless, these measures need to be re-examined. As with the implementation of the Department’s program-level action plans, the Department’s implementation of the BSA recommendations will necessarily be progressive. We look forward to the future opportunity to disclose progress towards implementing these recommendations. In the meantime, if you have any questions or concerns about any of these matters, please contact me at your pleasure. Very truly yours, (Signed by: Preston DuFauchard) Preston DuFauchard 5 California State Auditor Report 2005-123 cc: Members of the Legislature Office of the Lieutenant Governor Milton Marks Commission on California State Government Organization and Economy Department of Finance Attorney General State Controller State Treasurer Legislative Analyst Senate Office of Research California Research Bureau Capitol Press California State Auditor Report 2005-123 5