The Securities and Exchange Commission just hasn’t had enough bad news recently, so last month the media piled on even more: a probe of insider-trading allegedly going on inside the SEC.

Specifically, the agency’s inspector general has found evidence of “suspicious activity, appearances of improprieties, and … possible trading on non-public information, and/or potential insider trading” on the part of two SEC enforcement attorneys. According to the inspector general’s report, the suspected wrongdoings were so serious that the matter was passed along to the U.S. attorney for Washington, D.C., for further investigation and possible civil or criminal prosecution.

It gets worse. The investigation determined that one of the two SEC employees:

sold all her shares in a large healthcare company approximately two months before an investigation of the company was opened in her group at the SEC;

purchased additional shares of a global oil company’s stock both a few days and a few weeks after a formal investigation was opened by a colleague who occupied the office next to her; and

sold shares of that global oil company’s stock two days before an inquiry was opened in that matter.

As to the second SEC attorney, the inspector general found that both he and the first attorney traded in the stock of a large financial services company, even after one of their fellow enforcement attorneys became aware of three separate enforcement investigations of that company. This third staff lawyer told the inspector general she advised both of the attorneys in question during their regular weekly lunches that she could not purchase additional stock in this company, because she had become aware of these investigations.

The report also found that the two attorneys frequently violated “Rule 5,” the SEC’s barebones, internal policy governing employees’ reporting of securities transactions. More importantly, however, the report found that the SEC essentially has no compliance system in place to ensure that its employees—who possess tremendous amounts of material, non-public information—don’t engage in insider trading themselves. The current disclosure requirements and compliance system are based on the honor system, and there is no way to determine if an employee fails to report a securities transaction. No spot-checks are conducted. The SEC does not obtain duplicate brokerage account statements. There is little oversight or checking of the reports that employees do file to determine their accuracy or even whether an employee has reported at all.

Needless to say, the SEC does not need this news. Prior to the story breaking, the agency appeared to have regained at least some of its stride under the aggressive new leadership of Chairman Mary Schapiro and Enforcement Director Robert Khuzami. In April and May at least a small bit of positive momentum for the SEC re-emerged, with numerous media reports about the reforms that Schapiro and Khuzami had introduced or intended to bring in the near future. In addition, the SEC had been (and continues to be) quite aggressive in pursuing frauds such as Ponzi schemes, and trumpeting its successes in a very visible way on its Website.

All that went away in late May when the insider-trading story became public. Calls for the SEC to be abolished or demolished—which had previously flared up and faded away following the SEC’s admitted failure to take action to stop the Bernard Madoff fraud scheme—resurfaced loudly once again. Although the inspector general’s report was limited to two employees and hardly painted a picture of an agency rife with insider trading or misconduct, that is how the message was received and re-broadcasted by some in the press (including an editorial appearing May 21 on Forbes.com that breathlessly pleaded, “Mr. Obama, tear down the SEC!”).

To my thinking, the discovery of these two allegedly errant enforcement attorneys is extremely disappointing, yes—but it is not a sign of a corrupt organization. It certainly is not a reason to “demolish” anything. What it does (painfully) highlight is the need for the SEC to modernize its own insider-trading compliance program.

First, Enforce Thyself

Beyond its enforcement of the insider-trading laws, the SEC has been vocal in recent years about the need for investment professionals and others to have adequate policies and procedures to assure compliance with the federal securities laws. After a 2008 investigation into abuses at the Retirement System of Alabama (RSA), the SEC wrote that “most of the RSA investment personnel involved in this matter, including its CEO, did not have a clear understanding of the securities law duties and risks implicated when they came into possession of material, non-public information … If there had been a reasonable compliance program in place at RSA at the time of the events described in this report, RSA likely would not have purchased Liberty stock prior to the public announcement of the transaction.” The SEC concluded the report by stating: “We issue this report to remind investment managers, public and private, of their obligation to comply with the federal securities laws and the risks they undertake by operating without an adequate compliance program. RSA’s conduct could have been prevented with appropriate policies, procedures, and training.”

The inspector general’s report makes clear that the SEC itself suffers from the same lack of policies, procedures, and trading for its own insider-trading compliance program. Indeed, from what I can tell, as of early this spring, the SEC was operating under the same unverified “honor system” that was in place when I worked there in the mid-1990s.

Specifically, under the SEC’s decades-old Rule 5, employees are prohibited from purchasing any security that to their knowledge is involved in any pending investigation by or proceeding before the Commission. In addition, all securities purchased by an employee must be held for a minimum of six months. Employees are also required under Rule 5 to report annually to the SEC a complete list of securities in which he or she owns an interest, and also to report every acquisition or sale of any security within five business days of the transaction date or the date confirmation is received.

But as the inspector general correctly observed, there is no true compliance system at the SEC for determining whether SEC employees have committed Rule 5 violations. Among other failings, while employees are obviously expected to comply with Rule 5’s financial disclosure and clearance systems, the SEC has no way to determine reporting or clearance accuracy or even whether an employee has reported at all.

That all seems likely to change now. On May 22, the SEC announced that it would undertake a series of measures—many recommended by the inspector general—to strengthen its internal compliance program and guard against inappropriate securities trading by employees. “It only makes sense that we have a world-class compliance program, just as we expect from those we regulate,” Schapiro said at the time.

The significant measures the SEC announced include:

Creating new internal rules to govern securities transactions for all SEC employees, which will require preapproval of all trades. These new rules will, for the first time, prohibit staff trading in the securities of companies under SEC investigation regardless of whether the employee has personal knowledge of the investigation. They will also require that all employees authorize their brokers to provide the agency with duplicate trade confirmation statements.

Immediately hiring a vendor to create a computerized compliance system to track, audit, and oversee employee securities transactions and financial disclosure in real time, including the integration of duplicate confirmation statements.

Consolidating responsibility for oversight of employee securities transactions and financial disclosure reporting within the SEC’s Ethics Office.

Hiring a new chief compliance officer.

The SEC’s prompt action in response to the inspector general’s report was appropriate and necessary to help preserve faith in the SEC’s new management. As Schapiro observed, it only makes sense that as the enforcer of insider-trading laws, the SEC itself should strive to have a world-class compliance program.

No, it shouldn’t take something as severe as the alleged misconduct by two enforcement attorneys to spur these improvements, but the new rules governing trading by SEC employees and a modern computer system to track and audit such trading are important, long-overdue steps that the SEC must take to get its own house in order. Let’s hope that compliance program becomes a model we all can use at our own corporations.