PBGC

Protecting A m e r i c a ' s Pensions

PENSION B E N E F I T G U A R A N T Y

CORPORATION

S e m i a n n u a l R e p o r t t o t h e Congress

Management's Response to t h e S e m i a n n u a l R e port:

April 1, to S e p t e m b e r 3 0 ,

Office of t h e D i r e c t o r

V
PENSION B E N E F I T G U A R A N T Y C O R P O R A T I O N

SEMIANNUAL REPORT T O T H E CONGRESS

The P e n s i o n B e n e f i t G u a r a n t y C o r p o r a t i o n ( P B G C ) is r e s o l u t e i n o u r m i s s i o n t o i m p r o v e t h e r etirement

s e c u r i t y f o r millions of A m e r i c a ' s w o r k e r s a n d r etirees.

Through i t s d e d i c a t e d , i n d e p e n d e n t w o r k , P B G C ' s O f f i c e of I n s p e c t o r G e n e r a l ( O I G ) is f u n d a m e n t a l t o o u r

continued success s e r v i n g t h e p u b l i c . D u r i n g t h i s r e p o r t i n g p e r i o d , P B G C has b e e n w o r k i n g d iligently t o

address t h e O I G r e c o m m e n d a t i o n s . W e c o n t i n u e t o f o c u s o n i n f o r m a t i o n s e c u r i t y , t h e m o d e r n i z a t i o n o f

PBGC's k e y b e n e f i t s - r e l a t e d i n f o r m a t i o n t e c h n o l o g y s y st e m s , a n d t h e t r a n s p a r e n c y a n d a c c o u n t a b i l i t y o f

our p r o f e s s i o n a l s e r v i c e s c o n t r a c t i n g , w h i c h t h e O I G h a s cited as m a n a g e m e n t c h allenges.

M a n a g e m e n t c o n t i n u e s to t a k e steps to i m p r o v e t h e c o n t r o l e n v i r o n m e n t t o reduce t h e r i s k a s s o c i a t e d with

t h e p o t e n t i a l u n a u t h o r i z e d u s e of p e r s o n a l l y i d e n t i f i a b l e i n f o r m a t i o n . D u r i n g t h e r e p o r t i n g p e r i o d ,

m a n a g e m e n t i n s t i t u t e d a f o r m a l I n s i d e r T h r e a t P r o g r a m a n d d e p l o y e d technology to detect, p r e v e n t , a n d

mitigate access to c r i t i c a l P B G C d ata.

Over t h e l a s t 45 y e a r s , P B G C h a s w o r k e d d iligently t o p r e s e r v e p l a n s , p r o t e c t p l a n p a r t i c i p a n t s , a n d e n s u r e

t h a t p a r t i c i p a n t s i n t r u s t e e d p l a n s a n d t h e i r b e n e f i c i a r i e s r e c e i v e t i m e l y , u n i n t e r r u p t e d b e n e f i t s . L a s t y e a r ,

PBGC a t t a i n e d i t s 2 6 t h c o n s e c u t i v e u n m o d i f i e d a u d i t o p i n i o n , a n d m a i n t a i n e d , i n a l l m aterial respects,

effective i n t e r n a l c o n t r o l o v e r f i n a n c i a l r e p o r t i n g .

Building o n o u r r e c o r d of promoting s t e w a r d s h i p a n d a c c o u n t a b i l i t y , P B G C places a g r e a t e m p h a s i s on

internal c o n t r o l s . W e c o n t i n u e t o m a k e s i g n i f i c a n t p r o g r e s s i n i m p l e m e n t i n g t h e latest update to t h e O f f i c e

o f M a n a g e m e n t a n d B u d g e t ' s C i r c u l a r Management's Responsibility for Enterprise Risk 

Management and Internal Control including Appendix A, Management of Reporting and Data Integrity 

 W e a p p r e c i a t e t h e I n s p e c t o r G e n e r a l ' s r e c o g n i t i o n o f P B G C ' s I n t e r n a l C o n t r o l C o m m i t t e e ' s (ICC)

efforts t o s t r e n g t h e n i n t e r n a l c o n t r o l across t h e C o r p o r a t i o n a n d t o reduce t h e n u m b e r o f o p e n a u d i t

r e c o m m e n d a t i o n s . O u r R i s k M a n a g e m e n t Council (RMC), chaired by P B G C ' s R i s k M a n a g e m e n t O f f icer,

m e t f r e q u e n t l y t h r o u g h t h e r e p o r t i n g p e r i o d as w e l l . As o u r E n t e r p r i s e R i s k M a n a g e m e n t P r o g r a m m a t u r e s ,

w e a r e b e t t e r a b l e to i d e n t i f y , p r i o r i t i z e , a n d m a n a g e r i s k s f a c i n g P B G C .

Table 1 presents r e s o l v e d a u d i t r e p o r t s i s s u e d p r i o r t o S e p t e m b e r 3 0 , w h i c h c o n tain . 

r e c o m m e n d a t i o n s t h a t r e m a i n o p e n . I a m p l e a s e d t o r e p o r t t h a t P B G C has c l o s e d m o r e t h a n 76 p e r c e n t o f

t h e r e c o m m e n d a t i o n s these r e p o r t s . T a b l e 2 d e t a i l s O I G r e p o r t s r e q u i r i n g final action.

I n a d d i t i o n t o o u r c o n t i n u e d f o c u s o n i n t e r n a l c o n t r o l s to address t h e i m p o r t a n t issues raised by o u r O I G , I 

remain k e e n l y f o c u s e d o n t h e r i s k s f a c i n g P B G C i n s u r a n c e p r o g r a m s , p a rticularly with respect t o t h e

Multiemployer I n s u r a n c e P r o g r a m , w h i c h c o n t i n u e to b e r e p o r t e d i n t h e G o v e r n m e n t A c c o u n t a b i l i t y

Office's H i g h R i s k List.

Our work with t h e C o n g r e s s , t h e P B G C B o a r d o f D i r e c t o r s , a n d o u r O f f i c e o f I n s p e c t o r G e n e r a l is c r i t i c a l

Gordon Hartogensis

Director

1
Table 1 

Management Statement on Resolved Audit Reports Over Twelve Months Old

With Final Action Pending as of September 30, 2019

Date Issued Report No. Title of Report Status of Management Actions

2008-2

R e p o r t o n Internal Controls

PBGC's F Y and 2006

Financial Statement Audit

O f t h e r e c o m m e n d a t i o n s i n c l u d e d i n t h e

 1 two

 1

r e c o m m e n d a t i o n s h a v e been s u b m i t t e d t o t h e

OIG f o r c l o s u r e .

9/ 7 

F Y 2012 Vulnerability

Testing Report

O f the five r e c o m m e n d a t i o n s i n c l u d e d i n t h e

report, four w e r e c l o s e d . T h e r e m a i n i n g

r e c o m m e n d a t i o n h a s been s u b m i t t e d t o t h e

OIG f o r c l o s u r e .

 A 

 Vulnerability

Assessment a n d P e n e t r a t i o n

Testing Report

O f t h e s e v e n r e c o m m e n d a t i o n s i n c l u d e d i n

t h e r e p o r t , s i x w e r e c l o s e d . T h e r emaining

r e c o m m e n d a t i o n h a s been s u b m i t t e d t o t h e

OIG f o r c l o s u r e .

3/21/2014 2014-9

F Y Federal

Information Security

M a n a g e m e n t A c t

Independent Evaluation

Report

O f t h e r e c o m m e n d a t i o n s i n c l u d e d i n t h e

report, / were remaining

r e c o m m e n d a t i o n h a s been s u b m i t t e d t o t h e

OIG f o r c l o s u r e .

3/30/2015 2015-7

F Y 2014 Vulnerability

Assessment a n d P e n e t r a t i o n

Testing Report

O f t h e r e c o m m e n d a t i o n s i n c l u d e d i n t h e

 1 9 wprp two

 1 JL L V 1

r e c o m m e n d a t i o n s h a v e been s u b m i t t e d t o t h e

OIG f o r c l o s u r e .

5/6/2015 2015-9

F Y Federal

Information Security

M a n a g e m e n t A c t

Independent Evaluation

Report

O f t h e r e c o m m e n d a t i o n s i n c l u d e d i n t h e

r e p o r t , 2 0 w e r e c l o s e d . T h e r emaining

r e c o m m e n d a t i o n i s i n process.

12/11/2015 2016-1

F Y 2015 Vulnerability

Assessment a n d P e n e t r a t i o n

Testing Report

O f t h e s i x r e c o m m e n d a t i o n s i n c l u d e d i n t h e

report, four w e r e c l o s e d . Of t h e t w o

remaining r e c o m m e n d a t i o n s , o n e h a s been

s u b m i t t e d t o t h e O I G f o r c l o s u r e a n d o n e

r e m a i n s i n process.

2
Table 1 

Management Statement on Resolved Audit Reports Over Twelve Months Old

With Final Action Pending as of September 30, 2019

Date Issued Report No. Title of Report Status of Management Actions

11/13/2015 2016-3

Report on I n t e r n a l C o n t r o l s

Related to t h e P B G C

2 0 1 5 a n d F i n a n c i a l

Statement Audit

O f the five r e c o m m e n d a t i o n s i n c l u d e d i n t h e

report, four w e r e c l o s e d . T h e r e m a i n i n g

recommendation is i n process.

2/19/ 2016 2016-7

F Y Federal T • _ 

Information Security

Modernization Act Final

Report

O f t h e e i g h t r e c o m m e n d a t i o n s i n c l u d e d i n t h e

r e p o r t , w e r e c l o s e d . t h r e e r emaining

r e c o m m e n d a t i o n s h a v e been submitted to the

OIG f o r c l o s u r e .

11/15/2016 2017-3

Report on I n t e r n a l C o n t r o l s

 r S

 2 0 1 5 F inancial

Statements Audit

O f the five r e c o m m e n d a t i o n s i n c l u d e d i n t h e

r e c o m m e n d a t i o n s h a v e been submitted to the

OIG f o r c l o s u r e .

1/18/2017 2017-6

PBGC's F Y 2 0 1 6 F i n a n c i a l

Statement Audit

M a n a g e m e n t L e t t e r R e p o r t

O f t h e n i n e r e c o m m e n d a t i o n s i n c l u d e d i n t h e

report, five w e r e c l o s e d . Of the four

remaining r e c o m m e n d a t i o n s , o n e has been

submitted to t h e O I G f o r c l o s u r e a n d t h r e e

remain in process.

02/22/2017 2017-8

F Y 2016 Vulnerability

Assessment a n d P e n e t r a t i o n

Testing Report

O f t h e t h r e e r e c o m m e n d a t i o n s i n c l u d e d i n t h e

r e p o r t , t w o r e c o m m e n d a t i o n s w e r e s u b m i t t e d

t o t h e O I G f o r c l o s u r e . Subsequent to t h e

r e p o r t i n g p e r i o d , t h e third recommendation

w a s s u b m i t t e d to t h e O I G f o r c l o s u r e .

03/22/2017 2017-9

F Y Federal

Information Security

Modernization Act

Independent Evaluation

Report

O f the 20 r e c o m m e n d a t i o n s i n c l u d e d i n t h e

r e p o r t , w e r e c l o s e d . T h e r emaining

r e c o m m e n d a t i o n r e m a i n s i n process.

11/13/2017

F Y 2017 Vulnerability

Assessment a n d P e n e t r a t i o n

Testing Report

O f t h e s e v e n r e c o m m e n d a t i o n s i n c l u d e d i n

t h e r e p o r t , o n e has b e e n closed. Of t h e s i x

remaining recommendations, five have been

submitted to t h e O I G f o r c l o s u r e a n d o n e

r e m a i n s i n process.

2018-6

Report on I n t e r n a l Control

Related to t h e P B G C ' s F Y

 2 0 1 6 F i n a n c i a l

Statement Audit

O f t h e r e c o m m e n d a t i o n s i n t h e r e p o r t ,

t h r e e h a v e been c l o s e d . T h e r e m a i n i n g t w o

r e c o m m e n d a t i o n s h a v e been submitted to the

OIG f o r c l o s u r e .

3
Table 1 

Management Statement on Resolved Audit Reports Over Twelve Months Old

With Final Action Pending as of September 30, 2019

Date Issued Report No. Title of Report Status of Management Actions

12/20/2017 2018-7

F Y 2017 Federal

Information Security

Modernization Act

Independent Evaluation

Report

 r n e r e p o r t , a n

have been s u b m i t t e d t o t h e O I G f o r c l o s u r e .

01/16/2018 2018-9

F Y Financial

S t a t e m e n t A u d i t

M a n a g e m e n t L e t t e r R e p o r t

O f the five r e c o m m e n d a t i o n s i n t h e r e p o r t ,

t h r e e h a v e been c l o s e d a n d t w o r e m a i n i n

process.

4
Table 2 

Management Statement on OIG Reports Requiring Final Action For the

Period Ending September 30, 2019

Number of Disallowed

Ref. Title 5 (b)(2)(A)-(D) Reports Costs

Funds Put to

Better Use

A . For which final a c t i o n h a d n o t been t a k e n b y t h e

commencement of t h e r e p o r t i n g p e r i o d . 2 4 $ $

 For which m a n a g e m e n t d e c i s i o n s w e r e made during

t h e r e p o r t i n g p e r i o d . 5* $ $

For which final a c t i o n h a d been t a k e n b y t h e e n d o f

t h e r e p o r t i n g p e r i o d ,

i . d o l l a r v a l u e o f d i s a l l o w e d costs t h a t w e r e $ 

r e c o v e r e d b y m a n a g e m e n t

ii. d o l l a r v a l u e o f d i s allowed costs t h a t w e r e

written o f f b y m a n a g e m e n t

iii. d o l l a r v a l u e of r e c o m m e n d a t i o n s t h a t w e r e

C . a c t u a l l y c o m p l e t e d

iv. d o l l a r v a l u e of r e c o m m e n d a t i o n s t h a t

m a n a g e m e n t h a s s u b s e q u e n t l y c o n c l u d e d

s h o u l d n o t o r c o u l d n o t b e i m p l e m e n t e d o r

completed

No. o f r e p o r t s f o r which final a c t i o n w a s t a k e n

during t h e p e r i o d . 1 

$

 For which no final a c t i o n h a s been made b y t h e e n d

o f t h e r e p o r t i n g p e r i o d . 2 8 $ $

During t h e r e p o r t i n g p e r i o d , t h e O I G i s s u e d s i x ( 6 ) a u d i t r e p o r t s ; only five ( 5 ) r e p o r t s c o n t a i n e d a u d i t