Inspector General’s Semiannual Report to Congress

TABLE IT

INSPECTOR GENERAL ISSUED REPORTS
WITH RECOMMENDATIONS
THAT FUNDS BE PUT TO BETTER USE

Number Dollar Value
. For which no management decision has been made 0 0
by the commencement of the reporting period
. Which were issued during the reporting period 1 $16,800
Subtotal (A +B) 1 $16,800
- For which a management decision was made during
the reporting period 1 $16,800
(i) dollar value of recommendations that were
agreed to by management 1 $16,800
(ii) dollar value of recommendations that were 0 0
not agreed to by management
. For which no management decision has been made 0 0
by the end of the reporting period
. Reports for which no management decision was 0 0

made within six months of issuance

April 1, 2008 —- September 30, 2008 Page 17


Inspector General’s Semiannual Report to Congress

During this reporting period, the OIG opened and closed one preliminary investigation into
employee misconduct, and referred (i) four complaints received from the maritime industry to various
program bureaus/offices within the FMC, (ii) one complaint to a sister OIG with jurisdiction in the
subject matter of the complaint, and (iii) one complaint to another federal agency with jurisdiction over
the complaint. After reviewing another four complaints, the OIG closed them with no formal action
taken.

The OIG referred no matters to prosecutorial authorities during the period.

OTHER OIG ACTIVITIES

Review of Legislation

As required by the Inspector General Act of 1978, as amended, the Office of Inspector
General routinely reviews proposed legislation and regulations. The purpose of these reviews is to
assess whether the proposed legislation or regulation (1) impacts the economy and efficiency of FMC
programs and operations, and (2) contains adequate internal controls to prevent and detect fraud and
abuse. During this period, a number of Commission Orders/policy guidelines were reviewed by this
Office.

Executive Council on Integrity and Efficiency Activities
The Executive Council on Integrity and Efficiency (ECIE) was established by Executive Order
12805 on May 11, 1992, to:

e address integrity, economy and effectiveness issues that transcend individual government

agencies; and

e enhance the professionalism and effectiveness of IG personnel throughout the government.

April 1, 2008 — September 30, 2008 Page 11


Inspector General’s Semiannual Report to Congress

Details on these and other activities are provided below.

BACKGROUND

The FMC is an independent agency responsible for the regulation of oceanborne
transportation in the foreign commerce of the United States. The principal statutes or statutory
provisions administered by the Commission are the Shipping Act of 1984, as amended by the Ocean
Shipping Reform Act of 1998; the Foreign Shipping Practices Act of 1988; and Section 19 of the
Merchant Marine Act of 1920.

The FMC is headed by five Commissioners nominated by the President and confirmed by the
Senate, each serving five-year terms. For Fiscal Year (FY) 2008, the Commission was authorized

127 full-time equivalent positions with a total appropriation of $22,322,000.

Although the majority of the Commission’s personnel are located in Washington, D.C., it also
maintains a presence in Los Angeles, Seattle, New York, New Orleans, Houston and South Florida,
through area representatives who serve the major ports and transportation centers within their
respective geographic areas. In addition, two at-large area representatives operate out of

Washington, D.C.

The FMC’s Office of Inspector General (OIG) was established in 1989 as required by the
Inspector General Act Amendments of 1988 (5 U.S.C. app.). The OIG is an independent audit and
investigative unit headed by an Inspector General (IG) who reports directly to the Chairman of the
FMC. To aid the FMC in accomplishing its mission, the OIG was provided two full-time staff and a
budget of $512,000 for Fiscal Year 2008.

The OIG is responsible for conducting audits and investigations relating to the programs and

operations ofthe FMC. Audits are conducted for the purpose of finding and preventing fraud, waste

April 1, 2008 —- September 30, 2008 Page 2


HOTLINE COMPLAINTS

The success of the OIG mission to prevent fraud, waste and abuse
depends on the cooperation of FMC employees and the public.

A CompPLaINT CAN BE REPORTED BY CALLING OuR 24-HR DirRECcT LINE

(202) 523-5865

E-mait ADDREss:

oig@fmc.gov

To PLACE A ComPLAINT IN WRITING PLEASE MAIL To:

Federal Maritime Commission
Office of Inspector General
Room 1054

800 North Capitol Street, NW
Washington, DC 20573

To Be Opened By the IG Only

THE INFORMATION You PROVIDE Is CONFIDENTIAL AND You CAN BE ANONYMOUS

However, CALLERS ARE ENCOURAGED To Assist THE INSPECTOR GENERAL BY
SUPPLYING INFORMATION As To How THEY MAY Be CONTACTED FOR ADDITIONAL INFORMATION


Inspector General’s Semiannual Report to Congress

SUMMARY OF INSPECTOR GENERAL REPORTING REQUIREMENTS

IG Act
Reference Reporting Requirement Page(s)

Section 4(a)(2) Review of legislation and regulations 11

Section 5(a)(1) Significant problems, abuses and deficiencies None

Section 5(a)(3) Prior significant recommendations on which 12
corrective actions have not been made

Section 5(a)(4) Matters referred to prosecutive authorities 10

Section 5(a)(5) Summary of instances where information was 13
refused

Section 5(a)(6) List of audit reports by subject matter 4

Section 5(a)(7) Summary of each particularly significant report 4-10

Section 5(a)(8) Statistical tables showing number of reports and 16
dollar value of questioned costs

Section 5(a)(9) Statistical tables showing number of reports and 17
dollar value of recommendations that funds be put
to better use

Section 5(a)(10) Summary of each audit issued before this reporting None
period for which no management decision was
made by the end of the reporting period

Section 5(a)(11) Significant revised management decisions 12

Section 5(a)(12) Significant management decisions with which the 12
inspector general disagrees

April 1, 2008 — September 30, 2008 Page 15


Inspector General’s Semiannual Report to Congress

During FY 2008, the Office of Information Technology (OIT) hired an IT security consulting
firm to perform an inventory of the agency’s information security program. The results of this
assessment will be used to restructure the agency’s information security program and create
Certification and Accreditation (C&A) documentation for each of FMC’s four information systems.
The contractor is expected to complete the task by the spring of 2009, in time for the OIG’s FY 2009
FISMA evaluation.

Our FY 2008 FISMA evaluation identified two concrete steps the agency has taken to address
its IT security vulnerabilities. First, it now recognizes the extent of the task. Second, it has allocated
substantial resources to bring the security program up to Congressional and OMB standards and
expectations. Without minimizing the importance of this foundation and the effort involved to bring it
about, the fact of the matter is that, in FY 2008, many of the elements of a mature, robust and

comprehensive security program were not yet in place at the FMC.

The independent review identified one significant deficiency.' While FMC senior management
has begun to focus on FISMA as an agency responsibility, the following conditions were identified
that contributed to the significant deficiency:

e FMC C&A documentation did not comply with NIST and OMB guidance for the FMC
Network, Service Contracts Internet Based Filing System (SERVCON), and FORM-1. The
documentation lacked sufficient information that would provide management with the
assurance required to effectively demonstrate sound information security decisions based on

risk; and

1 OMB defines a significant deficiency in Memorandum 08-21 as “a weakness in an agency's overall information systems security
program or management control structure, or within one or more information systems, that significantly restricts the capability of the
agency to carry out its mission or compromises the security of its information, information systems, personnel, or other resources,
operations or assets.”

April 1, 2008 — September 30, 2008 Page7



Inspector General’s Semiannual Report to Congress

Issued Audits and Reviews

Audit Report Number Subject of Audit
A08-05 Audit of the Management of BlackBerry

Communication Devices

A08-06 Audit of the Federal Maritime Commission’s
Budget Execution Processes, Procedures and
Policies for Fiscal Year 2007

A08-07 Implementation of the Federal Information
Security Management Act for Fiscal Year 2008

A08-08 Privacy and Data Protection Evaluation Report

Summary of Audits Issued During the Current Period

In A08-05, Audit of the Management of BlackBerry Communication Devices, the audit
objectives were to assess whether the agency managed its BlackBerry program efficiently and

effectively, and whether controls were in place to discourage program abuse.

The OIG found that the agency is generally managing the BlackBerry program effectively, but
there is room for improvements that will reduce program expenses. On the positive side, we found no
abuse by staff of the BlackBerry’s voice or internet functions. The agency has policies and
procedures to help guide staff in the proper use of the devices, and “HelpDesk” staff are available to

assist users as needed.

Notwithstanding, the OIG believes that the agency should take additional steps to prevent
potential problems, reduce vulnerabilities and save money. An OIG survey indicates that many users
are unfamiliar with their responsibilities regarding BlackBerry use. Further, employees are not

required to sign agreements with the agency to hold themselves accountable for proper use of the

April 1, 2008 — September 30, 2008 Page 4


Inspector General’s Semiannual Report to Congress

and abuse and promoting economy, efficiency and effectiveness within the agency. OIG investigations
seck out facts related to allegations of wrongdoing on the part of FMC employees and individuals, or
entities having contracts with, or obtaining benefits from, the agency. The Inspector General Act
provides that the OIG shall have access to all agency records and may subpoena records from entities

outside of the agency in connection with an audit or investigation.

The IG is required by law to prepare a report summarizing its audits and investigations during
the immediately preceding six-month period. The report is sent to the FMC Chairman, the President
of the Senate, the Speaker of the House and FMC’s appropriating and authorizing committees. This

dual reporting requirement facilitates and ensures the independence of the Office.

AUDITS/EVALUATIONS
During this semiannual period, the OIG issued audits of the agency’s management of its
BlackBerry personal digital assistant program and budget execution processes, procedures and
policies for FY 2007. We also issued our annual evaluation of the agency’s compliance with the
Federal Information Security Management Act (FISMA) of 2002 and a companion report on privacy

and data protection activities.

In addition to these completed audits and evaluations, the OIG began its annually mandated
audit of the agency’s financial statements and initiated a program inspection of the agency’s check-out
procedures. Finally, we identified management challenges for inclusion in the FY 2008 FMC

Performance and Accountability Report.

April 1, 2008 — September 30, 2008 Page 3


Inspector General’s Semiannual Report to Congress

TABLE I
INSPECTOR GENERAL ISSUED REPORTS
WITH QUESTIONED COSTS
Dollar Value
Questioned Unsupported
Number Cost Costs

A. For which no management decision has been

made by the commencement of the reporting 0 0 0

period
B. Which were issued during the reporting period? 0 0 0

Subtotal (A + B) 0 0 0
C. For which a management decision was made 0 0 0

during the reporting period

(i) dollar value of disallowed costs 0 0 0

(ii) dollar value of costs not disallowed 0 0 0
D. For which no management decision has been 0 0 0

made by the end of the reporting period
E. Reports for which no management decision 0 0 0

was made within six months of issuance

April 1, 2008 — September 30, 2008 Page 16


Inspector General’s Semiannual Report to Congress

Commission apprised of funds that became available throughout the year (i.c., changed priorities and
program savings) and presented alternative spending options to meet previously unfunded needs. By

the end of the year, the agency reallocated approximately $1.3 million.

On the other hand, some of the FY 2007 appropriated funds were used for purposes other
than what the Appropriations Committees approved them for. The Committees have thresholds for
the movement of funds — which the agency exceeded only once. In this instance, the agency informed
the Appropriations Subcommittees of its intentions. But while not required to communicate all
modifications to its spending estimates, the OIG believes it is a good practice to informally discuss
significant changes with Committee — and OMB - staff, before these changes are implemented. The
OIG identified numerous examples where funds were reallocated — under the reprogramming
threshold — that still represented significant departures from the original estimates provided to the
Subcommittee. The Subcommittees were not informed of these changes until after the close of the
fiscal year. An e-mail or telephone call to committee staff to keep them apprised of changes is what

we have in mind.

The OIG also found that, in the rush to process multiple procurement actions in the waning
days of the fiscal year, the agency did not adhere to all procurement regulations. We found multiple
examples where proposals were not competed and minority set asides were not contacted. The OIG

made four recommendations to correct deficiencies noted in the report.

In A08-07, Implementation of the Federal Information Security Management Act for
Fiscal Year 2008, the review objectives were to assess compliance with FISMA and related
information security policies, procedures, standards and guidelines, and to test their effectiveness ona

representative subset of the agency’s information systems.

April 1, 2008 — September 30, 2008 Page 6


Semiannual Report
to the Congress

Covering the Period
April 1, 2008 to September 30, 2008

sBiTiMe 2


Inspector General’s Semiannual Report to Congress

at least every two years. PII is information which can be used to distinguish or trace an individual's
identity, such as his/her name, social security number, biometric records, etc., alone, or when
combined with other personal or identifying information which is linked or linkable to a specific
individual, such as date and place of birth, mother’s maiden name, etc. Section 522 also requires
certain agencies (including the FMC) to assign a Privacy Act Officer who is responsible for identifying
and safeguarding PII. This audit satisfies the required third-party review.

While the FMC has made progress in implementing privacy and data protection practices, it
has not always gone far enough to ensure that controls over PII in both paper and electronic form are
implemented. For example, the agency posted its privacy policy on the FMC website and created a
Privacy Impact Assessment (PIA) review tool. However, it did not issue guidelines or procedures for
conducting PIA’s on electronic information systems. A PIA review had only been conducted on one
of the agency’s four systems. Further, the web-posted policy was not posted in standardized,
machine-readable format to ensure that individuals using any one of a number of web browsers can

access it.

The OIG also noted that, contrary to OMB policy, the agency has not taken certain steps to
safeguard against a breach of PII. For example, the agency has not encrypted all data on mobile
computers/devices carrying agency data; required two-factor remote access authentication;
implemented a 30-minute inactivity timeout function for remote access; or logged and verified all

computer-readable data extracts from databases holding sensitive information.

Without implementing OMB’s technical security considerations, privacy data may be

vulnerable to unauthorized exposure.

April 1, 2008 — September 30, 2008 Page 9


Inspector General’s Semiannual Report to Congress

e FMC emergency preparedness documentation and Safety and Security of Employees and
Operations Plan/Continuity of Operations Plan (SEOP/COOP) did not address IT recovery in

sufficient detail.

In addition, the following three weaknesses were identified:

e A Plan of Action and Milestones (POA&M) process was suspended by OIT management in
FY 2008. Vulnerabilities were not tracked;

e Key aspects of Security Program were not implemented, including weaknesses with the
annual computer security awareness documentation, e-authentication process, and FMC

server configurations; and

e Removable media policies and procedures were not implemented.

FMC management cannot make credible risk-based determinations for its systems. FMC
management has not demonstrated an effective risk management process, as prescribed by National
Institute of Standards and Technology (NIST), and is not fully aware of the potential security control
weaknesses in its systems, thereby leaving its information and systems vulnerable to attack or

compromise.

The OIG made three recommendations in this limited evaluation. Management has agreed to

take the corrective actions.

In A08-08, Privacy and Data Protection Evaluation Report, the objective was to determine
if the FMC is complying with Section 522 of the Consolidated Appropriations Act, 2005, (42
U.S.C.A. § 2000ee-2). Section 522 requires an independent third-party review of agency use of

personally identifiable information (PII) and ofits privacy and data protection policies and procedures

April 1, 2008 — September 30, 2008 Page 8


Inspector General’s Semiannual Report to Congress

devices, This important control will help to ensure that the agency continues to stay within service

plan limits.

The agency also needs to scrutinize monthly bills more closely than it does now. We
identified overcharges for minimal amounts that, if not corrected, will continue to be billed.
Regardless of the amounts, this is simply wasteful and is casy to correct. Further, the agency should
revisit its BlackBerry service plan. Given the agency’s usage pattern over the prior 12 months, the
OIG believes that the agency could save about $8,400 a year (or $16,800 for a two-year plan) simply
by selecting a plan that better reflects this pattern while still providing ample overage allowances.
OIT should also review usage records to identify unused BlackBerry devices that the agency pays for
even though these devices are not being used. We found four assigned BlackBerry devices that were

rarely turned on.

The OIG made five recommendations to correct deficiencies noted in the report. Two of the
recommended actions have already been taken, and management has informed the OIG that the

remaining recommendations will be implemented by the end of this year.

In A08-06, Audit of the Federal Maritime Commission’s Budget Execution Processes,
Procedures and Policies for Fiscal Year 2007, the audit objectives were to determine whether (i) the
agency followed spending priorities and limitations provided to it by Congress, Office of Management
and Budget (OMB) and the Commission, (ii) budgetary controls over obligations were in place and
followed, and (iii) the agency complied with laws, regulations and internal policies and procedures in

executing its budget.

The OIG found that the agency generally follows budget practices and procedures used by
other agencies in the Federal government. Budget staff stayed within its appropriation and submitted

formal reprogramming requests to the Appropriations Committees when required. Staff kept the

April 1, 2008 —- September 30, 2008 Page 5


HOTLINE COMPLAINTS

The success of the OIG mission to prevent fraud, waste and abuse
depends on the cooperation of FMC employees and the public.

A CompPLAINT CAN BE REPORTED BY CALLING Our 24-HR DirEcT LINE

(202) 523-5865

E-maiL ADDRESs:

oig@fmc.gov

To PLAcE A ComPLAINT IN WRITING PLEASE MAIL To:

Federal Maritime Commission
Office of Inspector General
Room 1054

800 North Capitol Street, NW
Washington, DC 20573

To Be Opened By the IG Only

THE INFORMATION You PROVIDE Is CONFIDENTIAL AND You CAN BE ANONYMOUS

However, CAWERS ARE ENCOURAGED TO ASSIST THE INSPECTOR GENERAL BY
SUPPLYING INFORMATION AS To How THEY May Be CONTACTED For ADDITIONAL INFORMATION


Inspector General’s Semiannual Report to Congress

EXECUTIVE SUMMARY

This Semiannual Report to the Congress summarizes the activities and accomplishments of the
Federal Maritime Commission (FMC or Commission), Office of Inspector General (OIG), for the
period April 1, 2008, through September 30, 2008. During this period we issued four audits /
evaluations of FMC programs or activities, initiated a program inspection of the FMC’s employee
check-out procedures and identified five “management challenges” for inclusion in the FY 2008
Performance and Accountability Report (PAR). The OIG also initiated fieldwork on the annual
financial statement audit, and began a review of the OIG’s “audit universe” with the intent to increase
our focus on FMC core programs, including certification, licensing, trade analysis, enforcement and

outreach through area offices.

During this reporting period, the OIG opened and closed one preliminary investigation into
alleged travel abuse by FMC staff, and forwarded (i) one complaint to Department of Justice OIG for
follow up and disposition, (ii) four complaints regarding various maritime regulation issues to the
appropriate FMC bureaus/offices, and (iii) one complaint to another government agency with
jurisdiction over the subject matter of the complaint. In addition the OIG received four complaints
that we closed after a preliminary review. The OIG referred no matters to prosecutorial authorities

during the period.

In addition to these audit and investigative activities and outcomes, the OIG completed a first
draft of its new investigative manual, responded to questions from House Appropriations
Subcommittee majority and minority staff regarding OIG audits issued during the period, updated a
January, 2008, response to the Chairman and Ranking Minority Member of the House Committee on
Oversight and Government Reform pertaining to unimplemented audit recommendations and worked
with the agency’s webmaster to install a link on the FMC/OIG’s webpage that supports anonymous

communications to the OIG.

April 1, 2008 — September 30, 2008 Page 1


Inspector General’s Semiannual Report to Congress

To accomplish its mission, the ECIE members participate in interagency and inter-entity audit,
inspection and investigation projects to promote economy and efficiency in Federal programs and
operations and address more effectively government-wide issues of fraud, waste and abuse. The
Council members also develop policies, standards and approaches to aid in the establishment of a
well-trained and highly skilled IG workforce.

The Inspector General and Assistant Inspector General continued to participate in ECIE and
the Federal Audit Executive Council (FAEC) activities. The FAEC is comprised of senior audit staffs
that discuss and coordinate issues affecting the Federal audit community with special emphasis on

audit policy and operations of common interest to FAEC members.

During the reporting period, the OIG responded to an OIG wide request from the Chairman
and Ranking Minority Member of the House Committee on Government Reform, to follow up onan
earlier (January, 2008) request to identify all unimplemented audit recommendations issued since
January, 2001. As of July 11, 2008, the OIG had identified eight recommendations that had not been
implemented by the agency. The OIG reported to the Committee that, based on information provided

by FMC program offices, it expected to close these remaining recommendations within a year.

Significant Management Decisions

If the IG disagrees with any significant management decision, Section 5(a)(12) of the
Inspector General Act requires that such disagreement be reported in the semiannual report. Further,
Section 5(a)(11) of the Act requires that any decision by management to change its response to a
significant resolved audit finding must also be disclosed in the semiannual report. For this reporting
period, there were no significant management decisions made on which the IG disagreed, and

management did not revise an earlier decision on an OIG audit recommendation.

April 1, 2008 — September 30, 2008 Page 12


Inspector General’s Semiannual Report to Congress

Contacting the Office of Inspector General

Employees and the public are encouraged to contact the OIG regarding any incidents of
possible waste, fraud or abuse occurring within FMC programs and operations. The OIG telephone
number is (202) 523-5863. To report suspected wrongdoing, employees or the public may call the
OIG Hotline on (202) 523-5865. A confidential or anonymous message can be left 24 hours a day.
Complaints or allegations of fraud, waste or abuse can also be emailed directly to the Inspector

General at oig@fime.goyv. The OIG link on its webpage enables the sender to remain anonymous.

April 1, 2008 — September 30, 2008 Page 14


TABLE OF CONTENTS

Transmittal Letter

Executive Summary .........cscccssscessesesesesesescscsescscscsecscsssesscsssesecscsessscscsesscscacsasssestsvsacacsvaeneaees
Background cessvssssscssnncanscesusesssisisssssseevsveusestststsustssowtsss sev scas scsi sbccts tsa wastes beatae aN TES
Audits/Evaluations ............

Summary of Audits Issued Durin;
Audits and Reviews in Process.

Investigative Activities

OthGr OIG (A CHIVINIES ssscrocsepcsasasereseexegecpsasssistaiitetassdis cs ansonennonsscugueasenectennereenerneonennerenesemeeneeassurasne 11
Summary of Inspector General Reporting Requirements
Table I. IG Issued Reports with Questioned Costs ...........:sssecsesssessessessesesesserseeneenenneess 16

Table II. IG Issued Reports with Recommendations
that Funds be Put to Better Use


FEDERAL MARITIME COMMISSION
Washington, DC 20573

October 30, 2008

Office of Inspector General

Dear Commissioners:

The attached report is submitted in accordance with Section 5 of the Inspector General Act of
1978, as amended. It summarizes the activities of the Office of Inspector General (OIG) for the period
April 1, 2008, to September 30, 2008. The Act requires that you transmit the report to the appropriate
Congressional committees within 30 days of receipt. Your transmittal should also include any
comments you consider appropriate and other statistical tables and reports required by law.

During this period the OIG issued four audits/evaluations of Federal Maritime Commission
(FMC) programs or activities, began fieldwork on the annual financial statement audit, initiated a
program inspection of the FMC’s employee check-out procedures and identified five “management
challenges” for inclusion in the FY 2008 Performance and Accountability Report. We also began a
review of the OIG’s “audit universe” to increase our focus on the agency’s core programs, including,
licensing, trade analysis, enforcement and outreach through area offices.

The OIG opened and closed one preliminary investigation into alleged travel abuse by FMC staff,
and forwarded (i) one complaint to Department of Justice OIG for follow up and disposition, (ii) four
complaints regarding various maritime regulation issues to the appropriate FMC bureau/office, and (iii)
one complaint to an appropriate government agency. The OIG closed four complaints with no action
taken. We referred no matters to prosecutorial authorities during the period.

In addition to these audit and investigative activities and outcomes, the OIG completed a draft of
the its new investigative manual, responded to questions from House Appropriations Subcommittee staff
regarding OIG audits issued during the period, updated a January, 2008, response to the Chairman and
Ranking Minority Member of the House Committee on Oversight and Government Reform, pertaining to
unimplemented audit recommendations and worked with the agency’s webmaster to install a link on the
FMC/OIG’s webpage that supports anonymous communications to the OIG.

As in the past, management has been responsive in attempting to implement all OIG
recommendations. I appreciate management’s support and I look forward to working with you in our
ongoing efforts to promote economy and efficiency in agency programs.

fore

Adam R. Trzediak
Inspector General


Inspector General’s Semiannual Report to Congress

FMC management generally concurred with our findings and recommendations. Management
informed the OIG that most of the findings will be addressed by the agency’s recently-hired
information security contractor, who is tasked with bringing the agency’s information security

program up to current FISMA and OMB standards.

Audits and Reviews in Process

The OIG began fieldwork on the FY 2008 financial statement audit pursuant to requirements
in the Accountability of Tax Dollars Act of 2002, which requires most federal agencies, including the
FMC, to produce audited financial statements. The purpose of the audit is to express an opinion on
the financial statements of the Federal Maritime Commission for the fiscal year ending September 30,
2008. The principal statements to be audited include the (a) Balance Sheet; (b) Statement of Net
Cost; (c) Statement of Changes in Net Position; (d) Statement of Budgetary Resources; (e) Statement
of Financing; (f) Statement of Custodial Activity; and notes to the financial statements. The OIG will
also test the internal controls associated with the movement of transactions through the FMC’s

financial system, and assess compliance with selected laws and regulations.

The OIG also began fieldwork on a program inspection of the agency’s employee check out
process. The objectives of this inspection are to assess controls in place to remove separated
employees from agency systems, to collect outstanding balances owed to the agency and to retrieve

agency materials and equipment.

INVESTIGATIVE ACTIVITIES
The Inspector General Act of 1978, as amended, provides that the IG may receive and
investigate complaints or information concerning possible allegations of fraud, waste and abuse
occurring within FMC programs and operations. Matters of possible wrongdoing are referred to the
OIG in the form of allegations or complaints from a variety of sources, including FMC employees,

other government agencies and the general public.

April 1, 2008 — September 30, 2008 Page 10


Inspector General’s Semiannual Report to Congress

Access to Information

The IG is to be provided with ready access to all agency records, information or assistance
when conducting an investigation or audit. Section 6(b)(2) of the IG Act requires the IG to report to
the agency head, without delay, if the IG believes that access to required information, records or
assistance has been unreasonably refused, or otherwise has not been provided. A summary of each
report submitted to the agency head in compliance with Section 6(b)(2) must be provided in the

semiannual report in accordance with Section 5(a)(5) of the Act.

During the reporting period, the OIG did not encounter any difficulties in obtaining assistance
or access to agency records. Consequently, no report was issued by the IG to the agency head in
accordance with Section 6(b)(2) of the IG Act.

Audit Resolution

As of the end of this reporting period, all OIG audit recommendations for reports issued in
prior periods have been resolved. That is, management and the OIG have reached agreement on what
actions need to be taken. As noted above, cight of these recommendations remain open, i.e.,
management and OIG agree as to the action that management needs to take but management has not

yet taken the action to close them.

April 1, 2008 — September 30, 2008 Page 13