Inspector General’s Semiannual Report to Congress

If the IG disagrees with any significant management decision, Section 5(a)(12) of the
Inspector General Act requires that such disagreement be reported in the semiannual report. Further,
Section 5(a)(11) of the Act requires that any decision by management to change its response to a
significant resolved audit finding must also be disclosed in the semiannual report. For this reporting
period, there were no significant management decisions made on which the IG disagreed and

management did not revise an earlier decision on an OIG audit recommendation.

Access to Information
The IG is to be provided with ready access to all agency records, information or assistance
when conducting an investigation or audit. Section 6(b)(2) of the IG Act requires the IG to report to
the agency head, without delay, if the IG believes that access to required information, records or
assistance has been unreasonably refused, or otherwise has not been provided. A summary of each
report submitted to the agency head in compliance with Section 6(b)(2) must be provided in the

semiannual report in accordance with Section 5(a)(5) of the Act.

During the reporting period, the OIG did not encounter any difficulties in obtaining assistance
or access to agency records. Consequently, no report was issued by the IG to the agency head in
accordance with Section 6(b)(2) of the IG Act.

Audit Resolution
As of the end of this reporting period, all OIG audit recommendations for reports issued in
prior periods have been resolved. That is, management and the OIG have reached agreement on what

actions need to be taken.

Contacting the Office of Inspector General

April 1, 2007 — September 30, 2007 Page 11



Inspector General’s Semiannual Report to Congress

BACKGROUND

The FMC is an independent agency responsible for the regulation of oceanborne
transportation in the foreign commerce of the United States. The principal statutes or statutory
provisions administered by the Commission are the Shipping Act of 1984, as amended by the Ocean
Shipping Reform Act of 1998; the Foreign Shipping Practices Act of 1988; and Section 19 of the
Merchant Marine Act of 1920.

The FMC is currently headed by four Commissioners nominated by the President and
confirmed by the Senate, each serving five-year terms. During the prior reporting period the
Chairman resigned. A new Chairman has not been appointed as of this writing. As a result, the
remaining members of the Commission are jointly serving as the agency’s chief executive and

administrative officer.

In Fiscal Year (FY) 2007, the Commission funded 119 full-time equivalent positions with a
total appropriation of $20,427,910. Although the majority of the Commission’s personnel are located
in Washington, DC., the Commission also maintains a presence in Los Angeles, CA; Miami, Florida;
Seattle, Washington; New York, New York; New Orleans, Louisiana; and Houston, Texas; through
area representatives who serve the major ports and transportation centers within their respective

geographic areas. In addition, two at-large area representatives operate out of Washington, DC.

The FMC’s Office of Inspector General (OIG) was established in 1989 as required by the
Inspector General Act Amendments of 1988 (5 U.S.C. app.). The OIG is an independent audit and
investigative unit headed by an Inspector General (IG) who reports directly to the Chairman of the
FMC. To aid the FMC in accomplishing its mission, the OIG was provided two full time staff and a
budget of $400,000 for Fiscal Year 2007.

April 1, 2007 —- September 30, 2007 Page 2


Inspector General’s Semiannual Report to Congress

TABLE II

INSPECTOR GENERAL ISSUED REPORTS

WITH RECOMMENDATIONS

THAT FUNDS BE PUT TO BETTER USE

Number Dollar Value
. For which no management decision has been made 0 0
by the commencement of the reporting period
. Which were issued during the reporting period 0 0
Subtotal (A +B) 0 0
. For which a management decision was made during 0 0
the reporting period
(i) dollar value of recommendations that were 0 0
agreed to by management
(ii) dollar value of recommendations that were 0 0
not agreed to by management
. For which no management decision has been made 0 0
by the end of the reporting period
. Reports for which no management decision was 0 0
made within six months of issuance
April 1, 2007 — September 30, 2007 Page 15


Inspector General’s Semiannual Report to Congress

measures are based on nine months of actual data and three months of estimated industry trends. We
also recommended that the agency remind offices whose workload unit statistics are dependent on
manual counts to institute controls to guard against miscounts. One such control is to have two

individuals perform the count and to reconcile any differences between the two numbers if they exist.

Management agreed with the OIG recommendations and has informed the OIG that readers
will be made aware when estimates are used in the PAR and that controls will be implemented to

identify crrors before information is downloaded to the PAR.

In A07-03, Penetration Test of FMC’s Outward-Facing Network, the OIG performed a
penetration test of the FMC’s network. The objectives of the test were to (i) determine whether the
FMC network can be accessed by unauthorized users; (ii) document the risks to FMC’s network
caused by threats from the Internct; and (iii) identify vulnerabilities (if any) residing on the FMC’s
firewall.

The external penctration testing was conducted in accordance with guidance from the
Government Accountability Office (GAO), the National Institute of Standards and Technology
(NIST) and other best practices within the information technology security industry. Testing was
performed with limited knowledge of the FMC network, e.g., information that would be obtainable

from public sources.

The penetration testing did not identify any significant vulnerabilities on the FMC network.
The firewall is secure and did not allow unauthorized access to agency electronic files and databases.
On the other hand, the OIG did identify some issues surrounding the monitoring of internet activity.
The OIG presented its results to management for corrective action. Management informed the OIG
that corrective action is complete. (Due to the sensitive nature of the report findings and

recommendations, the document was not publicly released.)

April 1, 2007 —- September 30, 2007 Page7


Inspector General’s Semiannual Report to Congress

Issued Audits and Reviews

Audit Report Number Subject of Audit

A07-02 Audit of Contracts FMC-05-00021 and FMC-
06-00007, Procurement of Consulting Services

ORO7-02 Data Accuracy of FMC’s FY 2006 Performance
and Accountability Report

A07-03 Penetration Test of FMC’s Outward-Facing
Network

OR07-03 The Federal Maritime Commission’s

Implementation of the Federal Information
Security Management Act (OMB Template)

Summary of Audits Issued During the Current Period

In A07-02, Audit of Contracts FMC-05-00021 and FMC-06-00007, Procurement of
Consulting Services the objective was to determine whether Federal Acquisition Regulation (FAR)
provisions were followed throughout all phases of the contract.' To meet this objective, the OIG
reviewed (i) how the need was determined, (ii) the statement of work, including deliverables, (iii) the
selection process, evaluation criteria and scoring, (iv) contract award, (v) contract monitoring, (vi)
approval of invoices, including all supporting documentation for days worked, mileage, lodging and
other billed expenses, and (vii) the justification and timing of contract modifications. The scope of

our review covered the period December 2004 through October 2006.

' The Federal Acquisition Regulation is established for the codification and publication of uniform policies and
procedures for acquisition by all executive agencies. As such, it is the definitive authority for procurement actions
implemented by the Federal government.

April 1, 2007 — September 30, 2007 Page 4


Inspector General’s Semiannual Report to Congress

The OIG is responsible for conducting audits and investigations relating to the programs and
operations of the FMC. Audits are conducted for the purpose of finding and preventing fraud, waste
and abuse and to promote economy, efficiency and effectiveness within the agency. OIG
investigations seek out facts related to allegations of wrongdoing on the part of FMC employees and
individuals, or entities having contracts with or obtaining benefits from the agency. The Inspector
General Act provides that the OIG shall have access to all agency records and may subpoena records

from entities outside of the agency in connection with an audit or investigation.

The OIG is required by law to prepare a semiannual report summarizing its audits and
investigations during the immediately preceding six-month period. The report is sent to the FMC
Chairman, the President of the Senate, the Speaker of the House and FMC’s appropriating and
authorizing committees. This dual reporting requirement facilitates and ensures the independence of

the Office.

AUDITS/EVALUATIONS

During this semiannual period, the OIG issued an audit of contracts for consulting services
provided to FMC management and a performance review of the accuracy of information contained in
the FY 2006 Performance and Accountability Report (PAR). The OIG also completed a penetration
test of the agency’s outward-facing network to identify vulnerabilities that could be used to exploit
the FMC firewall. The OIG completed fieldwork on its annual information security evaluation, to
include testing for unauthorized wireless networks used by FMC employees, and began our annual

financial statement audit for FY 2007 and a review of the agency’s management of telephone services.

April 1, 2007 — September 30, 2007 Page 3


HOTLINE COMPLAINTS

The success of the OIG mission to prevent fraud, waste and abuse
depends on the cooperation of FMC employees and the public.

A COMPLAINT CAN BE REPORTED BY CALLING OuR 24-HR DiRECT LINE

(202) 523-5865

E-mail ADDRESS:

oig@fmc.gov

To PLACE A ComPLAINT IN WRITING PLEASE MAIL To:

Federal Maritime Commission
Office of Inspector General
Room 1054

800 North Capitol Street, NW
Washington, DC 20573

To Be Opened By the IG Only

THE INFORMATION YOU PROVIDE IS CONFIDENTIAL AND You CAN BE ANONYMOUS

HOWEVER, CALLERS ARE ENCOURAGED TO ASSIST THE INSPECTOR GENERAL BY
SWRPLYING INFORMATION As To How THEY May Be ContACTED FOR ADDITIONAL INFORMATION


Inspector General’s Semiannual Report to Congress

Office of Consumer Affairs and Dispute Resolution Services; Office of Administration; Office of the
General Counsel; Office of Administrative Law Judges; and the Bureaus of Enforcement, Trade

Analysis, and Certification and Licensing.

The PAR provides program and financial information that enables the President, Congress and
the public to assess Agency performance relative to its mission and resources. The report is divided
into three sections (chapters) and six appendices. Chapter One, Management’s Discussion and
Analysis, provides an overview of the Agency, its missions and responsibilities, as well as its financial
performance. Chapter Two, Program Performance, presents information on the performance of the
FMC, the FMC’s performance measurement system, resource requirements to meet strategic goals
and a summary of performance relative to specific program goals. Chapter Three, Auditor ’s Report
and Financial Statements, contains the auditor’s opinion of the Agency’s financial statements and the

statements themselves.

Based on discussions with senior agency staff and Office of Administration (OA) managers,
the OIG learned that the agency did not update PAR performance data estimates before publicly
releasing the information. Nor did it indicate in the PAR that the performance data was based on a
combination of actual and estimated information. As a result, a significant amount of performance

data appearing in the PAR was inaccurate.

In addition to identifying differences between the estimates and actuals in the PAR caused by
reliance on estimated figures, the OIG also checked, on a limited basis, the source documentation
behind the estimated and final numbers. In other words, we reviewed how reliable select systems
were when producing workload data for reporting purposes. We found that two of the three

processes reviewed produced inaccurate workload units.

To address the findings, the OIG recommended that the agency ensure that estimates are

updated prior to their public release in the PAR or that the reader be advised that the performance

April 1, 2007 — September 30, 2007 Page 6


Semiannual Report
To the Congress

Covering the Period
April 1, 2007 to September 30, 2007



Inspector General’s Semiannual Report to Congress

INVESTIGATIVE ACTIVITIES

The Inspector General Act of 1978, as amended, provides that the IG may receive and
investigate complaints or information concerning the possible allegations of fraud, waste and abuse
occurring within FMC programs and operations. Matters of possible wrongdoing are referred to the
OIG in the form of allegations or complaints from a variety of sources, including FMC employees,

other government agencies and the general public.

During this reporting period, the OIG opened and closed one preliminary investigation into
allegations of wrongdoing by FMC staff and/or individuals doing business with the agency. The
FMC/OIG was assisted by the Electronic Crimes Team from the Social Security Administration’s OIG.
Results were discussed with management and controls were implemented to address vulnerabilities
uncovered during the review. In addition, the OIG responded to two public requests to look into
various maritime-related issues and referred three “hotline” complaints to the appropriate FMC

program offices for disposition.

The OIG referred no matters to prosecutorial authorities during the period.

OTHER OIG ACTIVITIES

Review of Legislation
As required by the Inspector General Act of 1978, as amended, the Office of Inspector

General routinely reviews proposed legislation and regulations. The purpose of these reviews is to
assess whether the proposed legislation or regulation (1) impacts the economy and efficiency of FMC
programs and operations, and (2) contains adequate internal controls to prevent and detect fraud and
abuse. During this period, a number of Commission Orders/policy guidelines were reviewed by this
Office.

April 1, 2007 —- September 30, 2007 Page 9


Inspector General’s Semiannual Report to Congress

Audits and Reviews in Process

The OIG completed a draft report on the agency’s compliance with the Federal Information
Security Management Act. The evaluation responds to an annual reporting requirement for OIGs
contained in the Act. In addition to performing tests associated with systems currently in production,
the OIG also performed a wireless network vulnerability test, or, as it is known by security experts, a
“war walk.” The objectives of the testing were to identify vulnerabilities, if they existed, in the

wireless network.

The wireless network testing was conducted in accordance with guidance from GAO, NIST
and other best practices within the information technology security industry. A draft report was
shared with management soon after the testing was completed. The test results are not publicly

available due to their sensitive nature.

The OIG began fieldwork on its annual financial statement audit pursuant to requirements in
the Accountability of Tax Dollars Act of 2002, which required most federal agencies, including the
FMC, to produce audited financial statements. The purpose of the audit is to express an opinion on
the financial statements of the Federal Maritime Commission for the fiscal year ending September 30,
2007. The principal statements to be audited include the (a) Balance Sheet; (b) Statement of Net
Cost; (c) Statement of Changes in Net Position; (d) Statement of Budgetary Resources; (e) Statement
of Financing; (f) Statement of Custodial Activity; and notes to the financial statements. The OIG will
also test the internal controls associated with the movement of transactions through the FMC’s

financial system, and assess compliance with selected laws and regulations.

The OIG also began fieldwork on the management of telephone services at the FMC. The
OIG will assess controls in place to ensure that the agency receives and pays for only those services

that it needs to perform its mission.

April 1, 2007 - September 30, 2007 Page 8


Inspector General’s Semiannual Report to Congress

The audit found that the procurement action entered into with the contractor did not follow
the requirements for contracting as contained in the Federal Acquisitions Regulation (FAR) or the
Federal Maritime Commission’s (FMC) own internal policies and procedures. We also questioned
whether this contract was adequately monitored by the agency. The contractor was not required to
submit progress reports and the Statement of Work contained no deliverables or timeframes to hold
the contractor accountable. Invoices submitted by the contractor contained no FAR-required details,
e.g., receipts, time sheets, mileage calculations, etc., that would allow anyone reviewing these claims

to verify their veracity or their accuracy. All such invoices were, nonetheless, approved and paid.

Moving forward, the OIG believes that the agency should rely on assistance from the Bureau
of Public Debt (BPD), the agency’s administrative services agent, for contract support. BPD has
contracting experts that let over $200 million in contracts each year. By contrast, the FMC enters
into few contracts totaling less than $800,000 annually. The agency simply does not do enough
contracting to maintain the expertise it needs to stay current with complex federal acquisitions

relations.

The OIG also recommended that the agency recover $65,922 of $159,329 in fees and
expenses it paid to the contractor over a two year period, due primarily to the absence of receipts,
explanations and/or documentation to support his claims. Subsequent to issuance of the audit,
management identified telephone records that supported approximately $9,000 of previously
unsupported billings by the contractor. The OIG agreed with management’s methodology and with

its decision to reduce the amount to be recovered to $56, 421.

In ORO7-02, Data Accuracy of FMC’s FY 2006 Performance and Accountability Report,
the objectives were to determine, on a sample basis, whether (i) information externally reported in the
FY 2006 PAR is accurate, and (ii) processes used to compile the data are reliable. To meet our

objectives, we interviewed and/or obtained relevant information from the Office of the Secretary;

April 1, 2007 —- September 30, 2007 Page 5


Inspector General’s Semiannual Report to Congress

EXECUTIVE SUMMARY

This Semiannual Report to the Congress summarizes the activities and accomplishments of the
Federal Maritime Commission (FMC or Commission), Office of Inspector General (OIG) for the
period April 1, 2007, to September 30, 2007. During this period we issued one contract audit, one
performance audit, and completed a penetration test of the agency’s outward-facing network to
identify vulnerabilities that could be used to exploit the FMC firewall. The OIG also completed a draft
report on the agency’s information security posture pursuant to the Federal Information Security
Management Act of 2002. The review included a “war-walking” exercise whereby the OIG tested for

rogue or unauthorized networks and network access points.

On the investigative side, we opened and closed one preliminary investigation into allegations
of wrongdoing by FMC staff, responded to two public requests to look into various maritime-related

issues and referred three “hotline” complaints to the appropriate FMC program offices for disposition.

In addition to these audit and investigative outcomes, the OIG revised its strategic plan for
fiscal years 2008 - 2013, developed a Memorandum of Understanding (MOU) between the Office of
Inspectors General at the FMC and the Federal Trade Commission to implement a quality assurance
program for our audit responsibilities, and worked with FMC senior management to implement an
internal control questionnaire to assist management to comply with regulations issued by the Office of

Management and Budget in Circular A-123, Management's Responsibility for Internal Control.

Details on these and other activities are provided below.

April 1, 2007 — September 30, 2007 Page 1


Inspector General’s Semiannual Report to Congress

Employees and the public are encouraged to contact the OIG regarding any incidents of
possible waste, fraud or abuse occurring within FMC programs and operations. The OIG telephone
number is (202) 523-5863. To report suspected wrongdoing, employees or the public may call the
OIG Hotline on (202) 523-5865. A confidential or anonymous message can be left 24 hours a day.
Complaints or allegations of fraud, waste or abuse can also be emailed to OIG@FMC.GOV.

April 1, 2007 —- September 30, 2007 Page 12


Inspector General’s Semiannual Report to Congress

TABLE I

INSPECTOR GENERAL ISSUED REPORTS
WITH QUESTIONED COSTS

Dollar Value

Questioned Unsupported

A. For which no management decision has been
made by the commencement of the reporting
period

B. Which were issued during the reporting period?

Subtotal (A + B)

C. For which a management decision was made
during the reporting period

(i) dollar value of disallowed costs
(ii) dollar value of costs not disallowed

D. For which no management decision has been
made by the end of the reporting period

E. Reports for which no management decision
was made within six months of issuance

April 1, 2007 ~ September 30, 2007

Number Cost Costs
0 0 0
1 $56,421 0
1 $56,421 0
1 $56,421 0
1 $56,421 0
0 0 0
0 0 0
0 0 0
Page 14


TABLE OF CONTENTS

Transmittal Letter
Executive Summary .......ccesesesesesssesesesesesesesesesesesesesescseseseseseseseseseseseseacaeaeaeseseseseseseseseseseseseseeeees 1

Ba tk 210d css sserunssnneaseavswanananniendnnsstnaanser veea wien enUNT UR RNNETSS TeCiTS eSSOTIOIS IEC TCN GCC. 2

Audits/Evaluations
Summary of Audits Issued During the Current Perio
Audits and Reviews in Process ...

TnvestigativevACtivities ss.ssscsevsesssvvsssessawcansswscsvasexscuususteavsnunsrcuetavessacsapsra tee eeCte Ota UNTO E NOIR 9
OUT OLGA CUVIGS sxc seszcseesysgsperspycuscpsspeenrn ee recas aes eae ICUS ELATED ETS reer eanernegosraeneeneens 9
Summary of Inspector General’s Reporting Requirements. ................::cseccecceeeeeeeeeeeeeeeteeees 13

Table I.. IG Issued Reports‘ with Questioned. Costs ss.ssssscsssssrssssscssasicesssssarecissesvensssiseves 14

Table II. IG Issued Reports with Recommendations That Funds Put to Better Use........ 15


FEDERAL MARITIME COMMISSION
Office of Inspector General
Washington, DC 20573-0001

October 23, 2007

Tel: — (202) 523-5863
Office of Inspector General Fax: (202) 566-0043
E-mail: oig@fme.gov

Dear Commissioners:

The attached report is submitted in accordance with Section 5 of the Inspector
General Act of 1978, as amended by the Inspector General Act amendments of 1988. It
summarizes the activities of the Office for the period April 1, 2007, to September 30,
2007. The Act requires that you transmit the report to the appropriate committees of the
Congress within 30 days of receipt. Your transmittal should also include any comments
you consider appropriate and other statistical tables and reports required by law.

During this period we issued one contract audit and one performance audit to the
Commission. The OIG also completed a penetration test of the agency’s outward-facing
network to identify vulnerabilities that could be used to exploit the FMC firewall. The
OIG completed a draft report on the agency’s information security posture pursuant to the
Federal Information Security Management Act of 2002. The review included a “war-
walking” exercise whereby the OIG tested for rogue or unauthorized networks and
network access points.

On the investigative side, we opened and closed one preliminary investigation into
allegations of wrongdoing by FMC staff, responded to two public requests to look into
various maritime-related issues and referred three “hotline” complaints to the appropriate
FMC program offices for disposition.

In addition to these audit and investigative outcomes, the OIG revised its strategic
plan for fiscal years 2008 - 2013, developed a Memorandum of Understanding between
the Office of Inspectors General at the FMC and the Federal Trade Commission to
implement a quality assurance program for our audit function, and worked with FMC
senior management to implement an internal control questionnaire to assist management
to comply with regulations issued by the Office of Management and Budget in Circular
A-123, Management's Responsibility for Internal Control.

As in the past, management has been responsive in attempting to implement all

OIG recommendations. | appreciate management’s support and I look forward to working
with you in our ongoing efforts to promote economy and efficiency in agency programs.

Rak i BKM
nel

‘Hinaiar Ge


Inspector General’s Semiannual Report to Congress

Executive Council on Integrity and Efficiency Activities
The Executive Council on Integrity and Efficiency (ECIE) was established by Executive Order
12805 on May 11, 1992, to:

e address integrity, economy and effectiveness issues that transcend individual government

agencies; and

e enhance the professionalism and effectiveness of IG personnel throughout the government.

To accomplish its mission, the ECIE members participate in interagency and inter-entity audit,
inspection and investigation projects to promote economy and efficiency in Federal programs and
operations and address more effectively government-wide issues of fraud, waste and abuse. The
Council members also develop policies, standards and approaches to aid in the establishment of a
well-trained and highly skilled IG workforce.

The Inspector General and Assistant Inspector General continued to serve on the ECIE and
the Federal Audit Executive Council (FAEC). The FAEC is comprised of senior audit staff who
discuss and coordinate issues affecting the Federal audit community with special emphasis on audit

policy and operations of common interest to FAEC members.

During this reporting period, the FMC/OIG entered into an MOU with the OIG at the Federal
Trade Commission to jointly establish a quality assurance program for audit reports. Due to the size
and limited resources of each office, developing a formal program to review audit processes and
outcomes for the relatively few audit reports issued by each office in order to comply with
Government Auditing Standards is not practical or cost effective. On the other hand, by providing
report review services on a reciprocal basis, an independent determination can be made as to the

audit’s adherence to standards on an as-needed basis while effectively using limited staff resources.

Significant Management Decisions

April 1, 2007 — September 30, 2007 Page 10


Inspector General’s Semiannual Report to Congress

SUMMARY OF INSPECTOR GENERAL’S REPORTING REQUIREMENTS

IG Act
Reference Reporting Requirement Page(s)

Section 4(a)(2) Review of legislation and regulations 9

Section 5(a)(1) Significant problems, abuses and deficiencies None

Section 5(a)(3) Prior significant recommendations on which 11
corrective actions have not been made

Section 5(a)(4) Matters referred to prosecutive authorities 9

Section 5(a)(5) Summary of instances where information was 11
refused

Section 5(a)(6) List of audit reports by subject matter, showing 14-15
dollar value of questioned costs and funds put to
better use

Section 5(a)(7) Summary of each particularly significant report 4

Section 5(a)(8) Statistical tables showing number of reports and 14
dollar value of questioned costs

Section 5(a)(9) Statistical tables showing number of reports and 15
dollar value of recommendations that funds be put
to better use

Section 5(a)(10) Summary of each audit issued before this reporting None
period for which no management decision was
made by the end of the reporting period

Section 5(a)(11) Significant revised management decisions 11

Section 5(a)(12) Significant management decisions with which the 11
inspector general disagrees

April 1, 2007 —- September 30, 2007 Page 13