FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

FINAL REPORT 

Review of Outstanding Recommendations 

as of June 2013 

 August 2013 

ASSIGNMENT No. OIG -13-03 
 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

Report Overview 

As required by the Inspector General Act of 1978, as amended, the Office of Inspector General (OIG) 

is responsible for conducting audits of the Federal Election Commission’s (FEC) programs and 

operations. In addition to conducting and supervising audits, the OIG also has the responsibility to 

conduct audit follow-ups to ensure that management has effectively implemented OIG 

recommendations. Audit follow-up, to include the timely implementation of audit recommendations 

by FEC management, is required by Office of Management and Budget Circular A-50, Audit 

Followup, as revised, and FEC Directive 50: Audit Follow-Up. 

Management has established a process to adhere to Directive 50 and provide semiannual status 

reports to the Commission of their progress concerning outstanding OIG recommendations. The 

official status (open/closed) of OIG recommendations is determined by the OIG once the OIG has 

verified that management has adequately implemented the corrective actions. The Inspector General 

can also make a decision to close recommendations or seek resolution from the Commission for 

recommendations where the OIG and management disagree. The number of outstanding 

recommendations is reported to the Commission and Congress in the OIG’s Semiannual Reports to 

Congress. 

This report provides the Commission with details regarding the: 

 OIG’s Audit Follow-up process, see page 2; 

 Audit follow-up meetings/communications with management to determine the status of 

outstanding audit recommendations, starting on page 3: 

a. Audit Follow-up Review of the FEC’s Employee Transit Benefit Program, see page 4; 

b. Audit of the Commission’s Property Management Controls, see page 4; 

c. 2010 Follow-up Audit of Privacy and Data Protection, see page 5; 

d. 2010 Follow-up Audit of Procurement and Contract Management, see page 6; 

e. Inspection of FEC’s Kastle Key Program, see page 6; 

f. Quality Assessment Audit of the Audit Division, see page 6; 

 Additional Outstanding Recommendation Closures, see page 7; and
 

 OIG Concerns, see page 9.
 

For this review period, the OIG reviewed six audits and inspections that had a total of 114 

recommendations that were outstanding for six months or more as of December 2012, the date of our 

last report. Collectively, the OIG closed 42 outstanding recommendations based on the OIG’s review 

of management’s implementation of corrective action, or changes made to management processes 

that would satisfy the audit issue. Since our December 2012 report on the status of outstanding 

recommendations, the Quality Assessment Audit of the Audit Division report, released in September 

2012, was added to the audit follow-up process because the recommendations have been outstanding 

for more than six months. The OIG’s January 2013 Inspection of the FEC’s Disaster Recovery Plan 

and Continuity of Operations Plans report contained 30 recommendations, which are not included as 

these recommendations had not been outstanding for six months or more during this period of review. 

The follow-up on the status of the inspection recommendations will be reported in the next 

semiannual report of this kind. 

1 
 

 

 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

In addition, at the IG’s discretion, four recommendations from the 2010 Follow-up Audit of Privacy 

and Data Protection and two from the Audit of the Commission’s Property Management Controls 

were closed. Management disagreed with the OIG’s recommendations and decided not to apply the 

resources necessary to fully or adequately implement these recommendations. However, the OIG 

continues to believe these recommendations are important, and would reduce the risk of fraud, waste, 

and/or abuse to FEC programs if implemented. For details, see the Additional Outstanding 

Recommendation Closures section of this report on page 7. 

Audit Follow-up Process 

At the conclusion of each OIG audit and inspection, it is management’s responsibility to develop a 

corrective action plan (CAP). The CAP identifies the plan management has developed to address the 

OIG’s findings and recommendations. The CAP should detail the following: 

1. assignment of Audit Follow-up Official (AFO); 

2. OIG finding(s); 

3. OIG recommendation(s); 

4. detailed corrective action to implement the OIG’s recommendation(s); 

5. FEC staff person with responsibility to implement each task; and 

6. expected completion dates. 

Once management drafts the CAP, the OIG then reviews their CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the final 

CAP to the Commission with a courtesy copy to the OIG. 

FEC Directive 50 requires management to: 

“(3) Conduct regular meetings with the Inspector General throughout the year to follow-up 

on outstanding findings and recommendations, and include reports of these meetings in the 

written corrective action plan and semi-annual reports required to be presented to the 

Commission;...” 

In order to work effectively with FEC management in adhering to Directive 50, and to ensure 

continuous monitoring and adequate and timely audit resolution, the OIG meets with management at 

least semiannually to discuss the progress of outstanding OIG recommendations. These meetings 

provide management with timely OIG feedback for their semiannual reports to the Commission and 

enables the OIG to keep abreast of management’s progress. The OIG schedules these meetings and 

provides management with the results of our review prior to management’s reporting deadlines to the 

Commission. The OIG also reports semiannually (status as of June & December) to the Commission 

and management on recommendations that the OIG has closed (if any) based on follow-up reviews. 

The semiannual meetings are also intended to assist the audit follow-up official in following 

provisions 4 through 6 of Directive 50, which are listed as follows: 

2 
 

 

 

 

 

 

 

 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

“(4) Respond in a timely manner to all audit reports; 

 (5) Engage in a good faith effort to resolve all disagreements; and 

 (6) Produce semi-annual reports that are submitted to the agency head.” 

Follow-up Meetings & Communications 

To discuss the current status and progress of each outstanding recommendation, the OIG held 

meetings and communicated via email with the applicable audit follow-up official, and/or 

management staff for each audit/inspection. Out of the six follow-up reviews, the OIG was able to 

close recommendations from all six audits/inspection. 

Although several recommendations were closed, further corrective action from management is still 

needed to implement the remaining outstanding recommendations. Specifically, the OIG has 

concerns regarding the lack of progress and focus from the FEC’s Privacy Team regarding the 

outstanding recommendations for the 2010 Follow-up Audit of Privacy and Data Protection, and the 

Information Technology Division (ITD) regarding the Audit of the Commission’s Property 

Management Controls (release date 3/2010). See the table below for a summary of progress made by 

FEC management and the outstanding recommendations as of June 2013. 

Outstanding Audit Recommendations Status Table 

Title & Report Date 

of OIG 

Audits/Inspection 

Total Outstanding 

Recommendations 

as of December 2012 

1

Total 

Closed and 

Verified by 

OIG 

2

Additional 

Closed 

Total Open 

as of 

June 2013 

Audit Follow-up Review of 

the FEC’s Employee Transit 

Benefit Program (7/2009) 

15 7 N/A 8 

Audit of the Commission’s 

Property Management 

Controls (3/2010) 

14 5 2 7 

2010 Follow-up Audit of 

Privacy and Data Protection 

(3/2011) 

38 4 4 30 

2010 Follow-up Audit of 

Procurement and Contract 

Management (6/2011) 

29 12 N/A 17 

Inspection of the FEC’s 

Kastle Key Program 

(12/2011) 

7 6 N/A 1 

Quality Assessment Audit of 

the Audit Division (9/2012) 11 8 N/A 3 

Total Outstanding Recommendations as of June 2013 66 

1

 This column includes recommendations that management has disagreed with or has not adequately implemented, and
 

the OIG concludes that these recommendations are still ‘open’. 

2

 The numbers in this column include recommendations that were closed by the OIG, but not implemented by FEC 

management. See the “Additional Recommendation Closures” section on pg. 7.
 

3 
 

 

 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

A. Audit Follow-up Review of the FEC’s Employee Transit Benefit Program 

The December 2012 Review of Outstanding Audit Recommendations report identified 15 open 

recommendations. During the period ending June 30, 2013, the OIG met with the Transit Program 

Manager and the Director of OHR to discuss status of open recommendations. Subsequent to the 

meeting, OIG obtained documentation related to some of the outstanding recommendations. Based 

on the OIG’s review of supporting documentation, and actions taken to implement FEC Directive 54 

on the transit program, we were able to close seven (7) of the 15 open recommendations. 

B. Audit of the Commission’s Property Management Controls 

The Audit of the Commission’s Property Management Controls (Property Audit) audit report was 

released in March 2010. The responsibility of implementing the audit recommendations for the 

Property Audit is shared by the Administrative Services Division (ASD) and the Information 

Technology Division (ITD). The OIG has worked with the ASD Managers3

 and the Deputy Chief 

Information Officer of Operations (Deputy CIO) to receive any updates regarding the implementation 

of audit recommendations. 

The Property Audit report identified 36 audit recommendations; ASD is responsible for the 

implementation of 10 recommendations, and the ITD 26 of the 36 recommendations. In the OIG’s 

December 2012 outstanding recommendations report, ASD had only one remaining open 

recommendation, in which the OIG was able close this review period. All recommendations 

assigned to ASD for the Property Audit have been adequately implemented and the related 

findings have been officially closed. The OIG would like to note that the current ASD manager and 

her staff worked diligently and cooperatively with the OIG throughout the audit follow-up process to 

resolve these outstanding findings. The OIG appreciates ASD’s commitment to implementing the 

audit recommendations to ensure that FEC programs and processes are working effectively and 

efficiently. 

ITD is responsible for the remaining 13 recommendations still outstanding as of the December 2012 

report. For this review period, the OIG requested that ITD provide documentation for any corrective 

actions that were implemented regarding these outstanding recommendations; however, no corrective 

actions were implemented. Since management had not made any progress since the last review 

period to implement any additional recommendations, the OIG conducted follow-up on open 

recommendations where corrective actions were implemented by management in prior review 

periods, but the corrective action was either ineffective or inadequate. Through this review, the OIG 

was able to close four recommendations based on process improvements that would address the 

recommendation, but several remain open. 

The OIG is concerned with management’s lack of progress to improve their management controls 

over FEC property. As ITD has a non personnel budget of approximately seven million dollars ($7 

million), the largest budget (excluding personnel costs) in the entire agency, the OIG believes that 

3

 The OIG has worked with one acting ASD manager and two permanent ASD managers since the completion of the 

Property audit due to frequent turnover in this position. 

4 
 

 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

management should be more focused to ensure that the proper controls are in place to reduce the risk 

of any excessive cost, waste, or abuse to the agency and its programs. 

The OIG conducted an additional assessment of all outstanding recommendations, and the Inspector 

General (IG) decided to close two (2) outstanding recommendations. This decision was made because 

management disagreed with the OIG’s recommendation and/or decided not to apply the resources 

necessary to fully or adequately implement the recommendations. However, the IG believes 

management should focus their resources on the remaining open recommendations. See details in the 

Additional Recommendation Closures section, pg. 7. 

C. 2010 Follow-up Audit of Privacy and Data Protection 

For the 2010 Follow-up Audit of Privacy and Data Protection, the OIG’s December 2012 report 

identified 38 open recommendations. The OIG met with the Privacy Team on May 14, 2013 to 

discuss the status of the 38 open recommendations. The OIG was able to verify and close only four 

(4) recommendations during this review period. 

Also, management did not implement a planned system that was noted in the OIG’s prior outstanding 

recommendations report that would have the capability to keep a record of the laptops encrypted by 

the FEC. Since this corrective action was not implemented by management, this recommendation 

remains open. It is essential that ITD has assurance that all issued laptops have been encrypted to 

reduce the risk of unauthorized access to sensitive information. For instance, ITD provided FEC staff 

with new laptops this fiscal year that were not encrypted, and instructed staff via email to download 

the encryption software from the network to their laptops to encrypt the laptop hard drives. If there 

are any FEC employees who did not adhere to ITD’s email, there are potentially FEC laptops that are 

accessing FEC’s network and/or being removed from the agency building that are not encrypted. If 

so, and one of these laptops were to be lost or stolen, the information contained on the laptop, 

potentially sensitive, could be released to the public. ITD does not have an adequate process/system 

in place that can identify if there are laptops that are not encrypted, or ensure all devices accessing the 

network or that have been removed from the building (i.e. telework purposes) have been encrypted. If 

all devices are not encrypted, it also increases the risk that outside hackers can access or manipulate 

FEC sensitive information (i.e. Disclosure data). 

The OIG is aware that the Privacy Team has encountered many staff changes; however, our concern 

is that the Privacy Team has not made much progress in resolving these outstanding 

recommendations. The open recommendations have been outstanding since March 2011 with 

minimal progress from the Privacy Team to implement corrective action. 

The OIG conducted an additional assessment of all outstanding recommendations, and the Inspector 

General decided to close four (4) outstanding recommendations. This decision was made because 

management disagreed with the OIG’s recommendation and/or decided not to apply the resources 

necessary to fully or adequately implement the recommendations. The IG believes management 

should focus their resources on the remaining open recommendations. See details in the Additional 

Recommendation Closures section, pg. 7. 

5 
 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

D. 2010 Follow-up Audit of Procurement and Contract Management 

The December 2012 Review of Outstanding Recommendations report noted 29 outstanding 

recommendations. In March 2013, the OIG met with the outgoing Director of Procurement 

(Contracting Officer), to discuss processes implemented to address the recommendations. The OIG 

selected a sample of contract files to verify if controls were fully implemented. Based on the OIG’s 

review of 13 contract files and follow-up work performed, the OIG was able to close six (6) of the 29 

outstanding audit recommendations. In June 2013, the OIG met with the acting Chief Financial 

Officer (CFO) and other Office of the CFO staff members to discuss the remaining outstanding audit 

recommendations, as well as additional progress made since the CO left the agency. Subsequent to 

the meeting, the OIG obtained and reviewed documentation to support corrective actions to address 

some of the open recommendations. Based on this review, the OIG was able to close an additional six 

(6) recommendations. Therefore, a total of 12 of the 29 recommendations have been closed since our 

last report in December 2012. 

E. Inspection of the FEC’s Kastle Key Program 

The December 2012 Review of Outstanding Recommendations report noted seven outstanding 

recommendations. During this follow-up review period, six of the seven recommendations were 

closed based on the finalization of the revised Kastle key policy. 

One recommendation remains open. To test the implementation of the recommendation, the OIG 

selected a sample of six Kastle key request forms with temporary dates to: (1) ensure the correct 

temporary (expiration) date was entered in the Kastle system; (2) determine if the temporary date had 

past and was not updated; and (3) whether the key had been deactivated appropriately. The OIG’s 

review noted one of the six sampled temporary Kastle key assignments did not have a required date 

entered in the system. This issue was also noted in the OIG’s prior review, particularly with 

temporary keys issued to staff in the Reports and Analysis Division (RAD), who frequently request 

temporary date extensions. It is important that ASD enter the correct and/or updated temporary date 

of the Kastle keys assigned to ensure that staff and contractors do not have building access beyond 

the date authorized by management. To better track requests, the OIG suggests that ASD require a 

new Kastle key form whenever a date extension occurs, rather than allowing staff to provide an email 

to request date extensions. 

F. Quality Assessment Audit of the Audit Division 

The Quality Assessment Audit of the Audit Division (Audit Division) audit report was released in 

September 2012. The Audit Division audit report identified 11 audit recommendations to improve 

the quality assurance of audits conducted by the Audit Division (AD). In June 2013, the OIG met 

with AD management to discuss corrective actions taken to address the recommendations. 

Subsequent to the meeting, the AD Program Manager provided evidence to support processes 

implemented. Based on the OIG review of supporting documentation, we were able to close eight (8) 

of the 11 open recommendations. The AD management informed the OIG that corrective actions 

have been taken to address the other three (3) recommendations. Once the OIG can review evidence 

of corrective action, the OIG will be able to close the remaining recommendations. 

6 
 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

The OIG would like to recognize the work by the AD Program Manager and AD management to 

promptly and sufficiently implement the audit recommendations. These efforts by Audit Division 

have demonstrated a strong commitment to ensure a quality audit process. 

Additional Recommendation Closures 

The OIG reviewed all open recommendations that have been open for several follow-up review 

cycles, along with management’s responses and/or plan of action. At the IG’s discretion, based on 

the assessment of the open recommendations, a total of 6 recommendations were closed from the 

Property Audit, and the Privacy Audit. 

These recommendations were closed by the OIG because management disagreed with the 

recommendation and made the decision to focus their resources on other areas and not fully 

implement these recommendations. However, the OIG still believes that implementation of these 

recommendations by management would reduce the risk of fraud, waste, and abuse to agency 

programs. 

The recommendations that were not implemented by management, but have been closed by the IG, 

are listed below, along with the potential risk to the agency of not implementing the 

recommendations. 

Audit of the Commission’s Property Management Controls: 

1.	 Recommendation 2h: Provide the international add-on plan to the standard monthly service for 

users who frequently travel internationally for business. Require written request for the 

international add-on plan for Blackberry users who do not frequently travel internationally for 

business. This request should include their beginning and ending date of travel. Based on the 

information, the international service option should be promptly activated and terminated. 

	 OIG Assessment: Management is not deactivating the international add-on plan in a 

timely manner once the staff person has returned from travel. In some cases, the travel 

dates are not provided in the email in order for management to know when the add-on 

plan should be deactivated. Management has stated that they believe the human error of 

not deactivating this feature in a timely manner is at an acceptable level, and no further 

action will be taken. However, management is incurring additional cost to the agency 

because they are paying for services that are not in use; therefore, agency funds are being 

wasted. Especially during periods of strict budget control, it is troubling to the OIG that 

the program office is not planning to implement better cost controls. 

2.	 Recommendation 3c: ITD staff coordinate with GSA and implement processes and procedures 

to ensure: 

a.	 [Blackberry] devices no longer needed should be made available to other government 

agencies or non-profit organizations; and 

b.	 obsolete or broken devices are disposed in a manner that is not detrimental to public 

health. 

7 
 

 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

	 OIG Assessment: Management has not updated their policy to reflect their current 

process for the disposition of devices to GSA. Without proper documentation of current 

policies and procedures, it would be more difficult for management to hold staff 

accountable for the unauthorized use or disposition of the property (on-line 

trading/selling, retaining for personal use, etc.). In addition, in the event of staff 

changes/turnover in the program office, there are no documented policies on this process 

to ensure the disposal process is performed in accordance with proper procedures. 

2010 Follow-up Audit of Privacy and Data Protection: 

1. Recommendation 1b: Identify, document in position descriptions and performance plans, and 

assign specific roles and responsibilities for the monitoring and reporting of compliance with 

Federal and Commission privacy requirements. 

	 OIG Assessment: The lack of clear roles and responsibilities for the Privacy team 

members could result in important work not being accomplished and 

recommendations remaining open for extended periods of time because the Privacy 

team members have not made these tasks a priority, and may not understand their 

responsibilities for the privacy program. 

2. Recommendation 6d: Perform a review of the process and systems used to maintain the inventory 

of mobile devices to ensure that they are appropriately designed to maintain a complete and 

accurate inventory. A complete physical inventory of all mobile devices purchased less those 

disposed should be performed and reconciled to the existing mobile device inventory listing. 

	 OIG Assessment: In order to detect potential fraud, proper reconciliations should be 

performed periodically for all mobile devices. Currently, management can not 

identify if they have the correct number of mobile devices on hand if a reconciliation 

of devices purchased less obsolete/disposed devices is not performed. Without an 

expectation of the inventory count, there is a greater opportunity for devices to be 

removed from the agency for personal use, sold, or other unauthorized use because 

management does not have proper monitoring procedures. 

3. Recommendation 6f: Implement a process and form requiring employees and contractors to sign 

when they receive a mobile device acknowledging their receipt of the asset and maintain a record 

of these sign-offs. 

	 OIG Assessment: Management decision to not require employees to sign for receipt 

of a mobile device (laptop, Blackberry, etc.) increases the chance that FEC has 

inadequate inventory records, which was identified during the Privacy Audit. In 

addition, to hold employees accountable for proper stewardship of FEC issued 

equipment, there needs to be evidence that the physical device was provided to the 

employee. If there are no records of when a device was distributed, who it was 

distributed to, and which device was issued, management can not properly 

track/monitor the life cycle of the device. This allows for the potential loss of agency 

assets with little or no accountability by agency staff or management. 

8 
 

Office of Inspector General’s Review of Outstanding Recommendations 

June 2013 Report 

4. Recommendation 9: Implement logging for all computer-readable data extracts from databases 

holding personally identifiable information (PII). 

	 OIG Assessment: Without logging, FEC will not have a record of system user 

activity and the nature of the system activity which is essential in the event of a system 

intrusion or unauthorized activity occurs. It is more difficult for the FEC to capture 

the activity of employees or the activity of unauthorized individuals (i.e. hackers) if 

they penetrate the FEC’s network. 

OIG Concerns 

Currently, the FEC lacks the accountability necessary to ensure compliance with all aspects of 

Directive 50: Audit Follow-Up. It is essential that the Commission not only requires management to 

report on a semi-annual basis the status of outstanding recommendations, but also develop a process 

to ensure the Audit Follow-up Officials are being held accountable for implementing outstanding 

recommendations in a timely manner that are beneficial to the agency’s mission and will improve 

agency programs. Without the accountability necessary to ensure corrective actions are taken by 

management, the mission of the agency is consistently operating under weaker controls that can 

increase cost, expose the agency to risks, and increase the potential of fraud, waste, and abuse to 

agency programs. 

9