MEMORANDUM

1050 First Street NE Washington, DC 20463 | www.fec.gov/oig

TO: The Commission 

 

THROUGH: Christopher Skinner

Inspector General

FROM: Shellie Purnell-Brown

Senior Auditor 

SUBJECT: Transmittal of the Federal Election Commission’s Fiscal Year 2023 

Financial Statement Audit Report 

DATE: November 14, 2023 

ENCL: Independent Auditor’s report on the FEC’s FY 2023 Financial Statements

Pursuant to the Chief Financial Officers Act of 1990, as amended, this memorandum 

transmits the Independent Auditor’s Report issued by Brown & Company Certified Public 

Accountants and Management Consultants, PLLC (Brown & Company) for the fiscal year (FY) 

ending September 30, 2023. Enclosed you will find the Independent Auditor’s final audit report 

on the FEC (i.e., the “FEC” or “Commission”) FY 2023 Financial Statements. The final audit 

report is additionally included in Section II of the FEC’s FY 2023 Agency Financial Report. 

The audit was performed under a contract with, and monitored by, the OIG in accordance 

with generally accepted government auditing standards, the Comptroller General’s Government 

Auditing Standards, and applicable provisions of Office of Management and Budget (OMB) 

Bulletin No. 24-01, Audit Requirements for Federal Financial Statements. 

 In Brown & Company’s opinion, the FEC financial statements present fairly, in all material 

respects, the financial position, net cost, changes in net position, and budgetary resources for the 

year ending September 30, 2023, in accordance with U.S. generally accepted accounting 

principles. 

Additionally, due to the Commission’s position that it is legally exempt from the Federal 

Information Systems Management Act (FISMA), the OIG requires an assessment of the agency’s 

Information Technology (IT) systems security controls. Accordingly, the audit included an 

examination of the Commission’s IT security controls in comparison to government-wide best 
2 

practices. The OIG acknowledges that the independent auditors are only required to explicitly 

opine on internal controls that have a material impact on agency financial statement reporting. 

Brown & Company did not report any material weaknesses but did identify one significant 

deficiency1 related to the FEC’s IT security internal controls. The two remaining prior year 

recommendations have been closed. Management was provided a draft copy of the audit report 

for review and comment. The official management response is included in Exhibit C. 

The OIG reviewed Brown & Company’s report and related documentation and provided the 

required oversight throughout the course of the audit. Our review ensures the accuracy of the 

audit conclusions but may not express an opinion of the results. The OIG’s review determined 

that Brown & Company complied with applicable required Government Auditing Standards. 

We appreciate the collaboration and support from FEC staff and the professionalism that 

Brown & Company exercised throughout the course of the audit. If you have any questions 

concerning the enclosed report, please contact Ms. Shellie Purnell-Brown at (202) 694-1019. 

cc: John Quinlan, Chief Financial Officer 

Alec Palmer, Staff Director/Chief Information Officer

Lisa Stevenson, Acting General Counsel

James Gerber, Director of Budget

Greg Baker, Deputy General Counsel 

Dayna Brown, Acting Deputy Staff Director for Management and Administration

 

1 Repeat finding from FY 2022 Financial Statement audit report.

FEC OIG 2024-11-003
FEDERAL ELECTION COMMISSION

INDEPENDENT AUDITOR’S REPORT

AND

FINANCIAL STATEMENTS

FOR THE YEARS ENDED

SEPTEMBER 30, 2023 AND 2022 

Prepared By

Brown & Company CPAs and Management Consultants, PLLC

November 14, 2023 
INDEPENDENT AUDITOR’S REPORT 

Inspector General 

Federal Election Commission 

Washington, D.C. 

In our audits of the fiscal years 2023 and 2022 financial statements of the Federal Election Commission 

(FEC), we found:

• FEC’sfinancial statements as of and for the fiscal years ended September 30, 2023, and 2022,

are presented fairly, inall material respects, inaccordance with United States of America (U.S.) 

generally accepted accounting principles;

• no material weaknesses in internal control over financial reporting based on the limited

procedures we performed; and 

• no reportable noncompliance with provisions of applicable laws, regulations, contracts, and

grant agreements for fiscal year 2023. 

The following sections discuss in more detail (1) our report on the financial statements, which includes 

required supplementary information (RSI)

1

and other information2included with the financial

statements;(2)ourreportoninternalcontroloverfinancialreporting; and (3)our report on compliance with

laws, regulations, contracts, and grant agreements.

Report on the Financial Statements

Opinion 

In accordance with the provisions of the Accountability of Tax Dollars Act of 2002 (ATDA) (Pub. L. No. 

107-289), we have audited FEC’s financial statements. FEC’s financial statements comprise the balance 

sheets as of September 30, 2023, and 2022; the related statements of net cost, changes in net position, 

budgetary resources, and statement of custodial activity for the fiscal years then ended; and the related 

notes to the financial statements. In our opinion, FEC’s financial statements present fairly, in all material 

respects, FEC’s financial position as of September 30, 2023, and 2022, and its net costs of operations, 

changes in net position, budgetary resources, and statement of custodial activity for the fiscal years 

then ended in accordance with U.S. generally accepted accounting principles. 

Basis for Opinion

We conducted our audits in accordance with U.S. generally accepted government auditing standards. Our 

responsibilities under those standards are further described in the Auditor’s Responsibilities for the Audit

of the Financial Statements section of our report. We are required to be independent of FEC and to meet 

our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audit.

1 The RSI consists of Management’s Discussion and Analysis and the Statement of Budgetary Resources, which are included 

with the financial statements.

2 Other information consists of information included with the financial statements, other than the RSI, Financial section, and the 

auditor’s report.
2

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our 

audit opinion.

Responsibility of Management for the Financial Statements

FEC management is responsible for (1) the preparation and fair presentation of these financial statements

in accordance with U.S. generally accepted accounting principles; (2) preparing, measuring, and presenting

the RSI in accordance with U.S. generally accepted accounting principles; (3) preparing and presenting

other information included in FEC’s Agency Financial Report (AFR) and ensuring the consistency of that 

information with the audited financial statements and the RSI; and (4) designing, implementing, and 

maintaining effective internal control relevant to the preparation and fair presentation of financial

statements that are free from material misstatement, whether due to fraud or error.

Auditor’s Responsibility for the Audit of the Financial Statements

Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free 

from material misstatement, whether due to fraud or error, and to issue an auditor’s report that includes our 

opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not 

a guarantee that an audit of the financial statements conducted in accordance with U.S. generally accepted 

government auditing standards will always detect a material misstatement or a material weakness when it 

exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting

from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the 

override of internal control. Misstatements, including omissions, are considered to be material if there is a 

substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a 

reasonable user based on the financial statements.

In performing an audit in accordance with U.S. generally accepted government auditing standards, we:

• Exercise professional judgment and maintain professional skepticism throughout the audit.

• Identify and assess the risks of material misstatement of the financial statements, whether due to 

fraud or error, and design and perform audit procedures responsive to those risks. Such procedures 

include examining, on a test basis, evidence regarding the amounts and disclosures in the financial 

statements in order to obtain audit evidence that is sufficient and appropriate to provide a basis for 

our opinion.

• Obtain an understanding of internal control relevant to our audit of the financial statements in order 

to design audit procedures that are appropriate in the circumstances, but not for the purpose of 

expressing an opinion on the effectiveness of FEC’s internal control over financial reporting. 

Accordingly, no such opinion is expressed.

• Evaluate the appropriateness of accounting policies used and the reasonableness of significant 

accounting estimates made by management, as well as evaluate the overall presentation of the 

financial statements.

• Perform other procedures we consider necessary in the circumstances.

We are required to communicate with those charged with governance regarding, among other matters, the 

planned scope and timing of the audit, significant audit findings, and certain internal control–related matters 

that we identified during the financial statement audit.
3

Required Supplementary Information

U.S. generally accepted accounting principles issued by the Federal Accounting Standards Advisory Board 

(FASAB) require that the RSI be presented to supplement the financial statements. Such information is the 

responsibility of management and, although not a part of the financial statements, is required by FASAB, 

which considers it to be an essential part of financial reporting for placing the financial statements in 

appropriate operational, economic, or historical context. We have applied certain limited procedures to the 

RSI in accordance with U.S. generally accepted government auditing standards. These procedures consisted 

of inquiries of management about the methods of preparing the RSI and comparing the information for 

consistency with management’s responses to the auditor’s inquiries, the financial statements, and other 

knowledge we obtained during the audit of the financial statements, in order to report omissions or material 

departures from FASAB guidelines, if any, identified by these limited procedures. We did not audit and we 

do not express an opinion or provide any assurance on the RSI because the limited procedures we applied 

do not provide sufficient evidence to express an opinion or provide any assurance. 

Other Information

FEC’s other information contains a wide range of information, some of which is not directly related to the 

financial statements. This information is presented for purposes of additional analysis and is not a required 

part of the financial statements or the RSI. Management is responsible for the other information included 

in FEC’s AFR. The other information comprises a detailed statement of management assurances and other 

information as applicable but does not include the financial statements and our auditor’s report thereon. 

Our opinion on the financial statements does not cover the other information, and we do not express an 

opinion or any form of assurance thereon.

In connection with our audit of the financial statements, our responsibility is to read the other information 

and consider whether a material inconsistency exists between the other information and the financial 

statements, or the other information otherwise appears to be materially misstated. If, based on the work 

performed, we conclude that an uncorrected material misstatement of the other information exists, we are 

required to describe it in our report.

Report on Internal Control over Financial Reporting

In connection with our audits of FEC’s financial statements, we considered FEC’s internal control over 

financial reporting, consistent with our auditor’s responsibilities discussed below. 

Results of Our Consideration of Internal Control over Financial Reporting

Our consideration of internal control was for the limited purpose described below, and was not designed to 

identify all deficiencies in internal control that might be material weaknesses or significant deficiencies3 or 

to express an opinion on the effectiveness of FEC’s internal control over financial reporting. Given these 

limitations, during our 2023 audit, we did not identify any deficiencies in internal control over financial 

reporting that we consider to be material weaknesses. However, material weaknesses or significant 

deficiencies may exist that have not been identified.

3 A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the 

normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material 

weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable 

possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a 

timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting 

that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
4

During our FY 2023 audit, we identified one finding (repeat) and two recommendations related to FEC’s 

internal control over financial reporting which is considered to be significant deficiency. For more details 

see below and Exhibit A. 

• Finding # 2023-01 FEC Needs to Remediate High-Level and Medium Vulnerabilities. 

Basis for Results of Our Consideration of Internal Control over Financial Reporting

We performed our procedures related to FEC’s internal control over financial reporting in accordance with 

government auditing standards and OMB guidance.

Responsibilities of Management for Internal Control over Financial Reporting

FEC management is responsible for designing, implementing, and maintaining effective internal control 

over financial reporting relevant to the preparation and fair presentation of financial statements that are free 

from material misstatement, whether due to fraud or error.

Auditor’s Responsibilities for Internal Control over Financial Reporting

In planning and performing our audit of FEC’s financial statements as of and for the fiscal year ended 

September 30, 2023, in accordance with U.S. generally accepted government auditing standards, we 

considered FEC’s internal control relevant to the financial statement audit in order to design audit 

procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on 

the effectiveness of FEC’s internal control over financial reporting. Accordingly, we do not express an 

opinion on FEC’s internal control over financial reporting. We are required to report all deficiencies that 

are considered to be significant deficiencies or material weaknesses. We did not consider all internal 

controls relevant to operating objectives, such as those controls relevant to preparing performance 

information and ensuring efficient operations.

Definition and Inherent Limitations of Internal Control over Financial Reporting

An entity’s internal control over financial reporting is a process effected by those charged with governance, 

management, and other personnel, the objectives of which are to provide reasonable assurance that (1) 

transactions are properly recorded, processed, and summarized to permit the preparation of financial 

statements in accordance with U.S. generally accepted accounting principles, and assets are safeguarded 

against loss from unauthorized acquisition, use, or disposition, and (2) transactions are executed in 

accordance with provisions of applicable laws, including those governing the use of budget authority, 

regulations, contracts, and grant agreements, noncompliance with which could have a material effect on the 

financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and 

correct, misstatements due to fraud or error.

Intended Purpose of Report on Internal Control over Financial Reporting

The purpose of this report is solely to describe the scope of our consideration of FEC’s internal control over 

financial reporting and the results of our procedures, and not to provide an opinion on the effectiveness of

FEC’s internal control over financial reporting. This report is an integral part of an audit performed in 

accordance with U.S. generally accepted government auditing standards in considering internal control over 

financial reporting. Accordingly, this report on internal control over financial reporting is not suitable for 

any other purpose.
5

Report on Compliance with Laws, Regulations, Contracts, and Grant Agreements

In connection with our audits of FEC’s financial statements, we tested compliance with selected provisions 

of applicable laws, regulations, contracts, and grant agreements consistent with our auditor’s 

responsibilities discussed below.

Results of Our Tests for Compliance with Laws, Regulations, Contracts, and Grant Agreements

Our tests for compliance with selected provisions of applicable laws, regulations, contracts, and grant 

agreements disclosed no instances of noncompliance for fiscal year 2023 that would be reportable under 

U.S. generally accepted government auditing standards. However, the objective of our tests was not to 

provide an opinion on compliance with laws, regulations, contracts, and grant agreements applicable to

FEC. Accordingly, we do not express such an opinion.

Basis for Results of Our Tests for Compliance with Laws, Regulations, Contracts, and Grant Agreements

We performed our tests of compliance in accordance with U.S. generally accepted government auditing 

standards. Our responsibilities under those standards are further described in the Auditor’s Responsibilities 

for Tests of Compliance section below.

Responsibilities of Management for Compliance with Laws, Regulations, Contracts, and Grant Agreements 

FEC management is responsible for complying with laws, regulations, contracts, and grant agreements 

applicable to FEC.

Auditor’s Responsibilities for Tests of Compliance with Laws, Regulations, Contracts, and Grant 

Agreements

Our responsibility is to test compliance with selected provisions of applicable laws, regulations, contracts, 

and grant agreements applicable to FEC that have a direct effect on the determination of material amounts 

and disclosures in FEC’s financial statements, and to perform certain other limited procedures. 

Accordingly, we did not test compliance with all laws, regulations, contracts, and grant agreements 

applicable to FEC. We caution that noncompliance may occur and not be detected by these tests.

Intended Purpose of Report on Compliance with Laws, Regulations, Contracts, and Grant Agreements

The purpose of this report is solely to describe the scope of our testing of compliance with selected 

provisions of applicable laws, regulations, contracts, and grant agreements, and the results of that testing, 

and not to provide an opinion on compliance. This report is an integral part of an audit performed in 

accordance with U.S. generally accepted government auditing standards in considering compliance. 

Accordingly, this report on compliance with laws, regulations, contracts, and grant agreements is not

suitable for any other purpose.

Status of Prior Year’s Findings and Recommendations 

We have reviewed the status of open recommendations from the FY 2022 Independent Auditor’s Report, 

dated November 14, 2022, and all prior year recommendations were closed. Details of prior year 

recommendations is presented in Exhibit B.
6

Management’s Response to the Auditor’s Report 

Management has presented a response to the findings identified in our report. Management’s response to 

the report is presented in Exhibit C. We did not audit FEC’s response and, accordingly, we express no 

opinion on it. 

Evaluation of Management’s Response to the Auditor’s Report 

In response to the draft report, FEC provided its plans to address the findings, and agreed with the 

recommendations to improve information system security controls. FEC comments are included in their 

entirety in Exhibit C.

Greenbelt, Maryland

November 14, 2023
7

Exhibit A - Significant Deficiencies

Effectiveness of Information System Controls Over Financial Reporting

Findings and Recommendations

IT Finding 2023-01: FEC Needs to Remediate High-Level and Medium Vulnerabilities (Repeat 

finding)

Condition:

Brown and Company examined the FEC Office of Chief Information Officer (OCIO) Vulnerability Report 

dated July 26, 2023, noting that high-level and medium-level vulnerabilities were not remediated.

The FEC OCIO System Security Plan (SSP) requires staff to remediate vulnerabilities within 30 days for 

critical-level risk, 45 days for high-level risk, and 90 days for medium-level risk. The FEC OCIO 

Vulnerability Report showed that 44 high-level (ranging from 1063 to 1913 days outstanding) and 9 

medium-level (ranging from 1321 to 6679 days outstanding) vulnerabilities were not remediated timely as 

required by FEC OCIO SSP. See Table-1 Vulnerability Table below. Specifically, high- level and mediumlevel vulnerabilities were not resolved for Linux, Microsoft Windows 10, Microsoft Windows Server 2016, 

and Microsoft Windows Server 2012 operating systems.

FEC OCIO expressed that in cases where vulnerabilities are linked to outdated equipment and the Lotus 

Notes legacy systems, and OCIO has implemented compensating controls that must be maintain until the 

system is replaced.

Table -1 Vulnerability Table

Vulnerabilities Operating Systems Open Number of Days

High-level Amazon Linux 2 28 1,913

High-level Microsoft Windows 10 16 1,063

Total High-level 44

Medium-level Microsoft Windows 10 6 1321 to 6679

Medium-level Microsoft Windows 

Server 2016

2 1492

Medium-level Microsoft Windows 

Server 2022

1 1815

Total Medium-level 9
8

Criteria:

NIST SP 800-53, Revision 5.1, Security and Privacy Controls for Information Systems and 

Organizations:

RA-5 VULNERABILITY MONITORING AND SCANNING 

a. Monitor and scan for vulnerabilities in the system and hosted applications 

[Assignment: organization-defined frequency and/or randomly in accordance with 

organization- defined process] and when new vulnerabilities potentially affecting the 

system are identified and reported;

b. Employ vulnerability monitoring tools and techniques that facilitate interoperability 

among tools and automate parts of the vulnerability management process by using 

standards for:

1. Enumerating platforms, software flaws, and improper configurations;

2. Formatting checklists and test procedures; and

3. Measuring vulnerability impact;

c. Analyze vulnerability scan reports and results from vulnerability monitoring;

d. Remediate legitimate vulnerabilities [Assignment: organization-defined response 

times] in accordance with an organizational assessment of risk;

e. Share information obtained from the vulnerability monitoring process and control 

assessments with [Assignment: organization-defined personnel or roles] to help 

eliminate similar vulnerabilities in other systems; and

f. Employ vulnerability monitoring tools that include the capability to readily update the 

vulnerabilities to be scanned.

SI-2 FLAW REMEDIATION

g. Identify, report, and correct system flaws;

h. Test software and firmware updates related to flaw remediation for effectiveness and 

potential side effects before installation;

i. Install security-relevant software and firmware updates within [Assignment: 

organization- defined time period] of the release of the updates; and

j. Incorporate flaw remediation into the organizational configuration management

process.

FEC OCIO FECLAN System Security Plan (SSP):

The FEC OCIO FECLAN SSP requires staff to remediate vulnerabilities within 30 days for critical-level 

risk, 45 days for high-level risk, 90 days for medium-level risk, and 180-days for low-level risk.
9

Cause:

FEC OCIO stated vulnerabilities are linked to outdated equipment and the Lotus Notes legacy system. 

Applying the latest patches or transitioning to newer operating systems may adversely impact the 

functionality of legacy applications, leading to potential system failures. Also, FEC OCIO is not able to 

fully implement remediations due to budget and other resource constraints.

Effect:

Legacy systems with security vulnerabilities are challenging and expensive to address. Often, vendors 

discontinue support which increased security risks and costs. The vulnerabilities in legacy systems can be 

exploited by cybercriminals, leading to unauthorized access, data breaches, and system disruptions. 

Maintenance of these systems become costlier over time. Specialized knowledge in older technologies is 

essential, making recruitment tough and possibly more expensive. Further, in an era of constrained budgets, 

the high costs of maintaining legacy systems could limit agencies’ ability to modernize and develop new 

or replacement systems.

Recommendation 1:

We recommend FEC OCIO develop a feasibility plan for replacing the Lotus Notes legacy system, related 

outdated equipment and operating systems. The feasibility plan should contain an analysis of potential 

benefits, costs, risks, and other critical factors.

Recommendation 2:

We recommend FEC Senior Leaders prioritize funding and other resources needed to replace the Lotus 

Notes legacy system, related outdated equipment and operating systems.
10

Exhibit B – Status of Prior Year’s Findings and Recommendations

Status of FY 2022 Prior Year’s Audit Recommendations

Status as of 

September 30, 

2023

2022-01 We recommend FEC OCIO remediate critical-level and high-level 

vulnerabilities according to the FEC System Security Plan. 

FY 2022 NFR is 

closed. It has been 

superseded by FY 

2023 NFR 2023-01.

2022-02 We recommend the FEC OCIO establish controls to ensure user 

accounts are deactivated timely when employees separate from the agency.

Closed

2022-03 We recommend the FEC OCIO document and maintain evidence that 

the controls for identifying and obtaining management's approval for deviations 

from its established configuration settings for Windows 10 devices are 

performed on a consistent basis.

Closed
11

Exhibit C – Management’s Response to the Auditor’s Report

THE FEDERAL ELECTION COMMISSIOJ\ 

Washington, UC 20463 

November 14, 2023 

On behalf oflhe Federal Election Commission (FEC) Management, I would like to thank the FE

Office of Inspector General and Brown and Company for their diligent work auditing the FE

FY 2023 financial statements. The unmodified opinion that you rendered is reflective of the ha

work and continued process improvements made by the FEC staff 

On Behalf of Management, 

<;oA~Q~ 

John Quinlan 

ChicrFinancial Officer 

C 

C s 

rd 

--------------==--------------BROWN & COMPANY_:::==::::::::::=:::=::::::::==============~~ ----------CERTIFIED PUBLIC ACCOUNTANTS AND MANAGEMENT CONSULTANTS, PLLC ----------" 
12

IT Finding 2023-01: FEC Needs to Remediate High-Level and Medium Vulnerabilities 

(Repeat finding) 

Recommendation 1: 

We recommend FEC OCIO develop a feasibility plan for replacing the Lotus Notes legacy system, 

related outdated equipment and operating systems. The feasibility plan should contain an analysis of 

potential benefits, costs, risks, and other critical factors. 

Recommendation 2· 

We recommend FEC Senior Leaders prioritize funding and other resources needed to replace the Lotus 

Notes legacy system, related outdated equipment and operating systems. 

Management Response: 

_ X _ Management concurs with this finding. (See response below.) 

Management does not concur with this finding. 

4tzc,f)~ Signature: _________________ _ Date: l 0/5/2023 

Title: Chieflnformation Officer 

Management's Response: 

OCIO ackno,vledges the vulnerabilities shown in the report exist and that they have yet to be remediated 

but should be as soon as possible. OClO has a plan to remediate most of these in pince now; however, 

budgetary constraints have prevented OCIO from putting that plan into action. In the case of 

vulnerabilities affecting legacy application servers, OCIO has put compensating controls into place when it 

cannot replace the server. OCIO also recently used end-o±~year reallocated funding to purchase new 

laptops to replace outdated equipment operating on older operating systems. 

Specifically, in the case of the Lotus Notes applications with vulnerabilities, these are mission-critical 

legacy applications. Should OClO put remediations in place, it may render those applications unusable and 

cause Commissioners and agency staff to be unable to accomplish their duties and mission. Instead, 

OCTO 's SecOps learn h as pul in lo p lace rnmpensaling rnnlrols using the C'row<lStrike F.mlpoin l Ddedion 

and Response and McAfoc applications. Those applications help protect the agency from cybcrsccurity 

intrnsions. 

OCIO has requested funding for the replacement solutions for the Lotus Notes applications. An executive 

summary (attached) was prepared for the Commission's IT Committee to infonn them of the serious 

nature of the vulnerabilities and present the case for funding the solutions. The sunun ary contained an 

analysis of potential benefits, costs, risks, and other critical factors to consider. The IT Committee was 

unable to approve the funding only because funding this project would have reduced the amount available 

to the FEC to pay for cun-ent contracts and operations from its appropriation. Because the FEC must fully 

fund its ctment contracts, obligations and operations, the FEC has not been able to fund brand new 

--------------==--------------BROWN & COMPANY_::==::::::::::=::::=::::::::==============~~ ---------CERTIFIED PUBLIC ACCOUNTANTS AND MANAGEMENT CONSULTANTS, PLLC ----------" 
<lc:vdup1m:nt projc:d s sul:h as this um:. The: prujc:d, huwc:vc:r, l:annul prol:t:t:<l bc:yun<l markt:t n:st:arl:h until 

the funding is available and approved. OCIO continues to emphasize that funding the modernization of the 

Lotus Nolt:s Applil:aliuns is imp01tanl from an IT mo<lc:rnizaliun slan<lpuinl and it is c:sst:nlial lo c:nsurt: lht: 

security of the FEC's systems. 

The FEC included an appeal for funding the modernization of the Lotus Notes Applications in the FY 

2024 Congressional Budget Justification and OCIO included a request for funding in its internal request 

for reallocation of FY 2023 funds made to OCFO and the Finance Committee. OCIO anticipates its 

indusiun in the: agt:nl:y's FY 2025 buugc:t rc:quc:sl and in OCIO's FY 2024 propost:d managc:mc:nl plan. 

13

-------------==--------------BROWN & COMPANY_:::==:::::::::=::::=::::::::==============~~ ---------CERTIFIED PUBLIC ACCOUNTANTS AND MANAGEMENT CONSULTANTS, PLLC ----------"