Federal Election Commission

Office of Inspector General

Review of Outstanding Recommendations 

as of August 2017

September 2017

Assignment No. OIG-17-07
Office of Inspector General’s

Review of

Outstanding Recommendations as of

August2017

 Summary of Review

The Office of Inspector General (OIG) semiannually provides to the Commission a report on the 

status of outstanding recommendations. The OIG provides these status reports as of February and 

August of each year. For this reporting period, we continued our review of the previous seven

audits and inspections with outstanding recommendations as of February 2017. Collectively, 

these 7 audits and inspections had 59 outstanding recommendations that required follow-up for 

this review period. Based on the results of the follow-up review, the OIG was able to collectively 

close only 4 of the 59 outstanding recommendations from 2 separate OIG reports.

OIG Concerns

The overarching concern of the OIG is the lack of governance accountability for ensuring that

management enforces the required internal control to assure outstanding recommendations that 

are intended to improve agency programs and prevent fraud, waste, and abuse are timely and 

sufficiently implemented. This management control is mandated by the Office of Management 

and Budget’s (OMB) Circulars A-123 and A-50, and also is required by the Federal Election 

Commission’s (FEC) own policy, Commission Directive 50: Audit Follow-up. Governance must 

hold management accountable for promptly addressing outstanding recommendations to 

decrease the agency’s risk exposure, effectively manage resources, and ensure cost control. Per 

OMB’s Circular A-123, deficiencies reported “...through internal review or by an external audit, 

should be evaluated and corrected. A systematic process should be in place for addressing 

deficiencies.”

Although corrective action plans (CAP) are created to address audit issues, and are submitted to 

the Commission biannually,

1 the standard for addressing deficiencies timely and appropriately 

must be established and enforced by the head of the agency. The OIG has highlighted a few 

deficiencies below that have gone unaddressed for several years, having an impact on agency 

operations. 

 1 Per Commission Directive 50: Audit Follow-up, management must submit their CAPs to the Commission in May 

and November of each year.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 2 | Page

Risks to Agency Mission

The FEC has operated for almost 13 years without an approved and tested contingency plan to 

ensure that in the event of a local or agency specific disaster, the Commission would have the 

ability to continue normal business operations within a reasonable timeframe. This issue was first 

reported in the agency’s 2004 financial statement audit report in relation to Information 

Technology (IT) control weaknesses, and risks to government IT infrastructure have increased 

since then. In 2008, management hired a contractor for over $200,000 to assist with developing 

the agency’s contingency plan. The plans were finalized in 2010, but never tested by 

management to determine if the plans could be effectively executed. Due to the lack of progress 

in this critical area over time, the OIG conducted the Inspection of the FEC’s Disaster Recovery 

Plan and Continuity of Operations Plans (COOP Inspection) and released a report in 2013 to

support the need for improvement in this critical area. The absence of an approved and tested 

contingency plan poses a material threat to the agency’s mission, particularly during timeframes 

related to election cycles when agency staff is at the height of its daily business operations.

Risks to Agency Assets 

The OIG has reported on inventory control weaknesses regarding the Office of the Chief 

Information Officer’s (OCIO) inventory process for laptops since the release of the 2010 Followup Audit of Privacy and Data Protection report. In January 2017, management made the 

decision to officially accept the risks of this reported internal control weakness to close out the 

OIG’s audit recommendation. However, in accordance with its responsibilities outlined in the 

Inspector General Act of 1978 (IG Act) to recommend policies to promote efficiency and 

effectiveness, and to prevent fraud, the OIG continues to encourage management to reconsider 

its inventory and control process. Specifically, management does not maintain complete 

inventory records and has inadequate control processes for agency laptops. These weaknesses 

result in OCIO not having an account for all assets on hand in their inventory database, and the 

potential for waste of agency funds as assets can sit in storage for long periods of time unused, 

becoming obsolete due to an inherent short life cycle for IT equipment. In addition, the agency is 

also susceptible to theft and abuse that can go undetected not having adequate records for 

inventory.

The OIG has also reported for seven years that the OCIO has not maintained adequate inventory 

records for agency issued cellular devices as detailed in the Audit of the FEC’s Property 

Management Controls report. The continuous issues reported to the Commission through our 

follow-up reviews illustrates the high risk exposure the agency is subject to in this area, as 

management’s inventory process for laptops is the same for the agency cellular devices. Since 

the release of the initial OIG reports, the agency has been through at least two or more separate 

distribution cycles of new agency devices (cell phones and laptops) in which management could 

have implemented additional controls to fix the reported audit issues. 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 3 | Page

Risks to Procurement Functions

The six year outstanding 2010 Follow-up Audit of Procurement and Contract Management

recommendation has yet to be closed by the OIG because the updates by management to 

Commission Directive 66, which is the agency-wide policy for procurement and acquisitions, 

have yet to be approved by Governance. The Procurement Office is currently understaffed and 

the Contracting Officer’s position has experienced major turnover over the past few years. It is 

necessary that this essential part of the agency not only has consistent leadership, but also that 

policies and procedures are established for efficient operations, and for ensuring proper 

compliance with managing and distributing funds in accordance with Federal regulations. 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 4 | Page

Table Summary of Results

The table below summarizes the progress made by FEC management since the OIG’s last 

reporting period and the total outstanding recommendations as of August 2017.

Title & Report Date of OIG 

Audits/Inspection

Total Outstanding 

Recommendations 

as of February 

2017

Total Closed Total Open as of 

August 20172

Audit of the Commission’s 

Property Management Controls 

(3/2010)

1 0 1

2010 Follow-up Audit of Privacy 

and Data Protection (3/2011) 25 0 25

2010 Follow-up Audit of 

Procurement and Contract 

Management (6/2011) 1 0 1

Inspection of the FEC’s

Disaster Recovery Plan and

Continuity of Operations Plans

(1/2013)

10 1 9

Audit of the FEC’s Office of 

Human Resources (7/2013) 8 3 5

Inspection of FEC’s Compliance 

with FMFIA/OMB A-123 (6/2014) 5 0 5

Audit of the FEC Telework 

Programs (6/2016) 9 0 9

Total Outstanding Recommendations 55

 2 Column numbers may include recommendations that management has disagreed with or has not adequately 

implemented, and the OIG concludes that these recommendations are still open.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 5 | Page

Audit Follow-up Meetings/Communications

Closed Audits/Inspections3

The OIG did not close any audits or inspections this review period.

Open Audits/Inspections

A. Audit of the Commission’s Property Management Controls

The remaining outstanding recommendation for the Audit of the Commission’s Property 

Management Controls (Property Audit) is related to the Office of the Chief Information 

Officer’s (OCIO) inventory records for cellular devices. The OIG has followed up on 

this recommendation since the release of the report in March of 2010, and this reported 

weakness within management’s business process for appropriately recording agency 

assets remains an outstanding issue. For the most recent iPhone devices distributed to 

FEC staff, the OCIO enrolled in Apple’s Device Enrollment Program (DEP) to manage 

the agency devices. For review purposes, the OIG requested documentation of all devices 

enrolled and who was assigned administrative rights to this system. In addition, we 

requested the latest vendor billing information and the OCIO’s official inventory listing. 

The OIG found no issues with the current administrative rights assigned to the DEP; 

however, the following issues with the inventory records for the devices were noted:

• Eight active iPhone devices are missing from OCIO’s official inventory record 

• One device (same barcode, serial number, and phone number) is assigned to two 

different FEC employees on OCIO’s inventory list

Two devices are incorrectly assigned 

 One device is assigned to a user but listed as in storage

 One device is assigned to the wrong user

• One device is listed as in storage on the OCIO’s inventory, although vendor 

billing shows current usage activity and the device as being assigned to a 

separated employee 

• Inventory records are unclear on how many devices OCIO has on hand

o 133 iPhones are listed on OCIO’s official inventory list4

 3 An audit or inspection is closed when the OIG determines that all applicable recommendations have been 

adequately addressed by management. 

4 This does not include the one duplicate and the eight devices OIG identified from the AT&T bill that were not 

listed on OCIO’s official inventory list
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 6 | Page

o 138 iPhones are listed on AT&T’s latest monthly bill

o 163 iPhones are listed as enrolled devices for FEC per Apple records

 36 of the 163 agency iPhones registered with Apple were not 

recorded as inventory by OCIO 

Although OCIO management officially accepted the risks of their inventory process in 

January 2017, the OIG continues to have concerns that the failure to record all acquired 

assets upon receipt not only causes the agency to have incomplete inventory records, but 

also greatly exposes the agency to potential theft of assets without detection from 

management. During our follow-up review, OCIO management confirmed that new 

devices are only recorded at the time they are distributed to FEC employees. 

Management stated as a reason for doing so, “The plastic around the box includes 

information that we use and removing the wrapping to barcode the device and possibly 

losing the wrapping becomes a problem that we would rather avoid.” However, if the 

OCIO scanned the information for each purchased device at the time of receipt to ensure 

they matched the purchase order, the potential loss of pertinent information would be 

avoided and records would more accurately reflect current inventory. With this process, 

when a devices is issued to staff, the only task necessary would be to assign the already 

tracked device to the proper user on the inventory listing. See the OIG Concerns section 

regarding this matter.

B. 2010 Follow-up Audit of Privacy and Data Protection

For the 2010 Follow-up Audit of Privacy and Data Protection (Privacy Audit), the OIG’s 

Review of Outstanding Recommendations as of February 2017 report identified 25 open 

recommendations. As we reported in our February 2017 report, the OIG suggested that a 

meeting with the Privacy Team be scheduled between follow-up review periods to 

discuss the outstanding recommendations so that management could appropriately 

provide a status update for this current review period. The OIG provided the Privacy 

Team with a copy of all the outstanding Privacy Audit recommendations on February 17, 

2017, more than a month prior to the meeting scheduled for March 29, 2017. However, 

management was not prepared to discuss updates or corrective actions during this 

meeting. The OIG agreed to re-send the previous email and requested that management 

notify the OIG once it was ready to discuss the status of the open recommendations. The 

OIG followed up with the Privacy Team again on June 28 and July 18, 2017, but did not 

receive a response from management. Thus, the 25 outstanding recommendations remain 

open for the Privacy Audit. The OIG remains agreeable to meeting with the Privacy 

Team to discuss the outstanding recommendations.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 7 | Page

C. 2010 Follow-up Audit of Procurement and Contract Management

The 2010 Follow-up Audit of Procurement and Contract Management was issued in June 

2011. The OIG’s Review of Outstanding Recommendations as of February 2017 report 

identified only one open recommendation related to the updated Directive 66, which is 

the overarching agency-wide policy for procurement and acquisitions. This one 

recommendation is still open for this follow-up review period. See the OIG Concerns 

section regarding this matter.

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

The Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

(COOP Inspection) report was released in January 2013. The OIG’s Review of 

Outstanding Recommendations as of February 2017 report identified 10 outstanding 

recommendations. Based on management’s revised completion dates in their latest 

corrective action plan, five recommendations were scheduled to be completed during this 

follow-up review period. The OIG requested a status update from management regarding 

the five open recommendations, and was able to close one recommendation assigned to 

the Chief Information Security Officer upon review of the finalized FEC System Security 

Plan. The due date for three of the five recommendations was revised to September 

2017. The one remaining recommendation was partially completed, as an updated list of 

COOP essential staff was provided, but a Disaster Recovery Plan has yet to be finalized. 

Therefore, the COOP Inspection has nine open recommendations remaining. 

E. Audit of the FEC’s Office of Human Resources 

The Audit of the Federal Election Commission’s Office of Human Resources (OHR

Audit) report was issued in July 2013. The OIG’s Review of Outstanding 

Recommendations as of February 2017 report identified eight open recommendations for 

the OHR audit report. 

In August 2017, the OIG met with the Director of OHR to discuss the status of the eight 

outstanding audit recommendations as well as review corrective actions since the last 

follow-up review was conducted in February 2017. Based on follow-up work performed, 

the OIG closed three recommendations as follows:

• Two open recommendations related to the fingerprinting scheduling process have

been closed. The OIG confirmed that the on-line electronic scheduling system 

(Timetrade) has been fully implemented for automating the scheduling for both 

fingerprinting and badging appointments. 

• One recommendation related to the hiring process has also been closed. The OIG has 

confirmed that the OHR has converted to the USA Staffing automated system which 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 8 | Page

follows the standard OPM 80 day hiring model. The new system utilizes workflow 

and automatically tracks each vacancy according to the OPM 80 day hiring model 

and stores all applicable forms and documentation. 

The OIG would also like to acknowledge the progress made with updating and creating 

personnel related policies and procedures. For example, OHR has finalized and released 

the standard operating procedures for both the FERS and CSRS retirement systems, and 

is in the process of rolling out a service level agreement for hiring. The OHR Director is 

still waiting on a decision concerning an on-line correspondence tracking system called 

Service Now which is being considered for agency-wide use. The Director of OHR 

would like to replace HR On Demand, which is currently used to track and monitor HR 

inquiries, with the Service Now system, as he believes it would be a more effective and 

efficient tracking tool. Based on follow-up work performed, the OHR Audit has five 

open audit recommendations for this follow-up review period.

F. Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123

The Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123 (A-123 

Inspection) was released in June 2014. The OIG’s Review of Outstanding 

Recommendations as of February 2017 report identified five open recommendations for 

the A-123 Inspection report. Since the February 2017 follow-up review period, the 

Office of the Chief Financial Officer (OCFO), in cooperation with the FEC A-123 Task 

Force, has formally adopted the Senior Management Council (SMC) charter which will 

be the designated oversight body responsible for the FEC’s internal control and 

Enterprise Risk Management (ERM) programs. The SMC members have begun meeting 

on a regular basis to begin developing the FEC’s ERM plan. The OIG notes that the 

initial OMB requirements related to submitting ERM and Fraud Reduction plans by June 

4, 2017, have been postponed. 

Although progress was made during this review period, the OIG will be unable to close 

the remaining five recommendations until the FEC fully implements ERM and fraud risk 

assessments into the Internal Control Report process, and the OIG can verify that the new 

processes are operating effectively. Therefore, five recommendations remain open for 

this follow-up review period.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 9 | Page

G. Audit of the FEC’s Telework Programs

The Audit of the FEC’s Telework Programs (Telework Audit) was released in June 2016. 

The Telework Audit report identified 11 recommendations. The OIG’s Review of 

Outstanding Recommendations as of February 2017 report identified nine open 

recommendations for the Telework Audit report. In August 2017, the OIG contacted the 

Telework Management Official and was informed there is no additional updates to report 

at this time. Therefore, nine recommendations remain open for this follow-up review 

period.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 10 | Page

Background

As required by the Inspector General Act of 1978, as amended, the OIG is responsible

for conducting audits of the FEC’s programs and operations. In addition to conducting 

and supervising audits, the OIG also has the responsibility to conduct audit follow-ups

to ensure that management has effectively implemented OIG recommendations. Audit

follow-up, including the timely implementation of audit recommendations by FEC

management, is required by Office of Management and Budget Circular A-50, Audit 

Follow-up, as revised, and FEC Directive 50: Audit Follow-up.

At the conclusion of each OIG audit and inspection, it is management’s responsibility to 

develop a corrective action plan (CAP). The CAP identifies the plan management has

developed to address the OIG’s findings and recommendations. The CAP should detail the

following:

1. assignment of Audit Follow-up Official, who is responsible for overseeing the 

corrective action;

2. OIG finding(s);

3. OIG recommendation(s);

4. detailed corrective action to implement the OIG’s recommendation(s);

5. FEC staff person with responsibility to implement each task; and

6. expected completion dates.

Once management drafts the CAP, the OIG then reviews the CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the

final CAP to the Commission with a courtesy copy to the OIG.

FEC Directive 50 requires management to:

(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission...;

In order to work effectively with FEC management in adhering to FEC Directive 50, 

and to ensure continuous monitoring and adequate and timely audit resolution, the

OIG communicates with management at least semiannually to discuss the status of

outstanding OIG recommendations. If management has implemented any corrective

action(s), the OIG schedules a meeting with management to discuss the

implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (e.g., new/updated policies, procedures, and processes to improve

internal controls).
Office of Inspector General’s Review of Outstanding Recommendations as of August 2017 11 | Page

To provide management with timely feedback and the results of our review prior to 

management’s reporting deadlines to the Commission in May and November, the OIG 

reports on our review of outstanding recommendations as of February and August of each 

year. The semiannual meetings are also intended to assist the audit follow-up official in 

following provisions 4 through 6 of Directive 50, which are listed as follows:

(4) Respond in a timely manner to all audit reports;

(5) Engage in a good faith effort to resolve all disagreements; and

(6) Produce semi-annual reports that are submitted to the agency head.

The official status (open/closed) of OIG recommendations is determined by the OIG 

once the OIG has verified that management has adequately implemented the corrective 

actions. The Inspector General can also make a decision to close recommendations or 

seek resolution from the Commission for recommendations where the OIG and 

management disagree. Lastly, the number of outstanding recommendations is also 

reported to the Commission and Congress in the OIG’s Semiannual Reports to Congress.
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015