Semiannual Report to Congress 

April 1, 2018 – September 30, 2018 

November 2018 

Federal Election Commission - Offce of Inspector General 

1050 First Street, N.E., Suite 1010, Washington, D.C. 20463 


Office of Inspector General Semiannual Report to Congress

iv 
v 

April 1, 2013 - September 30, 2013

v 

April 1, 2018 – September 30, 2018

 

 

 

 

FEDERAL ELECTION COMMISSION

WASHINGTON, D.C. 20463

Office of Inspector General

A Message from the Deputy Inspector General 

The past six month reporting period has been productive for the Federal Election 

Commission (FEC) Office of Inspector General (OIG). The Audit of the FEC’s Fiscal 

Year 2018 Financial Statement was begun and work on the Audit of Contract 

Management and Oversight was continued. An audit peer review of the Postal 

Regulatory Commission Office of Inspector General was completed and a report issued. 

The semiannual Review of Outstanding Recommendations was completed, and one 

investigation was closed during this reporting period, as well. 

The FEC OIG conducted its annual risk assessment and held its annual work planning 

meeting in June 2018, and significant progress was made on redesigning the OIG’s public 

webpage. OIG staff completed training in EEOC law, internal controls, enterprise risk 

management, analysis techniques for auditors, and in other areas. Carla Smith, Counsel 

to the Inspector General and Chief Investigator, was invited to participate in the Law 

Enforcement and Government Alliance round table at the 2018 annual conference of the 

Association of Certified Fraud Examiners, which brings together anti-fraud professionals 

from around the world. She participated in a panel discussion of OIG challenges 

including, hiring, report writing, and staff morale. 

The position of Inspector General has been vacant for over a year and a half since the 

retirement of the former Inspector General in March 2017. Throughout this reporting 

period, the OIG staff has continued to perform exceptionally well and has taken on tasks 

beyond their normal duties, in part due to office vacancies. Their dedication to their 

work and involvement in the Federal IG community is exemplary. 

J. Cameron Thurber

Deputy Inspector General

Federal Election Commission

October 31, 2018
vi

Office of Inspector General Semiannual Report to Congress

vi 

Office of Inspector General Semiannual Report to Congress

 

 

Table of Contents 

Executive Summary 1 

OIG Audit Activity 3 

OIG Audit Follow-up Activity 5 

OIG Hotline Information 6 

OIG Investigative Information 7 

Additional OIG Activity 8 

Council of the Inspectors General on Integrity and Efficiency (CIGIE) Activity 10 

OIG Contacts 11 

List of Training, Meetings and Conferences Attended by OIG Staff 12 

Reporting Requirements 14 

Table I – Questioned Cost 16 

Table II – Funds Put To Better Use 17 

Table III – Summary Of Audit And Inspection Reports With 18 

Corrective Actions Outstanding For More Than Six Months 

Table IV – Summary Of Investigative Reports 19 

Appendix A – Peer Review Results 20 

Appendix B – Review of Outstanding Recommendations as of August 2018 21 

Appendix C – The Federal Election Commission 44 

Offce of Inspector General 44 
1

April 1, 2013 - September 30, 2013

1 

April 1, 2018 – September 30, 2018

 

Executive Summary 

The Inspector General Act of 1978, as amended (IG 

Act), states that the Inspector General (IG) is responsible for: conducting audits and investigations; recommending policies and procedures that promote 

economy, efficiency, and effectiveness of agency resources and programs; and preventing fraud, waste, 

abuse, and mismanagement.The IG Act also requires 

the IG to keep the Federal Election Commission 

(Commission or FEC) and Congress fully and currently informed about problems and defciencies in 

the Commission’s operations and the need for corrective action. 

This semiannual report includes the major accomplishments of the FEC Office of Inspector General 

(OIG), as well as relevant information regarding additional OIG activities. The executive summary highlights the most signifcant completed activities of the 

OIG. Additional details pertaining to each activity 

(e.g., audits, hotline, and investigations) can be found 

in subsequent sections of this report. The honesty, 

integrity, and diligent work of our entire IG staff make 

the accomplishments of the OIG possible. 

The OIG is conducting Audit of Contract 

Management and Oversight (OIG-16-02), an audit 

of contract management and oversight by the FEC’s 

operational units. Due to resource constraints and 

various OIG mandates, the completion date of this 

audit has been extended. However, in order to make 

continued progress on this audit, the OIG will be providing reports of audit issues to FEC management 

at the completion of each major audit section. The 

report on the frst set of issues is estimated to be provided to management during the frst second quarter 

of FY 2019. (See OIG Audit Activity section, page 3). 

Audit of the FEC’s FY 2018 Financial Statements 

(OIG-18-01). The OIG exercised the last option 

year of our fve year contract with Leon Snead 

and Company (LSC) to perform the agency’s 2018 

fnancial statement audit. The preliminary planning 

phase was completed in the prior reporting period. 

For this reporting period, the audit entrance conference was held on April 17, 2018, and LSC began audit work on site May 8, 2018. Review of the prior year 

auditing fndings was conducted during interim testing, and LSC was able to close three of the audit recommendations. Included in the remaining open audit 

fndings are the two recommendations that were reopened in FY 2017. Final audit testing is scheduled 

for October 15 and the exit conference on November 

9. (See OIG Audit Activity section, page 3). 

The OIG’s Review of Outstanding 

Recommendations as of August 2018 (OIG-18-

03) reviewed and assessed management’s latest 

corrective action plans provided to the Commission 

as of May 2018. In addition, for this reporting period 

we included the Required Review Under the DATA 

Act (Digital Accountability and Transparency Act) audit report. Collectively, these audits and inspections 

had 58 outstanding recommendations that required 

follow-up for this review period. Based on the results 

of the follow-up review, the OIG was able to close 8 

of the 58 outstanding recommendations. (See Audit 

Follow-up Activity section, page 5). 

The Council of Inspectors General on Integrity 

and Efficiency (CIGIE) Purchase Card Project 

(OIG-17-04) The OIG volunteered to participate in 

this CIGIE Information Technology (IT) Committee’s 

Government-wide purchase card (P-Card) project 

and completed testing during the previous reporting 

period. The FEC OIG compiled, certifed, and submitted its results to the U.S. Department of Agriculture 

(USDA) OIG, which agreed to compile all OIG results and publish a consolidated report for the CIGIE 

IT Committee. The FEC OIG obtained the draft consolidated report from USDA P-Card team on April 4, 

2018, and provided comments to USDA P-Card team 

on April 20, 2018. The CIGIE consolidated report 
2

Office of Inspector General Semiannual Report to Congress

2 

Office of Inspector General Semiannual Report to Congress

 

(CIGIE Report on the Government Purchase Card 

Initiative) was released in July 2018. 

The FEC OIG also issued a Management Letter to 

formally communicate the results of the P-Card review to FEC Management. Based on work performed, 

we found that all 46 transactions tested appear to be 

legitimate business expenses and we did not identify 

any potential fraudulent purchases. However, we did 

fnd one control defciency related to a lack of separation of duties for one P-Card Holder. (See Additional 

OIG Activity section, page 10). 

Peer Review of the Postal Regulatory Commission 

(PRC) OIG (OIG-18-04) The FEC OIG conducted a modifed peer review of the Postal Regulatory 

Commission (PRC) Office of Inspector General during this reporting period. The FEC OIG completed 

and provided the fnal peer review report and letter of 

comment to PRC OIG on September 28, 2018. The 

fnal peer review report did not include any recommendations. (See Appendix A Peer Review Results 

section, page 20). 

OIG HOTLINE AND INVESTIGATIVE INFORMATION 

During this semiannual reporting period, eight new 

hotline complaints were opened and fve hotline complaints were closed. The OIG has 17 open hotline 

complaints. No new investigations were opened during this reporting period, and one investigations was 

closed. For detailed information pertaining to hotline 

complaints and investigations, see the sections titled 

OIG Hotline Information (starting on page 6) or OIG 

Investigative Information (starting on page 7). 
3

April 1, 2013 - September 30, 2013

3 

April 1, 2018 – September 30, 2018

 

OIG Audit Activity 

Audit of Contract Management and Oversight 

Assignment Number: OIG-16-02 

Status: In Progress 

The OIG is conducting an audit of contract management and oversight by the FEC’s operational units. 

Specifcally, the OIG is looking at how the FEC monitors agency contracts throughout the period of performance. To date, the OIG has reviewed contract 

related hotline complaints for follow-up within the audit, interviewed Contracting Officer Representatives, 

reviewed agency policies and procedures around 

monitoring agency contracts, and is currently in the 

process of reviewing sample contract fles and associated payment documentation submitted by the 

agency. 

Due to resource constraints and various OIG mandates, the completion date of this audit has been extended. However, in order to make continued progress on this audit, the OIG will be providing reports of 

audit issues to FEC management at the completion 

of each major audit section to ensure timely notifcation of audit issues, rather than at the completion of 

the entire audit. The report on the frst set of issues is 

estimated to be provided to management during the 

frst second quarter of FY 2019. 

Audit of the FEC’s FY 2018 Financial Statements 

Assignment Number: OIG-18-01 

Status: In Progress 

The OIG exercised the last option year of its fve year 

contract with LSC to perform the agency’s 2018 fnancial statement audit. The preliminary planning 

phase, which included fnalizing the audit timeline, scheduling status meetings dates, providing 

management with the list of requested testing documents, and issuing the Acting Chief Financial Officer 

and Governance the 2018 audit Engagement Letter 

to sign and confrm their understanding of the purpose of the audit, was completed in the prior reporting period. 

For this reporting period, the audit entrance conference was held on April 17, 2018, and LSC began 

audit work on site May 8, 2018. Review of the prior 

year auditing fndings was conducted during interim testing, and LSC was able to close three of the 

audit recommendations due to sufficient corrective 

action by management. Several Notice of Findings 

and Recommendations (NFRs) were distributed to 

management for the remaining open audit issues. 

The NFRs were distributed to management and 

Governance. 

Included in the remaining open audit fndings are the 

two recommendations that were re-opened in FY 

2017 regarding the agency’s implementation of the 

National Institute of Standards and Technology security controls. These issues were discussed in further 

detail with the Vice Chair on September 17, 2018, during the meeting with Governance held in accordance 

with audit standards. In addition to the reopened recommendations, the meeting included discussions on 

the repeat issues that will remain open for FY 2018 

as sufficient corrective actions have not been implemented. Further, as all but one of the open recommendations are related to the weaknesses in internal controls around the agency’s information security, 

we also discussed with Governance the signifcant 

impact the current vacancy of the Chief Information 

Security Officer position has on the progression of 

management fxing the reported audit issues. 

Final audit testing is scheduled for October 15, 

followed by the draft report to management on 

November 7, and the exit conference on November 
4

Office of Inspector General Semiannual Report to Congress

4 

Office of Inspector General Semiannual Report to Congress

9, 2018. Currently the audit is on schedule to be completed in accordance with the mandate due date of 

November 15, 2018. 
5

April 1, 2013 - September 30, 2013

5 

April 1, 2018 – September 30, 2018

OIG Audit Follow-up Activity 

Office of Inspector General’s Review of 

Outstanding Recommendations as of August 

2018 

Assignment Number: OIG-18-03 

Status: Completed 

Report Location: Inspection and Special Review 

Reports 

https://transition.fec.gov/fecig/fecig.shtml 

For this semiannual status report, the OIG reviewed 

and assessed management’s latest corrective action 

plans provided to the Commission as of May 2018 for 

the six audits and inspections reported in our previous 

report, the Review of Outstanding Recommendations 

as of March 2018. In addition, for this reporting period 

we included the Required Review Under the DATA 

Act (Digital Accountability and Transparency Act) 

audit report released November 2017, as its recommendations have been outstanding for six months or 

more. 

We reviewed the following seven (7) audits and 

inspections: 

2010 Follow-up Audit of Privacy and Data Protection; 

• 2010 Follow-up Audit of Procurement and 

Contract Management; 

• Inspection of the FEC’s Disaster Recovery 

Plan and Continuity of Operations Plans; 

• Audit of the FEC’s Office of Human Resources; 

• Inspection of the FEC’s Compliance with 

FMFIA/OMB A-123, and 

• Audit of the FEC Telework Programs. 

• Required Review Under the DATA Act 

Collectively, these audits and inspections had 58 outstanding recommendations that required follow-up 

for this review period. Based on the results of the follow-up review, the OIG was able to close 8 of the 58 

outstanding recommendations, leaving 50 open recommendations. For FY 2019, the OIG will be revising 

its audit follow-up process to report only annually to 

the Commission regarding outstanding recommendations. The report will be issued for the period ending as of February of each year, providing the new 

Commission Chair that is assigned each January 

with an overview of the current control weaknesses 

and risk exposures facing the agency. 
6

Office of Inspector General Semiannual Report to Congress

6 

Office of Inspector General Semiannual Report to Congress

OIG Hotline Information 

The OIG Hotline exists to enable FEC employees, 

FEC contractors, and the public to have direct and 

confdential contact with the OIG. All allegations and 

referrals of fraud, waste, abuse, mismanagement, 

and misconduct involving FEC employees, contractors, programs, operations, property, or funds received through any means are termed “hotline complaints” per OIG policy. Once a hotline complaint has 

been received, a preliminary inquiry is conducted to 

determine whether the hotline complaint will have an 

investigation initiated, referred to management or another agency, or closed with no further action taken. 

The OIG considers many factors when evaluating 

whether to open an investigation based on a hotline 

complaint, and acknowledges that every hotline complaint received by the OIG will not be investigated, 

and in many cases a complaint does not merit an 

investigation. OIG policy requires that hotline complaints be evaluated on certain criteria, including the 

merits of an allegation, the availability of evidence, 

and the existing priorities, commitments, and resources of the OIG. Under this policy, hotline complaints are classifed as either high or low priority 

complaints. High priority complaints are investigated 

and low priority complaints are either closed with no 

action or referred to the appropriate FEC official for 

possible further review. Often, a hotline complaint will 

be closed because a preliminary inquiry found the 

allegations to be unsubstantiated, there is a lack of 

information to proceed, or the issue giving rise to the 

allegation has been otherwise resolved. Hotline evaluation decisions are made by the Chief Investigator, 

with concurrence from the IG. 

The OIG frequently receives reports and allegations 

which are misdirected complaints that should have 

been routed to the Office of Complaints and Legal 

Administration within the Office of General Counsel 

(OGC), are outside the jurisdiction of the OIG or the 

FEC, or are facially unsubstantiated or meritless. In 

cases of misdirected complaints, a response is sent to 

the individual referring him or her to the proper office 

or other agency. In some limited instances where a 

misdirected communication does not concern a campaign fnance violation but falls under the purview of 

another FEC component or government agency, the 

inquiry may be redirected and sent to the appropriate office or agency directly from the OIG. Reviewing 

and, where appropriate, responding to these reports 

and allegations when aggregated can entail a signifcant amount of staff time and effort, despite the fact 

that they are not valid hotline complaints. In order to 

capture and document these hotline contacts, the 

OIG created a category for “hotline inquiries” that do 

not meet the criteria for hotline complaints. 

During this reporting period, 8 new hotline complaints 

were opened and 5 hotline complaints were closed; 

17 hotline complaints remain open. 
7

April 1, 2013 - September 30, 2013

7 

April 1, 2018 – September 30, 2018

 

 

OIG Investigative Information 

OIG investigations seek out facts related to allegations of wrongdoing. OIG investigations may address 

administrative, civil, and criminal violations of laws, 

regulations, and policies. The subject of an OIG investigation can be any agency employee, an FEC 

contractor, consultant, or a person or entity involved 

in alleged wrongdoing affecting FEC programs and 

operations. 

As discussed in OIG Hotline Information, all hotline 

complaints are evaluated to determine if they warrant an investigation. If an investigation is opened, 

the hotline complaint is closed and merged into the 

investigative fle. OIG investigations involve a detailed 

examination or inquiry into issues brought to our attention by various sources, and may include interviews of relevant witnesses and subjects, document 

reviews, and computer forensic examinations. At the 

conclusion of an OIG investigation, the OIG prepares 

a report that sets forth the allegations and an objective description of the facts developed during the 

investigation. 

During this reporting period no new investigations 

were opened, one investigation was closed, and four 

investigations remain open. The closed investigation 

includes: 

Forgery Allegation Against a FEC Employee 

On November 10, 2015, the FEC OIG received 

a complaint and request for assistance from 

United States Postal Inspection Service (USPIS) 

regarding a FEC employee. The complaint alleged that a FEC employee sent a letter using 

District of Columbia Bar Letterhead to a non-FEC 

attorney’s employer, falsely claiming that the attorney was disbarred. Using United States Postal 

Service’s (USPS) purchasing logs, the source 

of payment used to purchase the forged letter’s 

postage was tracked to the FEC’s employee’s 

bank card. The FEC OIG could not determine 

motive or fnd additional information connecting 

the use of FEC resources or official time to the 

forged letter. The USPIS notifed the OIG that it 

closed its investigation. The OIG discussed the 

matter with the FEC Staff Director and Deputy 

General Counsel for Administration. The Staff 

Director’s Office later notifed the OIG that due to 

the time lapse and based on Labor Management 

Agreement provisions negotiated with the FEC’s 

union, no administrative action would be taken 

against the FEC employee. 
8

Office of Inspector General Semiannual Report to Congress

8 

Office of Inspector General Semiannual Report to Congress

Additional OIG Activity 

Besides conducting audits, inspections, and investigations, the OIG performs and is involved in an array of additional projects and activities. As required 

by the Inspector General Act of 1978, as amended 

(IG Act), legislation compiled by the Commission’s 

Congressional Affairs office that may affect agency 

programs and operations is reviewed by the OIG. The 

IG Act states that the Inspector General is responsible for: 1) conducting and supervising audits and investigations relating to the FEC’s programs and operations; 2) detecting and preventing fraud, waste, and 

abuse of agency programs and operations while providing leadership and coordination; 3) recommending policies designed to promote economy, efficiency, 

and effectiveness of the establishment; and 4) keeping the Commission and Congress fully and currently informed about problems and defciencies in FEC 

agency programs and operations, and the need for 

corrective action. 

The Inspector General also reviews and provides 

comments, when appropriate, on legislation provided 

by the Council of Inspectors General on Integrity and 

Efficiency (CIGIE) Legislative Committee. In addition, 

the Inspector General routinely reads all Commission 

agenda items. 

Listed below are examples of the OIG’s additional 

activities: 

The Council of Inspectors General on Integrity 

and Efficiency Purchase Card Project 

Assignment Number: OIG-17-04 

Status: Completed 

The CIGIE Information Technology (IT) Committee’s 

mission is to facilitate effective IT audits, evaluations, and investigations by OIGs, and to provide a 

vehicle to express the OIG community’s perspective 

on Government-wide IT operations. Under its operating principles, this committee strives to promote 

participation by the OIG community members in its 

activities; encourage communication and cooperation with colleagues in the IT feld; and promote effective teamwork in addressing Government-wide initiatives, improving Federal Government IT activities, 

and safeguarding national IT assets and infrastructure. The main objective of this project was to analyze P-Card data to determine risks associated with 

purchase card transactions. 

The OIG volunteered to participate in this CIGIE 

IT Committee’s Government-wide purchase card 

(P-Card) project and completed testing during the previous reporting period. The FEC OIG compiled, certifed, and submitted its results to the U.S. Department 

of Agriculture (USDA) OIG which agreed to compile 

all OIG results and publish a consolidated report for 

the CIGIE IT Committee. The FEC OIG obtained the 

draft consolidated report from USDA P-Card team 

on April 4, 2018, and provided comments to USDA 

P-Card team on April 20, 2018. The CIGIE consolidated report (CIGIE Report on the Government 

Purchase Card Initiative) was released in July 2018. 

The FEC OIG also issued a Management Letter to 

formally communicate the results of the P-Card review to FEC management. Based on work performed, 

we found that all 46 transactions tested appear to be 

legitimate business expenses and we did not identify 

any potential fraudulent purchases. However, we did 

fnd one control defciency related to a lack of separation of duties for one P-Card holder. The FEC OIG 

made two suggestions for FEC Management to consider to reduce the risk of unauthorized purchase 

card transactions. 
9

April 1, 2013 - September 30, 2013

9 

April 1, 2018 – September 30, 2018

Office of Management and Budget (OMB) 

Revised OMB Circular A-123, Appendix A 

Assignment Number: N/A 

Status: Completed 

In April 2018, OMB forwarded a draft memoran-

dum which would revise OMB Circular A-123, 

Management's Responsibility for Risk Management 

and Internal Control, Appendix A to the CIGIE Digital 

Accountability and Transparency Act Working Group 

(DAWG) for review and comment. The memoran-

dum for the circular includes a temporary require-

ment for agencies to develop Federal spending 

data quality control plans to be considered as part 

of agencies’ annual assurance statements. In ad-

dition, the revised A-123 Appendix A would supersede OMB Memorandum, Improving Data Quality 

for USAspending.gov (June 12, 2013) and OMB 

Memorandum M-15-12, Increasing Transparency of 

Federal Spending by Making Federal Spending Data 

Accessible, Searchable, and Reliable (May 8, 2015). 

As these revised requirements could impact the 

CIGIE community’s oversight work mandated by the 

Digital Accountability and Transparency Act (DATA 

Act), the FEC OIG employee who is a member of the 

DAWG reviewed the proposed requirements and pro-

vided comments that were consolidated and submit-

ted as part of the DAWG official comments. The re-

vised OMB Circular A-123 Appendix A, Management 

of Reporting and Data Integrity Risk (M-18-16) was 

fnalized on June 6, 2018, and became effective im-

mediately. The FEC OIG is also providing input to in-

corporate appropriate changes into the DAWG’s re-

vised CIGIE DATA Act Required Review Guide which 

will be used by the IG community when conducting 

the 2019 mandatory DATA Act audits. 
10

Office of Inspector General Semiannual Report to Congress

10 

Office of Inspector General Semiannual Report to Congress

Council of the Inspectors General on Integrity and 

Efficiency 

Deputy Inspector General J. Cameron Thurber, attended CIGIE meetings, as well as meetings of 

the Professional Development Sub Committee and 

Small/Unique OIGs. He also instructed CIGIE’s IG 

Authorities training course. 
April 1, 2013 - September 30, 2013

April 1, 2018 – September 30, 2018

OIG Contacts 

OIG contacts run the gamut, from citizens expressing their views or trying to reach the right FEC component to 

graduate students doing research. Contacts requesting information concerning where to submit a complaint or 

concern are directed to the appropriate FEC component or other agency. Other citizen contacts are handled and 

responded to as appropriate for the circumstances. 

The table below is a refection of the total contacts received by the OIG for the past six months – April 1, 2018 

through September 30, 2018. These contacts were made through various sources such as telephone calls, 

emails, faxes, U.S. mail, and personal visits to the OIG. Those forwarded for action were referred to another FEC 

component and/or appropriate outside source. 

Total OIG No Action Forwarded 

Contacts Action Necessary for Action 

3,398 152 3,210 36 

1111
Office of Inspector General Semiannual Report to Congress

Office of Inspector General Semiannual Report to Congress

List of Training, Meetings 

and Conferences 

The chart listed below depicts training, meetings, programs, seminars, and/or conferences attended by the 

Inspector General and/or the OIG staff for the period April 1, 2018 – September 30, 2018: 

MEETINGS: 

Host / Sponsor Topic / Subject 

FOIA Working Group 

Council of Counsels to the Inspectors General Monthly Meetings 

Small OIG Working Group 

Council of Inspectors General on 

Integrity and Effciency (CIGIE) 

2018 CIGIE/GAO Financial Statement Audit 

Conference 

2018 FAEC Conference 

Annual Leadership Conference 

CIGIE DAWG Quarterly Meetings 

CIGIE ERM Working Group 

Data Analytics Community of Practice 

FAEC Meetings 

Leadership Development Subcommittee Meetings 

Next Data Act Analytics Community of Practice 

Professional Development Committee Meetings 

Quarterly Small / Unique IG Quarterly Meetings 

Government Accountability Offce DATA Act Working Group Joint Meetings 

Federal Election Commission 

Bi-weekly Directors’ Meetings with IG, 

Acting GC, SD & Acting CFO 

Finance Committee Meetings 

New Employee Orientations 

Administrative Liaison Groups Meetings 

Information Systems Audit and Control Association 2018 Annual Conference 

1212
April 1, 2013 - September 30, 2013

April 1, 2018 – September 30, 2018

TRAINING/CONFERENCES: 

Host / Sponsor 

Association of Certifed Fraud Examiners 

Topic / Subject 

29th Annual Fraud Conference 2018 

Understanding the Mindset of a Fraudster 

Council of the Inspectors General on 

Integrity and Effciency Building on 40 Years of Excellence in Independent Oversight 

DC Bar Handling Whistleblower Claims 2018, 

Part 1: Rights of Federal Employees 

Federal Election Commission 

Active Shooter 

Information Security Awareness 

Mandatory COOP Training 

Occupant Emergency Plan Training 

Skype for Business: Calls , IMs, and Meeting Features 

Skype for Business: New Features, Profle, and Contacts 

FedVTE Introduction to Investigation of Digital Access 

FAITAS FCOR Refresher 

FELTG EEOC Nuts & Bolts: The Basics 

EEOC Law Week 

Institute of Internal Auditors 

Emerging Audit Trends 

How to Audit Culture 

Managing Fraud Risk Using Root Cause Analysis and Other 

Tools 

Serving as a DC Chapter Offcer 

Management Concepts Manage Risk through Effective Enterprise Management 

Overview of Internal Control Guidance 

Offce of Special Counsel Hatch Act Training 

Potomac Forum Managing Government Records (RM) Training Workshop XVI 

USDA Analysis Techniques for Auditors 

Federal Budgeting for Non-Budgeting Personnel 

Your Internal Controls FISMA-Vulnerability Assessment – Privacy - DATA Act 

1313
Office of Inspector General Semiannual Report to Congress

Office of Inspector General Semiannual Report to Congress

Reporting Requirements 

Reporting requirements required by the Inspector General Act of 1978, as amended by the Inspector 

General Act Amendments of 1988 are listed below: 

IG ACT DESCRIPTION PAGE 

Section 4(a)(2) Review of Legislation 8 

Section 5(a)(1) Signifcant Problems, Abuses, and Defciencies None 

Section 5(a)(2) Recommendations with Respect to Signifcant Problems, Abuses, 

and Defciencies None 

Section 5(a)(3) Recommendations Included in Previous Reports on Which 

Corrective Action Has Not Been Completed (Table III) 18 

Section 5(a)(4) Matters Referred to Prosecuting Authorities None 

Section 5(a)(5) Summary of Instances Where Information was Refused None 

Section 5(a)(7) Summary of Signifcant Reports 1 

Section 5(a)(8) Questioned and Unsupported Costs (Table I) 16 

Section 5(a)(9) Recommendations that Funds be put to Better Use (Table II) 17 

Section 5(a)(10)(A) Summary of Audit Reports issued before the start of the Reporting 

Period for which no Management Decision has been made N/A 

Section 5(a)(10)(B) 

Summary of Audit Reports Issued Before the start of the Reporting 

Period for which No Management Comment was Returned within 60 Days 

N/A 

Section 5(a)(10)(C) 

Summary of Audit Reports Issued Before the Start of the Reporting 

Period for which There Are Outstanding Unimplemented 

Recommendations 

21; App. B 

Section 5(a)(11) Signifcant revised Management Decisions N/A 

1414
April 1, 2013 - September 30, 2013

April 1, 2018 – September 30, 2018

Reporting requirements required by the Inspector General Act of 1978, as amended by the Inspector 

General Act Amendments of 1988 are listed below: 

Section 5(a)(12) Management Decisions with which the Inspector General is 

in Disagreement None 

Section 5(a)(11) Peer Review Recommendations 20; App. A 

Section 5(a)(17),(18) Investigative Reports Table and Metrics (Table IV) 19 

Section 5(a)(19) Investigations Involving a Senior Government Employee with 

Substantiated Misconduct None 

Section 5(a)(20) Instances of Whistleblower Retaliation None 

Section 5(a)(21) Attempts by the Agency to Interfere with OIG Independence None 

Section 5(a)(22) Undisclosed Inspections, Evaluations, Audits, and Investigations None 

1515
Office of Inspector General Semiannual Report to Congress

Office of Inspector General Semiannual Report to Congress

Table I 

Inspector General issued reports with questioned costs (dollar value in thousands) 

NUMBER QUESTIONED 

COSTS 

UNSUPPORTED 

COSTS 

A. For which no management decision has been made 

by commencement of the reporting period 0 0 0 

B. Which were issued during the reporting period 0 0 0 

Sub-Totals (A&B) 0 0 0 

C. For which a management decision was made during 

the reporting period 0 0 0 

(i) Dollar value of disallowed costs 0 0 0 

(ii) Dollar value of costs not disallowed 0 0 0 

D. For which no management decision has been made 

by the end of the reporting period 0 0 0 

E. Reports for which no management decision was 

made within six months of issuance 0 0 0 

1616
April 1, 2013 - September 30, 2013

April 1, 2018 – September 30, 2018

Table II 

Inspector general issued reports with recommendations that funds be put to better use 

Number Dollar Value 

(In Thousands) 

A. For which no management decision has been made by the 

commencement of the reporting period 

0 0 

B. Which were issued during the reporting period 0 0 

C. For which a management decision was made during the 

reporting period 

0 0 

(i) dollar value of recommendations were agreed to by 

management 

0 0 

based on proposed management action 0 0 

based on proposed legislative action 0 0 

(ii) dollar value of recommendations that were not agreed to 

by management 

0 0 

D. For which no management decision has been made by the 

end of the reporting period 

0 0 

E. Reports for which no management decision was made within 

six months of issuance 

0 0 

1717
Office of Inspector General Semiannual Report to Congress

Office of Inspector General Semiannual Report to Congress

Table III 

Summary of audit and inspection reports with corrective actions outstanding for more than six 

months 

Report Title 

2010 Follow-up Audit of Privacy and 

Data Protection 

2010 Follow-up Audit of Procurement and 

Contract Management 

Inspection of the Federal Election 

Commission’s Disaster Recovery Plan and 

Continuity of Operations Plans 

Audit of the Federal Election Commission’s 

Offce of Human Resources 

Report 

Number 

OIG-10-03 

OIG-10-02 

OIG-12-06 

OIG-12-05 

Issue 

Date 

03/11 

06/11 

01/13 

07/13 

Recommendations 

Number Closed Open 

45 22 23 

29 28 1 

30 23 7 

26 23 3 

Cost 

Savings 

0 

0 

0 

0 

Inspection of FEC’s Compliance with FMFIA/ 

OMB Circular A-123 

OIG-14-01 06/14 8 4 4 0 

Audit of the FEC's Telework Programs OIG-15-03 06/16 9 0 9 0 

Required Review Under the DATA Act OIG-17-05 11/17 4 1 3 0 

Cumulative Total Of Outstanding Recommendations: 50 

Total Cost Savings: 0 

1818
April 1, 2013 - September 30, 2013

April 1, 2018 – September 30, 2018

Table IV 

Summary of Investigative Reports 

Number 

Total Number of Investigative Reports Issued 1 

Total Number of Persons Referred to DOJ for Criminal Prosecution 0 

Total Number of Persons Referred to State and Local Prosecuting Authorities for Criminal 

Prosecution 0 

Total Number of Indictments and Criminal Information Resulting from Any Prior Referral to 

Prosecuting Authorities 0 

Metrics Used for Developing Data for Table IV: 

The Total Number of Investigative Reports Issued refects the number of all Reports of Investigation (ROI) issued 

to FEC management, the Department of Justice, or State and local prosecuting authorities during the reporting 

period; 

The Total Number of Persons Referred to DOJ for Criminal Prosecution and Total Number of Persons Referred to 

State and Local Prosecuting Authorities for Criminal Prosecution refects the total number of referrals for criminal 

prosecution made by the FEC OIG to the respective criminal prosecuting authorities during the reporting period; 

The Total Number of Indictments and Criminal Informations Resulting from Any Prior Referral to Prosecuting 

Authorities includes all indictments and informations issued during the reporting period by Federal, State, or local 

criminal prosecuting authorities based upon any referral by the FEC OIG, whether the referral was made during 

this reporting period or a prior reporting period. OIG, whether the referral was made during this reporting period 

or a prior reporting period. 

1919
20

Office of Inspector General Semiannual Report to Congress

20 

Office of Inspector General Semiannual Report to Congress

 

 

 

Appendix A 

PEER REVIEW RESULTS 

In accordance with the Dodd-Frank Wall Street 

Reform and Consumer Protection Act of 2010 

(Section 989C of P.L. 111-203), which amended 

Section 5 of the Inspector General Act of 1978, OIGs 

are required to include in their semiannual reports 

(SAR) to Congress the results of peer reviews of their 

offices, as well as outstanding and not fully implemented recommendations from peer reviews the OIG 

received from another OIG, and outstanding and not 

fully implemented recommendations the OIG made 

in any peer review it performed for another OIG. 

The last audit peer review of the FEC OIG was 

conducted by the Farm Credit Administration OIG 

and the report was issued on February 15, 2017. 

No recommendations were included in the last 

peer review report and there are no outstanding 

recommendations from previous peer reviews. 

Peer Review of the Postal Regulatory 

Commission OIG 

Assignment Number: OIG -18-04 

Status: Completed September 28, 2018 

The FEC OIG conducted a modifed peer review of 

the Postal Regulatory Commission (PRC) Office of 

Inspector General during this reporting period. The 

peer review entrance conference was held on June 

12, 2018, and feldwork was completed in August 

2018. Following the completion of the feldwork, the 

FEC peer review team held an exit conference with 

the PRC IG and staff on September 11, 2018, to discuss the results of the peer review and fndings to 

be included in the draft letter of comment. The FEC 

OIG prepared the draft report and letter of comment 

based on the documentation and evidence reviewed, 

and information discussed during the exit conference. 

The fnal draft report and letter of comment was 

provided to PRC OIG on September 11, 2018. The 

PRC OIG provided official written response to the 

FEC OIG on September 28, 2018. The PRC OIG 

agreed with the peer review results. The FEC OIG 

completed and provided the fnal peer review report 

and letter of comment to PRC OIG on September 

28, 2018. The fnal peer review report did not include any recommendations. 
April 1, 2013 - September 30, 2013

April 1, 2018 – September 30, 2018

Appendix B 

Appendix B 

REVIEW OF OUTSTANDING 

RECOMMENDATIONS AS OF 

AUGUST 2087 (ATTACHED) Federal Election Commission 

Office of Inspector General 

Review of Outstanding Recommendations 

as of August 2018 

September 2018 

Assignment No. OIG-18-03

2121
22

Office of Inspector General Semiannual Report to Congress

22 

Office of Inspector General Semiannual Report to Congress

 

Office of Inspector General’s 

Review of 

Outstanding Recommendations as of

August 2018 

Report Revisions 

Per Commission Directive 50: Audit Follow-up, the Office of Management and Budget’s 

Circulars A-50, Audit Follow Up and A-123, Management’s Responsibility for Enterprise Risk 

Management and Internal Controls (as revised), management is required to timely implement 

corrective actions to address reported deficiencies in agency programs. Since fiscal year (FY) 

2012, as a courtesy to governance, the Office of Inspector General (OIG) has provided the 

Commission with semiannual reports regarding the status of management’s corrective actions for 

deficiencies that have been outstanding for six months or more. The OIG’s objective in issuing 

these Commission reports is to provide governance with an understanding of the risks that exist 

in the FEC’s environment, and ensure management is held accountable for sufficiently and 

timely addressing those risks. 

Starting FY 2019, the OIG will be revising our follow-up process and providing an annual 

Commission report regarding outstanding recommendations. As in the past, the report will still 

contain the OIG’s review of recommendations that have been outstanding for six months or more 

and any progress management has made to address these recommendations. The report will be 

issued as of February of each year. Although the OIG will only be submitting an annual report, 

follow-up on outstanding recommendations will still be conducted biannually, documented, and 

tracked in real-time in the OIG’s reporting database. 

Summary of Review 

For the last semiannual status report of FY 2018, the OIG reviewed and assessed management’s 

latest corrective action plans provided to the Commission as of May 2018 for the six audits and 

inspections reported in our previous report, Review of Outstanding Recommendations as of 

March 2018. In addition, for this report we included the Required Review Under the DATA Act 

(Data Act) audit report released November 2017, as its recommendations have been outstanding 

for six months or more. 

Collectively, these audits and inspections had 58 outstanding recommendations that required 

follow-up for this review period. Based on the results of the follow-up review, the OIG was able 

to close 8 of the 58 outstanding recommendations. The details of the OIG‘s review is included in 

the body of this report, along with the an attachment of the OIG’s corrective action plan (CAP) 

report containing the official status of all outstanding recommendations. 
23

April 1, 2013 - September 30, 2013

23 

April 1, 2018 – September 30, 2018

 

 

 

Table Summary of Results 

The table below summarizes the progress made by FEC management since the OIG’s last 

reporting period and the total outstanding recommendations as of August 2018. 

OIG Audits/Inspection 

Total Outstanding 

Recommendations 

as of March 2018 

Total Closed Total Open as of 

August 20181 

2010 Follow-up Audit of Privacy 

and Data Protection 

7 years outstanding 

25 2 23 

2010 Follow-up Audit of 

Procurement and Contract 

Management 

6 years outstanding 

1 0 1 

Inspection of the FEC’s 

Disaster Recovery Plan and 

Continuity of Operations Plans

5 years outstanding 

9 2 7 

Audit of the FEC’s Office of 

Human Resources 

4 years outstanding 

5 2 3 

Inspection of FEC’s Compliance 

with FMFIA/OMB A-123 

4 years outstanding 

5 1 4 

Audit of the FEC Telework 

Programs 

2 years outstanding 

9 0 9 

Required Review Under the DATA 

Act 

9 months outstanding 

4 1 3 

Total Outstanding Recommendations 50 

1 Column numbers may include recommendations that management has disagreed with or has not adequately 

implemented, and the OIG concludes that these recommendations are still open. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 2 | P a g e 
24

Office of Inspector General Semiannual Report to Congress

24 

Office of Inspector General Semiannual Report to Congress

Audit Follow-up Meetings/Communications 

Closed Audits/Inspections2 

The OIG did not close any audits or inspections this review period. 

Open Audits/Inspections 

A. Required Review Under the DATA Act 

The FEC OIG’s Required Review under the DATA Act (DATA Act Audit) was released 

in November 2017. The DATA Act Audit report identified four recommendations. This 

is the first follow-up for the DATA Act Audit. In August 2018, the OIG met with the 

DATA Act program members to discuss the status of the open recommendations. The 

OIG acknowledges that FEC Management has implemented revised quarterly 

reconciliation and certification processes and procedures. The OIG has reviewed the 

revised procedures and note they are adequately designed to address the DATA Act 

requirements related to ensuring data files are complete, accurate, and of quality. The 

OIG recorded the status update in our tracking database, and was able to close one of four 

recommendations. However, the OIG was informed that there are still some issues with 

the DATA Act files submitted to another agency with responsibilities in posting the 

FEC’s data. FEC management is continuing to work with the Federal Shared Service 

Provider to determine the root cause and correct these issues. Until the existing data 

issues are resolved and the IG can verify that the control processes are operating 

effectively, the remaining recommendations cannot be closed. There are three 

outstanding recommendations for this reporting period. 

For details on current outstanding recommendations, see Attachment A 

B. 2010 Follow-up Audit of Privacy and Data Protection 

For the 2010 Follow-up Audit of Privacy and Data Protection (Privacy Audit), the OIG’s 

Review of Outstanding Recommendations as of March 2018 report identified 25 open 

recommendations. For this review period, the OIG reviewed management’s May 2018 

CAP sent to the Commission and also met with the FEC’s new Privacy Team leader to 

discuss the open items. Based on the OIG’s meeting with the Privacy Team leader, the 

Privacy Audit CAP has been updated with revised implementation dates and current 

2 An audit or inspection is closed when the OIG determines that all applicable recommendations have been 

adequately addressed and/or management has determined that it will accept the risks of not implementing the OIG’s 

recommendation. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 3 | P a g e 
25

April 1, 2013 - September 30, 2013

25 

April 1, 2018 – September 30, 2018

corrective actions to address the identified issues for the first time since February 2015. 

In addition, the OIG was able to close 2 of the 25 open recommendations based on our 

follow-up review. 

For details on current outstanding recommendations, see Attachment B 

C. 2010 Follow-up Audit of Procurement and Contract Management 

The 2010 Follow-up Audit of Procurement and Contract Management was issued in June 

2011. The OIG’s Review of Outstanding Recommendations as of March 2018 report 

identified only one open recommendation related to the updated Directive 66, which is 

the overarching agency-wide policy for procurement and acquisitions. This 

recommendation is still open this reporting period. 

For details on current outstanding recommendations, see Attachment C 

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans 

The Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans 

(COOP Inspection) report was released in January 2013. The OIG’s Review of 

Outstanding Recommendations as of March 2018 report identified nine outstanding 

recommendations. The OIG reviewed management’s May 2018 CAP sent to the 

Commission and noted two recommendations that had been implemented related to 

COOP training. The OIG recorded the management’s activity in our tracking database 

and closed the two recommendations, leaving seven outstanding recommendations for 

this reporting period. 

For details on current outstanding recommendations, see Attachment D 

E. Audit of the FEC’s Office of Human Resources 

The Audit of the Federal Election Commission’s Office of Human Resources (OHR 

Audit) report was issued in July 2013. The OIG’s Review of Outstanding 

Recommendations as of March 2018 report identified five open recommendations for the 

OHR audit report. The OIG met with the Director of OHR to discuss status of open 

recommendations. The OIG confirmed that the OHR has converted all hiring related 

processes to the USA Staffing automated system which follows the standard OPM 80 day 

hiring model. This new system utilizes workflow and has automated the hiring process 

including the tracking of each vacancy. The OIG also acknowledges that a standard 

operating procedures manual was also developed for this new process. Therefore, the 

OIG was able to close two of the five open recommendations related to the hiring and 

selection process. There are three outstanding recommendations for this reporting period. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 4 | P a g e 
26

Office of Inspector General Semiannual Report to Congress

26 

Office of Inspector General Semiannual Report to Congress

For details on current outstanding recommendations, see Attachment E 

F. Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123 

The Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123 (A-123 

Inspection) was released in June 2014. The OIG’s Review of Outstanding 

Recommendations as of March 2018 report identified five open recommendations for the 

A-123 Inspection report. Through follow-up inquiries with OCFO and a member of the 

A-123 Task Force, the OIG confirmed that the revised Directive 53 was submitted to the 

Commission for review and approval. Also, the OIG reviewed supporting documentation 

related to the process for ensuring any new program office members to be involved in the 

annual ICR process are trained timely. The OIG verified that this process has been fully 

implemented, and was able to close one of the five open recommendation. The OIG notes 

that OMB recently rolled out a new A-123 Appendix A that aligns the annual ICR 

assessment process with the guidance around the implementation of an Enterprise Risk 

Management (ERM) framework, which require risk assessments to incorporate ERM 

concepts and fraud risk assessments. This new guidance may require additional 

documentation and/or changes to the annual ICR process. The OIG will assess once these 

new requirements have been fully implemented. Therefore, four outstanding 

recommendations remain open for this reporting period. 

For details on current outstanding recommendations, see Attachment F 

G. Audit of the FEC’s Telework Programs 

The Audit of the FEC’s Telework Programs (Telework Audit) was released in June 2016. 

The OIG’s Review of Outstanding Recommendations as of March 2018 report identified 

nine open recommendations for the Telework Audit report. The OIG reviewed 

management’s May 2018 CAP sent to the Commission and noted a revised 

implementation date for generating telework reports to be utilized to monitor and assess 

the telework programs. The OIG recorded the status update in our tracking database. 

However, we are unable to close any recommendations until corrective actions are fully 

implemented and are operating effectively. Therefore, there are still nine outstanding 

recommendations for this reporting period. 

For details on current outstanding recommendations, see Attachment G 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 5 | P a g e 
27

April 1, 2013 - September 30, 2013

27 

April 1, 2018 – September 30, 2018

Background 

As required by the Inspector General Act of 1978, as amended, the OIG is responsible 

for conducting audits of the FEC’s programs and operations. In addition to conducting 

and supervising audits, the OIG also has the responsibility to conduct audit follow-ups 

to ensure that management has effectively implemented OIG recommendations. Audit 

follow-up, including the timely implementation of audit recommendations by FEC 

management, is required by Office of Management and Budget Circular A-50, Audit 

Follow-up, as revised, and FEC Directive 50: Audit Follow-up. 

At the conclusion of each OIG audit and inspection, it is management’s responsibility to 

develop a corrective action plan (CAP). The CAP identifies the plan management has 

developed to address the OIG’s findings and recommendations. The CAP should detail the 

following: 

1. assignment of Audit Follow-up Official, who is responsible for overseeing the 

corrective action; 

2. OIG finding(s); 

3. OIG recommendation(s); 

4. detailed corrective action to implement the OIG’s recommendation(s); 

5. FEC staff person with responsibility to implement each task; and 

6. expected completion dates. 

Once management drafts the CAP, the OIG then reviews the CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the 

final CAP to the Commission with a courtesy copy to the OIG. 

FEC Directive 50 requires management to: 

(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission...; 

In order to work effectively with FEC management in adhering to FEC Directive 50, 

and to ensure continuous monitoring and adequate and timely audit resolution, the 

OIG communicates with management at least semiannually to discuss the status of 

outstanding OIG recommendations. If management has implemented any corrective 

action(s), the OIG schedules a meeting with management to discuss the 

implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (e.g., new/updated policies, procedures, and processes to improve 

internal controls). 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 6 | P a g e 
28

Office of Inspector General Semiannual Report to Congress

28 

Office of Inspector General Semiannual Report to Congress

 

 

 

 

 

 

To provide management with timely feedback and the results of our review prior to 

management’s reporting deadlines to the Commission in May and November, the OIG 

conducts a scheduled review of outstanding recommendations as of February and August of 

each year, and provides an annual report to the Commission. The semiannual meetings are 

also intended to assist the audit follow-up official in following provisions 4 through 6 of 

Directive 50, which are listed as follows: 

(4) Respond in a timely manner to all audit reports; 

(5) Engage in a good faith effort to resolve all disagreements; and 

(6) Produce semi-annual reports that are submitted to the agency head. 

The official status (open/closed) of OIG recommendations is determined by the OIG 

once the OIG has verified that management has adequately implemented the corrective 

actions. The Inspector General can also make a decision to close recommendations or 

seek resolution from the Commission for recommendations where the OIG and 

management disagree. Lastly, the number of outstanding recommendations is also 

reported to the Commission and Congress in the OIG’s Semiannual Reports to Congress. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 7 | P a g e 
April 1, 2013 - September 30, 2013

April 1, 2018 – September 30, 2018

ATTACHMENTS 

A – G 

*Corrective Action Plans are as of September 25, 2018 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 8 | P a g e 

2929
Office of Inspector General Semiannual Report to Congress April 1, 2013 - September 30

Office of Inspector General Semiannual Report to Congress

Recommendation Actual Issue Date Estimated 

Implementation Date Last Status Update 

Revised 

Implementation 

Date 

Days Past Due OIG Follow-up 

Attachment A: Data Act Audit 

The SAO should ensure adequate control procedures 

are implemented to ensure data files are complete, 

accurate, timely, reconciled, and properly linked. 

11/30/2017 6/1/2018 

The DATA Act quarterly 

reconciliation and certification 

procedures have been updated. Also, 

File D1 is now reviewed monthly to 

identify and correct any errors prior to 

the submission. The SAO reviews the 

reconciliation spreadsheet and meets 

with the DATA Act program group to 

discuss data issues identified prior to 

certifying the DATA files in the 

Broker. 

Not Provided 116 

The OIG reviewed the updated 

reconciliation and certification procedures 

and they appear adequate to satisfy DATA 

Act requirements related to ensuring data 

files are complete, accurate, and of 

quality. OIG confirmed that File D1 is also 

reviewed monthly to identify and correct 

errors timely. However, there are still 

some data quality and recurring data 

linkage issues. The OIG was informed that 

some of these issues require corrective 

actions by the FSSP. Although, FEC 

management continues to work with the 

FSSP to resolve data issues, the FSSP will 

not guarantee that data will be corrected or 

DATA files will be resubmitted to the 

Broker. OIG notes that until corrective 

actions have been fully implemented to 

ensure accurate DATA Files are submitted 

to the Broker, this recommendation can 

not be closed. 

The FEC DATA Act PMO and Senior Accountable 

Official (SAO) should work with the FSSP to ensure 

appropriate corrective actions are implemented to 

ensure all future DATA Act submissions are 

submitted on time and the files are complete 

11/30/2017 6/1/2018 

All DATA files are being submitted 

to the Broker on time. However, there 

are still some accuracy and quality 

issues identified with some of the 

DATA files, but they are not always 

corrected by the FSSP and the FSSP 

will not commit to resubmit files. 

FEC management continues to work 

with the FSSP to resolve data issues. 

Not Provided 116 

OIG notes that until these data issues can 

be resolved, this recommendation can not 

be closed. 

The SAO should ensure that proper controls are in 

place to ensure all non-financial data related to Procurement is reviewing policies and 

standard data elements are entered into the Procurement is reviewing policies and procedures and is in the process of 

procurement system correctly. 

11/30/2017 6/1/2018 

procedures and is in the process of 

retraining and reeducating program 

offices in how to initiate an enter 

award data into Comprizon. Also, 

DATA Act program staff is reviewing 

File D1 monthly to identify any issues 

prior to the quarterly submission. 

Not Provided 116 

retraining and reeducating program offices 

in how to initiate an enter award data into 

Comprizon. Also, DATA Act program 

staff is reviewing File D1 monthly to 

identify any issues prior to the quarterly 

submission. This recommendation can not 

be closed enter the OIG can verify that the 

process is operating effectively. 

30 

30 
0, 2013

April 1, 2018 – September 30, 2018

Recommendation Actual Issue 

Date 

Estimated 

Implementation Date Last Status Update 

Revised 

Implementation 

Date 

Days Past Due OIG Follow-up 

Attachment B: 2010 Follow-up Audit of Privacy and Data Protection 

Should develop and maintain a comprehensive list 

of all vendors that handle PII. 

3/31/2011 9/30/2011 

Work with the Contracting Officer and CORs to 

develop a process to maintain a comprehensive list 

of PII vendors. 

10/1/2018 -6 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Develop a standardized template to allow system 

managers to accurately document SORs 

independently of the Privacy Team. 3/31/2011 2/29/2012 Develop a form template to send to managers to 

submit any SOR additions. 10/1/2018 -6 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Enhance existing guidelines and procedures to 

include timelines and deadlines that promote regular 

review and timely updates to SORs. 3/31/2011 1/31/2012 

Create a biennial (every 2 years) SOR review policy 

and review checklist and documentation of that 

review to be signed by the Chief Privacy Officer to 

ensure SORs reviewed. 

10/1/2018 -6 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Develop and implement policies and procedures that 

define monitoring and reporting processes to ensure 

SORs are updated and amendments published in 

accordance with Federal regulations by: 1) providing 

regular training to FEC managers and SOR system 

owners/managers; 2) establish deadlines, based on 

the legal requirements of OMB A-130, for 

documenting the new SORs, revisions to existing 

SORs, and publish the updated SORN; 3) providing 

legal assessment of potential changes in SORs and 

quality assuring the SORs produced by system 

owners/managers; 4) including performance 

standards in employee performance plans that are 

linked to successful compliance with Federal 

regulations; and 5) requiring regular reporting of 

compliance with the timelines to the Commission. 

3/31/2011 3/31/2012 

Send a memo to FEC managers explaining the 

institution and use of the SOR addition form and 

requesting any SOR additions by Dec 2018. By 

March 31, 2019, the privacy counsel will conduct 

the first biennial SOR review and update the SORs 

for the FEC. After this first review, the privacy team 

will continue conducting legal assessments of 

potential system of record changes and also will 

accept submissions of SORs using the SOR addition 

request form from managers outside the Privacy 

Team. A record of the Biennial SOR reviews will be 

kept for the IG to review. Privacy Counsels 

standards include reference to keeping accurate 

records and reviewing departments for changes. 

11/1/2018 -37 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Complete legal reviews of OMB memoranda on a 

more timely basis and consistently communicate the 

results of the affected stakeholders, with a copy to 

the co-Chief Privacy Officers. 

3/31/2011 6/30/2011 

OGC will create a policy memo and tracking system 

to ensure new OMB memoranda are reviewed and 

make this system available for IG review. 

11/1/2018 -37 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Finalize the evaluation of the draft STSI 

recommendations and develop, document and 

implement a corrective action plan as necessary. 

Progress against the corrective action plan should be 

formally and periodically reported to management. 

3/31/2011 2/29/2012 

Review STSI report, notate on report which action 

items correspond to the CAP and refer IG to the 

current CAP plan to resolve those joint STSI and 

CAP audit items. If any items on the STSI plan do 

not correspond to the CAP plan these will be 

addressed and resolved. This document will be 

provided to the IG. 

11/1/2018 -37 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

31 

31 
32 

Office of Inspector General Semiannual Report to Congress April 1, 2013 - September 30

32 

Office of Inspector General Semiannual Report to Congress

ISSO, Physical Security Officer, and/or division 

management should conduct regular walkthroughs Create a policy to conduct yearly walkthroughs to Reviewed management's 

to ensure that agency staff complies with privacy ensure staff comply with privacy and information updated corrective action plan 

and information security standards are being met. 3/31/2011 9/30/2011 security standards. Document findings. Make log 12/1/2018 -67 and will assess the adequacy of 

Implementation of these action items are subject to documenting yearly walkthroughs available to IG for implementation once 

Commission notification and/or approval. inspection. completed. 

Contracting Officer and COTRs should enforce the 

requirement for contractors to certify secure 

destruction or return of FEC information in both 

paper and electronic format 

3/31/2011 9/30/2011 

Create and institute an exit checklist for contracts 

that are ending that ensures that contractors return or 

securely destroy FEC information when no longer 

needed. 

12/1/2018 -67 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Should establish policy and procedures requiring 

COTRs to inspect the physical space occupied by 

contractors when the contractor departs to ensure 

paper and electronic records are securely disposed 

of or filed 

3/31/2011 9/30/2011 

Create and institute an exit checklist for contracts 

that are ending that includes an inspection of 

contractor-occupied space after termination of the 

contract. 

12/1/2018 -67 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Update and maintain the inventory of all systems 

that contain PII for all the divisions. A potential 

approach is to use the templates created by STSI and 

have each division update their current listing and 

implement business processes to continually update 

the inventory based on new or revised handling and 

storage of PII. A full review could be conducted by 

3/31/2011 4/30/2012 Update the 2009 PII review inventory and provide 

proof of this procedure to the IG. 2/1/2019 -129 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

the divisions at least annually and would help 

support the biennial Privacy Act Systems of Records 

update process. 

completed. 

Provide the Privacy Team’s SSN Reduction Plan 

Phase 1 report to the applicable division heads, and 

work with those offices to prepare action plans to 

address the findings in the report. 3/31/2011 3/31/2012 

Audit and inventory Social Security Number and PII 

usage within FEC. Interview information owners 

and determine whether PII and SSN collection and 

storage is necessary. Prepare spreadsheet reporting 

these findings to IG. (4c) Remediate by eliminating 

unnecessary uses of PII and SSNs (4d) and reporting 

results to IG. This process will be completed once 

per fiscal year. A record will be kept noting that we 

2/1/2019 -129 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Complete Phase 2 and Phase 3 of the “FEC’s Plan to 

Review and Reduce Holdings of Personally 

Identifiable Information and Eliminate Unnecessary 

Use of Social Security Numbers In Response to 

OMB Memorandum M-07-16, Safeguarding Against 

and Responding to the Breach of Personally 

Identifiable Information” as soon as practical. This 

can be accomplished by providing the STSI results 

to the divisions and requesting a response on the 

ability to reduce or eliminate the questionable uses 

of social security numbers already identified by the 

contractor. 

3/31/2011 3/31/2012 

Audit and inventory Social Security Number and PII 

usage within FEC. Interview information owners 

and determine whether PII and SSN collection and 

storage is necessary. Prepare spreadsheet reporting 

these findings to IG. (4c) Remediate by eliminating 

unnecessary uses of PII and SSNs (4d) and reporting 

results to IG. This process will be completed once 

per fiscal year. A record will be kept noting that we 

completed this process each year. 

2/1/2019 -129 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 
33 

0, 2013

33 

April 1, 2018 – September 30, 2018

Include a record in the inventory listing of whether Reviewed management's 

the device is encrypted or not. 

3/31/2011 9/30/2011 Management will provide a report that shows that 

devices are encrypted. 2/1/2019 -129 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Work with the Physical Security Officer, the FEC 

Records Officer, and FEC management to 

incorporate SORs assessment processes into 

electronic and paper records management processes. 3/31/2011 3/31/2012 

Management will consider whether in 

undocumented SORs exist in the Records 

Management processes (Commission Secretary 

Office) and Physical Security procedures (badging 

system info, etc.) if in paper or electronic form. 

5/1/2019 -218 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Division managers should work with the Physical 

Security Officer and the Records Officer to assess 

records management and secure storage needs and 

address failures to adequately secure sensitive 

information noted during the walkthrough. 

3/31/2011 9/30/2011 

Resolve issues found in walkthrough. Include in the 

discussion the pros and cons of locking suite doors 

after business hours. 

7/1/2019 -279 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Should review on a regular basis all of the privacy 

and data security policies, procedures, standards and 

guidelines on a defined timeframe (e.g., annually), 

and they should be dated, and updated as necessary 

and include a point of contact if employees have 

questions. 

3/31/2011 3/31/2012 

Conduct and keep a log of annual reviews of all 

privacy policies. Make log available to IG for 

inspection. The first privacy inspection will be 

conducted April 2019 

10/30/2019 -400 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Should develop a policy and supporting procedures 

to assess and approve vendors with access to FEC 

PII to reasonably ensure that the vendor has 

adequate controls in place to protect the information 

before any PII is provided to the vendor. 

3/31/2011 9/30/2011 

Collaborate with the Contracting Officer to 

document or develop policies and supporting 

procedures that require prospective contractors to 

provide evidence of internal controls that will 

safeguard the agency’s sensitive information or PII 

that the contractor has access to. 

11/1/2019 -402 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Should formally document the process used to 

review the FEC’s vendors and the results should be 

retained to evidence the review procedures 

performed. In addition, there should be documented 

management approval from the department head 

that is the source of the information to be shared 

with the vendor and either of the co-Chief Privacy 

Officers before the vendor is provided access to FEC 

PII. There may be more than one department head 

that should review and approve a specific vendor if 

the PII affected pertains to more than one 

department. 

3/31/2011 9/30/2011 

Work with Contracting Officer to document or 

develop a process for reviewing and documenting 

vendor privacy controls. 

11/1/2019 -402 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Conduct privacy impact assessments in accordance 

with Section 522, or create an alternative process for 

ensuring that privacy risks associated with PII are 

documented, assessed and remediated as necessary. 3/31/2011 11/30/2011 

OCFO has an ERM process in development per the 

new A123 guidance that assesses risk agency-wide 

and could cover this recommendation. Privacy 

Counsel will meet with Gilbert and discuss, then 12/1/2019 -432 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

provide further action plan. Management is implementation once 

researching and developing a solution to address the completed. 

recommendation. 
34 

Office of Inspector General Semiannual Report to Congress April 1, 2013 - September 30

34 

Office of Inspector General Semiannual Report to Congress

Comply with OMB memoranda, or in the event of 

statutory exemption and a decision not to voluntary 

comply, document that sufficient controls exist to 

mitigate the need to comply. Where compliance is 

not adopted due to resource constraints or other 

reasons, document the legal assessment, risk 

3/31/2011 6/30/2011 Management is researching and developing a 

solution to address the recommendation 12/1/2019 -432 

Will review management's 

planned corrective action once 

identified. 

analysis, and cost-benefit to the FEC. 

Identify and implement a governance framework 

(e.g., NIST, the AICPA's Generally Accepted 

Privacy Principles (GAPP)), to ensure that controls 

within the FEC to protect PII are appropriately 

identified, documented, and implemented. 

3/31/2011 4/30/2012 Management is researching and developing a 

solution to address the recommendation. 12/1/2019 -432 

Will review management's 

planned corrective action once 

identified. 

Conduct a risk assessment annually for all existing 

and new applications that collect, process, transmit 

or store PII. If PIAs were performed, a risk 

assessment component could be built into that 

process to accomplish both the PIA and risk 

assessment recommendations. 

3/31/2011 5/31/2012 

Conduct an informal risk assessment of agency PII. 

This could possibly be resolved with Gilbert's risk 

mgt process further research needed. 

12/1/2019 -432 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 

Prepare a documented corrective action plan for any 

deficiency noted for each risk assessment performed 

and report progress periodically until all corrective 

actions are implemented. The corrective action plan 

should be approved by management. 

3/31/2011 9/30/2012 Prepare a corrective action plan for what is found in 

5A. 12/1/2019 -432 

Reviewed management's 

updated corrective action plan 

and will assess the adequacy of 

implementation once 

completed. 
35 

0, 2013

35 

April 1, 2018 – September 30, 2018

Recommendation Actual Issue Date Estimated 

Implementation Date Last Status Update Revised 

Implementation Date Days Past Due OIG Follow-up 

Attachment C: 2010 Follow-up Audit of Procurement and Contract Management Complete the revisions to procurement policies and ensure 

that the procurement directive is finalized and issued 

within FY 2011. 

6/6/2011 1/30/2012 

OIG confirmed that Procurement has either updated or 

created appropriate Proc Pros to address current 

procurement practices and internal control procedures that 

are aligned with the FAR. However, this recommendation 

can not be closed until senior management makes a 

decision whether Directive 66 is still warranted or not. If 

so, Directive 66 should be finalized and approved by the 

Commission. The Acting CFO plans to add this to list of 

topics to be placed on the Commission's calendar within 

the next 6 months. 

Not Provided 2430 

There was no progress made 

on this recommendations. 
Office of Inspector General Semiannual Report to Congress April 1, 2013 - September 30

Office of Inspector General Semiannual Report to Congress

Recommendation Actual Issue Date 

Estimated 

Implementation 

Date 

Last Status Update 

Revised 

Implementation 

Date 

Days Past 

Due OIG Follow-up 

Attachment D: Inspection of the FEC's Disaster Recovery and Continuity of Operations Plan 

Update all Continuity of Operation Plan (COOP) and 

Disaster Recovery Plan (DRP) personnel contact 

information to reflect the most current information 

and distribute the updated plans to the appropriate 

officials by February 2013. 

1/30/2013 6/30/2013 

Management has updated the COOP list as part of its 

phased approach and dtermines the action to be 

completed. 

3/31/2017 543 

The OIG reviewed the COOP personnel 

listing and selected a sample of 32 personnel 

to verify if all 32 personnel were equipped to 

carryout their designated COOP roles in the 

event of a disruption to the FEC's normal 

business operations. The OIG recieved 16 

responses from the 32 personnel selected, and 

6 of the 16 had not been provided an agency 

tablet to perform their COOP duties. This 

review was documented in the OIG's 

outstanding recommendations report as of 

March 2018 and no further updates have been 

made by management after report issuance. 

Thus, the recommendation remains open, 

although management considers it closed. The 

OIG notes that management is currently in the 

process of issuing updated tablets for COOP. 

We recommend that COOP/DRP training is provided 

at least annually. Personnel newly appointed to COOP 

roles should receive training shortly thereafter joining 

the FEC if training has already been conducted for the 

year. 

1/30/2013 7/31/2013 Training implemented May 2018 and will be 

conducted yearly. 6/30/2017 452 

Although management issued training via 

skillport, the OIG noted signficant issues with 

the structure of the documented training that 

prevents an adequate assessement of COOP 

training results. In addition, an annual test 

plan of the COOP has not been scheduled. 

These issues were documented in the OIG's 

Review of Outstanding Recommendations As 

of March 2018 report. No further updates 

have been made by management since report 

issuance. 

We recommend that FEC install and test a backup 

media reader in the alternative disaster recovery site. 

1/30/2013 6/30/2013 

In reviewing various scenarios as well as our current 

backup infrastructure, we believe a more updated 

solution should be considered like off-site vaulting 

adn cloud backups. We are working to compare 

backup solutions from the top industry cloud 

providers as well as off-site vaulting providers to 

dermine which 

6/30/2017 452 

Per management's May 2018 CAP to the 

Commission, management is assessing a new 

corrective action to address this open 

recommendation. No revised due date 

provided. 

36 

36 
37 

0, 2013

37 

April 1, 2018 – September 30, 2018

Implement and document a policy that includes: • 

Who is responsible for updating and monitoring the 

contact information in the FEC’s COOPs and DRP to 

reflect current information; • An organization-defined 

frequency for updating the FEC’s COOP/DRP contact 

information; and • “Required” information that must 

be provided for those personnel with COOP 

responsibilities (i.e. FEC office#, FEC blackberry#, 

personal cell phone and/or home number). 

1/30/2013 6/30/2013 

Currently working with Deputy SD to determine the 

role where this responsibility should lay and update 

the COOP with this information. No policy required. 

12/29/2017 270 

Management has not provided a revised date 

for completion. The OIG disagrees that a 

policy is not requried as this role and the 

associated tasks should be inlcuded in a 

policy for consistent implementation. 

Within the fiscal year (FY13), develop and implement 

a test plan to fully test the ITD DRP, with a target 

date to begin testing on or before June 2013. 1/30/2013 12/31/2013 

Work has started to determine the functions and 

processes requiring testing. One plan doesn't work for 

all systems so this will be a lengthy process as we 

address each system individually. 

12/29/2017 270 

Corrective action has not been completed for 

this open recommendation and no revised 

implementation date provided. 

Ensure the disaster recovery Kofax server is updated A theoretical test plan has been devised and the team Corrective action has not yet been 

to mirror the Kofax production server by June 2013. 1/30/2013 12/31/2013 is working to validate this theory with a more concrete 12/29/2017 270 implemented and no revised date provided for 

plan, the additional planning. 

Procure the necessary hardware/software to fully test 

the data entry application needed for Disclosure by 

December 2013 1/30/2013 12/31/2013 

Based on further review, we have determined there is 

no need to purchase hardware/software to test Data 

Entry however more time is required to determine 

how best to conduct a test - end of FY 2018. 

9/30/2018 -5 

Management is assessing a new corrective 

action to address this open recommendation 

and has revised the implementation due date 

to the end of FY 2018. 
38 

Office of Inspector General Semiannual Report to Congress April 1, 2013 - September 30

38 

Office of Inspector General Semiannual Report to Congress

Recommendation Actual Issue Date Estimated 

Implementation Date Last Status Update Revised Implementation Date Days Past Due OIG Follow Up 

Attachment E: Audit of the FEC's Office of Human Resources 

Once the Remedy customer request tracking system 

is implemented, OHR Management should determine 

the most effective way to use the automated system 

to improve the HR On Demand process and leverage 

the new system to streamline other related processes 

and procedures. In addition, this new process along 

with other related processes should be formally 

documented in a policy and/or standard operating 

procedures(SOP). The policies/SOPs should clearly 

document each OHR members’ role and 

responsibilities, as well as details about the technical 

and operational components of the processes. 

7/31/2013 9/30/2013 Rememdy is not being used and has been terminated. 

OHR on Demand is primary communication tool. Not provided 1821 

The OIG was informed by the Director of OHR that 

OCIO is still exploring a new online correspondence 

tracking system called Service Now to replace the 

Remedy System/HR On Demand. The Director of 

OHR also noted that OHR is not the only program 

office set to use the new tracking system, and 

therefore he does not have the final decision on what 

system will be selected. The FEC OIG notes that until 

a new system or an effective tool to track and 

monitor the timeliness of customer inquiries has been 

fully implemented, this recommendation can not be 

closed. 

OHR should periodically (at least annually) review 

all HR- related policies and procedures for the 

agency and for the OHR to ensure policies and 

procedures are accurate and relevant, and update as 

needed. 

7/31/2013 10/1/2013 

New DHR reorganizing all HR policies to allow 

more frequent updates and better procedural 

approach. Plan to incorporate wiki tools to improve 

agency visibility of all procedures. 

Not provided 1820 

The Director of OHR has performed an assessment to 

identifying all HR/personnel related policies, 

directives, and SOPs that need to be revised, 

rescinded, and/or created to comply with current 

regulations/laws/guidance. As of July 2018, FEC 

OHR is now working with OPM's HR Solutions 

group to take the necessary corrective actions to 

update/create the neccesaary policies and 

procedures. To date, the following SOPs/policies 

have been completed: the retirement SOP, new 

fingerprinting SOP, and the Staff Acquistion process 

SOP. The OIG will verify once this recommendation 

has been fully implemented. 

All policies and procedures should be posted in a 

central location accessible to all FEC staff (ex: 

FECNet [FEC intranet], the FEC computer server). In 

addition, when policies and procedures are updated 

they should be reposted and an email sent to all FEC 

staff on the changes/updates. 

7/31/2013 9/30/2013 

(1) Policies/procedures will be updated as policies 

are approved. (2) New DHR reorganizing all HR 

policies to allow more frequent updates and better 

procedural approach. Plan to incorporate wiki tools 

to improve agency visibility of all procedures. 

Working with IT to upgrade OHR website, pending 

hiring IT web designer. 

Not provided 1821 The OIG will verify once this recommendation has 

been fully implemented. 
0, 2013

April 1, 2018 – September 30, 2018

Recommendation Actual Issue Date 

Estimated 

Implementation 

Date 

Last Status Update 

Revised 

Implementation 

Date 

Days Past Due OIG Follow-up 

Attachment F: Inspection of FEC's Compliance with FMFIA/ OMB A-123 

The Office of the Chief Financial Officer (OCFO) 

should ensure sufficient information is included in 

the internal control review (ICR) packages 

submitted by program offices by making the ICR 

report mandatory. 

6/17/2014 12/31/2014 

In 09-2015, the Acting CFO created the A-123 task 

force. The purpose of the A-123 Task Force is to 

develop recommendations for implementing and/or 

revising FEC's internal control framework to comply 

with the newOMB A-123 guidance. Detailed 

procedures and training for annual internal review 

process included risk assessments. ICR guidance is 

provided annually. The FEC's A-123 Task Force 

has revised Directive 53 and it was approved by the 

Commission.on September 6, 2018. 

Not Provided 1364 

The OIG acknowledges that the annual ICR process 

was revised, a new control assessment template was 

rolled out for the FY 2016 review period, and 

Directive 53 has been updated to include the current 

ICR process. Per review of the FY 2017 control 

assessments submitted by program offices, OIG 

concludes some offices did not provide sufficient 

information to satisfy the instructions and 

compliance with A-123. For instance, some offices 

did not provide adequate documentation for some of 

the 17 principles, some offices did not include 

specific program information, some offices did not 

list internal control issues identified. Also, OIG 

notes that OMB recently rolled out a new A-123 

Appendix A to align with the guidance around the 

implementation of an Enterprise Risk Management 

(ERM) framework and the DATA Act.This may 

require additional documentation and/or changes to 

the annual ICR process. The OIG will assess once 

the revised Directive 53 has been fully implemented 

and we can confirm that they are operating 

effectively and adequate to comply with the 

additional A-123 requirements. 

OCFO should require any item marked as high risk 

on the VAC is explained in the respective program The new ICR process and assessment template 

office’s ICR Report. requires any internal control high risk ratings to be 

identified and explained.However, per review of the 

FY 2017 control assessments submitted by program 

offices, OIG concludes some offices did not provide 

sufficient information to satisfy internal control risk 

The new ICR assessment template currently requires ratings or identify all known control issues. Also, 

6/17/2014 12/31/2014 items marked as high risk to be explained in the Not Provided 1364 OIG notes that OMB recently rolled out a new Arespective program offices report. 123 Appendix A to align with the guidance around 

the implementation of an Enterprise Risk 

Management (ERM) framework and the DATA 

Act.This may require additional documentation 

and/or changes to the annual ICR process. The OIG 

will assess once these new requirements have been 

fully implemented 

39 

39 
40 

Office of Inspector General Semiannual Report to Congress April 1, 2013 - September 30

40 

Office of Inspector General Semiannual Report to Congress

As a best practice, program managers with the 

assistance of OCFO, should be trained on how to OIG acknowledges that training was conducted by 

conduct an inherent risk assessment for all mission Management Concepts and by the A-123 Task 

critical programs. Going forward, these inherent risk Force. However, per review of the FY 2017 control 

assessments should be reviewed annually as part of assessments submitted by program offices, OIG 

the ICR process. Initial internal control training was provided by concludes that additional training may be required. 

Management Concepts in 2016. In addition A-123 Especially in light of the fact that OMB recently 

6/17/2014 12/31/2014 Task Force members trained the appropriate staff on Not Provided 1364 rolled out a new A-123 Appendix A to align with the 

FEC's new annual ICR process prior to the FY 2017 guidance around the implementation of an 

assessments were completed.. Enterprise Risk Management (ERM) framework and 

the DATA Act.This may require additional 

documentation and/or changes to the annual ICR 

process. The OIG will assess once these new 

requirements have been fully implemented. 

The OCFO should improve their review process by 

paying special attention to the methodologies for the 

risk ratings and explanations of control issues for 

reasonableness, and to ensure all internal control 

issues are properly reported and potential material 

control weaknesses are identified. 

The OIG notes that the FY 2017 CFO summary 

which compiles the results of all program offices 

ICRs used to form the basis for recommending an 

agency-wide unqualified statement of assurance did 

not adequately disclose information related to 

6/17/2014 12/31/2014 

The OCFO will follow-up with program offices. 

OCFO relies on program offices for control 

weaknesses. We review that they are reported 

forward. We also review the conclusions provided 

are supported and check to see that they are aligned. 

Establishment of SMC- Membership includes top 

management that is knowledgeable in program 

office responsibilities. This allows for 

comprehensive internal control review and risk 

identification. 

Not Provided 1364 

known control issues. According to FMFIA, which 

is incorporated into A-123 guidance, the agency is 

still required to disclose all control issues (regardless 

if they are significant, material weaknesses or not) to 

the applicable oversight members responsible for 

providing the overall agency-wide assurance letter. 

In addition, the new A-123 requirements which 

require risk assessments to incorporate ERM 

concepts and fraud risk assessments went into effect 

in FY 2017. The OIG acknowledges that the FEC 

has established the SMC which is similar to a Risk 

Committee. The SMC has developed an ERM 

implementation plan and the initial risk profile.This 

recommendation can not be closed until additional 

oversight procedures are fully implemented to 

ensure compliance with these new requirements are 

operating effectively. 
0, 2013

April 1, 2018 – September 30, 2018

Actual Issue Date Estimated 

Implementation Date Last Status Update 

Revised 

Implementation 

Date 

Days Past 

Due Recommendation OIG Follow-up

Attachment G: Audit of the FEC's Telework Program 

The TMO or designee should reinforce telework The OIG notes that emails are routinely sent 

policies and procedures to supervisors and staff during Telework open enrollment which 

annually (and as needed based on results of references compliance with telework policies. 

monitored activity). However, the OIG did not obtain any 

documentation to support specific training 

6/28/2016 1/31/2017 TMO to send periodic reminder emails to all staff 

concerning Telework procedures. Ongoing 12/30/2018 related to telework hours where administered. 

This recommendation will remain open until 

the OIG can confirm that telework training has 

been conducted and/or telework policies 

related to properly recording telework hours 

have been reinforced and is operating 

effectively. 

The TMO or designee should implement a control 

procedure to ensure all employees that are 

participating in the telework program have an 6/28/2016 9/30/2016 Reviewed annually 12/30/2018 The OIG has not been able to confirm that this 

procedure is operating effectively. 

approved telework application on file. 

The TMO or designee should periodically (at least 

annually) assess the telework programs and 

determine if policies and procedures need to be 

updated to reflect changes in standard practices 

and/or update for other reasons. 

6/28/2016 9/30/2016 On-going 12/30/2018 

The OIG to confirm once the monitoring 

procedures have been fully implemented and 

we can verify that controls around telework are 

operating effectively. 

Management should ensure telework policies and 

training materials give clear explanations as to when 

each type of telework pay category should be used. 

Also, the TMO should hold refresher training. 

The OIG notes that the revised telework pay 

categories incorporated into the new WebTA 

system are aligned with the pay categories in 

the NBU/BU policies. However, the OIG did 

not obtain any documentation to support 

6/28/2016 9/30/2016 Complete, included in WebTA program. 12/30/2018 specific training related to telework hours 

where administered. This recommendation 

will remain open until the OIG can confirm 

that telework training has been conducted 

and/or monitoring procedures have been full 

implemented and shows that controls around 

telework are operating effectively. 

Managers should ensure that episodic telework is 

only used for its intended purpose which is defined 

in the OPM federal telework guidance and FEC 

Telework policies as “sporadic, short period of 

time.” 

6/28/2016 9/30/2016 

Reminder notice to all staff to comply with 

Telework policies go out periodically. Recommend 

that this item is closed. 

12/30/2018 

The OIG to confirm once the monitoring 

procedures have been fully implemented and 

we can verify that controls around episodic 

telework are operating effectively. 

The TMO or designee should periodically monitor 

telework activity to ensure episodic telework is 

being used properly, and to identify excessive use of 

episodic telework. The OIG suggests that WebTA 6/28/2016 9/30/2016 Report development and testing in progress, 

estimated completion date is December 2018. 12/30/2018 The OIG to confirm once this recommendation 

has been fully implemented. 

telework reports could be generated to assist in this 

process. 

-96

-96

-96

-96

-96

-96

41 

41 
42 

Office of Inspector General Semiannual Report to Congress April 1, 2013 - September 30

42 

Office of Inspector General Semiannual Report to Congress

FEC telework policies should state whether 

employees can request and/or be granted special The OIG was informed that FEC's standard 

telework arrangements (any arrangement outside the telework business practice does not allow for 

normal policy), as well as list the criteria that will be special telework arrangements outside the 

used for determining whether or not an employee policy except for arrangements that are 

can be approved for a special telework arrangement. granted through the reasonable 

If special telework arrangements are to be allowed, accommodation process. However, the OIG 

even if on a temporary basis, they should be has reason to believe that special telework 

documented in writing separate from the standard arrangements have been made subsequent to 

telework application and should include the this audit report. However, we did not confirm 

anticipated timeframe of the special arrangement. whether the arrangement(s) were approved 

Consideration should be given to have all special 

telework arrangements approved by the Staff 

Director, General Counsel, or Chief Financial 

Officer, as appropriate, along with notification to the 

TMO. 

6/28/2016 1/31/2017 

Special telework requests are handled through the 

FEC's Reasonable Accommodation Process 

through the EEO office, with documented evidence 

that special circumstances exist. No further action 

required, recommend this item to be closed. 

12/30/2018 -96

through the reasonable accommodation 

program. The OIG still recommends that 

Management should consider revising the 

NBU telework policy to explicitly state that 

special telework arrangements that fall outside 

the policy guidelines must be documented 

either as part of a reasonable accommodation 

plan or authorized and memorialized (i.e. 

email) by the TMO. Similar language should 

also be proposed during the next LMA 

negotiations. In addition, the OIG suggests 

that management should ensure that the annual 

review procedures to be implemented will 

incorporate steps that would be able to identify 

these types of arrangements and to verify they 

were properly approved and granted equitably. 

The TMO or designee should perform monitoring of 

the telework programs at least annually. The 

WebTA telework activity reports could be generated 

and reviewed to perform monitoring and evaluation 

of the telework programs. Currently these reports 

are generated to respond to occasional OPM 

telework data calls. For example, some of the 

reports list the names of the employees who 

telework more days than the policies allow and 

break it down by the actual number of days 6/28/2016 9/30/2016 Report development and testing in progress, 

estimated completion date December 2018. 12/30/2018 -96 The OIG to confirm once this recommendation 

has been fully implemented. 

teleworked. A sample of employees who appear to 

telework more days than are allowed per policy 

could be followed up on to determine if the data is 

accurate, proper documentation exists, explanations 

are reasonable, and/or telework activity is not 

incompliance with applicable policies. 

The TMO or designee should implement tools and 

processes to evaluate the effectiveness of the FEC’s 

telework programs. 

6/28/2016 9/30/2016 Report development and testing in progress, 

estimated completion date December 2018. 12/30/2018 -96 The OIG to confirm once this recommendation 

has been fully implemented. 
43

April 1, 2013 - September 30, 2013

43 

April 1, 2018 – September 30, 2018

0, 2013

or toll free at 1-800-424-9530 (press 0; then dial 1015)

Fax us at 202-501-8134 or e-mail us at oig@fec.gov

Visit or write to us at 1050 First Street, N.E., Suite 1010, Washington DC 20463

Federal Election Commission 

Office of Inspector General

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to fraud, waste, abuse, 

and mismanagement of agency programs and operations. Individuals who contact the OIG can remain anonymous. 

However, persons who report allegations are encouraged to provide their contact information in the event additional 

questions arise as the OIG evaluates the allegations. Allegations with limited details or merit may be held in 

abeyance until further specific details are reported or obtained. Pursuant to the Inspector General Act of 1978, as 

amended, the Inspector General will not disclose the identity of an individual who provides information without the 

consent of that individual, unless the Inspector General determines that such disclosure is unavoidable during the 

course of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference.

Fraud Hotline

202-694-1015
44

Office of Inspector General Semiannual Report to Congress

44 

Office of Inspector General Semiannual Report to Congress

 

Appendix C 

The Federal Election 

Commission 

In 1975, Congress created the Federal Election 

Commission to administer and enforce the Federal 

Election Campaign Act of 1971, as amended. The 

duties of the FEC, an independent regulatory agency, are to disclose campaign fnance information, enforce the provisions of the law, and oversee the public 

funding of Presidential elections. 

The Commission consists of six members who are 

appointed by the President and confrmed by the 

Senate. Each member serves a six-year term, and 

two seats are subject to appointment every two years. 

By law, no more than three Commissioners can be 

members of the same political party, and at least four 

votes are required for any official Commission action. 

The Chairmanship of the Commission rotates among 

the members each year, with no member serving as 

Chairman more than once during his or her term. 

Currently the FEC has four Commissioners and 

two vacancies – Caroline C. Hunter, Chair; Ellen L. 

Weintraub, Vice Chair; and Commissioners Matthew 

S. Petersen and Steven T. Walther. 

Office of Inspector General 

The Inspector General Act of 1978, as amended, 

states that the Inspector General is responsible for: 

1) conducting and supervising audits and investigations relating to the FEC’s programs and operations; 

2) detecting and preventing fraud, waste, and abuse 

of agency programs and operations while providing 

leadership and coordination; 3) recommending policies designed to promote economy, efficiency, and 

effectiveness of the establishment; and 4) keeping 

the Commission and Congress fully and currently 

informed about problems and defciencies in FEC 

agency programs and operations, and the need for 

corrective action. 
45

April 1, 2013 - September 30, 2013

45 

April 1, 2018 – September 30, 2018

or toll free at 1-800-424-9530 (press 0; then dial 1015)

Fax us at 202-501-8134 or e-mail us at oig@fec.gov

Visit or write to us at 1050 First Street, N.E., Suite 1010, Washington DC 20463

Federal Election Commission 

Office of Inspector General

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to fraud, waste, abuse, 

and mismanagement of agency programs and operations. Individuals who contact the OIG can remain anonymous. 

However, persons who report allegations are encouraged to provide their contact information in the event additional 

questions arise as the OIG evaluates the allegations. Allegations with limited details or merit may be held in 

abeyance until further specific details are reported or obtained. Pursuant to the Inspector General Act of 1978, as 

amended, the Inspector General will not disclose the identity of an individual who provides information without the 

consent of that individual, unless the Inspector General determines that such disclosure is unavoidable during the 

course of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference.

Fraud Hotline

202-694-1015