1050 First Street NE Washington, DC 20463 | www.fec.gov/oig

MEMORANDUM

TO: The Commission

FROM: Christopher Skinner

SUBJECT: Transmittal of the Federal Election Commission’s Fiscal Year 2021 Financial

Statement Audit Report

DATE: November 12, 2021

Pursuant to the Chief Financial Officers Act of 1990, as amended, this memorandum transmits the 

Independent Auditor’s Report issued by Brown & Company Certified Public Accountants and 

Management Consultants, PLLC (Brown & Company) for the fiscal year (FY) ending 

September 30, 2021. Enclosed you will find the Independent Auditor’s final audit report on the FEC 

(i.e., the “FEC” or “Commission”) FY 2021 Financial Statements. The final audit report is 

additionally included in Section II of the FEC’s FY 2021 Agency Financial Report

The audit was performed under a contract with, and monitored by, the OIG in accordance with 

generally accepted government auditing standards, the Comptroller General’s Government Auditing 

Standards, and applicable provisions of Office of Management and Budget (OMB) Bulletin No. 21-

04, Audit Requirements for Federal Financial Statements. 

In Brown & Company’s opinion, the FEC financial statements present fairly, in all material respects, 

the financial position, net cost, changes in net position, budgetary resources, and custodial activity of 

the FEC as of, and for the year ending, September 30, 2021, in conformance with accounting 

principles generally accepted in the United States of America. 

Additionally, due to the Commission’s position that it is legally exempt from the Federal Information 

Systems Management Act (FISMA), the OIG requires an assessment of the agency’s Information 

Technology (IT) systems security controls. Accordingly, the audit included an examination of the 

Commission’s IT security in comparison to government- wide best practices. The OIG acknowledges 

that the independent auditors are only required to explicitly opine on internal controls that have a 

material impact on agency financial statement reporting.

Brown & Company did not report any material weaknesses or significant deficiencies with the 

Commission’s internal controls. There were six open recommendations from prior year audits to 

address deficiencies related to IT security controls. However, two of the six prior year 

recommendations have been closed. Accordingly, there are currently four open recommendations. 

Management was provided a draft copy of the audit report for review and comment. Since there were 
FEC OIG 2021-11-015

no current year findings and recommendations, an official management response to the report was not 

required. 

The OIG reviewed Brown & Company’s report and related documentation and provided the required 

oversight throughout the course of the audit. Our review ensures the accuracy of the audit 

conclusions but may not express an opinion of the audit’s results. The OIG’s review determines that 

Brown & Company complied with applicable required Government Auditing Standards.

We appreciate the collaboration and support from FEC staff and the professionalism that Brown & 

Company exercised throughout the course of the audit. If you have any questions concerning the 

enclosed report, please contact Ms. Shellie Purnell-Brown at (202) 694-1019. 

Thank you.

cc: John Quinlan, Chief Financial Officer

Alec Palmer, Staff Director/Chief Information Officer

Lisa Stevenson, Acting General Counsel

Gilbert A. Ford, Director of Budget

Greg Baker, Deputy General Counsel

Katie Higginbothom, Deputy Staff Director for Management and Administration
FEDERAL ELECTION COMMISSION

INDEPENDENT AUDITOR’S REPORT

AND

FINANCIAL STATEMENTS

FOR THE YEARS ENDED

SEPTEMBER 30, 2021 AND 2020

Prepared By

Brown & Company CPAs and Management Consultants, PLLC

November 12, 2021
INDEPENDENT AUDITOR’S REPORT 

Inspector General

Federal Election Commission

Washington, D.C.

In our audits of the fiscal years 2021 and 2020 financial statements of the Federal Election 

Commission (FEC), we found:

• FEC’sfinancial statements as of and for the fiscal years ended September 30, 2021, and 2020,

are presented fairly, in all material respects, in accordance with U.S. generally accepted

accounting principles;

• no material weaknesses in internal control over financial reporting based on the limited

procedures we performed; and

• no reportable noncompliance for fiscal year 2021 with provisions of applicable laws,

regulations, contracts, and grant agreements we tested.

The following sections discuss in more detail (1) our report on the financial statements, which includes 

requiredsupplementary information(RSI) andotherinformationincluded withthefinancialstatements;

(2) our report on internal control over financial reporting; and (3) our report on compliance with laws,

regulations, contracts, and grant agreements.

Report on the Financial Statements

In accordance with the provisions of the Accountability of Tax Dollars Act of 2002 (ATDA) (Pub. L. No. 

107-289),we have audited FEC’sfinancial statements. FEC’s financialstatements comprise the balance

sheets as of September 30, 2021, and 2020; the related statements of net cost, changes in net position,

budgetary resources, and custodial activity for the fiscal yearsthen ended; and the relatednotes to the

financial statements.

We conducted our audits in accordance with U.S. generally accepted government auditing standards and 

the provisions of OMB Bulletin No. 21-04, Audit Requirements for Federal Financial Statements. We

believe that the audit evidence we obtained is sufficient and appropriate to provide a basis for our audit

opinions.

Management’sResponsibility

FEC management is responsible for (1) the preparation and fair presentation of these financial statements

in accordance with U.S. generally accepted accounting principles; (2) preparing, measuring, and presenting

the RSI in accordance with U.S. generally accepted accounting principles; (3) preparing and presenting

other information included in documents containing the audited financial statements and auditor’s report,

and ensuring the consistency of that information with the audited financial statements and the RSI; and (4)

maintaining effective internal control over financial reporting, including the design, implementation, and

maintenance of internal control relevant to the preparation and fair presentation offinancial statements that

are free from material misstatement, whether due to fraud or error.
Auditor’s Responsibility

Our responsibility isto express an opinion on these financial statements based on our audits. U.S. generally

accepted government auditing standards require that we plan and perform the audit to obtain reasonable

assurance about whether the financial statements are free from material misstatement. We are also

responsible for applying certain limited procedures to RSI and other information includedwith the financial

statements.

An audit offinancial statements involves performing proceduresto obtain audit evidence about the amounts

and disclosures in the financial statements. The procedures selected depend on the auditor’s judgment,

including the auditor’s assessment ofthe risks of material misstatement ofthe financial statements, whether

due to fraud or error. In making those risk assessments, the auditor considers internal control relevant to

the entity’s preparation and fair presentation of the financial statements in order to design audit procedures

that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the

effectiveness of the entity’s internal control. Accordingly, we express no such opinion. An audit offinancial

statements also involves evaluating the appropriateness of the accounting policies used and the

reasonableness ofsignificant accounting estimates made by management, as well as evaluating the overall 

presentation of the financial statements. Our audits also included performing such other procedures as we

considered necessary in the circumstances.

Opinion on Financial Statements

In our opinion, FEC’s financial statements present fairly, in all material respects, FEC’s financial position

as of September 30, 2021, and 2020, and its net cost of operations, changes in net position, budgetary

resources, and custodial activity for the fiscal years then ended in accordance with U.S. generally accepted

accounting principles.

Other Matters

RequiredSupplementary Information

U.S. generally accepted accounting principles issued by the Federal Accounting Standards

Advisory Board (FASAB) require that the RSI be presented to supplement the financial

statements. Although the RSI is not a part of the financial statements, FASAB considers this

information to be an essential part of financial reporting for placing the financial statements in

appropriate operational, economic, or historical context. We have applied certain limited

procedures to the RSI in accordance with U.S. generally accepted government auditing

standards, which consisted of inquiries of management about the methods of preparing the RSI

and comparing the information for consistency with management’s responses to the auditor's

inquiries, the financial statements, and other knowledge we obtained during the audit of the

financial statements, in order to report omissions or material departures from FASAB

guidelines, if any, identified by these limited procedures. We did not audit and we do not

express an opinion or provide any assurance on the RSI because the limited procedures we

applied do not provide sufficient evidence to express an opinion or provide any assurance.
Other Information

FEC’s other information contains a wide range of information, some of which is not directly

related to the financial statements. This information is presented for purposes of additional

analysis and is not a required part of the financial statements or the RSI. We read the other 

information included with the financial statements in order to identify material inconsistencies,

if any, with the audited financial statements. Our audit was conducted for the purpose of

forming an opinion on FEC’s financial statements. We did not audit and do not express an

opinion or provide any assurance on the other information.

Report on Internal Control over Financial Reporting

In connection with our audits of the FEC’s financial statements, we considered the FEC’s internal

control over financial reporting, consistent with our auditor’s responsibility discussed below. We

performed our procedures related to the FEC’s internal control over financial reporting in accordance

with U.S. generally accepted government auditing standards.

Management’s Responsibility

FEC management is responsible for maintaining effective internal control over financial reporting,

including the design, implementation, and maintenance of internal control relevant to the preparation 

and fair presentation of financial statements that are free from material misstatement, whether due to

fraud or error.

Auditor’s Responsibility

In planning and performing our audit of FEC’s financial statements as of and for the year ended

September 30, 2021, in accordance with U.S. generally accepted government auditing standards, we

considered the FEC’s internal control over financial reporting as a basisfor designing audit procedures

that are appropriate in the circumstances for the purpose of expressing our opinion on the financial

statements, but not for the purpose of expressing an opinion on the effectiveness of the FEC’s internal

control over financial reporting. Accordingly, we do not express an opinion on the FEC’s internal

control over financial reporting. We are required to report all deficiencies that are considered to be

significant deficiencies or material weaknesses. We did not consider all internal controls relevant to

operating objectives, such as those controls relevant to preparing performance information and

ensuring efficient operations.

A deficiency in internal control exists when the design or operation of a control does not allow 

management or employees, in the normal course of performing their assigned functions, to prevent, 

or detect and correct, misstatements on a timely basis. A material weakness is a deficiency or 

combination of deficiencies in internal control, such that there is a reasonable possibility that a 

material misstatement of the entity’s financial statements will not be prevented, or detected and 

corrected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, 

in internal control that is less severe than a material weakness, yet important enough to merit attention 

by those charged with governance.
Definition and Inherent Limitations of Internal Control over Financial Reporting

An entity’s internal control over financial reporting is a process effected by those charged with

governance, management, and other personnel, the objectives of which are to provide reasonable

assurance that (1) transactions are properly recorded, processed, and summarized to permit the

preparation of financial statements in accordance with U.S. generally accepted accounting principles,

and assets are safeguarded against loss from unauthorized acquisition, use, or disposition, and (2)

transactions are executed in accordance with provisions of applicable laws, including those governing

the use of budget authority, regulations, contracts, and grant agreements, noncompliance with which

could have a material effect on the financial statements.

Because of itsinherent limitations, internal control over financial reporting may not prevent, or detect

and correct, misstatements due to fraud or error.

Results of Our Consideration of Internal Control over Financial Reporting

Our consideration of internal control was for the limited purpose described above, and was not

designed to identify all deficiencies in internal control that might be material weaknesses and

significant deficiencies or to express an opinion on the effectiveness of the FEC’s internal control over

financial reporting. Given these limitations, during our audit, we did not identify any deficiencies in

internal control over financial reporting that we consider to be material weaknesses. However,

material weaknesses may exist that have not been identified.

Intended Purpose of Report on Internal Control over Financial Reporting

The purpose of this report is solely to describe the scope of our consideration of the FEC’s internal

control over financial reporting and the results of our procedures, and not to provide an opinion on the

effectiveness of the FEC’s internal control over financial reporting. This report is an integral part of

an audit performed in accordance with U.S. generally accepted government auditing standards in

considering internal control over financial reporting. Accordingly, this report on internal control over

financial reporting is not suitable for any other purpose.

Report on Compliance with Laws, Regulations, Contracts, and Grant Agreements

In connection with our audits of FEC’s financial statements, we tested compliance with selected

provisions of applicable laws, regulations, contracts, and grant agreements consistent with our

auditor’s responsibility discussed below. We caution that noncompliance may occur and not be

detected by these tests. We performed our tests of compliance in accordance with U.S. generally

accepted government auditing standards.

Management’s Responsibility

FEC management isresponsible for complying with laws, regulations, contracts, and grant agreements

applicable to the FEC.
Auditor’s Responsibility

Our responsibility is to test compliance with selected provisions of applicable laws, regulations,

contracts, and grant agreements applicable to FEC that have a direct effect on the determination of

material amounts and disclosures in FEC’s financial statements, and perform certain other limited

procedures. Accordingly, we did not test compliance with all laws, regulations, contracts, and grant

agreements applicable to FEC.

Results of Our Testsfor Compliance with Laws, Regulations, Contracts, and Grant Agreements

Our tests for compliance with selected provisions of applicable laws, regulations, contracts, and grant

agreements disclosed no instances of noncompliance for fiscal year 2021 that would be reportable

under U.S. generally accepted government auditing standards. However, the objective of our tests was

not to provide an opinion on compliance with laws, regulations, contracts, and grant agreements 

applicable to FEC. Accordingly, we do not express such an opinion.

Intended Purpose of Report on Compliance with Laws, Regulations, Contracts, and Grant Agreements

The purpose of this report is solely to describe the scope of our testing of compliance with selected

provisions of applicable laws, regulations, contracts, and grant agreements, and the results of that

testing, and not to provide an opinion on compliance. This report is an integral part of an audit

performed in accordance with U.S. generally accepted government auditing standards in considering

compliance. Accordingly, this report on compliance with laws, regulations, contracts, and grant

agreements is notsuitable for any other purpose.

Status of Prior Year’s Findings and Recommendations

We have reviewed the status of open recommendations from the FY 2020 Independent Auditor’s 

Report, dated November 16, 2020. There are four open recommendations from the prior financial 

statement audit report. The status of prior year recommendations is presented in Exhibit A. 

Greenbelt, Maryland

November 12, 2021
Exhibit A – Status of Prior Year’s Findings and Recommendations 

Status of FY 2020 Prior Year’s Audit Recommendations

Status as of 

September 30, 

2021

2020-01 We recommend the FEC OCIO in conjunction with the direct managers 

perform and document periodic user access reviews for FEC systems according 

to the agency’s system security plan.

Open

2020-02: We recommend that the FEC OCIO fully implement STIG baseline 

configuration standards for Windows devices. Closed

2020-03: We recommend the FEC OCIO utilize lessons learned from the 

COVID- 19 pandemic to determine if any revisions are need to the Continuity 

of Operation Plan, and schedule periodic testing.

Open

2020-04: We recommend that the FEC develop system- specific contingency 

plans, as appropriate for the agency risk level. (Repeat Recommendation) Open

2020-05: We recommend the FEC OCIO implement an effective procedure to 

enforce compliance with the security awareness training policy to ensure all 

system users complete security training in accordance with the FEC Security 

Training and Awareness Policy.

Open

2020-06: We recommend that the FEC Chief Information Officer improve the 

plan of action and milestones report for the information system to include: -

Resources required to correct a control deficiency. -Critical path milestones that 

affect the overall schedule for implementing the corrective actions are needed 

to resolve the control deficiency. -Plan for prompt resolution and internal control 

testing to validate the correction of the control deficiency.

Closed