Federal Election Commission 

Agency Financial Report 

Fiscal Year 2018 
Federal Election Commission 

Agency Financial Report 

Fiscal Year 2018 

Federal Election Commission 

1050 First St. NE 

Washington, D.C. 20463 

(202) 694-1000 

1-(800) 424-9530 

www.fec.gov 

Released November 15, 2018 


Message from the Chair i

How to Use This Report iii

SECTION I – Management’s Discussion and Analysis 1

Section I.A: Mission and Organizational Structure 1

Mission Statement 2

Organizational Structure 2

Section I.B: Performance Goals, Objectives and Results 7

Strategic Goal 7

Strategic Objectives 7

Section I.C: Analysis of FEC Financial Statements and Stewardship Information 16

Section I.D: Analysis of FEC’s Systems, Controls and Legal Compliance 19

Section I.E: Limitations of the Financial Statements 31

SECTION II – Auditor’s Report and Financial Statements 32

Message from the Acting Chief Financial Officer 33

OIG Transmittal Letter 34

Independent Auditor’s Report 36

Financial Statements 58

Notes to the Financial Statements 64

SECTION III – Other Information 84

Inspector General’s Statement on FEC Management and Performance Challenges 85

Improper Payments Information Act Reporting Details 93

Civil Monetary Penalties Adjustment for Inflation 94

Reporting on Internal Controls Assurances 95

Fraud Risk Reporting in FY 2018 96

APPENDIX 97

List of Acronyms 98
Message from the Chair 

i 
ii
How to Use This Report 

This Agency Financial Report presents financial information, as well as relevant performance 

information, on the Federal Election Commission’s operations. The report was prepared pursuant to 

the Accountability of Tax Dollars Act of 2002 and Office of Management and Budget (OMB) 

Circular A-136, revised, Financial Reporting Requirements, and covers activities from October 1, 

2017 through September 30, 2018. 

The FEC places a high importance on keeping the public informed of its activities. To learn more 

about the FEC and what the agency does to serve the American public, visit the FEC’s website 

https://www.fec.gov/about/reports-about-fec/strategy-budget-and-performance/. 

The FY 2018 Agency Financial Report is organized into three primary sections: 

Section I – Management’s Discussion and Analysis (MD&A) provides an overview of the FEC. It 

describes our mission, organizational structure and regulatory responsibilities. It also includes 

relevant performance information related to the FEC’s strategic goals and objectives to provide a 

forward-looking discussion of future challenges. 

Section II – Financial Information, including the Independent Auditor’s Report, detailing the FEC’s 

financial performance by 1) highlighting the agency’s financial position and audit results and 2) 

describing the FEC’s compliance with key legal and regulatory requirements. 

Section III – Other Information includes our Inspector General’s (IG) assessment of the FEC’s 

management challenges and the FEC’s response. 

iii
SECTION I – Management’s Discussion and Analysis 

Section I.A: Mission and Organizational Structure 

The Federal Election Commission is an independent regulatory agency responsible for 

administering, enforcing, defending and interpreting the Federal Election Campaign Act of 1971, as 

amended (FECA or the Act).1 Congress created the FEC to administer, enforce and formulate policy 

with respect to the FECA. The Act reflects a belief that democracy works best when voters can make 

informed decisions in the political process—decisions based in part on knowing the sources of 

financial support for Federal candidates, political party committees and other political committees. 

Public confidence in the political process also depends on the knowledge that participants in Federal 

elections follow clear and well-defined rules and face consequences for non-compliance. 

Under the Act, all Federal political committees, including the committees of Presidential, Senate 

and House candidates, must file reports of receipts and disbursements. The FEC makes disclosure 

reports, and the data contained in them, available to the public through the Commission’s Internetbased public disclosure system on the Commission’s website, as well as in a public records office 

at the Commission's Washington, D.C. headquarters. The FEC also has exclusive responsibility 

for civil enforcement of the Act, and has litigating authority independent of the Department of 

Justice in U.S. district court and the courts of appeals. Additionally, the Commission promulgates 

regulations implementing the Act and issues advisory opinions responding to inquiries regarding 

interpretation and application of the Act and the Commission’s regulations. 

Additionally, the Commission is responsible for administering the Federal public funding 

programs for Presidential campaigns. This responsibility includes certifying and auditing all 

participating candidates and committees and enforcing the public funding laws. 

The FEC has chosen to produce an Agency Financial Report (AFR) and Annual Performance 

Report (APR) pursuant to the Government Performance and Results Act of 1993, as amended. 

The FEC will include its FY 2018 Annual Performance Report with its Congressional Budget 

Justification and will post it on the FEC website at https://www.fec.gov/about/reports-aboutfec/strategy-budget-and-performance/ in 2019. 

 1

 The Commission’s primary responsibilities pertain to the Federal Election Campaign Act of 1971, Public Law 92-225, 

86 Stat. 3 (1972) as amended (codified at 52 U.S.C. §§ 30101-30145) (formerly at 2 U.S.C. §§ 431-55) (the Act or the FECA). 

The Commission’s responsibilities for the Federal public funding programs are contained in the Presidential Election 

Campaign Fund Act, Public Law 92-178, 85 Stat. 562 (1971) (codified at 26 U.S.C. §§ 9001-13) and the Presidential 

Primary Matching Payment Account Act, Public Law 93-443, 88 Stat. 1297 (1974) (codified at 26 U.S.C. §§ 9031-42). 

1 
Mission Statement 

The FEC’s mission is to protect the integrity of the Federal campaign finance process by providing 

transparency and fairly enforcing and administering Federal campaign finance laws. 

 Organizational Structure 

To accomplish its legislative mandate, the FEC is directed by six Commissioners, who are 

appointed by the President with the advice and consent of the Senate. By law, no more than three 

Commissioners can be members of the same political party. Each member serves a six-year term, 

and two seats are subject to appointment every two years. Commissioners may serve beyond their 

six-year terms until new Commissioners are confirmed. The Chairmanship of the Commission 

rotates among the members, with no member serving as Chair more than once during his or her 

six-year term. The Commissioners are responsible for administering and enforcing the Act and 

meet regularly to formulate policy and to vote on significant legal and administrative matters. The 

Act requires the affirmative vote of four members of the Commission to approve official actions, 

thus requiring bipartisan decision-making. The FEC has its headquarters in Washington, D.C. and 

does not have any regional offices. 

Figure 1: FEC Organizational Chart 

2 
As noted in Figure 1, the offices of the Staff Director, General Counsel, Chief Information Officer 

and Chief Financial Officer support the agency in accomplishing its mission. The Office of the 

Inspector General, established within the FEC in 1989 under the 1988 amendments to the Inspector 

General Act, is independent and reports both to the Commissioners and to Congress. The specific 

roles and responsibilities of each office are described in greater detail below. 

 Office of the Staff Director (OSD) 

The Office of the Staff Director consists of four offices: 1) Management and Administration; 2) 

Compliance; 3) Communications; and 4) Equal Employment Opportunity. The Office of 

Management and Administration is responsible for the FEC’s strategic planning and performance 

and works with the Commission to ensure the agency’s mission is met efficiently. In addition, this 

office houses the Commission Secretary, the Office of Human Resources (OHR) and the 

Administrative Services Division (ASD). The primary responsibilities of the Office of Compliance 

are review of campaign finance reports and filing assistance, audits, administrative fines and 

alternative dispute resolution. The Office of Communications includes divisions charged with 

making campaign finance reports available to the public, encouraging voluntary compliance with the 

Act through educational outreach and training and ensuring effective communication with Congress, 

executive branch agencies, the media and researchers and the general public. The Equal Employment 

Opportunity Office administers and ensures compliance with applicable laws, regulations, policies 

and guidance that prohibit discrimination in the Federal workplace based on race, color, national 

origin, religion, age, disability, sex, pregnancy, genetic information or retaliation. The EEO Officer 

reports to the Staff Director on administrative issues, but has direct reporting authority on all EEO 

matters. See 29 CFR 1614.102(b). 

 Office of General Counsel (OGC) 

The Office of General Counsel consists of five organizational units: (1) the Deputy General 

Counsel—Administration; (2) the Deputy General Counsel—Law; (3) the Policy Division; (4) the 

Enforcement Division; and (5) the Litigation Division. The Deputy General Counsel— 

Administration directly supervises the Administrative Law Team, the Law Library and all OGC 

administrative functions. The Deputy General Counsel—Law has the primary responsibility for 

assisting the General Counsel in all of the substantive aspects of the General Counsel’s duties and 

shares in the management of all phases of OGC programs, as well as directly supervising the 

agency’s ethics program. The Policy Division drafts for Commission consideration advisory 

opinions and regulations interpreting the Federal campaign finance law and provides legal advice to 

the FEC’s compliance programs. The Enforcement Division recommends to the Commission 

appropriate action to take with respect to administrative complaints and apparent violations of the 

Act. Where authorized, the Enforcement Division investigates alleged violations and negotiates 

conciliation agreements, which may include civil penalties and other remedies. If an enforcement 

matter is not resolved during the administrative process, the Commission may authorize suit in 

district court, at which point the matter is transferred to the Litigation Division. The Litigation 

Division represents the Commission before the Federal district and appellate courts in all civil 

litigation involving campaign finance statutes. This Division assists the Department of Justice’s 

Office of the Solicitor General when the Commission’s FECA cases are before the Supreme Court. 

3 
 Office of the Chief Information Officer (OCIO) 

The Office of the Chief Information Officer (OCIO) consists of four units: (1) Enterprise 

Architecture; (2) Operational Support; (3) Data Administration; and (4) IT Security. The OCIO 

provides secure, stable and robust technology solutions for Commission staff and the public. OCIO 

both develops and maintains the systems that serve as the public's primary source of information 

about campaign finance data and law and ensures agency employees have a technology infrastructure 

that allows them to perform their day-to-day responsibilities administering and enforcing campaign 

finance law. OCIO also develops and supports analytic reporting tools that help staff perform their 

disclosure and compliance duties. 

 Office of the Chief Financial Officer (OCFO) 

The Office of the Chief Financial Officer is responsible for complying with all financial management 

laws and standards, and all aspects of budget formulation, budget execution and procurement. 

4 
$72.00 $71.25

$70.50

$66.00

$68.00

$70.00

Appropriations

Obligations

$64.00

$62.00

$60.00

2014 2015 2016* 2017** 2018

* $5 million in 2 year funds not included in total

** $8 million in 2 year funds not included in total

Sources of Funds 

The FEC also has the authority to collect fees from attendees of agency-sponsored educational 

conferences. The Commission may use those fees to defray the costs of conducting those 

conferences. In an effort to keep the fees as low as possible, the agency has not fully exercised that 

authority. Rather, the Commission sets its registration fees at a level that covers only the costs 

incurred by the agency’s conference-management contractor, including meeting room rental and 

conference meals and compensation. All other conference-related expenses, such as materials and 

staff travel, are paid using appropriated funds. Registration fees for FY 2018 were $161,630. 

Figure 2 shows the agency’s appropriations and obligations from FY 2014 to FY 2018. 

Figure 2: Summary of Funding (in millions of dollars) 

Personnel vs. Non-Personnel Costs 

Figure 3 represents the Commission’s FY 2018 obligations by personnel and non-personnel costs. 

Personnel costs, which are primarily composed of salaries and employee benefits, accounted for 67 

percent of the FEC’s costs. The remaining 33 percent of the Commission’s costs was spent on nonpersonnel items, such as infrastructure and support, software and hardware, office rent, building 

security and other related costs. 

5 
Figure 3: Fiscal Year 2018 by Major Category 

6 
Section I.B: Performance Goals, Objectives and Results 

This section provides a summary of the results of the FEC’s key performance objectives, which are 

discussed in greater detail in the FEC’s FY 2018 APR. This report will be part of the FEC’s FY 

2020 Congressional Budget Justification, which will be available at 

https://www.fec.gov/about/reports-about-fec/strategy-budget-and-performance/ in 2019. 

Strategic Goal 

The strategic goal of the Federal Election Commission is to fairly, efficiently and effectively 

administer and enforce the Federal Election Campaign Act, promote compliance and engage and 

inform the public about campaign finance data and rules, while maintaining a workforce that 

delivers results. 

Strategic Objectives 

The Act reflects a belief that democracy works best when voters can make informed decisions in 

the political process—decisions based in part on knowing the sources of financial support for 

Federal candidates, political party committees and other political committees. As a result, the 

FEC’s first strategic objective is to inform the public about how Federal campaigns and 

committees are financed. Public confidence in the political process also depends on the knowledge 

that participants in Federal elections follow clear and well-defined rules and face consequences 

for non-compliance. Thus, the FEC’s second strategic objective focuses on the Commission’s 

efforts to promote voluntary compliance through educational outreach and to enforce campaign 

finance laws effectively and fairly. The third strategic objective is to interpret the FECA and related 

statutes, providing timely guidance to the public regarding the requirements of the law. The 

Commission also understands that organizational performance is driven by employee performance 

and that the agency cannot successfully achieve its mission without a high-performing workforce 

that understands expectations and delivers results. Consequently, the FEC’s fourth strategic 

objective is to foster a culture of high performance in order to ensure that the agency accomplishes 

its mission efficiently and effectively. 

Objective 1: Engage and Inform the Public about Campaign Finance Data 

The FEC’s e-filing system acts as the point of entry for submission of electronically filed campaign 

finance reports, providing faster access to reports and streamlining operations. This system provides 

for public disclosure of electronically filed reports, via the FEC website, within minutes of being 

filed. During FYs 2019 and 2020, the FEC will continue work to upgrade the agency’s eFiling 

platform. In FY 2017, the Commission published a study of its current eFiling platform, including a 

survey of the existing functionality of the FEC’s free filing software and an in-depth investigation 

of needs expressed by filers.2

 The FEC will rely on the recommendations of this study to improve its 

 

2

 Available at https://fec.gov/about/reports-about-fec/agency-operations/e-filing-study-2016/.

7 
 

 

eFiling platform to allow greater operating system flexibility for users when generating filings for 

submission to the Commission and increase the consistency and accuracy of reporting. The FEC’s 

new eFiling platform is expected to improve the process for validating filings prior to acceptance 

and generate modern file outputs that will provide for more flexibility in accessing data. 

The Commission is continuing the redesign of its website by developing a user-centered online 

platform to deliver campaign finance information to its diverse base of users. This effort will ensure 

that the FEC provides full and meaningful campaign finance data and information in a manner that 

meets the public’s increasing expectations for data customization and ease of use.

Performance measures for assessing progress on this Strategic Objective include measures to ensure 

that data from campaign finance reports are quickly made available to the public and that the FEC 

pursues programs to make data more accessible to the public. 

Performance Goal 1-1: Improve the public’s access to information about how campaign funds 

are raised and spent. 

Key Indicator: Percent of reports processed within 30 days of receipt. 

FY 2013 

Actual 

FY 2014 

Actual 

FY 2015 

Actual 

FY 2016 

Actual 

FY 2017 

Actual 

FY 2018 

Target 

FY 2018 

Actual 

FY 2019 

Target 

FY 2020 

Target 

88% 79% 92% 100% 96% 95% 100% 95% 95% 

Objective 2: Promote Compliance with the FECA and Related Statutes 

Helping the public understand its obligations under the Act is an essential component of voluntary 

compliance. The FEC places a significant emphasis on encouraging compliance through its 

Information Division, Reports Analysis Division (RAD), Press Office and Office of Congressional, 

Legislative and Intergovernmental Affairs. The FEC measures its progress in meeting this Objective 

through two performance measures: one that measures the Agency’s efforts to encourage voluntary 

compliance through educational outreach and information and another that measures the FEC’s 

efforts to seek adherence to FECA requirements through fair, effective and timely enforcement and 

compliance programs. Progress against these measures is detailed in the charts below. 

Encourage voluntary compliance with FECA requirements through educational outreach and 

information. 

The FEC’s education and outreach programs provide information necessary for compliance with 

8 
campaign finance law and give the public the context necessary to interpret the campaign finance 

data filers disclose. The FEC maintains a toll-free line and public email accounts to respond to 

inquiries regarding campaign finance data disclosed to the public and questions about how to comply 

with campaign finance law and its reporting requirements. 

One way the Commission encourages voluntary compliance is by hosting conferences across the 

country, where Commissioners and staff explain how the Act applies to candidates, parties and 

political action committees. These conferences address recent changes in the law and focus on 

fundraising, methods of candidate support and reporting regulations. 

The FEC also devotes considerable resources to ensuring that staff can provide distance learning 

opportunities to the general public. The Commission’s website is one of the most important sources 

of instantly accessible information about the Act, Commission regulations, and Commission 

proceedings. In addition to viewing campaign finance data, anyone with Internet access can use the 

website to track Commission rulemakings, search advisory opinions, audits and closed enforcement 

matters, view campaign finance data, and find reporting dates. The Commission places a high 

emphasis on providing educational materials about campaign finance law and its requirements. 

Toward this end, the FEC has moved its focus away from the printing and manual distribution of its 

educational materials and instead looked for ways to leverage available technologies to create and 

disseminate dynamic and up-to-date educational materials through the website. While the 

Commission continues to make available printed copies of its educational brochures and 

publications, transitioning to primarily web-based media has allowed the agency to reduce 

significantly its printing and mailing costs and use of resources while at the same time encouraging 

new and expanded ways of communicating with the public via the website. 

As part of this broad effort to improve its Internet communications and better serve the educational 

needs of the public, the Commission maintains its own YouTube channel, which can be found at 

https://www.youtube.com/user/FECTube. The YouTube channel offers a variety of instructional 

videos and tutorials that enable users to obtain guidance tailored to their specific activities. 

The agency’s educational outreach program has been significantly enhanced with the addition of an 

online training service that enables political committees, reporters, students and other groups to 

schedule live, interactive online training sessions with FEC staff. This on-demand service allows the 

FEC to provide tailored, distance learning presentations and training to the public in a manner that 

will significantly increase the availability of FEC staff to serve the public. The service also offers an 

efficient and effective way for alternative dispute resolution and other enforcement respondents to 

satisfy the terms of their agreements with the agency. 

9 
 

 

Performance Goal 2-1: Encourage voluntary compliance with FECA requirements through 

educational outreach and information. 

Key Indicator: Educational outreach programs and events achieve targeted satisfaction 

rating on user surveys. 

FY 2013 

Actual 

FY 2014 

Actual 

FY 2015 

Actual 

FY 2016 

Actual 

FY 2017 

Actual 

FY 2018 

Target 

FY 2018 

Actual 

FY 2019 

Target 

FY 2020 

Target 

N/A N/A 4.34 4.53 4.43 4.0 or 

higher on 

a 5.0 

scale 

4.53 4.0 or 

higher on 

a 5.0 

scale 

4.0 or 

higher on 

a 5.0 

scale 

Seek adherence to FECA requirements through fair, effective and timely enforcement and 

compliance programs. 

The FEC has formed strategies for ensuring that its enforcement and compliance programs are fair, 

effective and timely. The Commission’s statutory obligation is to administer, interpret and enforce 

the Federal Election Campaign Act, which serves the compelling governmental interest in deterring 

corruption and the appearance of corruption in financing elections. In doing so, the Commission 

remains mindful of the First Amendment’s guarantees of freedom of speech and association, and the 

practical implication of its actions on the political process. 

The FEC has exclusive jurisdiction over civil enforcement of Federal campaign finance laws. It 

consults with the U.S. Department of Justice, as appropriate, on matters involving both civil and 

criminal enforcement of the Act. Commission enforcement actions, which are handled primarily by 

the Office of General Counsel (OGC), originate from a number of sources, including external 

complaints, referrals from other government agencies and matters generated by information 

ascertained by the Commission in the normal course of carrying out its supervisory responsibilities. 

Enforcement matters are handled by OGC pursuant to the requirements of the FECA. If the 

Commission cannot settle or conciliate a matter involving an alleged violation of the Act, the 

Commission may initiate civil litigation by filing and prosecuting a civil action in Federal district 

court to address the alleged violation. Closed enforcement matters are available via the FEC website. 

To augment OGC’s traditional enforcement role, the Office of Compliance manages several 

programs that seek to remedy alleged violations of the Act and encourage voluntary compliance. 

These programs include: 1) the Alternative Dispute Resolution Program, 2) the Administrative Fine 

Program and 3) the Audit Program. The Commission’s Alternative Dispute Resolution Program is 

designed to resolve matters more swiftly by encouraging the settlement of less-complex enforcement 

matters with a streamlined process that focuses on remedial measures for candidates and political 

committees, such as training, internal audits and hiring compliance staff. Violations involving the 

late submission of, or failure to file, disclosure reports are subject to the Administrative Fine 

10
Program. This Program is administered by RAD and the Office of Administrative Review (OAR), 

which assess monetary penalties and handle challenges to the penalty assessments. The Audit 

Program conducts “for cause” audits under the FECA in those cases where political committees have 

failed to meet the threshold requirements for demonstrating substantial compliance with the Act, and 

conducts mandatory audits under the public funding statutes. Subject to limited redactions, threshold 

requirements approved by the Commission and used by RAD and the Audit Division are public. 

Performance Goal 2-2: Seek adherence to FECA requirements through fair, effective and timely 

enforcement and compliance programs. 

Key Indicator: Of the enforcement matters resolved during the fiscal year, the 

percentage that was resolved within 15 months of the date of receipt. 

FY 2013 

Actual 

 

FY 2014 

Actual Actual 

FY 2015 FY 2016 

Actual 

FY 2017 

Actual 

FY 2018 

Target 

FY 2018 

Actual 

FY 2019 

Target 

FY 2020 

Target 

72% 28% 49% 38% 68% 50% 61% 50% 50%

11
Objective 3: Interpret the FECA and Related Statutes 

Commission initiatives, Congressional action, judicial decisions, petitions for rulemaking or other 

changes in campaign finance law may necessitate that the Commission update or adopt new 

regulations. Consequently, the FEC undertakes rulemakings either to write new Commission 

regulations or revise existing regulations. The Commission also provides guidance on how the Act 

applies to specific situations through the advisory opinion process and represents itself in most 

litigation before the Federal district court and appellate courts. The Commission’s three primary 

means for providing interpretive guidance for the Act and related statutes are discussed below. 

Regulations 

The Policy Division of OGC drafts various rulemaking documents, including Notices of Proposed 

Rulemaking (NPRMs), for Commission consideration. NPRMs provide an opportunity for the public 

to review proposed regulations, submit written comments to the Commission and, when appropriate, 

testify at public hearings at the FEC. The Commission considers the comments and testimony and 

deliberates publicly regarding the adoption of the final regulations and the corresponding 

Explanations and Justifications, which provide the rationale and basis for the new or revised 

regulations. 

Advisory Opinions 

An advisory opinion (AO) is an official Commission response to questions regarding the application 

of Federal campaign finance law to specific factual situations. The Act requires the Commission to 

respond to AO requests within 60 days. For AO requests from candidates in the two months leading 

up to an election, the Act requires the Commission to respond within 20 days. On its own initiative, 

the Commission also makes available an expedited process for handling certain time-sensitive 

requests that are not otherwise entitled to expedited processing under the Act. The Commission 

strives to issue these advisory opinions in 30 days. 

Defending Challenges to the Act 

The Commission represents itself in most litigation before the Federal district and appellate courts 

and before the Supreme Court with respect to cases involving publicly financed Presidential 

candidates. It also has primary responsibility for defending the Act and Commission regulations 

against court challenges. In addition, the Act authorizes the Commission to institute civil actions to 

enforce the Act. 

12
 

 

Performance Goal 3-1: Provide timely legal guidance to the public. 

Key Indicator: Percent of legal guidance provided within statutory and courtordered deadlines. 

FY 2013 

Actual 

FY 2014 

Actual 

FY 2015 

Actual 

FY 2016 

Actual 

FY 2017 

Actual 

FY 2018 

Target 

FY 2018 

Actual 

FY 2019 

Target 

FY 2020 

Target 

N/A 100%3 100%4

 100%5 100%6

 100% 100%7 100% 100% 

 3 The Commission obtained extensions to consider ten advisory opinion requests in FY 2014; four of those extensions were 

attributable to the Federal government shutdown during October 2013. The Commission did not have any rulemakings 

during FY 2014 with statutory or court-ordered deadlines. 4 

 The Commission obtained extensions to consider two advisory opinion requests in FY 2015. The Commission did not 

have any rulemakings during FY 2015 with statutory or court-ordered deadlines. 5

 The Commission obtained extensions to consider six advisory opinion requests in FY 2016. 6 

 The Commission obtained extensions to consider seven advisory opinion requests in FY 2017. 7 

 The Commission obtained an extension to consider one advisory opinion request in FY 2018. 

13
 

Objective 4: Foster a Culture of High Performance 

The Commission understands that the success of its programs depends upon the skills and 

commitment of its staff. The Commission is focused on ensuring that staff training needs are assessed 

and met at every level of the agency and that agency leaders receive training necessary to help 

manage and maintain a fully engage and productive workforce. The FEC is also focused on 

decreasing the time to hire, improving the agency’s performance management systems and 

developing a supervisory and managerial training program for senior leaders, mid-career managers 

and first time supervisors. During FY 2018, the FEC began a partnership with the Office of Personnel 

Management’s HR Solutions to improve the FEC’s staffing, classification and performance 

management processes. 

In order to reduce costs and improve the efficiency and effectiveness of services, the FEC is also 

pursuing a multi-year IT modernization project. During FY 2018, the agency successfully migrated 

a campaign finance database and its website to a cloud environment and shut down one of its four 

physical data centers. Migrating these assets to a cloud environment significantly lowers the cost of 

maintaining these systems, even as the campaign finance database continues to grow each year. 

Planned improvements to the eFiling system, which was designed in the mid-1990s, will provide 

an opportunity to migrate the eFiling data center to a cloud environment as well, reducing our costs 

for the support and maintenance of the legacy eFiling physical data center. 

Consistent with its commitment to fostering the talents and skills of its employees and providing 

excellent service to the public, the FEC will create a cross-functional group within the agency to 

develop and implement user-centered, evidence-based design solutions for achieving the agency’s 

mission efficiently and effectively. The team will leverage technological advancements to improve 

the delivery of mission critical functions. This team will be tasked with harnessing the creativity 

and ideas of agency employees, and emerging technologies, to restructure systems, tools and 

processes, while building a 21st century IT infrastructure to better serve the American public. 

The FEC is also participating in and contributing to the government-wide Records Management 

initiative. In compliance with the Federal Records Act, the FEC is updating its records management 

program. The updated program will increase efficiency and improve performance by eliminating 

paper and using electronic recordkeeping to the fullest extent possible. 

14
 

 

 

Performance Goal 4-1: Foster a workforce that delivers results. 

Key Indicator: Commission-required quarterly updates meet targeted performance 

goals. 

FY 2013 

Actual 

FY 2014 

Actual 

FY 2015 

Actual 

FY 2016 

Actual 

FY 2017 

Actual 

FY 2018 

Target 

FY 2018 

Actual 

FY 2019 

Target 

FY 2020 

Target 

NA 73% 80% 76% 85% 65% 73% 65% 65% 

15
 

 

 

 

 

 

Section I.C: Analysis of FEC Financial Statements and Stewardship 

Information 

The FEC’s FY 2018 financial statements and notes are presented in the required format in accordance 

with OMB Circular A-136, as revised, Financial Reporting Requirements. The FEC’s current-year 

financial statements and notes are presented in a comparative format in Section II of this report. 

The following table summarizes the significant changes in the FEC’s financial position during FY 

2018: 

Net Financial 

Condition FY 2018 FY 2017 Increase (Decrease) % Change 

Assets $37,958,046 $34,142,240 $3,815,806 11% 

Liabilities $ 15,288,642 $ 6,278,907 $9,009,735 143% 

Net Position $22,669,404 $27,863,333 ($5,193,929) -19% 

Net Cost $78,532,451 $69,133,455 $9,398,996 14% 

Budgetary Resources $80,846,191 $84,280,790 ($3,434,599) -4% 

Custodial Revenue $1,183,237 $ 1,910,206 ($726,969) -38% 

The following is a brief description of the nature of each required financial statement and its 

relevance. The effects of some significant balances or conditions on the FEC’s operations are 

explained. 

Balance Sheet 

The Balance Sheet presents the total amounts available for use by the FEC (assets) against the 

amounts owed (liabilities) and amounts that comprise the difference (Net Position). As a small 

independent agency, all of the FEC’s assets consist of Fund Balance with Treasury (FBWT), Property 

and Equipment (P&E) and Accounts Receivable. Fund Balance with Treasury (e.g., cash) is available 

through the Department of Treasury accounts, from which the FEC is authorized to make 

expenditures (i.e., obligations) and payments. FBWT decreased by approximately $3.2 million, or 

14 percent, from the prior year. 

Accounts Receivable primarily represent amounts due from the public for fines and penalties 

assessed by the FEC and referred to Treasury for collection, as deemed appropriate. In compliance 

with the Debt Collection Improvement Act of 1996 (DCIA), the OCFO takes into consideration the 

most appropriate approach to debt management. These amounts are not available for FEC operations 

and are sent to the U.S. Treasury as miscellaneous receipts. Net accounts receivable decreased by 

approximately $181 thousand dollars from the prior year. 

16
Property and equipment consists of software, general-purpose equipment used by the agency and 

software development. In FY 2018, the FEC moved office locations and capitalized fixed assets for 

leasehold improvements related to the new office. Total assets increased by $3 million from the 

prior year to $37 million, reflecting the additional property and equipment costs incurred by the FEC 

related to the agency’s office relocation. Total liabilities also increased by approximately $9 million. 

Statement of Net Cost 

The Statement of Net Cost presents the annual cost of operating the FEC program. Gross costs are 

used to arrive at the total net cost of operations. The FEC’s total gross costs in administering the 

FECA experienced a 14% fluctuation from the prior year. 

Statement of Changes in Net Position 

The Statement of Changes in Net Position presents in greater detail the net position section of the 

Balance Sheet, including Cumulative Results of Operations and Unexpended Appropriations. This 

statement identifies the activity that caused the net position to change during the reporting period. 

Total Net Position decreased by 19 percent, or approximately $5 million. In FY 2017, the FEC 

received approximately $8 million in two-year appropriated funds, which will expired at the end of 

FY 2018. 

Statement of Budgetary Resources 

The Statement of Budgetary Resources provides information on the source and status of budgetary 

resources made available to the FEC during the reporting period. It presents the relationship between 

budget authority and budget outlays, as well as the reconciliation of obligations to total outlays. Total 

Budgetary Resources and Status of Budgetary Resources decreased by approximately $3 million, or 

four percent, from the prior year. 

Statement of Custodial Activity 

The Statement of Custodial Activity (SCA) represents an accounting of revenue and funds collected 

by the FEC that are owed to the U.S. Treasury’s general fund. These monies are not available for the 

FEC’s use. Collection and revenue activity primarily result from enforcement actions that come 

before the Commission during the fiscal year. Revenue and collections on the SCA consist of 

collections on new assessments, prior year(s) receivables and Miscellaneous Receipts. In FY 2018, 

the total custodial revenue and collections decreased by approximately $727 thousand from the prior 

year. 

17
The chart below displays the assessment history for the past 20 years.8 

$1.05

$6.71

$1.16

FY 1998 FY 2018

FIGURE 4 - FINES ASSESSED, BY FISCAL YEAR

(in Millions of Dollars)

Figure 4: Fines Assessed, by Fiscal Year (in millions of dollars) 

 8 One MUR resolved during 2006 yielded the largest civil penalty in agency history, which was $3.8 million paid by 

Federal Home Loan Mortgage Corporation (Freddie Mac) for prohibited corporate activity. This 2006 penalty is the 

primary reason for the largest Fines Assessed (approximately $6.71 million) in Figure 4.

18
Section I.D: Analysis of FEC’s Systems, Controls and Legal Compliance 

I.D.i – FEC Integrated Internal Control Framework and Legal Compliance 

The Commission is subject to numerous legislative and regulatory requirements that promote and 

support effective internal controls. The FEC complies with the following laws and regulations: 

Annual Appropriation Law – establishes the FEC’s budget authority; 

Inspector General Act of 1978, as amended; 

Federal Managers’ Financial Integrity Act of 1982; 

Government Performance and Results Act of 1993, as amended; 

Federal Financial Management Improvement Act of 1996; 

Clinger-Cohen Act of 1996; 

Federal Civil Penalties Inflation Adjustment Act of 1990; 

Debt Collection Improvement Act of 1996, as amended; and 

Chief Financial Officers Act, as amended by the Accountability of Tax Dollars Act of 2002. 

The proper stewardship of Federal resources is a fundamental responsibility of the FEC. These laws 

help the FEC improve the management of its programs and financial operations, and assure that 

programs are managed in compliance with applicable law. 

I.D.ii – Management Assurances 

The Federal Managers’ Financial Integrity Act of 1982 (FMFIA) is implemented by OMB Circular 

A-123, revised, Management’s Responsibility for Internal Control, with applicable appendices. The 

FEC management is responsible for establishing and maintaining effective internal control and 

financial management systems that meet the objectives of the FMFIA and for performing a selfassessment under the guidance of its Directive 53, Implementation of OMB Circular A-123, Internal 

Control Review. Directive 53 outlines the process and describes roles and responsibilities for 

conducting risk assessments and internal control reviews. 

Section 2 of the FMFIA requires Federal agencies to report, on the basis of annual assessments, any 

material weaknesses that have been identified in connection with their internal and administrative 

controls. The reviews that took place during FY 2018 provide unqualified assurance that FEC 

systems and management controls comply with the requirements of the FMFIA. 

19
Section 4 of the FMFIA requires that agencies annually provide assurance on programmatic internal 

controls and financial management systems, and effectiveness of internal control over financial 

reporting. The FEC evaluated its financial management systems in accordance with the FMFIA, 

OMB Circular A-123, as applicable, and reviewed the Statements on Standards for Attestation 

Engagements, Reporting on Controls at a Service Organization (SSAE 18) reports received from its 

shared service providers. The results of management reviews provided an unmodified opinion that 

the FEC’s financial systems controls generally conform to the required principles and standards as 

per Section 4 of the FMFIA. 

Enterprise Risk Management 

In the current fiscal year, the FEC – led by the Senior Management Council (SMC) – successfully 

updated its Enterprise Risk Management Risk Profile of enterprise risks, as required by the revised 

OMB Circular A-123. The SMC identified a total of 11 enterprise risks in the areas of Strategic, 

Operational, and Compliance objectives rated as being a Medium or High inherent risk, and delivered 

the Initial Risk Profile to the Office of the Inspector General (OIG) and to OMB. The SMC looks 

forward to continuing to work closely with the Office of the Inspector General to remediate any 

weaknesses which the OIG may deem to be at the level of a material weakness. 

Prompt Payment Act 

The Prompt Payment Act (PPA) requires Federal agencies to make timely vendor payments and to 

pay interest penalties when payments are late. The FEC’s on-time payment rate for FY 2018 was 

nearly 100 percent, with less than .19 percent of all invoices paid after the date required by the PPA. 

Improper Payments 

The Improper Payments Information Act of 2002 (IPIA), the Improper Payments Elimination and 

Recovery Act of 2010 (IPERA), Improper Payments Elimination and Recovery Improvement Act of 

2012 (IPERIA) and OMB guidance require agencies to identify those programs that are susceptible 

to significant erroneous payments, and determine an annual estimated amount of erroneous payments 

made in their operations. The FEC reviewed all of its programs and activities to identify those 

susceptible to significant erroneous payments. Approximately 67 percent of the FEC’s obligations 

pertain to salaries and benefits, which represents a low risk for improper payments, based on 

established internal controls. The FEC also reviewed all of its FY 2018 non-personnel procurements, 

charge card, and payroll costs to verify their accuracy and completeness. Accordingly, the FEC is 

unaware of any improper payments. The FEC continues to monitor its payment and internal control 

process to ensure that the risk of improper payments remains low. 

20
Civil Monetary Penalties Adjustment for Inflation 

The FEC Civil Monetary Penalties Adjustment for Inflation is included in Section III. 

 

21
 

Annual Assurance Statement on Internal Control 

22
I.D.iii – Management’s Response to the Office of Inspector General’s Statement on the 

Federal Election Commission’s Management and Performance Challenges 9 

November 13, 2018 

In its Statement on the FEC’s Management and Performance Challenges (“Statement”), the Office 

of the Inspector General (“OIG”) identified three overarching management and performance 

challenges for inclusion in the FEC’s Agency Financial Report for Fiscal Year 2018. Management’s 

response to the OIG statement is below. 

Challenge 1: Governance Accountability 

A. Low Employee Morale 

Management is committed to investing time, resources, and effort to make a lasting impact and 

improvement to the morale of FEC employees. Management believes the efforts highlighted in 

the FY17 Response to the OIG Statement on Management and Performance Challenges have 

contributed to meaningful gains in employee morale. 

The 2018 FEVS results were recently released and the FEC had an eight percentage point gain 

in employee satisfaction.10 The FEC had the second largest gain of all small agencies with more 

than 100 employees. Additionally, the FEC went from having less than half of its employees 

responding in the survey in FY17 to 61% responding to the FEVS survey this fiscal year, fifteen 

percentage points above the government-wide average. Out of 71 items in the survey, 64 had 

positive gains when compared to FY17 results. Of particular note is that these gains came in the 

midst of significant changes at the FEC, primarily the move to a new location. 

We recognize that there are multiple factors that contribute to morale at the agency, and there are 

no simple solutions. The Commission has an exceptional workforce filled with dedicated 

professionals whose hard work and commitment to excellence enables the agency to carry out its 

essential mission. For this reason, it is vital that we continue to foster a workplace that is positive 

and productive, where everyone feels valued. Some of the efforts that management has made 

since the release of the Morale Study and that have continued in FY18 are summarized below: 

Management Performance Plans. The following items were included in all management 

performance plans for the 2017-18 review year, as well as the 2018-19 review year: 

• Engage in efforts to improve morale and foster a culture of trust within the manager’s 

area of responsibility, including implementing recommendations from the Morale 

Study. 

• Engage in efforts to improve as a manager, including training, participation in a 360 

Review, and development and implementation of a Leadership Development Plan. 

 9 Management consists of the agency’s senior managers, including the Staff Director, General Counsel and Chief Financial Officer. 10 https://www.govexec.com/management/2018/10/agencies-biggest-gains-and-losses-employeehappiness/152417/?oref=govexec_today_pm_nl 

23
• Provide training opportunities (both formal and informal) for all staff. Utilize inhouse resources including Skillport and OCIO one-on-one trainings. 

• Meet with each employee at least one time during the performance year in addition 

to the six-month and annual reviews to get the employee’s input on how things are 

going and ideas for improvement. 

Involving Staff in Preparation for the FEC’s Office Space Move. Throughout the entire FEC 

move process, management was committed to engaging and informing staff. Bargaining Unit 

members served on the Lease Renewal Advisory Team and on each of its subcommittees. 

Management also regularly updated the internal portal, “FEC Move,” on the agency’s intranet 

page that provided LRAT meeting minutes, photos of construction progress, and news about the 

move. 

Management Training. The agency has undertaken multiple training programs to target some 

of the areas where improved management performance is necessary to boost employee morale. 

Trainings have been held on areas including diversity and inclusion, conflict resolution, general 

management skills, and individual leadership training. Management is continuing this 

momentum by partnering with OPM to deliver on-site supervisory training to managers later this 

month. Management has also placed an emphasis on training, including it as a target in our annual 

performance and budget plans submitted to OMB and Congress. Since September 2016, over 

half of agency managers have undertaken 360 Reviews conducted by OPM and developed 

leadership plans to develop strengths and improve. Importantly, language has been added to all 

managers’ performance plans requiring that the managers demonstrate a commitment to 

improving morale and documenting steps taken within his or her area of responsibility. 

Staff Professional Development. Divisions throughout the agency continue to give staff 

opportunities for professional growth. 

• OGC detail program with the US Attorney’s Office in the District of Columbia, which 

provides staff attorneys the opportunity to prosecute general misdemeanor cases and 

develop their investigative and litigation skills; 

• OGC staff opportunities to serve details within different divisions in the Office; 

• OCIO staff partnering one-on-one with staff from the General Services 

Administration’s 18F to learn new information technology skills; 

• Information Division conducted training sessions for agency staff that participate in 

outreach efforts to learn how to maximize webinar participation; 

• RAD conducted branch-wide professional development months focused on skills 

training and one-on-one coaching sessions available to all staff; 

• Brown-bag lunches and informational sessions where staff can learn about what other 

divisions do and ask questions of senior staff and Commissioners; and

• Expanded opportunities for eligible FEC staff to compete for detail positions and 

temporary promotions within the agency. 

Diversity in Hiring and Promotion. Agency managers have undertaken a substantial effort to 

expand the diversity of the pool of applicants that apply for FEC positions, including OGC 

reaching out to local law schools, and having ongoing dialogs with Black Law Students 

24
Associations and Hispanic Latino Law Student Associations. OGC also launched an ongoing 

externship opportunity with Howard Law School, as well as participated in a Latina/o Alumni 

Association of the Washington College of Law (American University) externship program 

offered for displaced law students from the University of Puerto Rico. Agency managers continue 

to ensure that hiring panels are diverse and inclusive, ensuring that multiple viewpoints are 

present. 

Communication. Management has undertaken efforts to communicate more clearly and 

consistently across the agency as well as within divisions. Each division has been encouraged to 

hold regular division meetings, and senior leaders routinely attend those meetings to answer 

questions on any topic, as schedules have allowed. We have also attempted to be more proactive 

in getting information out. Some divisions are holding brown bag lunch and learn programs and 

are undertaking other, informal activities to give staff and managers a chance to interact. Most 

importantly, management continues to encourage an open door policy for employees to come 

with any questions or concerns at any time. 

Management understands that improving morale is not a one-off, “check the box” project. Our 

efforts on this front will continue. 

B. Enforcing Required Management Roles and Responsibilities 

Management follows FEC Commission Directive 50, reporting semi-annually on the progress of 

all outstanding recommendations identified in OIG audits. As was highlighted in the May 2018 

submission of Corrective Action Plans, progress was made to close some longstanding items in 

the COOP/Disaster Recovery Plan and Privacy and Data Protection CAPs. Management will be 

circulating Corrective Action Plans in November 2018, which will show significant progress to 

close remaining items in the Human Resources audit. 

Pursuant to the Federal Managers Financial Integrity Act (FMFIA) and OMB Circular A-123, 

the FEC established guidance to describe a Senior Management Council (SMC) for oversight of 

internal control and enterprise risk management (ERM) activities throughout the agency. The 

SMC meets, at minimum, on a quarterly basis and includes senior agency officials from all 

divisions of the FEC. The SMC is chaired by the agency Chief Financial Officer (CFO), who – 

with the agency Staff Director and General Counsel – is responsible for discussing 

recommendations for action with the FEC Commissioners regarding internal control and ERM 

actions, required for the agency to remain compliant with the FMFIA and OMB Circular A-123. 

The SMC helps ensure that the FEC implements and maintains a strong internal control 

framework including a positive internal control environment featuring top management 

commitment to the values of promoting the highest ethical standards and organizing all program 

and administrative processes to promote accuracy, efficiency, and compliance with all applicable 

laws and regulations, and to minimize, prevent, or promptly detect and correct any instances of 

fraud, waste, abuse, and mismanagement. The control environment will include promoting 

internal control knowledge and awareness among all staff. 

25
While the entrenchment of strong internal controls requires the active involvement of all agency 

personnel, this council recognizes that the most effective means of maintaining a robust internal 

controls environment requires a definitive and united “tone at the top.” This council involves the 

senior leaders and key managers who are all committed to this mission and the continual 

improvement of the internal controls environment of the FEC. 

During FY18, the SMC formally met to review and assess the risk profile for the agency. The 

SMC adjusted the agency’s risk profile after the departure of a Commissioner and after the move 

to the new building location. Management is committed to regularly assessing the agency’s risk 

profile and ensuring that adequate measures are in place to mitigate any risks. The SMC also 

communicated regularly when reviewing the annual A-123 submissions from FEC divisions. 

Challenge 2: Longstanding Vacancies in Senior Leadership Positions 

Management acknowledges that there are vacancies throughout the agency. Management 

continues to work with the Personnel and Finance committees for approval to post and hire 

qualified individuals for all of the identified positions. As identified by the OIG, the positions of 

Chief Financial Officer, General Counsel, Deputy Staff Director for Management and 

Administration, and the Deputy Chief Information Officer for Operations are all currently filled 

by qualified full-time employees on an acting basis. By statute, only the Commission can select 

a permanent General Counsel and Inspector General; and by agency practice, the same is true of 

the Chief Financial Officer. The Commission has recently selected an Inspector General and is 

nearing the conclusion of the hiring process for a Chief Financial Officer. Additionally, the 

Personnel Committee has approved the following positions to be filled on a permanent basis: 

Deputy Staff Director for Management and Administration, Deputy Chief Information Officer 

for Operations, and Chief Information Security Officer. All of these positions are currently in the 

hiring process and we anticipate concluding the hiring process in the next couple of months. As 

the senior leadership vacancies are filled, the Personnel and Finance Committees will closely 

scrutinize any remaining vacancies. In light of recent budget guidance from the Office of 

Management and Budget, prudent management requires that close examination is paid to the 

potential impact of each vacancy that is approved to hire. The Personnel and Finance Committees 

are committed to analyzing the current FEC workforce and looking ahead to fiscal years in order 

to avoid having to implement a reduction in force. 

Challenge 3: Organizational Structure 

A. Information Security Program 

OIG raises the concern that the FEC Information Security Program needs to be prioritized. 

Management shares this view and has committed considerable resources towards strengthening 

the FEC’s information security program. OIG also highlights the need to elevate the seniority 

level of the Chief Information Security Officer. Management recently requested assistance from 

OPM’s HR Solutions to review and reclassify the CISO position as a GS-2210-14/15, elevating 

the position to the same level as the two Deputy Chief Information Officers. Management is 

currently in the hiring process to recruit a new individual to fill this elevated role. 

26
Consistent with advice from the Office of General Counsel and in accordance with the 

Commission’s decision, the OCIO continues to implement a NIST-based Risk Management 

Framework (RMF) for the three most critical information systems-- the General Support System, 

E-Filing System, and Agency website. On September 15, 2017, in response to a request from the 

Deputy Inspector General, the Acting General Counsel and Chief Information Officer submitted 

a memorandum explaining the impact of the Commission’s decision and the steps OCIO has 

taken to implement the RMF. OCIO will continue to brief the Commission and Senior 

Management on necessary changes to the IT Security Program and continuously identify and 

mitigate risks in consultation with the Senior Management Council. 

B. Proper Leadership Structure 

OIG raises the concern that having the positions of Staff Director and Chief Information Officer 

filled by the same individual concentrates oversight of a significant portion of the agency’s 

operating budget under a single individual. It should be noted that prior to the current incumbent 

becoming Staff Director, the Chief Information Officer reported to the Staff Director. When the 

current incumbent became Staff Director, the Commission made the CIO position one that 

reported directly to the Commission. Assuming the Commission would return to prior practice 

if separate individuals were appointed to fill each position, the CIO would again report to the 

Staff Director and the portions of the budget identified by OIG would still be under the ultimate 

control of a single individual – that is, the Staff Director. Moreover, all agency IT projects are 

required to be approved by the Finance Committee prior to OCIO initiating the project, and 

approval of the full Commission is required before undertaking long-term projects of high 

magnitude, such as the redesign of the Commission’s website. This reporting structure does not 

put the FEC at any greater risk for fraud, waste, or abuse. In reality, it allows for expedited 

decisions through the proper change control processes of the Finance, Personnel, and IT 

committees. 

C. Senior Agency Officials for Privacy 

The OIG states the “agency’s Privacy Program is currently a shared role between the Office of 

General Counsel (OGC) and the OCIO, with the designated SAOP being a shared role assigned 

to the Deputy CIO of Operations and the Deputy General Counsel.” However, this is incorrect. 

The FEC’s Privacy Program is a shared role between the Office of General Counsel and the 

Office of the Staff Director, who in turn can designate officials to act in their capacity. The SAOP 

is a shared role between the Deputy General Counsel for Administration and the Deputy Staff 

Director for Management & Administration. The Privacy Team includes the Chief Information 

Security Officer, the Administrative Law Team, and other individuals as needed. The OIG 

highlights that the individual currently serving as Deputy Staff Director for Management and 

Administration in an acting capacity is an attorney. As a result, OIG questions whether having 

two attorneys overseeing the Privacy Program would not ensure coverage of information 

security. Management disagrees with this, since the individual serving as Deputy Staff Director 

is not serving as a practicing attorney in this role. The current arrangement ensures that privacy 

27
issues are adequately addressed throughout the agency and accounts for the collateral nature of 

the duties for the senior leaders performing the duties. Additionally, in FY18 the Administrative 

Law Team hired an attorney with significant experience in the Privacy Act to be able to assist 

management with resolving these longstanding issues. She will also be taking a rigorous 

information security training; upon completion she will be accredited as a Certified Information 

Systems Security Professional (CISSP), which will provide additional cross-pollination of 

knowledge between the legal and information security branches of the Privacy Team. 

Management is confident the current Privacy Team structure adequately addresses legal concerns 

and information security through having a dedicated administrative law attorney and the CISO. 

As noted by OIG, a revised corrective action plan was put in place and two open 

recommendations were closed. There is currently an individual serving in an acting capacity for 

the CISO role who has the expertise regarding IT security to competently advise the privacy 

attorney of IT related issues. 

Outstanding Recommendations 

The OIG states that the current Privacy Audit has 25 outstanding recommendations and that the 

Co-SAOPs have not made any significant progress on the Privacy Audit’s outstanding 

recommendations since June of 2013. Referring to these alleged outstanding recommendations, 

OIG claims that during the most recent review, “the SAOPs did not respond to any of the OIG’s 

inquiries to discuss the current open recommendations.” OIG helpfully shared with Management 

the 25 Privacy CAP recommendations considered to be outstanding earlier this year. 

Management respectfully disagrees with this assessment, concluding that there are only nine 

outstanding recommendations. Indeed OIG has re-opened multiple closed recommendations, 

including some recommendations closed more than six years ago. Moreover, OIG’s claim that 

the Co-SAOPs have not made “any significant progress” since June 2013 ignores ten of these 

“outstanding recommendations” that have been completed since that date.11 However, as a result 

of conversations with OIG, OGC’s new FOIA/Privacy Act attorney has begun addressing these 

outstanding recommendations so as to find ways to reach agreement with OIG on what is needed 

to close specific recommendations. Most of the successes of this reinvigorated partnership with 

OIG will most likely be seen in the FY19 report, but it is our understanding that OIG has agreed 

that recommendation number 10b is now closed as of August 22, 2018. 

The breakdown of OIG’s 24 “outstanding recommendations” (now that recommendation 10b has 

been closed) is displayed below (recommendations Management considers completed and closed 

are highlighted): 

 11 Additionally, in a January 23, 2017 memorandum to the Inspector General, the Co-SAOPs accepted the identified risks of not 

implementing OIG’s recommendations for two outstanding recommendations (1a and 7b). In that memorandum, Management also 

noted that although two other recommendations (6c and 6e) had been implemented and Management had provided documentation 

that the recommended tasks were completed in May and June of 2015, Management would accept the identified risks “[t]o the 

extent OIG believes the identified tasks are insufficient to meet the recommendations.” It appears that recommendation 6e remains 

open for OIG’s purposes. 

28
Outcomes of the 25 OIG “Outstanding Recommendations” 

Recommendation 

Number 

Management Response Completion Date 

2a Completed November 2011 

2b Completed June 2011 

2c Completed May 2015 

3b Completed June 2011 

4a To be completed by Mgmt N/A 

4b To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

4c Completed December 2012 

4d To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

5a To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

5b To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

6e Completed June 2015 

7a Completed June 2015 

7d Completed June 2015 

7e Completed June 2015 

7f Completed June 2015 

8d Completed October 2012 

10b Completed June 2015 

11a To Be Determined by Mgmt N/A 

11b Completed June 2015 

11c Completed June 2015 

12a Completed May 2012 

12b To be completed by Mgmt N/A 

12d To be completed by Mgmt N/A 

12e To be completed by Mgmt N/A 

13 Completed June 2015 

Management has signaled its continued willingness to work with OIG on closing many of the 

outstanding recommendations, and indeed, has mapped out a schedule that could represent 

29
 

closing most, if not all, of the outstanding recommendations by the close of calendar year 

2019. 

30
Section I.E: Limitations of the Financial Statements 

The principal financial statements have been prepared to report the financial position and results of 

operations of the FEC pursuant to the requirements of 31 U.S.C. §3515(b). While the statements 

have been prepared from the books and records of the FEC in accordance with United States 

generally accepted accounting principles (GAAP) for Federal entities and the formats prescribed by 

the OMB, the statements are in addition to the financial reports used to monitor and control budgetary 

resources which are prepared from the same books and records. 

The statements should be read with the realization that they are for a component of the U.S. 

Government, a sovereign entity. 

 

31
 

SECTION II – Auditor’s Report and Financial Statements 

32
Message from the Acting Chief Financial Officer 

November 15, 2018 

I am pleased to present the Commission’s financial statements for Fiscal Year (FY) 2018. The 

financial statements are an integral part of the Agency Financial Report. The Commission received 

an unmodified (clean) opinion on its financial statements from the independent auditors. This marks 

the ninth consecutive year with no material weaknesses identified. This is the sixth consecutive year 

with no significant deficiencies reported for the Office of the Chief Financial Officer (OCFO). I 

appreciate and applaud the good work of OCFO staff who strived diligently throughout the fiscal 

year to achieve these results, maintaining a commitment to excellence. 

The agency understands that information technology (IT) security is a continuing process of 

detecting risks, process improvements and hardening defenses. For that reason, the agency is 

committed to the timely implementation of the FY 2017 Financial Statement Audit Corrective Action 

Plan (CAP). Over the past year, the FEC has taken significant actions to improve the agency’s IT 

infrastructure generally and our IT security posture specifically. The agency has a robust plan and 

leadership support to continue IT enhancements in future years. 

In FY 2018, the OCFO took a lead role in the FEC’s Senior Management Council (SMC) to oversee 

activities relevant to agency-wide internal controls and Enterprise Risk Management (ERM), as 

described in the revised OMB Circular A-123. The SMC successfully updated the FEC’s Risk Profile 

in FY 2018, identifying enterprise-wide risks and appropriate responses relevant to the FEC’s 

strategic, operational, reporting and compliance objectives. 

Across all agency functions, the FEC continues to seek opportunities to modernize and upgrade 

business systems to improve operational efficiency. We are confident that FEC employees’ 

commitment to the agency’s mission will provide an opportunity to build on the prior year’s financial 

management successes. The OCFO looks forward to another successful year. 

Sincerely, 

Gilbert Ford 

Acting Chief Financial Officer 

33
 

OIG Transmittal Letter 

34
 

35
Independent Auditor’s Report 

36
37

TABLE OF CO·NTE TS 

Page 

Independent Auditor's Report .......................................................................................................... 1 

Report on Intern.al ControJ ............................................................................................................... 3 

Iteport on Comphance ................................................................................................................... 14 

Attachment l, tams of Prior Years, Recommendati.ons .............................................................. 15 

Attachment 2 Agency s Response to Report ................................................................................ 16 
38

LEONSNE..t\D 

& CO !PM ". P.C 

4]6Hm1t..~-d Dri.e, Sui!E, 400 

Rom e, _ 1acyl=d _os5o 

3-0 l-73 8-Sl90 

Fax: 3111-738-&_rn 

l.eoiliSlleaa.comp;;.nyp ~ ero xom 

Indespendeut Auditor s R-epom1 

THE Co~o.m,SIO~ £"EDER.AL ELECTIO - Cm,IM!IS IO 

I.. .PECTOR GE iERAL FEDERAL ELE:CTIO_ - COAWTI.SIO, -

\\ e have audited the accompanying financial statements of Federal E ection Commission (FEC), 

which comprise the ba ance sheet as of September 30 -018 and 2017, and the rela ed statements 

of net cost, changes in net posiho11,, budgetary resources, and custodial activity for the years then 

ended. The objective of our .audit was to e.,"lpress an opinion on the fan presentation of those 

fin.mcial statem.eut . In coruJ.ection with our audit, we also considered the FEC s internal control 

over financial reporting and tested fhe FEC's, compfiauoe with c.ertain provisions of applicable 

laws, regulations, and · ig11ificant provisions of contracts. 

As stated m our op:m1on on. the fm.ancial s.tatements, \Ve found that the FEC' s financial 

tateme11ts. as of.and for the. yeaIS ended September 30, _Ql 8, and 2017, are pre.sented furiy, m aJJ 

ma1erial respects, in confom1ity with accounting principles generally accepted m the United 

States. of AJ111.erica. 

Catifim Pnblie Acai1mt111it:. 

& Manngmnrul' CotIDJlt'111'11lr 

Our rnasidera:tion of internal control \voutd not necessarily disclose all deficiencies in intemaJ 

control over fina:nc · al reporting that migb be ma:terial weaknesses under standards issued by the 

American Institute of Certified Public Accountants. Our testing of internal. control identified no 

material Vi eakness rn intemaJ controls over financial reporting. We conllm1e to report a 

ignificant deficiency refated to FEC s Infom1ation Technology (IT) security program. FEC has 

made additional progress m addre.ssi:ng the findings during this fiSical year for seve:ral area.s 

:relating to its IT security program; while for other :findings we did not identify significam 

progress had been made. V. e have al.so reported a significant deficiency Doling that FEC's 

corredi\l·e action plan does not meet Office of1V1anagemeot and Budget-s (0MB) requirements. 

\\ e also identified one other colltrol issue dealing v. ith reco11cili:ng trading partner transactions 

that did not rise to the level of a reportable rooddion. U e provide tlris issue to management in a 

sepaiate letter dated November ] 5 0 HI. 

Our tests of compliance \Vith certain provisions of iaws, regu ations, and s-ignific.ant pro isions of 

contracts, disclosed no instance of noncompliance that is required o be reported under 

Government Auditing Standards and the 0MB audit bulletin_ 
39
40

OTHER MATTERS 

Required Supplementary Information 

Accounting principles generally accepted in the United States of America require that 

Management's Discussion and Analysis (MDA) be presented to supplement the basic financial 

statements. Such information although not a part of the basic financial statements is requ ired

by the Federal Accounting tandards Advisory Board (F ASAB) which considers it to be an 

essential part of financial reporting for placing the basic financial statements in an appropriate

operational, economic, or historical context. Wee hat>e applied certain limited procedures to the 

required supplementary information in aooordance with auditing standards generally accepted in 

he U nited S ates of America which consisted of inquiries of management about the methods of 

preparing the information and comparing the information for consistency with management's

responses to our inquiries, the basic financial statements and other knowledge we obtained 

during our audi.t oftbe basic financial tatements we do not express an opinion or provide .my 

assurance on the information because the limiited procedures do not provide us with sufficient 

evidence to express an opinion or provide any assurance. 

Other Information

Our audit was conducted for the purpose of forming an opinion on the basic financial statements 

aken a a whole. The performance measures and other accompanying information are presented 

for the purposes of additional analysis and are not required parts of the basic financial

tatements Such information has not been subjected to the auditing procedures applie in the 

audit ofthe basic financial statements and acoordinglyy, we do not express an opinion or provide

any assurance on it. 

OTHER. AUDITOR REPORTING REQ uirements

Report on Internal Control 

In planning and performing our audit of the financial statement of FEC as of and for the years 

ended September 3 0 2018 and 2017, in accordance with auditing standards generally accepted in 

the nitoo States of America we considered the FEC' s internal c:ontrol over financial reporting 

(internal control) as a basis for designing audit procedures that are appropriate in he

circumstances for the purpose of expressing our opinion on the financialstatemen , but not for 

he purpose of expressing an opmion on the effectiveness of the FEC's, internal control. 

Accordingly we do not express an opinion on the effectiveness of theFEC's internal control. 

Our consideration of internal control was for the limited purpose described in the preceding

paragraph and was not designed to identify all deficiencies in internal control that might be 

material weaknesses or significant deficiencies. Therefore, material weaknesses or significant 

defici.endes may exist that were not idenffied. However, given these limitations, during our 

audit we di.d not identify any deficiencies m internal oontrol that we consider to be a material 

weakness. As discussed below we identified deficiencies in internal control that we consider to 

be significant deficiencies. 

LeonSnead & Company, P. C. 3 
41

Because of inherent limitati.ons in internal controls indudmg the possibility of nu1nagement 

override of controls, misstatement , losses, or noncompliance may nevertheless occur and not be 

detected. A deficiency in internal control exists when the design or operation of a control does

not aUow management or employees in the normal course of performing their assigned 

functions, to prevent or detect and correct missstatements on a timely basis. A material 

weakness is a deficiency or a combinat ion of deficiencies in internal control, such that there is a 

reasonable possibility that a material misstatement of the entity's financial statements willnot be 

prevented, or detected and corrected on a tim.el y basis. A significantdeficiency is a deficiency 

or a combination of deficiencies, in internal control that is less evere than a material weakness, 

yet important ,enough to merit attention by those charged with. governance. 

Findings and Recommendations

L FEC Needs to Formally Adopt NI TIT Security Best Practicies and. 0 her 

Government-wideIT ' ecurityRequirements i(Repe. t Firndiu:g) 

In our FY 2017 financial statement audit we reported that we had re-opened(1) 1 a prior audit 

finding and recommendation that dealt with the need for the Commission to: (1) formally 

adopt the National Institute of Standards and Technology' s (NIST) best p:racti.ce IT security 

controls and all other applicable government-wide IT security requirements, and (2) conduct 

and document a fact-based risk assessment prior to declining to, implement governmentwide IT ecurity requirements that are applicable to FEC's business operations. The

recommendations were closed based on the response from management that the Commission 

had voted to implement the recommendations, an official management response to our audit 

report agreeing to implement the recommendation and management subsequent y hiring 

contracting services to assist with implementation. 

We followed-up with Office of the Chief Information Officer (OCIO) and the Office of 

General Counsel (OGC) personnel during our FY 2017 audit to determine the status of this 

finding and recommendation. In response to, an OIG request for further clarification on this 

matter the Ac.ting General Counsel in a memorandum dated September 15, 2017 advised 

that the Agency cou]d voluntarily adopt 1ST 800-37 as a whole or other FISMA

requirements , ". ..but that ·we do not believe the Commission bas done that to date." 

We met with OGC and OCIO officials during our FY 018 audit to follow up on this prior 

year open recommendation and we wer;e advised that the Commission would need to issue a 

policy to implement the open audit recommendation The prior Chief Information Security 

Officer along with OGC staffagreed o draft a policy for review and approval by the Chief 

Information Officer to address. the audit recommendation. As part of our standard audit 

requirements, we requested meetings with Governance and discussed this matter with the 

Vice-Chair who advised us that it was her understanding that the Commission had voted to 

adopt NIST best practices and she was not clear on where the breakdown in this agreement 

1 Government Auditing Standards require that auditors evaluatewhether the audited entity has taken appropriate 

corrective action to, address findings andrecommendations from previous engagements that are significant within 

the conteJd of l:he audit objectives.

Leon Snead & Company, P_ C 4 
42

occurred. To date, no additional information has been provided by FEC, and the finding and 

recommendation remains open. 

1. Adopt · 1ST IT Securitybest practices and other government-wide information security 

requirements that are applicable to the agency' business and information systems 

operations and document this policy throughthe issuance of a Commission Directiive or 

OCIO policy. 

2. Condu ct and document a fact-based risk assessment prior to declining to implement 

government-wide IT security requirements that ;u;e applicable to FEC's business 

operations. 

l);lauar-ement s Response

The OCIO agrees wiith the recommendation in principle and will seek comment from the 

Commission on accepting any residual risk for the FEC which has. recently and 

successfully adopted NIST as best practice and implemented NIST specific IT security 

controls into applicable systerns. Over the years the QC]:0 spent considerable effort 

implementing and executing the NIST Risk Management framework (RMF) and 

applying them into FEC's critical systems. The O CIO does not believe a separate policy 

should be created to specifically "adopt 1ST security best practices and other 

government-wide information security requirements" because these are iindefinable 

requirements Tue OCIO uses the following agency-wide policies to demonstrate use of 

NIST IT security b t practices and other government-wide information security 

requirements FEC Information System Security Program Policy 58A (updated April, 

2017); Delegation of authority appointment of Authorizing Officials in accordanoe wi:th 

NIST RMF ( igned Feb, 2017); CISO appointment order in accordance with FISMA 

(signed Dec 12, 2016); and Risk Management Framework (NIST RMF) Standard 

Operating Procedure (siigned and published March, 2017). Additionally, the OCIO has 

partnered with the fEC' s. Contracting Officer and has. established a tandard FEC-Wide 

procurement and contracting process to ensure IT acquisition adheres to the policies

stated above. 

Auditor's Comments 

While the response notes it 'agrees with the recommendation in principle", it goes on to 

state that ''the OCIO does not believe a separate policy hould be cr;eated to specifically 

adopt NIST security best practices and other government-wide information security 

requirements because these are indefinable requirements." 

During our audit, OGC advised us that it had determined that iit was unclear that the 

Commission had in fact, approved implementation of NIST best practices and that a 

Commission directive would probably be needed to implement the recommendation. 

As previously star ed wi:thout a polic.y based process to continue to strengthen 

weaknesses in FEC s IT security program progress made to date can be stopped or 

regress to the point where implementation o.f IT security controls are not a priority if 

Leon Snead & Company, P.C. 5 
43

changes occur in key personnel. W ith the recent separation of the FEC' CISO , who 

was instrumental. to the CIO in the recent signiificant progress made to IT security we are 

concerned that progress in remediating outstanding issu es will become atic if a formal 

policy is not approved that dearly states the Commission will adhere to applicable I1ST 

security standards and all other required government-wide ITsecurity requirements,. 

In addition, we are uncertain of the OCIO s position that the NIST security best practices, 

and other government-wide information ecurity requirements are an "indefinable 

requirement " . NIST has been established as the tandard setting entity for all IT security 

requirement - 3 _ 

Wee continue to believe that the Commis ion should formall y adopt NIST best prac ices 

and all other government-wide ecurity requirements by developing a policy that 

mandates adherence to all standards and requirements applicable to FEC business 

processes otherwise compliance with applicable security requirements will continue to 

be "person based and not policy based. uch a process does not ensure fue agency is 

consistently following the securi:ty standards et for the federal government. When 

changes in key personnel occur, the upward trend in addressing long standing IT security 

weaknesses are negatively impacted 

2. •. Agency Corrective AActionPlans Are Not Compliant WithGovernment Requirements

FEC corrective action plan (CAP) for the internal control deficiencies reported in prior 

financial tatement audit reports does not meet the Office of Management and Budget 

(0MB) requirements. We attributed this condition to a need for addiitfonal oversight and 

monitoring to ensure the agency meets Commissiion Directirve A-50 and related 0MB 

regulations. Without an adequate CAP the agency is, unable to track the implement ation of 

corrective actions for reported deficiencies ensure hat realistic milestones are established, 

and ensure that targeted resolution dates are consistently met to reduce the agency's risk 

exposure. 

0MB Circular A-123, Management s. Responsibility for Enterprise Risk Management and 

Internal Control, dated July 2016, requires each agency's CAP to address, the followi.:og 

areas:

• Resources. required to correct a control deficiency. The correctiv e action plan must 

indicate the types of resources needed (e.g. additional personnel, contract support, 

training, etc.), including non-financial resources, such as enior Leader hip upport 

for correcting the control defic.iency. 

• Critical path milestones that affect the overall schedule for implementing the 

corrective actions needed to resolve the control deficiency. The milestones must lead 

to a date certain of the correction of the control deficiency. 

The FEC' s CISO separated from tihe agency i11 September 10 8. 

3 NISTis responsible for developing information security standards and guidelines, including minimum 

requirements for :federal systems except for national security systems TheFISMA publications are consistent with 

the requirements of the Office of Management and Budget (OMB) Circular A-130. 

Leon Snead & Company, P. C. 6 
44

. , Requne prompt resolution and internal control testing to validate the correction of the 

control deficiency . 

• , Procedures to ensure that accurate records of the status of the identified control 

deficiency are maintained and updated throughout the entire process,. 

To determine whether the agency met federal standards and their own internal requirements 

we reviewed the June 2018 CAP. Our review identified the following areas where 

improvement were needed . 

• , The plan does not identify the resources required to correct a deficiency, including the 

types of resources needed to correct the deficiency . 

• The plan does not have critical path milestones that affect the overall schedule, or the 

corrective actions needed to resolve the deficiency, including a "date certain" that the 

deficiency will be corrected 

* Concerning the requirement in OMB Circular A-123 and Commission Directive 50, 

that the agency must promptly reso lveand perform internal control testing to validate 

the correction of the control deficiency, many of the deficiencies contained in this 

report and m the CAP have been outstanding for year , and some of the deficiencies 

have been reported outstanding since FY 2.004. 

We have reported problems wiitb the agency s C.AP and :related areas m several prior audit

reports and appropriate corrective action has yet to be implemented. 0MB Circular A-123, 

Section V, provide that agency managers are responsible for taking timely and effective 

action to correct deficiencies; correcting deficiencies is an integral part of management 

accountability and must be considered a priority by the agency; corrective action plans 

should be developed for all material weaknesses and progress against plans hould be 

periodically assessed and reported to agency management Management should track 

progress to ensure tmiely and effective results. 

Recommendation 

3,_ T.me actions to ensure that the agency's CAP includes all of the requirements of 

Commission Directive A-50 and 0MB Circular A-123. 

Agency's Response 

The OCIO continues to work towards, identifying a process to evalua e government-wide 

IT security best practices and mandates that aligns with the OGC's established policy 

review processes _ Partnering wi:th. OGC will enable the OCIO to track and assess 

government issued information security pohdes, mandates,. and directives for their

applicability to FEC systems

Auditor's Comments

OCIO indicated that it i continuing to work on a process o review government-wide IT

security requirements; however, this response does not address the recommendation in 

totality. As OGC may be involved in the leg, legality portion of the assessment, they are not 

Leon Snead & Company, P. C. 7
45

responsible, nor have the expertise in information security to formally conduct a 

fact-based risk assessment for implementing security controls assessing proper risk 

appetite, or proposing alternative security control approaohes to addressing new security 

requirement _ 

3. SecurityWeaknesses in Information Technology Controls

FEC has made further progr essm addressing long outstanding security oontrol weaknesses; 

however, there are till areas requiring improvement and more emphasis on remediation from 

management As required by Government Auditing Standards, we reviewed the actions 

taken and proposed by the FEC to address, the recommendations that remained open from 

prior audit _ During our current audit, we were abJe to close three of the audit 

recommendations that remamed open from prior years reports. Completion dates for he 

remaining open recommendations oontinue to be extended, even though the issue have been 

reported for several years and_ in some cases, since FY 2004. The following paragraphs 

discuss the findings and recommendations that remain open. 

a. . Review of ser Access Authorities (Open since FY 2004) 

FEC has not yet established a process that will provide supervisors. with the necessary 

information to recertif y user access authorities for their taff. While FEC officials agreed 

after our first report that such a control proces was needed (and required by its own 

policies), limited progress has been made to implement this control process _ Until this 

control is implemented FEC officials have reduced assuranoe that users only have access to 

information and information systems. that are necessary to accomplish their specific job 

responsibilities. We found no corrective actions taken on this problem area during FY 018. 

Best practices (NIST SpecialPublication ( P) 800-53 and related publications) provide that 

an organization sbouJd review user accounts on a periodic basis. The currently approved 

FEC Policy 58-2.2 provides that "All user account access rights and privileges will be 

periodically reviewed and validated in accordance with General Support System ... system 

security plans. ... _ . ' 

Recommendation

4. Complete the project relating to review of user acoess authorities and ensure necessary 

budgetary and personnel re ource are provided to complete this project in a timely 

manner. 

The OCIO agrees with the recommendation but notes that this finding has no impact on the 

actual ecurity of FECsystems. In 2017, the OCIO impl emented strict account management 

procedures that included detailed steps for users to gain and maintain access to FEC systems 

However, the OCIO is in the process, of researching effective ways and if an effective 

procedure is found for a reasonable cost it will be implemented enabling supervisors to 

review user access authorities annually. 

Leon Snead & COmpany .P. C. 8 
46

Auditor's Comments 

The OCIO agrees with the recommendation but added that the finding had no impact to the 

actual security of the FEC systems we disagree with the FEC s comment that this issue 

would have no actual impact to security, as securing agency information to only those who 

are properly authorized is a critical function of an agency s security program. This control 

would identify users who have moved positions within FEC or have separated from the 

agency and continue to have unauthorized acce s. to FEC information Such a condition 

would have a significant impact on IT security processes. 

\Ve have reported this IT security weakness to FEC ince 2009. .As noted in each. audit

report, FEC policies as. well as IST IT ecurity best practices provide for an annual review 

of actual user access. 

b. SGCB Requirements Need to be Implemented Agency-wide Open since FY 2009) 

In March 2007 OMB Memorandum M-07-11 announced the "Implementation of Co.mmonly 

Accepted ecurity Configurations for Windows Operating ystems ' directing agencies. .. to 

adopt the Federal. Desktop Core Configuration (FDCC) security configurations developed by 

the National Institute of Standards and Technology , IST), the Department of Defense and 

the Department of Homeland ecurity. The United State Government Configuration 

Baseline (USGCB)4 i.s the security configuration and policy developed for use on Federal 

computer equipment and as stated by the CIO Council, 'the USGCB initiative falls within

FDCC and comprises the configuration settings component ofFDCC. 

In prio:r audits, we reported that the FEC needed to implement the U GCB. During our FY 

20118 audit we were advised that the FEC had completed its implementation of this 

government-wide requirement. However, when we reviewed FEC IT security canning 

reports we identified a significant number of desktop that were not in fact compliant with 

all applicable GCB ecurity requirements. \Ve discussed this i sue with OCIO officials 

who agreed that additional actions were needed in this area. 

U has been over ten years since 0MB first issued minimum security requirements for 

window s operating systems. ntil this project is completed, the agency s systems and 

inf orma tionremain at risk .. 

Recommendation 

5. Implement U GCB baseline configuration standards for all workstations regardless of the 

current hardware in use. 

4 The United States Go vernment Configuration Baseline (USGCB) initiative is o create ecurity configuration 

baselines for Information Technologyproducts widely deployed across the federal agencies The USGCB baseline 

evolved from the Federal Desktop Core Configuration mandate The USGCB is a federal government-wide

initiative that provides guidance to agencies on what should be done to improve and maintain an effective 

configuration settings focusing primarily on security 

Leon Snead & Company, P. C. 9 
47

Agency's Response 

Management concurs. with the OIG regarding the implementation of the U GCB. In 

2017, the OCIO has pushed USGCB configuration settings on all Windows 7 laptops. 

However, recent scans indicated that USGCB is not consistently applied within the FEC 

environment. The OCIO wi.U accelerate the review and testing of U GCB to analyze and 

determine the best approaches. regarding functionality in meeting the FEC' infrastructure 

needs. Required USGCB settings wm be applied to all worksta tions FEC-wide as oon as 

it is ready. The estimated completion date for USGCB implementation js 4th. quarter 

FY19. 

Auditor'ss Comm ents

OCIO concurs with the finding and recommendation, and provides a completion date of 

fourth quarter FY 2019, and we have no additional comments. 

c. FEC Has Not Fully Implemented and Tested Their Agency Continuity of 

Operations Plan or Contingency Plans for IT Systems (Open since FY 2004)

We revi.ewed the acti.ons taken by FEC to address findings and recommendations relating to 

the development and testing of the FEC's Continuity of Operations Plan (COOP). Our 

review of FEC' FY 2018 CAP and discussions with OCIO officials howed that the agency 

is still working to complete the COOP. The current estimated completion date for this 

long-delayed proj ec.t is now the end of calendar year 2018. 

The FEC has operated for 14 years without an approved and tested COOP to ensure that in 

the event of a disaster the Commission would have the ability to continue normal business 

operations within a reasonable timeframe. Without an up-to-date COOP document that has 

been validated through testing and exercises any deficiencies in the plan cannot be 

determined, and the agency remains at high risk wiith the inability to carry out the mission of 

the agency m the event of local disaster. 

ln addition, the absence of contingency plans for the agency s general support system, and its 

other maj or applications pose a separate and material threat to the agency' mission 

particularl y during election cycles. 

FEC provided, at our request, a COOP specific. CAP related to the OIG' 's Inspection of the 

FEC's Disaster RecoveryPlan and Continuity of Operations Plans, released in January 

2013. We reviewed this document and noted the following: 

• The plan lists seven remaining OIG recommendations from 2013, 

• The original completion dates were from June to December 2013, and 

• Toe current estimated c:ompletion date for thi important project has been extended 

repeatedly and is now estimated to be completed by the end of December 2.018. 

Based on tbe level of effort, time and resources required to complete thi.s significant agency 

requirement we note that the December 2018 due date provided from management is not 

reasonable which will require another date extension 

Leon Snead & Company, P. C. 10
48

government-wide best practices, IST SP 800-34, Contingency Planning Guides for the 

Federal Government, states the following: 

«Information Systemsare vital elements in most mission/business processes. Because 

information system resources are so essential o an organization's success i is critical that 

identified ervices provided by these ystems are able to operate effectively without 

,excessive interruption Contingency planning supports this requirement by establishing

thorough plans, procedures, and technica l measures that can enable a system to be recovered

as. quicklyand effectively as possible following a service disruption contingency planning 

is unique to each ystem, providing preventive measures, recovery trategies, and technical 

considerations appropriate to the ystem' information confidentiality, integrity and 

availability requirements and the system impact evel. ' 

Recommendations 

6. Ensure that sufficient resources are assigned to the task of testing the COOP a critic. l IT 

control process, in order to reduce risk to the FEC, and complete all required tes in a 

timely manner. 

Estimated completion for a table top exercise is March 2019. Management 

acknowiedges the COOP requires updating and resources are being sought to assist in 

thi process. Information gathered from the table top exercise will also be used to update 

the COOP. Estimated completion for updating is, third quarter FY 19. 

7. Dei elop system specific contingency plans, as required by the NIST RMF

Management concurs use of IST SP 800-34 for each system identified as a critical 

system. FEC will establish information ystem contiingency plans for systems under the 

General Support System. (GSS) boundary: Law Manager Pro Comprizon Suite, 

Disclosure, Data Entry, Informatica Kofax, ECM suite and Presidential Matching Fund 

system. 

Management is currently conducting research and has been provided ISCP templ ates to 

assist in the process and working in coordination with each application owner to create 

each plan Estimate completion for analysis is six months (May 0119). 

Auditor's Comments 

Management concurred with the recommendations and advised that it W ould have these 

actions completed by May 2019. We have no additional comments. 

d. Further Improvements Needed in the Remediation of Vulnera bilities (Open si1ice FY 

2004)

In prior audit we reported FEC' vulnerability canning and remediation program did not 

meet best practices and was a significant internal control deficiency. In FY O 17, we 

Leon Snead & Company, P. C. 11 
49

reported that FEC had made improvements in its scanning program, including remediation of 

the vulnerabilties identified by these scans and monitoring related corrective actions. 

During our FY 018 audit we followed up on the actions taken by FEC to determine whether 

the agency had fullyy remediated this, probJem area. We identified that FEC had made 

addiitional ignificant progress, corrected a number of long outstanding critical 

vulnerabilities making further progres on others .and had established a monitoring system 

that met weekly to discuss progress and issues impacting the vulnerabilities. However our 

review concluded that FEC had not yet established a process to allow the agency to address 

these areas at a "managed and measured" level - the level 0MB bas determined is needed to 

assure hat an agency is meeting IT security requirements. 

Our audit also determined that while tracking of identified vulnerabilities has progressed and 

overall are reported on POA&Ms, key required elements. of effective monitoring efforts had 

not yet been. fully addressed. The POA&Ms for everal longstanding critical areas did not 

have key tasks identified, anticipated completion dates and other required elements of a 

POA&M The prior CISO stressed the need for improvement in this area and had established 

a weekly meeting of all key personnel to address the issues noted in the cans and POA&Ms .

We believe that this is a critical process and if continued, will enable FEC to more effectively 

identify needed tasks to remediate the issues, and track progress being made. 

OMB Circular A-BO states. that agencis " should assure that each system appropriately uses 

effective security products and techniques, consistent with standards and guidance from 

NIST. " IST SP 80 0-53 addresses vulnerability scanning as one of the recommended 

security controls and part of the risk assessment process. ST SP-800-115 states that as part 

of echnical security assessments. and to ensure that technical security testing and 

examinations provide maximum. Value NIST recommends that organizations: "Analyze 

findings and devefop risk :mitigation techniques to address weaknesses. To ensure that 

security assessments provide their ultimate value, organizations should conduct root cause 

analysis upon completion of an assessment to enable the translation of findings into 

actionable mitigation techniques. These results may indicate that organizations sbouJd 

address not only technical weaknesses, but weaknesses in organizational processes and 

proaedures as well " 

Recommendations

8. Strengthen controls around tihe remediation program to ensure that critical and high 

vulnerabilities identified through the \rulnerability scanning and other processes are 

completed within 60 days of identification or document an analysis and acceptance of 

risk for Jonger term remed,iation. (revised)

Agency's s Response

OCIO agrees with the OIG's assessment of a need to strengthen controls around the 

remediation program. W e remain committed to following the most effective way to 

mitiigate software flaw vulnerabilities and effective solutions to patch management. The 

OCIO followed recommendations from the Department of Homeland Security (DHS) 

Federal Incident Response Evaluation (FIRE) program. and the NIST Special Publication 

Leon Snead & Company P.C. 12 
50

800-40 Rev 3 in strengthenmg its patch management program ince a number of these 

actions did not appear in the OIG s. report, several of the more significant actions are 

listed here as supplemental information, 

Over the past two years the OCIO has executed some weeping changes to i patch 

management program and practices that provided more transparency and clarrity to OCIO 

administrators responsible for the timing, prioritization, and testing of patches. In March 

2018, the OCIO formalized a System ' ecurity Plan ( SP) that directed developers to 

mitigate high-risk vulnerabilities within thirty days (30) and moderat e-risk vulnerabilities 

within ninety days (90). Any request for extensions must be approved of in writing by am 

Authorizing Official (AO)_ Currently both the Deputy CIO for Enterprise Architecture 

and the Deputy CIO for Operations are formally appointed by the CIO as AOs, for FEC 

systems. additionally, in 2018, the OCIO formed a ecurity and Operations ( ECOPS) 

team to track and discus the status of outstanding vulnerabilities and remediation plans 

on a weekly basis. In all cases, all vulnerabilities are documented in an FEC owned 

GitHub repository and POAM_ All vulnerability remediation plans of actions .and 

milestones are tracked on a weekly basis by the FEC' s Information System Security 

Officer (ISSO). The OCIO will continue to strengthen oversight and execution control of 

changes. already implemented above. 

Auditor's Comments 

As the OCIO agrees wiith the audit recommendations., we have no further comments 

9. Establish Office of Chief Information Officer (OCIO) policies that require the 

development of POA&Ms to comply witih best practices, to include key reporting areas 

such as: resources required; overal1 remediation plan; scheduled c.ompletion date; and key

milestones with completiondates. 

Agency'sResponse

OCIO agrees with the OIG's assessment and aims to implement corrective actions. The 

CISO is. m the process finalizing the policies and procedures to address and strengthen 

the vulnerability management, Estimated completion of a POA&M policy is May O 19 . 

Auditor's Comments 

The OCIO agrees with the audit recommendations. However, we do not believe that 

a completion date of May2019 is appropriate to develop a POA&M policy for these 

orit i.cal areas. We believe this action should be better prioritized to have this 

recommendation implemented immediately_ 

We noted another control issue that did not rise to a level of a reportable condition, and reported 

this in a management letter dated Novem:ber 15, 201 8_ 

A summary of the tatus of prior year recommendations is included as. Attachment 1. 

Leon Snead & Company, P_ C. 13 
51

REPORT ON COMPLIA NCE

As part of obtaining reasonable assurance about whether the agency's financial statements .n;e 

free of material misstatement, we performed tests of its compliance wi.th. certain provisions of 

laws regulations and significant provisions of contracts, noncompliance with which could have 

a direct and material effect on the determination of financial sta ement amounts, and certain 

other laws and regulations. We limited our ests of compliance to these provisions and w,e di.d 

not test: compliance with all laws and regulations applicable to the FEC. Providing an opinion on 

compliance with certain provisions of laws, regulations, and significant contract provisions was 

not an objective of our audit and, accordingly, we do not express such an opinion. 

In c connection with our audi:t, we noted no instance of noncompliance that · required to be 

reported according to Government Auditing Standards and the O:MB audit but etin guidelines. 

No other matters came to our attention that caused us to believe that FEC failed to comply with 

applicable laws, regulations, or significant provisions of laws, regulati.ons, and contracts that 

have a material effeot on. the financial statements insofar as they relate to accounting matters. 

Our audit was not directed primarily toward obtaining knowledge of such noncompliance 

Accordingly, had we performed additional procedures other matters may have come to our 

attention regarding the FEC' s noncompliance with applicable laws, regulations, or significant 

provisions of laws, regulations, and contracts insofar as hey relate to accounting matters . 

Restricted Use Relating to Reports on Intemal Control and Compliarnce 

The purpose of the communication included in the secti.ons ideoti.fied as "Report on Internal 

Control" and "Report on Compliance" is solely to describe the scope of our testing of internal 

control over financial reporting and compliance and to describe any material weaknesses, 

significant deficiencies, or instances of noncompliance we noted as a result of that testing. Our 

objective was not to provide an opinion on the design or effectiveness of the FEC' internal 

control over financial reporting or its compliance with laws regulations, or provisions of 

contracts. The two sections of the report referred to above are integral parts of an audit 

performed in accordance with Govemment Auditing Standards in considering the FEC' s internal 

control over financial reporting and compliance. Accordingly, those secti.ons of the report are 

not suitable for any other prupose. 

The FEC's response to the audit report, which has been summarized in the body of this 

report is included in its entirety as Attachment 2. The FEC s response was not s ubjected to the 

auditing procedures applied in the audit of the financial statements and, accordingly, we 

express no opinion on it. 

Leon Snead & Company PC

Leon Snead & Company, P.C. 

ovember 15, 2018 

Leon Snead & Company, P. C. 14 
52

Attachment 1 

Status of Prior Years' Audi.t Recommeodati111ns 

1. 

2. 

3. 

5. 

7. 

Optn Recommt>n,da.tions 

Adopt NIST IT r.ecmity best practices and other go,;remment-wide information security 

requirements that are applicahle to fue a_§ency' s. bu.sines,s. an d inf01D1ation systems 

operations and document this policy through the ii.-.manoe of a · ommission Diireclirve. 

Conduct and d'ocumen a. fact-based risk as"lle ssment prior to, dedimng to iimple:mem 

govemment0wide IT security lieqrnirements that are applicabl.e to FEC's. business 

operations. 

Take actions o ensure that the agency's CAP includes all of 1he :i;eqni.rem.em:s of 

Commission Direcfa•e A-50 and 0 1\>IB Ci!rcubr A-123. 

Complete th.e proj,ect Feb .ting to re1,iew of user aoces."ll authorities and ,ensure necess.ll[;' 

budgetary and per:sonne] r,es- ourrc.es ar;e pr01iided to complete this proj,ect in a timely 

ma!DD.er. 

finalize lhe draft FEC policies ilia requi.Fe annual recertification of users' a.ocess 

imlhoriitie.s" En.sure that ilie policies address privileged ac.counts, and require val!idation to 

aclrn1l sys em access records, by uperviso:ry pernonnel who would !b.a"'·e :knowledge of 

lhe m:ern' requirements for accessing FEC .inform.a:lion and information systems. 

ImplemeJ11t USGCB base l.irne configuration stmdards for all workstations Fegard!les,s of 

·lhe current hard,vare in use. 

Ensme that sufficient resources are assigned to tib.e task of testing fue COOP, a critical IT 

c.o:ntro] process, .in orde:r to :i;ed'ttce risk to the FEC, and oompMe all requilied ests in a 

limely manner. 

Develop sys em :specific contingency plans, as required by the NIST R.1\.ff. 

8. Strerurthen controls aroUlld the remediation program to ensure ilia critica] and high 

Vl!llnerabi]ities identified through tib.e vnlnenhility sc.a lllll!Dg an d oiher processes are 

c.ompMed within 60 days of identification or doC111D1e11t an analysis and acceptance of 

risk:s. for longer tenn remediation. 

9. fatab]is!b. Offic.e of C!b.ief Information Offic.er (OCIO) policies that requrre, ilie 

development of POA&1\.fa to comply wiith best practices, to include k,ey reporting areas 

such as: resource;; required; overall r,ememation plan; oc!b.eduled completion date; and. 

key milestones with completion dates. 

W. De ·elop an Office of Chief Jnfonrui.tion Offioer (OCIO) policy that requires proJe.ct 

manager,;;. o d.evelop a detailed proj ect plan for all OCIO proj ec,ts tib.at r,eqnire multiple 

resom:c:es, extended timefhunes and/or have a total coiSt of$200,000 or more. 

11. Develop an OCIO policy that de iLs fue nec.ess-ai:y info=ation r,equrired for fue 

deve opment of a proj ec,t plan such as: 

a. identificc311ion of key tasks an or :stepiS· 

b. personnel respomilile for completi!ng the task an I or ste,p; 

c. the timeframe for beginning and comple,ting the task. an dfor :step; 

d. any associated oost; 

e. reoouroes requi.Fed; and 

f documentation to be maintained as part of th.e project plan to r.npport th.e 

acoompli:s!b.mem of .key plan tasks issues that .impacted fue project, and the 

oomp]etion of the overall proj ect. 

Status 

Open 

Open 

Open 

Open 

Open 

Open 

Open 

· losed 

Closed 

Closed 

~ The FY 201 8 lieport Separates the Commission policy :md the fact-based risk assessment into two separate open 

recommendations 

Leon Snead & Company, P. C. 15 
53

PEDERAL EILECTION COMMISSION 

Washington, DC 20463 

Attachment 2 

The FEC continues on the path to remediate all findings. The OIG incorporated our detailed 

responses to ea.oh of the :findings and recommendations in.to the body of the audit report. Our 

responses provide an overview ofho\v we plan to rem.edia.te each oftbe findings. 

Findings and R.e,commendations 

Recommendations 

Adopt NIST IT security best practices and other government-wide information security 

requirements that are applicable to the agency's busmess and information systems 

operations and document thi.s policy through the issuanoe of a Commiss · on Directive or 

OCIO policy. 

2. Conduct and doownent a fact-based risk assessment prior to declining to implement 

government-wide IT s.eourity requirements that are apphca:ble to FEC':s business 

operations. 

A:f:D<Y s Respouse 

The OCIO agrees \Vith the reoommend:11ihon in principle and wm :seek oomment from the 

Commission on accepting any residual risk for the FEC, which has recently and 

suoces:sfid1y adopted NIST as a best prachoe and implemented NIST :specific IT security 

controls in.to apphcable systems. itnoe 2015, the OCIO has spent oonsiderable -effort 

implementing and executing the NIST Risk Management Framework (RMF) and 

applying them to the FEC' s most critical systems. The OCIO does not believe a separate 

pohcy :should be cr;eated to specifically "adopt NIST security best praotires and other 

gmlemment-\1,ride itnformation security requn:ements" because these ar;e indefmable 

requirements. The OCIO uses the follmving agency-wide policies to, demonstrate use of 

NIST IT :seoruity best practices and other government-wide iinforma.tion security 

requirements: FEC Information System Security Program Policy 58A (updated April 

2017); Delegation of authorit,• appointment of Autboriring Officials in accordanoe with 

NIST RMF (signed Febrnruy 2017t CISO appointment order in aooordance with 

FIS:MA (stgned December 12, 2016); and Risk Management Framework (NIST RMF) 

Standard Operating Prooedure (signed and published March 2017). Additionally, the 

OCIO bas partnered with t.he FEC':s Contracting Offioer and has established a standard 

FEC-wide procurement and contracting prooess to ensure IT acquisitions adber;e to the 

policies :stated above. 

3. Take actions to ensure that the agency's CAP indude:s all of the requn:ements of 

Commission Dn:ecti\re A-50 and 0MB Cimdar A-123. 16 
54

Attachment 2 

Agency's Response 

The OCIO continues to work towards identifying a process to evaluate government-wide

IT security best practices and mandates that aligns with the OGC's established policy

revi.ew processes. Partnering with OGC wi.11 enable the OClO to track and assess 

government i.ssued information sec.uriity policies, mandates and directives for their

appJicability to FEC systems. 

4. Complete the project relating to review of user access authorities and ensure necessary 

budgetary and personnel resources are provided to complete thi.s project m a timely

manner

Agency's Response 

The OCIO agrees with the recommendation but notes that this finding has. no impact on 

the actual security of FEC systems In 2017, the OCIO implemented strict account

management procedures that included detailed steps for users to gain and maintain access 

to FEC systems. However the OClO is in the process of researching effective ways to 

periodicallyreview and recertify user access; and if an effective procedure is found for a 

reasonable cost it will be implemented enabling supervisors to :review user access 

authorities annually. 

5. Implement GCB baseline configuration standards for all workstations :regardless ofthe 

current hardware in use.

Agency's Response 

Management concurs wi.th the OIG regarding the implementation of the USGCB. In 2017, 

the OClO pushed SGCB configuration settings. on alJ Windows 7 laptops. However

recent scans indicated that USGCB is not consistently applied wi. thin the FEC 

environment. The OCIO will accelerate the review and testing ofUSGCB to analyze and 

determine the best approaches regarding functionality in meeting the FEC' s infrastructure

needs . Required U GCB settings will be applied to all workstations FEC-wide as soon as 

it is ready. The estimated completion date for SGCB implementation is fourth quarter 

FY19. 

6. Ensure that sufficient resources are assigned to the task of testing the COOP a critical IT 

control process in order to reduce risk to the FEC, and complete all required tests in a 

timely manner. 

The estimated completion date for a table top exercise is March 2019. Management 

acknowledges the COOP requires updating and resources are being sought to assist in this 

process. Information gathered from the table top exercise will also be used to update the 

COOP. The estimated completiondate for updating the COOP is third quarter FY19.

7. Develop system specific contmgency plans, as required by the NIST RMF

Agency's Response 

Management concurs use of IST SP 800-34 for each ystem identified as a critical 

system. FEC will establish information system contingency plans for s.ystems under the 

General Support System (GSS) boundary: L1,w Manager Pro Comprizon Suite, 

17 
55

Attachment 2 

Disclosure, Data Entry Informatica, Kofax, ECM suite, and Presidential Matching Fund 

system. 

Management is currently conducting research and has been provided ISCP templates to 

assist in the process and working in coordination with each application owner to create 

each plan. The estimated completion date for the analysis is May 2019. 

8. Strengthen controls around the remediation program to ensure that critical and high 

vulnerabilities identified through the vulnerability scanning and other processes are 

completed within 60 days of identification or document an analysis and acceptance of 

risks for longer term remediation. (Revised)

Agency's Response 

OCIO agrees with the OIG's assessment of a need to strengthen controls around the 

remediation program. We remain committed to follow ing the most effective way to 

mitigate software flaw vulnerabilities and effective solutions to patch management. The 

OCIO followed recornmendations from the Department of Homeland Security (DH ) 

Federal Incident Response Evaluation (FIRE) program and the NIST pecial Publication 

800-40 Rev 3 in strengthening its patch management program. Since a number of these 

actions did not appear in the OIG's report, everal of the more significant actions are 

listed here as supplemental information. 

Over the past two years the OCIO has executed some sweeping changes to its patch 

managem.ent program. and practices that provided more transparency and clarity to OCIO 

administrators responsible for the timing, prioritization, and testing of patches. In March 

2018 the OCIO formalized a System Securdy Plan ( SP) that directed developers. to 

mitigate high-risk vulnerabilities within thirty days (30) and moderate-risk vulnerabilities 

within nine.ty days. (90). Any request for extensions must be approved of in writing by an 

Authorizing Official (AO). Currently both the Deputy CIO for Enterprise Architecture 

and the Deputy CIO for Operahons. are formally appointed by the CIO as A.Os for FEC's

systems. Additionally, in 2018, the OCIO formed a Security and Operations. (SEOOPS) 

team to track and ctiscuss the tatus of outstanding vulnerabilities and remediation plans 

on a weekly basis. In all cases, all vulnerabilities are documented in an FEC owned GitHub 

repository and POAM. All vulnerability remediation plans. of actions and milestones are 

tracked on a weekly basis by the FEC's Information ystem e,curity Officer (IS 0 ). The 

OCIO will continue to strengthen oversight and execution control of changes already 

implemented above. 

9. Establish Office of Chief fu.formation Officer (OCIO) policies that require the 

development of POA&Ms to comply with best practices to include key reporting areas 

such as: resources required; overall remediation plan; scheduled completion date; and key 

milestones with completion dates. 

Agency' s Response 

OCIO agrees with the OIG's assessment and aims to implement correotive actions. The 

Acting CISO is in the process of finalizing the policies and procedures to address and 

strengthen the vulnerability management The estimated completion date of a POA&M 

policy is May 2019. 

18 
56

Attachment 2 

Thank you for the opportunity to once again work with the OIG and the fiancial statement 

audit team. during the a11dit process. We look fonvard to continue our work with the OIG for 

the Fiscal Year 2019 financial statement audit. 

tUbrut:-Ford - Gilbert Ford 

Acting Chief Financial Officer 

19 
This page marks the end of the Independent Auditor’s Report 

57
 Fund Balance With Treasury 

 Total Intragovernmental 

 Accounts Receivable, net 

 General Property, Plant and Equipment, Net 

 Accounts Payable 

 Other:

 Employer Contributions and Payroll Taxes Payable 

 Other Post Employment Benefits Due and Payable 

 

 Custodial Liability 

 Deferred Rent 

 Total Intragovernmental 

 Accounts Payable 

 Federal Employees and Veterans Benefits 

 

 Accrued Funded Payroll and Leave 

 Employer Contributions and Payroll Taxes Payable 

 Unfunded Leave 

 Unexpended 

Appropriations - All Other 

 Cumulative Results of 

 Total Net Position 

Financial Statements 

BALANCE SHEET 

As of September 30, 2018 and 2017 (in dollars) 

Assets: 

 Intragovernmental:

2018 

20,287,566 

20,287,566 

2017 

23,494,651 

23,494,651

Total Assets 

447,136 

17,223,344 

37,958,046 

628,528

10,019,061 

34,142,240 

Liabilities: 

 Intragovernmental: 

 Unfunded FECA Liability 

206,652 

369,966 

3,500 

6,052 

447,136 

8,446,642 

9,479,949 

120,434 

374,495

3,500

5,810

628,528

0 

1,132,767 

Other:

Total Liabilities 

1,876,045 

8,122 

1,352,064 

57,390 

2,515,072 

15,288,642 

574,113 

7,426 

1,354,304

55,786

3,154,512 

6,278,907 

Net Position:

Operations - All Other Funds 

 Total Net Position - All 

Other Funds (Consolidated 

Total Liabilities and Net Position 

16,421,949 

6,247,456 

22,669,404 

22,669,404 

37,958,046 

21,012,019

6,851,313

27,863,333 

27,863,333 

34,142,240 

58
 

 

 

 

STATEMENT OF NET COST 

For The Years Ended September 30, 2018 and 2017 (in dollars) 

2018 2017 

Program Costs: 

Administering and Enforcing the FECA

 Gross Costs 

 Less: Earned Revenue 

 Net Program Costs 

78,532,995 

544 

78,532,451 

69,135,721

2,266

69,133,455 

Net Cost of Operations 78,532,451 69,133,455 

59
 

STATEMENT OF CHANGES IN NET POSITION 

For The Years Ended September 30, 2018 and 2017 (in dollars) 

All Other Funds 

(Consolidated Totals) Consolidated Total 

Unexpended Appropriations: 

Beginning Balance 21,012,019 21,012,019 

Budgetary Financing Sources: 

Appropriations received 71,250,000 71,250,000 

Other adjustments (312,874) (312,874) 

Appropriations used (75,527,196) (75,527,196) 

Total Budgetary Financing Sources (4,590,071) (4,590,071) 

Total Unexpended Appropriations 16,421,949 16,421,949 

Cumulative Results from Operations: 

Beginning Balances 6,851,313 6,851,313 

Beginning balance, as adjusted 6,851,313 6,851,313 

Budgetary Financing Sources: 

Appropriations used 75,527,196 75,527,196 

Other Financing Sources (Non-Exchange): 

Imputed financing 2,401,397 2,401,397 

Total Financing Sources 77,928,593 77,928,593 

Net Cost of Operations 78,532,451 78,532,451 

Net Change (603,858) (603,858) 

Cumulative Results of Operations 6,247,456 6,247,456 

Net Position 22,669,404 22,669,404 

60
 

 

STATEMENT OF CHANGES IN NET POSITION 

For The Years Ended September 30, 2018 and 2017 (in dollars) 

All Other Funds 

(Consolidated Totals) Consolidated Total 

Unexpended Appropriations: 

Beginning Balance 13,198,773 13,198,773 

Budgetary Financing Sources: 

Appropriations received 79,119,000 79,119,000 

Other adjustments (689,422) (689,422) 

Appropriations used (70,616,331) (70,616,331) 

Total Budgetary Financing Sources 7,813,246 7,813,246 

Total Unexpended Appropriations 21,012,019 21,012,019 

Cumulative Results from Operations: 

Beginning Balances 3,452,424 3,452,424 

Beginning balance, as adjusted 3,452,424 3,452,424 

Budgetary Financing Sources: 

Appropriations used 70,616,331 70,616,331 

Other Financing Sources (Non-Exchange): 

Imputed financing 1,916,013 1,916,013 

Total Financing Sources 72,532,344 72,532,344 

Net Cost of Operations 69,133,455 69,133,455 

Net Change 3,398,890 3,398,890 

Cumulative Results of Operations 6,851,313 6,851,313 

Net Position 27,863,333 27,863,333 

61
 

 

 

STATEMENT OF BUDGETARY RESOURCES 

For The Years Ended September 30, 2018 and 2017 (in dollars) 

2018 2017 

Budgetary Budgetary 

BUDGETARY RESOURCES 

Unobligated balance from prior year budget authority, net (discretionary and mandatory) 9,595,647 5,159,524 

Appropriations (discrectionary and mandatory) 71,250,000 79,119,000 

Spending authority from offsetting collections (discretionary and mandatory) 544 2,266 

Total budgetary resources 80,846,191 84,280,790 

STATUS OF BUDGETARY RESOURCES 

New obligations and upward adjustments (total) 77,411,365 74,465,666 

Unobligated balance, end of year: 

Apportioned, unexpired account 1,810,910 8,521,878 

Unexpired unobligated balance, end of year 1,810,910 8,521,878 

Expired unobligated balance, end of year 1,623,916 1,293,245 

Unobligated balance, end of year (total) 3,434,826 9,815,124 

Total budgetary resources 80,846,191 84,280,790 

OUTLAYS, NET 

Outlays, net (discretionary and mandatory) 74,144,210 72,549,169 

Agency outlays, net (discretionary and mandatory) 74,144,210 72,549,169 

62
STATEMENT OF CUSTODIAL ACTIVITY 

For The Years Ended September 30, 2018 and 2017 

Revenue Activity

2018 2017 

 Sources of cash collections

 Civil penalties $ 1,100,416 $ 829,35

 Administrative fines $ 148,770 $ 222,56

 Miscellaneous receipts $ 115,443 $ 341,65

 Total cash collections $ 1,364,629 $ 1,393,57

 Accrual adjustments $ (181,392) $ 516,62

 Total custodial revenue (Note 10) $ 1,183,237 $ 1,910,20

Disposition of Collections

 Transferred to Treasury $ 1,364,629 $ 1,393,57

 Amount yet to be transferred $ (181,392) $ 516,62

 Total disposition of collections $ 1,183,237 $ 1,910,20

 Net custodial activity $ - $ -

5 

6 

7 

8 

8 

6 

8 

8 

6 

63
Notes to the Financial Statements 

Note 1 – Summary of Significant Accounting Policies 

Reporting Entity 

The Federal Election Commission (FEC or Commission) was created in 1975 as an independent 

regulatory agency with exclusive responsibility for administering, enforcing, defending and 

interpreting the Federal Election Campaign Act of 1971 (FECA), 2 U.S.C. 431 et seq., as amended 

(“the Act”). The Commission is also responsible for administering the public funding programs (26 

U.S.C. §§ 9001- 9039) for Presidential campaigns, which include certification and audits of all 

participating candidates and committees, and enforcement of public funding legislation. 

The financial activity presented relates to the execution of the FEC’s Congressionally approved 

budget. Consistent with Federal Accounting Standards Advisory Board’s (FASAB) Statement of 

Federal Financial Accounting Concept No. 2, “Entity and Display,” the Presidential Election 

Campaign Fund is not a reporting entity of the FEC. Financial activity of the fund is budgeted, 

apportioned, recorded, reported and paid by the U.S. Department of Treasury (Treasury). The 

accounts of the Presidential Election Campaign Fund are therefore not included in the FEC’s 

financial statements. 

Basis of Accounting and Presentation 

As required by the Accountability of Tax Dollars Act of 2002, the accompanying financial statements 

present the financial position, net cost of operations, changes in net position, budgetary 

resources and custodial activity of the FEC. While these financial statements have been prepared 

from the books and records of the FEC in accordance with U.S. generally accepted accounting 

principles (GAAP) for the Federal Government and in accordance with the form and content for 

entity financial statements specified by the Office of Management and Budget (OMB) in Circular 

A-136, as revised, Financial Reporting Requirements, as well as the accounting policies of the FEC, 

the statements may differ from other financial reports submitted pursuant to OMB directives for the 

purpose of monitoring and controlling the use of the FEC’s budgetary resources. 

These financial statements reflect both accrual and budgetary accounting transactions. Under the 

accrual method of accounting, revenues are recognized when earned and expenses are 

recognized when a liability is incurred, without regard to receipt or payment of cash. Budgetary 

accounting is designed to recognize the obligation of funds according to legal requirements. 

Budgetary accounting is essential for compliance with legal constraints and controls over the use of 

federal funds. 

Throughout these financial statements, assets, liabilities, revenues and costs have been classified 

according to the type of entity with which the transactions are associated. Intragovernmental assets 

64
and liabilities are those resulting from transactions with other federal entities. Intragovernmental 

earned revenues are collections or accruals of revenue from other federal entities and 

intragovernmental costs are payments or accruals to other federal entities. These statements should 

be read with the understanding that they are for a component of the Federal Government, a sovereign 

entity. 

Assets 

Assets that an entity is authorized to use in its operations are termed entity assets, whereas assets 

that are held by an entity and are not available for the entity’s use are termed non-entity assets. Most 

of the FEC’s assets are entity assets and are available for use in carrying out the mission of the FEC 

as appropriated by Congress. The FEC also has non-entity assets which primarily consist of 

receivables from fines and penalties. These custodial collections are not available to the FEC to 

use in its operations and must be transferred to Treasury. 

Fund Balance with Treasury 

The FEC does not maintain cash in commercial bank accounts. Treasury processes cash receipts and 

disbursements. Fund Balance with Treasury consists of appropriated funds and custodial collections. 

With the exception of the custodial collections, these funds are available to pay current liabilities 

and finance authorized purchase commitments. Custodial collections, which are not available to 

finance FEC activities, are classified as non-entity assets. 

Accounts Receivable 

The FEC’s Accounts Receivable mainly represents amounts due from the public for fines and 

penalties assessed by the FEC and referred to Treasury for collection. The FEC establishes an 

allowance for the estimated loss on accounts receivable from the public that are deemed 

uncollectible accounts. This allowance is included in Accounts Receivable, net on the balance 

sheet. The allowance is a percentage of the overall receivable balance, based on the collection 

rate of past balances. 

General Property and Equipment 

General Property and Equipment (P&E) is reported at acquisition cost, and consists of items that are 

used by the FEC to support its mission. Depreciation or amortization on these assets is calculated 

using the straight-line method with zero salvage value. Depreciation or amortization of an asset 

begins the day it is placed in service. Maintenance, repairs and minor renovations are expensed as 

incurred. Expenditures that materially increase the value, capacity or useful life of existing assets 

are capitalized. Refer to Note 5 General Property and Equipment, Net for additional details. 

65
Liabilities 

Liabilities represent amounts that are likely to be paid by the FEC as the result of transactions or 

events that have already occurred; however, no liabilities are paid by the FEC without an 

appropriation. Intragovernmental liabilities arise from transactions with other federal entities. 

Liabilities classified as not covered by budgetary resources are liabilities for which 

appropriations have not been enacted (e.g., annual leave benefits and actuarial liability under the 

Federal Employees Compensation Act), or those resulting from the agency’s custodial activities. 

The FEC has an intragovernmental liability to Treasury for fines, penalties and miscellaneous 

receipts which are due from the public but have not yet transferred. These funds may not be used to 

fund FEC operations. 

Accounts Payable 

Accounts Payable consists of liabilities to other entities or persons for amounts owed for goods and 

services received that have not yet been paid at the end of the fiscal year. Accounts Payable also 

consists of disbursements in-transit, which are payables that have been recorded by the FEC and are 

pending payment by Treasury. In addition to accounts payables recorded through normal business 

activities, unbilled payables are estimated based on historical data. 

Accrued Payroll and Employer Contribution 

Accrued payroll and benefits represent salaries, wages and benefits earned by employees, but not 

yet disbursed as of the statement date. Accrued payroll and Thrift Savings Plan contributions are 

not classified as intragovernmental. Employer contributions and payroll taxes payable are classified 

as intragovernmental. 

Annual, Sick and Other Leave 

Annual leave is recorded as a liability when it is earned by FEC employees; the liability is reduced 

as leave is taken. On a quarterly basis, the balance in the accrued leave account is adjusted to reflect 

the current leave balances and pay rates. Accrued annual leave is paid from future funding sources 

and is reflected as a liability not covered by budgetary resources. Sick leave and other types of 

non-vested leave are expensed as taken. 

Federal Employee Benefits 

A liability is recorded for estimated and actual future payments to be made for workers’ 

compensation pursuant to the Federal Employees Compensation Act. The liability consists of the 

net present value of estimated future payments calculated by the Department of Labor (DOL) 

and the actual unreimbursed cost paid by DOL for compensation paid to recipients under the Federal 

Employee’s Compensation Act. The future workers' compensation estimate is generated by DOL 

through an application of actuarial procedures developed to estimate the liability for the Federal 

66
Employee’s Compensation Act, which includes the expected liability for death, disability, 

medical and miscellaneous costs for approved compensation cases. The liability is calculated using 

historical benefit payment patterns related to a specific incurred period to estimate the total payments 

related to that period. These projected annual benefits payments are discounted to present value. 

Employee Retirement Plans 

Each fiscal year, the Office of Personnel Management (OPM) estimates the Federal Government 

service cost for all covered employees. This estimate represents an annuity dollar amount which, if 

accumulated and invested each year of an employee’s career, would provide sufficient funding to 

pay for that employee’s future benefits. As the Federal Government’s estimated service cost exceeds 

the amount of contributions made by employer agencies and covered employees, this plan is not 

fully funded by the FEC and its employees. As of September 30, 2018, the FEC recognized 

approximately $ 2,808,853 as an imputed cost and related financing source, for the difference 

between the estimated service cost and the contributions made by the FEC and its employees. This 

represents a 47% increase when compared to the $ 1,916,013 of imputed cost and related financing 

source recognized in Fiscal Year 2017. 

FEC employees participate in either the Civil Service Retirement System (CSRS) or the Federal 

Employees Retirement System (FERS), which became effective on January 1, 1987. For employees 

participating in CSRS, the FEC withheld 7% of base pay earnings and provided a matching 

contribution equal to the sum of the withholding. For employees covered by FERS, the FEC 

withheld .8% of base pay earnings and provided the agency contribution. The majority of FEC 

employees hired after December 31, 1983, are automatically covered by FERS. 

Effective January 1, 2013, the Middle Class Tax Relief and Job Creation Act of 2012 created a new 

FERS retirement category, Revised Annuity Employees (RAE) for new federal employees hired in 

calendar year (CY) 2013 or thereafter. In FY 2018, the FERS-RAE employee contribution rate was 

3.1%. 

Effective January 1, 2014, the Bipartisan Budget Act of 2013 introduced a new FERS retirement 

category, Further Revised Annuity Employees (FRAE) for new federal employees hired in CY 

2014 and thereafter. In FY 2018, the FERS-FRAE employee contribution rate was 4.4%. 

FERS contributions made by employer agencies and covered employees are comparable to the 

Federal Government’s estimated service costs. For FERS covered employees, the FEC made 

contributions of 13.7% of basic pay for FY 2018. For both FERS-RAE and FERS-FRAE 

covered employees, the FEC made contributions of 11.9% of basic pay for FY 2018. 

Employees participating in FERS are covered under the Federal Insurance Contribution Act (FICA), 

for which the FEC contributed 6.2% to the Social Security Administration in FY 2018. Effective in 

FY 2012 FERS and CSRS – Offset employees were granted a 2% decrease in Social Security for 

67
tax year (CY) 2012 under the Temporary Payroll Tax Cut Continuation Act of 2011; and H.R. 3630, 

the Middle Class Tax Relief and Job Creation Act of 2012. During FY 2013, employees contributed 

4.2% to Social Security through December 31, 2012. Effective January 1, 2013 the employee 

contribution rate is 6.2%. 

Thrift Savings Plan 

The Thrift Savings Plan (TSP) is a retirement savings and investment plan for employees 

covered by either CSRS or FERS. The TSP is administered by the Federal Retirement Thrift 

Investment Board on behalf of federal agencies. For employees belonging to FERS, the FEC 

automatically contributes 1% of base pay to their account and matches contributions up to an 

additional 4%. For employees belonging to CSRS, there is no governmental matching contribution. 

The FEC does not report on its financial statements CSRS and FERS assets, accumulated plan 

benefits or unfunded liabilities, if any, which may be applicable to FEC employees. Reporting such 

amounts is the responsibility of the Office of Personnel Management. The portion of the current and 

estimated future outlays for CSRS and FERS not paid by the FEC is in accordance with Statement 

of Federal Financial Accounting Standards (SFFAS) No. 5, Accounting for Liabilities of the Federal 

Government, and is included in the FEC's financial statements as an imputed financing source. 

Commitments and Contingencies 

A contingency is an existing condition, situation or set of circumstances involving uncertainty as to 

possible gain or loss. The uncertainty will ultimately be resolved when one or more future events 

occur or fail to occur. SFFAS No. 5 as amended by SFFAS No. 12, contains the criteria for 

recognition and disclosure of contingent liabilities. A contingency is recognized when a past event 

or exchange transaction has occurred, a future outflow or other sacrifice of resources is probable and 

the future outflow or sacrifice of resources is measurable. A contingency is disclosed where any of 

the conditions for liability recognition are not met and the chance of the future confirming event or 

events occurring is more than remote but less than probable. 

According to OMB Circular A-136, as revised, in addition to the contingent liabilities required 

by SFFAS No. 5, the following commitments should be disclosed: 1) an estimate of obligations 

related to cancelled appropriations for which the reporting entity has a contractual commitment for 

payment; and 2) amounts for contractual arrangements which may require future financial 

obligations. The FEC does not have commitments related to cancelled appropriations or amounts 

for contractual arrangements that would require future financial obligations. 

68
Revenues and Other Financing Sources 

Annual Appropriation 

The FEC received all of its funding through an annual appropriation as provided by Congress. 

Additionally, the FEC received funding through reimbursement for services provided to other 

Federal agencies. Services performed for other Federal agencies under reimbursable agreements are 

financed through the account providing the service and reimbursements are recognized as revenue 

when earned. 

Imputed Financing Sources 

In accordance with OMB Circular A-136, as revised, all expenses should be reported by agencies 

whether or not these expenses would be paid by the agency that incurs the expense. The amounts 

for certain expenses of the FEC, which will be paid by other federal agencies, are recorded in the 

Statement of Net Cost (SNC). A corresponding amount is recognized in the “Statement of Changes 

in Net Position” as an “Imputed Financing Source.” These imputed financing sources primarily 

represent unfunded pension costs of FEC employees, as described above. 

Statement of Net Cost 

Net cost of operations is the total of the FEC’s expenditures. The presentation of the statement is 

based on the FEC’s strategic plan, which presents one program that is based on the FEC’s 

mission and strategic goal. The program that reflects this strategic goal is to administer and enforce 

the Federal Election Campaign Act efficiently and effectively. 

Net Position 

Net position is the residual difference between asset and liabilities and consists of unexpended 

appropriations and cumulative results of operations. Unexpended appropriations include the portion 

of the FEC’s appropriations represented by undelivered orders and unobligated balances. 

Unobligated balances associated with appropriations that expire at the end of the fiscal year remain 

available for obligation adjustments, but not for new obligations, until that account is cancelled, five 

years after the appropriations expire. Cumulative results of operations represent the excess of 

financing sources over expenses since inception. 

Statement of Custodial Activity 

The Statement of Custodial Activity summarizes collections transferred or transferable to Treasury 

for miscellaneous receipts, fines and penalties assessed by the FEC. These amounts are not 

available for FEC operations, and accordingly, are reported as custodial revenue. 

69
Use of Estimates 

The preparation of the accompanying financial statements in accordance with GAAP requires 

management to make certain estimates and assumptions that directly affect the reported amounts 

of assets, liabilities, revenues and expenses. Actual results could differ from these estimates. 

70
 

Note 2 Non-Entity Assets 

Non–entity assets, which primarily represent amounts due to the FEC for fines and penalties on 

those that violated the requirements of the Federal Election Campaign Act, consisted of the 

following as of September 30, 2018 and September 30, 2017: 

2018 2017 

With the Public 

Accounts Receivable - Custodial $ 447,136 $ 628,528 

Total non-entity assets $ 447,136 $ 628,528 

Total entity assets $ 37,510,910 $ 33,513,712 

Total Assets $ 37,958,046 $ 34,142,240 

71
 

 $ 20,287,566 

Note 3 Fund Balance with Treasury 

Fund Balance with Treasury consisted of the following as of September 30, 2018 and September 30, 

2017: 

Fund Balances 

Appropriated Funds 

Total 

2018 

$20,287,566 

$20,287,566

2017 

$23,494,651 

$23,494,651

Status of Fund Balance with Treasury 

Unobligated Balance 

Available

Unavailable

Obligated Balance not yet Disbursed

Total 

 $ 1,810,910 

$ 1,623,916 

$ 16,852,740 

2018 

$ 8,521,878 

$ 1,293,245 

$ 13,679,527 

$ 23,494,651 

2017 

Available unobligated balances represent amounts that are apportioned for obligation in the current 

fiscal year. Unavailable unobligated balances represent amounts that are not apportioned for 

obligation during the current fiscal year and expired appropriations that are no longer available to 

incur new obligations. Obligated balances not yet disbursed include amounts designated for payment 

of goods and services ordered but not received, or goods and services received but for which payment 

has not yet been made. 

72
 

Intragovernmental 

Gross Accounts 

Receivable 

2018 

Allowance Net Accounts 

Receivable 

Intragovernmental

Total Intragovernmental

 $ -

 $ -

$ -

$ -

$ -

$ -

With the Public 

Fines and Penalties $ 619,091 $ 171,955 $ 447,136 

Total Non-Entity $ 619,091 $ 171,955 $ 447,136 

Total $ 619,091 $ 171,955 $ 447,136 

Intragovernmental 

Gross Accounts 

Receivable 

2017 

Allowance Net Accounts 

Receivable 

Intragovernmental

Total Intragovernmental

 $ -

 $ -

$ -

$ -

$ -

$ -

With the Public 

Fines and Penalties $ 786,706 $ 158,179 $ 628,528 

Total Non-Entity $ 786,706 $ 158,179 $ 628,528 

Total $ 786,706 $ 158,179 $ 628,528 

Note 4 - Accounts Receivables, Net 

All accounts receivable are with the public and consisted of the following as of September 30, 

2018 and September 30, 2017: 

Non-Entity receivables consist of civil penalties and administrative fines assessed by the FEC 

through its enforcement processes or conciliation agreements reached with parties. The FEC has 

three offices that administer the penalties: the Office of General Counsel (OGC); the Office of 

Administrative Review (OAR); and the Office of Alternative Dispute Resolution (ADR). Each office 

has a distinct role in the enforcement and collection process. The allowance is based on the historical 

rate of collection and an overall assessment of the debtor’s willingness and ability to pay. Delinquent 

debts are referred to Treasury in accordance with the Debt Collection Improvement Act of 1996. The 

terms of the agreement between the FEC and the parties establish the conditions for collection. The 

“intragovernmental accounts receivable” is primarily attributed to the Deputy Inspector General 

servicing a Federal agency on a reimbursable basis pursuant to the Inspector General Act. 

73
Note 5 General Property and Equipment, Net 

General Property and Equipment (P&E) is reported at acquisition cost. The capitalization threshold 

is established at $25,000 and a useful life of two or more years. For bulk purchases, items are 

capitalized when the individual useful lives are at least two years and have an aggregate 

value of $250,000 or more. Acquisitions of P&E that do not meet the capitalization criteria are 

recorded as operating expenses. 

General P&E consists of items that are used by the FEC to support its mission. Depreciation or 

amortization on these assets is calculated using the straight-line method with no salvage value. 

Depreciation or amortization begins the day the asset is placed in service. Maintenance, repairs and 

minor renovations are expensed as incurred. Expenditures that materially increase values, change 

capacities or extend useful lives are capitalized. 

Effective FY 2009, the estimated useful life of assets such as office furniture, office equipment, 

telecommunications equipment and audio/visual equipment is five years and the estimated useful life 

of information technology equipment is three years. 

The office building in which the FEC operates is leased through the General Services Administration 

(GSA) under an occupancy agreement, which manages the lease agreement between the Federal 

Government and the commercial leasing entity. The FEC is billed by GSA for the leased space based 

upon estimated lease payments made by GSA plus an administrative fee. The cost of the office 

building is not capitalized. The costs of any leasehold improvements, which are managed through 

GSA, are financed with FEC appropriated funds. Construction costs of $25,000 or more are 

accumulated as construction in progress until completion and then are transferred and capitalized as 

a leasehold improvement. Leasehold improvements are amortized over the lesser of five years or the 

remaining life of the lease term. 

The internal use software development and acquisition costs capitalization threshold changed as a 

result of a new policy that was implemented in FY 2011. Internal use software development and 

acquisition costs of $250,000 are capitalized as software in development until the development stage 

is completed and the software is tested and accepted. At acceptance, costs of software in development 

are reclassified as internal use software costs and amortized using the straight-line method over an 

estimated useful life of three years. Purchased commercial software that does not meet the 

capitalization criteria is expensed. In addition, enhancements which do not add significant new 

capability or functionality are also expensed. 

The general components of capitalized property and equipment, net of accumulated depreciation or 

amortization, consisted of the following as of September 30, 2018 and September 30, 2017, 

respectively: 

74
 

 

 

 

2018 

Asset Class Service Life 

(years) 

Acquisition 

Value 

Accumulated 

Depreciation/Am 

ortization 

Net Book Value 

Software 3 $18,703,643.48 $ 11,297,633.10 $ 7,406,010.38 

Computers and peripherals 3 $ 3,067,115.95 $ 3,063,507.77 $ 3,608.18 

Furniture 5 $ 852,753.70 $ 852,753.70 $ -

Leasehold Improvements 5 $ 8,577,985.98 $ 744,712.01 $ 7,833,273.97 

Software-in-Development n/a $ 1,980,450.97 $ - $ 1,980,450.97 

Total $33,181,950.08 $ 15,958,606.58 $17,223,343.50 

2017 

Asset Class Service Life 

(years) 

Acquisition 

Value 

Accumulated 

Depreciation/Am 

ortization 

Net Book Value 

Software 3 $ 9,903,521.06 $ 9,586,978.32 $ 316,542.74 

Computers and peripherals 3 $ 3,067,115.95 $ 2,962,201.29 $ 104,914.66 

Furniture 5 $ 852,753.70 $ 852,753.70 $ -

Leasehold Improvements 5 $ 925,095.51 $ - $ 925,095.51 

Software-in-Development n/a $ 8,672,508.02 $ - $ 8,672,508.02 

Total $23,420,994.24 $ 13,401,933.31 $10,019,060.93 

75
2018 2017 

Intragovernmental:

 Custodial Fines and Civil Penalties $ 447,136 $ 628,528 

 Deferred Rent 8,446,642 -

 Unfunded FECA Liability 6,052 5,810 

Total Intragovernmental 8,899,830 634,338 

With The Public:

 Unfunded Annual Leave 2,515,072 3,154,512 

 Actuarial FECA Liability 8,122 7,426 

Total Liabilities Not Covered by Budgetary Resources $ 11,423,024 $ 3,796,276 

Total Liabilities Covered by Budgetary Resources $ 3,865,618 $ 2,482,632 

Total Liabilities Not Requiring Budgetary Resources $ - $ -

Total Liabilities $ 15,288,642 $ 6,278,907 

 

Note 6 Liabilities Not Covered by Budgetary Resources 

Liabilities Not Covered by Budgetary Resources consisted of the following as of September 30, 2018 

and September 30, 2017: 

76
Note 7 Commitments and Contingencies 

As of September 30, 2018, in the opinion of FEC management and legal counsel, the FEC was not a 

party to any legal action which were likely to result in a material liability. Accordingly, no provision 

for loss was included in the financial statements. 

 

77
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Note 8 Leases 

The FEC did not have any capital leases as of September 30, 2018 and September 30, 2017. The 

FEC has a non-cancellable operating lease for its office space through November 30, 2032. 

Future payments under the operating lease are as follows: 

Future Operating Lease Payments 

2018 

Fiscal Year Lease Payment 

2019 100,769 

2020 4,303,737 

2021 5,223,565 

2022 5,277,789 

2023 5,333,639 

2024 5,391,165 

2025 5,450,416 

2026 5,511,445 

2027 5,574,305 

2028 5,772,369 

2029 5,865,720 

2030 5,934,409 

2031 6,005,158 

2032 6,078,030 

2033 944,644 

Total 71,822,517 

As per the terms of the Lease agreement, the FEC was granted a total of $8,943,504, or 22 months, 

in free rent from the lessor. Per the FEC’s policy, the total free rent will be amortized as Deferred 

Rent over the life of the lease. 

The table above represents the actual cash outlays for rent payments as contained in the FEC’s 

Occupancy Agreement with GSA, and does not include the amortized Deferred Rent referenced 

above. 

 

78
 

2018 2017 

Intragovernmental: 

Intragovernmental gross costs $ 27,336,005 $ 19,339,655 

Less: Intragovernmental earned revenue $ (544) $ 

$ 

(2,266) 

Intragovernmental net costs $ 27,335,461 19,337,389 

Public: 

Gross costs with the public $ 51,196,990 $ 49,796,066 

Net costs with the public $ 51,196,990 $ 49,796,066 

Net cost of operations $ 78,532,451 $ 69,133,455 

Note 9 Statement of Net Cost 

The FEC’s costs are consolidated into one program, “Administering and Enforcing the FECA,” and 

consisted of the following as of September 30, 2018 and September 30, 2017, respectively: 

Costs incurred for goods and services provided by other Federal entities are reported in the full costs 

of the FEC’s program and are identified as “intragovernmental.” The “intragovernmental earned 

revenue” is primarily attributed to the Deputy Inspector General servicing a Federal agency on a 

reimbursable basis pursuant to the Inspector General Act. All other costs are identified as “with the 

public.” 

79
Distributed 

Offsetting 

Receipts 

Budgetary 

Resources 

Obligations 

FY 2017 Incurred Net Outlays 

Statement of Budgetary Resources $84,280,789.80 $74,463,399.81 - $72,562,090.15 

Budget of the U.S. Government 83,000,000 74,000,000 - 73,000,000 

Difference $ 1,280,789.80 $ 463,399.81 $ - $ (437,909.85) 

Note 10 Explanation of Differences between the Statement of Budgetary Resources and the 

Budget of the U.S. Government 

The Statement of Budgetary Resources (SBR) compares budgetary resources with the status of those 

resources. For the year ended September 30, 2018, budgetary resources were $80,846,191.12 and 

net outlays were $74,148,210.07. For the year ended September 30, 2017, budgetary resources were 

$84,280,789.80 and net outlays were $72,562,090.15. 

Apportionment Categories of Obligations Incurred 

The FEC receives apportionments of its resources from OMB. Apportionments are for resources 

that can be obligated without restriction, other than to be in compliance with legislation for which 

the resources were made available. 

For the years ended September 30, 2018 and September 30, 2017, direct obligations incurred 

amounted to $77,410,821.11 and $74,463,399.81, respectively. For the years ended September 30, 

2018 and September 30, 2017, reimbursable obligations incurred amounted to $544.13 and 

$2,266.22, respectively. 

Comparison to the Budget of the United States Government 

SFFAS No. 7, Accounting for Revenue and Other Financing Sources and Concepts for Reconciling 

Budgetary and Financial Accounting, requires an explanation of material differences between 

budgetary resources available, the status of those resources and outlays as presented in the Statement 

of Budgetary Resources to the related actual balances published in the Budget of the United States 

Government (Budget). The Budget that will include FY 2018 actual budgetary execution information 

is scheduled for publication in February 2019, which will be available through OMB’s website at 

http://www.whitehouse.gov/omb. Accordingly, information required for such disclosure is not 

available at the time of publication of these financial statements. 

Balances reported in the FY 2017 SBR and the related President’s Budget reflected the following: 

The difference between the Statement of Budgetary Resources and the Budget of the United States 

Government for budgetary resources is primarily due to expired unobligated balances. The 

differences for obligations incurred and net outlays are due to rounding. 

80
Custodial Revenue 2018 2017 

Fines, Penalties, and Other Miscellaneous Revenue $ 1,183,237 $ 1,910,206 

Custodial Liability 

Receivable for Fines and Penalties $ 619,091 $ 786,706 

Less: Allowance for Doubtful Accounts $ (171,955) $ (158,179) 

Total Custodial Liability $ 447,136 $ 628,528 

 

Note 11 Custodial Revenues and Liabilities 

The FEC uses the accrual basis of accounting for the collections of fines, penalties and miscellaneous 

receipts. The FEC’s ability to collect fines and penalties is based on the responsible parties’ 

willingness and ability to pay: 

The Custodial Liability account represents the amount of custodial revenue pending transfer to 

Treasury. Accrual adjustments reflected on the Statement of Custodial Activity represent the 

difference between the FEC's opening and closing accounts receivable balances. Accounts receivable 

are the funds owed to the FEC (as a custodian) and ultimately to Treasury. The accrual adjustment 

for civil penalties is composed of a net decrease of approximately $186,000 for FY 2018 and a net 

increase of approximately $451,000 for FY 2017, respectively. The accrual adjustment for 

administrative fines is composed of a net decrease of approximately $58,000 in FY 2018 and a net 

increase of approximately $74,000 in FY 2017, respectively. 

81
Note 12 Undelivered Orders at the End of the Period 

For Fiscal Year 2018, Unpaid Undelivered orders were $12,059,857, of which $1,763,481 we

Federal and $ 10,296,376 were non Federal. As of September 30, 2018 there were no Fiscal Ye

2018 Paid Delivered Orders. 

For Fiscal Year 2017 Undelivered Orders totaled $11,196,896. 

re 

ar 

82
Note 13 - Reconciliation of Net Cost of Operations to Budget 

The objective of this information is to provide an explanation of the differences between budgetary 

and financial (proprietary) accounting. This is accomplished by means of a reconciliation of 

budgetary obligations and non-budgetary resources available to the reporting entity with its net cost 

of operations. 

2018 2017 

Resources used to finance activities 

Budgetary resources obligated

 Obligations incurred $ 77,411,365 $ 74,465,666 

 Less: Recoveries and offsetting collections $ (93,942) $ (13,201) 

Net obligations $ 77,317,423 $ 74,452,465 

Other resources

 Imputed financing from costs absorbed by others $ 2,401,397 $ 1,916,013 

Total resources used to finance activities $ 79,718,820 $ 76,368,478 

Resources used to finance items not part of the net cost of operations 

Change in budgetary resources obligated for goods, services, and benefits ordered but not 

yet provided $ 1,790,227 $ 3,836,134 

Resources that fund expenses recognized in prior periods $ - $ 87,060 

Resources that finance the acquisition of assets that do not affect net cost of operations 9,760,956 5,377,478 

Total resources used to finance items not part of the net cost of operations

 $ $ 

 $ 11,551,183 $ 9,300,671 

Total resources used to finance the net cost of operations $ 68,167,637 $ 67,067,807 

Components of the net cost of operations that will not require or generate resources in the 

current period 

Components requiring or generating resources in future periods

 Increase in annual leave liability $ (639,440) $ 654,505 

 Other

Total

 $ 8,447,581 $ 13,236 

 $ 7,808,140 $ 667,741 

Components not requiring or generating resources

 Depreciation and amortization $ 2,556,673 $ 1,397,907 

Total $ 2,556,673 $ 1,397,907 

Total components of the net cost of operations that will not require or generate resources 

in the current period $ 10,364,813 $ 2,065,648 

Net cost of operations $ 78,532,451 $ 69,133,455 

83
SECTION III – Other Information 

84
Inspector General’s Statement on FEC Management and Performance 

Challenges 

85

MEMORANDUM

TO: The Commission 

FROM: J. Cameron Thurber - - Deputy Inspector General -'7 

SUBJECT: Inspector General Statement on the Federal Election Commission 's

Management and Performance Challenges 

DATE: October 24, 2018 

FEDERAL ELECTION COMMISSION 

WASHINGTON, D.C. 20463 

Office of Inspector General 

Each year. the Inspector General (IG) is required to provide a summary and assessment 

of the most serious management and performance challenges facing the Federal Election 

Commission (FEC). The requirement is contained in the Reports Consolidation Act of 

2000 (Public Law l 06-531 ), an amendment to the Chief Financial Officers Act of I 990. 

The attached document responds to the requirement and provides the annual statement on 

Commission challenges to be included in the Federal Election Commission Agency 

Financial Report (AFR) Fiscal Year (FY) 2018. 

For FY 2018, the Office of [nspector General (010) still believes, as reported in FY 

2017, that the overarching management and performance challenge at the FEC is the 

agency's Governance and Management Framework. This overall agency challenge 

creates critical management and performance issues within the agency's environment 

programs, and negatively impacts the effectiveness and efficiency of achieving the 

agency's mission. The OIG believes that the ability to effectively achieve the mission of 

the agency is reliant on the need for Govenumce and the Senior Leadership to address the 

deficiencies within the governance framework, which sets the tone and structure of the 

organization. 

The OIG's annual assessment of management and performance challenges is based on 

information derived from a combination of several sources. including OIG audit and 

inspection work, Commission reports, management meetings, government-wide risk 

factors, and a general knowledge of the Commission's programs and activities. The 

management and _performance challenges are detailed in the attached report. The Reports 

Consolidation Act of 2000 permits agency comment on the IG's statements. Agency 

comments, if any, are due November l 5, 201 8.

Attachment 

cc: AJec Palmer, Staff Director and Chief Information Officer/Staff Director

Gilbert Ford, Acting Chief Financial Officer · -- -- - -

Lisa Stevenson, Acting General Counsel 
86

InspectorGeneral Statement on the Federal Election Commission''i 

Management and Performance Challenges for Fiscal Year 2018 

Overall Challenge: Governance and Management Framework 

The FEC'so erall governance framework needs improvement to contribute to the 

success of the agency. The Lack of accountability from Governance regarding critical 

management issues and the inadequate leadership structure of management has a negative 

impact on the agency achieving its mission efficiently and effectively. Tltis challenge 

creates several critical management and performance challenges within the agency, 

Challenge 1: Governance Accountability 

A. Low Employee Morale 

Due to the consistent Low ranking of the FEC in the results of the annual Federal 

Employee Viewpoint Survey (FEVS), the OIG contracted with a consultant company to 

conduct a study to determine the root causes of the Low employee morale at the agency. 

The study revealed that the following factors are the root causes of low employee morale: 

• Commissioners; 

• Accountability; 

• Management; 

• Communication; and 

• Other (diversity, caree development) 

The FY 2017 FEVS results places the EC at 27 of 28 best places. to work amongst small 

agencies. Additional survey data jdentified that less than half of the agency staff 

participated in the survey. The oontiriued low agency ranking and minimal participation 

of FEC staff in the survey demonstrates the impact of the low employee morale at the 

FEC. 

Since the emp1oyee morale study has been released, we acknowledge management's 

improvements in the area of communication regarding critical agency-wide projects, 

specifically; the recent relocation of the agency's headquarters. However, as low 

employee morale has a direct effect on accomplishing the agency's mission, we believe 

that an action p.lan from top level management to address all the root causes of low 

employee morale is still critical. The most important part of a solid control environment 

is the "Tone at the Top," which permeates down to create the philosophy and operational 

style that sets the cuJture of the agency. The OIG beJieves that without a continued, 

sincere effort by Governance to address morale issues, the objectives of the agency's 

offices and divisions will coutinu.e to be negatively impacted, increasing the risk of the 

agency not efficiently and effectively meeting its mission. 

B. Enforcing Required Management Roles and Responsibilities 

It is imperative to the success of the agency that Governance holds management 

accountable for adequately fulfilling their roles and responsibilities in addressing 

1 The term "Tone at the Top" is used to define the commitment of top level management to honesty, 

integrity, openness, and ethical behavior in achieving an organization's mission and objectives. 

2 
87

Inspector General Statement on the Federal Election Commission's 

Management and Performance Challenges for Fiscal Year 2018 

identified risks of fraud, waste, abuse, and program deficiencies, The OIG and external 

entities have reported risks and deficiencies in agency programs that management has not 

addressed or have made a low priority for several years. According to the Office of 

Management and Budget Circular A-123 (0MB A-123), Management's Responsibility 

for Internal Control, deficiencies reported " ... through internal review or by external 

audit, should be evaluated and corrected." Further, FEC Commission Directive 50 states, 

"All management officials are responsible for receiving and analyzing audit reports, 

providing timely responses, and take corrective action, if needed." However, the agency 

has 612 outstanding recommendations that have been reported by the OIG, in which many 

have, been reported since FY 2004. 

Management's prior year response to this challenge st-at.-ed lhey are following FEC 

Commission Directive 50, reporting semiannual progress of outstanding 

recommendations to the Commission. However, the updates provided show little to no 

progress; and in many cases the corrective action due dates are continuously extended 

with no management oorrective action taken. In addition, the recently developed FEC 

Senior Management Council (SMC) to address 0 MB Circular A-123 requirements for 

oversight of internal controls and enterprise risk management, developed their initial risk 

profile and identified many control issues related to long outstanding recommendations 

such as Privacy and Data Protection and Disaster Recovery Plan and Continuity of 

Operations Plans as only a "medium" risk to the agency. However, the OIG has issued 

reports on these specific areas that contain critical weaknesses that expose a hlgh risk to 

the agency, and these reports have recommendations that have been outstanding for five 

years or more. 

Collectively, these long outstanding issues that have been reported to management 

address risks to the agency's mission assets, government funding. and compliance with 

laws and regulations. The remediation of these issues is essential to reduc.ing the high 

likelihood of the dsk exposure to the agency, warranting Cornmission attention and for 

rn.anagement to institute corrective action. 

Challenge 2: Longstanding Vacancies in Senior Leadership Positions 

The FEC lacks continued stability in key senior leadership positions that are accountable 

for the mission and objectives of the agency, The FEC's SMC initial risk profile for the 

agency rated multiple agency vacancies as a "very high" risk for the agency, and the OIG 

agrees with this management risk assessment. 

Operating the agency with several vacant permanent senior leader positions, some staffed 

with personnel in acting roles, creates an nnstable environment that runs the risk of 

noncompliance with applicable federal laws and regulations. This ultimately puts the 

agency at risk of not efficiently and effectively meeting the agency's. mission. The 

following critical FEC senior leadership positions are currently vacant or filled only by 

staff jn an acting capacity: 

2 The iotal recommendation count includes the 11 repeat recommendations from the FEC's FY 2017 

Financial Statement Audit and the 50 recommendations included in the OIG's Review of Outstanding 

Rec:om.mendaiions as of August 2018. 

3 
88

Inspector General Statement on the Federal Election Commission's 

Management and Performance Challenges for Fiscal Year 2018 

• Chief Financial Officer - vacant since October 2012 

• General Counsel- vacant since July 2013 

• Deputy Staff Director - vacant since August 2014 

• Inspector General - vacant since March 2017 

Failure to ft.I.I these senior leadership positions in a timely manner with permanent fuJltime employees also creates resource gaps. When senior leader positions are vacant or 

filled with those in acting positions on a long-term basis, voids are often created in 

management positions that are responsible for the adequate oversight of daily operations. 

Thus, the following management level positions are currently vacant with only some 

having :u.1 acting personnel assigned: 

• Chief Information Security Officer 

• Director of Human Resources 

• Accounting Director 

• Budget Director 

• Deputy General Counsel for Law 

• Deputy Chief Information Officer of Ope.rations 

As many of these positions require specialized knowledge and skills to ensure offic.. e

operations are effectively and efficiently supporting the overall mission of the agency, 

assigning acting personnel to many of these vacant positions on a long tenn basis is not 

an efficient solution. It is imperative that the Personnel Committee elevate the importance 

of filling these vacant senior leader and management positions as a priority to ensure 

consistency and clear direction in the leadership of the agency. 

Challenge 3: Organizational Structure 

Per O:MB Circular A-123, management is responsible for complying with the Control 

Environment standard. Specifically, "Within the organizational structure management 

must clearly: define areas of authority and responsibility, appropriately delegate the 

authority and responsibility throughout the agency; establish a suitable heirarchy for 

reporting." Based on deficiencies noted wrthin the agency's programs and business 

processes via OIG reports and reviews by external entities management is not in 

compliance with the required Control Environment standard. 

A. Information Security Program 

Sinoe 2004 the OIG has reported the need for the FEC to make improvements to its 

information security controls, Through audits and assessments, oonduct.ed by the OIO and 

external entities, remediating weaknesses within the agency's information security 

program has been identified as a low priority. As examples, currently the FEC's annual 

financial statement audit includes several long outstanding audit findings related to the 

security of FEC information, some initially reported in FY 2004. In addition, an OIG 

report, Inspection of the FEC 's Disaster Recovery Plan and Continuity of Operations 

Plan, released in January 2013 still has outstanding. audit recommendations that identify 

areas of high risk to agency information and have yet to be addessed by management. 

4 
89

Inspector General tatement on the Federal Election Commission's 

Management and Performance Challenges for Fiscal Year 2018 

This issue has also been identified by external entities who have worked with FEC 

management to conduct evaluations and assessments of the agency's security measures. 

For instance, in June 2017, the agency was provided an analysis from Cyber.gov Systems 

Analysis Team who stated that there is a " lack of prioritization of cyber security" within 

the FEC, and recommended that 1he agency "prioritize cyber security alongside IT 

operations in strategic and operational planning." Following in luly 20 17, the Department 

of Homeland Security (DHS) provided a report to the FEC stating that cyber security at 

the agency "competes with and is often secondary to IT operations." 

In addition to the need for prioritization, the agency' s Information Security Office 

requires restructuring to ensure the agency meets its mission requirements efficiently and 

effectively over the next several year.s, with a high level of accountability, per the 

requirements of the agency Refonn Plan outlined in 0MB Memoranda M-17-22. As 

noted above jn Challenge 2, one of the critical management positions that is currently 

vacant is the FEC Chief Information Security Officer (ClSO}. As the position has o:nly 

been vacant for a short amount of time, due to the increasing security requirements and 

the agency's current need for improvementsto its information security program, it is 

critical that the agency not only fill this position with a qualified security professional, 

but also elevate this position to prrovide proper management authority. Through the 

OIG's management exit conference meetings held with the two prior FEC CISOs, it was 

noted that both persons separated :from the agency due to the need of the position to be 

ele vated to achieve proper authority and effective operations. In addition., both prior 

CISOs also noted a need for additional support staff within the Information Security 

Office (o ensure progressive maturity of the agency's information security program. 

Not only do the long outstanding information security control weaknesses reported by the 

OIG support the need for this restructuring, but the external assessments noted above also 

support the concerns of the prior CISOs. The Cyber.gov analysis specifically notes that 

the "CISO position at management level reduces effectiveness" and recommends that the 

FEC "elevate seniority level of [the] CISO". The analysis also recommends that the FEC 

"develop a cybersecurity team" as the office is currently staffed with only one full-time 

employee with the CISO vacancy. This point is further stressed in the subsequent repo11 

from DHS which states the need for FEC to ''increase FEC cybersecurity staffing." 

Further, the FEC is also in need of an applicable government-wide framework to support 

the agency's information security program. As the FEC's Office of General Counsel has 

determined that the agency is legally exempt from the, Federal information Systems 

Management Act, an applicable framework for information security has not been formally

adopted or adequately implemented. The OIG has recommended that the FEC formally 

adopt the applicable standards of the National Institute of Standards and Technology 

(NlST) as its framework since FY 2009, but the agency has not sufficiently implemented 

this recommendation 111e June 2017 DHS report states, "FEC elects to integratedthe N(ST 

SP 800-37rl into their security architecture but does not lmpJem.ent or follow the guidelines 

ofNIST 800-53ARL..."

3 ClSO position is currently staffed at a GS )4, which is lower than those who the CJSO must provide 

instruction and direction to, such as Deputy Chief Information Officers, to ensure proper security measures 

ore carried out. 

5 
90

Inspector General tatement on the Federal Election Commission's 

Management and Performance Challenges for Fiscal Year 2018

We do note that the agency has made significant improvements by updating many 

policies and procedures to address identified control weaknesses, reducing the number of

outstanding vulnerabilities, and most notably, assessing and authorizing the operations of

major agency systems. In order to continue addressing outstanding security control 

issues, ensure the agency is compliant with applicable security requirements develop a 

plan to fully implement an acceptable government-wide security framework, and 

ultimately work to deveJop a sufficiently mature FBC securily program; the information 

security program and office at the FEC must be revamped to address these major 

challenges. 

B. Proper Leadership Structure 

Currently, the senior leadership role-s of the Staff Director and Chief Information Officer 

(CIO) are filled by the same individual As both senior leader positions are critical to the 

agency, we strongly believe these two positions should have separate full time personnel 

solely dedicated to each position The current sstructure does not with OMB's control 

environment standard to "appropriately delegate the authority and responsibility 

throughout the agency," and "establish a suitable heirarchy for reporting." Specifically, 

FEC employees and supervisors have expressed concerns of inhibition with reporting 

significant personnel concerns or technology issues as the oversight of thes.e issues are 

reported to the same individual. Further, this dual position presents at minimum an 

appearance of bias, as there is only one person with oversight over more than half of the 

agency's programs and a large portion of the agency opernting budget 

The Office of the Chief Information Officer's (OCIO) processe-s and controls are also 

impacted by not having a fully devoted CIO. There are several reported control 

weaknesses within the FEC Is information security program that have been reported in 

more than one OJG report, with oome recommendations being outstanding as long as 14 

years In response to this challenge in the prior year's report, management provided 

examples of processes and policies that have been implemented to address hese OIO 

reported control weaknesses. However, these management actions have been reviewed by 

the OIG and external auditors each year and found to be insufficient to fully address the 

reported issues, and they continue to be reported in the annual financial stuern.ent audit 

and the OIG's annual Review of Out.~tanding Recommendations report. Without a fully 

dedicated CIO to focus on these issues to ensure resources are properly allocated,. and 

adequate processes are jn place fur the protection and safety of the agency, the agency 

will remain at high risk for fraud. waste, and abuse. 

C. Senior Agency Officials for Privacy 

Per OMB Memorandum 16-24, Role and Designation of Senior Agency Officials for 

Privacy, the designated SAOP [Senior Agency Official for Privacy] should serve in a 

"central leadership position at the agency;'' and have "agency-wide responsibility and 

accountability for the agency's privacy program." The agency's Privacy Program is 

currently a shared role between the Office of General Counsel (OGC) and the OCIO, 

with the designated SAOiP being a shared role .assigned to the Deputy CIO of Operations 

and the Deputy General Counsel. This current agency structure has not shown to be 

6 
91

Inspector General Statement on the Federal Election Commission's 

Management and Performance Challenges for Fiscal Year 2018 

effective or efficient, supporting the OJG's recommendation to have one person solely 

dedicated and knowledgeable of privacy issues to oversee the agency's Pri acy Program. 

As of August 2018, the Deputy CIO of Operations retired from the agency, and this 

portion of the SAOP role has been assigned to an OOC attorney, serving as the Acting 

Deputy Staff Director. Management noted in their prior year response to this challenge, 

that "the official in each of those positions has significant oversight over a discrete 

portion of the agency's Privacy Program;" however, the current structure of having two 

attorneys with oversight of the agency's Privacy Program does not ensure coverage ofthe 

privacy regulations over information security which has been heavily enhanced through 

the recent revisions ofOMB CIrcular A-123, and the applicable privacy requirements 

included in guidance such as 0MB Memoranda M-17-2 Preparing for and Responding to 

a Breach of Personally Identifiable Information and M-18-02. Guidance on Federal 

Information Security and Privacy Management Requirements The Jack of proper 

oversight for the information technology and security portions of the Privacy Program 

places the agency at greater r isk of being susceptible to privacy breach issues. 

An example of the inefficiencies to the Privacy Program is demonstrated in the lack of 

progress made in implementing the recommendations i11 the 2010 Follow-up Audit of 

Privacy and Data that was teleased in March of2011. Management included in their 

prior year response to this management challenge a table noting several recommendations 

that have been completed by management, resulting in only nine remaining open 

recommendations, and stated that "the OIG sought to re-open multiple 

recommendations .. management has not been able to discern the rationale for such reopen:ings nor convince OIG that these recommendations had been oompieted. ~ 

The OIG notes that this narrative from management is inaccurate Currently, there are 23 

outstanding recommendations related to p rivacy issues, including issues that haven 't been 

resolved since 2009.

4 In addition, the OJG contacts management twice a year for status 

updates regarding open recommendations. Specifically for the past eight follow-up 

reviews (2015 - present) ^5 theOIG has requested adequate documentation from 

management to support any corrective actions taken, and has provided feedback to 

management regarding our review and any deficiencies noted. that impacted the closure of 

an open recommendation. Also during the noted review pedod above, management 

specifically stated o.n several occasions that they had made no corrective actions. These 

review details are captured and publicly posted in each of the OIG's Review of 

Outstanding Recommendations reports. Further. as noted in our February and August 

2017 review reports, the OIG agreed to schedule a separate meeting to discuss each open 

recommendation however, on the meeting day, management provided no feedback or 

documentation to support stated corrective actions.. During subsequent follow-ups 

management did not provide feedbac or respond to :meeting requests. 

' An inventory of FEC systems containing Personally Identifiable Information (PII) was conducted by 

Solution Technology Systems Inc. who provided recommendations to enhance tile protection of PII. The 

report was dated May 20, 2009, and 1110 further action has been taken by management. 

5 Review details are documented in the OIG's Review of Outstanding Recommendations reports posted oo 

the OIG's external website. 

7 
92

Inspector General Statement on the Federal Election Commission's 

Management and Performance Challenges for Fiscal Year 2018 

OGC recently hired an attorney with responsibilities specifically focused on 

administering the FEC's Privacy Act Program. The OIG has worked with the new 

privacy attorney regarding the outstanding privacy issues and was abJe to recei· ve an 

updated management Corrective Action Plan report containing revised due dates, some 

updated correctiv e action plans, and closed two of the open recommendations Although 

adding additional resources in support of the Privacy Program is a great asset to th.e 

agency, it should be noted that the new privacy attotney does not have expertise in 

privacy issues related to information technology As the current FEC SAOP structure 

requires two management positions covering Privacy Law and IT security, the FEC's 

Chief Information Security Officer position is currently vacant, 6 and the assigned acting 

SAOP for IT coverage also does not have IT security expertise to advise the privacy 

attorney in this specific area. 

6 The Chief Information Securily Officer was placed on the Privncy Program team in support of the SAOP 

JT role. 

8 
 

Improper Payments Information Act Reporting Details 

The Improper Payments Information Act of 2002, as amended by the Improper Payments 

Elimination and Recovery Act of 2010, and Improper Payments Elimination and Recovery 

Improvement Act of 2012 requires agencies to review all programs and activities they administer 

and identify those which may be susceptible to significant erroneous payments. In FY 2018, the 

FEC performed a systematic review of its program and related activities to identify processes 

which may be susceptible to significant erroneous payments. Significant erroneous payments are 

defined as annual erroneous payments in the program exceeding both $10 million and 1.5 percent 

or $100 million of total annual program payments. The risk assessment included the consideration 

of risk factors that are likely to contribute to significant improper payments. The risk assessment 

was performed for the FEC’s only program area which is to administer and enforce the Federal 

Election Campaign Act. 

Risk Assessment 

In FY 2018, the FEC considered risk factors as outlined in OMB Memorandum M-18-20, 

Transmittal of Appendix C to OMB Circular A-123, Requirements for Payment Integrity 

Improvement which may significantly increase the risk of improper payments and determined that 

none are applicable to FEC’s operations. Based on the systematic review performed, the FEC 

concluded that none of its program activities are susceptible to significant improper payments at or 

above the threshold levels set by OMB. 

Recapture of Improper Payments Reporting 

The FEC has determined that the risk of improper payments is low; therefore, implementing a 

payment recapture audit program is not applicable to the agency. 

IPIA (as amended by IPERA) Reporting Details Agency Response 

Risk Assessment Reviewed as noted above. 

Statistical Sampling Not Applicable.* 

Corrective Actions Not Applicable.* 

Improper Payment Reporting Not Applicable.* 

Recapture of Improper Payments Reporting Not Applicable.* 

Accountability Not Applicable.* 

Agency information systems and other infrastructure Not Applicable.* 

Barriers Not Applicable.* 

*The FEC does not have programs or activities that are susceptible to significant 

improper payments. 

93
 

Civil Monetary Penalties Adjustment for Inflation 

The following is the FEC’s table of Civil Monetary Penalties Adjustment for Inflation for FY 2018. 

US Code

Statutory Authority;

Public Law

Year of

Enactment/Adjus

tment Other

Than Pursuant to

IAA

Name/Description of

Penalty Latest Annual Inflation of Adjustment

Section in Title

11 of CFR for

Penalty Update

Detail Current Penalty or Penalty Formula

Federal Election

Campaign Act

Amendments of

Violations of FECA or

chapters 95 or 96 of title

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

52 U.S.C.

30109(a)(5)(A), (6)

1976, PL 94-283 sec.

109 1976

26 of U S Code http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.24(a)(1) 19,446

52 U.S.C.

30109(a)(5)(B)

Federal Election

Campaign Act

Amendments of

1976, PL 94-283 sec.

109 1976

Knowing and willful

violations of FECA or

chapters 95 or 96 of title

26 of U S Code

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.24(a)(2)(i) 41,484

Bipartisan Campaign

Reform Act of 2002,

Knowing and willful

contributions in the name

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

52 U.S.C.

30109(a)(5)(B)

PL 107-155 sec.

312(a) 2002

of another http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.24(a)(2)(ii) 68,027

Federal Election

Campaign Act

Amendments of

Making public an

investigation without

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

52 U.S.C.

30109(a)(12)

1976, PL 94-283 sec.

109 1980

consent http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.24(b) 5,817

Knowingly and willfully

making public an

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

52 U.S.C.

30109(a)(12) 94-283 sec. 109 1980

investigation without

consent

http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.24(b) 14,543

52 U.S.C.

30109(a)(4)(C)

Treasury and General

Government

Appropriations Act,

2000, PL 106-58 sec.

640 2003

Late and Non- Filed

Reports

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

http://sers.fec.gov/fosers/showpdf.

htm?docid=355019 111.43(a)

Penalty formula that accounts for (a)

level of activity in late or non-filed

report; and (b) if report was filed late, (i)

the number of days late and (ii) the

number of previous violations; or (c) if

the report was not filed, the number of

previous violations) 

52 U.S.C.

30109(a)(4)(C)

Treasury and General

Government

Appropriations Act,

2000, PL 106-58 sec.

640 2003

Election Sensitive Late and

Non-Filed Reports

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.43(b)

Penalty formula that accounts for (a)

level of activity in late or non-filed

report; and (b) if report was filed late, (i)

the number of days late and number of

previous violations; or (c) if the report

was not filed, the number of previous

violations) 

Treasury and General

Government

Appropriations Act,

Late or Non-Filed Reports

where Commission cannot

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

52 U.S.C.

30109(a)(4)(C)

2000, PL 106-58 sec.

640 2000

calculate amount of

activity

http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.43(c) 7,797

Treasury and General

Government

Appropriations Act,

Civil Monetary

Penalties Annual Inflation Adjustments, 82

Fed. Reg. 8986 (Feb. 2, 2017)

Penalty formula is 142+ (.10 x amount

of contribution(s) not timely reported),

52 U.S.C.

30109(a)(4)(C)

2000, PL 106-58 sec.

640 2000

Late or Non-Filed 48 hour

notices

http://sers.fec.gov/fosers/showpdf.htm?docid=35

5019 111.44

subject to a 25% increase for each prior

violation

94
 

Reporting on Internal Controls Assurances 

The FEC is responsible for establishing and maintaining effective internal control and financial 

management systems that meet the objectives of the Federal Managers’ Financial Integrity Act of 

1982 (FMFIA), as implemented by OMB Circular A-123, revised, Management’s Responsibility for 

Internal Control. Internal control is an integral component of management to provide reasonable 

assurance that (1) programs operate effectively and efficiently, (2) financial reports are reliable, and 

(3) programs comply with applicable laws and regulations. The FEC conducted its evaluation of 

internal control in accordance with OMB Circular A-123. Based on the results of the Fiscal Year 

2017 internal control review, the FEC reported no material weaknesses under the FMFIA and is able 

to provide an unqualified statement of assurance that the internal controls and financial management 

systems meet the objectives of the FMFIA. 

The Annual Assurance Statement on Internal Control which was signed by the FEC Chair in 

accordance with OMB Circular A-123 and provided in “Section I.D: Analysis of FEC’s Systems, 

Controls and Legal Compliance” is supported by detailed assurances from each of the FEC’s 

assessable units. 

The assessable units that participated in the internal controls review process and provided assurances 

were as follows: 

• Office of the Chief Financial Officer 

• Office of the Chief Information Officer 

• Office of Communications 

• Office of Compliance 

• Office of the General Counsel 

• Office of the Inspector General 

• Management and Administration 

Detailed assurances for each of these assessable units were provided to the FEC’s OIG and 

independent auditor to support the single assurance statement signed by the FEC Chair. 

95
 

Fraud Risk Reporting in FY 2018 

The FEC’s Senior Management Council (SMC) anticipates developing a response to the new 

requirement for fraud risk reporting as directed in OMB Circular A-136 revised on July 30, 2018. It 

is anticipated that preliminary discussions to determine the necessity of any additional financial and 

administrative controls, as well as updates to the agency’s internal controls environment, related to 

assessing and managing fraud risk could be discussed at the next quarterly SMC meeting in FY 2019. 

96
APPENDIX 

97
AFR Agency Financial Report 

AO Advisory Opinion 

APR Annual Performance Report 

ASD Administrative Services Division 

CFR Code of Federal Regulations 

CSRS Civil Service Retirement System 

CY Calendar Year 

DCIA Debt Collection Improvement Act of 1996 

DOL Department of Labor 

EEO Equal Employment Opportunity 

ERM Enterprise Risk Management 

FAR Financial Audit Report 

FASAB Federal Accounting Standards Advisory Board 

FBWT Fund Balance With Treasury 

FEC Federal Election Commission 

FECA Federal Election Campaign Act 

FERS Federal Employees' Retirement System 

FMFIA Federal Managers' Financial Integrity Act 

FRAE Further Revised Annuity Employees 

FY Fiscal Year 

GAAP Generally Accepted Accounting Principles 

GSA General Services Administration 

IG Inspector General 

IPERA Improper Payments Elimination and Recovery Act 

IPERIA Improper Payments Elimination and Recovery Improvement Act 

IPIA Improper Payments Information Act 

MD&A Management's Discussion and Analysis 

NPRM Notices of Proposed Rulemaking 

NTEU National Treasury Employee Union 

OAR Office of Administrative Review 

OCFO Office of the Chief Financial Officer 

OCIO Office of the Chief Information Officer 

OGC Office of General Counsel 

OHR Office of Human Resources 

OMB Office of Management and Budget 

OPM Office of Personnel Management 

List of Acronyms 

98
OSD Office of the Staff Director 

P&E Property and Equipment 

PPA Prompt Payment Act 

RAD Reports Analysis Division 

RAE Revised Annuity Employees 

SBR Statement of Budgetary Resources 

SCA Statement of Custodial Activity 

SFFAS Statement of Federal Financial Accounting Standards 

SMC Senior Management Council 

SNC Statement of Net Cost 

SSAE Statements on Standards for Attestation Engagements 

TSP Thrift Savings Plan 

99