Federal Election Commission 

Office of Inspector General

Final Report

Inspection of FEC Compliance with 

FMFIA/OMB Circular A-123

June 2014

Assignment No. OIG-14-01
Office of Inspector General’s

Inspection of FEC Compliance with FMFIA/OMB Circular A-123 

April 2014 Report

The overall objective for this Office of Inspector General (OIG) inspection was to review and assess 

the Federal Election Commission’s (FEC) compliance with the Federal Managers’ Financial 

Integrity Act (FMFIA) requirements, as prescribed by Office of Management and Budget (OMB)

Circular A-123, and to provide management with recommendations to help strengthen this FEC 

function. The OIG conducted this inspection in accordance with the Council of the Inspectors 

General on Integrity and Efficiency (CIGIE) Quality Standards for Inspections and Evaluations, 

January 2011. 

Noteworthy Accomplishments

• The Office of the Chief Financial Officer (OCFO) provides detailed guidance for the annual 

internal control review process to assist program managers to assess and report on internal 

controls. 

• Four (Public Disclosure, Office of Administrative Review, Reports Analysis Division, and 

Office of Human Resources) of the 15 program offices reviewed are submitting internal 

control review (ICR) reports that describe what was entailed in their annual assessments.

Program offices are not required to submit an ICR report. Therefore, completing an ICR 

report demonstrates to the OIG that these offices understand the importance of effective 

internal controls.

OIG Concerns

• The OCFO’s review procedures for the annual internal control review (ICR) process needs to 

be enhanced to ensure standard operating procedures as outlined in Directive 53 (Internal 

Control Program) are operating effectively and are in compliance with FMFIA and OMB 

Circular A-123.

• 67% of program offices reviewed do not provide or maintain sufficient documentation to 

evidence compliance with Directive 53.

• As required, internal control weaknesses identified in OIG, independent reviews, and other 

government oversight agencies reports are not consistently disclosed by all program offices. 

This increases the risk that control weaknesses may not be properly reported.

• There is not sufficient evidence to conclude whether a comprehensive risk assessment is 

consistently performed for all program offices.

More detailed information related to the OIG Concerns can be found in the remainder of this report 

(see Executive Summary and Inspection Findings and Recommendations).
_________________________________________________________________________________ 

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 2 | Page

OIG Inspection of FEC’s Compliance with FMFIA/A-123 

TABLE OF CONTENTS Page

EXECUTIVE SUMMARY 3 

FINDINGS AND RECOMMENDATIONS 5 

I. Program Offices are not Complying with Directive 5 

Recommendations 6 

Management Comments 6 

II. Opportunity to Improve the Annual Risk Assessments 8 

Recommendations 8 

Management Comments 8 

III. Review Procedures by OCFO Needs to be Enhanced 10 

Recommendations 10

Management Comments 11 

Conclusion 12 

BACKGROUND 13 

OBJECTIVES, SCOPE AND METHODOLOGY 16 

APPENDIX: MANAGEMENT RESPONSE TO THE A-123 INSPECTION REPORT
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 3 | Page

Executive Summary 

At the Federal Election Commission (FEC), the Office of the Chief Financial Officer (OCFO) has 

been delegated operational responsibility for the FEC’s internal control program. The requirement for 

federal agencies to have adequate internal controls is mandated by the Federal Managers’ Financial 

Integrity Act (FMFIA) and the Office of Management and Budget’s (OMB) Circular A-123 guidance. 

According to the FMFIA, “...management is responsible for establishing and maintaining internal 

control to achieve the objectives of effective and efficient management operations, reliable financial 

reporting and compliance with applicable laws and regulations...” The FEC’s implementation of 

FMFIA/OMB Circular A-123 requirements are contained in FEC Directive 53 (Implementation of 

OMB Circular A-123: Internal Control Program) which also describes the FEC’s policies and 

standard procedures for performing the annual internal control reviews (ICR) at the program office 

level. For more detailed explanation of regulations and guidance related to internal controls and 

FEC’s compliance procedures, see the Background section (beginning on page 5) of this report.

In order to ensure internal controls are achieving the desired results, periodic assessments are 

necessary. In fact, OMB Circular A-123 states “...Federal managers must take systematic and 

proactive measures to... (ii) assess the adequacy of internal control in Federal programs and 

operations; [and] (iv) identify needed improvements.” 

As part of the Office of Inspector General (OIG) fiscal year (FY) 2013 work plan, a review of FEC’s 

processes for complying with FMFIA/A-123 was selected. The OIG’s objective for this inspection 

was to:

• determine if the FEC is complying with the requirements of FMFIA and OMB Circular A123;

• assess whether the FEC's ICR process is adequately designed and operating effectively; and

• identify any process improvements (best practices), and provide management with 

recommendations to help strengthen this FEC function. 

Overall, OIG concludes that the FEC is generally in compliance with FMFIA/OMB A-123 annual 

internal control assessment requirements. However, we have identified the following issues and 

process improvement opportunities related to the annual ICR process:

1. Program managers are not maintaining nor providing to the OCFO sufficient documentation to 

evidence that ICRs were properly conducted and in compliance with FEC internal control policies 

and procedures as outlined in Directive 53. 

2. There is an opportunity for the FEC to improve the risk assessment process. Currently, the 

standard control questionnaire (the Vulnerability Assessment Checklist) only captures general 

control risk. Therefore, all risk associated with a particular program/process is not specifically 

addressed. 

3. We believe that OCFO’s review procedures for the ICR process should be enhanced to ensure the 

assessments by program offices are in compliance with Directive 53 and that the FEC is adhering 

to FMFIA/OMB Circular A-123 requirements. 
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 4 | Page

OIG notes that OMB is in the process of revising the A-123 guidance. The proposed changes to the 

A-123 guidance are documented in the Government Accountability Office’s (GAO) 2013 Green 

Book Exposure Draft1 which was published in September 2013. The final version of the updated 

OMB Circular A-123 is expected to be released by the end of calendar year 2014. OIG reviewed the 

Green Book Exposure Draft and we do not anticipate any major changes to the internal control 

standards as they relate to the FEC. The revised guidance introduces 17 internal control principles 

along with related attributes that clarify what is required for an effective internal control system. 

Based on these new principles, OIG believes that the FEC will need to improve its current internal 

control structure to include policies and procedures for identifying, documenting, and monitoring 

internal controls. The recommendations included in this report are provided to help management

improve their current processes and assist with planning for implementing the new internal control 

guidance. The recommendations should be incorporated into revised policies and procedures for the 

ICR process. 

 1 GAO is required to issue standards for internal control in government. These standards, known as the Standards for 

Internal Control in the Federal Government (Green Book), provide the overall framework for establishing and 

maintaining an effective internal control system. For more information, see the 2013 Exposure Draft, GAO-13-830SP.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 5 | Page

Inspection Findings & Recommendations

I. Program Offices are not Complying with Directive 53

A. Based on testing performed, OIG determined the following:

• 10 of 15 program offices reviewed did not submit any 

detailed information in fiscal years 2012 and/or 2013 to 

formally document the program(s) reviewed and the 

procedures performed during the annual internal control 

review process. Therefore, the OIG concludes that 67% 

(10 of 15) of program offices are not properly 

documenting their annual internal control reviews.

• 3 of 5 program managers interviewed for this inspection do not prepare any supporting 

documentation to evidence steps completed during the annual review process. 

According to OMB Circular A-123 (A-123), “...Documentation should be appropriately 

detailed and organized and contain sufficient information to support management’s 

assertions...” 

According to Directive 53, “...documentation of final reviews and summaries should 

reside with the OCFO whereas detailed backup should stay with program offices. The 

documentation should be maintained for a period of at least two years for record-keeping 

purposes.” 

Failure to properly document the ICR process increases the risk that an adequate review 

was not performed. In addition, the lack of evidence to support the risk assessments may 

reduce the reliability of the assurance certification made by program offices on the 

effectiveness of internal controls to prevent and detect waste, fraud, abuse, and misuse.

B. Two program offices did not disclose in their ICR package unrectified internal control 

weaknesses reported in prior OIG and independent contractors’ reports as follows:

• Neither the Office of the General Counsel (OGC)

nor the Office of the Chief Information Officer (coprogram offices for privacy) disclosed control issues 

reported in the OIG Privacy Follow-up Audit in their 

FY 2012 and FY 2013 ICR package. Based on a 

discussion with one of the program managers, he 

didn’t think the related issues needed to be included 

in OGC’s ICR package. 

• Office of the Chief Information Officer’s (OCIO) ICR package did not disclose the 

information technology security internal control weaknesses from the FEC’s annual 

financial statement audits in the FY 2012 or FY 2013 assurance letters. 

All program managers are 

not providing sufficient 

information to support the 

annual internal control 

review.

Co-privacy program 

managers did not 

disclose control issues 

reported by OIG in their 

ICR package.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 6 | Page

Also, OCIO did not disclose data breaches and other control weaknesses from other 

audit reports (i.e. Inspection of the FEC’s Disaster Recovery Plan and Continuity of 

Operations Plans) in the FY 2012 and FY 2013 assurance letters. When OIG 

followed-up with the Deputy CIO to determine the reasons the internal control 

weaknesses were not included in the OCIO’s assurance letters, the Deputy CIO stated 

that he didn’t think it was necessary to include the control issues and corrective 

actions in the ICR packages because the details were already documented in the 

applicable reports’ corrective action plans (CAP). While OIG recognizes that program 

offices have limited resources and thus may strive to prevent duplicating work, it can 

not come at the expense of not complying with FEC policies and procedures or 

implementing federal regulations and guidance, and therefore the internal control 

weaknesses should have been included in the OCIO’s ICR package. 

According to Directive 53, “...The program managers will evaluate all internal control 

processes on an ongoing basis,...and report all findings and corrective actions taken in 

their annual report...Problems or weaknesses requiring immediate corrective action will 

be included in the program managers’ annual internal control reports as part of their 

letters of assurance...”

In addition, OIG notes that according to FMFIA

reporting requirements and Directive 53, all control 

issues should be reported internally and material 

control weaknesses along with corrective actions 

taken are required to be included in the agency’s 

annual assurance letter. Failure to disclose or 

include the referenced documents that list all 

internal control issues in the annual ICR package 

compromises the accuracy of the internal control assessments at the program office level. 

In addition, if aggregate control issues that constitute a material control weakness are not 

identified and thus not disclosed as such in the agency’s assurance letter to the President, 

this could have an adverse effect on the agency’s compliance with the law.

Recommendations

1. The Office of the Chief Financial Officer (OCFO) should ensure sufficient information is 

included in the internal control review (ICR) packages submitted by program offices by 

making the ICR report mandatory.

Management Response:

OCFO Management partially agrees with recommendation number one. 

The OCFO agrees with the OIG’s conclusion that “the FEC is generally in compliance 

with FMFIA/OMB A-123 annual internal control assessment requirements.” Under 

the guidance of Directive 53, the Commission delegated the responsibility to program 

managers to exercise professional judgment and assess the internal controls for their 

areas. The program managers complied with the guidance.

Per FMFIA, all control 

issues should be reported 

internally and material 

control weaknesses must be 

included in the agency’s 

annual assurance letter.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 7 | Page

While the OCFO does not agree with the recommendation to make the ICR Report 

mandatory, the OCFO does agree to enhance its guidance and documentation as 

appropriate. Specifically, program managers will be reminded that sufficient 

documentation must be maintained to support that internal controls were properly 

reviewed. The OCFO’s guidance for the Internal Control Review process will include 

a comparison of OIG findings to the feedback received from the program managers. If 

discrepancies are noted, the OCFO will discuss the matter with the appropriate 

managers to determine the status of the findings and the implications for the internal 

control of that program. The outcome of this process will be documented.

OIG Comment:

The OIG believes that making the ICR report mandatory is a best practice and should 

be considered by Management. In addition, summarizing and standardizing all the 

information required to support the ICR process into one document (the ICR report) 

would be more efficient. However, the corrective actions planned by Management 

should address this recommendation. OIG looks forward to reviewing the controls to 

be implemented to ensure that sufficient information is provided by management to 

support the assurance given.

2. As a best practice, the ICR Report should be standardized to include the following 

information:

o List of all programs/processes applicable and unique to the office/division;

o Brief description of each program's key controls with reference to pertinent 

policies/standard operating procedures;

o Summary of the annual internal control review including any specific programs that 

were assessed;

o Results and conclusion(s) of the review(s) including any internal control issues 

identified along with corrective actions planned/implemented (NOTE: If there is an 

applicable corrective action plan that addresses the corrective actions related to control 

issues/weaknesses included, then the ICR report only needs to reference the CAP); 

and

o Summary of control issues reported by OIG, other regulatory bodies, and/or 

independent reviews along with reference to any CAP(s).

Management Response:

OCFO Management partially agrees with recommendation number two. See response 

to recommendation number one above.

OIG Comment:

See comment to Management response to recommendation number one.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 8 | Page

The VAC does not

capture potential 

risk unique to each 

program office.

All program 

managers have not 

been trained on the 

ICR process.

II. Opportunity to Improve the Annual Risk Assessments

The standard questions included in the Vulnerability Assessment Checklist (VAC) only 

capture and rate general risk related to any FEC program offices. 

However, the VAC does not capture potential risk unique to a 

particular FEC program (which is known as “inherent risk”). In 

addition, as most program offices are not providing or maintaining

supporting documentation to describe the risk assessments 

performed, OIG is unable to confirm if the annual risk assessments 

conducted are adequate to substantiate the level of assurance required by Directive 53 and the 

FMFIA. The risk assessments at the program level would be more effective if specific control 

objectives and related inherent risks were identified, evaluated, and documented.

According to A-123, “...The agency head must describe the analytical basis for the type of 

assurance being provided, and the extent to which agency activities were assessed...;” and 

according to Directive 53, “Each program manager must evaluate risks associated with his 

or her program.”

OIG notes that all current program managers have not been 

trained on the ICR process and how to conduct a risk assessment, 

and may not understand what level of detail/information that

should be documented. Maintaining sufficient documentation is 

necessary to evidence compliance with the risk assessment 

process and to support the level of assurance given for each 

program. 

Recommendations

3. Once the new A-123 guidance is finalized, OCFO should revise the Vulnerability 

Assessment Checklist (VAC) to ensure it is aligned with the updated control objectives 

and their related principles and attributes.

Management Response:

Management agrees with recommendation number three. The OCFO agrees that the VAC 

will be addressed once the new A-123 is issued. For comparative purposes, however, a 

VAC should be general enough to cover all the common elements of all the program 

offices.

OIG Comment:

The OIG looks forward to reviewing Management’s corrective action plan to ensure it 

fully addresses this recommendation.

4. OCFO should require any item marked as high risk on the VAC is explained in the

respective program office’s ICR Report. 
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 9 | Page

Management Response:

OCFO Management partially agrees with recommendation number four. The OCFO 

does not plan to make the ICR Report mandatory (see Management Response to 

recommendation number one). However, the VAC will be supplemented to identify 

top risk factors and the impact if that risk is not mitigated. In the past few years, the 

OCFO has queried program managers about all the VAC items marked as high. As 

stated above, however, Directive 53 assigns program managers the responsibility to 

exercise their professional judgment in preparing their ICR reports if deemed 

necessary. As previously discussed with the OIG in December 2013 and January 

2014, OCFO Management would like to wait until a new A-123 is released to review 

and update the annual ICR process. 

OIG Comment:

The OIG believes that summarizing all supplemental information required to support 

the ICR process should be consolidated into one document (the ICR report). Creating 

a standard ICR report template would streamline the ICR process and would improve 

the efficiency of OCFO’s review of all program offices ICR packages. OIG looks 

forward to reviewing OCFO Management’s corrective action plan to ensure that it 

fully addresses this recommendation.

5. As a best practice, program managers with the assistance of OCFO, should be trained on 

how to conduct an inherent risk assessment for all mission critical programs. Going 

forward, these inherent risk assessments should be reviewed annually as part of the ICR 

process. 

Management Response:

OCFO Management partially agrees with recommendation number five. When the 

revised GAO Green Book and the updated version of A-123 are available, the OCFO 

will address the FEC’s Internal Control guidance and provide a training to appropriate 

program managers. The OCFO is unclear about the relationship between ‘potential 

risk unique to a particular FEC program’ and ‘inherent risk’ as mentioned in the IG’s 

recommendation number five above. Internally, the OCFO has its own determination 

of ‘inherent risk assessment’ that is different from the risk assessment for the annual 

ICR process.

OIG Comment:

For the purpose of the readers of this report, “potential risk unique to a particular FEC 

program” was meant to explain the term “inherent risk” and thus used 

interchangeably. The OIG looks forward to reviewing corrective actions planned by 

Management to ensure that it fully addresses this recommendation.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 10 | Page

III. Review Procedures by OCFO Needs to be Enhanced

Based on the OIG’s review of FEC’s ICR process and 

procedures, we believe that the OCFO is performing some 

review procedures for the ICR process. However, the OCFO 

review process is not an effective monitoring control to 

ensure that program managers are providing complete and 

accurate information to substantiate the assurance given. 

OIG concludes that this is mainly because program offices 

do not provide sufficient documentation to OCFO on the 

results of the program offices’ reviews. 

According to Directive 53:“...the Commission delegates operational responsibility for the 

FEC’s internal control program to the CFO...”

While OIG does agree that OCFO is not directly responsible for the internal control reviews 

of each program office, and that OCFO must rely on the 

results of the assessments made at the program level,

adequate review procedures are necessary to ensure all 

internal control issues are properly identified and evaluated 

for the agency’s annual assurance certification. In addition, 

the OIG also notes that the review procedures under the 

current internal control standards are expected to be 

expanded as oversight is one of the main internal control 

principles that will be added to the revised GAO Green Book.

According to the Standards for Internal Control in the Federal Government: 2013 Exposure 

Draft: 

“...The oversight body oversees management’s design, implementation, and operation 

of the entity’s internal control system. The oversight body’s responsibilities for the 

entity’s internal control system include:

...Monitoring - Scrutinize the nature and scope of management’s monitoring activities 

as well as management’s evaluation and remediation of identified deficiencies...”

Failure to report known internal control weaknesses increases the risk that the agency will not 

be in compliance with applicable laws, regulations, and guidance. 

Recommendations

6. The OCFO should improve their review process by paying special attention to the 

methodologies for the risk ratings and explanations of control issues for reasonableness,

and to ensure all internal control issues are properly reported and potential material 

control weaknesses are identified.

Management Response:

OCFO Management partially agrees with recommendation number six. 

OCFO is not 

obtaining sufficient 

information to 

perform adequate 

review procedures. 

Adequate review 

procedures are necessary 

to ensure all control

issues are properly 

identified and evaluated.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 11 | Page

With only operational responsibility delegated by Directive 53 to CFO, the OCFO will 

consider the OIG concerns when preparing the annual internal control guidance for 

Fiscal Year 2014. Please see the management responses above for what the OCFO 

plans to do in this regard. 

OIG Comment:

The OIG looks forward to reviewing corrective actions planned by Management to 

ensure that it fully addresses this recommendation. OIG also notes that given the fact 

that OCFO has been delegated operational responsibility for implementing the FEC’s 

internal control program, and the CFO Report includes a recommendation whether the 

Commission can “provide reasonable assurance that the FEC’s internal controls are 

adequate and operating effectively”, gives the OCFO implied responsibility to ensure that 

(1). The ICR process is being complied with; and (2). Assessments by program offices 

are sufficient and reasonable. 

7. After the new A-123 guidance is finalized and implemented by OCFO, OCFO should 

conduct agency-wide training on the ICR process for all program offices and designated 

program managers.

Management Response:

OCFO Management agrees with recommendation number seven. When the revised 

GAO Green Book (Green Book) and the updated version of OMB’s Circular A-123 

(A-123) guidance are available, the OCFO expects to address the FEC’s Internal 

Control guidance and provide a training to appropriate program managers.

OIG Comment:

The OIG looks forward to reviewing corrective actions planned by Management to 

ensure that it fully addresses this recommendation.

8. Going forward, OCFO should require any new designated program managers to be 

identified at the start of the agency-wide A-123 review process, and OCFO should ensure 

that all new program managers are trained on the ICR process before conducting their first 

review. 

Management Response:

OCFO Management agrees with recommendation number eight. See Management 

response to recommendation number seven above. 

OIG Comment:

OIG believes management’s corrective action plan may not be adequate to address this 

recommendation. Once the initial training on the new guidance is conducted, a control 

will need to be put in place to ensure any new program managers designated after the 

initial training is conducted is identified and trained before they are required to 

perform an internal control review. The OIG looks forward to reviewing corrective 

actions planned by Management to ensure that it fully addresses this recommendation.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 12 | Page

Conclusion

OIG concludes that while the FEC is generally complying with the FMFIA/A-123 requirements, the 

supporting documentation maintained and provided to the OCFO by program offices is not always 

sufficient to evidence compliance with A-123 guidance. However, we believe there is an opportunity 

to strengthen the annual risk assessment process. For example, all potential risk associated with a 

particular program/office should be identified and assessed to determine if existing internal controls 

are sufficient to mitigate the risk to an acceptable level. By improving the annual risk assessment 

process, implementing additional monitoring controls, and providing training to program managers, 

the FEC will have a more effective and robust assessment process and thus a stronger overall control 

environment. 
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 13 | Page

Background

The overarching legislation regarding internal controls in federal agencies is the Federal Managers’

Financial Integrity Act of 1982 (FMFIA) as codified in 31 U.S.C. 3512. 

According to the FMFIA: 

“Management is responsible for establishing and maintaining internal control to achieve the 

objectives of effective and efficient management operations, reliable financial reporting and 

compliance with applicable laws and regulations."

The Office of Management and Budget (OMB) issued guidance for implementing the requirements of 

the FMFIA through OMB Circular A-123. In December 2004 OMB Circular A-123 (“A-123”) was 

revised and consolidated other regulations applicable to internal controls into one document to 

include the Federal Financial Management Improvement Act of 1996 (FFMIA, formerly OMB 

Circular A-127), and the Improper Payments Elimination and Recovery Act of 2010 (IPERA). 

According to A-123: 

“Internal control comprises the plans, methods, policies, and procedures used to fulfill the 

mission, strategic plan, goals, and objectives of the organization. Internal control serves as 

the first line of defense in safeguarding assets and preventing and detecting errors and 

fraud...”

Circular A-123 requires federal agencies to:

• annually assess whether the internal controls in federal programs and operations are in 

compliance with FMFIA;

• identify control weaknesses along with corresponding corrective actions; 

• provide annual management assurance statements; 

• plan, document, and test internal controls over financial reporting (as defined in Appendix A);

• annually assess controls over charge card programs (as defined in Appendix B);

• annually assess improper payments (as defined in Appendix C);

• establish and annually report on the recovery audit program according to IPERA (as defined 

in Appendix C); and

• annually assess and test controls over financial systems (as defined in Appendix D).

The Federal Election Commission (FEC) is exempt from the requirement in Appendix A to document

and annually test internal controls over financial reporting since the FEC is not a Chief Financial 

Officers Act agency. However, the FEC is required to perform an annual assessment of internal 

controls and provide an assurance letter that certifies the agency’s internal controls can reasonably be 

relied on to prevent and detect waste, fraud, and abuse. 

The FEC updated and adopted Directive 53 (effective as of December 15, 2010) to document the 

FEC’s policies and standard procedures for implementing an internal control program that complies 
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 14 | Page

with FMFIA/A-123. Through Directive 53, the Commission has delegated operational responsibility 

for the FEC’s internal control program to the Chief Financial Officer (CFO). Directive 53 also gives 

detailed guidance on how program offices should conduct risk assessments. A risk assessment is a 

process whereby all potential risk associated with a particular program or activity is identified and 

evaluated to determine if adequate internal controls are in place and operating effectively to mitigate 

the risk or reduce the risk to an acceptable level. Risks are not limited to potential fraud, waste, and 

abuse; but also include, failure to achieve the agency’s mission, comply with laws, regulations, 

guidance, and/or reputational harm to the agency. 

FEC’s annual internal control review (ICR) process normally takes place in August and covers the 

current fiscal year which ends on September 30 of the same year. Currently, there are 16 FEC 

program offices (including the Office of Inspector General) that perform individual ICRs. Each 

program office designates a program manager who is responsible for the internal control program for 

their respective office or division.

The program managers are instructed to review applicable programs/processes, conduct a risk 

assessment of their respective programs/processes, document the results of the assessments, and 

identify any control weaknesses along with recommended corrective action plan(s). In addition, the 

program managers have to complete the Vulnerability Assessment Checklist (VAC) which requires 

the program managers to rate general internal control questions. For example, one of the questions in 

the VAC asks the offices/divisions whether clear and concise operating procedures are in place.

Based on the results of the ICR, the program managers must provide a statement of assurance on 

whether they can give “reasonable assurance that the government funds or assets under their 

respective programs are adequately safeguard from potential waste, fraud, abuse, or misuse.” The 

statement of assurance is provided in the form of a letter and the assurance letters must be signed by 

the applicable division/office head. The program managers have an option to document the results of 

their review in a separate ICR Report. Otherwise, the required information must be incorporated in 

the VAC and/or assurance letter.

The complete ICR package is forwarded to the OCFO. The ICR package consists of the following. 

1. Assurance Letter

2. ICR Report (optional)

3. Vulnerability Assessment Checklist 

4. List of Policies and Procedures for the office/division

The ICR documents serve as the basis for forming an agency-wide statement of assurance. The 

OCFO reviews all the ICR packages for completeness and to identify any changes/fluctuations to 

internal control risk levels from the prior year. Any major changes are followed-up with the 

appropriate program manager to determine the reason for the changes. The OCFO prepares an 

agency-wide internal control report (CFO Report) that consolidates and summarizes the results of all 

the program offices ICR packages and submits the report to the Commission. The CFO Report also 

includes a recommendation by the CFO as to whether the Commission can rely on the FEC’s internal 

controls and should give reasonable assure to prevent fraud, waste, and abuse.
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 15 | Page

Based on this report, the Chair, on behalf of the Commission, will sign the formal Assurance 

Statement on Internal Control. A separate assurance letter is mailed to the President of the United 

States and is also included in the annual Performance and Accountability Report (PAR). 

OIG notes that OMB is in the process of revising the A-123 guidance. The preliminary changes to the 

A-123 guidance are documented in the Government Accountability Office’s (GAO) exposure draft,

Standards for Internal Control in the Federal Government: 2013 Exposure Draft, GAO-13-830SP

(“The Green Book Exposure Draft”) which was published in September 2013. A-123 guidance is 

being revised to incorporate key concepts from the 2013 Committee of Sponsoring Organizations of 

the Treadway Commission (COSO)2 internal control integrated framework for the government 

environment. Per OIG review of “The Green Book Exposure Draft”, we conclude that there are no 

conceptual changes to the standards on internal controls. The new guidance will introduce 17 

principles along with detailed explanations (referred to as attributes) that clarify what is required for 

an agency’s internal control program to be considered effective. The updated version of OMB 

Circular A-123 is expected to be released in the later part of calendar year 2014. 

 2 COSO is a national private sector organization dedicated to improving the quality of financial reporting through 

business ethics, effective internal controls, and corporate governance and is recognized as a thought leader in the global 

marketplace on the development of guidance in the areas of risk and controls. See COSO Internal Control - Integrated 

Framework (May 2013)
_________________________________________________________________________________

Office of Inspector General’s Inspection of the Federal Election Commission’s Compliance with FMFIA/A-123 

2014 Report 16 | Page

OBJECTIVES, SCOPE AND METHODOLOGY

Objectives

The OIG’s objective for this inspection was to determine if the FEC is complying with the 

requirements of FMFIA and OMB Circular A-123, to assess whether the FEC's annual internal 

control review process is adequate, and provide management with recommendations to help 

strengthen this FEC function. 

Scope

The scope of the inspection included review of FEC’s FMFIA and A-123 compliance procedures 

performed during FYs 2012 and 2013.

Methodology – The OIG conducted the following inspection steps:

• The OIG reviewed FEC’s policies and procedures for compliance with FMFIA and OMB A-123 

requirements to ensure adequate management processes and controls are in place.

• Researched regulations and guidance related to internal controls including FMFIA, and OMB 

Circular A-123.

• Reviewed GAO’s exposure draft (Green Book) of new A-123 guidance expected to be issued in 

the latter part of calendar year 2014 to determine if any major changes will be required for FEC.

• Interviewed the Acting Accounting Director to gain a better understating of the FEC’s annual 

internal control review process.

• Reviewed all 15 program offices’ ICR packages submitted for FYs 2012 and 2013.

• Conducted interviews of five (5) program offices (Office of the Chief Information Officer, Office 

of the General Counsel - Litigation, Office of Administrative Review, Reports Analysis Division, 

and Administrative Services Division) to discuss their annual internal control review process, to 

include:

o The steps included in the program offices’ review process;

o The methodology for selecting programs to review;

o The resources/documents that are utilized during the assessment phase; and

o How the program office determines the team members to assist with the annual review 

process. 
1 

THE FEDERAL ELECTION COMMISSION 

Washington, DC 20463 

Appendix: Management Response 

June 10, 2014 

MEMORANDUM

TO: Lynne A. McFarland 

 Inspector General 

 

FROM: Judy Berning 

 Acting Chief Financial Officer 

SUBJECT: Responses to Office of Inspector General’s Inspection of the Federal Election 

Commission’s Compliance with FMFIA/A-123 2014 Report 

The Federal Election Commission (FEC) strives to maintain internal controls at a level sufficient to 

manage risk and provide program integrity while realizing that it’s impossible to eliminate all risk and 

it is cost effective to accept a tolerable level of risk. OCFO Management appreciates the opportunity 

to comment on the Office of Inspector General’s (OIG) draft report. While the OCFO would like to 

wait for an official release of GAO Green Book (Green Book) and revised OMB Circular A-123 (A123), the OCFO will consider the OIG concerns when preparing the annual internal control guidance 

for Fiscal Year 2014, wherever deemed appropriate. 

Recommendations:

I. Program Offices are not Complying with Directive

OCFO Management partially agrees with recommendation number one and two. 

The OCFO agrees with the OIG’s conclusion that “the FEC is generally in compliance with 

FMFIA/OMB A-123 annual internal control assessment requirements.” 

Under the guidance of Directive 53, the Commission delegated the responsibility to program 

managers to exercise professional judgment and assess the internal controls for their areas. The 

program managers complied with the guidance. 

While the OCFO does not agree with the recommendation to make the Internal Control Review 

(ICR) Report mandatory, the OCFO agrees to enhance its guidance and documentation as 

appropriate. Specifically, program managers will be reminded that sufficient documentation must 

be maintained to support that internal controls were properly reviewed. The OCFO’s guidance for 
2 

the Internal Control Review process will include a comparison of OIG findings to the feedback 

received from the program managers. If discrepancies are noted, the OCFO will discuss the 

matter with the appropriate managers to determine the status of the findings and the implications 

for the internal control of that program. The outcome of this process will be documented. 

II. Opportunity to Improve the Annual Risk Assessments

OCFO Management agrees with recommendation number three. We agree that the Vulnerability 

Assessment Checklist (VAC) should be updated once the new A-123 guidance is issued. For 

comparative purposes, however, a VAC should be general enough to cover all the common 

elements of all the program offices. The VAC will be supplemented to identify a top risk factor 

and the impact if that risk is not mitigated. 

OCFO Management partially agrees with recommendation number four. In the past few years, the 

OCFO has queried program managers about all the VAC items marked as high. As stated above, 

however, Directive 53 assigns program managers the responsibility to exercise their professional 

judgment in preparing their ICR reports if deemed necessary. 

OCFO Management partially agrees with recommendation number five. When the revised GAO 

Green Book and the updated version of A-123 are available, the OCFO will address the FEC’s 

Internal Control guidance and provide a training to appropriate program managers. The OCFO is 

unclear about the relationship between ‘potential risk unique to a particular FEC program’ and 

‘inherent risk’ as mentioned on Page 7 of the IG report. Internally, the OCFO has its own 

determination of ‘inherent risk assessment’ that is different from the risk assessment for the 

annual ICR process. 

III. Review Procedures by OCFO Needs to be Enhanced 

OCFO Management partially agrees with recommendation number six. With only operational 

responsibility delegated by Directive 53 to CFO, the OCFO will consider the OIG concerns when 

preparing the annual internal control guidance for Fiscal Year 2014. Please see the management 

responses above for what the OCFO plans to do in this regard. 

 

OCFO Management agrees with recommendation number seven and eight. When the revised 

GAO Green Book and the updated version A-123 guidance are available, the OCFO expects to 

update the FEC’s Internal Control guidance and provide a training to appropriate program 

managers. 

While it might be true to say the ‘Green Book Exposure Draft’ presents ‘no conceptual changes to 

the standards on internal controls’, this ignores the significance of A-123 which offer guidance as 

to how to implement the new COSO framework and the Green Book. 

Last fall, the OMB collected forty-three suggestions from various agencies on how to update its 

A-123 with the ‘Green Book Exposure Draft.’ Since the Green Book places a greater emphasis on 

program operation, one of the most popular suggestions is to ask for guidance on how to 

implement internal control assessment on program operations. One has to note that A-123 was 

originally designed for financial audits. 

Following the new COSO framework, the Green Book does emphasize the independence of the 

oversight body. Based on information received from recent conferences hosted by GAO and 
3 

OMB, however, it is still unclear how federal agencies may implement the concept of oversight 

body. 

The two examples above are used to illustrate that having implementation guidance from a new A123 will indeed be helpful. As previously discussed with the OIG in December 2013 and January 

2014, therefore, OCFO Management would like to wait until a new A-123 is released to review 

and update the annual ICR process. 
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015