FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

 FINAL REPORT 

 Review of Outstanding Recommendations 

 as of December 2012 

 

 January 2013 

 ASSIGNMENT No. OIG -13-01 
Office of Inspector General’s Review of Outstanding Audit Recommendations 

December 2012 Report 

Report Overview 

As required by the Inspector General Act of 1978, as amended, the Office of Inspector General (OIG) 

is responsible for conducting audits of the Federal Election Commission’s (FEC) programs and 

operations. When the OIG conducts an audit, or supervises an Independent Public Accounting firm 

to perform an audit, the OIG also has the responsibility of tracking audit recommendations and 

performing audit follow-up work to ensure adequate resolution of audit recommendations. Audit 

follow-up, to include the timely implementation of audit recommendations, is required by Office of 

Management and Budget Circular A-50, Audit Followup, as revised, and FEC Directive 50: Audit 

Follow-up.

Although management typically provides a semiannual status report to the Commission of their 

progress concerning outstanding audit recommendations, the official status (open/closed) of audit 

recommendations is determined by the OIG once the OIG has verified that management has 

adequately implemented the corrective actions to address the audit recommendations. This 

information is reported to the Commission and Congress in the OIG’s Semiannual Reports to 

Congress. 

This report provides the Commission with details regarding the: 

• OIG’s Audit Follow-up process, see page 2; 

• Quarterly meetings with management to determine the status of outstanding audit 

recommendations, starting on page 3: 

a. Audit Follow-up Review of the FEC’s Employee Transit Benefit Program, see page 4; 

b. Audit of the Commission’s Property Management Controls, see page 4; 

c. 2010 Follow-up Audit of Privacy and Data Protection, see page 5;

d. 2010 Follow-up Audit of Procurement and Contract Management, see page 5; and

e. Inspection of FEC’s Kastle Key Program, see page 6.

For this review period, the OIG reviewed five audits/inspections that had a total of 127 

recommendations that were outstanding for six months or more. Collectively for three of the five 

assignments, the OIG closed 24 outstanding recommendations based on the OIG’s review of 

management’s implementation of corrective action. However, the OIG’s review determined that 

management’s efforts to date do not adequately address the audit recommendations and all open audit 

recommendations reported in the OIG’s June 2012 report for the 2010 Follow-up Audit of Privacy 

and Data Protection and the 2010 Follow-up Audit of Procurement and Contract Management

remain outstanding. 

 

1 
Office of Inspector General’s Review of Outstanding Audit Recommendations 

December 2012 Report 

Audit Follow-up Process 

At the conclusion of each audit, it is management’s responsibility to develop a corrective action plan 

(CAP). The CAP identifies the plan management has developed to address the audit findings. The 

CAP should detail the following: 

1. assignment of Audit Follow-up Official (AFO); 

2. audit finding(s); 

3. audit recommendation(s); 

4. corrective action to implement the audit recommendation(s); 

5. staff person with responsibility to implement each task; and 

6. expected completion dates. 

Once management drafts the CAP, the OIG then reviews their CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the audit 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the final 

CAP to the Commission with a courtesy copy to the OIG. 

 

FEC Directive 50 requires management to: 

“(3) Conduct regular meetings with the Inspector General throughout the year to follow-up 

on outstanding findings and recommendations, and include reports of these meetings in the 

written corrective action plan and semi-annual reports required to be presented to the 

Commission;...” 

In order to work effectively with FEC management in adhering to Directive 50, and to ensure 

continuous monitoring and adequate and timely audit resolution, the OIG revamped our follow-up 

process to include quarterly meetings with management to discuss the progress of outstanding audit 

recommendations. The OIG is reporting semiannually (June & December) to the Commission on 

recommendations that the OIG has closed (if any) based on follow-up reviews. The quarterly 

meetings are also intended to assist the audit follow-up official in following provisions 4 through 6 of 

Directive 50, which are listed below: 

 “(4) Respond in a timely manner to all audit reports; 

 (5) Engage in a good faith effort to resolve all disagreements; and 

 (6) Produce semi-annual reports that are submitted to the agency head.” 

 

2 
Office of Inspector General’s Review of Outstanding Audit Recommendations 

December 2012 Report 

Quarterly Meetings 

In the OIG’s June 2012 report on the review of outstanding audit recommendations, there were four 

OIG audits with a total of 1121 outstanding audit recommendations. Since our June 2012 report, the 

Inspection of the FEC’s Kastle Key Program was added to the audit follow-up process because there 

are recommendations that have been outstanding for more than six months from the inspection 

completion date of December 2011. To discuss the current status and progress of each outstanding 

recommendation, the OIG held separate meetings with the applicable audit follow-up official and/or 

management staff for each audit/inspection. Out of the five follow-up reviews, the OIG was able to 

close several outstanding recommendations for three of the five audits/inspection: (1) Audit Followup Review of the FEC’s Employee Transit Benefit Program; (2) Audit of the Commission’s Property 

Management Controls; and (3) Inspection of the FEC’s Kastle Key Program. 

Although several recommendations were closed for three assignments, further corrective action from 

management is still needed to implement the remaining outstanding recommendations. In addition, 

no issues were closed for the 2010 Follow-up Audit of Procurement and Contract Management and 

the 2010 Follow-up Audit of Privacy and Data Protection. See table below for a summary of progress 

made by FEC management and the outstanding recommendations as of December 2012. 

Outstanding Audit Recommendations Status Table

Title of OIG 

Audits/Inspection 

Total 

Outstanding 

Recommendations 

As of June 2012 

Total 

Closed per 

OIG 

Total Open 

as of 

December 2012 

Report 

Release 

Date 

Audit Follow-up Review of 

the FEC’s Employee Transit 

Benefit Program 

25 10 15 7/2009 

Audit of the Commission’s 

Property Management 

Controls 

20 62 14 3/2010 

2010 Follow-up Audit of 

Privacy and Data Protection 

38 0 38 3/2011 

2010 Follow-up Audit of 

Procurement and Contract 

Management 

29 0 29 6/2011 

Inspection of the FEC’s 

Kastle Key Program 15 8 7 12/2011 

 

 

1

 The number (112) of outstanding recommendations includes recommendations that management has disagreed with the 

OIG. These recommendations remain open based on further improvement needed by management for the overall program 

and/or the OIG believes the recommendation is essential to fixing the weakness and should be implemented. 

2

 The OIG researched the Internal Revenue Service regulation for finding 1j, and noted that agency issued mobile devices 

are no longer labeled as “listed property” which makes the recommendation no longer applicable based on the revised 

regulations. See further explanation on page 5. 

3 
Office of Inspector General’s Review of Outstanding Audit Recommendations 

December 2012 Report 

 

A. Audit Follow-up Review of the FEC’s Employee Transit Benefit Program 

During the quarter ending September 30, 2012, OIG met with the Transit Program Manager on 

several occasions to obtain and review documentation related to some of the outstanding 

recommendations. Based on OIG’s review of supporting documentation and follow-up work 

performed, we were able to close 10 of the 25 outstanding recommendations. 

The OIG notes that nine (9) of the remaining fifteen (15) outstanding recommendations are tied to the 

issuance of a revised Commission Directive 54 on the transit benefit program. The OIG reviewed the 

final draft of Directive 54 and provided comments to the Transit Program Manager before it was 

submitted to the Commission for approval. In January 2013, the revised Directive 54 was approved 

and issued to FEC staff. The OIG plans to review the final directive to verify the actions and the 

related recommendations can be closed. 

B. Audit of the Commission’s Property Management Controls 

The Audit of the Commission’s Property Management Controls (Property Audit) audit report was 

released in March 2010. The OIG has worked with the Administrative Services Division (ASD) 

Managers3

 and the Deputy Chief Information Officer of Operations (Deputy CIO) to receive any 

updates regarding the implementation of audit recommendations. The responsibility of implementing 

the audit recommendations is shared by the Administrative Services Division and the Office of 

Information Technology (OIT). 

The Property Audit report identified 36 audit recommendations to improve the controls over FEC’s 

property. ASD is responsible for 10 of the 36 audit recommendations that relate to the FEC’s 

management controls over government vehicles and charge (fuel) cards. In the OIG’s June 2012 

Outstanding Recommendations report, ASD had 6 open recommendations regarding the Property 

Audit. During the latest audit follow-up meeting with ASD, the OIG reviewed supporting 

documentation and processes implemented to address the 6 open recommendations. The OIG’s 

review concluded that 5 of the 6 open recommendations were adequately implemented. Although the 

OIG could not close all 6 open recommendations, the ASD manager’s consistent progress in 

implementing corrective actions provides the OIG with assurance that the remaining open 

recommendation will be fully implemented in the near future. 

The Office of Information Technology is responsible for implementing 26 of the 36 outstanding audit 

recommendations that relate to the FEC’s management controls over mobile devices (Blackberry 

phones). The OIG’s June 2012 report identified 14 outstanding audit recommendations; 12 

recommendations had already been closed as of June 2012. The OIG held an audit follow-up meeting 

with the CIO and Deputy CIO to discuss the progress that ITD has made in implementing the 14 

outstanding recommendations. However, ITD has not implemented corrective action for any of the 14 

outstanding recommendations. Further, during the audit follow-up meeting, it was noted that 

management decided to disagree with recommendation 1h, Document the ITD re-authorization 

3

 The OIG has worked with one acting ASD manager and two permanent ASD managers since the completion of the 

Property audit due to frequent turnover in this position. 

4 
Office of Inspector General’s Review of Outstanding Audit Recommendations 

December 2012 Report 

 

process of PCD users in ITD’s Policy 58-4.4, a recommendation management initially agreed to 

implement. 

Prior to management changing their response to disagree with recommendation 1h, management’s 

Policy 58-4.4 was updated to state the following: 

“The approval authority must re-authorize approved PCD users under their cognizance via e-mail to 

OCIO. The OCIO will maintain the file of authorized PCD users and re-authorizations.” 

However, ITD has not been in compliance with their policy to require users to have their use of 

agency devices reauthorized. Management now believes that a reauthorization process would be 

redundant with other ITD processes of recording devices and maintaining email requests for devices. 

However, based on test results from the OIG’s initial audit, the OIG believes that if this 

recommendation is implemented, and mangers/supervisors have the opportunity to annually assess 

their staffs’ use and/or need for Blackberry devices, there is potential cost savings to the agency. 

In addition, the OIG researched the Internal Revenue Service (IRS) guidance regarding the use of 

agency issued mobile devices (cell phones) in relation to recommendation 1j, which states: “FEC 

should adhere to the IRS regulations and revise program policies to reflect those regulations.” The 

OIG identified that the IRS has issued Notice 2011-724. In this notice, the IRS has removed cell 

phones provided for business purposes from “listed property” and the substantiation requirements for 

identifying business versus personal use is no longer applicable. Therefore, the OIG has closed 

recommendation 1j, based on the revised IRS regulations. 

 

C. 2010 Follow-up Audit of Privacy and Data Protection 

For the Privacy and Data Protection Audit, the OIG’s June 2012 Review of Outstanding Audit 

Recommendations report identified 38 open recommendations. During the OIG’s recent audit followup meeting, management provided support for 4 (2a, 4c, 6a, and 8d) of the 38 open 

recommendations. The OIG reviewed the information provided and concluded that the support 

provided for the recommendations was not sufficient and did not adequately address the audit issues. 

However, for recommendation 6a, Modify the Federal Election Commission Mobile Computing 

Security Policy, 58-4, to require all mobile devices, including Blackberry devices, be encrypted, ITD 

has noted that they are currently working on changing the FEC’s current system that captures 

encryption information for FEC devices. ITD anticipates the new system will have the capability to 

provide the necessary information to document that all devices are encrypted. 

D. 2010 Follow-up Audit of Procurement and Contract Management 

The OIG held a quarterly meeting on October 5, 2012 with the outgoing Chief Financial Officer 

(CFO), the Accounting Officer, and the new Procurement Director. The purpose of the meeting was 

for OIG to obtain a status update of the outstanding audit recommendations for the 2010 Follow-up 

Audit of Procurement and Contract Management. During the meeting, the (former) CFO stated that 

all 295

 recommendations were still open, but that progress is now being made since the new 

4 http://www.irs.gov/pub/irs-drop/n-11-72.pdf

5

 Out of the 29 recommendations, there is one recommendation management has disagreed with the OIG, and does not 

plan to implement any corrective action. 

5 
Office of Inspector General’s Review of Outstanding Audit Recommendations 

December 2012 Report 

6 

Procurement Director is on board. OIG notes that the Procurement Director position was filled in 

June 2012. The Procurement Director stated that she was in the process of reviewing and updating 

the corrective action plan to reflect progress made and actions planned to address the audit 

recommendations. The Procurement Director stated that she needed more time and requested that we 

schedule another meeting to discuss the CAP once it was updated. 

The OIG met with the Procurement Director on November 15, 2012 and was informed that she had 

been busy with other priorities and has not had time to complete the CAP. The OIG gave the 

Procurement Director guidance on how to report on the status of open recommendations to be 

included in the November 2012 semiannual CAP report to the Commission. An updated CAP was 

received by OIG on November 21, 2012. Based on our review of the revised CAP, all 29 

recommendations are still open. However, OIG notes that partial corrective action has been made to 

address some of OIG’s recommendations to ensure compliance with contracting regulations. OIG 

will verify the new and/or planned procurement policies and procedures once they have been fully 

implemented. 

E. Inspection of the FEC’s Kastle Key Program 

The OIG held the first follow-up meeting with the Administrative Services Division (ASD) for the 

Inspection of the FEC’s Kastle Key Program to review their progress in implementing the 

outstanding recommendations. Although management agreed with 14 of the 15 recommendations in 

the inspection report, management’s CAP provided corrective action for all 15 recommendations. 

The OIG’s review noted that 6 of the 15 recommendations remained open, and the majority of these 

recommendations are open because ASD’s revised Kastle Key policy was still in draft at the time of 

our review. However, the OIG did review the draft policy, provided comments, and the Kastle Key 

policy has since been finalized and issued to FEC staff. The OIG will review the open 

recommendations and final policy during our next follow-up review and it is anticipated 

recommendations will be closed. 

In addition, the OIG reviewed one recommendation regarding ASD’s data that is processed in the 

Kastle key system by the Kastle key administrators. This recommendation could not be closed as the 

OIG noted that the data entered in the Kastle key system did not always reflect what was documented 

in the Kastle key request form by the user. ASD noted that these errors potentially occurred due to a 

difference in data entry processes by the two administrators. Therefore, this recommendation remains 

open. However, the remaining 8 recommendations were all closed by the OIG due to adequate 

implementation of the corrective actions by management. 
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015