Federal Election Commission

Office of Inspector General

Inspector General Statement

On the Federal Election Commission’s

Management and Performance

Challenges - 2015
Table of Contents Page

Inspector General Statement on the FEC’s Management and Performance Challenges...................1-6

Attachment A: Response to OIG’s Statement on the FEC’s Management

 and Performance Challenges...............................................................................................7
 FEDERAL ELECTION COMMISSION

WASHINGTON, D.C. 20463

Office of Inspector General

MEMORANDUM

TO: The Commission

FROM: Inspector General

SUBJECT: Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges

DATE: October 16, 2015

Each year, the Inspector General (IG) is required to provide a summary and assessment 

of the most serious management and performance challenges facing the Federal Election 

Commission (FEC). The requirement is contained in the Reports Consolidation Act of 

2000 (Public Law 106-531), an amendment to the Chief Financial Officers (CFO) Act of 

1990. The attached document responds to the requirement and provides the annual 

statement on Commission challenges to be included in the Federal Election Commission 

Financial Audit Report (FAR) Fiscal Year (FY) 2015.

The Office of Inspector General (OIG) has identified three management and performance 

challenges for inclusion in the FEC’s FY 2015 FAR:

Information Technology Project Planning and Management

Governance Framework

Human Capital Management / Human Resources Operations

This year’s management challenges statement contains a significant difference from those 

previous. For the past 11 years, the OIG has identified information technology (IT) 

security as a challenge. Due to the agency’s legal exemption from the Federal 

Information Systems Management Act, agency management had not formally adopted or 

implemented the applicable National Institute of Standards and Technology (NIST) IT 

security standards for the federal government. However, during the agency’s FY 2014

financial statement audit, management agreed with the OIG’s recommendation to 

formally adopt NIST as its risk management framework. In addition, management has 

recently taken the following steps to comply with the NIST standards:

• performed a system inventory gap analysis;

• performed a cost feasibility study to implement NIST; and

• developed a statement of work to procure contractor assistance to implement the 

NIST IT security.
2

Due to these management actions and a recent commitment to establish more robust IT 

security standards, the OIG has removed Information Technology Security as a 

management challenge. The OIG will continue to monitor and assess management’s 

progress in implementing NIST IT security standards to ensure adequate implementation.

However, the FEC’s Office of Chief Information Officer (OCIO) (formerly Information 

Technology Division, or ITD) continues to struggle with implementing IT projects 

efficiently and effectively, and in a timely manner due to a lack of adequate planning and 

management oversight. Currently the FEC’s Chief Information Officer (CIO) is also the 

agency’s full-time Staff Director, who has oversight of the FEC (except the Office of 

General Counsel, Office of Chief Financial Officer, and Office of Inspector General). In 

a Government Accountability Office (GAO) report,

1 GAO states: 

“We stressed that asking the CIO to shoulder a heavy load of responsibilities 

would make it extremely difficult, if not impossible for that individual to devote 

full attention to IRM [Information Risk Management] issues.”

The OIG believes the FEC’s current leadership structure in having one person as both the 

full-time CIO and full-time Staff Director hinders the effectiveness and efficiency of 

agency business and the improvement of FEC programs. For several years, the OIG has 

reported on IT projects that have yet to be completed or properly implemented. Some of 

these projects include developing a Continuity of Operations Plan (COOP) and 

verification of user access authorities, both of which date back to FY 2004 as findings in 

the agency’s annual financial statement audit. In the FY 2014 audit report, the OIG 

recommended requiring OCIO project managers to prepare project plans to ensure 

adequate planning and completion of IT projects. The OIG is aware of seven on-going 

projects2 that currently do not have proper planning documents to manage the project.

In light of the reported agency IT system hacks in 2013 and more recent data breaches 

encountered by other government entities (Office of Personnel Management, State 

Department), it is imperative that the FEC has efficient and effective project planning and 

management processes to complete IT projects, such as the recent implementation of 

NIST standards, and other critical IT projects that ensure the security of FEC data. 

Therefore, the OIG has elevated IT project planning and management as a management 

challenge for FY 2015.

The IG’s annual assessment of management and performance challenges is based on 

information derived from a combination of several sources, including OIG audit and 

inspection work, Commission reports, government-wide risks factors, and a general 

 1 GAO-11-634 2 Number of IT projects is limited to the specific IT projects related to the annual financial statement audit 

and does not include other IT projects not reviewed in the audit. 
3

knowledge of the Commission’s programs and activities. The management and 

performance challenges are detailed in the attached report. The Reports Consolidation 

Act of 2000 permits agency comment on the IG’s statements. Agency comments, if 

applicable, are due November 16, 2015.

Lynne A. McFarland

Inspector General

Attachment

cc: Alec Palmer, Staff Director and Chief Information Officer

Judy Berning, Acting Chief Financial Officer 

Daniel Petalas, Acting General Counsel

Edward Holder, Acting Deputy Staff Director for Management and 

 Administration

Derrick Allen, Director, Office of Human Resources
4

FEDERAL ELECTION COMMISSION (FEC)

MANAGEMENT AND PERFORMANCE CHALLENGES

FY 2015

I. Information Technology Project Planning and Management

Management Challenge:

Management consistently lacks the proper planning documentation and oversight 

of IT projects that are critical to the fulfillment of the agency’s mission and are 

required to ensure the security and reliability of agency data.

Applicable Government Requirements/Best Practices Not In Place:

• Project Management Body of Knowledge Guidelines;

• OMB Memorandums:

 M-10-25 Reforming the Federal Government’s Efforts to Manage 

Information Technology Projects;

3

 M-12-27 Information Technology Baseline Management Policy.

Critical Agency Impacts:

4

A. FEC is not in full compliance with the following: 

 Federal Continuity Directive 1, Federal Executive Branch 

National Continuity Program;

 OMB Memorandum M-08-22 Guidance on the Federal Desktop 

Core Configuration.

B. Project funding wasted or exceeding original planned budget5

 User Access Review Project;

 COOP Project.

C. Continuous delays:

 COOP project outstanding since FY 2004;

 User Access Authorities project outstanding since FY 2004;

 Assessment and Accreditation project6 outstanding since FY 

2008.

D. Weak Internal Controls:

 Inability to certify that mission essential functions of the agency have 

the ability to operate in the event of a local disaster;

 Unable to verify if unauthorized disclosure of Personally Identifiable 

Information or confidential information has occurred.

 3 Updated by M-10-31, Immediate Review of Information Technology Projects. 4 This section only includes information from those IT projects audited or reviewed by the OIG and that 

have been determined by the OIG to be most critical to the agency. 5 User Access Review Project: The OCIO purchased applications software in 2009 and 2011 to implement 

this project, but both projects were terminated as management determined they did not meet the FEC’s 

business need., The FEC will soon be starting this project for yet a third time, with a scheduled completion 

date of April 2017, and purchasing new software tools. COOP Project: From FY 2008 to 2010, the FEC 

spent $277,506 on contractors to develop plans for each division that were never updated and are now 

obsolete. 6 Periodic evaluations of the agency’s systems to ensure the security of the information systems, in addition 

to documenting management’s approval that the systems are operable for a specific period of time based 

on the results of the evaluation.
5

II. Governance Framework

Management Challenge:

FEC lacks adequate structure and continued stability in key senior leadership 

positions that are accountable for the mission and objectives of the agency. 

Applicable Government Requirements/Best Practices Not In Place:

• 52 U.S.C. section 30106(f);

7

• Clinger-Cohen Act of 1996.

8

Critical Agency Impacts:

A. Agency vacancies – The FEC has several senior leader positions that have 

been vacant for a year or more.9

 General Counsel - position vacant since July 2013;

10

 Chief Financial Officer - position vacant since October 2012;

11

 Deputy Staff Director for Management and Administration - position 

vacant since August 2014;

12

 Failure to fill senior leader positions creates resource gaps. Critical 

management positions filled with acting FTEs due to vacant senior 

leader positions, including:

 Director of Accounting;

 Deputy Chief Information Officer of Operations.

B. Dual office holding – The CIO also serves as the Staff Director.

 Failure to establish singular oversight of the OCIO significantly 

contributes to the following issues:

 Delays in IT project implementation due to lack of adequate 

oversight;

 Failure to timely implement recommendations to improve FEC 

business processes and programs from OIG audits/inspection in 

accordance with OMB Circular A-50 and Commission 

Directive 50;

 Failure to timely implement recommendations from external 

contractors procured by ITD to improve FEC business 

processes.

13

 7 Statutory requirement mandating a General Counsel at the FEC. 8 As the FEC is exempt from the act, the government-wide standard should be used as best practice as the 

FEC’s CIO is responsible for all IT functions as identified in the act. 9 There are several vacant senior and management positions not included on this list that are filled by staff 

in an acting capacity.

10 The FEC recently assigned the Associate General Counsel for Enforcement as Acting General Counsel in 

August 2015.

11 The FEC assigned the Director of Accounting as Acting CFO in October 2012. 12 The FEC assigned the Deputy CIO of Operations as Acting Deputy Staff Director in August 2014. 13 Mandiant’s October 2012 Threat Assessment Report ($54,000); Solution Technology Systems Inc. 

Comprehensive review of FEC’s PII ($340,433.28) in FY 2008; IonIdea’s COOP development contract

($277,506) in FY 2008.
6

III. Human Capital Management / Human Resources Operations

Management Challenge:

The Office of Human Resources (OHR) lacks leadership stability and adequate 

resources to achieve its mission critical program goals and objectives. 

Applicable Government Requirements/Best Practices Not In Place:

• Office of Personnel Management (OPM) Guidance, including Human Capital 

Assessment and Accountability Framework;

• 5 CFR 410, 5 CFR 412, and 5 CFR 430;

14

• OPM’s 2014 Report on FEC’s HR Management Evaluation 

Recommendations.

Critical Agency Impacts:

A. Consistent turnover in the Director of OHR Position – The FEC has had 

four different OHR Directors since FY 2010. The current Director of OHR 

was hired in September 2015 and the previous Director was only in the 

position for approximately one year.

 Lack of stability and continuity in leadership roles leads to resource 

gaps, lack of direction, and low moral which has a direct impact on 

productivity and efficiency;

 Marginal progress in implementing standard operating procedures to 

improve customer service levels;

 Critical personnel policies and procedures have not been updated,

created, and/or approved;

 Lack of accountability to comply with OMB Circular A-50 and 

Commission Directive 50 to timely implement recommendations to 

improve FEC business processes and programs from OIG audits and 

inspections, as well as external audits.

 OPM 2014 Report of FEC’s HR Management Evaluation 

Recommendations have not been implemented (e.g. Training 

and Development Plans, Leadership Succession Plan).

B. Lack of resources to improve customer service levels– Lack of resources 

impact OHR’s ability to implement effective internal control improvements.

 Three vacant positions – one position has been vacant for over three

years, and one position has been vacant for over one year;

 The Remedy System implemented to automate and improve the 

tracking and timely response to employee inquiries is not conducive to 

the needs of the human resources operations.

 14 As an excepted service agency, the FEC is exempt from certain parts of Title 5. However, governmentwide standards should be used as best practices even if the agency is exempt from those sections. 
ATTACHMENT A

Management’s Response

(2015 Management’s Challenges)

7

• Federal Continuity Directive 1, Federal Executive Branch National Continuity Program;

• OMB Memorandum M-08-22 Guidance on the Federal Desktop Core Configuration.

Management Response:

• For all the new hardware installed, we are 100% compliant. Currently, we have 90 compliant 

machines. Because it is not possible to implement the plan on older hardware, the OCIO 

implementation plan is linked to the desktop hardware refresh cycle. Therefore, based on 

budget availability the remaining machines will be compliant during FY 2016-2017 during

new hardware implementation.

OCIO has provided OIG with the project plan of what we have accomplished thus far as an 

example, of which the IG’s office has accepted. 

B. Project funding wasted or exceeding original planned budget:

• User Access Review Project;

• COOP Project.

Management Response:

• Because much of the technology we currently have in place can no longer supports the 

strategic vision of the Agency regarding its IT security program, FEC is evaluating tools that 

can meet the strategic need of the Agency. OCIO expects this project to be a multi-year and 

multi-phase approach. The tools we are evaluating are in the range of $200K for an Agency 

our size. Pending approval of the Commission, we will acquire and implement the 

appropriate tools that will meet the FEC’s need for the next several years. OIG is aware of 

the changes in IT security that necessitate this new evaluation.

• During July and August, OCIO updated the COOP plan to ensure the document reflects the 

current operational details FEC would need to operate in the event of a local disaster. A copy 

of the plan was provided to the IG office in August FY15 for their information.

We disagree with the assessment that the Agency wasted funds on the COOP project. The 

framework for the COOP plan provided by the Contractor in FY 2010 is the foundation for 

the current plan that was updated in August. In FY 2015, we replaced the original 

equipment, which had become obsolete, with new Surface tablets that are compatible with 

new security technology and infrastructure. 

In September 2015, we tested the updated COOP. This test was a simulation of a local 

unavailability of the primary work site, with all designated COOP personnel working from 

their alternative work site. A full report of the test results will be available in November 

2015. In addition, depending on the results of the test, appropriate modifications will be 

made to the COOP and if additional testing is required, a project outline will be provided.

C. Continuous delays:

• COOP project outstanding since FY 2004;

• User Access Authorities project outstanding since FY 2004;

• Assessment and Accreditation project outstanding since FY 2008.

Management Response:

• During July and August, OCIO updated the COOP plan to ensure the document reflects the 

current operational details FEC would need to operate in the event of a local disaster. A copy 

of the plan was provided to the IG office in August FY15 for their information.

• The access re-certification projects were terminated because they no longer support the 

current operating environment of the FEC, and they no longer meet the strategic need of the 
FEC. OCIO will continue to end projects that no longer make sense for the FEC and start new 

projects that help the FEC continue advancement in the 21st century. 

• OIG is aware and has acknowledged OCIO’s continuous work in this area. OCIO is currently in 

the process of acquiring the service of a contractor to have the NIST Management 

Framework implemented (including SP 800-53r4) in the Agency. OCIO already provided 

OIG with a copy of the SOW for their review. As previously stated above, a project plan will 

be created by the contractor once the contract is awarded.

D. Weak Internal Controls:

• Inability to certify that mission essential functions of the Agency have the ability to operate 

in the event of a local disaster;

• Unable to verify if unauthorized disclosure of Personally Identifiable information or 

confidential information has occurred.

Management Response: 

• During July and August, OCIO updated the COOP plan to ensure the document reflect the 

current operational details FEC would need to operate in the event of a local disaster. A copy 

of the plan was provided to the IG office in August FY15 for their information.

In September 2015, we tested the updated COOP. This test was a simulation of a local 

unavailability of the primary work site, with all designated COOP personnel working from 

the alternate work site. A full report of the test results will be available in November 2015. 

In addition, depending on the results of the test appropriate modifications will be made to 

the COOP and if additional testing is required a project outline will be provided.

• The FEC is continually taking steps to improve its security posture by increasing its security 

capabilities. FEC is currently a member of agencies participating in the DHS Continuous 

Diagnostic and Mitigation (CDM) program. This program allows small, medium, and large 

agencies the ability to fill-in gaps in agency capabilities. The FEC is in Group 2F, which has an 

estimated date of award the 2nd quarter of FY16. Once the award is made the GSA/DHS, FEC 

may be able to leverage this program to get the necessary tools to verify if unauthorized 

disclosure of Personally Identifiable information or confidential information has occurred.

II. Governance Framework

Management Challenge:

FEC lacks adequate structure and continued stability in key senior leadership positions that are 

accountable for the mission and objectives of the Agency. 

Applicable Government Requirements/Best Practices Not In Place:

• 52 U.S.C. section 30106(f);

• Clinger-Cohen Act of 1996.

Critical Agency Impacts:

A. Agency vacancies – The FEC has several senior leader positions that have been vacant for a 

year or more.

 General Counsel - position vacant since July 2013;

 Chief Financial Officer - position vacant since October 2012;

 Deputy Staff Director for Management and Administration - position vacant since August 

2014;

 Failure to fill senior leader positions creates resource gaps. Critical management positions 

filled with acting FTEs due to vacant senior leader positions, including:

 Director of Accounting;
 Deputy Chief Information Officer of Operations

Management Response: 

• Management understands the importance of filling these key, vacant positions. It remains a 

challenge, however, to permanently fill these high-level positions. It should be noted that in 

the interim, the responsibilities of these positions are being fulfill by qualified, capable, 

hardworking individuals. Management is assisting the Commission in its recruitment, 

screening, and selection process.

B. Dual office holding – The CIO also serves as the Staff Director. 

 Failure to establish singular oversight of the OCIO significantly contributes to the following 

issues:

 Delays in IT project implementation due to lack of adequate oversight; 

 Failure to timely implement recommendations to improve FEC business processes 

and programs from OIG audits/inspection in accordance with OMB Circular A-50 

and Commission Directive 50; 

 Failure to timely implement recommendations from external contractors procured 

by ITD to improve FEC business processes.

Management Response: 

• Although management is appreciative of OIG’s recommendations, management is committed 

to prudent management, the strategic distribution of resources, and minimal acceptance of 

risk. 

• The proper emphasis and attention has been afforded to all areas of management. 

Accountability is essential to ensuring progress in completing OIG’s recommendations 

where management and OIG agree, and will continue to take action to ensure such progress. 

Management has appropriately responded to the applicable recommendations across 

functional areas within the Agency and will continue to do so. 

• In 2011, the Commission approved, that the Staff Director and Chief Information Officer 

(CIO) positions would be filled by one FEC employee. IT is a critical part of the Agency’s 

mission in disclosing campaign, finance information to the public and an area of concern 

regarding IT security and the current employee who fulfills both the Staff Director and CIO 

positions is fulfilling his obligations as directed by the Commission. Significantly, the 

auditors’ assessment does not identify any specific delays in IT project completion related to 

the CIO also serving as the Staff Director. Generally speaking, any perceived delays in IT 

project implementation can be related to delays in funding, staffing, inadequate cross 

functional support and antiquated IT contracting rules (which are currently under review by 

the Administration). The auditors do not identify, and management is not aware of, any case 

where the fact that the CIO also serves as the Staff Director has led to project delays. Indeed, 

this year, under the leadership of the current CIO, OCIO has accomplished more in both the 

strategic and tactical arenas than any other year, especially in the area of security.

• OCIO has implemented all the primary recommendations from the Mandiant report. The 

supplemental recommendations will fall under larger projects OCIO is currently working on 

and/or plan to implement in FY16. For example, as part of the USGCB project, admin access 

from client machines will be removed as OCIO refreshes its client machines. OCIO also made 

a recommendation to eliminate xmail that would address this finding. The Commission 

instead decided to implement multi-factor authentication for “webmail” as the Agency

moves from Lotus Notes to Office365 early next year. 

Additionally, in order to improve the business process, an external contractor provided a PII 

inventory to FEC and actions were taken based on this inventory, as appropriate.
• As OIG acknowledged, management agreed with the recommendation to formally adopt 

NIST as its risk management framework and OCIO has taken steps to comply with the 

appropriate NIST standards for this Agency. These improvements and the OIG’s 

recommendation to implement a Trusted Internet Connection (TIC) have been made under 

the current OCIO leadership. 

• FEC followed the framework for the COOP plan provided by the Contractor in FY 2010. Since 

then, the equipment has become obsolete. In FY 2015, we replaced the original equipment, 

which had become obsolete, with new Surface tablets that are compatible with new security 

technology and infrastructure.

III. Human Capital Management / Human Resources Operations

Management Challenge:

The Office of Human Resources (OHR) lacks leadership stability and adequate resources to achieve its 

mission critical program goals and objectives. 

Applicable Government Requirements/Best Practices Not In Place:

• Office of Personnel Management (OPM) Guidance, including Human Capital Assessment and 

Accountability Framework;

• 5 CFR 410, 5 CFR 412, and 5 CFR 430;

• OPM’s 2014 Report on FEC’s HR Management Evaluation Recommendations

Critical Agency Impacts:

A. Consistent turnover in the Director of OHR Position – The FEC has had four different OHR 

Directors since FY 2010. The current Director of OHR was hired in September 2015 and the 

previous Director was only in the position for approximately one year. 

 Lack of stability and continuity in leadership roles leads to resource gaps, lack of direction, 

and low moral which has a direct impact on productivity and efficiency; 

 Marginal progress in implementing standard operating procedures to improve customer 

service levels;

 Critical personnel policies and procedures have not been updated, created, and/or 

approved;

 Lack of accountability to comply with OMB Circular A-50 and Commission Directive 50 to 

timely implement recommendations to improve FEC business processes and programs from 

OIG audits and inspections, as well as external audits.

 OPM 2014 Report of FEC’s HR Management Evaluation Recommendations have not 

been implemented (e.g. Training and Development Plans, Leadership Succession 

Plan).

B. Lack of resources to improve customer service levels– Lack of resources impact OHR’s ability 

to implement effective internal control improvements.

 Three vacant positions – one position has been vacant for over three years, and one position 

has been vacant for over one year;

 The Remedy System implemented to automate and improve the tracking and timely 

response to employee inquiries is not conducive to the needs of the human resources 

operations.

Management Response: 

• The FEC hired a new Director of Human Resources in the final month of the fiscal year. As he 

assesses the office's current policies and practices, his top priorities are improved Customer 

Service, Human Capital Management, and updating Policies and Procedures. He is working 

to hire additional resources to address these priorities and improve overall HR performance. 
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015