Federal Election Commission

Office of Inspector General

Inspector General Statement on the

Federal Election Commission’s

Management and Performance

Challenges - 2018
Table of Contents Page

Inspector General Statement on the FEC’s Management and Performance Challenges.........1-8

Attachment A: Response to OIG’s Statement on the FEC’s Management

 and Performance Challenges.............................................................................9

Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges for Fiscal Year 2018

2

Overall Challenge: Governance and Management Framework

The FEC’s overall governance framework needs improvement to contribute to the 

success of the agency. The lack of accountability from Governance regarding critical

management issues and the inadequate leadership structure of management has a negative 

impact on the agency achieving its mission efficiently and effectively. This challenge 

creates several critical management and performance challenges within the agency. 

Challenge 1: Governance Accountability

A. Low Employee Morale

Due to the consistent low ranking of the FEC in the results of the annual Federal 

Employee Viewpoint Survey (FEVS), the OIG contracted with a consultant company to 

conduct a study to determine the root causes of the low employee morale at the agency. 

The study revealed that the following factors are the root causes of low employee morale:

 Commissioners;

 Accountability;

 Management;

 Communication; and 

 Other (diversity, career development)

The FY 2017 FEVS results places the FEC at 27 of 28 best places to work amongst small 

agencies. Additional survey data identified that less than half of the agency staff 

participated in the survey. The continued low agency ranking and minimal participation 

of FEC staff in the survey demonstrates the impact of the low employee morale at the 

FEC. 

Since the employee morale study has been released, we acknowledge management’s 

improvements in the area of communication regarding critical agency-wide projects, 

specifically, the recent relocation of the agency’s headquarters. However, as low 

employee morale has a direct effect on accomplishing the agency’s mission, we believe 

that an action plan from top level management to address all the root causes of low 

employee morale is still critical. The most important part of a solid control environment 

is the “Tone at the Top,”

1 which permeates down to create the philosophy and operational 

style that sets the culture of the agency. The OIG believes that without a continued, 

sincere effort by Governance to address morale issues, the objectives of the agency’s 

offices and divisions will continue to be negatively impacted, increasing the risk of the 

agency not efficiently and effectively meeting its mission. 

B. Enforcing Required Management Roles and Responsibilities

It is imperative to the success of the agency that Governance holds management 

accountable for adequately fulfilling their roles and responsibilities in addressing 

 

1 The term “Tone at the Top” is used to define the commitment of top level management to honesty, 

integrity, openness, and ethical behavior in achieving an organization’s mission and objectives. 
Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges for Fiscal Year 2018

3

identified risks of fraud, waste, abuse, and program deficiencies. The OIG and external 

entities have reported risks and deficiencies in agency programs that management has not 

addressed or have made a low priority for several years. According to the Office of 

Management and Budget Circular A-123 (OMB A-123), Management’s Responsibility 

for Internal Control, deficiencies reported “...through internal review or by external 

audit, should be evaluated and corrected.” Further, FEC Commission Directive 50 states, 

“All management officials are responsible for receiving and analyzing audit reports, 

providing timely responses, and take corrective action, if needed.” However, the agency 

has 612outstanding recommendations that have been reported by the OIG, in which many 

have been reported since FY 2004.

Management’s prior year response to this challenge stated they are following FEC 

Commission Directive 50, reporting semiannual progress of outstanding 

recommendations to the Commission. However, the updates provided show little to no 

progress, and in many cases the corrective action due dates are continuously extended

with no management corrective action taken. In addition, the recently developed FEC 

Senior Management Council (SMC) to address OMB Circular A-123 requirements for 

oversight of internal controls and enterprise risk management, developed their initial risk 

profile and identified many control issues related to long outstanding recommendations

such as Privacy and Data Protection and Disaster Recovery Plan and Continuity of 

Operations Plans as only a “medium” risk to the agency. However, the OIG has issued 

reports on these specific areas that contain critical weaknesses that expose a high risk to 

the agency, and these reports have recommendations that have been outstanding for five

years or more. 

Collectively, these long outstanding issues that have been reported to management 

address risks to the agency’s mission, assets, government funding, and compliance with 

laws and regulations. The remediation of these issues is essential to reducing the high 

likelihood of the risk exposure to the agency, warranting Commission attention and for 

management to institute corrective action. 

Challenge 2: Longstanding Vacancies in Senior Leadership Positions

The FEC lacks continued stability in key senior leadership positions that are accountable 

for the mission and objectives of the agency. The FEC’s SMC initial risk profile for the 

agency rated multiple agency vacancies as a “very high” risk for the agency, and the OIG 

agrees with this management risk assessment.

Operating the agency with several vacant permanent senior leader positions, some staffed 

with personnel in acting roles, creates an unstable environment that runs the risk of 

noncompliance with applicable federal laws and regulations. This ultimately puts the 

agency at risk of not efficiently and effectively meeting the agency’s mission. The 

following critical FEC senior leadership positions are currently vacant or filled only by 

staff in an acting capacity:

 

2 The total recommendation count includes the 11 repeat recommendations from the FEC’s FY 2017 

Financial Statement Audit and the 50 recommendations included in the OIG’s Review of Outstanding 

Recommendations as of August 2018. 
Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges for Fiscal Year 2018

4

 Chief Financial Officer – vacant since October 2012

 General Counsel- vacant since July 2013

 Deputy Staff Director - vacant since August 2014

 Inspector General - vacant since March 2017

Failure to fill these senior leadership positions in a timely manner with permanent fulltime employees also creates resource gaps. When senior leader positions are vacant or 

filled with those in acting positions on a long-term basis, voids are often created in 

management positions that are responsible for the adequate oversight of daily operations. 

Thus, the following management level positions are currently vacant with only some 

having an acting personnel assigned:

 Chief Information Security Officer 

 Director of Human Resources 

 Accounting Director

 Budget Director

 Deputy General Counsel for Law

 Deputy Chief Information Officer of Operations

As many of these positions require specialized knowledge and skills to ensure office 

operations are effectively and efficiently supporting the overall mission of the agency, 

assigning acting personnel to many of these vacant positions on a long term basis is not 

an efficient solution. It is imperative that the Personnel Committee elevate the importance 

of filling these vacant senior leader and management positions as a priority to ensure 

consistency and clear direction in the leadership of the agency. 

Challenge 3: Organizational Structure

Per OMB Circular A-123, management is responsible for complying with the Control 

Environment standard. Specifically, “Within the organizational structure, management 

must clearly: define areas of authority and responsibility, appropriately delegate the 

authority and responsibility throughout the agency; establish a suitable hierarchy for 

reporting.” Based on deficiencies noted within the agency’s programs and business 

processes via OIG reports and reviews by external entities, management is not in 

compliance with the required Control Environment standard. 

A. Information Security Program

Since 2004, the OIG has reported the need for the FEC to make improvements to its 

information security controls. Through audits and assessments conducted by the OIG and 

external entities, remediating weaknesses within the agency’s information security 

program has been identified as a low priority. As examples, currently the FEC’s annual 

financial statement audit includes several long outstanding audit findings related to the 

security of FEC information, some initially reported in FY 2004. In addition, an OIG

report, Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations 

Plan, released in January 2013 still has outstanding audit recommendations that identify 

areas of high risk to agency information and have yet to be addressed by management. 
Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges for Fiscal Year 2018

5

This issue has also been identified by external entities who have worked with FEC 

management to conduct evaluations and assessments of the agency’s security measures. 

For instance, in June 2017, the agency was provided an analysis from Cyber.gov Systems 

Analysis Team who stated that there is a “lack of prioritization of cyber security” within 

the FEC, and recommended that the agency “prioritize cyber security alongside IT 

operations in strategic and operational planning.” Following in July 2017, the Department 

of Homeland Security (DHS) provided a report to the FEC stating that cyber security at 

the agency “competes with and is often secondary to IT operations.”

In addition to the need for prioritization, the agency’s Information Security Office 

requires restructuring to ensure the agency meets its mission requirements efficiently and 

effectively over the next several years, with a high level of accountability, per the 

requirements of the agency Reform Plan outlined in OMB Memoranda M-17-22. As 

noted above in Challenge 2, one of the critical management positions that is currently 

vacant is the FEC Chief Information Security Officer (CISO). As the position has only 

been vacant for a short amount of time, due to the increasing security requirements and 

the agency’s current need for improvements to its information security program, it is 

critical that the agency not only fill this position with a qualified security professional, 

but also elevate this position to provide proper management authority. Through the 

OIG’s management exit conference meetings held with the two prior FEC CISOs, it was 

noted that both persons separated from the agency due to the need of the position to be 

elevated3to achieve proper authority and effective operations. In addition, both prior 

CISOs also noted a need for additional support staff within the Information Security 

Office to ensure progressive maturity of the agency’s information security program.

Not only do the long outstanding information security control weaknesses reported by the 

OIG support the need for this restructuring, but the external assessments noted above also 

support the concerns of the prior CISOs. The Cyber.gov analysis specifically notes that 

the “CISO position at management level reduces effectiveness” and recommends that the 

FEC “elevate seniority level of [the] CISO”. The analysis also recommends that the FEC 

“develop a cybersecurity team” as the office is currently staffed with only one full-time 

employee with the CISO vacancy. This point is further stressed in the subsequent report 

from DHS which states the need for FEC to “increase FEC cybersecurity staffing.”

Further, the FEC is also in need of an applicable government-wide framework to support 

the agency’s information security program. As the FEC’s Office of General Counsel has 

determined that the agency is legally exempt from the Federal Information Systems 

Management Act, an applicable framework for information security has not been formally 

adopted or adequately implemented. The OIG has recommended that the FEC formally 

adopt the applicable standards of the National Institute of Standards and Technology 

(NIST) as its framework since FY 2009, but the agency has not sufficiently implemented

this recommendation. The June 2017 DHS report states, “FEC elects to integrate the NIST 

SP 800-37r1 into their security architecture, but does not implement or follow the guidelines 

of NIST 800-53Ar1...”

 

3 CISO position is currently staffed at a GS 14, which is lower than those who the CISO must provide 

instruction and direction to, such as Deputy Chief Information Officers, to ensure proper security measures 

are carried out. 
Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges for Fiscal Year 2018

6

We do note that the agency has made significant improvements by updating many 

policies and procedures to address identified control weaknesses, reducing the number of 

outstanding vulnerabilities, and most notably, assessing and authorizing the operations of 

major agency systems. In order to continue addressing outstanding security control 

issues, ensure the agency is compliant with applicable security requirements, develop a 

plan to fully implement an acceptable government-wide security framework, and 

ultimately work to develop a sufficiently mature FEC security program, the information 

security program and office at the FEC must be revamped to address these major 

challenges. 

B. Proper Leadership Structure

Currently, the senior leadership roles of the Staff Director and Chief Information Officer 

(CIO) are filled by the same individual. As both senior leader positions are critical to the 

agency, we strongly believe these two positions should have separate full time personnel 

solely dedicated to each position. The current structure does not with OMB’s control 

environment standard to “appropriately delegate the authority and responsibility 

throughout the agency,” and “establish a suitable hierarchy for reporting.” Specifically, 

FEC employees and supervisors have expressed concerns of inhibition with reporting 

significant personnel concerns or technology issues as the oversight of these issues are 

reported to the same individual. Further, this dual position presents at minimum an 

appearance of bias, as there is only one person with oversight over more than half of the 

agency’s programs, and a large portion of the agency’s operating budget. 

The Office of the Chief Information Officer’s (OCIO) processes and controls are also 

impacted by not having a fully devoted CIO. There are several reported control 

weaknesses within the FEC’s information security program that have been reported in 

more than one OIG report, with some recommendations being outstanding as long as 14 

years. In response to this challenge in the prior year’s report, management provided 

examples of processes and policies that have been implemented to address these OIG 

reported control weaknesses. However, these management actions have been reviewed by 

the OIG and external auditors each year and found to be insufficient to fully address the 

reported issues, and they continue to be reported in the annual financial statement audit 

and the OIG’s annual Review of Outstanding Recommendations report. Without a fully 

dedicated CIO to focus on these issues to ensure resources are properly allocated, and 

adequate processes are in place for the protection and safety of the agency, the agency 

will remain at high risk for fraud, waste, and abuse.

C. Senior Agency Officials for Privacy

Per OMB Memorandum 16-24, Role and Designation of Senior Agency Officials for 

Privacy, the designated SAOP [Senior Agency Official for Privacy] should serve in a 

“central leadership position at the agency,” and have “agency-wide responsibility and 

accountability for the agency’s privacy program.” The agency’s Privacy Program is 

currently a shared role between the Office of General Counsel (OGC) and the OCIO, 

with the designated SAOP being a shared role assigned to the Deputy CIO of Operations

and the Deputy General Counsel. This current agency structure has not shown to be 
Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges for Fiscal Year 2018

7

effective or efficient, supporting the OIG’s recommendation to have one person solely 

dedicated and knowledgeable of privacy issues to oversee the agency’s Privacy Program. 

As of August 2018, the Deputy CIO of Operations retired from the agency, and this 

portion of the SAOP role has been assigned to an OGC attorney, serving as the Acting 

Deputy Staff Director. Management noted in their prior year response to this challenge, 

that “the official in each of those positions has significant oversight over a discrete 

portion of the agency’s Privacy Program;” however, the current structure of having two 

attorneys with oversight of the agency’s Privacy Program does not ensure coverage of the 

privacy regulations over information security which has been heavily enhanced through 

the recent revisions of OMB Circular A-123, and the applicable privacy requirements 

included in guidance such as OMB Memoranda M-17-2 Preparing for and Responding to 

a Breach of Personally Identifiable Information and M-18-02, Guidance on Federal 

Information Security and Privacy Management Requirements. The lack of proper 

oversight for the information technology and security portions of the Privacy Program

places the agency at greater risk of being susceptible to privacy breach issues. 

An example of the inefficiencies to the Privacy Program is demonstrated in the lack of 

progress made in implementing the recommendations in the 2010 Follow-up Audit of 

Privacy and Data that was released in March of 2011. Management included in their 

prior year response to this management challenge a table noting several recommendations 

that have been completed by management, resulting in only nine remaining open 

recommendations, and stated that “the OIG sought to re-open multiple 

recommendations...management has not been able to discern the rationale for such reopenings nor convince OIG that these recommendations had been completed.” 

The OIG notes that this narrative from management is inaccurate. Currently, there are 23 

outstanding recommendations related to privacy issues, including issues that haven’t been 

resolved since 2009.

4

 In addition, the OIG contacts management twice a year for status 

updates regarding open recommendations. Specifically for the past eight follow-up 

reviews (2015 – present)5the OIG has requested adequate documentation from 

management to support any corrective actions taken, and has provided feedback to 

management regarding our review and any deficiencies noted that impacted the closure of 

an open recommendation. Also during the noted review period above, management 

specifically stated on several occasions that they had made no corrective actions. These 

review details are captured and publicly posted in each of the OIG’s Review of 

Outstanding Recommendations reports. Further, as noted in our February and August 

2017 review reports, the OIG agreed to schedule a separate meeting to discuss each open 

recommendation; however, on the meeting day, management provided no feedback or 

documentation to support stated corrective actions. During subsequent follow-ups

management did not provide feedback or respond to meeting requests. 

 

4 An inventory of FEC systems containing Personally Identifiable Information (PII) was conducted by 

Solution Technology Systems Inc. who provided recommendations to enhance the protection of PII. The 

report was dated May 20, 2009, and no further action has been taken by management. 

5 Review details are documented in the OIG’s Review of Outstanding Recommendations reports posted on 

the OIG’s external website. 
Inspector General Statement on the Federal Election Commission’s 

Management and Performance Challenges for Fiscal Year 2018

8

OGC recently hired an attorney with responsibilities specifically focused on 

administering the FEC’s Privacy Act Program. The OIG has worked with the new 

privacy attorney regarding the outstanding privacy issues and was able to receive an 

updated management Corrective Action Plan report containing revised due dates, some 

updated corrective action plans, and closed two of the open recommendations. Although

adding additional resources in support of the Privacy Program is a great asset to the 

agency, it should be noted that the new privacy attorney does not have expertise in 

privacy issues related to information technology. As the current FEC SAOP structure 

requires two management positions covering Privacy Law and IT security, the FEC’s 

Chief Information Security Officer position is currently vacant,

6

and the assigned acting 

SAOP for IT coverage also does not have IT security expertise to advise the privacy 

attorney in this specific area. 

 

6 The Chief Information Security Officer was placed on the Privacy Program team in support of the SAOP 

IT role. 
9

ATTACHMENT A

Management’s Response

(2018 Management & Performance Challenges)
Management’s Response to the Office of Inspector General’s Statement on the 

Federal Election Commission’s Management and Performance Challenges1

November 13, 2018 

In its Statement on the FEC’s Management and Performance Challenges (“Statement”), the 

Office of the Inspector General (“OIG”) identified three overarching management and 

performance challenges for inclusion in the FEC’s Agency Financial Report for Fiscal Year 

2018. Management’s response to the OIG statement is below. 

Challenge 1: Governance Accountability 

A. Low Employee Morale 

Management is committed to investing time, resources, and effort to make a lasting impact 

and improvement to the morale of FEC employees. Management believes the efforts 

highlighted in the FY17 Response to the OIG Statement on Management and Performance 

Challenges have contributed to meaningful gains in employee morale. 

The 2018 FEVS results were recently released and the FEC had an eight percentage point 

gain in employee satisfaction.2

 The FEC had the second largest gain of all small agencies 

with more than 100 employees. Additionally, the FEC went from having less than half of its 

employees responding in the survey in FY17 to 61% responding to the FEVS survey this 

fiscal year, fifteen percentage points above the government-wide average. Out of 71 items in 

the survey, 64 had positive gains when compared to FY17 results. Of particular note is that 

these gains came in the midst of significant changes at the FEC, primarily the move to a new 

location. 

We recognize that there are multiple factors that contribute to morale at the agency, and there 

are no simple solutions. The Commission has an exceptional workforce filled with dedicated 

professionals whose hard work and commitment to excellence enables the agency to carry 

out its essential mission. For this reason, it is vital that we continue to foster a workplace that 

is positive and productive, where everyone feels valued. Some of the efforts that 

management has made since the release of the Morale Study and that have continued in 

FY18 are summarized below: 

Management Performance Plans. The following items were included in all management 

performance plans for the 2017-18 review year, as well as the 2018-19 review year: 

 Engage in efforts to improve morale and foster a culture of trust within the 

manager’s area of responsibility, including implementing recommendations from 

the Morale Study. 

                                                            

1

 Management consists of the agency’s senior managers, including the Staff Director, General 

Counsel and Chief Financial Officer. 

2

 https://www.govexec.com/management/2018/10/agencies-biggest-gains-and-losses-employeehappiness/152417/?oref=govexec_today_pm_nl 
 Engage in efforts to improve as a manager, including training, participation in a 

360 Review, and development and implementation of a Leadership Development 

Plan. 

 Provide training opportunities (both formal and informal) for all staff. Utilize inhouse resources including Skillport and OCIO one-on-one trainings. 

 Meet with each employee at least one time during the performance year in 

addition to the six-month and annual reviews to get the employee’s input on how 

things are going and ideas for improvement. 

Involving Staff in Preparation for the FEC’s Office Space Move. Throughout the entire 

FEC move process, management was committed to engaging and informing staff. Bargaining 

Unit members served on the Lease Renewal Advisory Team and on each of its 

subcommittees. Management also regularly updated the internal portal, “FEC Move,” on the 

agency’s intranet page that provided LRAT meeting minutes, photos of construction 

progress, and news about the move. 

Management Training. The agency has undertaken multiple training programs to target 

some of the areas where improved management performance is necessary to boost employee 

morale. Trainings have been held on areas including diversity and inclusion, conflict 

resolution, general management skills, and individual leadership training. Management is 

continuing this momentum by partnering with OPM to deliver on-site supervisory training to 

managers later this month. Management has also placed an emphasis on training, including it 

as a target in our annual performance and budget plans submitted to OMB and Congress. 

Since September 2016, over half of agency managers have undertaken 360 Reviews 

conducted by OPM and developed leadership plans to develop strengths and improve. 

Importantly, language has been added to all managers’ performance plans requiring that the 

managers demonstrate a commitment to improving morale and documenting steps taken 

within his or her area of responsibility. 

Staff Professional Development. Divisions throughout the agency continue to give staff 

opportunities for professional growth. 

 OGC detail program with the US Attorney’s Office in the District of Columbia, 

which provides staff attorneys the opportunity to prosecute general misdemeanor 

cases and develop their investigative and litigation skills; 

 OGC staff opportunities to serve details within different divisions in the Office; 

 OCIO staff partnering one-on-one with staff from the General Services 

Administration’s 18F to learn new information technology skills; 

 Information Division conducted training sessions for agency staff that participate 

in outreach efforts to learn how to maximize webinar participation; 

 RAD conducted branch-wide professional development months focused on skills 

training and one-on-one coaching sessions available to all staff; 

 Brown-bag lunches and informational sessions where staff can learn about what 

other divisions do and ask questions of senior staff and Commissioners; and

 Expanded opportunities for eligible FEC staff to compete for detail positions and 

temporary promotions within the agency. 
Diversity in Hiring and Promotion. Agency managers have undertaken a substantial effort 

to expand the diversity of the pool of applicants that apply for FEC positions, including OGC 

reaching out to local law schools, and having ongoing dialogs with Black Law Students 

Associations and Hispanic Latino Law Student Associations. OGC also launched an ongoing 

externship opportunity with Howard Law School, as well as participated in a Latina/o 

Alumni Association of the Washington College of Law (American University) externship 

program offered for displaced law students from the University of Puerto Rico. Agency 

managers continue to ensure that hiring panels are diverse and inclusive, ensuring that 

multiple viewpoints are present. 

Communication. Management has undertaken efforts to communicate more clearly and 

consistently across the agency as well as within divisions. Each division has been 

encouraged to hold regular division meetings, and senior leaders routinely attend those 

meetings to answer questions on any topic, as schedules have allowed. We have also 

attempted to be more proactive in getting information out. Some divisions are holding 

brown bag lunch and learn programs and are undertaking other, informal activities to give 

staff and managers a chance to interact. Most importantly, management continues to 

encourage an open door policy for employees to come with any questions or concerns at any 

time. 

Management understands that improving morale is not a one-off, “check the box” project. 

Our efforts on this front will continue. 

B. Enforcing Required Management Roles and Responsibilities 

Management follows FEC Commission Directive 50, reporting semi-annually on the 

progress of all outstanding recommendations identified in OIG audits. As was highlighted in 

the May 2018 submission of Corrective Action Plans, progress was made to close some 

longstanding items in the COOP/Disaster Recovery Plan and Privacy and Data Protection 

CAPs. Management will be circulating Corrective Action Plans in November 2018, which 

will show significant progress to close remaining items in the Human Resources audit. 

Pursuant to the Federal Managers Financial Integrity Act (FMFIA) and OMB Circular A123, the FEC established guidance to describe a Senior Management Council (SMC) for 

oversight of internal control and enterprise risk management (ERM) activities throughout the 

agency. The SMC meets, at minimum, on a quarterly basis and includes senior agency 

officials from all divisions of the FEC. The SMC is chaired by the agency Chief Financial 

Officer (CFO), who – with the agency Staff Director and General Counsel – is responsible 

for discussing recommendations for action with the FEC Commissioners regarding internal 

control and ERM actions, required for the agency to remain compliant with the FMFIA and 

OMB Circular A-123. 

The SMC helps ensure that the FEC implements and maintains a strong internal control 

framework including a positive internal control environment featuring top management 

commitment to the values of promoting the highest ethical standards and organizing all 

program and administrative processes to promote accuracy, efficiency, and compliance with 
all applicable laws and regulations, and to minimize, prevent, or promptly detect and correct 

any instances of fraud, waste, abuse, and mismanagement. The control environment will 

include promoting internal control knowledge and awareness among all staff. 

While the entrenchment of strong internal controls requires the active involvement of all 

agency personnel, this council recognizes that the most effective means of maintaining a 

robust internal controls environment requires a definitive and united “tone at the top.” This 

council involves the senior leaders and key managers who are all committed to this mission 

and the continual improvement of the internal controls environment of the FEC. 

During FY18, the SMC formally met to review and assess the risk profile for the agency. 

The SMC adjusted the agency’s risk profile after the departure of a Commissioner and after 

the move to the new building location. Management is committed to regularly assessing the 

agency’s risk profile and ensuring that adequate measures are in place to mitigate any risks. 

The SMC also communicated regularly when reviewing the annual A-123 submissions from 

FEC divisions. 

Challenge 2: Longstanding Vacancies in Senior Leadership Positions 

Management acknowledges that there are vacancies throughout the agency. Management 

continues to work with the Personnel and Finance committees for approval to post and hire 

qualified individuals for all of the identified positions. As identified by the OIG, the positions 

of Chief Financial Officer, General Counsel, Deputy Staff Director for Management and 

Administration, and the Deputy Chief Information Officer for Operations are all currently 

filled by qualified full-time employees on an acting basis. By statute, only the Commission 

can select a permanent General Counsel and Inspector General; and by agency practice, the 

same is true of the Chief Financial Officer. The Commission has recently selected an 

Inspector General and is nearing the conclusion of the hiring process for a Chief Financial 

Officer. Additionally, the Personnel Committee has approved the following positions to be 

filled on a permanent basis: Deputy Staff Director for Management and Administration, 

Deputy Chief Information Officer for Operations, and Chief Information Security Officer. 

All of these positions are currently in the hiring process and we anticipate concluding the 

hiring process in the next couple of months. As the senior leadership vacancies are filled, the 

Personnel and Finance Committees will closely scrutinize any remaining vacancies. In light 

of recent budget guidance from the Office of Management and Budget, prudent management 

requires that close examination is paid to the potential impact of each vacancy that is 

approved to hire. The Personnel and Finance Committees are committed to analyzing the 

current FEC workforce and looking ahead to fiscal years in order to avoid having to 

implement a reduction in force. 

Challenge 3: Organizational Structure 

A. Information Security Program 

OIG raises the concern that the FEC Information Security Program needs to be prioritized. 

Management shares this view and has committed considerable resources towards 
strengthening the FEC’s information security program. OIG also highlights the need to 

elevate the seniority level of the Chief Information Security Officer. Management recently 

requested assistance from OPM’s HR Solutions to review and reclassify the CISO position as 

a GS-2210-14/15, elevating the position to the same level as the two Deputy Chief 

Information Officers. Management is currently in the hiring process to recruit a new 

individual to fill this elevated role. 

Consistent with advice from the Office of General Counsel and in accordance with the 

Commission’s decision, the OCIO continues to implement a NIST-based Risk Management 

Framework (RMF) for the three most critical information systems-- the General Support 

System, E-Filing System, and Agency website. On September 15, 2017, in response to a 

request from the Deputy Inspector General, the Acting General Counsel and Chief 

Information Officer submitted a memorandum explaining the impact of the Commission’s 

decision and the steps OCIO has taken to implement the RMF. OCIO will continue to brief 

the Commission and Senior Management on necessary changes to the IT Security Program 

and continuously identify and mitigate risks in consultation with the Senior Management 

Council. 

B. Proper Leadership Structure 

OIG raises the concern that having the positions of Staff Director and Chief Information 

Officer filled by the same individual concentrates oversight of a significant portion of the 

agency’s operating budget under a single individual. It should be noted that prior to the 

current incumbent becoming Staff Director, the Chief Information Officer reported to the 

Staff Director. When the current incumbent became Staff Director, the Commission made 

the CIO position one that reported directly to the Commission. Assuming the Commission 

would return to prior practice if separate individuals were appointed to fill each position, the 

CIO would again report to the Staff Director and the portions of the budget identified by OIG 

would still be under the ultimate control of a single individual – that is, the Staff Director. 

Moreover, all agency IT projects are required to be approved by the Finance Committee prior 

to OCIO initiating the project, and approval of the full Commission is required before 

undertaking long-term projects of high magnitude, such as the redesign of the Commission’s 

website. This reporting structure does not put the FEC at any greater risk for fraud, waste, or 

abuse. In reality, it allows for expedited decisions through the proper change control 

processes of the Finance, Personnel, and IT committees. 

C. Senior Agency Officials for Privacy 

The OIG states the “agency’s Privacy Program is currently a shared role between the Office 

of General Counsel (OGC) and the OCIO, with the designated SAOP being a shared role 

assigned to the Deputy CIO of Operations and the Deputy General Counsel.” However, this 

is incorrect. The FEC’s Privacy Program is a shared role between the Office of General 

Counsel and the Office of the Staff Director, who in turn can designate officials to act in their 

capacity. The SAOP is a shared role between the Deputy General Counsel for Administration 

and the Deputy Staff Director for Management & Administration. The Privacy Team 
includes the Chief Information Security Officer, the Administrative Law Team, and other 

individuals as needed. The OIG highlights that the individual currently serving as Deputy 

Staff Director for Management and Administration in an acting capacity is an attorney. As a 

result, OIG questions whether having two attorneys overseeing the Privacy Program would 

not ensure coverage of information security. Management disagrees with this, since the 

individual serving as Deputy Staff Director is not serving as a practicing attorney in this role. 

The current arrangement ensures that privacy issues are adequately addressed throughout the 

agency and accounts for the collateral nature of the duties for the senior leaders performing 

the duties. Additionally, in FY18 the Administrative Law Team hired an attorney with 

significant experience in the Privacy Act to be able to assist management with resolving 

these longstanding issues. She will also be taking a rigorous information security training; 

upon completion she will be accredited as a Certified Information Systems Security 

Professional (CISSP), which will provide additional cross-pollination of knowledge between 

the legal and information security branches of the Privacy Team. Management is confident 

the current Privacy Team structure adequately addresses legal concerns and information 

security through having a dedicated administrative law attorney and the CISO. 

As noted by OIG, a revised corrective action plan was put in place and two open 

recommendations were closed. There is currently an individual serving in an acting capacity 

for the CISO role who has the expertise regarding IT security to competently advise the 

privacy attorney of IT related issues. 

Outstanding Recommendations 

The OIG states that the current Privacy Audit has 25 outstanding recommendations and that 

the Co-SAOPs have not made any significant progress on the Privacy Audit’s outstanding 

recommendations since June of 2013. Referring to these alleged outstanding 

recommendations, OIG claims that during the most recent review, “the SAOPs did not 

respond to any of the OIG’s inquiries to discuss the current open recommendations.” OIG 

helpfully shared with Management the 25 Privacy CAP recommendations considered to be 

outstanding earlier this year. Management respectfully disagrees with this assessment, 

concluding that there are only nine outstanding recommendations. Indeed OIG has reopened multiple closed recommendations, including some recommendations closed more 

than six years ago. Moreover, OIG’s claim that the Co-SAOPs have not made “any 

significant progress” since June 2013 ignores ten of these “outstanding recommendations” 

that have been completed since that date.3

 However, as a result of conversations with OIG, 

OGC’s new FOIA/Privacy Act attorney has begun addressing these outstanding 

recommendations so as to find ways to reach agreement with OIG on what is needed to close 

                                                            

3

 Additionally, in a January 23, 2017 memorandum to the Inspector General, the Co-SAOPs 

accepted the identified risks of not implementing OIG’s recommendations for two outstanding 

recommendations (1a and 7b). In that memorandum, Management also noted that although two 

other recommendations (6c and 6e) had been implemented and Management had provided 

documentation that the recommended tasks were completed in May and June of 2015, 

Management would accept the identified risks “[t]o the extent OIG believes the identified tasks 

are insufficient to meet the recommendations.” It appears that recommendation 6e remains open 

for OIG’s purposes. 
specific recommendations. Most of the successes of this reinvigorated partnership with OIG 

will most likely be seen in the FY19 report, but it is our understanding that OIG has agreed 

that recommendation number 10b is now closed as of August 22, 2018. 

The breakdown of OIG’s 24 “outstanding recommendations” (now that recommendation 10b 

has been closed) is displayed below (recommendations Management considers completed 

and closed are highlighted): 

Outcomes of the 25 OIG “Outstanding Recommendations” 

Recommendation 

Number 

Management Response Completion Date 

2a Completed November 2011 

2b Completed June 2011 

2c Completed May 2015 

3b Completed June 2011 

4a To be completed by Mgmt N/A 

4b To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

4c Completed December 2012 

4d To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

5a To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

5b To Be Determined by Mgmt 

(Management is reconsidering 

strategy for meeting this 

recommendation) 

N/A 

6e Completed June 2015 

7a Completed June 2015 

7d Completed June 2015 

7e Completed June 2015 
7f Completed June 2015 

8d Completed October 2012 

10b Completed June 2015 

11a To Be Determined by Mgmt N/A 

11b Completed June 2015 

11c Completed June 2015 

12a Completed May 2012 

12b To be completed by Mgmt N/A 

12d To be completed by Mgmt N/A 

12e To be completed by Mgmt N/A 

13 Completed June 2015 

Management has signaled its continued willingness to work with OIG on closing many of 

the outstanding recommendations, and indeed, has mapped out a schedule that could 

represent closing most, if not all, of the outstanding recommendations by the close of 

calendar year 2019. 
or toll free at 1-800-424-9530 (press 0; then dial 1015)

Fax us at 202-501-8134 or e-mail us at oig@fec.gov

Visit or write to us at 1050 First Street, N.E., Suite 1010, Washington DC 20463

Federal Election Commission

Office of Inspector General

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to fraud, waste, abuse, 

and mismanagement of agency programs and operations. Individuals who contact the OIG can remain anonymous. 

However, persons who report allegations are encouraged to provide their contact information in the event additional 

questions arise as the OIG evaluates the allegations. Allegations with limited details or merit may be held in 

abeyance until further specific details are reported or obtained. Pursuant to the Inspector General Act of 1978, as 

amended, the Inspector General will not disclose the identity of an individual who provides information without the 

consent of that individual, unless the Inspector General determines that such disclosure is unavoidable during the 

course of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference.

Fraud Hotline

202-694-1015