FEDERAL MARITIME COMMISSION
800 North Capitol Street, N.W.
Washington, DC 20573

May 19, 2011

Tel: (202) 523-5863
Fax: (202) 566-0043
E-mail: oig@fme.gov

Ms. Lynne A. McFarland
Inspector General

Federal Election Commission
999 E Street, NW
Washington, DC 20463

Dear Ms. McFarland,

The Federal Maritime Commission Office of Inspector General (FMC-OIG) has reviewed
the system of quality control for the Federal Election Commission Office of Inspector
General (FEC-OIG) in effect for the year ended September 30, 2010, and has issued our
report thereon dated May 5, 2011, in which the FEC-OIG received a rating of pass. That
report should be read in conjunction with the comments in this letter which were
considered in determining our opinion. The findings described below were not considered
to be of sufficient significance to affect the opinion expressed in that report.

uality Control and Assurance ~ Annual Review Not Completed as
GAGAS

Government Auditing Standards 3.53(f) provides guidance for monitoring of quality.
According to the standard, there should be an ongoing assessment of work designed to
provide management of the audit organization with reasonable assurance that the policies
and procedures related to the system of quality control are suitably designed and
operating effectively. Sec. 3.54 states further that “(he audit organization should
summarize the results of its monitoring procedures at least annually, with identification
of any systemic issues needing improvement, along with recommendations for corrective
action.”

The review of its policies and procedures should collectively address:

Leadership responsibilities for quality within the audit organization;
Independence, legal and ethical requirements;

Initiation, acceptance and continuance of audit engagements;
Human resources;



Finding 3. Reporting Standards - No GAGAS Compliance Statement in Report

Section 8.30 of the July 2007 revision to the Government Auditing Standards states that
when auditors comply with all applicable generally accepted government auditing
standards (GAGAS), they should use specific language which represents an unmodified
GAGAS compliance statement in the audit report to indicate that they performed the
audit in accordance with GAGAS. The following language is required by the
Government Auditing Standards

We conducted this performance audit in accordance with generally accepted
government auditing standards. Those standards require that we plan and
perform the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for our
findings and coriclusions based on our audit objectives.

Use of the word “should” in GAGAS specifies a “presumptively mandatory requirement”
that auditors and audit organizations must comply with in all cases in which the
circumstances exist. Justification for any departure from the mandatory requirement
must be documented.

We reviewed the compliance statement contained in FEC’s Audit of the Commission’s
Property Management Controls (OIG-09-02). We found the FEC-OIG did not provide
the statement in its entirety. The audit report had the following statement “The audit was
performed in accordance with generally accepted government auditing standards.”

Recommendation
FMC-OIG recommends that performance audit reports contain the GAGAS statement as
required by Government Auditing Standards

View of Responsible Official

In accordance with GAS 1.12a, the FEC OIG’s Audit of the Commission’s Property
Management Controls report contains the unmodified GAGAS compliance statement:
“The audit was performed in accordance with generally accepted government auditing
standards.” In addition, the FEC OIG reviewed OIG reports from other agencies and
noted that the statement in the audit reports can vary. However, the FEC OIG will
consider the complete language identified in GAS 8.30 for future audits.

Finding 4. Audit Documentation — Workpapers Did Not Always Contain Purpose,
Source, Scope and Conclusion

Government Auditing Standards state that “auditors are to prepare audit documentation in
sufficient detail to enable an experienced auditor, having no previous connection to the
audit, to understand from the audit documentation the nature, timing, extent, and results


SCOPE AND METHODOLOGY (Enclosure 1)
Scope and Methodology

We tested compliance with the FEC-OIG’s system of quality control to the extent we
considered appropriate. These tests included a review of the only performance audit
conducted by the FEC-OIG during the semiannual reporting periods ended March 31,
2010 and September 30, 2010.

We also reviewed FEC-OIG’s monitoring of its independent auditor performance on the
FY 2010 financial statement audit. We extended the performance period to November
15, 2010, to fully capture FEC-OIG monitoring activities in our review. Monitoring of
engagements is not subject to the requirements of Government Auditing Standards and is
not reflected in our opinion of FEC-OIG’s system of quality control.

OIG Office Reviewed

We visited and performed our review at the Federal Election Commission’s Office of
Inspector General, located in Washington, DC during March 2011. We did not visit the
independent auditor’s office to review supporting documentation as documentation was
maintained by the FEC-OIG.

Reviewed Engagements Performed by FEC-OIG

ReportNo. Report Date Report Title
OIG-09-02 March 2010 Audit of the Commission’s Property Management Controls

Reviewed Monitoring Files of FEC-OIG for Contracted Engagements

ReportNo. Report Date Report Title
OIG-10-01 | November 2010 Audit of the Federal Election Commission’s
FY 2010 Financial Statements



e Audit engagement performance, documentation and reporting; and
¢ Monitoring of quality

The Council of the Inspectors General on Integrity and Efficiency, Peer Review Guide,
issued March 2009, also provides this instruction and suggests using the Silver Book as a
framework to complete the review.

The FEC-OIG provided the FMC-OIG with Annual A-123 Assurance Letters for FY
2009 and FY 2010. However, these letters do not address the intent of the Government
Auditing Standards nor the Standards’ requirements.

Recommendation

FMC-OIG recommends the FEC-OIG annually reviews its operations, reports on its
results, makes recommendations, if applicable, and maintains the results. The annual
review should collectively address the following:

Leadership responsibilities for quality within the audit organization;
Independence, legal and ethical requirements;

Initiation, acceptance and continuance of audit engagements;
Human resources;

Audit engagement performance, documentation and reporting; and
Monitoring of quality.

View of Responsible Official

GAS A3.04 (Appendix) provides guidance to assist auditors and audit organizations in
establishing policies and procedures in its system of quality control to address the
elements in GAS section 3.53, which are the same elements identified in FMC OIG’s
recommendation. In accordance with A3.04, the FEC OIG’s policies and procedures
address the six elements identified by GAGAS and documented in the FMC OIG’s
recommendation. See table below.

GAGAS Quality Control Element | _FEC OIG Policy and/or Procedure
e Leadership responsibilities for quality | Deputy IG/IG review and approval of audit
within the audit organization programs, review and sign-off of audit

workpapers; Review of audit reports for
GAGS compliance by the Deputy IG/ IG;
FEC OIG Audit Manual Chapter 7:
Supervising Engagement

e Independence, legal, and ethical | Mandatory Independence Certification Form,
requirements Organizational Conflict of Interest Forms,
a _ and Nondisclosure Agreements
| e Initiation, acceptance, and | Annual performance plans approved by the
continuance of audit engagements | IG; FEC OIG Audit Manual Chapter 5:

Annual Audit Planning

2


of audit procedures performed...” FEC-OJG audit manual stated the purpose, source,
scope and conclusion should be part of the audit documentation.

In FMC’s review of audit documentation for the Audit of the Commission's Property
Management Controls (OIG-09-02), we found the audit documentation did not always
contain sufficient evidence to allow a person with no connection to the audit to
understand the documentation. The sample of audit documentation reviewed did not
contain the purpose, source, scope, results or conclusions made for audit documentation
collected.

Recommendation
FMC-OIG recommends all workpapers (audit documentation) contain the purpose,
source, scope and conclusions.

View of Responsible Official
The FEC OIG concurs with the finding. The FEC OIG will ensure that future audits
contain the purpose, source, scope, and conclusion for all appropriate workpapers.

Finding 5. Audit Manual —Update Needed to Reflect the OIG’s Current Processes

In 2007, the FEC-OIG implemented the use of TeamMate (TM), software for automating
the audit process. In FEC-OIG’s previous peer review, FEC-OIG noted that it would be
updating its audit manual to incorporate TM processes. During the current peer review
we found the audit manual still had not been updated to incorporate TM’s functions and
other controls, although the FEC-OIG responses to Appendix A of the peer review
questionnaire adequately describe the TM work paper processes.

Recommendation

FMC-OIG recommends that FEC-OIJG updates its audit manual and incorporates the
responses provided to the FMC-OIG in Appendix A: Policies and Procedures and
TeamMate’s functionality

View of Responsible Official

The FEC OIG concurs with the finding. The FEC OIG has recently (March 2011)
completed revisions to the FEC OIG Audit Manual to reflect the current OIG processes
This revised audit manual was provided to the FMC OIG for review and evidence of
completion. The revised audit manual has been in effect since March 31, 2011.

The FMC OIG appreciates the courtesies extended by FEC OIG during our review.

AQP sh

Inspector General


FEDERAL MARITIME COMMISSION
800 North Capitol Street, N.W.
Washington, DC 20573

May 5, 2011
Office of Inspector General
Tel.: (202) 523-5863

Fax: (202) 566-0043
E-mail: oig@fme.gov

Ms. Lynne A. McFarland
Inspector General

Federal Election Commission
999 E Street, NW
Washington, DC 20463

Subject: | System Review Report on the Federal Election Commission’s Office of
Inspector General Audit Organization

Dear Ms. McFarland:

Attached is the final System Review Report of the Federal Election Commission Office
of Inspector General audit organization conducted in accordance with Government
Auditing Standards and Council of the Inspectors General on Integrity and Efficiency
guidelines. Your response to the Comment Letter is included as Exhibit A.

We agree with your proposed corrective action to the recommendations. We thank you
and your staff for your assistance and cooperation during the conduct of the review.

—_— \

p i

dtd .
Inspector General

Attachment


FEC OIG hiring requirements; CPE logs and
training certificates maintained by the
Special Assistant to the IG; FEC OIG Audit
Manual Chapter 4: Staff Qualifications &

e¢ Human Resources

CPE
e Audit engagement performance, FEC OIG Audit Manual Chapter 14
documentation and reporting Electronic Workpapers (use of TeamMate) &

Chapter 17: Reporting Audit Results; OIG
to a Report Processing Checklist |
¢ Monitoring of quality Audit Quality Assurance Checklist, IPA
Monitoring checklist, Monitoring
Performance guidance provided by the
Contracting Officer in the Assignment of
CoTR letter.

In addition to our current annual quality control process, the FEC OIG will document the status,
effectiveness, and adequacy of the six control elements identified in GAS 3.53 that are
incorporated in the FEC OIG’s policies and procedures identified in the table above.

Finding 2. Independence — No Evidence of Independence Statements in Workpapers

The FEC-OIG is organizationally independent from the FEC by reporting directly to the
Commissioners. FEC-OIG audit manual provides policy on “Professional Conduct”
which includes independence, personal impairments, external impairments and
professional care. The manual does not require an independence statement from its
auditors; however staff indicated that such statements are routinely prepared

The FEC-OIG does require independence statements from contractors performing work
and those that participate on contract proposal evaluation.

Notwithstanding the OIG’s stated practice, we did not find independence statements in
the audit documentation for the audits reviewed. Appendix A provided by FEC-OIG
stated that the updated audit manual will have the independence certification for its
auditors to complete.

Recommendation

FMC-OIG recommends the FEC-OIG require its staff, and staff that provide referencing
of its products, to complete an independence statement annually (preferably at the
beginning of the fiscal year).

View of Responsible Official

The FEC OIG Audit Manual was recently been revised to require all FEC OIG auditors
in addition to OIG audit contractors to complete an Independence Certification Statement
for each audit. The audit manual was completed in March 2011 and was provided to the
FMC OIG peer review team for review and evidence of completion

3


FEDERAL MARITIME COMMISSION
800 North Capitol Street, N.W.
Washington, DC 20573

cn May 5, 2011
Office of Inspector General

Tel: (202) 523-5863
Fax: (202) 566-0043
E-mail: oig@fme.go

System of Review Report

Ms. Lynne A. McFarland
Inspector General

Federal Election Commission
999 E Street, NW
Washington, DC 20463

We have reviewed the system of quality control for the Federal Election Commission
Office of Inspector General (FEC-OIG) in effect for the year ended September 30, 2010.
A system of quality control encompasses the OIG’s organizational structure and policies
adopted and procedures established to provide it with reasonable assurance of
conforming with Government Auditing Standards. The elements of quality control are
described in Government Auditing Standards. FEC-OIG is responsible for designing a
system of quality contro] and complying with it to provide FEC-OIG with reasonable
assurance of performing and reporting in conformity with applicable professional
standards in all material respects. Our responsibility is to express an opinion on the
design of the system of quality control and FEC-OIG’s compliance therewith based on
our review.

Our review was conducted in accordance with Government Auditing Standards and
guidelines established by the Council of the Inspectors General on Integrity and
Efficiency (CIGIE). During our review, we interviewed FEC-OIG personnel and
obtained an understanding of the nature of the FEC-OIG audit organization, and the
design of the FEC-OIG’s system of quality control sufficient to assess the risks implicit
in its audit function. Based on our assessments, we selected engagements and
administrative files to test for conformity with professional standards and compliance
with the FEC-OIG’s system of quality control. The engagements selected represented a
reasonable cross-section of the FEC-OIG’s audit organization. Prior to concluding the
review, we reassessed the adequacy of the scope of the peer review procedures and met
with FEC-OIG management to discuss the results of our review. We believe that the
procedures we performed provide a reasonable basis for our opinion.

In performing our review, we obtained an understanding of the system of quality control
for the FEC-OIG’s audit organization. In addition, we tested compliance with the FEC-


OIG’s quality control policies and procedures to the extent we considered appropriate.
These tests covered the application of the FEC-OIG’s policies and procedures on selected
engagements. Our review was based on selected tests; therefore, it would not necessarily
detect all weaknesses in the system of quality control or all instances of noncompliance
with it.

There are inherent limitations in the effectiveness of any system of quality control and,
therefore, noncompliance with the system of quality control may occur and not be
detected. Projection of any evaluation of a system of quality control to future periods is
subject to the risk that the system of quality control may become inadequate because of
changes in conditions, or because the degree of compliance with the policies or
procedures may deteriorate.

In our opinion, the system of quality control for FEC-OIG in effect for the year ended
September 30, 2010, has been suitably designed and complied with to provide FEC-OIG
with reasonable assurance of performing and reporting in conformity with applicable
professional standards in all material respects. Federal audit organizations can receive a
rating of pass; pass with deficiencies, or fail. FEC-OIG has received a peer review rating
of pass.

In addition to reviewing its system of quality control to ensure adherence with
Government Auditing Standards, we applied certain limited procedures in accordance
with guidance established by the CIGIE related to FEC-OIG’s monitoring of
engagements performed by Independent Public Accountants (IPA) under contract where
the IPA served as the principal auditor. It should be noted that monitoring of
engagements performed by an IPA is not an audit and therefore is not subject to the
requirements of Government Auditing Standards. The purpose of our limited procedures
was to determine whether FEC-OIG had controls to ensure the IPA performed contracted
work in accordance with professional standards. However, our objective was not to
express an opinion and, accordingly, we do not express an opinion on FEC’s OIG
monitoring of work performed by the IPA.

As is customary, we have issued a letter dated April 14, 2011, that sets forth findings that
were not considered to be of sufficient significance to affect our opinion expressed in this
report.

Enclosure | to this report identifies our scope and methodology, FEC-OIG site visited
and engagements reviewed.

Ag R. Trzeci f
Inspector General

Enclosure