Federal Election Commission

Office of Inspector General

Review of Outstanding

Recommendations as of 

August 2016

Assignment No. OIG-16-05
Office of Inspector General’s

Review of

Outstanding Recommendations as of

August2016

The Office of Inspector General (OIG) semiannually provides to the Federal Election 

Commission (FEC) a report on the status of outstanding recommendations. The OIG provides

these status reports as of February and August of each year. 

For this reporting period, we continued our review of the previous six audits and inspections that 

were outstanding as of February 2016. The six previous assignments had a total of 78

outstanding recommendations as of February 2016. Based on management’s progress in 

implementing corrective actions, the OIG was only able close three of the 78 recommendations 

this reviewed period. (See table on page 2). 

 Noteworthy Accomplishments

The A-123 Task Force finalized the new internal control review process, along with the 

assessment template and instructions, in time for program offices to complete the FY 2016 

annual internal control review to comply with OMB’s new A-123 guidance. 

OIG Concerns

The overarching concern of the OIG is the lack of governance accountability for ensuring that 

outstanding recommendations that are intended to improve agency programs and prevent fraud, 

waste, and abuse are timely and sufficiently implemented by management. Many 

recommendations have been outstanding for five or more years, with no consistent progress or 

dedicated effort from management to implement corrective actions. 

The OIG is concerned that management will not address the identified risks until the agency’s 

weaknesses have been exposed, and management is forced to not only address the long standing 

control weaknesses, but also remediate any effects of the risk exposure. This approach is often 

costly to the agency because contractors are often hired to address the effects of the exposed risk, 

while additional funds and resources are needed to implement the OIG’s outstanding 

recommendation, which was intended to address the control weakness that lead to the risk 

exposure. 

For example, a reported 2012 hack of the agency’s computer system resulted in the agency 

contracting with a company to review the exposed threats and provide recommendations to 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2016 2 | Page

remediate those issues. In addition, to implement a seven year outstanding OIG recommendation

that was intended to address this control weakness, the OCIO also procured services from two 

additional contractors and purchased new information technology (IT) security software to 

implement the appropriate National Institute of Standards and Technology (NIST) IT control 

standards. Governance must make management accountable for promptly addressing these 

outstanding recommendations to decrease the risk exposure to the agency, effectively manage 

resources, and control cost.

Table Summary of Results

The table below summarizes the progress made by FEC management since the OIG’s last 

reporting period and the total outstanding recommendations as of August 2016.

Title & Report Date of

OIG Audits/Inspection

Total

Outstanding 

Recommendations 

as of

February 2016

Total 

Closed and 

Verified by

OIG

Total Open 

as of

August 20161

Audit of the Commission’s

Property Management Controls

(3/2010)

1 0 1

2010 Follow-up Audit of

Privacy and Data Protection

(3/2011)

28 0 28

2010 Follow-up Audit of

Procurement and Contract

Management (6/2011)

1 0 1

Inspection of the FEC’s

Disaster Recovery Plan and

Continuity of Operations Plans

(1/2013)

29 0 29

Audit of the FEC’s Office of 

Human Resources (7/2013) 11 3 8

Inspection of FEC’s Compliance 

with FMFIA/OMB A-123

(6/2014)

8 0 8

Total Outstanding Recommendations 75

 1 Column numbers include recommendations that management has disagreed with or has not adequately 

implemented, and the OIG concludes that these recommendations are still open.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2016 3 | Page

Audit Follow-up Meetings/Communications

Closed Audits/Inspections2

The OIG did not close any audits or inspections this review period.

Open Audits/Inspections

A. Audit of the Commission’s Property Management Controls

The remaining outstanding recommendation for the Audit of the Commission’s Property 

Management Controls is related to the Office of the Chief Information Officer’s (OCIO) 

inventory records for cellular devices. As stated in the OIG’s Review of Outstanding 

Recommendations as of February 2016 report, the Acting Deputy CIO of Operations

stated that the OICO had started testing new iPhones to be distributed to FEC staff in 

fiscal year 2016. The OCIO began distribution of the new devices (iPhone 6) in August 

2016; therefore, the OIG has continued to postpone follow-up of the open 

recommendation until OCIO has completed its distribution process of the new devices to 

ensure the most current and relevant agency data is reviewed to verify management’s 

corrective actions. 

B. 2010 Follow-up Audit of Privacy and Data Protection

For the 2010 Follow-up Audit of Privacy and Data Protection, the OIG’s Review of 

Outstanding Recommendations as of February 2016 report identified 28 open 

recommendations. As stated in our prior report, management provided the OIG with 

documentation for seven of the 16 items that they noted as closed. The OIG reviewed the 

supporting documentation, but required further explanation and information in order to 

conclude that the recommendations were properly implemented. As of August 2016, 

management has not yet provided the additional information to the OIG to complete our 

review. 

We noted that management stated in a transmittal letter to the Commission dated June 2, 

2016, that they had closed three recommendations (7a, 7d, and 10b) within the last year. 

However, the OIG specifically requested documentation from the Co-Chief Privacy 

Officers on May 18, 2016, to verify that a privacy walkthrough was conducted in June 

2015, per their corrective action plan. The documentation provided was a copy of a 

Word document only containing a brief paragraph certifying that the Co-Chief Privacy 

 2 An audit or inspection is closed when the OIG determines that all applicable recommendations have been 

adequately addressed by management. 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2016 4 | Page

Officers conducted the walkthrough on September 16, 2015. The document also included 

signatures from both Privacy Officers. However, the documentation did not include any 

type of attached report/memo with a description of weaknesses identified, location of 

information found, which managers were contacted to discuss security failures, or a 

description of the "subsequent mitigations" that where noted in the provided document. 

Based on our review of this document, and the lack of detail regarding the walkthrough 

that was conducted, the OIG determined that the information was not sufficient to verify 

the Privacy Officer’s certification that “...all FEC employees and contractors in the 

building are complying with all privacy and information security standards.” Therefore,

recommendation 7a remains open.

In response to the lack of information provided by management, the OIG conducted an 

independent privacy walkthrough on the evening of July 8, 2016. The OIG noted three

instances of non-compliance (i.e. confidential folders unsecure). The OIG continues to 

recommend that the Privacy Officer’s establish an official policy and maintain proper 

documentation for the periodic walkthroughs that detail the issues that were noted and 

what corrective actions were implemented. Therefore, no recommendations have been 

closed for this follow-up review period.

C. 2010 Follow-up Audit of Procurement and Contract Management

The 2010 Follow-up Audit of Procurement and Contract Management was issued in June 

2011. The OIG’s Review of Outstanding Recommendations as of February 2016 report 

identified only one open recommendation related to the updated Directive 66 which is the 

overarching agency-wide policy for procurement and acquisitions. The OIG was 

informed that Directive 66 is still awaiting approval by the Commission before it can be 

finalized and issued. Therefore, this one recommendation is still open for this follow-up 

review period.

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

The Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

(COOP) report was released in January 2013. As reported in February 2016, one of the 

OIG’s open recommendations, number 24, reads:

“Develop and implement a COOP exercise plan. The functional exercise should include 

all COOP points of contact and be facilitated by the system owner or responsible 

authority. Exercise procedures should be developed to include an element of system 

recovery from backup media.”

The OCIO conducted its first test of the draft COOP plan in September 2015 to attempt to 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2016 5 | Page

implement corrective action for recommendation 24. The OIG assessed the test plan and 

reviewed the results provided by OCIO and concluded that the testing conducted in 

September 2015 was not adequate to close recommendation 24. OCIO has not made any 

further progress to address the open recommendations; thus, all 29 outstanding 

recommendations from the COOP report remain open. 

Ina status update to the Commission in June 2016, management decided to accept the 

risks of not implementing certain recommendations, and is requesting to have certain 

other recommendations closed due to obsolescence. The OIG will review those items 

prior to the next follow-up period to conduct an assessment of the recommendations 

status.

E. Audit of the FEC’s Office of Human Resources 

The Audit of the Federal Election Commission’s Office of Human Resources (OHR) 

report was issued in July 2013. The OIG’s Review of Outstanding Recommendations as 

of February 2016 report identified 11 open recommendations for the OHR audit report. 

In accordance with the OIG’s follow-up review process, in July 2016 the OIG met with 

the Director of OHR to discuss the status of the 11 outstanding audit recommendations as 

well as review corrective actions since the last follow-up review was conducted in 

February 2015. Based on follow-up work performed and review of supporting 

documentation, the OIG was able to close three recommendations. Two other open 

recommendations (Recommendation 16 and 17) are related to the electronic 

fingerprinting scheduling process. The OHR informed the OIG that it has not 

implemented the electronic fingerprinting and badging scheduling process and does not 

intend to do so. The OIG concludes that until the OHR has implemented adequate control 

procedures to ensure the initiation and completion of the fingerprinting and badging 

process is consistently operating effectively, these recommendations cannot be closed. As 

a result, the OHR audit has eight open audit recommendations for this follow-up review 

period.

F. Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123

The Inspection of FEC’s Compliance with FMFIA/ OMB Circular A-123 (A-123 

Inspection) was released in June 2014. The OIG’s Review of Outstanding 

Recommendations as of February 2016 report identified eight open recommendations for 

the A-123 Inspection report. Although no open audit recommendations have been closed, 

the OCFO continues to make significant progress to address the remaining audit 

recommendations. As of the August 2016 follow-up review period, the OCFO, in 

cooperation with the FEC A-123 Task Force, finalized and rolled out the new annual 

internal control review (ICR) procedures to comply with the new OMB A-123 guidance. 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2016 6 | Page

Also, most of the designated program managers for the annual ICR process have been 

trained. The new ICR process is scheduled to be completed in September 2016.

The OIG cannot close any recommendations until the new ICR process has been fully 

implemented and the OIG can verify that the new process is operating effectively. 

Therefore, all eight recommendations remain open for this follow-up review period.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2016 7 | Page

Background

As required by the Inspector General Act of 1978, as amended, the OIG is responsible

for conducting audits of the FEC’s programs and operations. In addition to conducting 

and supervising audits, the OIG also has the responsibility to conduct audit follow-ups

to ensure that management has effectively implemented OIG recommendations. Audit

follow-up, including the timely implementation of audit recommendations by FEC

management, is required by Office of Management and Budget Circular A-50, Audit 

Follow-up, as revised, and FEC Directive 50: Audit Follow-up.

At the conclusion of each OIG audit and inspection, it is management’s responsibility to 

develop a corrective action plan (CAP). The CAP identifies the plan management has

developed to address the OIG’s findings and recommendations. The CAP should detail the

following:

1. assignment of Audit Follow-up Official, who is responsible for overseeing the 

corrective action;

2. OIG finding(s);

3. OIG recommendation(s);

4. detailed corrective action to implement the OIG’s recommendation(s);

5. FEC staff person with responsibility to implement each task; and

6. expected completion dates.

Once management drafts the CAP, the OIG then reviews the CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the

final CAP to the Commission with a courtesy copy to the OIG.

FEC Directive 50 requires management to:

(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission...;

In order to work effectively with FEC management in adhering to FEC Directive 50, 

and to ensure continuous monitoring and adequate and timely audit resolution, the

OIG communicates with management at least semiannually to discuss the status of

outstanding OIG recommendations. If management has implemented any corrective

action(s), the OIG schedules a meeting with management to discuss the

implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (i.e., new/updated policies, procedures, and processes to improve

internal controls).
Office of Inspector General’s Review of Outstanding Recommendations as of August 2016 8 | Page

To provide management with timely feedback and the results of our review prior to 

management’s reporting deadlines to the Commission in May and November, the OIG 

reports on our review of outstanding recommendations as of February and August of each 

year. The semiannual meetings are also intended to assist the audit follow-up official in 

following provisions 4 through 6 of Directive 50, which are listed as follows:

(4) Respond in a timely manner to all audit reports;

(5) Engage in a good faith effort to resolve all disagreements; and

(6) Produce semi-annual reports that are submitted to the agency head.

The official status (open/closed) of OIG recommendations is determined by the OIG 

once the OIG has verified that management has adequately implemented the corrective 

actions. The Inspector General can also make a decision to close recommendations or 

seek resolution from the Commission for recommendations where the OIG and 

management disagree. Lastly, the number of outstanding recommendations is also 

reported to the Commission and Congress in the OIG’s Semiannual Reports to Congress.
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015