Federal Election Commission
Office of Inspector General

or toll free at 1-800-424-9530 (pi
Fax us at 202-501-8134 or e-ma'

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to
fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals
who contact the OIG can remain anonymous. However, persons who report allegations are encouraged
to provide their contact information in the event additional questions arise as the OIG evaluates the
allegations. Allegations with limited details or merit may be held in abeyance until further specific details
are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector
General will not disclose the identity of an individual who provides information without the consent of that
individual, unless the Inspector General determines that such disclosure is unavoidable during the course
of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml

Together we can make a difference.



are all acting positions, and the Director of Accounting position is vacant. The previous
acting Chief Financial Officer recently retired and the acting General Counsel resigned.
Both of these positions have again been filled by staff in an acting capacity. The constant
fluctuation or absence of leadership promotes poor stability and inconsistency in the
leadership structure.

Additionally, in September 2016, the FEC incurred a vacancy in the Chief Information
Security Officer (CISO) position. Although this position has been vacant for only a short
period of time, it is essential to note that the CISO position is a very critical position not
only within the FEC, but also government-wide. On an agency level, the FEC is currently
going through a significant transformation within its business structure in implementing
the National Institute of Standards and Technology’s Information Technology (IT)
security standards to establish an adequate risk-based information security program for
the agency, which is the responsibility of a CSIO. The former CISO was heavily
involved in the progress, oversight, and communication channels for implementing these
standards. Management is making progress on filling this position as it has been
advertised, interviews have been held and a selection is anticipated in the near future.

The Government Accountability Office (GAO) released a report! in September 2016
identifying the need for agencies to have a sufficient cybersecurity workforce with the
right skills and training. The report also noted that IT security is consistently an
expanding government-wide high-risk area. During an OIG senior leader exit conference
with the former CISO prior to his separation from the agency, the CISO noted that the
agency’s IT security staff requires more resources than the current two established FTEs
to sufficiently carryout all the inherent roles and responsibilities of a security office,
which causes many delays with outstanding IT security projects. With the CISO being a
high-priority position within the federal government, along with the other vacant senior
leadership positions, the OIG encourages Governance to take the necessary steps to
stabilize their leadership structure in promptly filling all open senior leadership positions.

Information Technology Project Planning and Management

IT Project Planning and Management was first reported as a management challenge in
FY 2015. The FEC’s Office of Chief Information Officer (OCIO) continues to struggle
with implementing IT projects efficiently, effectively, and in a timely manner due to a
lack of adequate planning and management oversight. Since the FEC’s FY 2014 financial
statement audit report, the OIG has recommended that OCIO management require a
project plan for all OCIO projects that require multiple resources and/or have a
timeframe of completion beyond 60 days. Management has not agreed to implement the
recommendation, and continues to experience major delays in fully implementing
projects such as a vulnerability remediation program, the agency’s Continuity of
Operations Plan, and verification of user access authorities, all of which have been repeat
findings in the agency’s annual financial statement audit report for several years. It is
imperative that the FEC has efficient and effective project planning and management
processes to ensure the security and integrity of FEC data.

The IG’s annual assessment of management and performance challenges is based on
information derived from a combination of several sources, including OIG audit and
inspection work, Commission reports, government-wide risks factors, and a general

' GAP-16-885T


ATTACHMENT A

Management’s Response
(2016 Management & Performance Challenges)


FEDERAL ELECTION COMMISSION (FEC)
MANAGEMENT AND PERFORMANCE CHALLENGES
FY 2016

I. Low Employee Morale

Management Challenge:

The established tone and culture from Governance and the Senior Leaders as a
whole has a negative impact on employee morale and ultimately the success of the
agency in effectively accomplishing its mission.

Applicable Government Requirements/Best Practices? Not In Place:

e GAO Standards For Internal Control in the Federal Government
© OMB A-123
> Control Environment
o Management and employees should establish and maintain an
environment throughout the organization that sets a positive and
supportive attitude toward internal controls and conscientious
management.
o The organizational culture is also crucial within the standard.
The culture should be defined by management's leadership in
setting values of integrity and ethical behavior... Management’s
philosophy and operational style will set the tone within the
organization.

Critical Agency Impacts:

e Negative tone and attitude by Commissioners negatively impacts the
employees perception of their job

e Employees do not feel valued, which impacts their work product and
dedication to the job

e Lack of trust in management and leadership direction

e Ineffective leadership
> No established accountability for managers from Governance
> One person serving as both Staff Director and CIO
> Many vacant senior leadership positions

¢ Breakdowns in communication between senior leaders and employees

? In instances where the FEC may be exempt from a government requirement or standard, the reference
should be used as best practice to ensure adequate government business operations — applicable to all
sections in this report.

5


knowledge of the Commission’s programs and activities. The management and
performance challenges are detailed in the attached report. The Reports Consolidation
Act of 2000 permits agency comment on the IG’s statements. Agency comments, if any,
are due November 15, 2016.

AyrmeG-Mehebanh

Lynne A. McFarland
Inspector General

Attachment

ce: Alec Palmer, Staff Director and Chief Information Officer
Gilbert Ford, Acting Chief Financial Officer
Lisa Stevenson, Acting General Counsel
Edward Holder, Acting Deputy Staff Director for Management and
Administration
Derrick Allen, Director of Human Resources


Ill. Information Technology Project Planning and Management

Management Challenge:

Management lacks the proper planning and oversight of IT projects that are critical
to the fulfillment of the agency’s mission and are required to ensure the security
and reliability of agency data.

Applicable Government Requirements/Best Practices Not In Place:
e Project Management Body of Knowledge Guidelines
e OMB Memorandums:
=  M-10-25 Reforming the Federal Government’s Efforts to Manage
Information Technology Projects®
= M-12-27 Information Technology Baseline Management Policy.

Critical Agency Impacts:?
A. FEC is not in full compliance with the following:
= Federal Continuity Directive 1, Federal Executive Branch
National Continuity Program
= OMB Memorandum M-08-22 Guidance on the Federal Desktop
Core Configuration
= Privacy Act 1974
B. Project funding wasted or exceeding original planned budge
= 2008 Agency-wide Personally Identifiable Information (PII)
Review Assessment
= Agency-wide COOP Project
= User Access Review Authorities
C. Continuous delays:
= Adequate testing of agency COOP
= Periodic user access authorities review
= Assessment and Accreditation project!!
D. Weak Internal Controls:
= Inability to certify that:
> mission essential functions of the agency have the ability to
operate in the event of a local disaster
> unauthorized disclosure of PII or confidential information
has not occurred
> proper access authorities are provided to each employee

10

8 Updated by M-10-31, Immediate Review of Information Technology Projects.

° This section only includes information from those IT projects audited or reviewed by the OIG and that
have been determined by the OIG to be most critical to the agency.

10 User Access Review Project: The OCIO purchased applications software in 2009 and 2011 to
implement this project, but both projects were terminated as management determined they did not meet the
FEC’s business need. The FEC will soon be starting this project for yet a third time, with a scheduled
completion date of April 2017, and purchasing new software tools. COOP Project: From FY 2008 to
2010, the FEC spent $277,506 on contractors to develop plans for each division that were never updated
and are now obsolete.

"| Periodic evaluations of the agency’s systems to ensure the security of the information systems, in
addition to documenting management’s approval that the systems are operable for a specific period of time
based on the results of the evaluation.

7


Federal Election Commission

Office of Inspector General

Inspector General Statement on the
Federal Election Commission's
Management and Performance

Challenges - 2016


senior leaders and direct reports to the Staff Director about efforts to build trust. Management
and staff from several Offices and Divisions, including some of the largest organizational
components, have also met to discuss the morale report. Management has also taken steps to
consider morale issues in the Labor Management Forum with representatives of the National
Treasury Employee Union. Management notes that it shares Chairman Petersen’s view reflected
in recent public statements that employee morale is essential to fulfilling our mission
responsibilities to the greatest extent of our ability. Management looks forward to continued
support from the Commissioners as we work to find steps that can be taken to better the work
environment. Management would welcome the constructive collaboration of the OIG in
addressing the employee morale issues identified in the consultant’s report.

I. Governance Framework

Management agrees with the Statement that key leadership vacancies need to be filled.
Unfortunately, the agency continues to experience a challenge in permanently filling these
positions. Management remains committed to assisting the Commission in recruiting, screening
and selecting applicants for these positions. During the past year, two key, longstanding
leadership vacancies were permanently filled when the positions of Associate General Counsel
for Policy and Associate General Counsel for Litigation were filled on a permanent basis. As the
Statement notes elsewhere, another key position, the Director of Human Resources, has been
successfully filled recently as well. While the hiring process is underway for other positions, it is
important to note that nearly all of the vacant positions are filled on an acting basis by qualified,
capable, and hardworking individuals. In fact, both recently hired Associate General Counsels
were serving in those position on an acting basis previously.

The Statement discusses one vacancy in particular, the Chief Information Security Officer.
Rather than publicly discuss the status of a hiring process in which many applicants are
participating, Management will note its agreement with the Statement that filling this position as
expeditiously as prudently possible is important, and Management appreciates the Statement’s
observation that Management is making progress on filling this position. Once the hiring
process is successfully concluded, Management will announce that this position has been filled.

The Statement also notes that one person is filling two major senior leadership positions, Staff
Director and Chief Information Officer. Confronted with a vacancy in the Staff Director
position, which had been held by several individuals over a relatively short period of time, and
facing similar challenges to filling this position on a permanent basis, the Commission sought
and received the approval of the U.S. Government Accountability Office an arrangement it
desired of having the Chief Information Officer also serve as Staff Director. This arrangement
has achieved stability in the highest ranking staff position at the agency since 2011, and stability
in this most senior staff position had previously eluded the agency. Stability in the Staff Director
position has been particularly valuable given the changes experienced in other senior
management positions. As noted in the Management Response to the Fiscal Year 2015 in
response to similar challenges, the Statement once again does not identify any specific projects
or activities that have been negatively affected by one individual serving as Staff Director and
Chief Information Officer.


Response to the Inspector General’s Statement on the Federal Election Commission’s
Management and Performance Challenges!

November 30, 2016

The Federal Election Commission’s (“FEC”) Inspector General (“IG”) reports as a “noteworthy
accomplishments for the agency” that the Human Capital Management is no longer a major
management challenge. Management is pleased to note that the IG reports that “the agency has
stabilized the leadership structure in the Office of Human Resources (OHR) by hiring a full-time
Director who has been successful in increasing the staffing in the OHR to address the need for
improved customer service.”

In its Statement on the FEC’s Management and Performance Challenges (“Statement”), the
Office of the Inspector General (“OIG”) identified three management and performance
challenges for inclusion in the FEC’s Agency Financial Report for Fiscal Year 2016.
Management’s response to each identified challenge appears below.

I. Low Employee Morale

The OIG engaged a consultant to report on the root causes of low employee morale at the FEC,
and the consultant released its report on July 25, 2016. Management notes that neither the
consultant nor the OIG sought a response to the consultant’s report from Management. In the
three months since receiving the report, Management has begun the work necessary to find
collaborative solutions to improve morale at the FEC and to identify concrete steps we can take
to better the work environment. In light of the actions specifically described below,
Management strenuously disagrees with the Statement’s characterization of communication from
Management on this topic as “near silence” and its claim that Management has “yet to discuss a
potential action plan or even a basic framework with the agency.”

The Staff Director communicated Management’s intention to find collaborative solutions to
improve morale at the FEC and to identify concrete steps that can be taken to better the work
environment at the FEC to every FEC employee (which includes all OIG employees) by email.
Moreover, action has begun on these efforts. Specifically, as a first step, Management has
prioritized the establishment of a new communication portal to improve communication at the
FEC, which was identified as one of the five major root causes of low morale. To best design
that portal, the Information Division conducted an on-line survey of FEC employees to learn
how they currently receive information and the types of information that are most valued by
employees. The results of that survey became available in early November and are currently
under review. Additionally, Office of Staff Director Management has begun a conversation with

: Management consists of the agency’s senior managers, including the Staff Director,
General Counsel and Chief Financial Officer. The Commissioners, who often hold diverse
views, are aware of these findings and are monitoring management’s responses and working to
ameliorate the concerns identified in this section.


Governance Framework

Management Challenge:
FEC lacks adequate structure and continued stability in key senior leadership
positions that are accountable for the mission and objectives of the agency.

Applicable Government Requirements/Best Practices Not In Place:
¢ Statutory Requirement for General Counsel - 52 U.S.C. section 30106(f)
e Clinger-Cohen Act of 1996
« Privacy Act of 1974

Critical Agency Impacts:
A. Agency vacancies — The FEC has several senior leader positions that have
been vacant for a year or more
= General Counsel - position vacant since July 2013?
= Chief Financial Officer - position vacant since October 2012*
= Deputy Staff Director for Management and Administration -
position vacant since August 2014°
" Chief Information Security Officer®
= Failure to fill senior leader positions creates resource gaps. Critical
management positions are vacant or filled with acting FTEs due to
incumbents serving in vacant senior leader positions, including:
> Director of Accounting
> Budget Director
> Deputy Chief Information Officer of Operations.
B. Dual office holding — The CIO also serves as the permanent Staff Director.
" Contributes to low employee morale’
= Conflict of interest in agency reporting structure for staff
= Poor IT project planning and management
= Lack of management accountability
> No significant progress in complying with the IT portions of
the agency’s Privacy Program to comply with the Privacy
Act
> Major delays in IT project implementation
= Failure to timely implement OIG recommendations in accordance
with OMB Circular A-50 and Commission Directive 50
> Outstanding OIG recommendations from the 2010 Follow-
up Audit of Privacy and Data Protection released in March
2011
> Outstanding OIG recommendations from the Inspection of
the FEC’s Disaster Recovery Plan and Continuity of
Operations Plans released in January 2013

3 The Associate General Counsel for Enforcement was assigned as Acting General Counsel in August 2015
— September 2016 followed by the Deputy General Counsel for Law from September 2016 to present.

4 The FEC assigned the Director of Accounting as Acting CFO in October 2012- September 2016 and then
the Budget Director in September 2016 to present.

5 The FEC assigned the Deputy CIO of Operations as Acting Deputy Staff Director in August 2014.

© Noted as a recent vacancy but a critical position that needs to be filled based on agency IT weaknesses
and the high risk area government-wide.

7See OIG report: Root Causes of Low Employee Morale Study

6



Low Employee Morale

For the past five years, the FEC has consistently ranked low on the annual list of The Best
Places to Work in the Federal Government based on the responses provided from FEC
staff to the Federal Employee Viewpoint Survey, administrated by the Office of
Personnel Management. As employee satisfaction has a direct impact on the agency’s
ability to effectively achieve its mission, the OIG contracted with a consulting company
to conduct a study to determine the root causes of the low employee morale at the FEC.
The consultants released their report in July 2016, and consistent with many staff
complaints via OIG hotline submissions, annual risk assessments, and general discussions
with FEC staff, the study identified the following five major root causes:

e Commissioners
o Tone and attitude perceived as poor
© Many positions filled by acting managers

e Management
oo. Lack of trust
o Top leaders seen as ineffective

e Communication
© Little information provided
o Employees do not believe management

e Accountability
o Poor managers not accountable
© Poor performing employees not accountable

e Other
o Perceived lack of diversity in management
o Little career development

Since the release of the report, Governance has yet to discuss a potential action plan or
even a basic framework with the agency to address the root causes of low employee
morale. The near silence of Governance and the Senior Leadership in this critical area
further reinforces the perceptions and beliefs of the FEC staff causing low employee
morale. The OIG believes that the ability to achieve the mission of the agency will be
heavily impacted if Governance does not make sincere and concrete attempts to begin
addressing the employee morale issues.

Governance Framework

Consistent with one of the root causes of low employee morale, the FEC continues to
experience inefficiencies in the management structure with prolonged vacancies in key
senior leadership positions, causing ineffective management, and operating with one
person fulfilling two major senior leader positions (Chief Information Officer and Staff
Director). The FEC’s Chief Financial Officer; General Counsel; Deputy Staff Director for
Management and Administration, and Deputy Chief Information Officer for Operations

2


FEDERAL ELECTION COMMISSION
WASHINGTON, D.C. 20463
Office of Inspector General

MEMORANDUM

TO: The Commission
FROM: Inspector General

SUBJECT: Inspector General Statement on the Federal Election Commission’s
Management and Performance Challenges

DATE: October 19, 2016

Each year, the Inspector General (IG) is required to provide a summary and assessment
of the most serious management and performance challenges facing the Federal Election
Commission (FEC). The requirement is contained in the Reports Consolidation Act of
2000 (Public Law 106-531), an amendment to the Chief Financial Officers Act of 1990.
The attached document responds to the requirement and provides the annual statement on
Commission challenges to be included in the Federal Election Commission Financial
Audit Report (FAR) Fiscal Year (FY) 2016.

As a noteworthy accomplishment for the agency, the IG was able to remove Human
Capital Management as a major management challenge for FY 2016. The IG has
reported this area as a challenge for the agency since 2004. However, since the IG’s FY
2015 management challenges report was released, the agency has stabilized the
leadership structure in the Office of Human Resources (OHR) by hiring a full-time
Director who has been successful in increasing the staffing in the OHR to address the
need for improved customer service. Although the IG believes that the OHR still has
room for improvement in providing customer service to staff and in addressing reported
weaknesses within their daily operations, the noted accomplishments are key factors in
addressing the consistent operational challenges reported from past years.

For FY 2016, the Office of Inspector General (OIG) has identified one new, and two
continued management and performance challenges for inclusion in the FEC’s FAR:

Low Employee Morale
Governance Framework
Information Technology Project Planning and Management


Table of Contents Page

Inspector General Statement on the FEC’s Management and Performance Challenges........ 1-7

Attachment A: Response to OIG’s Statement on the FEC’s Management
and Performance Challenges...........:0::cccccsessseceeessseeeeeeesseeesnieestaeeseetaaeestatereeneses 8


Ill. Information Technology Project Planning and Management

Management’s response to the Statements concerns in this regard are discussed in connection
with the Independent Auditor’s Report Finding and Recommendations on “Planning and
Oversight of IT Projects,” and are not repeated here.