FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

 FINAL REPORT 

 Review of Outstanding Audit Recommendations 

JUNE 2012 

ASSIGNMENT No. OIG -12-04 
 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

Report Overview 

As required by the Inspector General Act of 1978, as amended, the Office of Inspector General 

(OIG) is responsible for conducting audits of the Federal Election Commission’s (FEC) 

programs and operations. When the OIG conducts an audit, or supervises an Independent Public 

Accounting firm to perform an audit, the OIG also has the responsibility of tracking audit 

recommendations and performing audit follow-up work to ensure adequate resolution of audit 

recommendations. Audit follow-up, to include the timely implementation of audit 

recommendations, is required by Office of Management and Budget Circular A-50, Audit 

Followup, as revised, and FEC Directive 50: Audit Follow-up, 

Although management typically provides a semiannual status report to the Commission of their 

progress concerning outstanding audit recommendations, the official status (open/closed) of 

audit recommendations is determined by the OIG once the OIG has verified that management 

has adequately implemented the corrective actions to address the audit recommendations. This 

information is reported to the Commission and Congress in the OIG’s Semiannual Reports to 

Congress. 

This report provides the Commission with details regarding the: 

•	 OIG’s Audit Follow-up process, see page 2; 

•	 Quarterly meetings with management to determine the status of outstanding audit 

recommendations, see page 2; 

a.	 Audit Follow-up Review of the FEC’s Employee Transit Benefit Program, see 

page 3 

b.	 Audit of the Commission’s Property Management Controls, see page 4 

c.	 2010 Follow-up Audit of Privacy and Data Protection, see page 5 

d.	 2010 Follow-up Audit of Procurement and Contract Management, see page 6 

•	 OIG’s concerns regarding management’s progress and management of outstanding audit 

recommendations, see page 6; and 

•	 Other FEC reviews with outstanding audit recommendations, see page 8. 

For this review period, the OIG reviewed four audits that had a total of 161 audit 

recommendations that were outstanding for six months, or more. Collectively for three of the 

four audits, the OIG closed 48 outstanding audit recommendations based on the OIG’s review of 

management’s implementation of corrective action. However, for one audit (2010 Follow-up 

Audit of Procurement and Contract Management), the OIG’s review determined that 

management had not implemented any corrective action, and all audit recommendations remain 

outstanding. The OIG’s follow-up reviews were completed prior to the most recent May 2012 

corrective action plans (CAPs) submitted to the Commission by management. Therefore, any 

recent corrective action completed by management will be reviewed by the OIG during the next 

review period. 

1 
 

 

 

 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

Audit Follow-up Process 

At the conclusion of each audit, it is management’s responsibility to develop a CAP. The CAP 

identifies the plan management has developed to address the audit findings. The CAP should 

detail the following: 

1. assignment of Audit Follow-up Official (AFO); 

2. audit finding(s); 

3. audit recommendation(s); 

4. corrective action to implement the audit recommendation(s); 

5. staff person with responsibility to implement each task; and 

6. expected completion dates. 

Once management drafts the CAP, the OIG then reviews their CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the audit 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the 

final CAP to the Commission with a courtesy copy to the OIG. 

FEC Directive 50 requires management to 

“(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission;...” 

In order to work effectively with FEC management in adhering to Directive 50, and to ensure 

continuous monitoring and adequate and timely audit resolution, the OIG has revamped our 

follow-up process to include quarterly meetings with management to discuss the progress of 

outstanding audit recommendations, and reporting semiannually (June & December) to the 

Commission on recommendations that the OIG has closed (if any) based on follow-up reviews. 

The quarterly meetings are also intended to assist the audit follow-up official in following 

provisions 4 through 6 of Directive 50, which are listed below: 

“(4) Respond in a timely manner to all audit reports; 

 (5) Engage in a good faith effort to resolve all disagreements; and 

 (6) Produce semi-annual reports that are submitted to the agency head.” 

Quarterly Meetings 

At the start of the OIG’s quarterly review process (December 2011), four OIG audits had a total 

of 1611

 outstanding audit recommendations. Corrective actions had not been adequately 

implemented since the release of each audit report. To discuss the current status and progress of 

1

 The number (161) of outstanding audit recommendations includes recommendations that management has 

disagreed with the OIG. These recommendations remain open based on further improvement needed by 

management and/or the OIG believes the recommendation is essential to fixing the audit issue and should be 

implemented. 

2 
 

 

 

 

 

 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

each audit recommendation, the OIG held separate meetings with the applicable audit follow-up 

official and/or management staff for each audit. The OIG held the first meetings during the 

quarter ending December 2011. The OIG then conducted follow-up reviews in early 2012, and 

held meetings with management to discuss the official status of audit recommendations based on 

our reviews. Out of the four audits reviewed, the OIG was able to close several outstanding 

audit recommendations in three of the four audits, Audit Follow-up Review of the FEC’s 

Employee Transit Benefit Program, Audit of the Commission’s Property Management Controls, 

and 2010 Follow-up Audit of Privacy and Data Protection. 

Although several audit recommendations were closed for these three audits, further corrective 

action from management is still needed to implement the remaining outstanding audit 

recommendations. In addition, no findings have been closed for the 2010 Follow-up Audit of 

Procurement and Contract Management where all audit recommendations remain open. See 

table below for summary of progress made and outstanding recommendations as of May 2012. 

Outstanding Audit Recommendations Status Table 

Title of OIG Audits Total 

Outstanding 

Recommendations 

Total 

Closed per 

OIG 

Total as of 

 May 2012 

Total Months 

Outstanding 

Audit Follow-up Review of 

the FEC’s Employee Transit 

Benefit Program 

51 26 25 29 

Audit of the Commission’s 

Property Management 

Controls 

36 15 21 21 

2010 Follow-up Audit of 

Privacy and Data Protection 

45 7 38 9 

2010 Follow-up Audit of 

Procurement and Contract 

Management 

29 0 29 6 

A. Audit Follow-up Review of the FEC’s Employee Transit Benefit Program 

The OIG met with the Transit Benefit program manager on December 7, 2011 to discuss the 

status of each audit recommendation. During the meeting, the program manager described how 

implementation of system enhancements to the METRO’s SmartBenefits software application 

has improved the transit benefits process through automation and system preventative controls. 

OIG was also informed of the additional manual monitoring controls implemented by the FEC 

program management team. Following the meeting, the Transit Benefit program manager 

provided documentation to support the work performed and controls implemented to address 

many of the audit recommendations. The OIG reviewed, verified, and/or assessed the 

information provided to determine if the audit recommendations have been properly addressed 

and was able to close 26 of the 51 open recommendations. These recommendations were closed 

3 
 

 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

either because the OIG verified that adequate controls were implemented and operating 

effectively, or recommendations were no longer needed due to new automation and/or changes to 

the program since our audit. 

The OIG held another quarterly meeting with the Director of the Office of Human Resources 

(OHR) on March 29, 2012 to provide an update to management based on the OIG’s follow-up 

procedures performed to date. During this meeting, the OIG informed management that there are 

25 audit recommendations that we consider are still open. OIG notes that management considers 

12 of these 25 open recommendations as closed; the OIG will consider these findings closed 

once the OIG determines the findings have been addressed and the program is operating 

effectively. The OIG requested additional supporting documentation that could be used to 

evidence that corrective actions for these 12 audit recommendations have been properly 

implemented. Once the applicable information is reviewed and confirmed, these 

recommendations can be closed. 

For the remaining 13 outstanding recommendations, the OIG received a status update and 

revised due dates from OHR management. The OIG notes that the majority of the 13 

recommendations are tied to the issuance of a revised Commission Directive 54 on the transit 

benefit program. Until the revised Directive 54 is finalized and approved, and standard operating 

procedures are documented and communicated to employees, these recommendations cannot be 

closed. 

B. Audit of the Commission’s Property Management Controls 

The Audit of the Commission’s Property Management Controls (Property Audit) audit report was 

released in March 2010. Since release of the audit report, management has not identified an 

Audit Follow-up Official for this audit; therefore, the OIG has worked with the Administrative 

Services Division (ASD) Managers2

 and the Deputy Chief Information Officer of Operations 

(Deputy CIO) to receive any updates regarding the implementation of audit recommendations. 

The responsibility of implementing the audit recommendations are shared by the Administrative 

Services Division and the Office of Information Technology (OIT). 

The Property Audit report identified 36 audit recommendations to improve the controls over 

FEC’s property. ASD is responsible for 10 of the 36 audit recommendations that relate to the 

FEC’s management controls over government vehicles and charge (fuel) cards. The OIG held 

the first quarterly meeting with the ASD manager for the Property Audit on December 13, 2011. 

The ASD manager discussed the status of the 10 audit recommendations and provided 

documentation and supporting information for the corrective actions that had been completed. 

The OIG reviewed the information provided by the ASD manager and then conducted follow-up 

reviews of tasks identified as completed by management to ensure adequate implementation. 

The OIG held the next quarterly meeting in March 2012 to provide the ASD manager with the 

official status (open/closed) of the outstanding audit recommendations based on the OIG’s 

2

 The OIG has worked with one acting ASD manager and two permanent ASD managers since the completion of the 

Property audit due to frequent turnover in this position. 

4 
 

 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

review of supporting documentation and follow-up work. The OIG was able to close four of the 

ten ASD audit recommendations based on sufficient implementation of the audit 

recommendations by management. It should be noted that the current ASD manager is 

consistently working with her staff and outside parties to implement the remaining six audit 

recommendations, and the OIG has verified that much progress has been made in getting the 

corrective actions completed and fully implemented. 

The Office of Information Technology is responsible for implementing 26 of the 36 outstanding 

audit recommendations that relate to the FEC’s management controls over mobile devices 

(Blackberry phones). The OIG also met with the Deputy CIO on December 13, 2011 to discuss 

the current status of the 26 audit recommendations. During and after the meeting, the Deputy 

CIO provided a revised policy along with other supporting documents to support corrective 

actions that have been completed. The OIG reviewed the information provided; conducted 

interviews with IT staff; and requested further documentation to determine if management had 

sufficiently implemented the audit recommendations. 

The OIG’s review identified seven audit recommendations that could be closed based on the 

FEC’s decision to transition to a bundled (voice and data) service plan with AT&T. These seven 

audit recommendations were no longer applicable based on the change of the service plan. In 

addition, four audit recommendations were closed based on updates made to the OIT’s Policy 

58-4.4: Personal Communication Devices Security Policy, and one recommendation was closed 

related to a process change. However, for the remaining 14 audit recommendations, which all 

require process improvements, management has not made any significant progress in addressing 

the audit recommendations. In total, the Property Audit still has 20 outstanding audit 

recommendations outstanding, six in the ASD area, and 14 in OIT. 

C. 2010 Follow-up Audit of Privacy and Data Protection 

The OIG met with the Privacy Team regarding the 2010 Follow-up Audit of Privacy and Data 

Protection on December 12, 2011. The Privacy Team and the OIG went through the CAP and 

discussed the status of each audit recommendation. Following the meeting, the Privacy Team 

provided supporting documentation for 16 of the 453

 audit recommendations that management 

considered completed. The OIG reviewed all information that was provided and was able to 

close six audit recommendations due to sufficient implementation. The corrective actions and/or 

documentation management provided to support the remaining ten audit recommendations were 

not sufficient or adequately implemented to effectively address the audit issue. 

Due to conflicting schedules and office workload in both offices, the Privacy Team and the OIG 

were unable to meet during the next quarterly period (ending March 2012). Therefore, a meeting 

was held on May 17, 2012 to discuss the OIG’s review. From this meeting, further supporting 

documentation and information was provided by the Privacy Team to close one additional 

finding. In total, the OIG was able to close seven findings, leaving 38 still outstanding. 

3

 Out of the 45 recommendations, there are 8 recommendations management has disagreed with the OIG, and does 

not plan to implement any corrective action. 

5 
 

 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

D. 2010 Follow-up Audit of Procurement and Contract Management 

The OIG held quarterly meetings with the Chief Financial Officer (CFO) on December 13, 2011 

and March 28, 2012 to determine the status of the outstanding audit recommendations for the 

2010 Follow-up Audit of Procurement and Contract Management. During the December 2011 

meeting, the CFO stated that all 294

 recommendations were open and would not be completed 

until Directive 66 (planned procurement Directive/policy) was finalized and approved by the 

Commission. When the OIG met with the CFO in March 2012, it was determined that minimal 

progress had been made and all 29 audit recommendations are still outstanding. The CFO 

continued to report that corrective action on outstanding audit recommendations had been 

delayed pending the approval of the new procurement directive, as well as a vacancy in the 

Procurement Director position and other staffing gaps. The OIG communicated to the CFO that 

we did not agree that progress on all 29 recommendations should be contingent on the 

finalization and approval of Directive 66 or hiring a Procurement Director. The OIG stressed the 

importance of implementing adequate internal controls and that management should make every 

effort to complete all recommendations by the revised due dates. 

Office of Inspector General Concerns 

1.	 Management’s reporting process for providing the Commission with semiannual status 

reports needs to be improved. Based on review of the semiannual status reports sent to the 

Commission, we identified the following: 

	 May 2012 status report for the Audit of the Commission’s Property Management 

Controls was not the most recent CAP to reflect the current status of audit 

recommendations; 

	 CAPs submitted to the Commission for May 2012 did not contain all relevant 

information. The CAPs did not include OIG comments, the status (open/closed) 

of each recommendation and/or estimated completion dates; 

 Management did not consistently revise the corrective action due dates in the 

CAPs when the original completion dates are not achieved; 

 In many instances, completion dates for audit implementation are overdue by 

several months without any progress being made; 

 Historically, CAPs are not submitted in a timely fashion or not at all5

; and 

 CAPs are not always in a readable format. CAPs are scanned and/or converted to 

a PDF format and the font is not legible. For example, the Audit of the 

Commission’s Property Management Controls CAP sent to the Commission in 

October 2010, May 2011, and the most recent May 2012. 

Suggestion: Management should improve the timeliness and quality of the CAPs submitted 

to the Commission. 

4

 Out of the 29 recommendations, there is one recommendation management has disagreed with the OIG, and does
 

not plan to implement any corrective action. 

5

 The OIG notes that FEC management submitted all May 2012 CAPs to the Commission on time, and therefore the
 

OIG is hopeful that improvement on timeliness is being addressed by management. 

6 
 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

2.	 There is no standard format used for reporting the status of the CAPs to the Commission or 

the OIG. 

Suggestion: Management should adopt a standard CAP template to be used for all CAPs. A 

standard template will ensure consistency of the information. The OIG has provided 

management a standard template and the OIG plans to work with management to save this 

template in a central location for all follow-up officials. 

3.	 Management has made minimal progress on the corrective action plan for the 2010 Followup Audit of Procurement and Contract Management. The OIG is concerned by the delay in 

implementing adequate internal controls in procurement processes, which is an area that has 

a high inherent risk of fraud. The OIG notes that some of the audit recommendations are 

directly related to bringing the FEC in compliance with the FAR (Federal Acquisition 

Regulations). The longer it takes to address these recommendations, the greater the exposure 

the FEC has to being cited for violating government mandated regulations over the 

procurement function, among other risks. According to the Office of the Chief Financial 

Officer, delays in implementing recommendations are attributed to a lack of continuity in the 

Contracting Officer position and the revision of a Commission Directive on procurement 

pending Commission approval. While we agree these are relevant issues, the OIG believes 

some progress on implementing recommendations could and should have been made since 

the issuance of the OIG’s audit report. 

Suggestion: A new Contracting Officer has been hired by the FEC and is expected to start 

on Monday, June 18, 2012. Also, in the event the revised Commission Directive on 

Procurement is not finalized by July 31, 2012, the OIG suggests the Office of the Chief 

Financial Officer should move forward with implementation of corrective action on the 

OIG’s recommendations to ensure compliance with contracting regulations and internal 

control requirements. Any revisions to operating procedures as a result of the new 

Commission Directive can be made, as appropriate. 

4.	 The progress that has been made by Office of Information Technology to adequately 

implement audit recommendations for the Audit of the Commission’s Property Management 

Controls is minimal. Management has expressed that additional progress to sufficiently 

address outstanding audit findings is not likely. 

Suggestion: The CIO should review the latest CAP, discuss progress with his OIT team, and 

meet with the OIG to discuss a plan forward. 

5.	 Management has not established an audit follow-up official for the Audit of the 

Commission’s Property Management Controls. Also ASD and OIT do not maintain one 

comprehensive CAP with management’s updated activity. 

Suggestion: Management should appoint an audit follow-up official for all audits as 

required by Commission Directive 50 and OMB Circular A-50. Specifically, an audit followup official should be appointed for the Audit of the Commission’s Property Management 

Controls. In addition, for all future audits, an audit follow-up official should be identified at 

7 
 

Office of Inspector General’s Review of Outstanding Audit Recommendations 

June 2012 Report 

the time the initial CAP is finalized by management and submitted to the Commission and 

OIG, i.e. within 30 days from the issuance of the final audit report. 

Other Matters 

In addition to the aforementioned audits, there are other FEC audits and reviews that have 

outstanding recommendations: 

1. 2011 Inspection of the FEC’s Kastle Key Program; 

2. FEC’s FY 2011 Financial Statement Audit; and 

3. FEC’s 2009 Human Capital Management Evaluation. 

The objective of the inspection was to identify management processes or controls concerning the 

FEC’s Kastle Key system that can be improved, and provide management with recommendations 

to help strengthen this FEC function. The OIG released the Kastle Key inspection report in 

December 2011, which proposed 15 recommendations to management to assist in strengthening 

the controls over the Kastle Key program. This inspection was not included in this review as the 

recommendations have not been outstanding for six months, which is the time frame for 

triggering an OIG follow-up review. Management’s CAP for the Kastle Key inspection is 

scheduled for review in the upcoming quarterly review period. Any recommendations that have 

been adequately implemented based on the OIG’s review will be closed and reported during the 

OIG’s next semiannual reporting period, December 2012. 

The FEC’s FY 2011Financial Statement Audit contained 20 outstanding audit recommendations. 

In accordance with LSC’s contract with the OIG, LSC is responsible for conducting follow-up 

work each audit year on the prior year’s audit recommendations, and reporting on management’s 

progress. LSC began the current year’s (FY 2012) financial statement audit in May 2012. LSC 

will be reviewing the work completed by management to address the outstanding audit 

recommendations from FY 2011. The results of LSC’s follow-up work will be reported in the 

FEC’s FY 2012 Financial Statement Audit report. 

The FEC’s Human Capital Management Evaluation was conducted by the Office of Personnel 

Management (OPM) in 2009. OPM’s evaluation resulted in 35 required corrective actions that 

should be implemented by OHR, and 39 recommended corrective actions to assist in improving 

OHR’s business processes. According to management, via their May 2012 semiannual report of 

corrective actions submitted to the Commission, management has fully implemented 17 of the 35 

required corrective actions, and 19 of the 39 recommended actions since 2009. Although this 

evaluation was conducted by an external entity that was not contracted by the OIG, the OIG 

reviews the progress that management is making to implement the OPM recommendations and 

requesting the CAP updates that are sent to the Commission. However, the OIG does not review 

OHR’s implementation of OPM’s evaluation recommendations for sufficiency, and does not 

confirm that the recommendations identified as closed by management have been adequately 

implemented. The OIG’s review of OHR’s progress in implementing OPM’s evaluation 

recommendations is used as part of the OIG’s risk assessment for our annual work plan. 

8 
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015