Federal Election Commission

Office of Inspector General

Final Report

Review of Outstanding 

Recommendations as of 

August 2015

September 2015

Assignment No. OIG-15-05
Office of Inspector General’s

Review of

Outstanding Recommendations as of

August 2015

The Office of Inspector General (OIG) semiannually provides to the Federal Election 

Commission (FEC) a report on the status of outstanding recommendations. The OIG provides

these status reports as of February and August of each year. This process provides sufficient 

time for management to include any updates from the OIG in their semiannual corrective action 

plans (CAP) to the Commission in May and November.

Since the February 2015 report was issued, the Inspection of the FEC’s Travel and Purchase 

Card Programs report (also released in February 2015) has been added to the follow-up review. 

The Office of the Chief Financial Officer (OCFO) initiated the follow-up process with the OIG 

prior to the recommendations being outstanding for six months; therefore, the recommendations 

were reviewed and included during this reporting period. 

For this reporting period, we reviewed a total of 7 audits and inspections that contained a total of 

83 outstanding recommendations as of February 2015. The OIG was able to collectively close 4

recommendations from 3 of the 7 audits and inspections (see table on page 2).

 Noteworthy Accomplishments

• The Office of the Chief Financial Officer closed the two open recommendations from 

the Inspection of the FEC’s Travel and Purchase Card Programs report within six (6) 

months of issuing the final report to close out the inspection.

• The Administrative Services Division timely implemented monitoring controls and 

documented standard operating procedures for the FEC that aligned with the 

requirements of the Government Charge Card Abuse Prevention Act of 2012.

 OIG Concerns

• The OIG continues to be concerned with the agency’s position to operate with two CoChief Privacy Officers (the Deputy Chief Information Officer (CIO) of Operations and 

Deputy General Counsel) to oversee the agency’s privacy programs, as we feel this 

contributes to the lack of progress being made in completing agreed-upon 

recommendations.

For further details, please see page 7.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 2 | Page

Table Summary of Results

The table below summarizes the progress made by FEC management since the OIG’s last 

reporting period and the total outstanding recommendations as of August 2015.

Title & Report Date 

of OIG 

Audits/Inspection

Total Outstanding 

Recommendations 

as of February 

2015

Total Closed 

and Verified

by OIG

Total Open 

as of

August 20151

Audit of the Commission’s

Property Management

Controls (3/2010)

1 0 1

2010 Follow-up Audit of

Privacy and Data Protection

(3/2011)

28 0 28

2010 Follow-up Audit of

Procurement and Contract

Management (6/2011)

3 1 2

Inspection of the FEC’s

Disaster Recovery Plan and

Continuity of Operations Plans

(1/2013)

30 12 29

Audit of the FEC’s Office of 

Human Resources (7/2013) 11 0 11

Inspection of FEC’s 

Compliance with FMFIA/OMB 

A-123 (6/2014)

8 0 8

Inspection of the FEC’s Travel 

Card and Purchase Card 

Programs (2/2015)

2 2 0

Total Outstanding Recommendations 79

 1 Column numbers include recommendations that management has disagreed with or has not adequately 

implemented, and the OIG concludes that these recommendations are still open. 2 Recommendation was closed based on a duplicate recommendation in the FEC’s annual financial statement audit 

that was reviewed and closed.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 3 | Page

Audit Follow-up Meetings/Communications

Closed Inspections

A. Inspection of the FEC’s Travel And Purchase Card Programs

The OIG’s February 2015 inspection report identified two open recommendations. In July 2015, 

the OCFO initiated the audit follow-up process to provide the corrective actions 

implemented for the open recommendations. The Director of the Administrative 

Services Division (ASD) issued the Travel Card Program Policy on March 24, 

2015, and the Acting Chief Financial Officer posted the Travel Policy on the 

FECNet site on July 30, 2015. The issuance of these policies were 

communicated agency wide via email which included a link to the respective 

policy documents. The OIG meet with ASD on August 11, 2015, to discuss the 

monthly monitoring process and reviewed a sample of three monthly travel card 

activity reports. Based on the OIG’s review, we confirmed that evidence was provided to support 

monthly monitoring of travel cards is consistently performed. As a result of the OIG follow-up 

review, both recommendations were closed, and the inspection report has been closed. 

Open Audits/Inspections

A. Audit of the Commission’s Property Management Controls

The OIG’s Review of Outstanding Recommendations as of February 2015 report 

identified one open recommendation for the Audit of the FEC’s Property Management 

Controls: 

• Recommendation 2f: “Blackberry user information should be kept up to date and 

adjusted in a timely manner on the ITD master Blackberry listing and the AT&T 

Premier website for employee separations and new assignment of devices.”

For this review period, the Information Technology Division (ITD)3 management 

initiated the follow-up review by providing the OIG with their inventory records and 

recent AT&T billing statement to review the accuracy of their iPhone inventory records. 

The OIG completed a detailed review of the inventory records and found similar issues 

with the inventory records as in past follow-ups. 

 3 The ITD has since changed its name to the Office of Chief Information Officer (OCIO), but will be referred to as 

ITD for consistency with the original report. Additionally, iPhones have replaced Blackberries, but the open 

recommendations are still relevant to the iPhones.

OCFO and ASD 

Management worked to 

close the inspection 

recommendations in a 

timely manner.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 4 | Page

The OIG provided management with our review results and comments, noting the 

inaccuracies found. Thus, the OIG continues to report recommendation 2f as an 

outstanding recommendation for this reporting period.

In addition, for this review period, ITD management provided two 

separate inventory list for iPhones, in which both lists capture the 

same type of data, but did not always have congruent information 

(i.e., different users assigned to the same device). In addition to 

providing the results of our review, we suggested to management to

choose one method for capturing the inventory information to eliminate conflicting 

inventory data. We also suggested that the selected method should be the most accurate 

and timely method.

B. 2010 Follow-up Audit of Privacy and Data Protection

For the 2010 Follow-up Audit of Privacy and Data Protection, the OIG’s February 2015

report identified 28 open recommendations. For this review period, management 

provided the OIG with an updated CAP where management had closed several 

recommendations. The OIG reviewed the updated CAP and requested the associated 

supporting documentation to verify the implementation of the corrective actions. 

Management was unable to provide the requested documentation prior to the release of 

this report; therefore, no updates could be made to the status of the open 

recommendations. However, the OIG looks forward to reviewing the corrective actions 

that were implemented and including any status updates in the February 2016 report. 

C. 2010 Follow-up Audit of Procurement and Contract Management

The 2010 Follow-up Audit of Procurement and Contract Management was issued in June 

2011. The OIG’s Review of Outstanding Recommendations as of February 2015 report 

identified three open recommendations. In May 2015, the OCFO initiated follow-up on 

an open audit item by providing the OIG with documentation to support corrective 

actions. Based on the OIG’s review, it was determined that the corrective action was 

properly implemented and this recommendation has been closed. In accordance with the 

OIG’s follow-up review process, in July 2015 the OIG contacted OCFO to determine if 

any additional progress had been made on the two remaining audit recommendations, and 

the OIG was informed that no addition corrective actions had been taken, leaving two 

open audit recommendations as of August 2015. 

ITD should maintain 

only one master 

inventory list for 

cellular devices.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 5 | Page

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

The Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans 

report was released in January 2013. The OIG met with the Acting Staff Director of 

Management and Administration (temporarily promoted from Deputy CIO of Operations)

to provide a status of the open recommendations. During this meeting, the OIG was 

notified that there had been no significant changes to the status of the outstanding 

recommendations; however, management has made some progress in regards to 

establishing COOP for the FEC. The following items were noted: 

• Management purchased Surface Tablets for all FEC employees identified as 

essential in relation to the COOP;

• The draft plan was to be finalized by the end of July 2015;

4 and

• COOP testing was scheduled to commence in August 2015.

5

The OIG recognizes that management has taken some actions to satisfy this government 

requirement; however, review of the draft COOP plan identified that there were still areas 

of the plan that needed to be developed, and there was no detailed testing plan as required 

by Federal Continuity Directive 1, Federal Executive Branch National Continuity 

Program and Requirements, revised October 2012.

6

E. Audit of the FEC’s Office of Human Resources 

The Audit of the Federal Election Commission’s Office of Human Resources (OHR) 

report was issued in July 2013. The OIG’s Review of Outstanding Recommendations as 

of February 2015 report identified 11 open recommendations for the OHR audit report. 

The OIG contacted the OHR on July 31, 2015, to initiate the follow-up process. The OIG 

was informed that due to the departure of the Director of Human Resources in May 2015, 

and the substantive nature of the remaining 11 open audit recommendations, OHR would

not be able to provide follow-up status at this time. The OHR plans to provide updated 

status of open recommendations once the new Director of OHR has had an opportunity to 

review and act on the corrective actions.7 Therefore, the OHR audit still has 11 open 

audit recommendations as of August 2015.

 4 Date revised from January 2015. 5 Date revised from February 2015 due to compatibility issues experienced with the tablet configurations.

6 A revised COOP Plan was issued by the agency on September 16, 2015, and will be evaluated for the next report. 7 The new Director of Human Resources started work in September 2015.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 6 | Page

F. Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123

The Inspection of FEC’s Compliance with FMFIA/ OMB Circular A-123 (A-123 

Inspection) was released in June 2014. The OIG’s Review of Outstanding 

Recommendations as of February 2015 report identified eight open recommendations for 

the A-123 Inspection report, and also stated that corrective action had been made related 

to two of the recommendations (see below). 

• Recommendation 1: “The Office of the Chief Financial Officer (OCFO) should 

ensure sufficient information is included in the internal control review (ICR) 

packages submitted by program offices by making the ICR report mandatory.”

• Recommendation 2: “As a best practice, the ICR report should be 

standardized....” 

During this follow-up period, the OIG reviewed a sample of five ICR packages to 

determine if the revised guidance related to Directive 53 was followed during the FY 

2014 ICR process. For the ICR packages reviewed, the OIG confirmed that OCFO did 

ensure that applicable prior audit findings/control issues identified were included in the 

respective program ICR packages, and that the findings/control issues were considered

when providing the assurance related to the applicable program. While not mandatory, 

the OIG feels that all program offices, including those with no prior audit/control 

findings, should submit an ICR report to reflect the review performed. The OIG still 

believes that a standard ICR report (or a similar document) that summarizes and 

consolidates all the information required to support the ICR process should be 

mandatory. Once the new "Draft" A-123 guidance has been finalized, management 

should consider developing a standard report template for program offices to document 

and summarize the results of the annual ICR. Utilizing a standard report template would 

be more efficient and considered a best practice. In addition, the OIG believes that the 

new "Draft" A-123 guidance will require additional documentation to support 

compliance. Therefore, the OIG still considers these two recommendations open.

The OIG also acknowledges that the OCFO made progress on another recommendation 

(Recommendation 7) related to training. The OCFO identified program managers and 

ICR points of contact for each division, and in May 2015 held mandatory training 

(Internal Controls – Meeting Federal Requirements for Accountability). However, the 

OIG notes that the training did not address how to perform and document the FEC’s 

annual ICR process. In addition, the FEC’s annual ICR process and requirements could 

change once the new "Draft" A-123 guidance is finalized which is scheduled for 

September 2015. Therefore, this recommendation will remain open.
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 7 | Page

The OIG was also informed of other corrective actions by the OCFO as follows:

• OCFO members participated in an Interagency Internal Control Working Group 

meeting that was held in August 2015. The goal of the working group is to share 

ideas and plans on how to implement the new A-123 guidance.

• The OCFO created an A-123 task force that includes authoritative management 

officials to be responsible for implementing and maintaining a strong internal 

control program. The initial meeting was held in August 2015.

While the OCFO has made progress in certain areas, until the OIG can 

review FEC’s implementation plan and updated Directive 53 (if 

required) to comply with the new A-123 guidance, and be able to 

confirm that corrective actions fully address the recommendations, none 

of the recommendations can be closed. Therefore, all eight 

recommendations will remain open. 

OCFO created an 

A-123 task force to 

implement and 

maintain strong 

internal controls. 
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 8 | Page

OIG Concerns

Privacy Program

Many of the critical outstanding recommendations from the 2010 Follow-up Audit of Privacy 

and Data Protection have not been implemented since the release of the report in March 2011. 

This is due, in part, to the full time responsibilities of each Co-Chief Privacy Officer and their 

office staff. The OCIO and the Office of General Counsel are two offices that are critical to the 

agency’s mission and require their staffing resources to be dedicated to achieving the mission of 

the agency, and it is challenging for them to complete the collateral duties of the privacy officers. 

The OIG encourages management to reconsider their position8 to the outstanding 

recommendation 1a of the Privacy Audit: 

Assign privacy roles and responsibilities to one individual CPO [Chief Privacy Officer] 

with high level sponsorship in the Commission, to ensure any sensitive data and/or 

personally identifiable information within the agency is properly recorded, safeguarded, 

and distributed.

The lack of one fully dedicated Privacy Officer has delayed progress in improving the agency’s 

overall Privacy Program. The agency is at high risk of not being current with required 

government privacy requirements, ensuring that proper privacy protocols and processes are 

enforced within the agency, and meeting deadlines for privacy reporting requirements. 

 8 “Management does not concur with this audit recommendation.”
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 9 | Page

Background

As required by the Inspector General Act of 1978, as amended, the Office of Inspector

General is responsible for conducting audits of the Federal Election Commission’s 

programs and operations. In addition to conducting and supervising audits, the OIG

also has the responsibility to conduct audit follow-ups to ensure that management has 

effectively implemented OIG recommendations. Audit follow-up, including the timely

implementation of audit recommendations by FEC management, is required by Office

of Management and Budget Circular A-50, Audit Follow-up, as revised, and FEC

Directive 50: Audit Follow-up.

At the conclusion of each OIG audit and inspection, it is management’s responsibility to 

develop a corrective action plan. The CAP identifies the plan management has developed to 

address the OIG’s findings and recommendations. The CAP should detail the following:

1. assignment of Audit Follow-up Official, who is responsible for overseeing the 

corrective action;

2. OIG finding(s);

3. OIG recommendation(s);

4. detailed corrective action to implement the OIG’s recommendation(s);

5. FEC staff person with responsibility to implement each task; and

6. expected completion dates.

Once management drafts the CAP, the OIG then reviews the CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the

final CAP to the Commission with a courtesy copy to the OIG.

FEC Directive 50 requires management to:

(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission...;

In order to work effectively with FEC management in adhering to FEC Directive 50, 

and to ensure continuous monitoring and adequate and timely audit resolution, the

OIG communicates with management at least semiannually to discuss the status of

outstanding OIG recommendations. If management has implemented any corrective

action(s), the OIG schedules a meeting with management to discuss the

implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (i.e., new/updated policies, procedures, and processes to improve

internal controls).
Office of Inspector General’s Review of Outstanding Recommendations as of August 2015 10 | Page

To provide management with timely feedback and the results of our review prior to 

management’s reporting deadlines to the Commission in May and November, the OIG 

reports on our review of outstanding recommendations in February and August. The

semiannual meetings are also intended to assist the audit follow-up official in following

provisions 4 through 6 of Directive 50, which are listed as follows:

(4) Respond in a timely manner to all audit reports;

(5) Engage in a good faith effort to resolve all disagreements; and

(6) Produce semi-annual reports that are submitted to the agency head.

The official status (open/closed) of OIG recommendations is determined by the OIG 

once the OIG has verified that management has adequately implemented the corrective 

actions. The Inspector General can also make a decision to close recommendations or 

seek resolution from the Commission for recommendations where the OIG and 

management disagree. Lastly, the number of outstanding recommendations is also 

reported to the Commission and Congress in the OIG’s Semiannual Reports to Congress.
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015 
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015