FEDERAL ELECTION COMMISSION 
 

OFFICE OF INSPECTOR GENERAL 
 

FINAL REPORT 
 

Audit of the Federal Election Commission’s 
 

Fiscal Year 2008 Financial Statements 
 

November 2008 
 

ASSIGNMENT No. OIG-08-01 
 
Table of Contents 

Transmittal Memorandum 

Independent Auditor’s Report ......................................................................1 

Independent Auditor’s Report on Internal Control Over Financial Reporting...............3 

Independent Auditor’s Report on Compliance and Other Matters............................20 
 

 

 

FEDERAL ELECTION COMMISSION 

WASHINGTON, D.C. 20463 

Office of Inspector General 

MEMORANDUM 

TO: The Commission 

FROM: Inspector General 

SUBJECT: Audit of the Federal Election Commission’s Fiscal Year 2008 Financial 

 Statements 

DATE: November 12, 2008 

Pursuant to the Chief Financial Officers Act of 1990, commonly referred to as the “CFO 

Act”, as amended, this letter transmits the Independent Auditor’s Report and 

accompanying Independent Auditor’s Reports on Internal Control and Compliance and 

Other Matters issued by Clifton Gunderson (CG-LLP) for the fiscal year ending 

September 30, 2008. The audit was performed under a contract with and monitored by 

the Office of Inspector General (OIG) in accordance with the auditing standards 

generally accepted in the United States of America; the standards applicable to financial 

audits contained in Government Auditing Standards, issued by the Comptroller General 

of the United States; and, applicable provisions of Office of Management (OMB) 

Bulletin No. 07-04, Audit Requirements for Federal Financial Statements, as amended. 

Opinion on the Financial Statements 

The consolidated balance sheets of the Federal Election Commission (FEC) as of 

September 30, 2008 and 2007 and the related statements of net cost, changes in net cost, 

changes in net position, and combined statement of budgetary resources for the years 

then ended (hereinafter collectively referred to as the “financial statements”) were 

audited. The audit included an examination, on a test basis, of evidence supporting the 

amounts and disclosures in the financial statements. The audit also included assessing 

the accounting principles used and significant estimates made by management, as well as 

evaluating the overall principal statements’ presentation. 

The CG-LLP Independent Auditor’s Report concluded that the FEC’s financial 

statements present fairly, in all material respects, the financial position of the FEC as of 

September 30, 2008 and 2007, and its net cost, changes in net position, budgetary 

resources, and custodial activity for the years then ended in conformity with accounting 

principles generally accepted in the United States of America. 
Report on Internal Control 

CG-LLP’s planning and performance of the audit included consideration of the FEC’s 

internal control over financial reporting as a basis for designing audit procedures for the 

purpose of expressing an opinion on the financial statements and to comply with OMB 

Bulletin 07-04, as amended, but not for the purpose of expressing an opinion on the 

effectiveness of FEC’s internal control over financial reporting. The auditors did not test 

all internal controls relevant to operating effectiveness as broadly defined by the Federal 

Managers’ Financial Integrity Act (FMFIA) (31 U.S.C. 3512), such as those controls 

relevant to ensuring efficient operations. Consequently CG-LLP did not express an 

opinion on the agency’s internal control over financial reporting. 

The American Institute of Certified Public Accountants (AICPA) established standards 

on communicating deficiencies related to internal control over financial reporting 

identified by the auditors. As defined by the AICPA, a control deficiency exists when 

the design or operation of a control does not allow the agency’s management or its 

employees, in the normal course of performing their assigned duties, to prevent or detect 

misstatements on a timely basis. 

Auditors determine whether an internal control deficiency is a significant deficiency or a 

material weakness based on the factors of likelihood and magnitude. A significant 

deficiency is a control deficiency, or combination of control deficiencies, that adversely 

affects the agency’s ability to initiate, authorize, record, process, or report financial data 

reliability in accordance with generally accepted accounting principles such that there is 

a more than a remote likelihood that a misstatement of the agency’s financial statements 

that is more than inconsequential will not be prevented or detected by the agency’s 

internal controls. A material weakness is a significant deficiency, or combination of 

significant deficiencies, that results in more than a remote likelihood that a material 

misstatement of the financial statements will not be prevented or detected by the 

agency’s internal controls. 

CG-LLP identified a significant deficiency in the area of: 

• Information Technology (IT) 

CG-LLP identified a material weakness in the area of: 

• Financial Accounting and Reporting Controls 

Report on Compliance and Other Matters 

FEC management is responsible for complying with laws and regulations applicable to 

the agency. To obtain reasonable assurance about whether FEC’s financial statements 

are free of material misstatements, CG-LLP performed tests of compliance with certain 

provisions of laws and regulations, non-compliance which could have a direct and 

material effect on the determination of financial statement amounts, and certain other 

laws and regulations specified in OMB Bulletin No. 07-04, as amended. Tests of 

2
 
 

 

compliance were limited to these provisions and CG-LLP did not test compliance with all 

laws and regulations applicable to FEC. 

The results of CG-LLP’s tests of compliance with laws and regulations described in the 

audit report disclosed an instance of reportable noncompliance that is required to be 

reported under U.S. generally accepted government auditing standards or OMB guidance. 

CG-LLP identified a reportable noncompliance in the area of: 

• The Federal Managers’ Financial Integrity Act (FMFIA) 

Audit Follow-up 

The report on internal control contains recommendations to address weaknesses found by 

the auditors. Management was provided a draft copy of the audit report for comment and 

generally concurred with the findings and recommendations. In accordance with OMB 

Circular No. A-50, Audit Follow-up, revised, the FEC’s corrective action plan is to set 

forth the specific action planned to implement the recommendations and the schedule for 

implementation. The Commission has designated the Chief Financial Officer to be the 

audit follow-up official for the financial statement audit. 

OIG Evaluation of Clifton Gunderson LLP’s Audit Performance 

We reviewed CG-LLP’s reports and related documentation and made necessary inquiries 

of its representatives. Our review was not intended to enable the OIG to express, and we 

do not express, an opinion on the FEC’s financial statements, provide conclusions about 

the effectiveness of internal control or conclusions on FEC’s compliance with laws and 

regulations. However, the OIG review disclosed no instances where CG-LLP did not 

comply, in all material respects, with Government Auditing Standards. 

We appreciate the courtesies and cooperation extended to Clifton Gunderson LLP and the 

OIG staff during the audit. If you should have any questions concerning these reports, 

please contact my office on (202) 694-1015. 

Lynne A. McFarland 

 Inspector General 

Attachments 

Cc: Acting Staff Director 

 General Counsel 

Acting Chief Financial Officer 

Chief Information Officer 

 Accounting Officer 

3
 
Independent Auditor’s Report 

To the Inspector General of the 

Federal Election Commission 

We have audited the balance sheets of the Federal Election Commission (FEC) as of 

September 30, 2008 and 2007, and the related statements of net cost, changes in net position, 

budgetary resources, and custodial activity for the years then ended (hereinafter collectively 

referred to as the “financial statements”). These financial statements are the responsibility of 

FEC’s management. Our responsibility is to express an opinion on these financial statements 

based on our audits. 

We conducted our audits in accordance with auditing standards generally accepted in the 

United States of America; the standards applicable to financial audits contained in Government 

Auditing Standards, issued by the Comptroller General of the United States; and Office of 

Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements for Federal Financial 

Statements, as amended. Those standards require that we plan and perform the audit to obtain 

reasonable assurance about whether the financial statements are free of material misstatement. 

An audit includes examining, on a test basis, evidence supporting the amounts and disclosures 

in the financial statements. An audit also includes assessing the accounting principles used and 

significant estimates made by management, as well as evaluating the overall financial 

statements’ presentation. We believe our audits provide a reasonable basis for our opinion. 

In our opinion, the financial statements referred to above present fairly, in all material respects, 

the financial position of FEC as of September 30, 2008 and 2007, and its net cost, changes in 

net position, budgetary resources, and custodial activity for the years then ended in conformity 

with accounting principles generally accepted in the United States of America. 

In accordance with Government Auditing Standards, we have also issued our reports dated 

November 7, 2008 on our consideration of FEC’s internal control over financial reporting, and on 

our tests of FEC’s compliance with certain provisions of laws and regulations and other matters. 

The purpose of those reports is to describe the scope of our testing of internal control over 

financial reporting and compliance and the results of that testing, and not to provide an opinion 

on the internal control over financial reporting or on compliance. Those reports are an integral 

part of our audit performed in accordance with Government Auditing Standards and should be 

considered in assessing the results of our audit. 

The information in the Management’s Discussion and Analysis section is not a required part of 

the financial statements, but is supplementary information required by accounting principles 

generally accepted in the United States of America. We have applied certain limited procedures, 

which consisted principally of inquiries of management regarding the methods 

11710 Beltsville Drive 

Suite 300 

Calverton, MD 20705-3106 

tel: 301-931-2050 

fax: 301-931-1710 1 

www.cliftoncpa.com Offices in 17 states and Washington, DC 
of measurement and presentation of this information. However, we did not audit this information 

and, accordingly, we express no opinion on it. 

Our audits were conducted for the purpose of forming an opinion on the financial statements 

taken as a whole. The information in the Message from the Chairman, Performance Section, 

and Other Accompanying Information is presented for purposes of additional analysis and is not 

required as part of the financial statements. This information has not been subjected to auditing 

procedures and, accordingly, we express no opinion on it. 

Calverton, Maryland 
 

November 7, 2008 
 

2 
 
Independent Auditor’s Report on Internal Control Over Financial Reporting 

To the Inspector General of the 

 Federal Election Commission 

We have audited the financial statements of the Federal Election Commission (FEC) as of and 

for the year ended September 30, 2008 and have issued our report thereon dated 

November 7, 2008. We conducted our audit in accordance with the auditing standards generally 

accepted in the United States of America; the standards applicable to financial audits contained 

in Government Auditing Standards, issued by the Comptroller General of the United States; 

and, applicable provisions of Office of Management and Budget (OMB) Bulletin No. 

07-04, Audit Requirements for Federal Financial Statements, as amended. 

The management of FEC is responsible for establishing and maintaining internal control to 

achieve the objectives of effective and efficient operations, and reliable financial reporting. In 

planning and performing our audit, we considered FEC’s internal control over financial reporting 

as a basis for designing our audit procedures for the purpose of expressing our opinion on the 

financial statements and to comply with OMB Bulletin 07-04, as amended, but not for the 

purpose of expressing an opinion on the effectiveness of FEC’s internal control over financial 

reporting. We did not test all internal controls relevant to operating effectiveness as broadly 

defined by the Federal Managers’ Financial Integrity Act (FMFIA) (31 U.S.C. 3512), such as 

those controls relevant to ensuring efficient operations. Accordingly, we do not express an 

opinion on the effectiveness of FEC’s internal control over financial reporting. 

Our consideration of internal control over financial reporting was for the limited purpose 

described in the preceding paragraph and would not necessarily identify all deficiencies in 

internal control over financial reporting that might be significant deficiencies or material 

weaknesses. As discussed below, we identified certain deficiencies in internal control over 

financial reporting that we consider to be a material weakness and a significant deficiency. 

A control deficiency exists when the design or operation of a control does not allow 

management or employees, in the normal course of performing their assigned functions, to 

prevent or detect misstatements on a timely basis. A significant deficiency is a control 

deficiency, or combination of control deficiencies, that adversely affect the entity’s ability to 

initiate, authorize, record, process, or report financial data reliability in accordance with 

generally accepted accounting principles such that there is more than a remote likelihood that a 

misstatement of the entity’s financial statements that is more than inconsequential will not be 

prevented or detected by the entity’s internal control. We consider the deficiency in Information 

Technology described below to be significant deficiency in internal control over reporting. 

A material weakness is a significant deficiency, or combination of significant deficiencies, that 

results in more than a remote likelihood that a material misstatement of the financial statements 

will not be prevented or detected by the entity’s internal controls. 

11710 Beltsville Drive 

Suite 300 

Calverton, MD 20705-3106 

tel: 301-931-2050 

fax: 301-931-1710 Page 1 of 17 

www.cliftoncpa.com Offices in 17 states and Washington, DC 
Our consideration of the internal control over financial reporting was for the limited purpose 

described in the second paragraph of this section and would not necessarily identify all 

deficiencies in the internal control that might be significant deficiencies and, accordingly, would 

not necessarily disclose all significant deficiencies that are also considered to be material 

weakness. However, we believe that the significant deficiency in Financial Accounting and 

Reporting Controls described below is a material weakness. 

************************************* 

MATERIAL WEAKNESS 

I. Financial Accounting and Reporting Controls (Repeat Modified Finding) 

The Accountability of Tax Dollars Act of 2002 (ATDA) extends to FEC a requirement to 

submit to the Congress and the Director of the Office of Management and Budget (OMB) 

audited financial statements. OMB Circular A-136, Financial Reporting Requirements, 

defines the form and content of financial statements to be prepared by the agency. To 

accomplish the objective of complying with the ATDA, the agency is required to develop 

a system to prepare a complete set of financial statements on a timely basis in 

accordance with generally accepted accounting principles. The statements are to result 

from an accounting system that is an integral part of an integrated financial management 

system containing sufficient structure, effective internal control and reliable data. 

Financial reporting also consists of policies and procedures related to the processing 

and summarizing of accounting entries, and the preparation of financial statements. 

Below are descriptions of the control deficiencies within FEC’s financial reporting 

environment: 

A. Insufficient Resources and Personnel with Appropriate Federal Accounting 

and Reporting Skill Sets (New Finding) 

FEC did not have adequate resources and employees with appropriate skills sets to 

handle financial management accounting and reporting. There was turnover in key 

financial positions during the year and adequate resources were not always available 

to fill the vacancies. For example, the staff accountant position has been vacant 

since March 2008. This position is responsible for performing monthly reconciliations 

and calculating accrual and property, plant and equipment amounts reported on the 

financial statements. FEC has not developed a program to cross train other Office of 

Chief Financial Officer (OCFO) personnel in performing these tasks and contractors 

hired to perform some of these duties were done so intermittently throughout the 

year. As a result, the Accounting Officer had to take on some of these responsibilities 

leaving FEC with insufficient resources to effectively administer quality assurance 

procedures within their financial reporting environment. 

This deficiency was aggravated by the migration of the agency’s accounting and 

financial reporting operations to a service provider during FY 2008. FEC’s 

understanding of key processes, controls and reports utilized by the service provider 

is on-going and was not obtained timely enough to adequately assess associated 

control risks and develop or redesign internal controls to mitigate those risks. These 

deficiencies are key factors in many of the weaknesses in financial reporting as 

described further in this report. 

Page 2 of 17 
GAO Standards for Internal Control in the Federal Government states “People are 

what make internal control work. The responsibility for good internal controls rests 

with all managers. Management sets the objectives, puts the control mechanisms 

and activities in place, and monitors and evaluates the control. However, all 

personnel in the organization play important roles in making it happen”. Moreover, 

“All personnel need to possess and maintain a level of competence that allows them 

to accomplish their assigned duties, as well as understand the importance of 

developing and implementing good internal control. Management needs to identify 

appropriate knowledge and skills needed for various jobs and provide needed 

training, as well as candid and constructive counseling, and performance appraisals.” 

The need for employees with analytical and federal accounting and reporting 

competencies will only increase as FEC further integrates its financial management 

system. Without the adequate staffing levels and the proper skill sets, the FEC will 

continue to encounter challenges in the financial reporting process including 

preparing financial reports in a timely manner, and consistent with applicable laws 

and regulations. 

Recommendations: 

1. Fill vacant positions within the OCFO as soon as possible. Ensure that the 

individuals possess analytical, Federal accounting and financial reporting 

knowledge and experience to enhance the FEC’s ability to comply with 

accounting and financial reporting standards. 

2. 	 Evaluate the resources and appropriate skills needed throughout the agency to 

meet FEC’s financial management and reporting responsibilities and implement a 

plan on achieving the results and recommendations of the evaluation. 

3. 	 Ensure that appropriate and on-going training is provided to FEC employees on 

federal accounting and reporting and the accounting service provider’s financial 

system. Also, ensure OCFO personnel are properly cross-trained in department 

activities. 

Management Response: 

Management generally concurs with the finding and recommendations. FEC 

management is committed to improving its internal control and accordingly, will 

develop a corrective action plan to address the issues identified. 

B. Inadequate Financial Statement Preparation and Reporting (Modified Repeat 

Finding) 

OMB Circular A-136, Financial Reporting Requirements, “preparation of the annual 

financial statements is the responsibility of the agency’s management. In carrying out 

this responsibility, each agency chief financial officer should prepare a policy bulletin 

or guidance memorandum that guides the agency’s fiscal and management 

personnel in the preparation of the annual financial statements.” The existence of 

written procedures will provide structure and accountability for the financial 

Page 3 of 17 
statements preparation and review processes. They also help ensure activities are 

carried out in accordance with management directives. 

Our audit disclosed the following control deficiencies in FEC’s financial statement 

preparation and reporting process. Many of these deficiencies were identified during 

the prior year audit. FEC’s audit follow-up process was ineffective in resolving these 

deficiencies in a timely manner. 

•	 FEC did not have a comprehensive policy bulletin or guidance memorandum as 

required by OMB Circular A-136. The lack of formalized policies and procedures 

is a contributing factor for the additional control deficiencies described below. 

•	 Accounting entries recorded in the accounting system or posted to the financial 

statements as “on-top” adjustments were not reviewed timely by FEC or the 

review was not independently performed by someone other than the preparer. 

Other controls in place such as management’s review of the financial statements 

were ineffective in detecting incorrect accounting entries made by the service 

provider. Further, an audit trail supporting the entry was not properly maintained. 

Lack or inadequate internal control increases the risk of financial statement 

misstatements. Our audit identified accounting posting errors related to the 

following transactions: 

3⁄4	 The June 30, 2008 financial statements improperly included: 

o	 $1.5 million in accrued payroll costs; 

o	 $769,314 in advanced payments to GSA; 

o	 $41,530,546 in budget authority temporarily unavailable during the 

continuing resolution period; and 

o	 Accrued employer contributions and payroll taxes costs. 

3⁄4	 The Draft September 30, 2008 financial statements provided included: 

o	 Approximately $2.6 million of collections from custodial activity in 

Fund Balance with Treasury and the Custodial Liability line items 

on the Balance Sheet improperly; and 

o	 Adjustments made by the service provider to the trial balance, 

after conversion, which impacted the Statement of Budgetary 

Resources for Expired Allotments were not sufficiently 

documented. 

•	 FEC has not established a formalized timeline for completing key processes and 

controls related to the financial statement process. For example, we noted that 

the Finance Office Checklist detailing month end closing and financial statement 

preparation procedures was not prepared throughout the year. Furthermore, 

control activities, such as fluctuation analysis and relationship testing, were not 

finalized until after the financial statements were issued to the auditors for audit. 

•	 A mechanism for tracking manual accounting entries sent to the service provider 

was not developed, which prevented FEC from being able to verify accounting 

entries were posted as intended or properly. 

Page 4 of 17 
As a result of the control deficiencies noted above, the financial statements provided 

for audit contained many inconsistencies, errors and typos throughout the document. 

We also noted that the financial statements provided were inconsistent with the 

guidance issued by OMB Circular A-136. Although the FEC has corrected all the 

items identified through the audit process, adequate controls were not in place to 

sufficiently detect such mistakes in a timely manner. 

Recommendations: 

4. Formalize and periodically update policies and procedures to a) ensure 

segregation of duties, b) provide guidance to management and staff in recording 

both recurring and unique transactions, including budgetary accounts, and c) 

provide guidance to management and staff in executing the financial statement 

preparation process in a manner that enhances the timeliness of financial 

statement preparation and minimizes the risk of preparing inaccurate financials. 

5. 	 Implement control activities to help ensure accounting transactions are recorded 

correctly, timely and are properly reviewed and adequate support documentation 

is maintained. Some of these control activities should include, but not be limited 

to: 

•	 Improving analytical and quality control review of journal vouchers, 

reconciliations and the financial statements, including interim financial 

statements. Procedures should include independent supervisory review of 

controls performed by someone other than the preparer. 

•	 Developing management’s expectations for fluctuation analysis, which 

includes setting the criteria for variances considered significant. Each 

expectation that is not met should be researched and results collaborated by 

data. Analytical tools that could be used are ratio analysis and trend analysis, 

as well as predictive techniques such as calculation of an expected balance. 

Results should be documented and maintained for management review and 

audit purposes. 

•	 Implementing proper and timely cut-off controls from processing transactions 

and in preparing the financial statements to allow for management’s timely 

analysis of financial data and for audit purposes. 

•	 Researching the accounting treatment of unique and non-reoccurring 

transactions and seeking specific guidance from accounting standard-setters 

from the beginning to ensure the recording of such events are properly 

included in the financial statement account balances and to ensure accuracy 

and transparency of financial accountable events. 

6. Establish formalized policies and procedures for performing continuous

assessment of risk factors associated with financial reporting, evaluating relevant 

controls and developing or redesigning controls to mitigate risks. These policies 

should include a well-defined documentation process that contains an audit trail, 

verifiable results, and specify retention periods so that someone not connected 

with the procedures can understand the assessment process. 

7. Enforce the use of the Finance Office Check List throughout the entire fiscal 

year. 

Page 5 of 17 
8. Establish a mechanism for tracking manual journal entries sent to the service 

provider and maintaining associated support documents. 

9. 	 Develop or redesign controls that strengthen the accountability structure related 

to the process for resolving audit findings 

Management Response: 

Management generally concurs with the finding and recommendations. FEC 

management is committed to improving its internal control and accordingly, will 

develop a corrective action plan to address the issues identified. 

C. Integrate Financial Management System (Modified Repeat Finding) 

FEC utilizes the general ledger and core financial management system (general 

ledger system) of its accounting service provider. The general ledger system is not 

capable of generating most user reports for data analysis on a real time basis. Users 

have to request from the accounting service provider some basic reports, which are 

generated by another software application. 

Other financial management systems used at FEC include excel spreadsheets, 

database applications, and PeopleSoft (PS). These systems are used to accumulate 

and summarize data for the following financial transactions, all of which are material 

to FEC’s financial statements: 

•	 Collections, Accounts Receivable, and Custodial Liability specific to Fines 

and Penalties; 

•	 Property and equipment, accumulated depreciation, and depreciation 

expense; 

• Obligations; and 

•	 Payroll and time attendance reporting. 

None of these FEC financial management systems are interfaced with the general 

ledger system. OMB Circular No. A-127, Financial Management Systems, requires 

that each agency establish and maintain a single integrated financial management 

system. Without a single integrated financial management system to ensure timely 

and accurate financial data, poor policy decisions may occur due to inaccurate or 

untimely information. Managers are less likely to be able to report accurately to the 

President, Congress, and the public on Government operations in a timely manner. 

And, scarce resources are more likely to be directed toward the collection of 

information rather than to delivery of the intended programs. 

As a result of these systems not being integrated, significant time is required to 

compile the information. In addition to gathering the data from the offices, the OCFO 

manually incorporates the information into each stand alone system in order to 

generate the necessary documentation to support the balances reported on the 

financial statements. For example, the OCFO must request accounts receivable 

information from three divisions since there is no mechanism in place to 

automatically notify the OCFO that a fine or penalty was assessed. After the OCFO 

obtains the relevant information, which may not always be received in a timely 

Page 6 of 17 
manner, the data is keystroked into a database. A journal entry is prepared for 

submission to the service provider to record the details into the accounting system. 

Given the number of times the information is separately recorded into different 

systems, there is an increased risk for input error. A monthly reconciliation is 

performed of the accounts receivable, however, without the staff accountant, as 

mentioned above, the recording of transactions may not always occur timely or 

accurately. 

Another example where the lack of an integrated financial system impacts efficiency 

pertains to the recording of obligations. The FEC has improved its procurement 

operations from the prior year by converting to a web-based procurement system 

that requires all purchase requests to be processed electronically, which alleviates 

the duplication of entry in preparing the obligating document. However, the 

procurement system is not integrated to the financial management system. 

Therefore, several areas for error still exist. Specifically, the obligating document is 

provided via e-mail to the Finance Office for review and submission to the service 

provider. Should the Procurement Office forget to send the obligating document to 

the Finance Office, there is an increased risk that the obligation does not get 

recorded in a timely manner or at all. Once the Finance Office receives the obligating 

document, they then print the document to submit the hard copy document to the 

service provider. At this time, the FEC does not send the document to the service 

provider electronically. Therefore, this process further increases the risk that the 

obligation may not be recorded timely or at all. Finally, once the service provider 

receives the obligating document, they keystroke in the relevant financial information 

into the accounting system, providing for the opportunity for an input error. 

Having a single, integrated financial management system does not necessarily mean 

having only one software application within each agency covering all financial 

management system needs. Also, it does not mean that all information is physically 

located in the same database. Rather, a single, integrated financial management 

system is a unified set of financial systems linked together electronically in an 

efficient and effective manner to provide agency-wide financial system support. 

Integration means that the user is able to have one view into systems such that, at 

whatever level the individual is using the system, he or she can obtain needed 

information efficiently and effectively through electronic means. Interfaces are 

acceptable as long as the supporting detail is maintained and accessible to 

managers. Interface linkages must be electronic unless the number of transactions is 

so small that it is not cost beneficial to automate the interface. Easy reconciliations 

between systems, where interface linkages are appropriate, must be maintained to 

ensure data accuracy. 

Without these systems being integrated, controls surrounding the processing, 

recording and review of financial transactions become much more critical and require 

greater resources to ensure completeness and accuracy. FEC management 

continues to place its emphasis on the compilation of the financial and performance 

data, but due to the lack of resources it is not capable of sufficiently performing the 

reviews needed to alleviate the control risk associated with the lack of an integrated 

financial management system. 

Page 7 of 17 
Recommendation: 

10. Re-evaluate if interfacing its standalone financial management systems with the 

service provider’s system is feasible and/or cost effective. If not feasible and/or 

cost effective, consider the subsystems used by the service provider’s financial 

management systems. 

Management Response: 

Management generally concurs with the finding and recommendations. As of 

February 2008, the FEC transitioned the processing of its accounting transactions to 

an OMB-certified line of business provider. FEC management will evaluate its standalone financial management systems and develop a corrective action plan to 

address the issues identified. 

These deficiencies in internal control may adversely affect any decision by management that is 

based, in whole or in part, on information that is inaccurate because of these deficiencies. 

Unaudited financial information reported by FEC, including budget information, also may contain 

misstatements not prevented or detected because of these deficiencies. 

************************************* 

SIGNIFICANT DEFICIENCY 

II. Information Technology (IT) (Modified Repeat Finding) 

A. Commission-Wide Security Administration Needs To Be Enhanced (Repeat 

Finding) 

An entity-wide security management program should be in place to establish a 

framework and continuing cycle of activity to manage security risks, develop security 

policies, assign responsibilities, and monitor the adequacy of computer security 

related controls. It should also represent the foundation for an entity’s security control 

structure and a reflection of senior management’s commitment to addressing 

security risks. 

During our Fiscal Year 2008 review of FEC’s security program, we noted that FEC 

made progress in addressing prior years’ findings, notably a contract was awarded 

on September 16, 2008 to certify and accredit its major applications and general 

support systems. Also, FEC had developed its Disaster Recovery Plan. However, 

continued efforts are required especially in the areas of security administration and 

oversight. Specifically, we noted that FEC had not fully implemented all security 

procedures and standards; had not finalized and implemented an information 

classification policy; had not finalized and implemented its certification and 

accreditation policy. Furthermore, FEC is currently in the process of developing a 

security plan for its Local Area Network (LAN) that incorporates the results of the 

LAN Risk Assessment 

Page 8 of 17 
Office of Management and Budget (OMB) Circular No. A-130, Appendix III Security 

of Federal Automated Information Resources, requires agencies to implement and 

maintain a program to assure that adequate security is provided for all agency 

information collected, processed, transmitted, stored, or disseminated in general 

support systems and major applications. 

Without an effective entity-wide security program plan, FEC has an increased risk 

that security controls are inadequate and inconsistently applied. Such conditions may 

lead to insufficient protection of sensitive data and high expenditures for controls 

over low risk resources. 

At the time of this review, FEC’s existing security program revealed weaknesses in 

controls that expose the FEC’s financial management systems and data to 

unauthorized access and/or modification. Security weaknesses noted included: 

•	 FEC has not fully implemented a framework of policies and standards to mitigate 

risks associated with the management of its information resources. Although 

FEC has implemented the majority of its information security policies, it has not 

fully implemented all of the related procedures and standards. FEC has not 

finalized and implemented an information classification policy, as well as its 

certification and accreditation policy. (Repeat Finding) 

•	 FEC is currently in the process of developing a security plan for its LAN that 

incorporates the results of the LAN Risk Assessment. However, the security plan 

is still in the development phase and has not been finalized and approved. 

(Repeat Finding) 

•	 There are weaknesses in FEC’s program for the continuous monitoring and 

evaluation of the computer security policy and control effectiveness. FEC does 

not utilize corrective action plans for all internal reviews of security controls. 

(Repeat Finding) 

•	 Major applications and mission critical general support systems have not been 

certified and accredited to ensure that they are operating according to FEC’s 

security requirements. (Repeat Finding). 

•	 There is currently no process in place to ensure that contractors undergo 

background investigations before obtaining access to FEC systems or data. 

(Repeat Finding) 

•	 The PeopleSoft application is currently running on an Oracle Release 8i 

Relational Database Management System that is no longer supported by the 

vendor. (Repeat Finding) 

Recommendations: 

11. Finalize and implement FEC’s information classification policy and certification 

and accreditation policy along with any accompanying standards. 

12. Incorporate the results of risk assessments into FEC security plans. 

13. Utilize corrective action plans for all reviews of security controls whether 

performed internally or by a third-party. 

Page 9 of 17 
14. Certify and accredit all major applications and mission critical general support 

systems. 

15. Implement a process to ensure that background investigations are performed on 

all contractors prior to granting them access to FEC system resources. 

16. FEC should move all of its PeopleSoft financial processing capabilities to GSA or 

update its existing platform to vendor-supported versions/releases. 

Management Response: 

FEC agrees with the majority of elements within this finding. The FEC awarded a 

contract to certify and accredit its major applications and general support systems on 

September 16, 2008. On September 23, 2008 a formal Kick-Off meeting was held to 

formally begin work on the contract. Since that time the vendor has provided the 

Contracting Officer Technical Representative (COTR) with an updated project plan 

that describes how and when certification and accreditation objectives are to be 

achieved. The vendor is currently updating system characterizations and performing 

a system classification for each major application and general support system. The 

Certification and Accreditation contract specifies line items to address the following 

issues identified within this finding: 

•	 Finalizing and implementing a modified certification and accreditation and 

information classification policies. 

•	 Updating current security plans by incorporating the results of the recently 

completed risk assessment. 

•	 Developing a Program of Actions and Milestones to monitor and evaluate the 

internal review of security controls. 

•	 Certify and Accredit FEC major applications and general support systems. 

On September 29, 2008 the Director of Human Resources addressed the issue of 

contractor background investigations by issuing the following policy “that all 

contracting personnel from this date forward (September 29, 2008) must obtain a 

background investigation prior to obtaining access to FEC systems.” 

With respect to Oracle 8i, due to legacy issues associated with some FEC 

applications the current version of Oracle 8i is required. Although the vendor no 

longer provides support for this version of Oracle it does provide limited support 

which includes assisting customers with work-arounds to issues that may arise. In 

addition the FEC has built a considerable amount of experience and internal 

expertise over the years this product has been in its inventory. In addition to its 

considerable experience, the FEC has tested and maintains Oracle 8i application 

and data backups allowing it to restore any databases to a usable state in the event 

of any mishap. 

The FEC recognizes the risk associated with maintaining a product with limited 

support. Accordingly the FEC is relying upon its considerable internal expertise, 

restricted access to only a few persons, backup and restoral capabilities and 

Oracle’s limited support as compensating factors until the application can be 

removed from its inventory. 

Page 10 of 17 
B. Disaster Recovery and Continuity of Operations Plan Need to be Developed 

(Repeat Finding) 

Losing the capability to process and protect information maintained on FEC’s 

computer systems can significantly impact FEC’s ability to accomplish its mission. 

The purpose of disaster recovery and continuity of operations controls is to ensure 

that, when unexpected events occur, critical operations continue without interruption 

or critical operations are promptly resumed. To achieve this objective, FEC should 

have procedures in place to protect information resources and minimize the risk of 

unplanned interruptions and a plan to recover critical operations should interruptions 

occur. These plans should consider activities performed at FEC’s general support 

facilities (e.g. FEC’s local area network, wide area network, and telecommunications 

facilities), as well as the activities performed by users of specific applications. To 

determine whether the disaster recovery plans will work as intended, FEC should 

establish and periodically test the capability to perform its functions in disaster 

simulation exercises. 

Our review of the service continuity controls identified that FEC has not developed a 

Continuity of Operations Plan (COOP) to support the continuation of its core mission 

in the event of a disaster or other interruption that renders the FEC’s facilities 

unusable. (Repeat Finding) 

Recommendation: 

17. Develop and implement a Disaster Recovery Continuity of Operations Plan 

(COOP). 

Management Response: 

Management agrees with the issue presented in this finding, and in fiscal year 2008 

implemented a multiple year three phase project plan to develop and implement a 

FEC-Wide Continuity of Operations Plan (COOP). Phase One consisted of 

developing an Office of Information Technology (OIT) Disaster Recovery Plan (DRP), 

Phase Two (Kick Off Meeting September 29, 2008) consists of preparing for the 

migration of the OIT DRP into a COOP, and Phase Three consists of implementing a 

Commission wide COOP. Bear in mind that, Phase Three is contingent upon 

receiving adequate funding and senior management support. 

C. Logical Access Control Needs to be Strengthened (Modified Repeat Finding) 

Achieving an adequate level of information protection is highly dependent upon 

consistently maintaining effective access controls, system software and configuration 

management controls. Access controls limit and monitor access to computer 

resources (i.e., data files, application programs, and computer-related facilities and 

equipment) to the extent necessary to provide reasonable assurance that these 

resources are protected against waste, loss, unauthorized modification, disclosure, 

or misappropriation. Access controls include logical controls, such as security 

software programs designed to prevent or detect unauthorized access to sensitive 

files. Without proper controls, there is a risk that security features could be 

inadvertently or deliberately omitted or "turned off" or that processing irregularities or 

malicious code could be introduced. 

Page 11 of 17 
Our testing of internal controls identified a weakness related to the information 

protection in FEC’s information systems environment. These include FEC’s midrange 

computer systems (e.g. servers) and applications. Weaknesses noted include the 

following: 

We noted the following control weaknesses over monitoring access to FEC’s 

networks, systems and physical facility: 

o	 4 out of 10 separated employees still have active network accounts; and 

o	 There is currently no exit clearance process in place for contractors to 

ensure that all FEC property is returned and all access permissions are 

removed. 

Recommendations: 

18. FEC should promptly terminate access to FEC resources for separated 

employees. Procedures should be documented and implemented to coordinate 

separations between Human Resources and IT management to ensure user 

accounts are immediately disabled upon termination. 

19. Implement an exit clearance process to track separated FEC contractors and 

ensure that their access permissions are removed and all FEC property has been 

returned. 

Management Response: 

Although the FEC has a documented process in place to terminate FEC resources 

and collect property from separated employees and contractors, it concurs that this 

process can be improved. To this end, the FEC has established a working group to 

implement more stringent procedures to ensure that network access is appropriately 

curtailed. In addition OIT will soon be implementing an automated information 

system to better deal with the issues identified in this finding. The New FEC Access 

System (FAS) includes processes for full time employees, interns, and contractors 

and will eliminate the discrepancies described in this finding. FAS will track staff and 

contractors from the start of their employment or contract at the Commission to exit 

and allow managers to request and document changes in network and application 

access. FAS will enable a higher degree of coordination among offices to ensure that 

user accounts are disabled and equipment is properly returned per FEC policy. FAS 

will retain all historical information regarding; account creation, changes to access 

rights, system resources, and termination information regarding a particular staff or 

contractor. FAS is now in the final testing stages and is tentatively scheduled for full 

implementation by December 1, 2008. 

III. Other Matter 

As required by OMB Bulletin No. 07-04, as amended, we compared the material weaknesses 

disclosed during the audit with those material weaknesses reported in the FEC’s FMFIA report 

that relate to control over financial reporting. Our audit identified a material weakness related to 

the financial statement preparation and reporting as reported above that was not included in the 

FEC’s FMFIA report. 

Page 12 of 17 
IV. Status of Prior Year Conditions 

We have reviewed the status of the FEC’s corrective actions with respect to the findings and 

recommendations from the prior year’s report on internal controls. We have attached Appendix 

A to our report that presents the status of prior year findings and recommendations. 

******************************** 

FEC's response to the material weakness and significant deficiency identified in our audit is 

presented within the body of our report. We did not audit the FEC's response and, accordingly, 

we express no opinion on it. 

In addition to the material weakness and significant deficiency described above, we noted 

certain matters involving internal control and its operation that we reported to the management 

of the FEC in a separate letter dated November 7, 2008. 

This report is intended solely for the information and use of the management of the FEC, the 

FEC Office of Inspector General, Government Accountability Office, the OMB, and the U.S. 

Congress, and is not intended to be and should not be used by anyone other than these 

specified parties. 

Calverton, Maryland 
 

November 7, 2008 
 

Page 13 of 17 
APPENDIX A 
 

FEDERAL ELECTION COMMISSION 
 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS
 

September 30, 2008
 

PY Rec. 

No. 

Condition/Audit 

Area Recommendation Current Status 

Material Weakness 

I. Integrated Financial Management System 

1. Integrated 

Financial 

Management 

System 

Assess the extent of financial 

management system integration 

needed for existing systems while 

outsourcing the accounting 

operations to a third party service 

provider. 

Recommendation 

closed. 

2. Integrated 

Financial 

Management 

System 

Implement control activities to 

compensate for the lack of an 

integrated financial management 

system and to ensure that 

accounting transactions are 

recorded correctly, timely reviewed 

and with adequate supporting 

documentation. Some of these 

controls activities should include, but 

not limited to: 

• Improving preparation and 

review of procurement 

documents, including purchase 

requests, purchase 

orders/contracts, and related 

supporting documentation; 

• Improving analytical and quality 

control review of journal 

vouchers, reconciliations and the 

financial statements, including 

interim financial statements; 

• Implementing proper and timely 

cut-off controls for processing 

transactions and in preparing the 

financial statements to allow for 

management’s timely analysis of 

financial data and for audit 

purposes; and 

• Establish a timeline for timely 

receipt of completed accounts 

receivable schedules by the 

finance office from the program 

offices. 

Recommendation 

open: reported in FY 

2008 as a material 

weakness. 

3. Integrated 

Financial 

Management 

System 

Ensure that the general ledger setup 

and posting model definitions are in 

compliance with the latest 

transaction posting consistent with 

USSGL guidance and policies for 

Recommendation 

closed. 

Page 14 of 15 
APPENDIX A 
 

FEDERAL ELECTION COMMISSION 
 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS
 

September 30, 2008 
 

PY Rec. 

No. 

Condition/Audit 

Area Recommendation Current Status 

recording and classifying 

transactions. 

4. Integrated 

Financial 

Management 

System 

Provide employee training on 

procurement, appropriation law, 

budget execution, and financial 

reporting, as applicable to ensure 

financial reporting and fund control 

policies are consistently and 

accurately executed. 

Recommendation 

open: reported in FY 

2008 as a material 

weakness. 

5. Integrated 

Financial 

Management 

System 

Ensure that FEC complies with 

regulatory agencies’ reporting 

requirements. 

Recommendation 

updated: reported in 

FY 2008 management 

letter 

Significant Deficiencies 

II. Information Technology 

6. Security 

Administration 

Perform risk assessments, as part of 

FEC’s overall strategy to mitigate 

risks associated with its IT 

environment. 

Recommendation 

closed 

7. Security 

Administration 

Finalize and implement FEC’s 

information classification policy and 

certification and accreditation policy 

along with any accompanying 

standards. 

Recommendation 

open: reported in FY 

2008 as a significant 

deficiency. 

8. Security 

Administration 

Incorporate the results of risk 

assessments into FEC security 

plans. 

Recommendation 

open: reported in FY 

2008 as a significant 

deficiency. 

9. Security 

Administration 

Certify and accredit all major 

applications and mission critical 

general support systems. 

Recommendation 

open: reported in FY 

2008 as a significant 

deficiency. 

10. Security 

Administration 

Refine procedures to ensure that all 

newly hired employees undergo the 

appropriate background 

investigations commensurate with 

the risk level of their position. FEC 

should also ensure these 

investigations are initiated within a 

reasonable time of employment start 

date. 

Recommendation 

closed. 

Re-opened in FY 2008 

for New Contractors 

11. Disaster recovery 

& Continuity of 

Operations 

Perform a BIA to formally identify 

and prioritize all critical data and 

operations on FEC’s networks and 

the resources needed to recover 

them if there is a major interruption 

Recommendation 

closed 

Page 15 of 17 
APPENDIX A 
 

FEDERAL ELECTION COMMISSION 
 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS
 

September 30, 2008 
 

PY Rec. 

No. 

Condition/Audit 

Area Recommendation Current Status 

or disaster. 

12. Disaster recovery 

& Continuity of 

Operations 

Establish an alternate processing 

site and incorporate the results of 

the BIA into the contingency plan. 

Recommendation 

closed 

13. Disaster recovery 

& Continuity of 

Operations 

Develop a comprehensive 

contingency plan that incorporates 

the results of the BIA and includes 

the procedures and resources 

necessary to restore FEC systems in 

the event of a disaster. Ensure 

emergency processing priorities are 

established to assist in managing 

disaster situations, and ensure once 

developed, the plan is tested 

annually and updated based on the 

results of these tests. 

Recommendation 

closed 

14. Disaster recovery 

& Continuity of 

Operations 

Develop a COOP that addresses 

measures and procedures to follow 

in the event of a long-term 

interruption. 

Recommendation 

open: reported in FY 

2008 as a significant 

deficiency. 

15. Logical Access, 

System Software 

and Change 

Management 

Controls 

Transfer processing to a service 

provider or update existing platform 

to vendor-supported 

versions/releases. 

Recommendation 

open: reported in FY 

2008 as a significant 

deficiency. 

16. Logical Access, 

System Software 

and Change 

Management 

Controls 

Write audit trails related to DBA 

activity to Operating Systems logs 

and limit DBA’s access to these logs. 

Recommendation 

closed 

17. Logical Access, 

System Software 

and Change 

Management 

Controls 

Maintain documentation to support 

the testing and approval of system 

software changes. 

Recommendation 

closed 

18. Logical Access, 

System Software 

and Change 

Management 

Controls 

Develop additional mitigating 

controls to ensure that PeopleSoft 

passwords are in agreement with 

FEC policy or ensure that if 

PeopleSoft processing is 

outsourced, the third party maintains 

password controls that comply with 

FEC password policies. 

Recommendation 

closed 

19. Logical Access, 

System Software 

Promptly terminate access to FEC 

resources for separated employees. 

Recommendation 

open: reported in FY 

Page 16 of 17 
APPENDIX A 
 

FEDERAL ELECTION COMMISSION 
 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS
 

September 30, 2008 
 

PY Rec. 

No. 

Condition/Audit 

Area Recommendation Current Status 

and Change Procedures should be documented 2008 as a significant 

Management and implemented to coordinate deficiency. 

Controls separations between Human 

Resources and IT management to 

ensure user accounts are 

immediately disabled upon 

termination. 

20. Logical Access, 

System Software 

and Change 

Management 

Controls 

Utilize access request forms that 

identify the user’s access level to 

document user access rights to all 

FEC systems and facilities. 

Additionally, FEC should periodically 

review and recertify user access to 

ensure current access is 

commensurate with job 

responsibilities. 

Recommendation 

closed 

Page 17 of 17 
Independent Auditor’s Report on Compliance and Other Matters 

To the Inspector General of the 

Federal Election Commission 

We have audited the financial statements of the Federal Election Commission (FEC) as of, and 

for the year ended September 30, 2008, and have issued our report thereon dated November 7, 

2008. We conducted our audit in accordance with the auditing standards generally accepted in 

the United States of America; the standards applicable to financial audits contained in 

Government Auditing Standards, issued by the Comptroller General of the United States; and 

Office of Management and Budget (OMB) Bulletin 07-04, Audit Requirements for Federal 

Financial Statements, as amended. 

The management of FEC is responsible for complying with laws and regulations, and 

government-wide policies applicable to FEC. As part of obtaining reasonable assurance about 

whether FEC’s financial statements are free of material misstatements, we performed tests of 

FEC’s compliance with certain provisions of laws and regulations, and government-wide 

policies, non-compliance with which could have a direct and material effect on the determination 

of financial statement amounts and certain other laws and regulations specified in OMB Bulletin 

07-04, as amended. We limited our tests of compliance to these provisions and we did not test 

compliance with all laws and regulations applicable to FEC. Providing an opinion on compliance 

with certain provisions of laws and regulations, and government-wide policies was not an 

objective of our audit, and, accordingly, we do not express such an opinion. 

The results of our tests of compliance with applicable laws and regulations, and governmentwide polices described in the preceding paragraph disclosed an instance of reportable 

noncompliance that is required to be reported under U.S. generally accepted government 

auditing standards or OMB guidance and is described in the following paragraphs. 

The Federal Managers' Financial Integrity Act (FMFIA) 

The FMFIA requires agencies to establish management controls over their programs and 

financial systems as stated in the following sections of the Act: 

•	 Section 2 seeks to assess internal controls necessary to ensure obligations and costs are in 

compliance with applicable law; funds, property, and other assets are safeguarded against 

waste, loss, unauthorized use, or misappropriation; and revenues and expenditures are 

properly recorded and accounted for to permit the preparation of accounts and reliable 

financial and statistical reports. 

•	 Section 4 seeks to assess nonconformance with government-wide financial systems 

requirements. 

11710 Beltsville Drive 

Suite 300 

Calverton, MD 20705-3106 

tel: 301-931-2050 

fax: 301-931-1710 1 

www.cliftoncpa.com	 Offices in 17 states and Washington, DC 
OMB Circular A-123, Management’s Responsibility for Internal Control, is issued under the 

authority of the FMFIA (section 2). OMB Circular A-123 states that management is responsible 

for establishing and maintaining internal control to achieve the objectives of effective and 

efficient operations, reliable financial reporting, and compliance with applicable laws and 

regulations. Management shall consistently apply the internal control standards to meet each of 

the internal control objectives and to assess the internal control effectiveness. 

OMB Circular A-127, Financial Management Systems, offers guidance in implementing FMFIA 

(section 4). OMB Circular A-127 requires that “Financial management systems shall be 

designed to provide for effective and efficient interrelationships between software, hardware, 

personnel, procedures, controls, and data contained within the systems”. 

The FEC has not fully complied with certain requirements of the FMFIA. See details in our 

Independent Auditor’s Report on Internal Control, Sections I and II. The key items we identified 

include: 

•	 Insufficient resources and personnel with appropriate Federal accounting and reporting skill 

sets; 

•	 Inadequate financial statement preparation and reporting controls; 

•	 Financial management systems not fully integrated; and 

•	 Weaknesses in information technology. 

This report is intended solely for the information and use of the management of FEC, FEC 

Office of Inspector General, GAO, OMB and Congress, and is not intended to be and should not 

be used by anyone other than these specified parties. 

Calverton, Maryland 
 

November 7, 2008 
 

2