Federal Election Commission 

Office of Inspector General 

Review of Outstanding Recommendations 

as of August 2018 

September 2018 

Assignment No. OIG-18-03 
 

 

 

 

 

 

 

 

 

 

Office of Inspector General’s
 

Review of
 

Outstanding Recommendations as of
 

August 2018
 

Report Revisions 

Per Commission Directive 50: Audit Follow-up, the Office of Management and Budget’s 

Circulars A-50, Audit Follow Up and A-123, Management’s Responsibility for Enterprise Risk 

Management and Internal Controls (as revised), management is required to timely implement 

corrective actions to address reported deficiencies in agency programs. Since fiscal year (FY) 

2012, as a courtesy to governance, the Office of Inspector General (OIG) has provided the 

Commission with semiannual reports regarding the status of management’s corrective actions for 

deficiencies that have been outstanding for six months or more. The OIG’s objective in issuing 

these Commission reports is to provide governance with an understanding of the risks that exist 

in the FEC’s environment, and ensure management is held accountable for sufficiently and 

timely addressing those risks. 

Starting FY 2019, the OIG will be revising our follow-up process and providing an annual 

Commission report regarding outstanding recommendations. As in the past, the report will still 

contain the OIG’s review of recommendations that have been outstanding for six months or more 

and any progress management has made to address these recommendations. The report will be 

issued as of February of each year. Although the OIG will only be submitting an annual report, 

follow-up on outstanding recommendations will still be conducted biannually, documented, and 

tracked in real-time in the OIG’s reporting database. 

Summary of Review 

For the last semiannual status report of FY 2018, the OIG reviewed and assessed management’s 

latest corrective action plans provided to the Commission as of May 2018 for the six audits and 

inspections reported in our previous report, Review of Outstanding Recommendations as of 

March 2018. In addition, for this report we included the Required Review Under the DATA Act 

(Data Act) audit report released November 2017, as its recommendations have been outstanding 

for six months or more. 

Collectively, these audits and inspections had 58 outstanding recommendations that required 

follow-up for this review period. Based on the results of the follow-up review, the OIG was able 

to close 8 of the 58 outstanding recommendations. The details of the OIG‘s review is included in 

the body of this report, along with the an attachment of the OIG’s corrective action plan (CAP) 

report containing the official status of all outstanding recommendations. 
 

 

 

 

 

 

 

 

 

 

 

Table Summary of Results 

The table below summarizes the progress made by FEC management since the OIG’s last 

reporting period and the total outstanding recommendations as of August 2018. 

OIG Audits/Inspection 

Total Outstanding 

Recommendations 

as of March 2018 

Total Closed Total Open as of 

August 20181 

2010 Follow-up Audit of Privacy 

and Data Protection 

7 years outstanding 

25 2 23 

2010 Follow-up Audit of 

Procurement and Contract 

Management 

6 years outstanding 

1 0 1 

Inspection of the FEC’s 

Disaster Recovery Plan and 

Continuity of Operations Plans 

5 years outstanding 

9 2 7 

Audit of the FEC’s Office of 

Human Resources 

4 years outstanding 

5 2 3 

Inspection of FEC’s Compliance 

with FMFIA/OMB A-123 

4 years outstanding 

5 1 4 

Audit of the FEC Telework 

Programs 

2 years outstanding 

9 0 9 

Required Review Under the DATA 

Act 

9 months outstanding 

4 1 3 

Total Outstanding Recommendations 50 

1 Column numbers may include recommendations that management has disagreed with or has not adequately 

implemented, and the OIG concludes that these recommendations are still open. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 2 | P a g e 
 

 

 

 

 

 

 

Audit Follow-up Meetings/Communications
 

Closed Audits/Inspections2 

The OIG did not close any audits or inspections this review period. 

Open Audits/Inspections 

A. Required Review Under the DATA Act 

The FEC OIG’s Required Review under the DATA Act (DATA Act Audit) was released 

in November 2017. The DATA Act Audit report identified four recommendations. This 

is the first follow-up for the DATA Act Audit. In August 2018, the OIG met with the 

DATA Act program members to discuss the status of the open recommendations. The 

OIG acknowledges that FEC Management has implemented revised quarterly 

reconciliation and certification processes and procedures. The OIG has reviewed the 

revised procedures and note they are adequately designed to address the DATA Act 

requirements related to ensuring data files are complete, accurate, and of quality. The 

OIG recorded the status update in our tracking database, and was able to close one of four 

recommendations. However, the OIG was informed that there are still some issues with 

the DATA Act files submitted to another agency with responsibilities in posting the 

FEC’s data. FEC management is continuing to work with the Federal Shared Service 

Provider to determine the root cause and correct these issues. Until the existing data 

issues are resolved and the IG can verify that the control processes are operating 

effectively, the remaining recommendations cannot be closed. There are three 

outstanding recommendations for this reporting period. 

For details on current outstanding recommendations, see Attachment A 

B. 2010 Follow-up Audit of Privacy and Data Protection 

For the 2010 Follow-up Audit of Privacy and Data Protection (Privacy Audit), the OIG’s 

Review of Outstanding Recommendations as of March 2018 report identified 25 open 

recommendations. For this review period, the OIG reviewed management’s May 2018 

CAP sent to the Commission and also met with the FEC’s new Privacy Team leader to 

discuss the open items. Based on the OIG’s meeting with the Privacy Team leader, the 

Privacy Audit CAP has been updated with revised implementation dates and current 

2 An audit or inspection is closed when the OIG determines that all applicable recommendations have been 

adequately addressed and/or management has determined that it will accept the risks of not implementing the OIG’s 

recommendation. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 3 | P a g e 
 

 

 

 

 

 

 

 

 

corrective actions to address the identified issues for the first time since February 2015. 

In addition, the OIG was able to close 2 of the 25 open recommendations based on our 

follow-up review. 

For details on current outstanding recommendations, see Attachment B 

C. 2010 Follow-up Audit of Procurement and Contract Management 

The 2010 Follow-up Audit of Procurement and Contract Management was issued in June 

2011. The OIG’s Review of Outstanding Recommendations as of March 2018 report 

identified only one open recommendation related to the updated Directive 66, which is 

the overarching agency-wide policy for procurement and acquisitions. This 

recommendation is still open this reporting period. 

For details on current outstanding recommendations, see Attachment C 

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

The Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans 

(COOP Inspection) report was released in January 2013. The OIG’s Review of 

Outstanding Recommendations as of March 2018 report identified nine outstanding 

recommendations. The OIG reviewed management’s May 2018 CAP sent to the 

Commission and noted two recommendations that had been implemented related to 

COOP training. The OIG recorded the management’s activity in our tracking database 

and closed the two recommendations, leaving seven outstanding recommendations for 

this reporting period. 

For details on current outstanding recommendations, see Attachment D 

E. Audit of the FEC’s Office of Human Resources

The Audit of the Federal Election Commission’s Office of Human Resources (OHR 

Audit) report was issued in July 2013. The OIG’s Review of Outstanding 

Recommendations as of March 2018 report identified five open recommendations for the 

OHR audit report. The OIG met with the Director of OHR to discuss status of open 

recommendations. The OIG confirmed that the OHR has converted all hiring related 

processes to the USA Staffing automated system which follows the standard OPM 80 day 

hiring model. This new system utilizes workflow and has automated the hiring process 

including the tracking of each vacancy. The OIG also acknowledges that a standard 

operating procedures manual was also developed for this new process. Therefore, the 

OIG was able to close two of the five open recommendations related to the hiring and 

selection process. There are three outstanding recommendations for this reporting period. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 4 | P a g e 
 

 

 

 

 

 

For details on current outstanding recommendations, see Attachment E 

F. Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123 

The Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123 (A-123 

Inspection) was released in June 2014. The OIG’s Review of Outstanding 

Recommendations as of March 2018 report identified five open recommendations for the 

A-123 Inspection report. Through follow-up inquiries with OCFO and a member of the 

A-123 Task Force, the OIG confirmed that the revised Directive 53 was submitted to the 

Commission for review and approval. Also, the OIG reviewed supporting documentation 

related to the process for ensuring any new program office members to be involved in the 

annual ICR process are trained timely. The OIG verified that this process has been fully 

implemented, and was able to close one of the five open recommendation. The OIG notes 

that OMB recently rolled out a new A-123 Appendix A that aligns the annual ICR 

assessment process with the guidance around the implementation of an Enterprise Risk 

Management (ERM) framework, which require risk assessments to incorporate ERM 

concepts and fraud risk assessments. This new guidance may require additional 

documentation and/or changes to the annual ICR process. The OIG will assess once these 

new requirements have been fully implemented. Therefore, four outstanding 

recommendations remain open for this reporting period. 

For details on current outstanding recommendations, see Attachment F 

G. Audit of the FEC’s Telework Programs 

The Audit of the FEC’s Telework Programs (Telework Audit) was released in June 2016. 

The OIG’s Review of Outstanding Recommendations as of March 2018 report identified 

nine open recommendations for the Telework Audit report. The OIG reviewed 

management’s May 2018 CAP sent to the Commission and noted a revised 

implementation date for generating telework reports to be utilized to monitor and assess 

the telework programs. The OIG recorded the status update in our tracking database. 

However, we are unable to close any recommendations until corrective actions are fully 

implemented and are operating effectively. Therefore, there are still nine outstanding 

recommendations for this reporting period. 

For details on current outstanding recommendations, see Attachment G 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 5 | P a g e 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Background
 

As required by the Inspector General Act of 1978, as amended, the OIG is responsible 

for conducting audits of the FEC’s programs and operations. In addition to conducting 

and supervising audits, the OIG also has the responsibility to conduct audit follow-ups 

to ensure that management has effectively implemented OIG recommendations. Audit 

follow-up, including the timely implementation of audit recommendations by FEC 

management, is required by Office of Management and Budget Circular A-50, Audit 

Follow-up, as revised, and FEC Directive 50: Audit Follow-up. 

At the conclusion of each OIG audit and inspection, it is management’s responsibility to 

develop a corrective action plan (CAP). The CAP identifies the plan management has 

developed to address the OIG’s findings and recommendations. The CAP should detail the 

following: 

1.	 assignment of Audit Follow-up Official, who is responsible for overseeing the 

corrective action;
 

2.	 OIG finding(s); 

3.	 OIG recommendation(s); 

4.	 detailed corrective action to implement the OIG’s recommendation(s); 

5.	 FEC staff person with responsibility to implement each task; and 

6.	 expected completion dates. 

Once management drafts the CAP, the OIG then reviews the CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the 

final CAP to the Commission with a courtesy copy to the OIG. 

FEC Directive 50 requires management to: 

(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission...; 

In order to work effectively with FEC management in adhering to FEC Directive 50, 

and to ensure continuous monitoring and adequate and timely audit resolution, the 

OIG communicates with management at least semiannually to discuss the status of 

outstanding OIG recommendations. If management has implemented any corrective 

action(s), the OIG schedules a meeting with management to discuss the 

implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (e.g., new/updated policies, procedures, and processes to improve 

internal controls). 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 6 | P a g e 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

To provide management with timely feedback and the results of our review prior to 

management’s reporting deadlines to the Commission in May and November, the OIG 

conducts a scheduled review of outstanding recommendations as of February and August of 

each year, and provides an annual report to the Commission. The semiannual meetings are 

also intended to assist the audit follow-up official in following provisions 4 through 6 of 

Directive 50, which are listed as follows: 

(4) Respond in a timely manner to all audit reports; 

(5) Engage in a good faith effort to resolve all disagreements; and 

(6) Produce semi-annual reports that are submitted to the agency head. 

The official status (open/closed) of OIG recommendations is determined by the OIG 

once the OIG has verified that management has adequately implemented the corrective 

actions. The Inspector General can also make a decision to close recommendations or 

seek resolution from the Commission for recommendations where the OIG and 

management disagree. Lastly, the number of outstanding recommendations is also 

reported to the Commission and Congress in the OIG’s Semiannual Reports to Congress. 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 7 | P a g e 
 

 

 

ATTACHMENTS
 

A – G
 

*Corrective Action Plans are as of September 25, 2018 

Office of Inspector General’s Review of Outstanding Recommendations as of August 2018 8 | P a g e 
Recommendation Actual Issue Date Estimated Implementation Date Last Status Update Revised Implementation Date Days Past Due 

Attachment A: Data Act Audit 

The SAO should ensure adequate control procedures are implemented to ensure data files are complete, accurate, timely, reconciled, and properly linked. 

11/30/2017 6/1/2018 

The DATA Act quarterly reconciliation and certification procedures have been updated. Also, File D1 is now reviewed monthly to identify and correct any errors prior to the submission. The SAO reviews the reconciliation spreadsheet and meets with the DATA Act program group to discuss data issues identified prior to certifying the DATA files in the Broker. 

Not Provided 116 

The OIG rereconciliatiand they apAct requirefiles are comquality. OIG reviewed merrors timelsome data qlinkage issusome of theactions by tmanagemenFSSP to resnot guarantDATA files Broker. OIG actions havensure accuto the Broknot be close

The FEC DATA Act PMO and Senior Accountable Official (SAO) should work with the FSSP to ensure appropriate corrective actions are implemented to ensure all future DATA Act submissions are submitted on time and the files are complete 

11/30/2017 6/1/2018 

All DATA files are being submitted to the Broker on time. However, there are still some accuracy and quality issues identified with some of the DATA files, but they are not always corrected by the FSSP and the FSSP will not commit to resubmit files. FEC management continues to work with the FSSP to resolve data issues. 

Not Provided 116 

OIG notes tbe resolvedbe closed. 

The SAO should ensure that proper controls are in place to ensure all non-financial data related to Procuremenstandard data elements are entered into the Procurement is reviewing policies and procedures procurement system correctly. 

11/30/2017 6/1/2018 

procedures and is in the process of retraining and reeducating program offices in how to initiate an enter award data into Comprizon. Also, DATA Act program staff is reviewing File D1 monthly to identify any issues prior to the quarterly submission. 

Not Provided 116 

retraining ain how to inComprizonstaff is reviidentify any submissionbe closed eprocess is o
Recommendation Actual Issue Date Estimated Implementation Date Last Status Update Revised Implementation Date Days Past Due 

Attachment B: 2010 Follow-up Audit of Privacy and Data Protection 

Should develop and maintain a comprehensive list of all vendors that handle PII. 

3/31/2011 9/30/2011 

Work with the Contracting Officer and CORs to develop a process to maintain a comprehensive list of PII vendors. 

10/1/2018 -6 

Develop a standardized template to allow system managers to accurately document SORs independently of the Privacy Team. 3/31/2011 2/29/2012 Develop a form template to send to managers to submit any SOR additions. 10/1/2018 -6 Enhance existing guidelines and procedures to include timelines and deadlines that promote regular review and timely updates to SORs. 3/31/2011 1/31/2012 

Create a biennial (every 2 years) SOR review policy and review checklist and documentation of that review to be signed by the Chief Privacy Officer to ensure SORs reviewed. 

10/1/2018 -6 

Develop and implement policies and procedures that define monitoring and reporting processes to ensure SORs are updated and amendments published in accordance with Federal regulations by: 1) providing regular training to FEC managers and SOR system owners/managers; 2) establish deadlines, based on the legal requirements of OMB A-130, for documenting the new SORs, revisions to existing SORs, and publish the updated SORN; 3) providing legal assessment of potential changes in SORs and quality assuring the SORs produced by system owners/managers; 4) including performance standards in employee performance plans that are linked to successful compliance with Federal regulations; and 5) requiring regular reporting of compliance with the timelines to the Commission. 

3/31/2011 3/31/2012 

Send a memo to FEC managers explaining the institution and use of the SOR addition form and requesting any SOR additions by Dec 2018. By March 31, 2019, the privacy counsel will conduct the first biennial SOR review and update the SORs for the FEC. After this first review, the privacy team will continue conducting legal assessments of potential system of record changes and also will accept submissions of SORs using the SOR addition request form from managers outside the Privacy Team. A record of the Biennial SOR reviews will be kept for the IG to review. Privacy Counsels standards include reference to keeping accurate records and reviewing departments for changes. 

11/1/2018 -37 

Complete legal reviews of OMB memoranda on a more timely basis and consistently communicate the results of the affected stakeholders, with a copy to the co-Chief Privacy Officers. 

3/31/2011 6/30/2011 

OGC will create a policy memo and tracking system to ensure new OMB memoranda are reviewed and make this system available for IG review. 

11/1/2018 -37 

Finalize the evaluation of the draft STSI recommendations and develop, document and implement a corrective action plan as necessary. Progress against the corrective action plan should be formally and periodically reported to management. 

3/31/2011 2/29/2012 

Review STSI report, notate on report which action items correspond to the CAP and refer IG to the current CAP plan to resolve those joint STSI and CAP audit items. If any items on the STSI plan do not correspond to the CAP plan these will be addressed and resolved. This document will be provided to the IG. 

11/1/2018 -37 
ISSO, Physical Security Officer, and/or division 

management should conduct regular walkthroughs Create a policy to conduct yearly walkthroughs to 

to ensure that agency staff complies with privacy ensure staff comply with privacy and information and information security standards are being met. 3/31/2011 9/30/2011 security standards. Document findings. Make log 12/1/2018 -67 

Implementation of these action items are subject to documenting yearly walkthroughs available to IG for 

Commission notification and/or approval. inspection. Contracting Officer and COTRs should enforce the requirement for contractors to certify secure destruction or return of FEC information in both paper and electronic format 

3/31/2011 9/30/2011 

Create and institute an exit checklist for contracts that are ending that ensures that contractors return or securely destroy FEC information when no longer needed. 

12/1/2018 -67 

Should establish policy and procedures requiring COTRs to inspect the physical space occupied by contractors when the contractor departs to ensure paper and electronic records are securely disposed of or filed 

3/31/2011 9/30/2011 

Create and institute an exit checklist for contracts that are ending that includes an inspection of contractor-occupied space after termination of the contract. 

12/1/2018 -67 

Update and maintain the inventory of all systems that contain PII for all the divisions. A potential approach is to use the templates created by STSI and have each division update their current listing and implement business processes to continually update the inventory based on new or revised handling and storage of PII. A full review could be conducted by 

3/31/2011 4/30/2012 Update the 2009 PII review inventory and provide proof of this procedure to the IG. 2/1/2019 -129 

the divisions at least annually and would help support the biennial Privacy Act Systems of Records update process. Provide the Privacy Team’s SSN Reduction Plan Phase 1 report to the applicable division heads, and work with those offices to prepare action plans to address the findings in the report. 3/31/2011 3/31/2012 

Audit and inventory Social Security Number and PII usage within FEC. Interview information owners and determine whether PII and SSN collection and storage is necessary. Prepare spreadsheet reporting these findings to IG. (4c) Remediate by eliminating unnecessary uses of PII and SSNs (4d) and reporting results to IG. This process will be completed once per fiscal year. A record will be kept noting that we 

2/1/2019 -129 

Complete Phase 2 and Phase 3 of the “FEC’s Plan to Review and Reduce Holdings of Personally Identifiable Information and Eliminate Unnecessary Use of Social Security Numbers In Response to OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information” as soon as practical. This can be accomplished by providing the STSI results to the divisions and requesting a response on the ability to reduce or eliminate the questionable uses of social security numbers already identified by the 

3/31/2011 3/31/2012 

Audit and inventory Social Security Number and PII usage within FEC. Interview information owners and determine whether PII and SSN collection and storage is necessary. Prepare spreadsheet reporting these findings to IG. (4c) Remediate by eliminating unnecessary uses of PII and SSNs (4d) and reporting results to IG. This process will be completed once per fiscal year. A record will be kept noting that we completed this process each year. 

2/1/2019 -129 

contractor. 
Include a record in the inventory listing of whether 

the device is encrypted or not. 

3/31/2011 9/30/2011 Management will provide a report that shows that devices are encrypted. 2/1/2019 -129 

Work with the Physical Security Officer, the FEC Records Officer, and FEC management to incorporate SORs assessment processes into electronic and paper records management processes. 3/31/2011 3/31/2012 

Management will consider whether in undocumented SORs exist in the Records Management processes (Commission Secretary Office) and Physical Security procedures (badging system info, etc.) if in paper or electronic form. 

5/1/2019 -218 

Division managers should work with the Physical Security Officer and the Records Officer to assess records management and secure storage needs and address failures to adequately secure sensitive information noted during the walkthrough. 

3/31/2011 9/30/2011 

Resolve issues found in walkthrough. Include in the discussion the pros and cons of locking suite doors after business hours. 

7/1/2019 -279 

Should review on a regular basis all of the privacy and data security policies, procedures, standards and guidelines on a defined timeframe (e.g., annually), and they should be dated, and updated as necessary and include a point of contact if employees have questions. 

3/31/2011 3/31/2012 

Conduct and keep a log of annual reviews of all privacy policies. Make log available to IG for inspection. The first privacy inspection will be conducted April 2019 

10/30/2019 -400 

Should develop a policy and supporting procedures to assess and approve vendors with access to FEC PII to reasonably ensure that the vendor has adequate controls in place to protect the information before any PII is provided to the vendor. 

3/31/2011 9/30/2011 

Collaborate with the Contracting Officer to document or develop policies and supporting procedures that require prospective contractors to provide evidence of internal controls that will safeguard the agency’s sensitive information or PII that the contractor has access to. 

11/1/2019 -402 

Should formally document the process used to review the FEC’s vendors and the results should be retained to evidence the review procedures performed. In addition, there should be documented management approval from the department head that is the source of the information to be shared with the vendor and either of the co-Chief Privacy Officers before the vendor is provided access to FEC PII. There may be more than one department head that should review and approve a specific vendor if 

3/31/2011 9/30/2011 

Work with Contracting Officer to document or develop a process for reviewing and documenting vendor privacy controls. 

11/1/2019 -402 

the PII affected pertains to more than one department. Conduct privacy impact assessments in accordance with Section 522, or create an alternative process for ensuring that privacy risks associated with PII are documented, assessed and remediated as necessary. 3/31/2011 11/30/2011 

OCFO has an ERM process in development per the new A123 guidance that assesses risk agency-wide and could cover this recommendation. Privacy Counsel will meet with Gilbert and discuss, then provide further action plan. Management is researching and developing a solution to address the recommendation. 

12/1/2019 -432 
Comply with OMB memoranda, or in the event of 

statutory exemption and a decision not to voluntary comply, document that sufficient controls exist to mitigate the need to comply. Where compliance is not adopted due to resource constraints or other reasons, document the legal assessment, risk 

3/31/2011 6/30/2011 Management is researching and developing a solution to address the recommendation 12/1/2019 -432 

analysis, and cost-benefit to the FEC. Identify and implement a governance framework (e.g., NIST, the AICPA's Generally Accepted Privacy Principles (GAPP)), to ensure that controls within the FEC to protect PII are appropriately identified, documented, and implemented. 

3/31/2011 4/30/2012 Management is researching and developing a solution to address the recommendation. 12/1/2019 -432 

Conduct a risk assessment annually for all existing and new applications that collect, process, transmit or store PII. If PIAs were performed, a risk assessment component could be built into that process to accomplish both the PIA and risk assessment recommendations. 

3/31/2011 5/31/2012 

Conduct an informal risk assessment of agency PII. This could possibly be resolved with Gilbert's risk mgt process further research needed. 

12/1/2019 -432 

Prepare a documented corrective action plan for any deficiency noted for each risk assessment performed and report progress periodically until all corrective actions are implemented. The corrective action plan should be approved by management. 

3/31/2011 9/30/2012 Prepare a corrective action plan for what is found in 5A. 12/1/2019 -432 
Recommendation Actual Issue Date Estimated Implementation Date Last Status Update Revised Implementation Date Days Past 

Attachment C: 2010 Follow-up Audit of Procurement and Contract Management 

Complete the revisions to procurement policies and ensure that the procurement directive is finalized and issued within FY 2011. 

6/6/2011 1/30/2012 

OIG confirmed that Procurement has either updated or created appropriate Proc Pros to address current 

procurement practices and internal control procedures that are aligned with the FAR. However, this recommendation can not be closed until senior management makes a decision whether Directive 66 is still warranted or not. If so, Directive 66 should be finalized and approved by the Commission. The Acting CFO plans to add this to list of topics to be placed on the Commission's calendar within the next 6 months. 

Not Provided 2430 
Recommendation Actual Issue Date 

Estimated 

Implementation 

Date 

Last Status Update 

Revised 

Implementation 

Date 

Days Past 

Due 

Attachment D: Inspection of the FEC's Disaster Recovery and Continuity of Operations Plan 

Update all Continuity of Operation Plan (COOP) and Disaster Recovery Plan (DRP) personnel contact information to reflect the most current information and distribute the updated plans to the appropriate officials by February 2013. 

1/30/2013 6/30/2013 

Management has updated the COOP list as part of its phased approach and dtermines the action to be completed. 

3/31/2017 543 

The OIG listing anto verify carryout event of business response6 of the tablet to review woutstandMarch 2made by Thus, the although 

OIG noteprocess o

We recommend that COOP/DRP training is provided at least annually. Personnel newly appointed to COOP roles should receive training shortly thereafter joining the FEC if training has already been conducted for the year. 

1/30/2013 7/31/2013 Training implemented May 2018 and will be conducted yearly. 6/30/2017 452 

Although skillportthe strucprevents training rplan of thThese issReview oof March have beeissuance

We recommend that FEC install and test a backup media reader in the alternative disaster recovery site. 

1/30/2013 6/30/2013 

In reviewing various scenarios as well as our current backup infrastructure, we believe a more updated solution should be considered like off-site vaulting adn cloud backups. We are working to compare backup solutions from the top industry cloud providers as well as off-site vaulting providers to dermine which 

6/30/2017 452 

Per manaCommiscorrectivrecommeprovided
Implement and document a policy that includes: • 

Who is responsible for updating and monitoring the contact information in the FEC’s COOPs and DRP to reflect current information; • An organization-defined frequency for updating the FEC’s COOP/DRP contact 

information; and • “Required” information that must be provided for those personnel with COOP responsibilities (i.e. FEC office#, FEC blackberry#, personal cell phone and/or home number). 

1/30/2013 6/30/2013 

Currently working with Deputy SD to determine the role where this responsibility should lay and update the COOP with this information. No policy required. 

12/29/2017 270 

Managemfor comppolicy is associatepolicy fo

Within the fiscal year (FY13), develop and implement a test plan to fully test the ITD DRP, with a target date to begin testing on or before June 2013. 1/30/2013 12/31/2013 

Work has started to determine the functions and processes requiring testing. One plan doesn't work for all systems so this will be a lengthy process as we address each system individually. 

12/29/2017 270 

Correctivthis open impleme

Ensure the disaster recovery Kofax server is updated A theoretical test plan has been devised and the team Correctiv

to mirror the Kofax production server by June 2013. 1/30/2013 12/31/2013 is working to validate this theory with a more concrete 12/29/2017 270 impleme

plan, the addit

Procure the necessary hardware/software to fully test the data entry application needed for Disclosure by December 2013 1/30/2013 12/31/2013 

Based on further review, we have determined there is no need to purchase hardware/software to test Data Entry however more time is required to determine how best to conduct a test - end of FY 2018. 

9/30/2018 -5 

Managemaction to and has rto the en
Recommendation Actual Issue Date Estimated Implementation Date Last Status Update Revised Implementation Date Days Past Due 

Attachment E: Audit of the FEC's Office of Human Resources 

Once the Remedy customer request tracking system is implemented, OHR Management should determine the most effective way to use the automated system to improve the HR On Demand process and leverage the new system to streamline other related processes and procedures. In addition, this new process along with other related processes should be formally documented in a policy and/or standard operating procedures(SOP). The policies/SOPs should clearly document each OHR members’ role and responsibilities, as well as details about the technical and operational components of the processes. 

7/31/2013 9/30/2013 Rememdy is not being used and has been terminated. OHR on Demand is primary communication tool. Not provided 1821 

The OIG was iOCIO is still etracking system Remedy SystemOHR also noteoffice set to ustherefore he dosystem will be a new system omonitor the timfully implemenclosed. 

OHR should periodically (at least annually) review all HR- related policies and procedures for the agency and for the OHR to ensure policies and procedures are accurate and relevant, and update as needed. 

7/31/2013 10/1/2013 

New DHR reorganizing all HR policies to allow more frequent updates and better procedural approach. Plan to incorporate wiki tools to improve agency visibility of all procedures. 

Not provided 1820 

The Director oidentifying all directives, and rescinded, and/regulations/lawOHR is now wgroup to take tupdate/create tprocedures. To have been comfingerprinting SOP. The OIG has been fully 

All policies and procedures should be posted in a central location accessible to all FEC staff (ex: FECNet [FEC intranet], the FEC computer server). In addition, when policies and procedures are updated they should be reposted and an email sent to all FEC staff on the changes/updates. 

7/31/2013 9/30/2013 

(1) Policies/procedures will be updated as policies are approved. (2) New DHR reorganizing all HR policies to allow more frequent updates and better procedural approach. Plan to incorporate wiki tools to improve agency visibility of all procedures. Working with IT to upgrade OHR website, pending hiring IT web designer. 

Not provided 1821 The OIG will v

been fully imp
Actual Issue Date

Estimated 

Implementation 

Date

Last Status Update

Revised 

Implementation 

Date

Days Past Due O

The Office of the Chief Financial Officer (OCFO) should ensure sufficient information is included in the internal control review (ICR) packages submitted by program offices by making the ICR report mandatory.

6/17/2014 12/31/2014

In 09-2015, the Acting CFO created the A-123 task force. The purpose of the A-123 Task Force is to develop recommendations for implementing and/or revising FEC's internal control framework to comply with the newOMB A-123 guidance. Detailed procedures and training for annual internal review process included risk assessments. ICR guidance is provided annually. The FEC's A-123 Task Force has revised Directive 53 and it was approved by the Commission.on September 6, 2018.

Not Provided 1364

The OIG acknowledwas revised, a new rolled out for the FY Directive 53 has beeICR process. Per revassessments submitconcludes some offiinformation to satisfcompliance with A-did not provide adeqthe 17 principles, sospecific program inflist internal control notes that OMB recAppendix A to align implementation of a(ERM) framework arequire additional dthe annual ICR procthe revised Directivand we can confirm effectively and adeqadditional A-123 re

OCFO should require any item marked as high risk on the VAC is explained in the respective program office’s ICR Report.

6/17/2014 12/31/2014

The new ICR assessment template currently requires items marked as high risk to be explained in the respective program offices report.

Not Provided 1364

The new ICR procerequires any internaidentified and explaFY 2017 control assoffices, OIG conclusufficient informatioratings or identify aOIG notes that OMB 123 Appendix A to the implementation Management (ERMAct.This may requirand/or changes to thwill assess once thefully implemented

Recommendation

Attachment F: Inspection of FEC's Compliance with FMFIA/ OMB A-123 
As a best practice, program managers with the 

assistance of OCFO, should be trained on how to conduct an inherent risk assessment for all mission critical programs. Going forward, these inherent risk assessments should be reviewed annually as part of the ICR process.

6/17/2014 12/31/2014

Initial internal control training was provided by Management Concepts in 2016. In addition A-123 Task Force members trained the appropriate staff on FEC's new annual ICR process prior to the FY 2017 assessments were completed..

Not Provided 1364

OIG acknowledges Management ConceForce. However, peassessments submitconcludes that additEspecially in light orolled out a new A-guidance around the Enterprise Risk Manthe DATA Act.This documentation and/process. The OIG wrequirements have b

The OCFO should improve their review process by paying special attention to the methodologies for the risk ratings and explanations of control issues for reasonableness, and to ensure all internal control issues are properly reported and potential material control weaknesses are identified.

6/17/2014 12/31/2014

The OCFO will follow-up with program offices. OCFO relies on program offices for control weaknesses. We review that they are reported forward. We also review the conclusions provided are supported and check to see that they are aligned. Establishment of SMC- Membership includes top management that is knowledgeable in program office responsibilities. This allows for comprehensive internal control review and risk identification.

Not Provided 1364

The OIG notes that which compiles the ICRs used to form tagency-wide unquanot adequately disclknown control issueis incorporated into still required to discif they are significanthe applicable oversproviding the overaIn addition, the new require risk assessmconcepts and fraud rin FY 2017. The OIhas established the SCommittee. The SMimplementation plan recommendation caoversight procedureensure compliance woperating effectivel
Actual Issue Date Estimated Implementation Date Last Status Update Revised Implementation Date Days Past Due 

The TMO or designee should reinforce telework policies and procedures to supervisors and staff annually (and as needed based on results of monitored activity).

6/28/2016 1/31/2017 TMO to send periodic reminder emails to all staff concerning Telework procedures. Ongoing 12/30/2018 -96

The OIG notes during Teleworreferences compHowever, the Odocumentation related to telewThis recommenthe OIG can conbeen conducted related to propehave been reinfeffectively. 

The TMO or designee should implement a control procedure to ensure all employees that are participating in the telework program have an approved telework application on file.

6/28/2016 9/30/2016 Reviewed annually 12/30/2018 -96 The OIG has no

procedure is op

The TMO or designee should periodically (at least annually) assess the telework programs and determine if policies and procedures need to be updated to reflect changes in standard practices and/or update for other reasons.

6/28/2016 9/30/2016 On-going 12/30/2018 -96

The OIG to conprocedures have we can verify thoperating effect

Management should ensure telework policies and training materials give clear explanations as to when each type of telework pay category should be used. Also, the TMO should hold refresher training.

6/28/2016 9/30/2016 Complete, included in WebTA program. 12/30/2018 -96

The OIG notes categories incosystem are alignthe NBU/BU ponot obtain any dspecific training where administwill remain opethat telework trand/or monitoriimplemented antelework are op

Managers should ensure that episodic telework is only used for its intended purpose which is defined in the OPM federal telework guidance and FEC Telework policies as “sporadic, short period of time.”

6/28/2016 9/30/2016

Reminder notice to all staff to comply with Telework policies go out periodically. Recommend that this item is closed.

12/30/2018 -96

The OIG to conprocedures have we can verify thtelework are op

The TMO or designee should periodically monitor telework activity to ensure episodic telework is being used properly, and to identify excessive use of episodic telework. The OIG suggests that WebTA telework reports could be generated to assist in this process.

6/28/2016 9/30/2016 Report development and testing in progress, estimated completion date is December 2018. 12/30/2018 -96 The OIG to con

has been fully i

Recommendation

Attachment G: Audit of the FEC's Telework Program 
FEC telework policies should state whether 

employees can request and/or be granted special telework arrangements (any arrangement outside the normal policy), as well as list the criteria that will be used for determining whether or not an employee can be approved for a special telework arrangement. If special telework arrangements are to be allowed, even if on a temporary basis, they should be documented in writing separate from the standard telework application and should include the anticipated timeframe of the special arrangement. Consideration should be given to have all special telework arrangements approved by the Staff Director, General Counsel, or Chief Financial Officer, as appropriate, along with notification to the TMO.

6/28/2016 1/31/2017

Special telework requests are handled through the FEC's Reasonable Accommodation Process through the EEO office, with documented evidence that special circumstances exist. No further action required, recommend this item to be closed.

12/30/2018 -96

The OIG was intelework businespecial telework policy except fogranted through accommodation has reason to barrangements hthis audit reportwhether the arrathrough the reasprogram. The OManagement shNBU telework pspecial teleworthe policy guideeither as part of plan or authorizemail) by the Talso be proposenegotiations. In that managemenreview proceduincorporate stepthese types of awere properly a

The TMO or designee should perform monitoring of the telework programs at least annually. The WebTA telework activity reports could be generated and reviewed to perform monitoring and evaluation of the telework programs. Currently these reports are generated to respond to occasional OPM telework data calls. For example, some of the reports list the names of the employees who telework more days than the policies allow and break it down by the actual number of days teleworked. A sample of employees who appear to telework more days than are allowed per policy could be followed up on to determine if the data is accurate, proper documentation exists, explanations are reasonable, and/or telework activity is not incompliance with applicable policies.

6/28/2016 9/30/2016 Report development and testing in progress, estimated completion date December 2018. 12/30/2018 -96 The OIG to con

has been fully i

The TMO or designee should implement tools and processes to evaluate the effectiveness of the FEC’s telework programs.

6/28/2016 9/30/2016 Report development and testing in progress, estimated completion date December 2018. 12/30/2018 -96 The OIG to con

has been fully i
or toll free at 1-800-424-9530 (press 0; then dial 1015)

Fax us at 202-501-8134 or e-mail us at oig@fec.gov

Visit or write to us at 1050 First Street, N.E., Suite 1010, Washington DC 20463

Federal Election Commission

Office of Inspector General

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to fraud, waste, abuse, 

and mismanagement of agency programs and operations. Individuals who contact the OIG can remain anonymous. 

However, persons who report allegations are encouraged to provide their contact information in the event additional 

questions arise as the OIG evaluates the allegations. Allegations with limited details or merit may be held in 

abeyance until further specific details are reported or obtained. Pursuant to the Inspector General Act of 1978, as 

amended, the Inspector General will not disclose the identity of an individual who provides information without the 

consent of that individual, unless the Inspector General determines that such disclosure is unavoidable during the 

course of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference.

Fraud Hotline

202-694-1015