FEDERAL ELECTION COMMISSION 
 

OFFICE OF INSPECTOR GENERAL 
 

FINAL REPORT 

Audit of the Federal Election Commission's 
 

Fiscal Year 2004 Financial Statements 
 

December 2004 
 

ASSIGNMENT OIG-04-01 
 
FEDERAL ELECTION COMMISSION 

WASHINGTON, D.C. 20463 

Office of Inspector General 

MEMORANDUM 

TO: 	 The Commission 

FROM: 	 Inspector General 

SUBJECT: 	 Audit of the Federal Election Commission's Fiscal Year 2004 Financial 
 

Statements 
 

DATE: 	 December 16,2004 

This letter transmits the final audit report of the Federal Election Commission's (FEC) fiscal year 

(FY) 2004 financial statements. In accordance with the Accountability of Tax Dollars Act of 

2002, the FEC prepared financial statements in accordance with Office of Management and 

Budget (OMB) Bulletin No. 01-09, Form and Content of Agency Financial Statements, as 

amended, and subjected them to audit. 

The Chef Financial Officers Act of 1990 (Public Law 101 -576, commonly referred to as the 

"CFO Act"), as amended, requires the FEC Office of Inspector General (OIG), or an independent 

external auditor as determined by the Inspector General, to audit the agency financial statements. 

Under a contract monitored by the OIG, Clifton Gunderson LLP (CG-LLP), an independent 

certified public accounting firm, performed the audit of the FEC's FY 2004 financial statements. 

In the report dated December 8,2004, CG-LLP issued an unqualified opinion on the FEC's 

financial statements. The OIG commends the FEC for the noteworthy accomplishment of 

receiving an unqualified opinion, the first year the FEC was subject to the requirements of the 

Accountability of Tax Dollars Act of 2002. Although the OIG recognizes this significant 

accomplishment, it is important to recognize that a tremendous amount of effort by FEC 

management, staff, and consultants was necessary to achieve the unqualified opinion. In 

addition, the auditor report on internal control includes both reportable conditions and material 

weaknesses, and numerous audit recommendations that must be addressed by management. 
Audit Process 

CG-LLP conducted the audit in accordance with auditing standards generally accepted in the 

United States of America; the standards applicable to financial audits contained in Government 

Auditing Standards, issued by the Comptroller General of the United States; and OMB Bulletin 

No. 01-02, Audit Requirements for Federal Financial Statements, as amended. The results of the 

financial statement audit are detailed in three reports: report on compliance with laws and 

regulations; report on internal control; and the opinion on the financial statements. 

Report on Compliance with Laws and Regulations 

FEC management is responsible for complying with laws and regulations applicable to the 

agency. To obtain reasonable assurance about whether FEC's financial statements are fi-ee of 

material misstatements, CG-LLP performed tests of compliance with certain provisions of laws 

and regulations, non-compliance with which could have a direct and material effect on the 

determination of financial statement amounts, and certain laws and regulations specified in OMB 

Bulletin No. 01 -02, such as the Anti-Deficiency Act and the Prompt Payment Act. 

The results of CG-LLP's tests of compliance with laws and regulations described in the audit 

report disclosed no instances of noncompliance with the laws and regulations that are required to 

be reported under Government Auditing Standards and OMB Bulletin No. 01-02. 

Report on Internal Control 

CG-LLP's planning and performance of the audit included consideration of the FEC's internal 

control over financial reporting. The CG-LLP auditors obtained an understanding of the FEC's 

internal control; determined whether internal controls had been placed in operation; assessed 

control risk; and performed tests of controls in order to determine auditing procedures for the 

purpose of expressing an opinion on the financial statements. The auditors limited their internal 

control testing to those controls necessary to achieve the objectives described in OMB Bulletin 

No. 01-02 and consequently CG-LLP did not provide an opinion on internal control. 

Internal control as it relates to the financial statements, is a process, affected by agency's 

management and other personnel, designed to provide reasonable assurance of the following: 

(1) transactions are properly recorded, processed, and summarized to permit preparation of the 

financial statements and assets are safeguarded against loss fi-om unauthorized acquisition, use or 

disposition; (2) transactions are executed in accordance with laws governing the use of budget 

authority and other laws and regulations that could have a direct and material effect on the 

financial statements and other laws and regulations identified by OMB; and (3) transactions and 

other data that support reported performance measures are properly recorded, processed, and 

summarized to permit the preparation of performance information in accordance with criteria 

stated by management. 
In performing the testing of internal control necessary to achieve the objectives in OMB Bulletin 

No. 01-02, the auditors identified matters relating to significantdeficiencies in the design or 

operation of FEC's internal control. The testing of internal control identified both reportable 

conditions and material weaknesses. The American Institute of Certified Public Accountants 

(AICPA) categorizes reportable conditions as matters relating to significant deficiencies in the 

design or operation of the internal control, which in thejudgment of the auditor, could adversely 

affect the agency's ability to record, process, summarize,and report financial data consistent 

with the assertions by management in the financial statements. Material weaknesses are 

reportable conditions in which the design or operation of one or more of the internal control 

components does not reduce to a relatively low level the risk that misstatements in amounts that 

would be material in relation to the financial statements being audited may occur and not be 

detected within a timely period by employees in the normal course of performing their assigned 

functions. 

CG-LLP identified material weaknesses in the areas of: 

Financial Reporting 

Information Technology 

CG-LLP identified reportable conditions, not considered to be material weaknesses, which 

include the following: 

Cost Accounting System and Processes 

General Property and Equipment 

Payroll 

Opinion on the Financial Statements 

CG-LLP audited the balance sheet of the FEC as of September 30,2004, and the related 

statements of net cost, changes in net position, budgetary resources, financing, and custodial 

activity for the year then ended. In the report dated December 8,2004, CG-LLP issued an 

unqualified opinion on the FEC's financial statements. 

The audit included an examination, on a test basis, evidence supporting the amounts and 

disclosures in the financial statements. The audit also included assessing the accounting 

principles used and significant estimates made by management, as well as evaluating the overall 

principal statements' presentation. 

Audit Follow-up 

The report on internal control contains numerous recommendations to address weaknesses found 

by the auditors. Management was provided a draft copy of the audit report for comment and 

CG-LLP reviewed management's comments. Although CG-LLP stands by the report and the 
weaknesses detailed, the OIG and CG-LLP intend to work with management through the followup and audit process to ensure the weaknesses are addressed satisfactorily. In accordance with 

OMB Circular No. A-50, Audit Followup, revised, and based on an agreement with the Offices 

of the Staff Director and General Counsel, the Staff Director or designee shall develop an action 

plan for corrective action of the recommendations. The action plan is to set forth specific action 

planned to implement the recommendations and the schedule for implementation. 

OIG Evaluation of Clifton Gunderson LLP's Audit Performance 

In connection with the OIG's contract with CG-LLP, the OIG reviewed CG-LLP's reports and 

related documentation and inquired of its representatives. Specifically, we performed the 

following: (1) reviewed CG-LLP's approach and planning of the audit; (2) evaluated the 

qualifications and independence of the auditors; (3) monitored the work of the auditors 

throughout the audit; (4) examined audit documents and audit reports to ensure compliance with 

Government Auditing Standards and OMB Bulletin No. 0 1-02; and (5) performed other 

procedures we deemed necessary. 

The OIG's review of CG-LLP's work, as differentiated fkom an audit in accordance with 

Government Auditing Standards issued by the Comptroller General of the United States, was not 

intended to enable us to express an opinion on the FEC's financial statements; provide 

conclusions about the effectiveness of internal control; or reach conclusions on whether FEC's 

management substantially complied with laws and regulations related to the audit. CG-LLP is 

responsible for the opinion and conclusions reached in the attached reports dated December 8, 

2004. The OIG review disclosed no instances where CG-LLP did not comply, in all material 

respects, with Government Auditing Standards. 

If you should have any questions, please contact my office on (202) 694-1015. We appreciate 

the courtesies and cooperation extended to Clifton Gunderson LLP and the OIG staff during the 

conduct of the audit. 

~ykneA. McFarland 

Inspector General 

Attachments 

Cc: Staff Director 

Acting Chief Financial Officer 

Accounting Officer 

Information Technology Director 

Deputy Staff Director for Audit and Review 
Table of Contents 

Transmittal Memorandum 

Independent Auditor's Report ....................................................................... 1 
 

Independent Auditor's Report on Internal Control .............................................3 
 

Independent Auditor's Report on Compliance with Laws and Regulations .................... 19 
 

Management's Comments to the Independent Auditor's Reports .........................20 
 
tiE#Lm
LL* 


Certified Wit Accountanb & ~ultants 

Independent Auditor's Report 

To the Inspector General of the 

Federal Election Commission 

We have audited the balance sheet of the Federal Election Commission (FEC) as of 

September 30,2004, and the related statements of net cost, changes in net position, budgetary 

resources, financing, and custodial activity for the year then ended. These financial statements 

are the responsibilityof FEC's management. Our responsibilityis to express an opinion on these 

financial statementsbased on our audit. 

We conducted our audit in accordance with auditing standards generally accepted in the United 

States of America; the standards applicable to financial audits contained in GovernmentAuditing 

~tandards,issued by the Comptroller General of the United States; and Office of Management 

and Budget (OMB) Bulletin No. 01-02, Audit Requirementsfor Federal FinancialStatements, as 

amended Those standards require that we plan and perform the audit to obtain reasonable 

assurance about whether the financial statements are free of material misstatement. An audit 

includes examining, on a test basis, evidence supporting the amounts and disclosures in the 

financial statements. An audit also includes assessing the accounting principles used and 

significant estimates made by management, as well as evaluating the overall principal 

statements' presentation. We believe our audit provides a reasonable basis for our opinion. 

In our opinion, the financial statements referred to in the first paragraph present fairly, in all 

material respects, the financial position of FEC as of September 30, 2004, and its net cost, 

changes in net position, custodial activity, budgetary resources and reconciliation of net cost to 

budgetary obligationsfor the year then ended in conformity with accountingprinciples generally 

accepted in the United States of America. 

In accordance with Government Auditing Standards, we have also issued our reports dated 

December 8,2004 on our considerationof FEC's internal control over financialreporting, and on 

our tests of FEC's compliance with certain provisions of laws and regulations. The purpose of 

those reports is to describe the scope of our testing of internal control over financial reporting 

and compliance and the results of that testing, and not to provide an opinion on the internal 

control over financial reporting or on compliance. Those reports are an integral part of our audit 

performed in accordance with Government Auditing Standards and should be considered in 

assessing the results of our audit. 

1 of2 , Offices in 15 states and Washington, DC 

IndependentAuditor's Report Page 1 
Our audit was conducted for the purpose of forming an opinion on the basic financial statements 

taken as a whole. The Management Discussion and Analysis and Required Supplementary 

Information are not a required part of the basic linancial statements, but are supplementary 

information required by OMB Bulletin No. 01-09, Form and Content of Agency Financial 

Statements. We have applied certain limited procedures to such information, which consisted 

principally of inquiries of FEC management regarding the methods of measurement and 

presentation of the supplementary information. However, we did not audit the information and 

express no opinion on it. 

Calverton, Maryland 

December 8,2004 

IndependentAuditor's Report Page 2 
Independent Auditor's Report on Internal Control 

To the Inspector General of the 

Federal Election Commission 

We have audited the financial statements of the Federal Election Commission (FEC) as of and 

for the year ended September 30,2004, and have issued our report dated December 8,2004. We 

conducted our audit in accordance with auditing standards generally accepted in the United 

States of America; the standards applicable to financial audits contained in Government Auditing 

Standards, issued by the Comptroller General of the United States; and Ofice of Management 

and Budget (OMB)Bulletin No. 01-02, Audit Requirements for Federal Financial Statements, as 

amended. 

In planning and performing our audit, we considered FEC's internal control over financial 

reporting by obtaining an understanding of FEC's internal control; determined whether internal 

controls had been placed in operation; assessed control risk; and performed tests of controls in 

order to determine our auditing procedures for the purpose of expressing our opinion on the 

financial statements. We limited our internal control testing to those controls necessary to 

achieve the objectives described in OMB Bulletin No. 01-02. We did not test all intemal 

controls relevant to operating objectives as broadly defined by the Federal Managers' Financial 

Integrity Act (FMFIA) (31 U.S.C. 3512), such as those controls relevant to ensuring efficient 

operations. The objective of our audit was not to provide assurance on internal control. 

Consequently, we do not provide an opinion on internal control. 

Our consideration of the intemal control over financial reporting would not necessarily disclose 

all matters in the internal control over fmancial reporting that might be reportable conditions. 

Under standards issued by the American Institute of Certified Public Accountants, reportable 

conditions arematters coming to our attention relating to significant deficiencies in the design or 

operation of the internal control that, in ourjudgment, could adversely affect the agency's ability 

to record, process, summarize, and report financial data consistent with the assertions by 

management in the hcial statements. Material weaknesses are reportable conditions in which 

the design or operation of one or more of the internal control components does not reduce to a 

relatively low level the risk that misstatements in amounts that would be material in relation to 

the financial statements being audited may occur and not be detected within a timely period by 

employees in the normal course of performing their assigned functions. Because of inherent 

limitations in internal controls, misstatements, losses, or noncompliance may nevertheless occur 

and not be detected. However, we noted certain matters discussed in the following paragraphs 

involving the internal control and its operation that we consider to be reportable conditions and 

material weaknesses. 

1 of 16 

Offices in 15 states and Washington, DC 

IndependentAuditor's Report on Internal Control Page 3 
Finally, with respect to intend control related to performance measures reported in FEC's 

Performance and Accountability Report, we obtained an understanding of the design of 

significant internal controls relating to the existence and completeness assertions, as required by 

OMB Bulletin No. 01-02, as amended. Our procedures were not designed to provide assurance 

on internal control over reported performance measures, and, accordingly, we do not provide an 

opinion on such controls. 

I. Financial Reporting 

The Accountabilityof Tax Dollars Act of 2002 extends to FEC a requirement to prepare 

and submit to the Congress and the Director of the OMB an audited financial statement. 

Fiscal year 2004 is the first year FEC is preparing and submitting audited financial 

statements. 

FEC has attained a major achievement by having its financial statements audited for the 

first time. FEC, however, had to expend a tremendous amount of effort to "cleanup" its 

accounting records in order to prepare auditable financial statements as of and for the 

year ended September 30,2004. 

The weaknesses identified below collectively resulted in a material weakness in FEC's 

financial reportingprocess. 

A. Financial Statement Preparation 

Our audit of the interim financial statements disclosed several misstatements andlor 

misclassifications resulting fiom ineffective or lack of adequate quality and 

supervisoryreviews and internal controls over the financial statement preparation and 

reporting process. These errors or omissions, some illustrated below, have consumed 

significant FEC resources in researching and correcting. The resources expended 

could have been devoted to the normal dailybusiness operations of FEC. 

FEC downloads the trial balance from the general ledger (GL) system to a 

qmadsheet to generate its financial statements. The unadjusted trial balance used 

in preparing the March 31,2004 financial statements did not agree to the balances 

in the GL system for most of its financial statement line items such as fund 

balance with treasury (FBWT), accounts payable (AP), net position and related 

wunts. Accordingly, the financial statements submitted to OMB did not have 

the correct balances because the errors were identified by both the FEC and the 

auditors only after the financial statementswere submitted. 

The March 31,2004 financial statementsdid not properly report the appropriation 

received and the status of budgetary resources. 

Independent Auditor's Report on Internal Control Page 4 
Software-in-development was not reported in the interim financial statements 


because FEC was still compiling the data. 


Certain on-top financial statement adjustments were posted incorrectly and key 


account relationshipsdid not always agree. 


The interim financial statements did not reflect the current accounting activities 


for certain areas and only partially met the guidance in OMB Bulletin 01-09, 


Form and Content of Agency Financial Statements. 

In addition, "catch-up" journal vouchers and significant past activities detected during 

this "clean-up" process were recorded for the first time as adjustingjournal entries or 

"on-top" financial statement adjustments. 

Moreover, OMB Bulletin No. 01-09, Form and Content of Agency Financial 

Statements, states that preparation of the annual financial statements is the 

responsibility of the agency's management. In canying out this responsibility, each 

agency chief financial officer should prepare a policy bulletin or guidance 

memorandum that guides the agency's fiscal and management personnel in the 

preparation of the annual financial statements. FEC does not have formal plans, 

methodology, or procedures to guide the financial statement preparation and reporting 

process. 

Two of the five standards for internal control as stated in the Government 

Accountability Office (GAO) St&& for Internal Control in the Federal 

Government are (1) information and communications, and (2) control activities. 

(1) 	 Information should be recorded and communicated to management and others 

within the entity who need it and in a form and within a timeframe that enables 

them to carry out their internal control and other responsibilities. 

(2) 	 Examples of control activities are: Reviews by management at the functional or 

activity level, proper execution of transactions and events, and accurate and 

timely recording of transactions and events. 

B. Timely Recording, Reconcllation and Analysis 

A major objective of internal control is to ensure the integrity of the underlying 

accounting data supporting the linancial statements. An important control in this 

regard is the reconciliation of accounting records. An adequate reconciliation, 

provides the assurancethat processed transactiom are properly and timely recorded in 

the accounting records and financial statements, which then allows management the 

ability to analyzeits financialcondition and results of operations on a routine basis. 

The FEC has not performed many of the periodic account reconciliations and 

analyses necessary during the year. Account reconciliations not performed included 

certain FBWT reports from the Department of Treasury, budgetary accounts such as 

Independent Auditor's Report on Internal Control 	 Page 5 
obligations, intragovernmental activities, and general property and equipment, among 

others. In addition, reconciliations that were performed were often not completed in a 

timely manner and certain account reconciliations contained reconciling items that 

have long been outstanding. Moreover, certain assets, such as software-indevelopment, were not reported in the interim financial statements because FEC was 

still compiling the data. 

Furthermore, due to FECYs delay in submitting the June 30, 2004 accounting data in 

the Treasury's Federal Agencies' Centralized Trial-Balance System (FACTS II),FEC 

was prevented by the system to submit the data. Thus,FEC did not submit its June 

30, 2004 accounting data. The accounting data includes mostly budgetary 

information that is required for the Report on Budget Execution and Budgetary 

Resources (SF 133), and the Year-End Closing Statement @MS 2108). 

C. GL System Setup and Posting Model Definitions 

The GL system setup and posting model definitions do not fully comply with the 

transactions posting models consistent with the United States Standard General 

Ledger (USSGL) guidance and policies when recording and classifying certain 

transactions. As a result, certain proprietary accounts and budgetary accounts do not 

agree, and certain trial balance accounts do not trace to the USSGL crosswalk. 

FEC is aware of the inherent limitations of the GL system and has attempted to 

upgrade the GL system during fiscal year 2004 to correct weaknesses identified. 

However, due to the enormous resources consumed in testing and monitoring the 

system upgrade and the problems arising hm the upgrade process and the audit of 

the financial statements, FEC has decided to postpone its upgrade until fiscal year 

2005. 

D. Integrated Financial Management System 

A single, integrated financial management system is a unified set of financial systems 

linked together electronically in an efficient and effective manner to provide agencywide financial system support. Integration means that the user is able to have one 

view into systems such that, at whatever level the individual is using the system, he or 

she can obtain needed information efficiently and effectively through electronic 

means. It does not necessarily mean having only one software application covering 

all financial management system needs within an agency. Interfaces are acceptable as 

long as the supporting details are maintained and accessible to managers. Interface 

linkages must be electronic unless the number of transactions is so small that it is not 

cost beneficial to automate the interface. Easy reconciliation between systems, where 

interface linkages are appropriate, must be maintained to ensure data accuracy. 

Independent Auditor's Report on Internal Control Page 6 
FEC does not have an integrated financial management system. Significant financial 

management systems such as the "cost system" and the property and equipment 

system are not interfaced with the GL system. 

Recommendations: 

1. 	 Establish written policy and procedures to formalize plans, methods and procedures 

to guide the financial statement preparation and reporting process. 

2. 	 Prepare and analyze monthly reconciliations of subsidiary and summary account 

balances. Consider a "formal closing" of all accounts at an interim &te(s), which 

will reduce the level of accounting activity and analysis required at year-end. This 

"formal closing" entails ensuring that all transactions are recorded in the proper 

period through the month-end. With complete and timely transaction recording, 

analysis of all major accounts can be performed effectively. 

3. 	 Ensure that supervisory reviews 	are applied to the financial statements and its 

supporting documentation, and the reviews are documented. 

4. 	 Ensure that upgrades to the financial management system comply with the posting 

model definitions in the USSGL. 

5. 	 Evaluate the functional requirements to integrate the financial reporting, property and 

equipment and the cost systems with the GL system; assess the degree of integration 

necessary to have a single, unified financial management system. 

11. Information Technology (IT) 

The reportable conditions below, when evaluated together, make the IT area a material 

weakness. 

A. 	Entity-Wide Security Program 

Effective information security management is critical to FEC's ability to ensure the 

reliability, availability, and confidentiality of its information assets, and thus its 

ability to perform its mission. If effective information security practices are not in 

place, FEC's data and systems are at risk of inadvertent or deliberate misuse, fraud, 

improper disclosure, or destruction-possibly without detection. 

GAO's research of public and private sector organizations, recognized as having 

strong information security programs, shows that their programs include (1) 

establish a central focal point with appropriate resources, (2) continually assessing 

business risks,(3) implementing and maintaining policies and controls, (4) promoting 

awareness, and (5) monitoring and evaluating policy and control effectiveness. (U.S. 

Government Accountability Office, Executive Guide: Information Security 

Independent Auditor'sReport on Internal Control 	 Page 7 
Management, Learning From Leading Organizations, GAOIAIMD-98-68 

[Washington, D.C.: May 1998]), and (GAO's Information Security Risk Assessment: 

Practices of Leading Organizations, A Supplement to GAO's May 1998 Executive 

Guide on Information Security Management, GAOIAIMD-00-33 [Washington, D.C.: 

November 19991). 

FEC has taken important steps to establish an effective information security program, 

but much remains to be done. In January 2004, FEC revised the Computer Security 

Officer position descriptionto fiuther strengthen the Commission's computer security 

program. In April 2004, FEC issued an Interim Final "Information System Security 

Program Policy", Policy Number 58A. Policy Number 58A was issued to "manage 

the risk to information rather than just systems". The FEC approved Policy Number 

58A and supplementsto Policy Number 58A in September2004. 

Current weaknesses that exist in the FEC's information security program include the 

following: 

FEC did not fhake its InformationSystem Security Policy until September 

2004. This policy was not fully implemented in fiscal year 2004; 

A hework of policies and standards to mitigate risks associated with the 

management of informationresources has not yet been implemented; 

Risk assessments, as part of FEC's overall strategy to mitigate risks associated 

with its informationtechnology environment, have not been conducted for more 

than three years. The FEC conducted a risk assessment in March of 2000, with 

several recommendations for strengtheningits informationtechnology 

environment. We noted that the FEC has not implemented many of the 

recommendations. Furthermore, the FEC has not updated its risk assessment 

since March of 2000 to ensure that its strategyto mitigate risk reflects changes in 

its informationtechnologyenvironment; 

There was no documented and approved entity-wide securityprogram plan. FEC 

has indicated that it is in the process of documentingits entity-wide security 

program plan. The FEC hasjust established in September2004 policy guidelines 

which it will use in the development and implementation of an entity-wide 

security program plan; 

The FEC completed the identificationof its major application and mission critical 

general support systems in September 2004, as part of its risk mitigation strategy. 

Thus,the FEChas not completed the development of security plans for these 

applicationsand systems; 

Major applications and mission critical general support systemshave not been 

certified to ensure that they are operating accordingto FEC's security 

requirements; 

A program for the continuous monitoring and evaluation of FEC's policy and 

controlsto ensure operatingeffectivenesshas not been established, and 

There is no periodic security awareness training. Training is only provided to 

new employees and contractors. The FEC did conduct a baseline awareness 

Independent Auditor's Report on Internal Control Page 8 
training program, but does not have a process in place to provide security 

awareness training on an annualbasis. 

Recommendations: 

6. 	 Implement a framework of policies and standards to mitigate risks associated with the 

information resources management. 

7. 	 Conduct risk assessments at least every three years as part of an overall strategy to 

mitigate risks associated with its information technology environment. 

8. 	 Complete the documentation, approval and implementation of an entity-wide security 

program plan. 

9. 	 Develop, and implement security plans for major applications and mission critical 

general support systems as part of a risk mitigation strategy. 

10. Certify that the major applications and mission critical general support systems are 

operating according to FEC's security requirements. 

11. Establish a program for the continuous monitoring and evaluation of the computer 

security policy and control effectiveness. 

12. Provide periodic computer security awareness training to all employees and 

contractors (i.e. contractors granted access to the FEC's network). 

B. 	Controls to Protect Information 

For a computerized organization like FEC, achieving an adequate level of information 

protection is highly dependent upon maintaining consistently effective access controls 

and system software controls. Access controls limit and monitor access to computer 

resources (i.e., data files, application programs, and computer-related facilities and 

equipment) to the extent necessary to provide reasonable assurance that these 

resources are protected against waste, loss, unauthorized modification, disclosure, or 

misappropriation. Access controls include 1ogicaVtechnical controls such as 

designing security software programs to prevent or detect unauthorized access to 

sensitive data. Similarly, system software controls limit and monitor access to 

pow& programs and sensitive files that control computer processing and secure the 

application and data supported by the system. 

Our limited testing of internal controls identified information protection related 

weaknesses in FEC's information systems environment. Impacted areas included the 

local area and wide area networks as well as its midrange computer systems (e.g. 

servers). These vulnerabilities expose FEC and its computer systems to risks of 

Independent Auditor's Report on Internal Control 	 Page 9 
external and internal intrusion, and subject sensitive information related to its major 

applicationsto potential unauthorized access, modification, andor disclosure. 

FEC has not assessed the risk of inadequate protection for its sensitive and mission 

critical files. No written criteria have been established to guide security personnel in 

monitoring and restricting access to production data and program files. 

Current weaknesses in access controls include the following: 

No documentationor verification that the vulnerabilitiesidentified in the February 


2004 network penetration scan have been addressed; 


Visitor (individuals that do not have approved daily access) logs for data center 


access were not maintained and no compensating controls to monitor and record 


visitor access to the data centerhave been implemented; 


Password controls are weak: 


o 	 There is no password lifetime set on the local area network (LAN); 

o 	 There are no technical controls to enforce password changes on the LAN and 

the GL system; 

o 	 Somepasswords on the FEC LAN have not been changed since 1997; 

o 	 The password policy cannot be updated or changed in the cwrent version of 

the GL system; 

o 	 The GL system passwords do not expire; 

o 	There is no limitation on the number of GL system password attempts (i.e. no 

lock-out policy); 

o 	There is no policy on the GL system composition of passwords; and 

o There are no controls on password length for the GL system. 

There are no records of access requests granted to remote users. The FEC was 

unable to provide access request approval documentation to support the access of 

all dial-up and Virtual Private Network (VPN)users that we sampled for our 

review. In addition, there was no evidence of periodic re-validations of these 

users; 

GL system access requests are not properly documented or reviewed. The FEC 

was only able to provide us ori@ access matrices for eight of the 33 current GL 

system users. Additionally, the FEC does not periodically perform revalidations 

of GL system access; 

The principle of "least privilege" is not consistently applied in the GL system 

application. A high level IT official has similar access rights and privileges in the 

GL system application as the Accounting Officer; 

Datacenter access is not adequatelydocumented or reviewed: 

o 	 Four employeeshave their names misspelled on the cardholder report; 

o 	One of the individuals with access to the data center was terminated recently, 

but his access key is still active and the physical location of the key could not 

be detee, and 

o 	FEC could not identify one user who has access to the data center or justify 

why the individual has access to the data center. 

Independent Auditor's Report on Internal Control 	 Page 10 
The FEC is not in compliance with its auditing policy because it does not 

automatically log the network activity described in the Audit Event Standard, 

even though it has the capability to do so. 

Recommendations: 

13. Establish a program to document corrective actions and verify that weaknesses 

identified have been addressed. Ensure and document that recommendations from the 

most recent network security review .have been implemented. 

14. Monitor and record visitor access to the &ta center. 

15. Strengthen the password controls for the FEC's network and major applications, 

including the GL system. 

16.Document and periodically revalidate VPN and dial-up access rights and privileges. 

17.Document access requests and approvals for the 	GL system. Perform periodic 

revalidation of access granted to the GL system. 

18. Ensure that the principle of "least privilege" is enforced. Ensure access in the GL 

system is granted according to job function and responsibility. 

19. Disable the active access keys of users not requiring access to the data center. 

Correct the misspelled names on the cardholder report. 

20. Use access request forms to document user access rights and periodically review the 

access for appropriateness. 

21. Automatically log network activity as required by the Audit Events Standardr. 

C. 	ContingencyPlan 

Losing the capability to process and protect information maintained on FEC's 

computer systems can significantly impact FEC's ability to accomplish its mission to 

serve the public. The purpose of service continuity controls is to ensure that, when 

unexpected events occur, critical operations continue without interruption or are 

promptly resumed. 

To achieve this objective, FEC should have procedures in place to protect information 

resources and minimize the risk of unplanned interruptions and a plan to recover 

critical operations should interruptions occur. These plans should consider activities 

performed at FEC's general support facilities (e.g. FEC's LAN, wide area network 

(WAN),and telecommunications hilities), as well as the activities performed by 

users of specific applications. To determine whether the disaster recovery plans will 

Independent Auditor's Report on Internal Control 	 Page 11 
work as intended, FEC should establish and periodically test the capability to perform 

its functions in disaster simulationexercises. 

Our review of the service continuity controls identified deficiencies that could affect 

FEC's ability to respond to a disruption in business operations as a result of a disaster 

or other long-term emergency. The deficiencieswere as follows: 

FEC has not formally identified and prioritized all critical data and operations on 

its major applications and the resources needed to recover them if there is a major 

interruption or disaster. In addition, we could not determine whether FEC had 

established emergency processing priorities that will help manage disaster 

situations more effectively for the network, 

FEC does not have alternative processing sites for most of its operations in the 

event of a disaster, includingits general ledger system; 

The FEC Disclosure Database is replicated at an off-site location as a webenabled read-only database the public can access. In the event that data cannot be 

updated at the FEC and then replicated at the off-site location, there is no 

operational mechanism to update the Disclosure Database replicated at the oBite 

location; 

FEC does not have adequate capacity for most of its back-up tapes in its fireproof 

safe; hence, back-up tapes are not kept in a fireproof safe. Back-up tapes, 

however, are rotated on a weekly basis to an off-site facility; 

FEC data center is fully exposed to a wet pipe sprinkler system, with no 

compensating controls to avert inadvertent water damage to critical hardware and 

magnetic media in the case of a malfunction or false alarm; and 

FEC has not developed and documented a comprehensive contingency of 

operationsplan of its data centers, networks and telecommunicationfacilities. 

Recommendations: 

22. Formally idenhfy and prioritize all critical data and operations on FEC's networks 

and the resources needed to recover them if there is a major interruption or disaster. 

Ensure that emergency processing priorities are established to assist in managing 

disaster situations more effectivelyfor the network. 

23. Establish alternative processing sites for FEC's operations in the event of a disaster. 

24. Establish operational mechanisms to update the Disclosure Database in the event the 

FEC database is unavailable to replicate the Disclosure Database resident at the 

offsite location. 

25. Procure an additional fireproof safe(s) for back-up tapes. 

IndependentAuditor's Report on Internal Control Page 12 
26. Investigate and document options for compensating controls to avoid inadvertent 

water damage to critical hardware and magnetic media in the case of a malfunction or 

false alarm from the wet pipe sprinkler system. 

27. Develop and document a comprehensive contingency of operations plan of FEC's 

data centers, networks and telecommunication facilities. 

D. Software Development and Change Controls 

Establishingcontrols over the modification of application software programs helps to 

ensure that only authorized programs and authorized modifications are implemented. 

This is accomplished by instituting policies, procedures, and techniques that help 

make sure all programs and program modifications are properly authorized, tested, 

and approved and that access to and distribution of programs is carefully controlled. 

Without proper controls, there is a risk that security features could be inadvertentlyor 

deliberately omitted or "turned off' or that processing irregularities or malicious code 

could be introduced. 

Weaknesses that currently exist in the FECYscontrols over modification of 

applicationprograms include the following: 

System Development Life Cycle Methodology has not been fdized and 

implemented; 

No written policy has been created to manage software libraries; 

Written pdures to modify, test, approve or release software for any of its 

applications, includingthe GL system, have not been documented; 

Emergency change pdures and procedures for installing patches are not 

documented; and 

Certain softwue code changes for the GL system were not reviewed before being 

implemented. 

Recommendations: 

28. Finalize and implement the System Development Life Cycle Methodology. 

29. Create a written policy to manage software libraries. 

30. Document written procedures to modify, test, approve or release software for any of 

its applications. 

31. Document written emergencychange procedures for installing patches. 

32. Establishpolicies and procedures to ensure that the soke code is reviewed prior to 

moving the modified code into production. 

IndependentAuditor's Report on Internal Control Page 13 
REPORTABLE CONDITIONS 
 

111. 
 Cost Accounting System and Processes 

A. Cost Allocation Methodology 

FEC does not have a cost accounting system that is integrated with the GL system. 

The current cost accounting system is not adequate to produce the cost data for the 

Statement of Next Cost (SNC) in an efficient manner. Accordingly, the cost data 

presented on the SNC is compiled from three systems' raw data, which is then 

gathered and analyzed in an elaborate, complex, and manually intensive spreadsheet. 

Raw data used in the allocation of costs, such as payroll, is sometimes based on 

estimates due to the timing of the availability of the data. Expenses on the budget 

execution report, another source of raw data, are not reconciled with the general 

ledger balances. 

FEC summarhes employee hours in a spreadsheet based on an office's program 

numbers, which is generated by a system. The program numbers represent the type of 

work performed by an employee and the hours are assigaed directly or allocated to 

FEC's three major programs. FEC could not provide crosswalk documentation or 

definitions supporting the basis of assignment or allocation. The data accumulation 

and analysis is performed by one person and not subjected to a second review. 

In addition, the FEC did not have a formal comprehensive policy and procedures for 

the program cost allocation. Although a written procedures document was provided 

to us, the document was written in response to our audit request and did not include a 

comprehensive set of procedures. 

The manually intensive and elaborate cost allocation process dictates the need for a 

formal comprehensive policy and procedures. Moreover, the heavy reliance on a 

single person to carry out this process could impair FEC's ability to generate a timely 

and accurate report when the person becomes unavailable. 

A control activity in the GAO Standarch for Internal Control in the Federal 

Government is appropriate documentation of transactions and internal control. 

Internal control and all transactions and other significant events need to be clearly 

documented, and the documentation should be readily available for examination. The 

docmentation should appear in management directives, administrative policies, or 

operating manuals. All documentation and mds should be properly managed and 

maintained. 

33. Establish formal and comprehensive cost allocation methodology and related policy 

and procedures. 

Independent Auditor's Report on Internal Control Page 14 
34. Cross-train employees to minimize the risks of major interruptions in normal business 

operations. 

35. Establish a review process wherein a person, other than the preparer, reviews the 

work performed to ensure accuracy and propriety. 

B. Managerial Cost Accounting 

Statement of Federal Financial Standard No. 4, Managerial Cost Accounting 

Concepts and Standarkfor the Federal Government, requires reporting components 

to perform a minimum-level of cost accounting and provide basic information 

necessary to accomplish the many objectives associated with planning, decisionmaking, and reporting. This minimum-level of cost accounting includes, among 

others: providing information for performance measurement; integrating both cost 

accounting and general kcial accounting by using the USSGL; providing useful 

information; and accommodating management's special cost information needs or 

any other needs that may arise due to unusual or special situations or circumstances. 

The present FEC cost accounting system does not provide the minimum-level 

identified above. 

FEC management notified us that it is in the process of developing a new cost 

accounting system. 

36. Evaluate the functional requirements for the new cost accounting system to ensure 

that at least, the minimum level of cost accounting required in SFFAS No. 4 is 

attained. 

IV. General Property and Equipment (Property) 

FEC's accounting for property involves a time-consumingeffort that increases the risk of 

errors due to its process of expensing its property at the time of acquisition and preparing 

ajournal voucher to reclassify the expense to an asset for reporting purposes. 

Our audit disclosed deficiencies, mors or omissions that questioned the effectiveness of 

FEC's internal control onproperty. Some examples are noted below: 

Depreciation expense and accumulated depreciation reported on the depreciation 

report were not correct. We were informed that although the property management 

system calculates depreciation correctly, when the data is converted into another 

system to generate the depreciation report,the calculation gets corrupted. This error 

was identified during the audit and was subsequently adjusted. 

Software-indevelopment was not adequately tracked and was not reported until the 

September 30, 2004 financial statements. There was one instance of software-inIndependent Auditor's Report on Internal Control Page 15 
development being reported as completed software in the property management 

system; therefore, the asset was being improperly depreciated. Another instance was 

completed software that was not recorded. These errors were only identified during 

the audit process. 

Several assets were recorded using the purchase order amount, instead of the actual 

cost. 

For the 45 sample items we tested, we noted that 45 receiving reports were not 

completed properly, that is, they were either not signed, did not have the date of 

receipt, did not have a description of the goods or services received, or lacked a 

reference to the invoice to be paid. Although only 6 of the 45 items pertained to 

acquisitionsin fiscal year 2004, this deficiency persisted throughout fiscal year 2004. 

One of the five standards for internal control in GAO Standards for Internal Control in 

the Federal Government is control activities. Control activities occur at all levels and 

functions of the entity. They include a wide range of diverse activities such as approvals, 

authorizations, verifications, reconciliations, performance reviews, maintenance of 

security, and the creation and maintenance of related records, which provide evidence of 

execution of these activitiesas well as appropriate documentation. 

Recommendations: 

37. Enforce current procedures to require documentation of approvals and certifications 

for procurement and disbursementstransactions. 

38. Formally communicate to all appropriate personnel to ensure compliance and 

consistent application of the policies and procedures. 

V. Payroll 

We identified the following weaknesses related to the 45 items tested for payroll: 

Twelve employees' leave andlor credit hour balances reported on the time & 

attendance (T&A) reports did not agree with comparable data on the Statement of 

Earningsand Leave fimn the payroll serviceprovider; 

FEC's policy requires timekeepers to perform a monthly reconciliation between the 

leave balances in FEC's records and the payroll service provider. The timekeepers 

are to fmard leave balance certifications to the finance office indicating whether 

balances agree or disagree. Nine leave balance certification forms were either not 

completed or not submitted by the timekeepers to the finance office; 

Forty one documents supporting payroll activities such as requests for leave, 

approved absence forms, and certain payroll deduction elections forms were not 

available for review; and 

Changes made to some T&A reports were not authorized or properly authorized. In 

addition, the T&A reports of two employees were already approved by the certifying 

officer even though the pay period has not yet ended. 

Independent Auditois Report on Internal Control Page 16 
OMB Circular A- 123, Management Accountability and Control (Revised June 2 1, 1999, 

requires that "the documentation for transactions, management controls and other 

significant events must be clear and readily available for examination." GAO Standardr 

for Internal Control in the Federal Government states that transactions and other 

significant events should be authorized and executed only by persons acting within the 

scope of their authority. This is the principal means of assuring that only valid 

transactions to exchange, transfer, use or commit resources and other events are initiated 

or entered into." 

Recommendations: 

39. Implement procedures to ensure that payroll deduction elections are authorized by 

maintaining adequate supporting documentation or an ability to query the service 

provider systems to verify these deductions if initiated by an employee without the 

FEC's intervention. Consider traininghe-training payroll employees on the proper 

procedures for obtaining and retaining support documents for payroll elections. 

40. Ensure that timekeepers perform a monthly reconciliation of leave balances reported 

in its records and the service provider records and submit the leave balance 

certification to the finance office monthly. 

41. Implement procedures for ensuring hours recorded on the T&A reports are properly 

supported and authorized. Consider further automating payroll processing to 

decrease the risk of errors. 

42. Implement procedures for ensuring all payroll and personnel documents are properly 

completed and authorized before payroll data is transmitted to the payroll service 

provider for processing. 

OTHER MATTERS 

Federal Managers' fiancial Integrity Act (31 U.S.C. 3512) (Integrity Act) Compliance and 

Reporting 

OMB Circular No. A-123 provides the reporting guidance for the Integrity Act. OMB Circular 

A-123 states that annually, by December 31, the head of each executive agency submit to the 

President and the Congress (i) a statement on whether there is reasonable assurance that the 

agency's controls are achieving their intended objectives; (ii) a reporton material weaknesses in 

the agency's controls, and (iii) whether the agency's financial management systems conform with 

government-wide requirements. 

OMB Bulletin No. 01-02 requires that we compare the material weaknesses in the agency's 

controls and material non-conformances on the agency's financial management systems in the 

FEC's Integrity Act reportto our report on internal control dated December 8,2004. Since the 

Independent Auditor's Report on Internal Control Page 17 
Integrity Act report is due by December 31, 2004, FEC has not started and does not intend to 

start the process of accumulating the information required for its report until November 2004. 

Accordingly, since the Integrity Act report has not been completed, the comparison of reports 

could not be performed. 

In addition to the material weaknesses and reportable conditions described above, we noted 

certain matters involving internal control and its operation that we reported to the management of 

FEC in a separate letter dated December 8,2004. 

This report is intended solely for the information and use of the management of FEC, FEC 

Office of Inspector General, OMB, and Congress, and is not intended to be and should not be 

used by anyone other than these specified parties. 

Calverton, Maryland 

December 8,2004 

IndependentAuditor's Report on Internal Control Page 18 
IndependemtAudttor'r Report on Compliancewlth Law8 and Rejplatlons 

Tothe hpector General of the 

Federal Blactio~lCommiseion 

We have audittd the handal atatemarts of tha FadaalBloction Co-n 0as of and 
 

for the year cded Sqtahr 30, 2004, Md have issued w rapopt therwrn dated 
 

Deccmk8,2004. We~ourauditm~with~~gsn

~iatbeunitodStatarrof~tho~r~~~IstofZnrncialaudits~ 

inOovamaJAudw-,Mbytha-baeaarlofthaUllitbdStBfd8; aud 

Officeof h4anaganaUand Budget (OMB)Bull& No.01-02, A& -jGr Federal 

Financial ,Y&kmm&, rs amadad 

Tbe of FEC ismpaqiile fbrfiorlying with laws mdmguhthe applicable to 

FEC. hputof~~le~JbosltwhtbaFBC'a~~rr

fisaofmakri.1~we~~oficlloompliaucewith~~onsof 

lswsmd1.agulaliorte,~~withwhfchoaaldhaverdiractmdd~on&le 

~onof~rtrtsmcot~darclin~lawsrmd~cms~ed

OMBBullctinNo.01-02. Welimbdaattssteofcanplianceto~pravisiansandwedidnot 

testcompliancewith all lam.and mgdationaappliubleto PEC. 

The results of our tests of compb with lawn andmgulati- descriiin(hapraosding 

paragraph dbhpd no instmca of'noncompb with thc laws and ~ 0 0 &at8 are 

nquhdtobe raportedundaGownmewAd-- and OMB BullelinNo. 01-02. 

Providing an opinion on compliance with catain pmvishs of laws and regulations was not an 

objectiveof ouraudit,and acad@y, we donot expa suchan opinion. 

J IndependentAuditoia Report on Compliance with Lawa and Fbgulationa Page 19 
FEDERAL ELECTION COMMISSION 	 December 14,2004 

WASHINGTON, D.C. 20463 

MEMORANDUM 
 

To: 	 Lynne A. McFarland 

Gector General 

From: 	 John C. O'Brien Y 

Acting Deputy Staff Director for Management 
 

Acting CFO 
 A 

Through: 	 James A. 

Staff Director 

SUBJECT: 	 Comments on Draft Reports on Compliance with Laws and Regulations 

and Internal Control 

Attached are FEC Management's responses to and comments on the draft reports on 

compliance with laws and regulations and internal control. The FEC is pleased to find that the review 

conducted by the independent public accounting firm of Clifton Gunderson LLP (CG), under the 

auspices of the FEC's Office of Inspector General, rendered an unqualified opinion of the FEC's FY 

2004 Financial Reports. We also note that the FEC's financial statements are fairly presented. This is 

a noteworthy achievement for a first year audit. 

We are also pleased to find that the FEC was not in violation of any law or regulation to which 

the FEC was subject. We are working within the attached responses to eliminate or at least reduce the 

number andlor scope of reportable conditions and the potential for any material weaknesses. The 

FEC's goal is to receive an unqualified opinion with no material weaknesses or reportable conditions 

each year. 

It is important to FEC Management that the audit of the FEC's financial statements as of and 

for the year ended September 30,2004 indicated that the FEC financial systems are in general 

accordance with auditing standardsgenerally accepted in the United States of America; the standards 

applicable to financial auditscontained in Government Auditing Standards, issued by the Comptroller 

General of the United States; and Office of Management and Budget (OMB) Bulletin No. 01-02, Audit 

Requirements for Federal Financial Statements, as amended. 

Thankyou for the opportunity extended by you, your staff and CG to respond to the draft audit 

report. Everyone involved in the audit process worked extremely hard to ensure a successll 

conclusion to the audit. The FEC views the unqualified opinion as a success although it requiredan 

extensive commitment of staff and contract resources, and a large amount of staff time that could have 

been committed to other activities and on-going operations. 

Management's Comments to the Independent Auditor's Reports 	 Page 20 
We will use CG's report as an opportunity to continue to improve the FEC's financial 

management systems, policies and procedures. The FECviewed a previous review several years ago of 

the overall operations of the Commission by PricewaterhouseCoopers (PwC) in a similar fashion and 

used the results of their review to improve and enhance FEC programs where appropriate. The FEC 

takes such recommendations seriously and will study them to seek ways to implement appropriate 

proposals to enable us to serve the public better and to more effectively and efficiently meet our 

mission to administer and enforce the campaign finance disclosure laws. 

Attachments 

Management's Comments to the Independent Auditor's Reports Page 21 
MATERIAL WEAKNESSES 

I. Financial Reporting 

The Accountability of Tax Dollars Act of 2002 extends to FEC a requirement to prepare 

and submit to the Congress and the Director of the OMB an audited financial statement. 

Fiscal year 2004 is the first year FEC is preparing and submitting audited financial 

statements. FEC has attained a major achievement by having its financial statements 

audited for the first time. FEC, however, had to expend a tremendous amount of effort to 

"cleanup" its accounting records in order to prepare auditable financial statements as of 

and for the year ended September 30,2004. 

The weaknesses identified below collectively resulted in a material weakness in FEC's 

financial reporting process. 

A. Financial Statement Preparation 

Our audit of the interim financial statements disclosed several misstatements andlor 

misclassifications resulting from ineffective or lack of adequate quality and supervisory 

reviews and internal controls over the financial statement preparation and reporting 

process. These errors or omissions, some illustrated below, have consumed significant 

FEC resources in researching and correcting. The resources expended could have been 

devoted to the normal daily business operations of FEC. 

FEC Response: FEC acknowledges that there were misstatements in its March 3 1,2004 

financial reports, but does not agree that the controls surrounding its quarterly and annual 

financial statement preparation process is so ineffective to warrant the classification of 

this frnding as a material weakness in FEC's financial reporting function. During the 

audit, we have made significant improvements to our supervisory controls. Though we 

are continuing to identi@ ways to improve further, we believe our current processes have 

improved to the point that they are no longer a material weakness. 

Fiscal Year 2003 was the first year for which FEC was required to compile a full 

set of financial statements to comply with the provisions of the Accountability of Tax 

Dollars Act of 2002. Although FEC was waived fiom the requirement to submit such 

statements to the Office of Management and Budget (OMB), it endeavored to conduct an 

intemal evaluation of its fiscal year 2003 financial data and financial reporting risks to 

ensure that its annual and qWerly financial statements were materially accurate. 

Additionally, in fiscal year 2002, FEC replaced its accounting system and converted its 

financial information from the "oldn system to the 'hew" accounting system. As part of 

its internal evaluation, FEC sought to analyze and correct any inconsistencies resulting 

from the data conversion, and identify and correct any misstatements andlor relationship 

discrepancies related to its general ledger accounts. 

The agency made great strides in its commitment to present a complete set of 

financial statements, which not only appropriately reflect current year activities, but also 

Management's Comments to the Independent Auditor's Reports Page 22 
reflect accurate historical financial information. "Catch-up" journal vouchers and "on 

top" adjustments to FEC's accounting records for fiscal year 2003 and the first and 

second quarters of fiscal year 2004 were necessary to achieve its commitment. The 

misstatement found in the March 31,2004 financial statements was due to human error. 

However, FEC has since prepared accurate financial statements for the third and fourth 

quarter of fiscal year 2004. 

In light of FEC's implementation of compensating management controls (i.e., 

extensive data analysis to appropriately reflect account balances) and given that the error 

found in the second quarter of the fiscal year 2004 financial statements was not a 

persistent problem in FEC's financial statements compilation process, FEC does not 

concur with this material weakness. FEC believes that process for the latter half of the 

fiscal year was vastly improved (better controls) and the risk of misstatement to the 

financial statements was effectively mitigated. 

Improper reporting of the appropriation received and the status of budgetary 

resources in the March 31,2004 statements was cited by the auditors. At the time the 

appropriation received amount was recorded, FEC was under a Continuing Resolution. 

FEC's efforts to solicit the guidance from OMB as to how the Appropriations should be 

reported, given the Continuing Resolution, were unsuccessful, as information received 

from OMB was not received timely (before the financials statements submission due 

date). 

FY 2004 was the first year FEC had to file quarterly financial statements with 

OMB. Many agencies use spreadsheet models supplied by CPA firms to compile the 

complex quarterly and annual statements. It is common to download ledger information 

into these models. The minor error noted in a spreadsheet formula was caught and 

corrected by FEC. Once the FY 2003 comtions were entered the June statements were 

submitted on time and accurately. Since this is FEC's first audit, CG's audit plan was to 

control the year end processing schedule. FEC will tailor this to its operations and 

incorporate it into a formal schedule in N 2005. 

B. Timely Recording, Reconciliation and Analysis 

A major objective of internal control is to ensure the integrity of the underlying 

accounting data supporting the financial statements. An important control in this regard is 

the reconciliation of accounting records. An adequate reconciliation provides the 

assurance that processed transactions are properly and timely recorded in the ~ccounting 

records and financial statements, which then allows management the ability to analyze its 

financial condition and results of operations on a routine basis. 

The FEC has not performed many of the periodic account reconciliations necessary 

during the year. Account reconciliations not performed included certain FBWT reports 

from the Department of Treasury, budgetary accounts, intragovemrnental activities, and 

general property and equipment, among others. In addition, reconciliations that were 

performed were often not completed in a timely manner and certain account 

Management's Comments to the Independent Auditor's Reports Page 23 
reconciliations contained reconciling items that have long been outstanding. Moreover, 

certain assets, such as software-in-development, were not reported in the interim financial 

statements because FEC was still compiling the data. 

Furthermore, due to FEC's delay in submitting the June 30,2004 accounting data in the 

Treasury's Federal Agencies' Centralized Trial-Balance System (FACTS II), FEC was 

prevented by the system to submit the data. Thus,FEC did not submit its June 30,2004 

accounting data. The accounting data includes mostly budgetary information that is 

required for the Report on Budget Execution and Budgetary Resources (SF 133), and the 

Year-End Closing Statement (FMS 2108). 

FEC Res~onse:EEC understands the critical role played by reconciliations in internal 

control and acknowledges the lack of routine reconciliations during the first half of the 

fiscal year. However, we do not concur with the classification of this finding as a material 

weakness in FEC's financial reporting function. We have taken steps to implement an 

appropriate reconciliation schedule in the future 

As a result of its internal evaluation of the fiscal year 2003 financial data and 

financial reporting process, FEC identified the need to acquire additional personnel 

resources to assist with the preparation of periodic reconciliations, in order to mitigate the 

risk of material misstatements to its financial statements. As such, FEC engaged 

contractors who have expended considerable effort to bring reconciliations up to date in 

fiscal year 2004. Though these reconciliations lagged for the first and second quarters of 

fiscal year 2004, they were completed prior to the completion of the audit and have 

revealed insignificant reconciling items on the Fund Balance with Treasury account. The 

PPE reconciliation was performed on time and provided to the auditors. 

Additionally, with assistance from contractors, FEC is currently performing 

routine reconciliations of its subsidiary records to the general ledger balances and is 

committed to this effort for fiscal year 2005. With respect to the submission of FEC's 

financial information to Treasury, when FEC tried to log on to submit the June 30,2004 

reportsby the due date, the Treasury computer system was not operational. Since 

Treasury did not extend the deadline to agencies for FACTS submissions, FEC's 

accounting data was not submitted by the due date. All first, second and fourth quarter 

reportswere submitted to Treasury and OMB on time. To date, CG has had no 

adjustments to the reports except minor reclassifications. 

Finally, FEC concurs with the matters pertaining to the compilation of softwareindevelopment financial data. FEC has revised the data-gathering procedures and 

methodology for accounting for software-indevelopment. 

C. GL System Setup and Posting Model Definitions 

The GL system setup and posting model definitions do not fully comply with the 

transactions posting models consistent with the United States Standard General Ledger 

Management's Comments to the Independent Auditor's Reports Page 24 
(USSGL) guidance and policies when recording and classifying certain transactions. As a 

result, certain proprietary accounts and budgetary accounts do not agree, and certain trial 

balance accounts do not trace to the USSGL crosswalk. 

FEC is aware of the inherent limitations of the GL system and has attempted to upgrade 

the GL system during fiscal year 2004 to correct weaknesses identified. However, due to 

the enormous resources consumed in testing and monitoring the system upgrade and the 

problems arising from the upgrade process and the audit of the financial statements, FEC 

has decided to postpone its upgrade until fiscal year 

2005. 

FEC Response: FEC does not concur with this finding as a material weakness. 

According to generally accepted auditing standards (AU 319), "the auditor should obtain 

sufficient lcnowledge of the entity's risk assessment process to understand how 

management considers risks relevant to financial reporting objectives and decides about 

actions to address those risks". FEC was fully aware of the posting model glitches and 

adequately considered the risk of misstatements in the financial reports. As such, FEC 

reengaged the implementer of the accounting system to upgrade the system and correct 

posting model glitches. However, the upgrade was postponed to dedicate resources and 

attention to the audit. FECadequately compensated for the posting model glitches with 

extensive reconciliations and analyses. Relationships between proprietary and budgetary 

accounts were tested on a monthly basis and were provided to the auditors throughout the 

audit. FEC expects the upgrade of its financial system to be completed in FY2005 but 

will continue the reconciliation of the accounts impacted by the posting model glitches. 

The upgraded financial system will be fully compliant with the USSGL. 

D. Integrated Financial Management System 

A single, integrated financial management system is a unified set of financial systems 

linked together electronically in an efficient and effective manner to provide agency-wide 

financial system support. Integration means that the user is able to have one view into 

systems such that, at whatever level the individual is using the system, he or she can 

obtain needed information efficiently and effectively through electronic means. It does 

not necessarily mean having only one software application covering all financial 

management system needs within an agency. Interfaces are acceptable as long as the 

supporting details are maintained and accessible to managers. Interface linkages must be 

electronic unless the number of transactions is so small that it is not cost beneficial to 

automate the interface. Easy reconciliation between systems, where interface linkages are 

appropriate, must be maintained to ensure data accuracy. 

FEC does not have an integrated financial management system. Significant financial 

management systems such as the "cost system" and the property and equipment system 

are not interfaced with the GL system. 

FEC Res~onse: FEC does not concur with this finding as a material weakness. 

The FEE made a decision based on acceptable risk and on a cost benefit basis that the 

Management's Comments to the Independent Auditor's Reports Page 25 
MIS,budget projection, and other performance reporting processes would be migrated 

after other priority commission programs were migrated to the new environment. This 

process is on-going: in FY 2004 and now in FY 2005 the FEC is engaged in a legacy 

system off-load process to migrate legacy systems over to the new IT platform. In 

addition, the FEC has been engaged since late FY 2003 in developing and implementing 

a budget preparation and MIS system that will be totally integrated with the financial 

system and all other oracle based IT systems. 

The OMB guidance and GAO standards do not require agencies to have totally 

integrated financial management systems with all other agency systems. OMB Directives 

A-127 and A-123 and the GAO standards, as well as the CFO Act, were designed to 

make agencies modernize, automate, and integrate outdated and disparate accounting 

systems. In addition the goal was to make sure all agency accounting systems were 

compliant with GAO standards and OMB directives. These initiatives do not require all 

agency systems to be totally integrated--they must use the same information in preparing 

performance and cost allocation reports and data. The FEC does this. The FEC budget 

projection process uses the same pay information hm NFC as the accounting system 

does, and both use the same HR infmation hm the FEC Personnel system. In that 

regard, they are integrated. 

The A-123 and A-127 Directives and the GAO standards provide for agencies to 

make decisions on a cost-benefit basis with regard to management controls. The FEC 

determined that limited fundsand stafTresou~cesavailable for the FEC IT initiatives 

mandated a priority for the main Disclosure database and other major disclosure and 

compliance programs. In addition, fundswere allocated to acquire a financial and 

accounting system that was compliant with GAO standards and was JFMIP certified. 

The migration of other systems such as the MIS,budget projection, and other 

performance reporting processes to the new oracle based client server platform was given 

a lower priority. 

The FEC also made decisions not to acquire vendor produced COTS HR packages 

due to costs and general reportshm other agencies about the performance of these 

systems. A similar decision was made with regard to the procurement and propeaty 

systems. The detennination was made to not incur additional costs until the Gnancial 

system upgrade to a newer version was complded. At that time a determination would 

be made on a cost benefits and potential risk analysis basis on whether it was worth the 

costs to totally integrate the pramemat, property and financial systems. bntly the 

FEC is comfortable with the acceptable riskswith the two systems not totally integrated. 

1. Establish written policy and procedures to formalize plans, methods and procedures to 

guide the financial statement preparation and reporting process. 

2. Prepare and analyze monthly reconciliations of subsidiary and summary account 

balances. Consider a "formal closing" of all accounts at an interim date(s), which will 

Management's Comments to the Independent Auditor's Reports Page 26 
reduce the level of accounting activity and analysis required at year-end. This "formal 

closing" entails ensuring that all transactions are recorded in the proper period through 

the month-end. With complete and timely transaction recording, analysis of all major 

accounts can be performed effectively. 

3. Ensure that supervisory reviews are applied to the financial statements and its 

supporting documentation, and the reviews are documented. 

4. Ensure that upgrades to the financial management system comply with the posting 

model definitions in the USSGL. 

5. Evaluate the functional requirements to integrate the financial reporting, property and 

equipment and the cost systems with the GL system; assess the degree of integration 

necessary to have a single, unified financial management system. 

FEC Response: Per the discussion above, the FEC will continue to evaluate the 

acceptable risk levels and the costs and benefits of integrating the financial system with 

the procurement and property systems; as noted the MIS and Budget systems are in the 

process of being upgraded and enhanced, including integrating them fiuther with the FEC 

NFC and accounting systems. 

The FEC IT Strategic Plan provides for the future evaluation of the costs and 

benefits of fbrther integrating the HR and other systems with the FEC financial system. 

Decisionsto proceed will be based on Commission priorities and available resourcesand 

funds. 

As noted in the Financial Reporting section a formal plan for monthly closing, 

reconciliation review and statement analysis will be prepared in FY 2005. Finally, when 

the financial system upgrade is complete the system will be USSGL compliant. 

11. Information Technology (IT) 

The reportable conditions below, when evaluated together, make the IT area a material 

weakness. 

FEC General Reswnse: The FEC does not agree that the reportable conditions in the 

IT area reach the level of a material weakuess. In conjunction with the Financial 

Statements Audit of the FEC, four areas of Infodon Technology were examined for 

material weaknesses. The outcome of the audit in ITrevealed a number of reportable 

conditions, none of which, individually, rise to the level of material weakness. FEC 

Management is also of the opinion that the collective '%eight" of these reportable 

conditions does not together result in a material wealmess. The reason for this position is 

that reportable conditions have been recognized and corrective actions have been and are 

being taken. The cost benefits test may be used for portions of these conditions, but for 

the majority the FEC has initiated corrective actions, some of which predate the audit. 

Management's Commenta to the Independent Auditor's Reporta Page 27 
FEC Management has also indicated our position on the FEC exemption from the 

Paperwork Reduction Act, which also exempts the FEC from many of the related and 

underlying statutes and regulations. We agree that best practices and sound management 

controls justify the use of some of the recommendations made during the audit in the area 

of IT control (many of which the FEC as implemented already). However, the FEC 

strongly believes that these recommendations, either singularly or collectively, do not rise 

to the level of material weaknesses. In addition, the FEC maintains that the agency can 

not be held to guidance and criteria identified in studies and analyses as if these were 

standards that are required to be adhered to. 

Finally, the FEC continues to maintain that it is not appropriate to find the 

existence of financial management material weaknesses for systems and applications that 

do not directly impact on the accuracy and security of information used in the FEC 

financial statements. 

The audit for IT support of financial statements was broken down into four areas: 

(1) Entity-wide Security Program, (2) Controls to Protect Information, (3) Contingency 

Plan and (4) Software Development and Change Controls. 

Entitv-wide Security Prom: 

It was noted in the draft report that the "FEC has taken important steps to 

establish an effective information security program, but much remains to be done." The 

references cited in the audit report, provide general guidance and are not audit standards. 

The FEC, in strengthening and building upon its security policy, has implemented the 

level of security that is commensurate with the FEC mission, best practices, budget and 

available resources. The resulting updated and modernized security program 

demonstrates the FEC's commitment to information security and a continuing pursuit of a 

balanced security program and costs to the agency. 

Controls to Protect Information: 

The FEC has installed an automated key entry system to all sensitive areas, such 

as the data center and hub rooms,in addition to the general building entry security 

processes. The access to the general areas where data is stored are fkther protected via 

password protection systems installed on each server and all personal computers. In an 

effort to follow the NIST guidanceand protect to the level required by overall agency 

mission, the methodology employed by the FEC for physical security of the IT systems 

and data is in keepingwith GSA, GAO and NiST standardsand best practices. 

Contingency Plan: 

The FEC has taken reasonable precautions in preserving data in the event of a 

catastrophe. All FEC information and data is backed up daily, weekly and monthly and 

stored at an off-site facility. The main disclosure data base is retained at an acceptable 

level of redundancy in order to reproduce it in the event of catastrophe. Although the 

Management's Comments to the Independent Auditor's Reports Page 28 
FEC identified a potential budget request for FY 2006 of over $15 million to fully 

replicate the FEC IT systemsand provide a staffed continuity of operationsback-up site, 

there is no interest at either OMB or our oversight and appropriation committees for such 

and expenditure. The existing spending and resulting level of risk in this area is at an 

acceptablelevel, based on the costs benefits test. 

SoftwareDevelo~mentand Change Controls: 

The FEC has established a System Development Life Cycle Plan that reflects the 

existing development environment of the FEC. That environment consists of purchased 

applicationsoftware that is in compliancewith existing certifications, and set-up and 

adapted for specific,particular FEC mission requirements. There is very little, if any, 

homegrown softwarethat is developed solely by FEC personnel at this time. The level of 

controls over the modification and implementationof application systems are adequate 

for the size and single location of the agency. The use of systemmodification logs has 

been an effectivemethod of control, yet use of this methodologywas not acknowledged 

in the report. The agency has established an IT Quality Assurance Office, in an effort to 

incorporate the latest best practices in software application control. 

A Entity-wide Security Program 

FEC did not finalize its Information System Security Policy until September 2004. 

This policy was not fully implemented in fiscal year 2004; 

FEC Response: In November 1997, the FEC established Directive 58, outliningthe 

Commissionpolicy on the control of commission software, and the use of agency 

computers. This directive formed the basis of the agency's computer securityprogram. 

This directivehas been enhanced and expanded incorporating the latest guidance and best 

practices provided by NIST in detail, and issued in policy 58A. The updating of 

Directive 58 was begun in December 2001 with the establishment of an agency 

Information Systems SecurityOfficer, and followed with the establishment of an interim 

Information System SecurityProgram Policy 58A dated April 2004. Thisinterim policy 

became final in September2004 as approved by the agency's Chief TechnologyOfficer 

(CTO). 

A firamework of policies and standards to mitigate risks associated with the 

management of information resources has not yet been implemented, 

FEC Reswnse: As a vital component of the Information Systems SecurityProgram 

Policy (ISSPP) 58A, the FEC has developed and approved sub-policy 58-2.1 : Risk 

Management policy. This policy establishes a fkimework of procedures and standardsto 

mitigate risks associated with the management of information resources. The FEC is in 

the early stages of implementing this new policy. 

Risk assessments, as part of FEC's overall strategy to mitigate risks associated with 

its information technology environment, have not been conducted for more than three 

Management's Comments to the Independent Auditor's Reports Page 29 
years. The FEC conducted a risk assessment in March of 2000, with several 

recommendations for strengthening its information technology environment. We 

noted that the FEC has not implemented many of the recommendations.Furthermore, 

the FEC has not updated its risk assessment since March of 2000 to ensure that its 

strategy to mitigate risk reflects changes in its information technology environment; 

FECReswnse: The FEC Risk Management policy specifies a risk assessment of its 

major applications and general supports systems every 3 years. The FEC has addressed 

many of the recommendations outlined in the March 2000 risk assessment; greater detail 

is required fiom the auditors as to which specific recommendations they believe have not 

been met. The FEC has updated its risk assessment program by developing and 

implementing 58A Infomation System Security Program Policy and 58-2.1 Risk 

Management. A risk assessmentwas conducted February 24,2004 in the form of a 

Security Audit, the purpose of which was to identify any vulnerabilities in the IT 

infrastructure and to identifythe risks associated with those vulnerabilities. 

There was no documented and approved entity-wide securityprogram plan. FEC has 

indicated that it is in the process of documenting its entity-wide security program 

plan. The FEC has just established in September 2004 policy guidelines which it will 

use in the development and implementation of an entity-wide security program plan; 

FEC Response: This issue is addressed in the response to the first bullet above. 

The FEC completed the identification of its major application and mission critical 

general support systems in September 2004, as part of its risk mitigation strategy. 

Thus, the FEC has not completed the development of security plans for these 

applicationsand systems; 

FEC Response: The FEC identifiedits major applications,mission critical in May 2004. 

The lone General Support System was identified in March 2000, when the development 

of the securityplan was completed for that system. These documentshave been provided 

to the audit team. 

Major applications and mission critical general support systems have not been 

certified to ensure that they are operating according to FEC's securityrequirements; 

FECResnonee: The FEC has a policy that provides for the certification and 

accreditationof major applicationsand mission critical systems. That policy is 58-2.4: 

Certificationand AccreditationPolicy. The agency SecurityOfficer attended an 

Accreditationand Certification workshop sponsored by MST in order to apply the NIST 

guidelinesthat may be appropriateto the FEC, in June 2004. 

A program for the continuousmonitoring and evaluationof FEC's policy and controls 

to ensure operating effectivenesshas not been established, and 

Management's Comments to the Independent Auditor's Reports Page 30 
FEC Response: The FEC has established the position of Information Systems Security 

Officer. This is a full-time management position, and as indicated in the position 

description, has the responsibilityfor continuouslymonitoring the overall policies and 

controls. This position description has been provided to the audit team. 

There is no periodic security awareness training. Training is only provided to new 

employees and contractors. The FEC did conduct a baseline awareness training 

program, but does not have a process in place to provide security awareness training 

on an annual basis. 

FEC Response: The FEC has finalized and approved a SecurityAwareness training 

policy which provides initial and ongoing training for all current and new employees, as 

well as contractors. This training has been in place during the past year and-a-half. The 

FEC has a securityawarenessprogram in place and documented, this documentation was 

provided to the audit team. All new employeesand contractors undergo this training 

upon anival at the FEC. Securityawareness is emphasized in all FEC training classes as 

it pertains to the particular lesson being taught. Security awareness is re-enforced by the 

help desk personnel as problems are reported, and each time a help mission is launched. 

Informationconcerning virus protection, new viruses reported in trade journals and as 

reported through our support contractsare disseminated on a regular basis by the FEC 

security team, Help Desk personnel and trainers. Sincethe Security Awareness Training 

Program has only been established for a shortperiod of time, an appropriateperiodic 

training refiesh period has yet to be established. 

B. Controls to Protect Information 

No documentation or verification that the vulnerabilities identified in the February 

2004 network penetration scan have been addressed; 

F'EC Res~onse:The FEC has addressed and verified that the vulnerabilities pinpointed 

by the Nessus scan have been addressed. We are in the process of fully documenting all 

corrective actions. 

Visitor (individuals that do not have approved daily access) logs for data center 

access were not maintained and no compensating controls to monitor and record 

visitor access to the data center have been implemented, 

FEC Res~onse:The FEC does, in fact,maintain an electronic log which is the Kastle 

Key system. Each time a person enters the room the date and time is recorded. The only 

way to accessthe data center is with a Kastle key. Only individualswith Kastle Key 

access privileges for the data center are allowed entry. 

Password controls are weak: 

o 	 There is no password lifetime set on the local area network (LAN); 

o 	 There are no technical controls to enforce password changes on the LAN and the 

GL system; 

o 	 Somepasswords on the FEC LAN have not been changed since 1997; 

Management's Comments to the IndependentAuditor's Reports 	 Page 31 
o 	 The password policy cannot be updated or changed in the current version of the 

GL system; 

o 	 The GL system passwords do not expire; 

o 	 There is no limitation on the number of GL system password attempts (i.e. no 

o 	 lock-out policy); 

o 	 There is no policy on the GL system composition of passwords; and 

o 	 There are no controls on password length for the GL system. 

FEC Response: The FECis in the process of implementing the recommendations to 

provide stronger password controls. Users will be forced through system control to 

change their password periodically. Below is the implementation of the agency's 

password policy, as outlined in policy 58A: 

As many of you are aware, the Federal government has increased its focus on computer security. 

Agencies that wocess sensitive but unclassifii information are required to enforce more 

stringent access control policies. One stipulation of these policies is that we enhance our 

identificationlauthenticationmethods. Due to this increased focus and recently initiated audit by 

the Office of Inspector General, the Commission is implementing a formal password policy. The 

policy (58-3.1 Logical Access Policy) and its derived FEC password standard can be found in 

\NTSRVl\FEC-WIDE\ FEC IT Policies and Standards. Please take the time to review them both. 

This password standard requires a change of passwords no less than every 180 days. In order to 

ensure that every one has changed their Network, Lotus Notes and other logon passwords, 

current passwords will expire at midnight (12:OO AM) December 13,2004. In order to logon after 

that time you will need to change your password. As usual, any questions should be addressed 

to the Helpdesk. 

Summarv of FEC IT Securitv Password and Standard 

Passwords must contain a minimum of ekrht - (81 . ,characters.

Passwords must consist of a mix of upper and lower case letters, numbers, and special 
 

characters. 
 

Passwords must not contain any word found in any dictionary in any language, or be 
 

based on any word or character in literature. 
 

Passwords must not be based on user IDS, or related to personal information. 
 

Passwords must be changed no less than once every 180 days. 
 

Passwordswill not be allowed to be repeated for at least fnre generations. 
 

Users passwords must not be related to one another such that compromise of one makes 
 

others easier to guess; e.g., "abCdefgln, uabCdefg2", uabCdefg3". 
 

User IDS will be disabled or revoked following five (5) consecutive failed login attempts. 
 

Please note, we highly recommend our employees use Pass Phrases such as 

SeeUZmmwl or *CUZmmw. 

Again, please be aware that these password standards am effective as of December 13,2004 

and apply to all FEC Information Systems that require a password including; 

Windows(your network account) 

Lotus Notes 

Peoplesoft 

FEC (Keaterm) 

Comprizon.buy 

Management's Comments to the Independent Auditor's Reports 	 Page 32 
To assist you in implementingthese standards the ITD HelpDesk has created instructionson 

changing passwords to meet these criteria. These instructions are located in \\Ntsrvl\FECWlDRHelp Desk Information\PasswordInformation& Instructions. As always, the HelpDesk 

can be reached at XI255 or via email. 

There are no records of access requests granted to remote users. The FEC was unable 

to provide access request approval documentation to support the access of all dial-up 

and Virtual Private Network (VPN) users that we sampled for our review. In addition, 

there was no evidence of periodic re-validations of these users; 

FEC Response: There is a record of those individuals that have been granted access 

through the use of the VPN. The individuals on the access list have been approved by the 

CTO. The list is maintained by the Systems Branch. The list is periodically reviewed by 

the CTO. It is FEC policy that all FEC employees may access the network via dialup 

connection. Many FEC personnel have been provided with FEC laptops so that dial-up 

access may be available at home. 

GL system access requests are not properly documented or reviewed. The FEC was 

only able to provide us original access matrices for eight of the 33 current GL system 

users. Additionally, the FEC does not periodically perform revalidations of GL 

system access; 

FECRes~onse:GL user matrix has been provided to the audit team. Supervisors 

request access for people that require access to the GL system either directlyto the 

administrator or report them via the GL system Lotusnotes database that is used to 

record all administrator activity. For example, log number 159is a request for access 

rights. 

The principle of "least privilege" is not consistently applied in the GL system 

application. A high level IT official has similar access rights and privileges in the 

GL system application as the AccountingOfficer; 

FEC Response: The privileges for the high level IT official, were modified to allow the 

appropriate level necessary to perform the functions of the position, at the time it was 

identified by the audit team. This was complete months ago. 

Data center access is not adequatelydocumented or reviewed: 

o Four employeeshave their names misspelled on the cardholder report; 

o One of the individuals with access to the data center was terminated recently, but 

his access key is still active and the physical location of the key could not be 

determined; and 

o FEC could not identify one user who has access to the data center or justify why 

the individual has access to the data center. 

FECRes~onse:Data Center is adequatelydocumented and reviewed through the use of 

the automated Kastle Key secure entry system. Kastle is under contract to monitor access 

24-7 to the building as well as the data center. On occasion, since names are entered 

Management's Comments to the Independent Auditois Reports Page 33 
manually by the administrativedivision, spellingerrorsmay occur and go undetected, 

due to the reviewers may be unaware of the correct spelling. 

The individual in question in the second sub-bullet above, was not terminated, but 

in fact passed away. His Kastle Key was in his possession at the time of death and was 

unrecoverable at the time. Lost key procedures were instituted and his access was 

revoked during August 2004. He passed away on July 21,2004. When personnel are 

terminated, or they leave the employ of the FECvoluntarily, their key is collected in 

accordance with personnel check out policy. 

The individual that could not be identified was unknown to the Systems Branch 

Manager when asked. It is not expected of the Systems Branch manager to how each 

person on an access list. The person was a contract employee with proper credentialsto 

be on the access list. 

The FEC is not in compliance with its auditing policy because it does not 

automatically log the network activity described in the Audit Event Standarris, even 

though it has the capabilityto do so. 

FEC Reswnse: 58-3.3: Auditing and Monitor Policy and the Audit Event Standards 

are recently approvedpolicies and standards, they were developedjust prior to the 

audit. All of the FEC Information Systemshave not yet come under their purview. 

The accounting system is scheduled for compliance soon. 

C. Contingency Plan 

FEC has not formally identified and prioritized all critical data and operations on its 

major applications and the resources needed to recover them if there is a major 

intenuption or disaster. In addition, we could not determine whether FEC had 

established emergency processing priorities that will help manage disaster situations 

more effectivelyfor the network. 

FEC Reswnse: The FEC Mission Critical, General Support Systems, and Major 

Applications have been identified. The rwurces and data necessary to recover those 

entitiesin the event of a major interruption or disasterwill be identified when the FEC 

completesits disaster recovery plans and procedures which is in process. 

FEC does not have alternativeprocessing sites for most of its operations in the event 

of a disaster, including its general ledger system 

FEC R~sDo~s~: the FECdoes not have the budget or the mission criticalityto justify the 

expenseof establishingan alternative site. The FEChas the appropriate level of data 

processing that is consistent with its mission. 

The FEC Disclosure Database is replicated at an off-site location as a web-enabled 

read-only database the public can access. In the event that data cannot be updated at 

Management's Comments to the Independent Auditor's Reports Page 34 
the FEC and then replicated at off-site location, there is no operational mechanism to 

update the Disclosure Database replicated at the off-site location. 

FEC Response: the FEC does not have the budget or the mission criticality to justify the 

expense of establishing an alternative site. The FEC has the appropriate level of data 

processing that is consistent with its n~ission. 

FEC does not have adequate capacity for most of its back-up tapes in its fireproof 

safe; hence backup tapes are not kept in a fireproof safe. 

FEC Response: The FEC will look into the expenses involved in expanding its fireproof 

safe capacities. In the interim, the off-site storage facility picks up tapes on a weekly 

basis, in the event of a catastrophe in the FEC Data Center, the maximum loss of data 

would be one week. At this time this is considered acceptable risk 

FEC data center is fully exposed to a wet pipe sprinkler system, with no 

compensating controls to avert inadvertent water damage to critical hardware and 

magnetic media in the case of a malfunction or false alarm. 

FEC Response: In accordance with the NIST Computer Security Handbook chapter 15 

Physical and Environmental Security, page 171, Water sprinkler systems are the 

preferred fire extinguishing systems. See below extract: 

Fire Extinguishment. A fire will burn until it consumes all of the fuel in the building 

or until it is extinguished. Fire extinguishment may be automatic, as with an 

automatic sprinkler system or a HALON discharge system, or it may be 

performed by people using portable extinguishers, cooling the fire site with a 

stream of water, by limitingthe supply of oxygen with a blanket of foam or 

powder, or by breaking the combustion 

chemical reaction chain. 

When properly installed, maintained, and 

provided with an adequate supply of water, 

automatic sprinkler systems are highly 

effective in protecting buildingsand their 

content^.^ Nonetheless, one often hears 

uninformed persons speak of the water 

damage done by sprinkler systems as a 

disadvantage. Fires that triggersprinkler systems cause the water damage.'05 In 

short, sprinkler systems reducefire damage, protect the lives of building 

occupants, and limit the fire damage to the building itself. All these factors 

contribute to more rapid recovery of systems following a fire. 

Management's Comments to the Independent Auditor's Reports Page 35 
Each of these factors is importantwhen estimating the occurrence rate of fires 

and the amount of damage that will result. The objective of a fire-safety program 

is to optimize these factors to minimize the risk of fire. 

FEC has not developed and documented a comprehensive contingency of operations 

plan of its data centers, networks and telecommunication facilities. 

FEC Res~onse:The FEC is in process of developing a disaster recovery plan that will 

address these issues. 

D. Software Development and Change Controls 

System Development Life Cycle (SDLC) Methodology has not been finalized and 

implemented. 

FEC Res~onse:The overall agency SDLC has been drafted and the policies and 

procedures are written. The implementation will take place with the establishmentof the 

QualityAssuranceBranch within the IT Division, as soon as the IT organizationplan 

takes effect. There is a Quality Assurance Manager on board and he has taken stepsto 

begin the establishmentof appropriate QA controls. 

No written policy has been created to manage software libraries. 

FEC Response: See the SDLC that was provided. The management of softwarelibraries 

is addressed in the SDLC. 

Written procedures to modify, test, approve or release software for any of its 

applications, including the GL system have not been documented. 

FEC Res~onse:See the SDLC. In addition to the procedures in the SDLC, the 

procedures and flow are depicted in graphic fonn with the key players identified in the 

diagram for each system supported by the IT Division. The key players are identified as 

the business owners, the IT owners with the hardware and OS identified. See sampleof 

the major systems diagram. 

Emergency change procedures and procedures for installing patches are not 

documented. 

FEC Response: See SDLC 

Softwarecode changeswere not reviewed before being implemented. 

FEC Reswnse: All changes to the GL system are recorded in the Lotus Data Base set 

up to provide a log of all activity in the GL system. The changes are documented in this 

Management's Comments to the IndependentAuditor's Reports Page 36 
log, and acceptance is verified by the business owner of the GL system. As far as code 

changes are concerned, the FEC does not own source code to any purchased software, 

and therefore is not capable of making any code changes. We do, however maintain and 

modify as requested, via the log any changes to application scripts developed in house 

pertaining to the specific applications requirements of the FEC. 

REPORTABLE CONDITIONS 

111. Cost Accounting System and Processes 

A. Cost Allocation Methodology 

FEC does not have a cost accounting system that is integrated with the GL system. 

The current cost accounting system is not adequate to produce the cost data for the 

Statement of Net Cost (SNC) in an efficient manner. Accordingly, the cost data presented 

on the SNC is compiled from three systems' raw data, which is then gathered and 

analyzed in an elaborate, complex, and manually intensive spreadsheet. 

FEC Res~onse: The FEC prepares its cost allocation based on the MIS data, and the 

Budget Execution Report (BER)-two main sources of information. Our costs are based 

on data that is meaningful to OMB and our oversight committees in the presentation of 

budget requests and appropriation justifications: actual FTE allocated to programs and 

activities, and Budget Authority (BA), obligations, and final expenditures. These are the 

data that they are interested in reviewing in the context of the budget and appropriation 

processes. Both the OMB and congressional offices have commented on the quality and 

usability of FEC budget presentations in recent years, and the proof is that the FEC has 

attained a 3.5% increase in FY2005 and a recommended 5.5% increase for EY 2006 

when many domestic agencies and programs have been from or even reduce in recent 

years. 

Raw data used in the allocation of costs, such as payroll, is sometimes based on estimates 

due to the timing of the availability of the data. 

FEC Res~onse: As noted during the audit in the responses to requests for information, 

use of data from the actual NFC and FEC payroll process necessarily requires the use of 

projections from actual data due to compressed time hmes mandated by the 

Accountability of Tax Dollars Act and OMB regulations. Depending upon when the end 

of the last month of a quarter falls, there is a built in 10day to two week processing time 

lag from when payroll data is collected and reported to the NFC and the payroll 

information is reported back to the FEC. This necessarily requires the use of projections 

to meet quarterly timeframes for reporting. These "estimates" are projections based on 

actual year to date data as available when the reporting time frame falls. 

Management's Comments to the Independent Auditor's Reports Page 37 
FEC could not provide crosswalk documentation or definitions supporting the basis of 

assignment or allocation ... The data accumulation and analysis is performed by one 

person and not subjected to a second review. In addition, the FEC did not have a formal 

comprehensive policy and procedures for the program cost allocation. Although a written 

procedures document was provided to us, the document was written in response to our 

audit request and did not include a comprehensive set of procedures. The manually 

intensive and elaborate cost allocation process dictates the need for a formal 

comprehensive policy and procedures. Moreover, the heavy reliance on a single person to 

carry out this process could impair FEC's ability to generate a timely and accurate report 

when the person becomes unavailable. 

FECResponse: Definitions of the three major programs are provided in the FEC 

Strategic Plan, Performance Plans, and FEC Mission Statement. A document describing 

the allocation process was provided and additional documentation and explanation was 

provided in both written and verbal form in meetings to describe the new allocation 

process (see below). The document in question was written prior to the audit request, but 

was in preparation for the audit--documenting procedures in preparation for an audit is 

part of the audit process. The FEC noted that comprehensive procedures were not 

required due to the limited scope of the allocation process at the FEC. In a small agency 

such as the FEC with a two person budget office, it is not unusual that one person 

performs a function. Costs negate the ability to double-check all functions--at some 

point officials are responsible for performing their tasks properly and efficiently, and this 

is acceptable risk under the costs benefits test. 

Recommendations: 

35. Establish formal and comprehensive cost allocation methodology and related policy 

and procedures. 

FEC Res~onse: The FEC has documented formal cost allocation procedures; prior to 

the FY 2002 Act the FEC did not allocate management and overhead costs to the three 

major programs but reported them separately. The FEC does not see a cost effective need 

for "comprehensive" detailed procedures camed out solely by the budget office, 

particularly when as noted the system is being replaced by a new MIS and budget 

preparation system, automated and more filly integrated with the FEC financial system,. 

Due to the 2002 Act the FEC added requirements to the new system to automate the 

allocation process in the new system which will be filly documented. 

36. Cross-train employees to minimize the risks of major interruptions in normal business 

operations. 

FECResponse: The FEC will train several employees to use the new automated system 

and it will be fully documented. 

37. Establish a review process wherein a person, other than the preparer, reviews the 

work performed to ensure accuracy and propriety. 

Management's Comments to the Independent Auditor's Reports Page 38 
FEC Res~onse:The FEC notes again that at somepoint in a small agency with limited 

staff the costs benefits test requires that officials perform their tasks responsibly and 

effectively. There is a limit to what taskscan be double-checkedwith a two person 

budget office. Furthermore, as noted the new automated system will be in place and will 

provide a built in check. 

B. Managerial Cost Accounting 

Statement of Federal Financial Standard No. 4, Managerial Cost Accounting 

Concepts and Standards for the Federal Government, requires reporting components to 

perform a minimum-level of cost accounting and provide basic information necessary to 

accomplish the many objectives associated with planning, decision making, and 

reporting...The present FEC cost accounting system does not provide the minimum-level 

identified above. FEC management notified us that it is in the process of developing a 

new cost accounting system. 

Recommendations: 

38. Evaluate the functional requirements for the new cost accounting system to ensure 

that at least, the minimum level of cost accounting required in SFFAS No. 4 is attained. 

FEC Reswnse: The FEC notes that SFFAS No. 4 is a very broadly worded and applied 

standard that was designed to be so by OMB when it was developed. The FEC believes 

that the current MIS and other FEC reporting systemsprovide beneficial and usefulhigh 

level management infomation, and make even more detailed information available to 

division and office managers. This will be improved upon in the new fully integrated 

budget and MIS systems which will contain an automated cost allocationprocess. It is 

not cost effectiveto take action to improve the existing system while the new system is 

beiideveloped. The FEC notes that existing systems predated the 2002 Act that 

required the full allocationof all management and overhead costs. 

IV. General Property and Equipment (Property) 

FEC's accounting for property involves a time-consuming effort that increases the risk of 

errors due to its process of expensing its property at the time of acquisitionand preparing 

ajournal voucher to reclassify the expense to an asset for reporting purposes. 

Our audit disclosed deficiencies, emrs or omissions that questioned the effectiveness of 

FEC's internal control on property. Some examples are noted below: 

Depreciation expense and accumulated depreciation reported on the depreciation 

report were not correct. We were informed that although the property 

management system calculates depreciation correctly, when the data is converted 

into another system to generate the depreciation report, the calculation gets 

corrupted. This error was identified during the audit and was subsequently 

adjusted. 

Management's Comments to the IndependentAuditor's Reports Page 39 
Software-indevelopment was not adequately tracked and was not reported until 

the September 30,2004 financial statements. There was one instance of softwarein- development being reported as completed software in the property 

management system; therefore, the asset was being improperly depreciated. 

Another instance was completed software that was not recorded. These errors 

were only identified duringthe audit process. 

Several assets were recorded using the purchase order amount, instead of the 

actual cost. 

For the 45 sample items we tested, we noted that 45 receiving reports were not 

completed properly, that is, they were either not signed, did not have the date of 

receipt, did not have a description of the goods or services received, or lacked a 

reference to the invoice to be paid. Although only 6 of the 45 items pertained to 

acquisitions in fiscal year 2004, this deficiency persisted throughout fiscal year 

2004. 

One of the five standards for internal control in GAO Standarch for Internal Control in 

the Federal Government is control activities. Control activities occur at all levels and 

functions of the entity. They include a wide range of diverse activities such as approvals, 

authorizations, verifications, reconciliations, performance reviews, maintenance of 

security, and the creation and maintenance of related records, which provide evidence of 

execution of these activitiesas well as appropriate documentation. 

Recommendations: 

37. Enforce current procedures to require documentationof approvalsand certifications 

for procurement and disbursementstransactions. 

38. Formally communicate to all appropriate personnel to ensure compliance and 

consistent application of the policies and procedures. 

FEC Res~onse:FEC agrees with these recommendations.In FY 2003 and in preparation 

for the audit FEC needed to establishasset values for prior year purchases. Detailed 

records were not always available. Federal accountingstandards allow for the use of 

estimates where detailed records are not available. In some cases that meant using reports 

and estimates (purchase orders) fiom as far back as FY 1997. Thus,not all receiving 

reports were available. FEC provided the audit team with invoices, purchase orders and 

receiving reports for FY 2004 purchases. FEC will modify its stated requirement on 

receiving reports to delete the provision requiring a description of goods and services 

received. Since this information is on the purchase order and invoice, it is not necessary 

to require it on the receiving report. Instead, FEC will add an invoice number field to the 

receiving report. This will tie the approvalto the goods or servicesreceived. 

Management's Comments to the Independent Auditor's Reports Page 40 
The error in the spreadsheet calculation of depreciation expense was caught and 

corrected by FEC in its regular review of the financial statements. Software in Progress 

was a new account added in FY 2004 and will be tracked quarterly in FY 2005. 

Current procedures will be enforced. Late in FY 2004 some minor procedures 

changed (e.,g., Software in Progress). These changes will be documented and 

communicated to appropriate staff in early FY 2005. 

V.Payroll 

Recommendations: 

39. Implement procedures to ensure that payroll deduction elections are authorized by 

maintaining adequate supporting documentation or an ability to query the service 

provider systems to verify these deductions if initiated by an employee without the FEC's 

intervention. Consider traininglre-training payroll employees on the proper procedures 

for obtaining and retaining support documents for payroll elections. 

40. Ensure that timekeepers perform a monthly reconciliation of leave balances reported 

in its records and the service provider records and submit the leave balance certification 

to the finance office monthly. 

41. Implement procedures for ensuring hours recorded on the T&A reports are properly 

supported and authorized. Consider further automating payroll processing to decrease the 

risk of errors. 

42. Implement procedures for ensuring all payroll and personnel documents are properly 

completed and authorized before payroll data is transmitted to the payroll service 

provider for processing. 

F'EC response: FEC's payroll is processed by USDA's National Finance Center. Seventy 

percent of FEC's annualbudget is for payroll. We were pleased that after an extensive 

audit, CG found no incorrect payments or leave balances and had only minor suggestions 

on improvements. . 

The official recordof an employee's leave balance is the earnings and leave 

statement, not the manually prepared timesheets. 

FEC agrees it is responsible for obtaining original documents (tax forms, health 

deductions, etc.) when employees arehired. However, FEC employees may use OPM's 

Employee Express to change certaindeductions. In some cases changes are made by NFC 

employees (TSP loan repayments) or an authorized contractor such as for enrollment in 

the Flex Fund HCA Program. Thus,there is not necessarily a form in FEC's files for 

every change to an employee's deductions. Of the 41 documents CG states were not in 

FEC's files, Payroll personnel were able to produce computer screen shots showing the 

Management's Commenta to the Independent Auditor'e Reporta Page 41 
changes were made either by the employee through Employee Express, NFC or an 

authorized FEC employee or contractor. 

FEC recognizes there are some situations (i.e., holidays, travel) where timesheets 

may be approved before the end of the pay period. Both cases noted by CG in the audit 

were around holiday time, when many employees are off. Supervisors remain responsible 

for hours worked by their employees. There is no indication this is widespread problem 

or anyone was paid incorrectly as a result of the advanced approval of the timesheets. 

Timekeepers and supervisors will be reminded of the proper procedures for 

approving leave, correcting timesheets to minimize potential errors and submitting leave 

verifications to payroll each pay period. 

OTHER MATTERS 

Federal Managers' Financial Integrity Act (31 U.S.C. 3512) (Integrity Act) 

Compliance and Reporting 

OMB Circular No. A-123 provides the reporting guidance for the Integrity Act. OMB 

Circular A- 123 states that annually, by December 3 1, the head of each executive agency 

submit to the President and the Congress (i) a statement on whether there is reasonable 

assurance that the agency's controls are achieving their intended objectives; (ii) a report 

on material weaknesses in the agency's controls, and (iii) whether the agency's financial 

management systems conform with government-wide requirements. OMB Bulletin No. 

01-02 required that we compare the material weaknesses in the agency's controls and 

material non-conformances on the agency's financial management systems in the 

FEC's Integrity Act report to our report on internal control dated November 1, 2004. 

Since the Integrity Act report is due by December 31,2004, FEC has not started and does 

not intend to start the process of accumulating the information required for its report until 

November 2004. Accordingly, the comparison of reports could not be performed. 

FEC Response: The FEC noted to CG that the A-123 annual statement process is an 

annual one based on calendar years, not fiscal years, and is due to the President 

December 3 1,2004, not by September 30,2004. Given the heavy workload faced by 

FEC managers during an election year (2004), FEC management stated that we would not 

require division and office managers to prepare their statements prior to September 30, 

2004. The FEC notes that CG was made aware that the A-123 process at the FEC 

requires all managers to integrate concern for management controls into the on-going 

managerial and supervisory duties they perform on a continuing basis. This conforms to 

the last OMB revision of the A-123 process designed to integrate management controls 

and A-123 into the overall management processes of federal agencies. 

It is therefore incorrect to state that the process has not been started-it is ongoing on a regular basis. The process of preparing and submitting the annual statements 

to the Staff Director will not have been completed by September 30.2004. 

Management's Comments to the Independent Auditor's Reports Page 42 
FEC management did note that the December 3 1,2003 letters and statement 

indicated that managers had discovered no major potential weaknesses or potential 

vulnerabilities in their self assessment process. The FEC notes that the A-127 financial 

systems management controls review process can be more than covered by the extensive 

self-assessment the FEC and its contract audit support performed for FY 2003 processes 

in preparation for the FY 2004 audit. It should also be noted that the review and 

evaluation process covered by the audit is more extensive than any self-assessment 

provided for in A-127 of financial management controls. 

The FEC has noted in prior communications to the FEC OIG that the FEC does 

not require a comprehensive plan to integrate its one existing financial system with any 

other financial systems. In terms of integrating the financial system with other systems 

such as the Budget and MIS systems, as well as property, the FEC indicates in both the 

main FEC and FEC IT Strategic Plans and Performance Plans, the schedule for 

improving these systems. As noted the FEC is currently engaged in developing and 

implementing a more fully integrated MIS and budget system with the financial system. 

Management's Comments to the Independent Auditois Reports Page 43