FEDERAL ELECTION COMMISSION 
 

OFFICE OF INSPECTOR GENERAL 
 

FINAL REPORT 
 

Audit of the Federal Election Commission's 
 

Fiscal Year 2005 Financial Statements 
 

November 2005 
 

ASSIGNMENT OIG-05-0 1 
 
FEDERAL ELECTION COMMISSION 

WASHINGTON, D.C.20463 

Office of Inspector General 

MEMORANDUM 

TO: The Commission 

FROM: Inspector General 

SUBJECT: Audit of the Federal Election Commission's Fiscal Year 2005 Financial 

Statements 

DATE: November 10,2005 

This letter transmits the final audit report of the Federal Election Commission's (FEC) fiscal 

year (FY) 2005 financial statements. In accordance with the Accountability of Tax Dollars 

Act of 2002, the FEC prepared financial statements in accordance with Office of Management 

and Budget (OMB) Bulletin No. 01-09, Form und Content of Agency Financial Statements, as 

amended, and subjected them to audit. 

The Chief Financial Officers Act of 1990 (Public Law 101-576, commonly referred to as 

the "CFO Act"), as amended, requires the FEC Office of Inspector General (OIG), or an 

independent external auditor as determined by the Inspector General, to audit the agency 

financial statements. Under a contract monitored by the OIG, Clifton Gunderson LLP (CGLLP), an independent certified public accounting firm, performed the audit of the FEC's FY 

2005 financial statements. 

The OIG commends the FEC for the accomplishment of completing the fiscal year 2005 on 

time this year. The Inspector General acknowledges the significant challenge of meeting the 

accelerated due date of the annual financial statement audit required by OMB. 

Audit Process 

CG-LLP conducted the audit in accordance with auditing standards generally accepted in the 

United States of America; the standards applicable to financial audits contained in Govern~nent 

Auditing Standards, issued by the Comptroller General of the United States; and OMB Bulletin 

No. 01-02, Audit Requiren~ents for Federal Financial Statements, as amended. The results of 
the financial statement audit are detailed in three reports: report on compliance with laws and 

regulations; report on internal control; and the opinion on the financial statements. 

Report on Corn pliance with Laws and re nu la ti on^ 

FEC management is responsible for complying with laws and regulations applicable to the 

agency. To obtain reasonable assurance about whether FEC's financial statements are free of 

material misstatements, CG-LLP performed tests of compliance with certain provisions of 

laws and regulations, non-compliance with which could have a direct and material effect on the 

determination of financial statement amounts, and certain laws and regulations specified in OMB 

Bulletin No. 01-02, such as the Anti-Deficiency Act and the Prompt Payment Act. 

The results of CG-LLP's tests of compliance with laws and regulations described in the audit 

report disclosed no instances of noncompliance with the laws and regulations that are required to 

be reported under Government Auditing Standards and OMB Bulletin No. 01-02. 

Report on Internal Control 

CG-LLPYs planning and performance of the audit included consideration of the FEC9s internal 

control over financial reporting. The CG-LLP auditors obtained an understanding of the FEC's 

internal control; determined whether internal controls had been placed in operation; assessed 

control risk; and performed tests of controls in order to determine auditing procedures for the 

purpose of expressing an opinion on the financial statements. The auditors limited their internal 

control testing to those controls necessary to achieve the objectives described in OMB Bulletin 

No. 01-02 and consequently CG-LLP did not provide an opinion on internal control. 

Internal control as it relates to the financial statements, is a process, affected by agency's 

management and other personnel, designed to provide reasonable assurance of the following: 

(I) transactions are properly recorded, processed, and summarized to permit preparation of the 

financial statements and assets are safeguarded against loss from unauthorized acquisition, use 

or disposition; (2) transactions are executed in accordance with laws governing the use of budget 

authority and other laws and regulations that could have a direct and material effect on the 

financial statements and other laws and regulations identified by OMB; and (3) transactions and 

other data that support reported performance measures are properly recorded, processed, and 

summarized to permit the preparation of performance information in accordance with criteria 

stated by management. 

In performing the testing of internal control necessary to achieve the objectives in OMB Bulletin 

No. 01-02, the auditors identified matters relating to significant deficiencies in the design or 

operation of FEC's internal control. The testing of internal control identified both reportable 

conditions and material weaknesses. The American Institute of Certified Public Accountants 

(AICPA) categorizes reportable conditions as matters relating to significant deficiencies in the 
design or operation of the internal control, which in the judgment of the auditor, could adversely 

affect the agency's ability to record, process, summarize, and report financial data consistent with 

the assertions by management in the financial statements. Material weaknesses are reportable 

conditions in which the design or operation of one or more of the internal control components 

does not reduce to a relatively low level the risk that misstatements in amounts that would be 

material in relation to the financial statements being audited may occur and not be detected 

within a timely period by employees in the normal course of performing their assigned 

functions. 

CG-LLP identified material weaknesses in the areas of: 

Cost Accounting System and Processes 


Administrative Fines, Civil Penalties and MiscellaneousReceipts 


General Property and Equipment 


Information Technology 


CG-LLP identified reportable conditions, not considered to be material weaknesses, which 

include the following: 

Financial Reporting 


Payroll 


. . Q~lnlonon the Financial Statements 

CG-LLP audited the balance sheets of the FEC as of September 30,2005 and 2004, and the 

related statements of net cost. changes in net position, budgetary resources, financing, and 

custodial activity for the years then ended. In the repoit dated November 7,2005, CG-LLP 

issued a qualified opinion on the FEC's financial statements. 

In fiscal year 2005, the FEC was late in providing cost information to support the allocation of 

program costs reported on the statement of net cost. As a result, adequate time did not remain to 

obtain sufficient competent evidential matter and apply auditing procedures necessary to conduct 

the audit in accordance with the standards and OMB audit guidance mentioned above. 

In the independent auditor's opinion, except for the effects of such adjustments to the fiscal year 

2005 statement of net cost. if any, as might have been necessary had the auditors been able to 

perform adequate audit procedures on the program costs referred to in the preceding paragraph, 

the financial statements and related notes referred to above were presented fairly, in all material 

respects, the financial position of the FEC as of September 30,2005 and 2004, and its net cost, 

changes in net position, budgetary resources, reconciliation of net cost to budgetary obligations, 
and custodial activity for the years then ended in conformity with accounting principles generally 

accepted in the United States of America. 

The audit included an examination, on a test basis, evidence supporting the amounts and 

disclosures in the financial statements. The audit also included assessing the accounting 

principles used and significant estimates made by management, as well as evaluating the overall 

principal statements' presentation. 

Audit Follow-yp 

The report on internal control contains numerous recommendations to address weaknesses found 

by the auditors. Management was provided a draft copy of the audit report for comment and 

CG-LLP reviewed management's comments. Although CG-LLP stands by the report and the 

weaknesses detailed, the OTG and CG-LLP intend to work with management through the followup and audit process to ensure the weaknesses are addressed satisfactorily. In accordance with 

OMB Circular No. A-50, Audit Followup, revised, and based on an agreement with the Offices of 

the Staff Director and General Counsel, the Staff Director or designee shall develop an action 

plan for corrective action of the recommendations. The action plan is to set forth specific action 

planned to implement the recommendations and the schedule for implementation. 

OTG Evaluation of Clifton Gunderson LLP's Audit Performance 

In connection with the OIG's contract with CG-LLP, the OIG reviewed CG-LLP's reports 

and related documentation and inquired of its representatives. Specifically, we performed 

the following: (1) reviewed CG-LLP's approach and planning of the audit; (2) evaluated 

the qualifications and independence of the auditors; (3) monitored the work of the auditors 

throughout the audit; (4) examined audit documents and audit reports to ensure compliance 

with Govern~ltent Auditing Standards and OMB Bulletin No. 01-02; and (5) performed other 

procedures we deemed necessary. 

The OIG's review of CG-LLPYs work, as differentiated from an audit in accordance with 

Governmertt Auditing Standards issued by the Comptroller General of the United States, was 

not intended to enable us to express an opinion on the FEC's financial statements; provide 

conclusions about the effectiveness of internal control; or reach conclusions on whether FEC's 

management substantially complied with laws and regulations related to the audit. CG-LLP 

is responsible for the opinion and conclusions reached in the attached reports dated November 

7,2005. The OIG review disclosed no instances where CG-LLP did not comply, in all material 

respects, with Government Auditing Standards. 
Tf you should have any questions, please contact my office on (202) 694-1015. We appreciate the 

courtesies and cooperation extended to Clifton Gunderson LLP and the OIG staff during the 

conduct of the audit. 

~yfmeA. McFarland 

Inspector General 

Attachments 

Cc: 	 Acting Staff Director 

Chief Financial Officer and Deputy Staff Director for Management 

Accounting Officer 

Information Technology Director 
Table of Contents 

Transmittal Memorandum 

Independent Auditor's Report ............................................................ 1 
 

Independent Auditor's Report on Internal Control ..........................................3 
 

Independent Auditor's Report with Laws and Regulations ................................23 
 

Management's Comments to the Independent Auditor's Reports .......................24 
 
Independent Auditor's Report 

To the Inspector General of the 

Federal Election Commission 

We have audited the balance sheets of the Federal Election Commission (FEC) as of 

September 30,2005 and 2004, and the related statements of net cost, changes in net position, 

budgetary resources, financing, and custodial activity for the years then ended. These financial 

statements are the responsibility of FEC's management. Our responsibility is to express an 

opinion on these financial statements based on our audit. 

Except as discussed in the following paragraph, we conducted our audits in accordance with 

auditing standards generally accepted in the United States of America; the standards applicable 

to financial audits contained in Government Auditing Standard, issued by the Comptroller 

General of the United States; and Office of Management and Budget (OMB) Bulletin No. 01-02, 

Audit Requirements for Federal Financial Statements, as amended Those standards require that 

we plan and perform the audit to obtain reasonable assurance about whether the financial 

statements are free of material misstatement. An audit includes examining, on a test basis, 

evidence supporting the amounts and disclosures in the financial statements. An audit also 

includes assessing the accounting principles used and significant estimates made by 

management, as well as evaluating the overall financial statements' presentation. We believe our 

audits provide a reasonable basis for our opinion. 

In fiscal year 2005, the FEC was late in providing cost information to support the allocation of 

program costs reported on the statement of net cost. As a result, adequate time did not remain to 

obtain sufficient competent evidential matter and apply auditing procedures necessary to conduct 

the audit in accordance with the standards and OMB audit guidance mentioned above. 

In our opinion, except for the effects of such adjustments to the fiscal year 2005 statement of net 

cost, if any, as might have been necessary had we been able to perform adequate audit 

procedures on the program costs referred to in the preceding paragraph, the financial statements 

and related notes referred to above present fairly, in all material respects, the financial position of 

the FEC as of September 30,2005 and 2004, and its net cost, changes in net position, budgetary 

resources, reconciliation of net cost to budgetary obligations, and custodial activity for the years 

then ended in conformity with accounting principles generally accepted in the United States of 

America. 

Ctntt~purkI 

4041 Podrri\fi//Rard, SmIe 410 

Cuf1yrt011, rC1ngL11d20.V5-3 106

Y.. .l tcl: 301 -93 1-2050 

kv: 301-931-1710 

Officcs in 14 stntcs 

1 of 23 

and Washinson, l3C mM-*,

Independent Auditor's Report Page 1 
In accordance with Government Auditing Stanhrds, we have also issued our reports dated 

November 7, 2005 on our consideration of FEC's internal control over financial reporting, and 

on our tests of FEC's compliance with certain provisions of laws and regulations. The purpose 

of those reports is to describe the scope of our testing of internal control over financial reporting 

and compliance and the results of that testing, and not to provide an opinion on the internal 

control over financial reporting or on compliance. Those reports are an integral part of our audit 

performed in accordance with Government Auditing Standard and should be considered in 

assessing the results of our audit. 

Our audits were made for the purpose of forming an opinion on the basic financial statements 

taken as a whole. The Management Discussion and Analysis, required supplementary 

information, and other accompanying information contain a wide range of data, some of which is 

not directly related to the financial statements. We do not express an opinion on this 

infoxmation. However, we compared this infoxmation for consistency with the financial 

statements and discussed the methods of measurement and presentation with the FEC officials. 

Based on this limited work, we found no material inconsistencies with the financial statements or 

nonconformance with OMB guidance. 

Calverton, Maryland 

November 7,2005 

Independent Auditor's Report Page 2 
Independent Auditor's Report on Internal Control 

To the Inspector General of the 

Federal Election Commission 

We have audited the financial statements of the Federal Election Commission (FEC) as of and 

for the year ended S-eptember 30,2005, and have issued our report dated November 7,2005. In 

our report, our opinion was qualified for the effects of adjustments, if any, as might have been 

necessary had we been able to perform adequate audit procedures on the cost information 

supporting the allocation of program costs reported on the statement of net cost. Except as 

described above, we conducted our audit in accordance with auditing standards generally 

accepted in the United States of America; the standards applicable to financial audits contained 

in Government Auditing Standards, issued by the Comptroller General of the United States; and 

Office of Management and Budget (OMB) Bulletin No. 01-02, Audit Requirementsfor Federal 

Financial Statements, as amended. 

In planning and performing our audit, we considered FEC's intemal control over financial 

reporting by obtaining an understanding of FEC's internal control; determined whether internal 

controls had been placed in operation; assessed control risk; and performed tests of controls in 

order to determine our auditing procedures for the purpose of expressing our opinion on the 

financial statements. We limited our internal control testing to those controls necessary to 

achieve the objectives described in OMB Bulletin No. 01-02. We did not test all intemal 

controls relevant to operating objectives as broadly defined by the Federal Managers' Financial 

Integrity Act (FMFIA) (31 U.S.C. 3512), such as those controls relevant to ensuring efficient 

operations. The objective of our audit was not to provide assurance on internal control. 

Consequently, we do not provide an opinion on internal control. 

Our consideration of the internal control over financial reporting would not necessarily disclose 

all matters in the internal control over financial reporting that might be reportable conditions. 

Under standards issued by the American Institute of Certified Public Accountants, reportable 

conditions are matters coming to our attention relating to significant deficiencies in the design or 

operation of the internal control that, in our judgment, could adversely affect the agency's ability 

to record, process, summarize, and report financial data consistent with the assertions by 

management in the financial statements. Material weaknesses are reportable conditions in which 

the design or operation of one or more of the internal control components does not reduce to a 

relatively low level the risk that misstatements in amounts that would be material in relation to 

the financial statements being audited may occur and not be detected within a timely period by 

employees in the normal course of performing their assigned functions. Because of inherent 

limitations in internal controls, misstatements, losses, or noncompliance may nevertheless occur 

Ctntttprk I 

4W 1 Powder~lfi// Rocid,SUI&4 10 

Calwtiox,rlfo~~lu~td 20.V5-3106 

tcl: 301-931-2050 

fax: 301-931-1710 3 of 23 

Officus in 14 stntcs and Wtrjhinpon, DC 

Independent Auditor's Report on Internal Control Page 3 
and not be detected. However, we noted certain matters discussed in the following paragraphs 

involving the internal control and its operation that we consider to be reportable conditions and 

material weaknesses. 

Finally, with respect to internal control related to performance measures reported in FEC's 

Performance and Accountability Report, we obtained an understanding of the design of 

significant internal controls relating to the existence and completeness assertions, as required by 

OMB Bulletin No. 01-02, as amended. Our procedures were not designed to provide assurance 

on internal control over reported performance measures, and, accordingly, we do not provide an 

opinion on such controls. 

FEC attained a major achievement by having its financial statements audited for the first time in 

fiscal year 2004. FEC continues to design and implement internal controls to strengthen its 

financial reporting processes. Also, early in the second half of fiscal year 2005, FEC hired a 

Deputy Staff Director for ManagementIChief Financial Officer, a position which was not filled 

for over a year. In fiscal year 2005, however, certain controls were still being designed, not yet 

implemented, not fully implemented or not consistently implemented throughout the year. 

MATERIAL WEAKNESSES 

I. Cost Accounting System and Processes 

The weaknesses identified below collectively resulted in a material weakness in FEC's 

cost accounting system and processes. 

A. Cost Allocation Methodology (Repeat Finding) 

FEC does not have a cost accounting system that is integrated with the general ledger 

(GL) system. The current cost accounting system is not adequate to produce the cost 

data for the Statement of Net Cost (SNC) in an efficient manner. Moreover, the lack 

of documented procedures and the heavy reliance on a single person to carry out this 

process impaired FEC's ability to generate timely information especially after the 

person became unavailable. Consequently, FEC was not able to provide the 

documentation for cost allocation timely and we were not able to apply auditing 

procedures to satisfy ourselves with the program costs reported on the SNC. 

The cost data presented on the SNC is compiled from three systems' raw data, which 

is then gathered and analyzed using an elaborate, complex, and manually intensive 

process. Raw data used in the allocation of costs, such as FTE hours, is sometimes 

based on estimates due to the timing of the availability of the data. 

Independent Auditor's Report on Intd Control Page 4 
FEC summarizes employee hours in a spreadsheet based on an office's program 

numbers, which is generated by a system. The program numbers represent the type of 

work performed by an employee and the hours are assigned directly or allocated to 

FEC's three major programs. FEC could not provide crosswalk documentation or 

definitions supporting the basis of assignment or allocation. The data accumulation 

and analysis is performed by one person and not subjected to a second review. 

The manually intensive and elaborate cost allocation process dictates the need for a 

formal comprehensive policy and procedures. 

A control activity in the GAO Standard for Internal Control in the Federal 

Government is appropriate documentation of transactions and internal control. 

Internal control and all transactions and other significant events need to be clearly 

documented, and the documentation should be readily available for examination. The 

documentation should appear in management directives, administrative policies, or 

operating manuals. All documentation and records should be properly managed and 

maintained. 

Recommendations: 

1. 	 Establish formal and comprehensive cost allocation methodology and related policy 

and procedures. 

2. 	 Cross-train employees to minimize the risks of major intemptions in normal business 

operations. 

3. 	 Establish a review process wherein a person, other than the preparer, reviews the 

work performed to ensure accuracy and propriety. 

4. 	 Maintain audit trails to support the allocation methodology and amounts. 

B. Managerial Coat Accounting (Repeat Finding) 

Statement of Federal Financial Accounting Standards No. 4, Managerial Cost 

Accounting Concepts and Standards for the Federal Government, requires reporting 

components to perform a minimum-level of cost accounting and provide basic 

information necessary to accomplish the many objectives associated with planning, 

decision-making, and reporting. This minimum-level of cost accounting includes, 

among others: providing information for performance measurement; integrating both 

cost accounting and general financial accounting by using the United States Standard 

General Ledger (USSGL); providing useful information; and accommodating 

management's special cost information needs or any other needs that may arise due to 

Independent Auditor's Report on Internal Control 	 Page 5 
unusual or special situations or circumstances. The present FEC cost accounting 

system does not provide the minimum-level identified above. 

FEC is currently testing a new cost accounting system with a target implementation 

date of January 2006. The FEC believes the conditions noted above will be corrected 

by the new cost accounting system. 

Recommendation: 

5. 	 Evaluate the functional requirements for the new cost accounting system to ensure 

that at least, the minimum level of cost accounting required in SFFAS No. 4 is 

attained. 

11.	 Administrative Fines, Civil Penalties and Miscellaneous Receipts (Custodial 

Receipts) (New Condition) 

The weaknesses identified below collectively resulted in a material weakness in FEC's 

custodial receipts. 

FEC does not have adequate systems and controls in place to ensure that custodial 

receipts are properly accounted for and recorded timely. There were no formal 

accounting policy and procedures to ensure that various offices periodically forward to, 

or notify, the finance office of all identifiable, legally enforceable claims (receivable and 

revenue) for recording of activities in accordance with the accounting standards. The 

lack of a policy, standard mechanism and consistent approach resulted in transactions not 

being recorded and reported timely and required the FEC to expend significant effort 

towards the end of the fiscal year to identify all transactions that should be recorded. 

Moreover, for receivables already recorded in the books, FEC lacked adequate 

documentation of analysis applied in determining the allowance for doubtful accounts. In 

addition, transactions related to the custodial receipts, which are non-appropriated funds, 

were recorded in Standard General Ledger (SGL) account no. 101 1, an account used for 

appropriated funds. The use of the incorrect SGL account was corrected in September 

2005 when the auditors brought this issue to FEC's attention. 

SFFAS No. 7, Accounting for Revenue and Other Financing Sources, states that nonexchange revenue (e.g. penalties and fines) should be recognized when a specifically 

identifiable, legally enforceable claim to resources arises, to the extent that collection is 

probable (more likely than not) and the amount is reasonably estimable. An allowance 

for uncollectible accounts receivable should be recognized as a revenue adjustment. 

Independent Auditor's Report on Internal Control 	 Page 6 
The United States Standard General Ledger (USSGL) provides a uniform Chart of 

Accounts and technical guidance to be used in standardizing federal agency accounting. 

Recommendations: 

6. 	 Establish and implement policy and procedures ensuring communication and 

coordination between program offices and finance office on activities with financial 

impact. The policy should also clearly establish the FEC's revenue recognition 

policy. The finance office should design a standard report outlining all the necessary 

information to record the financial activities. The report should be prepared and 

submitted timely at least monthly by the program offices to the finance office. 

7. 	 Document the policy and basis for the allowance for uncollectible accounts. 

111. General Property and Equipment (Property) (Modified Repeat Finding) 

FEC's accounting for property involves a time-consuming effort that increases the risk of 

errors due to its process of expensing its property at the time of acquisition and preparing 

a journal voucher to reclassify the expense to an asset for reporting purposes. In midSeptember 2005, FEC changed to a new property management system. However, the 

accounting for property did not change. 

Our audit disclosed deficiencies, errors or omissions that questioned the effectiveness of 

FEC's internal control on property. The weaknesses identified below collectively 

resulted in a material weakness in FEC's general property and equipment. Some 

examples are noted below: 

The internal control to ensure completeness and proper valuation of property recorded 

in the books was not properly designed, and consequently, was not effective. The 

periodic property reconciliation process did not identify software that should have 

been capitalized until during the audit process. In addition, the monthly management 

analysis of financial activities did not show an analysis of property. 

Although the number of items in FEC's capitalized asset is not many, most of these 

assets are bulk purchases comprised of many individual properties which are 

individually entered into the property system for accountability purposes. The 

information contained in the property system is not always complete. We found that 

some items in the property system did not have the bar code identification, serial 

number and location of the asset. 

Although we were informed that a property physical inventory was conducted, FEC 

could not provide the instructions, complete results and reconciliation of the physical 

inventory to the property system and the general ledger balance. 

Independent Auditor's Report on Internal Control 	 Page 7 
FEC did not always capitalize assets in accordance with the Statement of Federal 

Financial Accounting Standards (SFFAS) No. 10, Accounting for Internal Use 

Sofiware. Moreover, FEC's processes of identifying software in progress and 

completed were not adequate to ensure that all software was identified and recorded. 

For 12 of the 18 property additions tested, the receiving reports were not complete or 

included incorrect information. 

The obligating memo for one of the 15 sample items was not approved by the 

accounting officer, an authorized approving officer. 

There was no standard process, mechanism or a policy to ensure that program offices 

notify the finance office of the acquisition or disposition of property such as software 

in development, completed software, construction in progress, and completed 

construction to ensure the accounting impact of the transaction is recorded timely and 

proper1y. 

One of the five standards for internal control in the Government Accountability Oflice's 

(GAO) Standard for Internal Control in the Federal Government is control activities. 

Control activities occur at all levels and functions of the entity. They include a wide 

range of diverse activities such as approvals, authorizations, verifications, reconciliations, 

performance reviews, maintenance of security, and the creation and maintenance of 

related records, which provide evidence of execution of these activities as well as 

appropriate documentation. 

Recommendations: 

8. 	 Reconcile the total of the individual property items in the property system to the bulk 

purchase total recorded in the books to ensure completeness of the property system 

records. 

9. 	 Document physical inventory procedures, results, and reconciliation and maintain the 

documentation for audit trail purposes. 

10. Revise the software capitalizationpolicy to comply with SFFAS No. 10. 

11. Enforce compliance and consistent implementation of policies and procedures related 

to completing receiving reports and the review and approval of obligating memos or 

documents. 

12. Establish a standard process and policy where program offices are required to notify 

the finance office of any property acquisition or disposition with accounting impact to 

ensure proper and timely recording of the transaction. 

Independent Auditor's Report on Internal Control 	 Page 8 
IV. Information Technology (IT) 

The reportable conditions below, when evaluated together, make the IT area a material 

weakness. 

A. Entity-Wide Security Program 

GAO reported in July 2005 that the underlying cause for information security 

weaknesses is that agencies have not yet fully implemented entity-wide information 

security programs. An entity-wide security program provides a framework and 

continuing cycle of activity for managing risk, developing security policies, assigning 

responsibilities, and monitoring the adequacy of the entity's computer-related 

controls. Without a welldesigned program, security controls may be inadequate; 

responsibilities may be unclear, misunderstood, and improperly implemented; and 

controls may be inconsistently applied. Such conditions may lead to insufficient 

protection of sensitive or critical resources and disproportionately high expenditures 

for controls over low-risk resources. (U.S. Government Accountability Office, 

Weaknesses Persist at Federal Agencies Despite Progress Made in Implementing 

Related Statutory Requirements, GAO-05-552 [Washington, D.C.: July 20051). 

FEC has taken important steps to establish an effective information security program, 

but has not completed the documentation, approval and implementation of an entitywide security program plan. In October 2004, FEC issued a memo informing 

employees that the "Information System Security Program Policy" (Policy Number 

58A) was approved and should be followed by all employees. Policy Number 58A 

was created to "manage the risk to information rather than just systems" and serve as 

the backbone of FEC's entity-wide security program. Policy 58A and its subsets 

supplement Directive 58, "Electronic Records, Software and Computer Usage," 

which was issued in November 1997. 

In fiscal year 2005, FEC has completed the identification of its major applications and 

mission critical general support systems (MCGSS) as part of its risk mitigation 

strategy. FEC management also created a Security Review Policy that calls on 

management to perform annual external penetration testing, disaster recovery tests, a 

review of incident response procedures, a network vulnerability study, a code review 

of one major application and a review of access control procedures. Additionally, 

FEC management is currently in the process of soliciting bids for risk assessments. 

Management has completed the statement of work, received proposals and is 

currently reviewing the proposals. The risk assessment and business impact analysis 

are key components in the development of security plans and disaster recovery plans. 

These components are essential in the establishment of the framework for the 

development and implementation of the FEC's security plans and disaster recovery 

plans. 

Independent Auditor's Report on Internal Control Page 9 
Current weaknesses that exist in FEC's information security program include the 

following: 

(Repeat Finding) FEC has not filly implemented its documented framework of 

policies and standards to mitigate risks associated with the management of 

information resources. 

(Repeat Finding) FEC has not completed the documentation, approval and 

implementation of its entity-wide security program plan. 

(Modified Repeat Finding) FEC has not completed the documentation, approval 

and implementation of security plans for six of the 13 identified major 

applicationsand MCGSS. 

Resource Classifications in FEC7s security plans are not based on Risk 

Assessments. 

(Modified Repeat Finding) FEC has not fully implemented a program for the 

continuous monitoring and evaluation of the computer security policy and control 

effectiveness. Although the FEC has created a Security Review Policy, the FEC 

did not provide evidence of several components of the security reviews to be 

conducted during the fiscal year that would document the continuous monitoring 

and evaluation of the security policy. For example, the auditors were not 

provided with evidence of the following reviews required by the policy: MCGSS 

reviews; test of the incident response procedures; and a code review of one major 

application. The FEC has created a Security Review Policy that calls on 

management to perform annual external penetration testing, disaster recovery 

testing, a review of incident response procedures, a network vulnerability study, 

and a review of access control procedures. Additionally, FEC management issued 

a memo on May 21, 2004 outlining a schedule of review of its major applications 

and MCGSS with reviews of the MCGSS beginning in the third quarter of fiscal 

year 2005. 

(Repeat Finding) Risk assessments have not been conducted for more than three 

years. FEC management is currently in the process of soliciting bids for risk 

assessments. 

(Repeat Finding) Major applications and MCGSS have not been certified and 

accredited to ensure that they are operating according to FEC's security 

requirements. 

There are weaknesses in FEC's program to document corrective actions and 

verify that the weaknesses identified have been addressed. 

IndependentAuditor's Report on Internal Control Page 10 
Recommendations: 

13. Implement a framework of policies and standards to mitigate risks associated with the 

information resources management. 

14. Complete the documentation, approval and implementation of an entity-wide security 

program plan. 

15. Develop and implement security plans for all major applications and MCGSS as part 

of a risk mitigation strategy. 

16. Ensure that Resource Classifications in FEC's security plans accurately reflect the 

risk and vulnerabilities of FEC systems. 

17. Complete the implementation of the program for the continuous monitoring and 

evaluation of the computer security policy and control effectiveness. 

18. Conduct risk assessments at least every three years as part of an overall strategy to 

mitigate risks associated with its information technology environment. 

19. Certify that the major applications and MCGSS are operating according to FEC's 

security requirements. 

20. Strengthen FEC's program to document corrective actions and verify that weaknesses 

identified have been addressed. Ensure and document that recommendations fkom the 

most recent network security review have been implemented. 

B. Controls to Protect Information 

For a computerized organization like FEC, achieving an adequate level of information 

protection is highly dependent upon maintaining consistently effective access controls 

and system software controls. Access controls limit and monitor access to computer 

resources (i.e., data files, application programs, and computer-related facilities and 

equipment) to the extent necessary to provide reasonable assurance that these 

resources are protected against waste, loss, unauthorized modification, disclosure, or 

misappropriation. Access controls include logical/technical controls such as 

designing security software programs to prevent or detect unauthorized access to 

sensitive data. Similarly, system software controls limit and monitor access to 

powerful programs and sensitive files that control computer processing and secure the 

application and data supported by the system. 

Independent Auditor's Report on Internal Control Page 11 
Our limited testing of internal controls identified weaknesses related to the 

information protection in the FEC's information systems environment. Impacted 

areas included the local area and wide area networks as well as its midrange computer 

systems (e.g. servers). These vulnerabilities expose FEC and its computer systems to 

risks of external and internal intrusion, and subject sensitive information related to its 

major applications to potential unauthorized access, modification, andlor disclosure. 

Current weaknesses in access controls include the following: 

(Modified Repeat Finding) The principle of "least privilege" is not enforced. A 

high-level finance officer has system administrator access to the GL system. 

(Repeat Finding) FEC does not maintain visitor logs for data center access and 

has not implemented adequate compensating controls to monitor and record 

visitor access to the data center. 

(Modified Repeat Finding) FEC does not use access request forms to document 

user access rights or periodically review all access rights for appropriateness. 

Specifically, we noted that data center access request e-mails were only available 

for three out of 40 users and there was no evidence of data center access 

revalidation. Additionally, we noted that access rights for the new property 

system were not documented; access requests were verbally approved, according 

to management. 

(Modified Repeat Finding) The GL system application does not have the built in 

functionalityto enforce password controls. Specifically, 

o It does not enforce password changes, 

o It does not have an account lockout policy, 

o It does not prevent users from using previous passwords, and 

o It does not have the ability to enforce strong password requirements. 

(Repeat Finding) FEC does not comply with its auditing policy because it does 

not automatically log the network activity described in its Audit Event Standardr, 

even though it has the capability to do so. 

FEC is not actively monitoring the use of budgetary ovemdes in the GL 

application. 

FEC does not periodically review its firewall rule set for appropriateness. 

Local area network (LAN) user accounts are not appropriately reviewed: 

o One account has not been used since 1998; 

o One account has not been used since 2002; and 

o Two accounts have not logged on since 2004. 

IndependentAuditor's Report on Internal Control Page 12 
Recommendations: 

21. Create a new GL system application role to give employees with necessary and 

appropriate access rights to fulfill their job responsibility. 

22. Monitor and record visitor access to the data center. 

23. Use access request forms to document user access rights and periodically review the 

access for appropriateness. 

24. Develop mitigating controls to ensure that GL system passwords are in agreement 

with FEC policy. 

25. Automatically log network activity as required by the Audit Events Standarak. 

26. Institute a process to manually review logs of users using budgetary overrides where 

the reviewer is an individual who does not have access to utilize the overrides. 

27. Periodically review the firewall rule set for appropriateness. 

28. Periodically review LANuser accounts and disable unnecessary user accounts. 

C. ContingencyPlan 

Losing the capability to process and protect information maintained on FEC's 

computer systems can significantly impact FEC's ability to accomplish its mission to 

serve the public. The purpose of service continuity controls is to ensure that, when 

unexpected events occur, critical operations continue without interruption or critical 

operations are promptly resumed. 

To achieve this objective, FEC should have procedures in place to protect information 

resources and minimize the risk of unplanned interruptions and a plan to recover 

critical operations should interruptions occur. These plans should consider activities 

performed at FEC's general support facilities (e.g. FEC's LAN, wide area network, 

and telecommunications facilities), as well as the activities performed by users of 

specific applications. To determine whether the disaster recovery plans will work as 

intended, FEC should establish and periodically test the capability to perform its 

functions in disaster simulation exercises. 

Our review of the service continuity controls identified deficiencies that could affect 

FEC's ability to respond to a disruption in business operations as a result of a disaster 

or other long-term emergency. The deficiencies were as follows: 

Independent Auditor's Report on InternalControl Page 13 
(Modified Repeat Finding) FEC has not performed a Business Impact Analysis 

(BIA) to formally identify and prioritize all critical data and operations on its 

networks and the resources needed to recover them if there is a major intermption 

or disaster. In addition, we could not determine whether FEC had established 

emergency processing priorities that will help manage disaster situations more 

effectively for the network. FEC also has not included business owners in the 

discussion to determine how much backup data is needed on-hand to minimize the 

impact of a disaster. FEC is currently in the process of creating a request for 

proposal for completing a BIA. 

(Modified Repeat Finding) FEC has not established an alternate processing site 

for its operations in the event of a disaster, including its general ledger system. 

Additionally, the FEC disclosure database is replicated at an off-site location as a 

web-enabled, read-only database the public can access. In the event that data 

cannot be updated at FEC and then replicated to the off-site location, there is no 

operational mechanism to update the disclosure database at the off-site location. 

FEC has developed a cost analysis of establishing an alternate site and is cumntly 

pursuing interagencyagreements to address this issue. 

FEC has not developed a Continuity of Operations Plan (COOP) to support the 

continuation of its core mission in the event of a disaster that renders the FEC's 

facilities unusable. 

(Modified Repeat Finding) FEC has not developed and documented a 

comprehensive contingency plan of its data centers, networks and 

telecommunication facilities. FEC has created a contingency plan that includes 

procedures for restoring its network and the GL system application in the event of 

a disaster. Although FEC has identified the system resources and relevant points 

of contact associated with the two systems, the following elements were missing 

from the contingency plan: 

o 	 The plan does not cover all major applications and mission critical 

systems, and 

o 	 The plan does not prioritize resources or set a timeframe for recovery. 

Recommendations: 

29. Perform a Business Impact Analysis to formally identify and prioritize all critical data 

and operations on FEC's networks and the resources needed to recover them if there 

is a major intermption or disaster. Ensure that emergency processing priorities are 

established to assist in managing disaster situations more effectively for the network 

and include business owners in the discussion to determine how much backup data is 

needed on-hand to minimize the impact of a disaster. 

Independent Auditor's Report on Internal Control 	 Page 14 
30. Establish alternative processing site for FEC's operations in the event of a disaster 

and ensure that an operational mechanism exists to update the disclosure database in 

the event that the FEC database is unavailable to replicate the disclosure database 

resident at the off-site location. 

31. Develop a Continuity of Operations Plan (COOP) to support the continuation of the 

FEC's core mission in the event of a disaster that renders the FEC's facilities 

unusable. 

32. Develop and document a comprehensive contingency of operations plan of FEC's 

data centers, networks and telecommunication facilities. 

D. Software Development and Change Controls 

Establishing controls over the modification of application software programs helps to 

ensure that only authorized programs and authorized modifications are implemented. 

This is accomplished by instituting policies, procedures, and techniques that help 

make sure all programs and program modifications are properly authorized, tested, 

and approved and that access to and distribution of programs is carefully controlled. 

Without proper controls, there is a risk that security features could be inadvertently or 

deliberately omitted or "turned off' or that processing irregularities or malicious code 

could be introduced. 

(Modified Repeat Finding) FEC has not fully implemented its System Development 

Life Cycle (SDLC)Methodology, specifically: 

The FEC is not using Change Implementation/Notices to document change 

requests, 

One change did not show evidence of user acceptance testing, 

Two changes did not show evidence of implementation approval, 

Test results and approvals are not documented on Test Problem Reports and 

Test Approval Determinations,as indicated in the SDLC, and 

The FEC did not perform a feasibility study or cost-benefit analysis for the 

acquisition of Probar, a new property management system. 

Recommendation: 

33. Fully implement the System Development Life Cycle Methodology. 

Independent Auditor's Report on Internal Control Page 15 
REPORTABLE CONDITIONS 
 

V. Financial Reporting (Modified Repeat Finding) 

A.	 General Ledger (GL) System Setup and Posting Model Definitions (Modified 

Repeat Finding) 

The GL system setup and posting model definitions do not fully comply with the 

transactions posting models consistent with the USSGL guidance and policies when 

recording and classifying certain transactions. The resources expended to 

periodically review and research incorrect posting logic errors, reconciliation, and 

adjustments to the general ledger accounts could be devoted to the routine daily 

business operations of FEC. FEC is aware of the inherent limitations of the GL 

system and has requested assistance fiom the vendor to correct posting logic. FEC 

anticipates corrections will be finalized in fiscal year 2006. 

Recommendation: 

34. Ensure that corrections made to the posting logic comply with the USSGL and that 

the USSGL accounts and posting logic are updated as changes to USSGL are issued. 

B.	 Continuing Resolution Accounting (New Finding) 

FEC did not record apportionments granted during the continuing resolution period in 

accordance with the instructions fiom the OMB Circular No. A-1 1, Preparation and 

Submission of Budget Estimates, and OMB Bulletin No. 04-05, Apportionment of 

Continuing Resolution(s) for Fiscal Year 2005. Specifically, FEC recorded the entire 

requested appropriation of $52 million as budget authority in October 2004 even 

though the entire budget authority did not become available until January 2005. 

Under the continuing resolution accounting scenario provided by the U.S. Treasury, 

amounts recorded as appropriation1 apportionment should only be in amounts 

determined in accordance with OMB Bulletin No. 04-05. Although the incorrect 

entries automatically became correct entries upon the receipt of the full appropriation, 

which was apportioned in January 2005, the system's funds control during the 

continuing resolution period was not effective and the risk that unavailable funds 

could be expended during this period was high. 

In addition, proper reconciliation should be performed by reflecting what was actually 

recorded in the books versus what was reported by the U.S. Treasury FMS 6653, 

Undisbursed Appropriation Account Ledger. 

Independent Auditor's Report on Internal Control 	 Page 16 
Recommendation: 

35. Comply with the continuing resolution accounting scenario prescribed by 	 U.S. 

Treasuryin accordance with memorandum issued by OMB. 

C. 	Integrated Financial Management System (Repeat Finding) 

A single, integrated financial management system is a unified set of financial systems 

linked together electronically in an efficient and effective manner to provide agencywide financial system support. Integration means that the user is able to have one 

view into systems such that, at whatever level the individual is using the system, he or 

she can obtain needed information efficiently and effectively through electronic 

means. It does not necessarily mean having only one software application covering 

all financial management system needs within an agency. Interfaces are acceptable as 

long as the supporting details are maintained and accessible to managers. Interface 

linkages must be electronic unless the number of transactions is so small that it is not 

cost beneficial to automate the interface. Easy reconciliationbetween systems, where 

interface linkages are appropriate,must be maintained to ensure data accuracy. 

FEC does not have an integrated financial management system. Significant financial 

management systems such as the cost system, receivable systems and the property 

and equipment system do not interface with the GL system. 

Recommendation: 

36. Continue to assess the degree of integration necessary to have a single, unified 

financial system by evaluating the functional requirements and the costs and benefits 

of integrating the financial reporting, property and equipment, receivable, and the cost 

systems with the GL system. 

VI. Payroll (Modified Repeat Finding) 

The results of our internal control tests disclosed weaknesses in payroll processing 

similar to the prior year, as follows: 

Transmitting certain payroll transactions, such as leave balance adjustments, to FEC's 

payroll service provider is a two-step process initiated by the FEC. We noted that in 

two instances, FEC made the first step in adjusting an employee's leave balance but 

failed to perform the second step. As a result, the leave adjustment was not 

transmitted or reflected in the service provider's system. 

Documentation such as election forms for payroll deduction authorization (FEGLI, 

federal tax withholding, savings bond, FEHB,and TSP-FERS) and SF-50 form were 

Independent Auditor's Report on Internal Control 	 Page 17 
not consistently maintained in the payroll files, and therefore some were not available 

for our review. 

FEC's policy requires timekeepers to perform bi-weekly reconciliations between the 

leave balances in FEC's records and the payroll service provider. The timekeepers 

are to forward leave balance certifications to the finance office indicating whether 

balances agree'or disagree. Thirteen of the 45 leave balance certification forms were 

not submitted and five of the 45 submitted were incomplete. Furthermore, there was 

no indication that the finance ofice followed-up on the certifications that were not 

received or incomplete. 

For two of the 45 employees tested, the T&A (time and attendance) report did not 

agree with the service provider's leave balance report. However, the timekeeper 

certified that the leave balance report agreed with individual leave records. In 

addition, there were also two instances where the timekeeper submitted a leave 

balance certification but there was no leave balance on the employee's T&A report. 

For two of the 45 employees tested, we noted four instances where the approved 

T&A reports were not properly completed. 

OMB Circular A- 123, Management Accountability and Control (Revised June 21, 1995), 

requires that "the documentation for transactions, management controls and other 

significant events must be clear and readily available for examination." GAO Standarch 

for Internal Control in the Federal Government states that transactions and other 

significant events should be authorized and executed only by persons acting within the 

scope of their authority. This is the principal means of assuring that only valid 

transactions to exchange, transfer, use or commit resources and other events are initiated 

or entered into." 

FEC Accounting Manual Vol. I, Section 1.3.2.2.10, Reconciliation, states that 

"transactions recorded in the FEC accounting system [should be] periodically reconciled 

with source documents." Section 1.3.2.2.15, Compensation, also states "'timely,accurate, 

and complete subsidiary records [should be] maintained of vacation [and] sick leave and 

other balances." 

Recommendations: 

37. Implement procedures to ensure that leave adjustments are completely processed and 

transmitted to the service provider. 

38. Maintain in the personnel files all payroll deduction authorization forms initiated 

through FEC, i.e., not done directly by the employee with a service provider. 

39. Ensure that timekeepers: perform the bi-weekly reconciliation between leave balances 

reported in its records and the service provider's records; and submit the bi-weekly 

leave balance certification to the finance office timely. 

Independent Auditor's Report on Internal Control Page 18 
40. Implement procedures for ensuring all payroll and personnel documents are properly 

completed and authorized before payroll data is transmitted to the payroll service 

provider for processing. 

41. Consider automating payroll processing to decrease the risk of errors. 

VII. Status of Prior Year Comments 

As required by Government Auditing Standarh and OMB Bulletin No. 01-02, as 

amended, we have reviewed the status of FEC's corrective actions with respect to the 

findings and recommendations from the previous year's report on internal controls. For 

those items not addressed in various sections of our Independent Auditor's Report on 

Internal Control, summarized above, the following discusses the current status of 

resolutions for matters raised: 

Financial Reporting 

Condition: FEC did not have a written policy and procedures to formalize plans, 

methods, and procedures to guide the financial statement preparation and reporting 

process. 

In fiscal year 2005, FEC established an accounting department annual calendar and 

audit schedule and developed written procedures for the compilation of the quarterly 

reports. Therefore, we have removed this as a material weakness. 

Condition: FEC did not prepare and analyze monthly reconciliations of subsidiary 

and summary account balances. 

In fiscal year 2005, FEC continued with the monthly reconciliations and analysis that 

it started at the end of fiscal year 2004 for Fund Balance with Treasury, budgetary 

accounts, and general property and equipment accounts. However, we continue to 

identify deficiencies in the reconciliation of software in development and physical 

inventory. This condition, therefore, continues to exist for certain accounts as 

explained above. 

Entity-Wide Security Program 

Condition: There is no periodic security awareness training. Training is only 

provided to new employees and contractors. FEC did conduct a baseline awareness 

training program, but does not have a process in place to provide security awareness 

training on an annual basis. 

Independent Auditor's Report on Internal Control Page 19 
In fiscal year 2005, FEC provided periodic computer security awareness training to 

all employees and contractors (i.e. contractors granted access to the FEC's network). 

Therefore, we have removed this as a reportable condition. 

Controls to Protect Information 

Condition: No documentation or verification that the vulnerabilities identified in the 

Feb~ary2004 network penetration scan had been addressed. 

In fiscal year 2005, FEC rescanned its systems and verified that the vulnerabilities 

identified in the February 2004 network penetration scan had been addressed. 

Therefore, we have removed this as a reportable condition. 

Condition: There are no records of access requests granted to remote users. FEC 

was unable to provide access request approval documentationto support the access of 

all dial-up and virtual private network (VPN) users that we sampled for our review. 

In addition, there was no evidence of periodic re-validations of these users. 

In fiscal year 2005, FEC documented and revalidated VPN and dial-up access rights 

and privileges. Therefore, we have removed this as a reportable condition. 

Condition: GL system access requests are not properly documented or reviewed. 

FEC was only able to provide us original access matrices for eight of the 33 current 

GL system users. Additionally, FEC does not periodically perform revalidations of 

GL system access. 

In fiscal year 2005, FEC documented access requests for new users and performed 

revalidations of access rights granted to existing users of the GL system. Therefore, 

we have removed this as a reportable condition. 

Condition: Data center access is not adequatelydocumented or reviewed: 

o 	 Four employeeshave their names misspelled on the cardholder report; 

o 	 One of the individuals with access to the data center was terminated recently, but 

his access key is still active and the physical location of the key could not be 

determined;and 

o 	 FEC could not identify one user who has access to the data center or justify why 

the individual has access to the data center 

In fiscal year 2005, FEC disabled the active access keys of users not requiring access 

to the data center and identified all users with access to the data center, but FEC 

needs to ensure names are correctly spelled on the cardholder report. Therefore, we 

have removed this as a reportable condition. 

Independent Auditor's Report on Internal Control 	 Page 20 
ContingencyPlan 

Condition: FEC does not have adequate capacity for most of its back-up tapes in its 

fireproof safe; hence, back-up tapes are not kept in a fireproof safe. 

In fiscal year 2005, FEC has procured an additional fireproof safe@) for back-up 

tapes. Therefore, we have removed this as a reportable condition. 

Condition: FEC's data center is fully exposed to a wet pipe sprinkler system, with 

no compensating controls to avoid inadvertent water damage to critical hardware and 

magnetic media in the case of a malfunction or false alarm. 

FEC has compensating controls to avoid inadvertent water damage to critical 

hardware and magnetic media in the case of a malfunction or false alarm from the wet 

pipe sprinkler system. Therefore, we have removed this as a reportable condition. 

SoftwareDevelopment and Change Controls 

Condition: No written policy has been created to manage software libraries. 

In fiscal year 2005, FEC has established a written policy to manage software libraries. 

Therefore, we have removed this as a reportable condition. 

Condition: Written procedures to modify, test, approve or release software for any 

of its applications, including the GL system, have not been documented. 

In fiscal year 2005, FEC documented written procedures to modify, test, approve and 

release software for its applications. Therefore, we have removed this as a reportable 

condition. 

Condition: Emergency change procedures and procedures for installing patches are 

not documented. 

In fiscal year 2005, FEC documented written emergency change procedures for 

installing patches. Therefore, we have removed this as a reportable condition. 

Condition: Certain software code changes for the GL system were not reviewed 

before being implemented. 

In fiscal year 2005, FEC has established policies and procedures to ensure that the 

software code is reviewed prior to moving the modified code into production. 

Independent Auditor's Report on Internal Control Page 21 
Additionally, there were no software changes to the GL system for fiscal year 2005. 

Therefore, we have removed this as a reportable condition. 

OTHER MATTERS 

Federal Managers' Financial Integrity Act (31 U.S.C. 3512) (FMFIA) 

OMB Circular No. A-123, Management Accountability and Control, provides the reporting 

guidelines for the FMFIA. OMB Circular No. A-123 states that annually, by December 31, the 

head of each executive agency submit to the President and the Congress (i) a statement on 

whether there is reasonable assurance that the agency's controls are achieving their intended 

objectives, (ii) a report on material weaknesses in the agency controls, and (iii) whether the 

agency's financial management systems conform with government-wide requirements. 

OMB Bulletin No. 01-02 requires that the auditor's report on internal control "identify those 

material weaknesses disclosed by the audit that were not reported in the reporting entity's 

FMFIA report." FEC's FMFIA report dated October 4,2005 reports that FEC management did 

not identify material weaknesses, but acknowledged the FEC fiscal year 2004 Independent 

Auditor's Report on Internal Control included material weaknesses. FEC disagreed with the 

material weaknesses identified in the internal control report, and therefore, did not prepare a 

report on material weaknesses, including agency plans to correct the material weaknesses and 

progress against those plans in the FMFIA report submitted. 

In addition to the material weaknesses and reportable conditions described above, we noted 

certain matters involving internal control and its operation that we reported to the management of 

FEC in a separate letter dated November 7,2005. 

This report is intended solely for the information and use of the management of FEC, FEC 

Ofice of Inspector General, OMB, and Congress, and is not intended to be and should not be 

used by anyone other than these specified parties. 

Calverton, Maryland 

November 7,2005 

Independent Auditor's Report on Internal Control Page 22 
B! R2zk!mLL* 
 c.nuw NYc kc- L CuknU 

Independent Auditor's Report on Compliance with Laws and Regulations 

To the Inspector General of the 
 

Federal Election Commission 
 

We have audited the financial statements of the Federal Election Commission (FEC) as of and 

for the year ended September 30,2005, and have issued our report dated November 7,2005. In 

our report, our opinion was qualified for the effects of adjustments, if any, as might have been 

necessary had we been able to perform adequate audit procedures on the allocation of program 

costs in the statement of net cost. Except as described above, we conducted our audit in 

accordance with auditing standards generally accepted in the United States of America; the 

standards applicable to financial audits contained in Government Auditing Standard, issued by 

the Comptroller General of the United States; and Offtice of Management and Budget (OMB) 

Bulletin No. 01-02, Audit Requirementsfor Federal Financial Statements, as amended. 

The management of FEC is responsible for complying with laws and regulations applicable to 

FEC. As part of obtaining reasonable assurance about whether FEC's financial statements are 

free of material misstatements, we performed tests of its compliance with certain provisions of 

laws and regulations, noncompliance with which could have a direct and material effect on the 

determination of financial statement amounts, and certain other laws and regulations specified in 

OMB Bulletin No. 01-02. We limited our tests of compliance to these provisions and we did not 

test compliance with all laws and regulations applicable to FEC. 

The results of our tests of compliance with laws and regulations described in the preceding 

paragraph disclosed no instances of noncompliance with the laws and regulations that are 

required to be reported under Government Auditing Stanhrds and OMB Bulletin No. 01-02. 

Providing an opinion on compliance with certain provisions of laws and regulations was not an 

objective of our audit, and accordingly, we do not express such an opinion. 

We noted certain immaterial instances of noncompliance that we have reported to management 

of FEC in a separate letter dated November 7,2005. 

This report is intended solely for the information and use of the management of FEC, FEC 

Oflice of Inspector General, OMB and Congress, and is not intended to be and should not be 

used by anyone other than these specified parties. 

Calverton, Maryland 

November 7,2005 

Ccnt& I 

404 1 Powdtr,.\fifl bd,Jxdt 410 

Cubrrtor~,bfaglot~d20.70fJ106 

tcl: 301 -931-2050 

hx:301-931-1710 23 of 23 

Ofticur 1.1 14 atnicl; und Wmshmst~,n.DC 

Independent Auditor's Report on Compliance with Laws and Regulations Page 23 
Management Comments and Response to the Inde~endentAuditor's Report 

EXECUTIVE SUMMARY 

This year the independent auditas, Clifton Gunderson (CG), identified four material weakness 

(cost accounting system and processes, custodial receipts, general praperty and equipment and 

information technology) and two reportable conditions (financial reporting and payroll). While 

area for improvement exists, the FEC fundamentally disagrees with several of CG's findings. 

The FEC has made significant progress in addressing the material weaknesses and reportable 

conditions identified last year. We demonstrated the improvements made throughout the 

financial and information technology (IT) areas, and yet very little improvementwas recognized. 

We firmly believe that the FEC improved its fjnancial reporting and IT policies and procedures, 

both in response to audit findings and in compliance with all laws andregulations. Following 

are specific highlights: 

a 	 Cost allocation methodology - although the process is manual, it meets the flexible 

standards allowed far in this area. There were no changes in the cost allocation 

methodology from last year to this year. Yet, last year it was not a material weakness and 

this year it not only was a material weakness, it was enough to qualify a statement. A 

new system will be implemented in early FY 2006. Management found it was neither 

cost effective nor practical to implement the syskm so close to the end of the fiscal year. 

The new system will ensure accurate and more efficient processing. 

Managerial cost accounting -should not be classified as a material weakness because the 

critical elements of SFFASNo. 4 have been met. 

Custodial receipts - the process we had in place was sufficient given the nature of the 

activity. For FY 2006 we require monthly, stmdardized reports from the relevant 

divisions. 

a 	 Generalproperty and equipment - we believe that none of the weaknesses cited by CG, 

either alone or collectively, are substantial enough to warrant classification as a material 

weakness. 

Information Technology - none of the reportable conditions in the area of IT, either 

individually or collectively, rise to the level of material weakness. The FEC meets the 

standards set forth in all applicableIT standards and regulations. 

Most important, any issue noted by CG was detected within a timely period by employees in the 

normal course of performing their assigned functions and, therefore, by definition does not 

constitute a material weakness. 

Management Comments and Response to the Independent Auditor's Report 	 Page 24 
Following are the FEC's responses to and comments on the auditor's report on internal control. 

Clifton Gunderson (CG) also provided a report on compliance with laws and regulations. They 

found that the FEC was in compliance with laws and regulations. 

The FEC is proud of the significant progress made over the past fiscal year in terms of 

strengthening our inkma1 controls. Such strides have beennoted both by the Inspector General 

and the independent auditors. Fully mindful of the IG's and auditor's comments from the 

previous year, we took a critical look at the issues and prioritized them. Most findings in the 

finance area were resolved in FY 2005. For example, in prior years it had taken us up to three 

weeks to prepare quarterly financial reports. Now we are able to complete this process in a 

matter of days. We were also able to improve our timeliness with respect to reconciliations. Not 

only have we become more efficient at producing financial reports, we have become more 

effective. This year we only had to make six "on top" adjustments; down from thirteen last year. 

We implemented several process changes. We standardized and formalized reconciliation 

processes. We added purchase order reconcilidon, relationship testing and property modules to 

automate our system processes and reduce error. All of these improvements have been formally 

documented. The Accounting Policy and Procedu~ manual was changed and formally reviewed 

and approved by the Chief Financial Officer. The manuals have allowed for better cross training 

of .staff to ensure that no process is fully dependent on one employee. 

The overriding issue for the FEC's comments is what constitutes a material weakness. GAO 

defines material weakness as ". . . reportable cmditions in which the design or operation of one 

or more of the internal control components does not reduce to a relatively low level the risk that 

misstatements in amounts that would be material in relation to the financial statements being 

audited may occur and not be detected within a timely period by employees in the normal course 

of performing their assigned functions." Reportable conditions "are matters coming to the 

auditor's attention that, in the auditor's judgment, should be communicated because they 

represent significant deficiencies in the design or operation. . .." (OMB Bulletin 01-02). 

MATERIAL WEAKNESSES 

I. 	 Cost Accounting System and Processes 

A. 	 Cost Allocation Methodology (Repeat Finding) (NFR #37, #38, #40) 

Recommendations 

1. 	 Establish formal and comprehensive cost allocation methodology and related 

policy and procedures. 

Management Comments and Response to the Independent Auditor's Report 	 Page 25 
FEC RESPONSE: 

The FEC established and provided the auditors with a simple, straightforward crosswalk, 

supporting the basis of allocations. The FEC also established and p~vided the auditors 

with cost allocation methodology and related policy and procedures. 

2. 	 Cross-train employees to minimize the risks of major interruptions in normal 

business operations. 

FEC RESPONSE: 

The FEC cross-trained three employees on the cost allocation process. The FEC 

provided evidence to the auditors that personnel were crossed trained and able to perform 

the cost-allocation process. 

3. 	 Establish a review process wherein a person, other than the preparer, reviews the 

work performed to ensure accuracy and propriety. 

FEC RESPONSE: 

The FEC established a review process for the cost allocation process. The FEC provided 

evidence to the auditors that a review process was in place and was followed in the costallocation process. 

4. 	 Maintain audit trails to support the allocation methodology and amounts. 

FEC RESPONSE: 

The FEC maintained an audit trail that supports the allocation methodology and provided 

the audit trail to the auditors. 

B. Managerial Cost Accounting (Repeat Finding) 

Recommendation: 

5. 	 Evaluate the functional requirements for the new cost accounting system to ensure 

that at least, the minimum level of cost accounting required in SFFAS No. 4 is 

attained. 

The FEC disagrees with this finding and its classification as a material weakness. SFFAS 

No. 4 gives agencies the flexibility to devise methods for allocating costs that are 

appropriate for the agency's size, mission and nature of ccsts incurred, so long as the 

method is reliable and timely. The FEC's system provides sufficient information to both 

high level management and program managers on the full cost of federal programs, our 

Management Comments and Response to the Independent Auditor's Report 	 Page 26 
activities, and outputs. The FEC system meets the fundamental elements of managerial 

cost accounting as set forth in SFFAS No. 4. It: (1) accumulates and reports FTE usage 

rates on a regular basis for management information purposes; (2) establishes 

responsibility segments to match costs with outputs; (3) determines fill costs of 

government goods and services; and (4) uses appropriate costing methodologies to 

accumulate and assign costs to outputs. The new system will meet the same 

requirements. 

11.	 Administrative Fines, Civil Penaltie and Miscellaneous Receipts (Custodial 

Receipts) (New Condition) (NFR #19,#36, #38) 

FEC RESPONSE: 

While we are cognizant of the issues preseIlted in this finding, we do not believe it 

warrants classification as a material weakness. Although the FEC recognizes this as an 

area that needs to be strengthened with more fonnal processes, the FEC does have 

adequate systems and controls in place to ensure custodial receipts are properly 

accounted for and timely recorded. 

During FY 2005, the relevant divisions reported internally on a quarterly basis. Take for 

example the Administrative Fine program. After an initial attempt to collect debts, 

delinquent civil penalties are referred to Treasury. This requires significant reporting and 

documentation. The FEC and Treasury amunts must balance each month, and this 

reconciliation serves as an external check. 

Of the total in-house serviced debt outstanding at September 30, 2005, over 70% of it 

accrued in September 2005. Thus, most of the accounts receivable (AR) balance could 

not have been entered into the general ledger (GL) before year end. The increase in inhouse serviced debt was due in part to the fact that Treasury put ahold on submission of 

collections. CG did not propose any adjustments to any balances recorded in GL. 

Therefore, FEC believes it is unlikely material misstatements could have occurred in this 

area and not have been detected in a timely manner by the staff in the routine 

performance of their jobs. 

While we believe that quarterly reporting was sufficient given the nature of the activities, 

we have implemented monthly reporting for FY 2006. We are in the process of 

developing a standard format for each division to use. Each month all internally 

generated reports will be reconciled to the GL and each division will be provided a status 

report. FEC will continue reconciling cash and receivables with Treasury and adding 

aging categories to facilitate review by management and preparation of the quarterly 

report on receivables to Treasury. All of these changes, including a description of how 

the Allowance for Uncollectible Accounts is calculated, will be put into the Accounting 

Manual once they are finalized. 

Management Comments and Response to the Independent Auditor's Report 	 Page 27 
6. 	 Establish and implement policy and procedures ensuring communication and 

coordination between program offices and finance office on activities with 

financial impact. The policy should also clearly establish the FEC's revenue 

recognition policy. The finance office should design a standard report outlining 

all the necessary information to record the financial activities. The report should 

be prepared and submitted timely at least monthly by the program offices to the 

finance office. 

m C RESPONSE: 

A policy will be developed and distri'buted to program offices for monthly reporting. 

Expected completion: November 30,2005. 

7. 	 Document the policy and basis for the allowance for uncollectible accounts. 

FECRESPONSE: 

Procedures will be developed and included in the Accounting Policy and Procedures 

Manual. Expected completion: November 30,2005. 

,111. 	 General Property and Equipment (Property) (Modified Repeat Finding) (NFR #38, 

#39, #32) 

FEC RESPONSE: 

The FEC agrees with this comment in general, but not its classification as a Material 

Weakness. The FEC made significant strides in the property accounting area in FY 2005. 

Furthermore, the FEC did not have to make any material adjustments to the GL or 

schedulesprovided to CG as a result of the audit. 

Significant improvements from last year's report on intemal controls include: 

A new property system was implemented in September 2005 which 

eliminated difficulty in calculating depreciation which stemmed from 

programming issues with the prior contractor; 

Software-indevelopmentwas tracked and reported quarterly; 

All assets were recorded at invoice values (vs. estimates for some last year); 

and 

Exceptions to intemal control sample items decreased significantly 

As noted to CG, the new properly system facilitates preparation of audit schedules and 

related notes. Moreover, the new system, along with improved policies and procedures to 

be implemented in FY 2006, will: 1) help link individual assets to bulk purchases by PO 

Management Comments and Response to the IndependentAuditor's Report 	 Page 28 
number; 2) help identify new assets that meet the capitalization criteria; and 3) capture 

additional data regarding custody and location of assets. For example, all new computers 

made as part of a bulk purchase were entered in the system with the associated purchase 

order and reports were developed to list individual items. These improvements should 

result in a more seamless integration between the inventory system and the identifying, 

reporting and tracking of capitalized assets to the balances in the general ledger. FEC is 

also continuing to review all inventory items to complete the information coded in the 

system. 

The process of conducting a physical inventory of assets for FY 2005 was contracted out 

to a vendor. The contractor used a bar code scanner for all assets and uploaded the 

information to the property system. The general ledger balance was reconciled to the 

balances in the property system and the reconciliation was provided to CG. The physical 

inventory did not disclose any capitalized assets that needed to be adjusted. In FY 2006 

specific procedures will be written for the contractor and FEC staff to use and assist with 

the reconciliation. 

FEC software capitalization policy is in compliance with SSFAS No. 10. The FEC 

believes the process to identi@ software in progress and completed software in progress 

was adequate and that all such software was identified and recorded correctly. CG has 

not provided specifics as to why it believes FEC is not in compliance with SFFAS No. 

10, which was taken almost verbatim fiom the standard. FEC is continuing to develop 

more formalized methods of notifications for various property events to trigger entries in 

the general ledger. This will include coding training in FY 2006 for affected offices. The 

timeliness of completed construction was more a function of a delay in obtaining 

adequate information from General Services Administration (GSA) than a lack of internal 

notifications. FEC notes these types of tramactions were all recorded accurately well 

before the year end statements were prepared. 

The FEC is only aware of problems with nine receiving reports, not twelve as indicated in 

the report. Most of these were for the lack of descriptions on the receiving report, which 

is not required by FEC. We agree with one noted problem where the approving official 

cited the work authorization number instead of the invoice number on the receiving 

report; however, the invoice was paid correctly. 

Recommendations: 

8. 	 Reconcile the total of the individual property items in the property system to the 

bulk purchase total recorded in the books to ensure canpleteness of the property 

system records. 

FEC RESPONSE: 

The FEC implemented a new property system to accomplish this. For example, all new 

computers made as part of a bulk purchase were entered in the system with the associated 

purchase order and reports were developed to list individual items. The FEC maintains 

Management Comments and Response to the Independent Auditor's Report 	 Page 29 
that for each individual asset of a bulk purchase, the reconciliation of cost between the 

general ledger and the inventory system is not necessary and will not be accurate due to 

fieight andlor installation costs which are not recorded at the individual asset level. The 

damagelloss of an individual asset of a bulk purchase would not materially impact the 

balances in the general ledger. Bulk buys arerecorded in the general ledger at the actual 

total invoice cost. The individual items are tracked in the physical inventory system and 

are inventoried annually. 

9. 	 Document physical inventory procedures, results, and reconciliation and maintain 

the documentation for audit trail purposes. 

FEC RESPONSE: 

Procedures will be developed for the next inventory which is planned for FY 2006. The 

reconciliation will be maintained for audit. 

10. 	 Revise the software capitalization policy to comply with SFFAS No. 10. 

FEC RESPONSE: 

The software capitalization policy is in canpliance with SSFAS No. 10. No specific area 

of non compliance was identified by CG. 

11. 	 Enforce compliance and consistent implementation of policies and procedures 

related to completing receiving reports and the review and approval of obligating 

memos or documents. 

FEC RESPONSE: 

As noted in last year's response and throughout this year's fieldwork, the description on 

the receiving report is an optional, not a required, field. In FY 2006 the form and 

procedures will be rewritten to make this clearer. 

12. 	 Establish a standard process and policy where program offices are required to 

notify the finance office of any property acquisition or disposition with 

accounting impact to ensure proper and timely recording of the transaction. 

FECRESPONSE: 

FEC agrees with this recommendation and has already started to write the policy and 

develop necessary procedures and forms. Expected completion: December 31,2005. 

Management Comments and Response to the Independent Auditor's Report 	 Page 30 
IV. 	
 Information Technology (IT) 

FEC RESPONSE: 

The FEC does not agree that the reportable anditions in the IT area reach the level of a 

material weakness. In conjunction with the Financial Statements Audit of the FEC, four 

areas of Information Technology were examined for material weaknesses. The outcome 

of the audit in IT revealed a number of reportable conditions, none of which, 

individually, rise to the level of material weakness. FEC Management is also of the 

opinion that the collective "weight" of these reportable conditions does not together result 

in a material weakness. The reason for tlis position is that reportable conditions have 

been recognized and corrective actions have been and are being taken. The cost benefits 

test may be used for portions of these conditions, but for the majority the FEC has 

initiated corrective actions, some of which predate the audit. 

FEC Management has also indicated our position on the FEC exemption from the 

Paperwork Reduction Act, which also exetrpts the FEC from many of the related and 

underlying statutes and regulations. We agree that best practices and sound management 

controls justify the use of some of the recanmendations made during the audit in the area 

of IT control (many of which the FEC as implemented already). However, the FEC 

strongly believes that these recommendations, either singularly or collectively, do not rise 

to the level of material weaknesses. In addition, the FEC maintains that the agency 

cannot be held to guidance and criteria identified in studies and analyses as if these were 

standards that are required to be adhered to. 

Finally, the FEC continues to maintain that it is not appropriate to find the existence of 

financial management material weaknesses for systems and applications that do not 

directly impact on the accuracy and security of information used in the FEC financial 

statements. 

A. Entity-Wide Security Program 

Recommendations: 

13. 	 Implement a framework of policies and standards to mitigate risks associated with 

the information resources management. 

FEC RESPONSE: 

As a vital component of the Information Systems Security Program Policy (ISSPP) 58A, 

the FEC developed and approved sub-policy 58-2.1: Risk Management Policy. This 

policy establishes a framework of procedures and standards to mitigate risks associated 

with the management of information resources. The Risk Management Policy states that 

external risk assessments should be performed within the recommended 3 year period; 

however, current budgetary restraints have prevented this. 

Management Comments and Response to the Independent Auditor's Report 	 Page 31 
FEC management completed the Statement of Work (SOW), received proposals from 

three vendors and is currently reviewing the proposals. In addition the FEC has allocated 

$250,000 in FY 2006 (pending no further budgetary constraints) to partially accomplish 

this goal. Until greater resources are allocated, the FEC shall continue to conduct its own 

internal reviews such as those specified in its Security Review Policy. 

14. 	 Complete the documentation, approval and implementation of an entity-wide 

security program plan. 

In November 1997, the FEC established Directive 58, outlining the Commission policy 

on the control of Commission software and the use of agency computers. This Directive 

formed the basis of the Agency's computer security program. This Directive has been 

enhanced and expanded incorporating the latest guidance and best pmctices provided by 

NIST. In December 2001 Directive 58 was updated by establishing an Information 

Systems Security Officer. In April 2004 Information System Security Program Policy 

58A was developed and the final policy was approved by the Chief Information Officer 

in September 2004. The implementation of the FEC entity wide security program plan 

occurred on October 2004, when FEC issued a memo infonning all 

employees/contractors that "Information System Security Program Policy" Policy 

Number: 58A was approved and should be adhered to by all employees/contractors. 

15. 	 Develop and implement security plans for all major applications and MCGSS as 

part of a risk mitigation strategy. 

FEC RESPONSE: 

The FEC has provided the financial auditors with system security plans for all of its 

financial systems and four non-financial systems for a total of seven. The financial 

auditors have been provided with planned target dates for ~ remaining four nonfinancial systems. 

16. 	 Ensure that Resource Classifications inFEC's security plans accurately reflect the 

risk and vulnerabilities of FEC systems. 

The FEC has implemented an entity-wide secwity program plan that specifies that 

external risk assessments should be performed within the recommended 3 year period. 

FEC management has completed the Statement of Work (SOW) has received proposals 

from three vendors and is currently reviewing the proposals. In addition the FEC has 

allocated $250,000.00 in fiscal 2006 (pending no further budgetary constraints) to 

partially accomplish this goal. Until greater resources are allocated, the FEC shall 

continue to utilize the considerable knowledge, skills and experience of the Infonnation 

Technology Division to provide input for resource classifications. 

Page 32 Management Comments and Response to the Independent Auditor's Report 
17. 	 Complete the implementation of the program for the continuous monitoring and 

evaluation of the computer security policy and control effectiveness. 

FEC RESPONSE: 

The FEC has implemented an entity-wide security program plan that specifies the 

establishment of a program for the continuous monitoring and evaluation of the computer 

security policy and control effectiveness. To this end the FEC has developed and 

implemented 58-2.1 1 Security Review Policy that specifies a minimum set of review 

activities such as: annual external penetration testing; disaster recovery testing; a review 

of incident response procedures; a network vulnerability study; a code review of one 

Major Application and a review of access mntrol procedures. FEC has provided the 

auditors with documentation and evidence that the specified activities did occur. 

18. 	 Conduct risk assessments at least every three years as part of an overall strategy to 

mitigate risks associated with its information technology environment. 

FECRESPONSE: 

The FEC has implemented an entity-wide sectnity program plan that specifies that 

external risk assessments should be performed within the recommended 3 year period. 

FEC management completed the Statement of Work (SOW), received proposals from 

three vendors and is currently reviewing the proposals. In addition the FEC has allocated 

$250,000 in FY 2006 (pending no further budgetary constraints) to partially accomplish 

this goal. Until greater resources are allocated, the FEC shall continue to conduct its own 

internal reviews such as those specified in its Security Review Policy. 

19. 	 Certify that the major applications and MCGSS are operating according to FEC's 

security requirements. 

FEC RESPONSE: 

The FEC has implemented an entity-wide security program plan that specifies that the 

certification of its major applications and mission critical general support systems are 

operating according to FEC's security requirements. These certifications will occur upon 

the completion of external risk assessments In lieu of such assessments, FEC has 

leveraged the considerable knowledge, skills and experience of the Information 

Technology Division senior management. 

20. 	 Strengthen FEC's program to document corrective actions and verifj. that 

weaknesses identified have been addressed. Ensure and document that 

recommendations from the most recent network security review have been 

implemented. 

Management Comments and Response to the Independent Auditor's Report 	 Page 33 
FEC RESPONSE: 

The FEC has completed the majority of recommendations from the prioryear's audit. In 

accordance with its risk management strategy, the FEC has assessed the risk associated 

with these deficiencies and has documented, developed and implemented compensating 

controls or has documented and developed multi-fiscal-year mitigation strategies to 

counteract the specified deficiency. These compensating controls andlor multi-fiscalyear mitigation strategies take into account that all associated risk may not be completely 

eliminated during the current audit year, resulting in some residual risk. Any residual 

risk has been accepted by the appropriate system owner. 

B. 	 Controls to Protect Information 

Recommendations: 

21. 	 Create a new GL system application role to give employees with necessary and 

appropriate access rights to fulfill their job responsibility. 

FEC RESPONSE: 

The FEC has recognized the need to further refine the granularity of GL's access control 

matrix and has developed a system application role with appropriate access rights for 

employees to fulfill their job responsibility. The FEC is currently testing the system 

application role to reduce the possibility of disrupting critical bwiness functions. The 

financial auditors have been provided planned target dates for the implementation of the 

system application role. 

22. 	 Monitor and record visitor access to the data center. 

FEC RESPONSE: 

Individuals requiring an escort within the FEC building are always escorted by an 

authorized employee when they enter the FEC computer facilities. The FEC has 

historically used the Kastle Key system to electronically log when someone enters the 

computer facility and will continue to do so. However, ITDhas implemented the use of a 

written log for all escorted persons who enter the facility, even though we believe it is a 

manual redundant system. 

23. 	 Use access request forms to document user access rights and periodically review 

the access for appropriateness. 

Management Comments and Response to the Independent Auditor's Report 	 Page 34 
FEC RESPONSE: 

The FEC has instituted a process that utilizes electronic mail to request, approve and 

document user access rights. Access rights are periodically reviewed in accordance with 

58-2.11 Security Review Policy. 

24. 	 Develop mitigating controls to ensure that GL system passwords are in agreement 

with FEC policy. 

FEC RESPONSE: 

The current version of Peoplesoft does not contain a facility for the automated 

enforcement of passwords. The FEC is aware of this vulnerability and the risk associated 

with this version of PeopleSoft's lack of automated authentication enforcement. The 

FEC has implemented a series of cornpensatis controls consisting of additional user 

awareness training, policy issuance and manual enforcement to mitigate associated risk. 

The FEC understands and accepts the residual risk until an automated solution can be 

found. 

25. 	 Automatically log network activity as required by theAudit Events Standards. 

FEC RESPONSE: 

The Audit Event Standards have been modified, and the FEC in now in compliance with 

these standards. 

26. 	 Institute a process to manually review logs of users using budgetary ovemdes 

where the reviewer is an individual who does not have access to utilize the 

ovemdes. 

FEC RESPONSE: 

Please refer to the Accounting Officer response in NFR-10. 

27. 	 Periodically review the firewall rule set for appropriateness. 

FEC RESPONSE: 

The FEC does periodically review the firewall rules. The rules were reviewed in May 

2005. 
 

28. 	 Periodically review LAN user accounts and disable unnecessary user accounts. 

Management Comments and Response to the Independent Auditor's Report 	 Page 35 
FEC RESPONSE: 

The System Administrators review computer accounts periodically and delete the 

accounts that have not been accessed within 90 days. The user accounts are also reviewed 

and deleted using the "Hiring Report" that is produced by HR. In addition, all user 

accounts that have not been accessed within 90 days will be disabled. 

C. 	 Contingency Plan 

Recommendations: 

29. 	 Perform a Business Impact Analysis to fomally identify and prioritize all critical 

data and operations on FEC's networks and the resources needed to recover them 

if there is a major intemption or disaster. Ensure that emergency processing 

priorities are established to assist in managing disaster situations more effectively 

for the network and include business owners in the discussion to determine how 

much backup data is needed on-hand to minimize the impact of a disaster. 

FEC RESPONSE: 

The BIA is a new requirement, and we do not have funds in the 06 Budget. Funds will be 

requested in the 2007 Budget. 

The plan covers all major Financial Applications and does provide a detailed restoration 

time for the Peoplesoft restoration process. The other major application, Comprizon Buy, 

is a less complicated restoration and has a much shorter relative time frame for 

installation, making a detailed time breakdown unnecessary. 

30. 	 Establish alternative processing site(s) for FEC's operations in the event of a 

disaster and ensure that an operational mechanism exists to update the disclosure 

database in the event that the FEC database is unavailable to replicate the 

disclosure database resident at the offsite location. 

FEC RESPONSE: 

Currently an alternate processing site for operations is not in the budget, and we could not 

afford an alternate site. 

31. 	 Develop a Continuity of Operations Plan (COOP) to support the continuation of 

the FEC's core mission in the event of a disaster that renders the FEC's facilities 

unusable. 

FEC RESPONSE: 

The COOP plan is a new requirement that was raised by the audit this year, and funds 

will be requested in the 2007 budget. 

Management Comments and Response to the Independent Auditor's Report 	 Page 36 
32. 	 Develop and document a comprehensive contingency of operations plan of FEC's 

data centers, networks and telecommunication facilities. 

FEC RESPONSE: 

This has been done. Please see the disaster recovery plan 

D. 	 Software Development and Change Controls 

Recommendation: 

33. 	 Fully implement the System Development Life Cycle Methodology. 

FEC RESPONSE: 

Establishing controls over the modification of application software programs is an 

industry Best Practice and one the FEC agrees with. The FEC has instituted policies, 

procedures and techniques that help make sure all programs and program modifications 

are properly authorized, tested and approved. This has been accomplished through the 

implementation of the SDLC and the associated policies and procedures (for example: the 

Change Management Policy, Requirements Procedure, Release Procedure, Change 

Management Procedure, etc.) The SDLC has been fully implemented; however, we have 

found that there are a couple instances where the SDLC does not match the actual 

practice. For example, changes are documented using ClearQuest (an industry standard 

for managing changes). However, the SDLC mentions documenting changes using a 

Change Implementation Notice. As a result ofthis difference the FEC is in the process of 

making sure the SDLC reflects the actual practice. To reiterate, the FEC does have 

procedures and controls in place to ensure programs and program modifications are 

properly authorized, tested and approved, and the FEC is in the process of making sure 

those procedures and controls are identified properly in the SDLC. 

REPORTABLE CONDITIONS 

V. 	 Financial Reporting (Modified Repeat Finding) 

A. General Ledger (GL) System Setup and Posting Model Definitions (Modified 

Repeat Finding) (NFR #41) 

Recommendation: 

34. 	 Ensure that corrections made to the posting logic comply with the USSGL and 

that the USSGL accounts and posting logic are updated as changes to USSGL are 

issued. 

Management Comments and Response to the Independent Auditor's Report 	 Page 37 
As noted, FEC disagrees with this as a Reportable Condition. However, FEC is in full 

compliance with this in FY 2006. 

C. 	 Integrated Financial Management System (Repeat Finding) (NFR #40) 

FEC RESPONSE: 

While the FEC is pleased that CG has downgra8d this from a material weakness to a 

reportable condition, we still disagree with this classificatim. To be fully integrated, a 

system must use the same information in preparing performance and cost allocation 

reports and in this regard, FECYs systems are fully integrated. Even if one were to adopt 

a more broad definition of integration, the FEC is compliant with OMB and GAO 

standards. CG is fully aware that a budget preparation and MIS system will be fully 

operational and integrated with the financial system as of January 1, 2006. The FEC 

implemented these new systems even though OMB guidance and GAO standards do not 

require agencies to have totally integrated systems. 

Recommendation: 

36. 	 Continue to assess the degree of integration necessary to have a single, unified 

financial system by evaluating the functional requirements and the costs and 

benefits of integrating the financial reporting, property and equipment, receivable, 

and the cost systems with the GL system; 

FEC RESPONSE: 

The FEC continues to perform a cost-benefit analysis to determine whether total 

integration of all budget, procurement, property and financial systems is worth the cost 

for a small federal agency. Based upon the accuracy and reliability of our current 

financial systems, the FEC is comfortable with the risks of the current interfaces we have 

developed between the systems. 

Additionally, the FEC has requested funding in the FY 2006 and FY 2007 budgets to 

fully examine our finance system requirements, with the objectives ranging from a 

system upgrade to a complete system replacement that would be fully integrated with the 

FEC's budget, procurement, inventory, and HR system. The FEC has been meeting with 

US Government agencies that have been selected as Centers of Excellence (COE), as 

well representatives of the Office of Management and Budget to refine our quest for a 

integrated financial management system. 

Management Comments and Response to the Independent Auditor's Report 	 Page 38 
FEC RESPONSE: 

As noted, FEC disagrees with this as a Reportable Condition. However, FEC is in full 

compliance with this in FY 2006. 

C. 	 Integrated Financial Management System (Repeat Finding) (NFR#40) 

FEC RESPONSE: 

While the FEC is pleased that CG has downgraded this from a material weakness to a 

reportable condition, we still disagree with this classificatim. To be fully integrated, a 

system must use the same information in preparing performance and cost allocation 

reports and in this regard, FEC's systems are fully integrated. Even if one were to adopt 

a more broad definition of integration, the FEC is compliant with OMB and GAO 

standards. CG is fully aware that a budget preparation and MIS system will be fully 

operational and integrated with the financial system as of January 1, 2006. The FEC 

implemented these new systems even though OMB guidance and GAO standards do not 

require agencies to have totally integrated systems. 

Recommendation: 

36. 	 Continue to assess the degree of integration necessary to have a single, unified 

financial system by evaluating the functional requirements and the costs and 

benefits of integrating the financial reporting, property and equipment, receivable, 

and the cost systems with the GL system; 

FEC RESPONSE: 

The FEC continues to perform a cost-benefit analysis to determine whether total 

integration of all budget, procurement, property and financial systems is worth the cost 

for a small federal agency. Based upon the accuracy and reliability of our current 

financial systems, the FEC is comfortable with the risks of the current interfaces we have 

developed between the systems. 

Additionally, the FEC has requested funding in the FY 2006 and FY 2007 budgets to 

fully examine our finance system requirements, with the objectives ranging from a 

system upgrade to a complete system replacement that would be fully integrated with the 

FEC's budget, procurement, inventory, and HR system. The FEC has been meeting with 

US Government agencies that have been selected as Centers of Excellence (COE), as 

well representatives of the Office of Management and Budget to refine our quest for a 

integrated financial management system. 

Management Comments and Response to the Independent Auditor's Report 	 Page 39 
VI. 	 Payroll (Modified Repeat Finding) 

FEC RESPONSE: 

The FEC believes it has strong controls in the payroll area, bd as in all areas we believe 

controls can be improved. The FEC improved several important control processes in the 

payroll area in FY 2005. Compliance with requirements to submit leave verification 

reports requested from timekeepers saw improvement in the latter part of the year. 

Recommendations: 

37. 	 Implement procedures to ensure that leave adjustments are completely processed 

and transmitted to the service provider. 

FEC RESPONSE: 

Instructions will be issued in early FY 2006 to ensure staff is clear on this issue. Another 

technician will initial the changes have been made correctly. 

38. 	 Maintain in the personnel files all payloll deduction authorization forms initiated 

through FEC, i.e., not done directly by the employee with a service provider. 

Finance and HR met in May 2005 to coordinate the roles of the respective offices. Most 

of the documents cited as missing by CG were subsequently located. More attention will 

be paid to this in FY 2006, including spot checks by management. 

39. 	 Ensure that timekeepers: perform the monthly reconciliation between leave 

balances reported in its records and the service provider's records; and submit the 

bi-weekly leave balance certification to the finance office timely. 

FEC RESPONSE: 

As noted to CG during the audit, compliance with this requirement increased 

significantly during the latter part of the fiscal year and is continuing in FY 2006. Finance 

management will also have a technician audit one timesheet for completeness per 

timekeeper for each pay period. Results will be documented. 

40. 	 Implement procedures for ensuring all payroll and personnel documents are 

properly completed and authorized before payroll data is transmitted to the 

payroll service provider for processing. 

Management Comments and Response to the Independent Auditor's Report 	 Page 40 
FEC will place more emphasis on this in FY 2006 including sampling of timesheets for 

completeness and accuracy. 

41. Consider automating payroll processing to decrease the risk of errors. 

FEC RESPONSE: 

FEC is studying the merging of time and attendance with the management information 

system. Part of that study wi1.l include whether it is feasible to further automate the 

payroll process. 

OTHER MATTERS 
 

Federal Managers' Financial Integrity Act (31U.S.C. 3512) (FMFIA) 

OMB Circular No. A-123, Management Accountability and Control, provides the reporting 

guidelines for the FMFIA. OMB Circular No. A-123 states that annually, by December 31, the 

head of each executive agency submit to the President and the Congress (i) a statement on 

whether there is reasonable assurance that the agency's controls are achieving their intended 

objectives, (ii) a report on material weaknesses in the agency controls, and (iii) whether the 

agency's financial management systems conform with government-wide requirements. 

OMB Bulletin No. 01-02 requires that the auditor's report on internal control "identify those 

material weaknesses disclosed by the audit that were not reported in the reporting entity's 

FMFIA report." FEC's FMFIA repott dated October 4, 2005 reports that FEC management did 

not identify material weaknesses, but acknowledged the FEC fiscal year 2004 Independent 

Auditor's Report on Internal Control included material weaknesses. FEC disagreed with the 

material weaknesses identified in the internal control report, and therefore, did not prepare a 

report on material weaknesses, including agency plans to correct the material wealcnesses and 

progress against those plans in the FMFIA report submitted. 

FEC RESPONSE: 

We believe that our annual asswance letter satisfies the requirements of A-123 for FY 2005. 

OMB Circular A-123 Management's Accountability and Control states "[tlhe statement on 

reasonable assurance represents the agency head's informed judgment as to the overall adequacy 

and effectiveness of management controls within the agency." Whenmonitoring and evaluating 

internal controls, A-1 23 clearly states that management should independently make the 

determination as to whether any material weaknesses exist. The "auditor's reports" is only one 

of ten possible sources. 

We further believe that our documentation is sufficient under A-123. A-123 states "[algency 

management should determine the appropriate level of documentation needed to support this 

assessment." We are comfortable with our current level of documentation. 

Management Comments and Response to the Independent Auditor's Report Page 41