FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

 

FINAL REPORT 

Audit of the Federal Election Commission’s 

Fiscal Year 2006 Financial Statements 

November 2006 

ASSIGNMENT No. OIG-06-02 
Table of Contents 

Transmittal Memorandum 

Independent Auditor’s Report .....................................................................1 

Independent Auditor’s Report on Compliance and Other Matters............................3 

Independent Auditor’s Report on Internal Control... ..........................................4 
FEDERAL ELECTION COMMISSION 

WASHINGTON, D.C. 20463 

Office of Inspector General 

MEMORANDUM 

TO: The Commission 

FROM: 

SUBJECT: 

DATE: 

Inspector General 

Audit of the Federal Election Commission's Fiscal Year 2006 Financial 

Statements 

November 15,2006 

This letter transmits the final audit report of the Federal Election Commission's (FEC) fiscal year 

(FY) 2006 financial statements. In accordance with the Accountability of Tax Dollars Act of 

2002, the FEC prepared financial statements in accordance with Office of Management and 

Budget (OMB) Circular No. A-136, Financial Reporting Requirements, revised, and subjected 

them to audit. 

The Chief Financial Officers Act of 1990 (Public Law 101-576, commonly referred to as the 

"CFO Act"), as amended, requires the FEC Office of Inspector General (OIG), or an independent 

external auditor as determined by the Inspector General, to audit the agency financial statements. 

Under a contract monitored by the OIG, Clifton Gunderson LLP (CG-LLP), an independent 

certified public accounting firm, performed the audit of the FEC's FY 2006 financial statements. 

The FEC's continued commitment to sound financial management resulted in improvement in 

several areas. Specifically, improvements in information technology resulted in the removal of 

the area as a material weakness; this area is a reportable condition. Further, financial reporting 

and payroll have been removed from the list of reportable conditions in FY 2006. In addition, 

the FEC implemented a new cost allocation process in fiscal year 2006. The Inspector General 

believes the new system will yield Wher improvements in internal controls and reporting of 

FEC program costs in fiscal year 2007 and beyond. 
Audit Process 

CG-LLP conducted the audit in accordance with auditing standards generally accepted in the 

United States of America; the standards applicable to financial audits contained in Government 

Auditing Standards, issued by the Comptroller General of the United States; and OMB Bulletin 

No. 06-03, Audit Requirements for Federal Financial Statements, as amended. The results of the 

financial statement audit are detailed in three reports: opinion on the financial statements; report 

on internal control; and report on compliance with laws and regulations. 

Opinion on the Financial Statements 

The audit included an examination, on a test basis, of evidence supporting the amounts and 

disclosures in the financial statements. The audit also included assessing the accounting 

principles used and significant estimates made by management, as well as evaluating the overall 

principal statements' presentation. 

CG-LLP audited the balance sheets of the Federal Election Commission as of September 30, 

2006 (FY 2006) and 2005 (FY 2005), and the related statements of net cost, changes in net 

position, budgetary resources, financing, and custodial activity for the years then ended. 

In FY 2006 and 2005, CG-LLP was not able to obtain sufficient competent audit evidence to 

support the allocation of program costs reported on the statements of net cost. As a result, CGLLP was not able to apply auditing procedures necessary to conduct the audit in accordance with 

the standards and the OMB guidance mentioned above. Therefore, CG-LLP issued a qualified 

opinion on the statements of net cost. 

Except for the effects of such adjustments, if any, to the FY 2006 and FY 2005 statements of net 

cost referred to in the preceding 'paragraph, as might have been necessary had CG-LLP been able 

to obtain sufficient competent audit evidence and perform adequate audit procedures on the 

allocation of the program costs, the CG-LLP opined the financial statements present fairly, in all 

material respects, the financial position of the FEC as of September 30,2006 and 2005, and its 

net cost, changes in net position, budgetary resources, reconciliation of net cost to budgetary 

obligations, financing and custodial activity for the years then ended in conformity with 

accounting principles generally accepted in the United States of America. 

Report on Internal Control 

CG-LLP's planning and performance of the audit included consideration of the FEC's internal 

control over financial reporting. The CG-LLP auditors obtained an understanding of the FEC's 

internal control; determined whether internal controls had been placed in operation; assessed 

control risk; and performed tests of controls in order to determine auditing procedures for the 

purpose of expressing an opinion on the fmancial statements. The auditors limited their internal 

control testing to those controls necessary to acheve the objectives described in OMB Bulletin 

No. 06-03 and consequently CG-LLP did not provide an opinion on internal control. 
Internal control as it relates to the financial statements, is a process, affected by agency's 

management and other personnel, designed to provide reasonable assurance of the following: 

(1) transactions are properly recorded, processed, and summarized to pennit preparation of the 

financial statements and assets are safeguarded against loss from unauthorized acquisition, use or 

disposition; (2) transactions are executed in accordance with laws governing the use of budget 

authority and other laws and regulations that could have a direct and material effect on the 

financial statements and other laws and regulations identified by OMB; and (3) transactions and 

other data that support reported performance measures are properly recorded, processed, and 

summarized to permit the preparation of performance information in accordance with criteria 

stated by management. 

In performing the testing of internal control necessary to achieve the objectives in OMB Bulletin 

No. 06-03, the auditors identified matters relating to significant deficiencies in the design or 

operation of FEC's internal control. The testing of internal control identified both reportable 

conditions and material weaknesses. The American Institute of Certified Public Accountants 

(AICPA) categorizes reportable conditions as matters coming to the auditor's attention relating 

to significant deficiencies in the design or operation of the internal control that, in the auditor's 

judgment, could adversely affect the agency's ability to record, process, summarize, and report 

financial data consistent with the assertions by management in the financial statements. Material 

weaknesses are reportable conditions in which the design or operation of one or more of the 

internal control components does not reduce to a relatively low level the risk that misstatements 

caused by error or fraud in amounts that would be material in relation to the financial statements 

being audited may occur and not be detected within a timely period by employees in the normal 

course of performing their assigned functions. 

CG-LLP identified material weaknesses in the areas ofi 

Program Cost Allocation 

General Property and Equipment (Property) 

CG-LLP identified reportable conditions, not considered to be material weaknesses, which 

include the following: 

Information Technology (IT) 

Integrated Financial Management System 

Administrative Fines, Civil Penalties and Miscellaneous Receipts 

Controls Over Procurement and Disbursement Transactions 

Audit Follow-up 
Report on Compliance with Laws and Regulations 

FEC management is responsible for complying with laws and regulations applicable to the 

agency. To obtain reasonable assurance about whether FEC's financial statements are fi-ee of 

material misstatements, CG-LLP performed tests of compliance with certain provisions of laws 

and regulations, non-compliance with which could have a direct and material effect on the 

determination of financial statement amounts, and certain laws and regulations specified in OMB 

Bulletin No. 06-03, such as the Anti-Deficiency Act and the Prompt Payment Act. 

The results of CG-LLP's tests of compliance with laws and regulations described in the audit 

report disclosed no instances of noncompliance with the laws and regulations that are required to 

be reported under Government Auditing Standards and OMB Bulletin No. 06-03. 

Audit Follow-up 

The report on internal control contains numerous recommendations to address weaknesses found 

by the auditors. Management was provided a draft copy of the audit report for comment and 

CG-LLP reviewed management's comments. Although CG-LLP stands by the report and the 

weaknesses detailed, the OIG and CG-LLP intend to work with management through the followup and audit process to ensure the weaknesses are addressed satisfactorily. In accordance with 

OMB Circular No. A-50, Audit Followup, revised, the FEC's corrective action plan is to set forth 

the specific action planned to implement the recommendations and the schedule for 

implementation. The Commission has designated the Chief Financial Officer to be the audit 

follow-up official for the annual financial statement audit. 

OIG Evaluation of Clifton Gunderson LLP's Audit Performance 

In connection with the OIG's contract with CG-LLP, the OIG reviewed CG-LLP's reports and 

related documentation and inquired of its representatives. Specifically, we performed the 

following: (1) reviewed CG-LLP's approach and planning of the audit; (2) evaluated the 

qualifications and independence of the auditors; (3) monitored the work of the auditors 

throughout the audit; (4) examined audit documents and audit reports to ensure compliance with 

Government Auditing Standards and OMB Bulletin No. 06-03; and (5) performed other 

procedures we deemed necessary. 

The OIG's review of CG-LLP's work, as differentiated from an audit in accordance with 

Government Auditing Standards issued by the Comptroller General of the United States, was not 

intended to enable the OIG to express an opinion on the FEC's financial statements; provide 

conclusions about the effectiveness of internal control; or reach conclusions on whether FEC's 

management substantially complied with laws and regulations related to the audit. CG-LLP is 

responsible for the opinion and conclusions reached in the attached reports dated November 15, 

2006. The OIG review disclosed no instances where CG-LLP did not comply, in all material 

respects, with Government Auditing Standards. 
If you should have any questions, please contact my office on (202) 694-1015. We appreciate 

the courtesies and cooperation extended to Clifton Gunderson LLP and the OIG staff during the 

conduct of the audit. 

Lynne A. McFarland 

Inspector General 

Attachments 

Cc: Staff Director 

General Counsel 

Acting Chief Financial Officer and Deputy Staff Director for Management 

Information Technology Director 

Accounting Officer 
A1

1 of 30 

t

Centerpark I

4041 Powder Mill Road, Suite 410 

Calverton, Maryland 20705-3106

tel: 301-931-2050 

fax: 301-931-1710 

www.cliftoncpa.com Offices in 15 states and Washington, DC h

Independent Auditor’s Report 

To the Inspector General of the 

 Federal Election Commission 

We have audited the balance sheets of the Federal Election Commission (the FEC) as of 

September 30, 2006 (FY 2006) and 2005 (FY 2005), and the related statements of net cost, 

changes in net position, budgetary resources, financing, and custodial activity for the years then 

ended (hereinafter collectively referred to as the “financial statements”). These financial 

statements are the responsibility of the FEC’s management. Our responsibility is to express an 

opinion on these financial statements based on our audits. 

Except as explained in the following paragraph, we conducted our audit in accordance with 

auditing standards generally accepted in the United States of America; the standards applicable 

to financial audits contained in Government Auditing Standards, issued by the Comptroller 

General of the United States; and Office of Management and Budget (OMB) Bulletin No. 06-03, 

Audit Requirements for Federal Financial Statements. Those standards require that we plan and 

perform the audit to obtain reasonable assurance about whether the financial statements are free 

of material misstatement. An audit includes examining, on a test basis, evidence supporting the 

amounts and disclosures in the financial statements. An audit also includes assessing the 

accounting principles used and significant estimates made by management, as well as evaluating 

the overall financial statements’ presentation. We believe our audits provide a reasonable basis 

for our opinion. 

In FY 2006 and 2005, we were not able to obtain sufficient competent audit evidence to support 

the allocation of program costs reported on the statements of net cost. As a result, we were not 

able to apply auditing procedures necessary to conduct the audit in accordance with the standards 

and the OMB guidance mentioned above. 

In our opinion, except for the effects of such adjustments, if any, to the FY 2006 and FY 2005 

statements of net cost referred to in the preceding paragraph, as might have been necessary had 

we been able to obtain sufficient competent audit evidence and perform adequate audit 

procedures on the allocation of the program costs, the financial statements present fairly, in all 

material respects, the financial position of the FEC as of September 30, 2006 and 2005, and its 

net cost, changes in net position, budgetary resources, reconciliation of net cost to budgetary 
2 of 30 

obligations, financing and custodial activity for the years then ended in conformity with 

accounting principles generally accepted in the United States of America. 

In accordance with Government Auditing Standards, we have also issued our reports dated 

November 7, 2006 on our consideration of the FEC’s internal control over financial reporting, 

and on our tests of the FEC’s compliance with certain provisions of laws and regulations and 

other matters. The purpose of those reports is to describe the scope of our testing of internal 

control over financial reporting and compliance and the results of that testing, and not to provide 

an opinion on the internal control over financial reporting or on compliance. Those reports are 

an integral part of our audit performed in accordance with Government Auditing Standards and 

should be considered in assessing the results of our audit. 

Our audits were made for the purpose of forming an opinion on the basic financial statements 

taken as a whole. The Management Discussion and Analysis, required supplementary 

stewardship information, supplementary information, and other accompanying information 

containing a wide range of data, some of which is not directly related to the financial statements. 

We do not express an opinion on this information. However, we compared this information for 

consistency with the financial statements and discussed the methods of measurement and 

presentation with the FEC officials. Based on this limited work, we found no material 

inconsistencies with the financial statements or no

a1

nconformance with OMB guidance. 

Calverton, Maryland 

November 7, 2006 
a1

Page 3 of 30 

Centerpark I

4041 Powder Mill Road, Suite 410 

Calverton, Maryland 20705-3106

tel: 301-931-2050 

fax: 301-931-1710 

www.cliftoncpa.com Offices in 15 states and Washington, DC h

t

Independent Auditor’s Report on Compliance and Other Matters 

To the Inspector General of the 

 Federal Election Commission 

We have audited the financial statements of the Federal Election Commission (FEC) as of and 

for the year ended September 30, 2006, and have issued our report thereon dated November 

7, 2006. In our report, our opinion was qualified for the effects of adjustments, if any, as might 

have been necessary had we been able to obtain sufficient competent audit evidence and perform 

adequate audit procedures on the allocation of the program costs in the statement of net cost. 

Except as described above, we conducted our audit in accordance with auditing standards 

generally accepted in the United States of America; the standards applicable to financial audits 

contained in Government Auditing Standards, issued by the Comptroller General of the United 

States; and Office of Management and Budget (OMB) Bulletin No. 06-03, Audit Requirements 

for Federal Financial Statements.

The management of FEC is responsible for complying with laws and regulations applicable to 

FEC. As part of obtaining reasonable assurance about whether FEC’s financial statements are 

free of material misstatements, we performed tests of its compliance with certain provisions of 

laws and regulations, noncompliance with which could have a direct and material effect on the 

determination of financial statement amounts, and certain other laws and regulations specified in 

OMB Bulletin No. 06-03. We limited our tests of compliance to these provisions and we did not 

test compliance with all laws and regulations applicable to FEC. 

The results of our tests of compliance disclosed no instances of noncompliance with the laws and 

regulations discussed in the preceding paragraph or other matters that are required to be reported 

under Government Auditing Standards and OMB Bulletin No. 06-03. 

Providing an opinion on compliance with certain provisions of laws and regulations was not an 

objective of our audit, and accordingly, we do not express such an opinion. 

We noted certain immaterial instances of noncompliance that we have reported to management 

of FEC in a separate letter dated November 7, 2006.

This report is intended solely for the information and use of the management of FEC, FEC 

Office of Inspector General, Government Accountability Office, OMB and Congress, and is not 

a1

intended to be and should not be used by anyone other than these specified parties. 

Calverton, Maryland 

November 7, 2006 
A1

Page 4 of 30 

t

Centerpark I

4041 Powder Mill Road, Suite 410 

Calverton, Maryland 20705-3106

tel: 301-931-2050 

fax: 301-931-1710 

www.cliftoncpa.com Offices in 15 states and Washington, DC h

Independent Auditor’s Report on Internal Control 

To the Inspector General of the 

 Federal Election Commission 

We have audited the financial statements of the Federal Election Commission (the FEC) as of 

and for the year ended September 30, 2006, and have issued our report dated November 7, 2006. 

In our report, our opinion was qualified for the effects of adjustments, if any, as might have been 

necessary had we been able to obtain sufficient competent audit evidence and perform adequate 

audit procedures on the allocation of the program costs in the statement of net cost. Except as 

described above, we conducted our audit in accordance with auditing standards generally 

accepted in the United States of America; the standards applicable to financial audits contained 

in Government Auditing Standards, issued by the Comptroller General of the United States; and 

Office of Management and Budget (OMB) Bulletin No. 06-03, Audit Requirements for Federal 

Financial Statements.

In planning and performing our audit, we considered the FEC’s internal control over financial 

reporting by obtaining an understanding of the FEC’s internal control; determining whether 

internal controls had been placed in operation; assessing control risk; and performing tests of 

controls in order to determine our auditing procedures for the purpose of expressing our opinion 

on the financial statements. We limited our internal control testing to those controls necessary to 

achieve the objectives described in OMB Bulletin No. 06-03. We did not test all internal 

controls relevant to operating objectives as broadly defined by the Federal Managers’ Financial 

Integrity Act (FMFIA) (31 U.S.C. 3512), such as those controls relevant to ensuring efficient 

operations. The objective of our audit was not to provide assurance on internal control. 

Consequently, we do not provide an opinion on internal control. 

Our consideration of the internal control over financial reporting would not necessarily disclose 

all matters in the internal control over financial reporting that might be reportable conditions. 

Under standards issued by the American Institute of Certified Public Accountants, reportable 

conditions are matters coming to our attention relating to significant deficiencies in the design or 

operation of the internal control that, in our judgment, could adversely affect the agency’s ability 

to record, process, summarize, and report financial data consistent with the assertions by 

management in the financial statements. Material weaknesses are reportable conditions in which 

the design or operation of one or more of the internal control components does not reduce to a 

relatively low level the risk that misstatements caused by error or fraud in amounts that would be 
Page 5 of 30

material in relation to the financial statements being audited may occur and not be detected 

within a timely period by employees in the normal course of performing their assigned functions. 

Because of inherent limitations in internal controls, misstatements, losses, or noncompliance may 

nevertheless occur and not be detected. However, we noted certain matters discussed in the 

following paragraphs involving the internal control and its operation that we consider to be 

material weaknesses and reportable conditions. 

Finally, with respect to internal control related to performance measures reported in the FEC’s 

Performance and Accountability Report as of September 30, 2006, we obtained an understanding 

of the design of significant internal controls relating to the existence and completeness 

assertions, as required by OMB Bulletin No. 06-03. Our procedures were not designed to 

provide assurance on internal control over reported performance measures, and, accordingly, we 

do not provide an opinion on such controls. 

******************************** 

MATERIAL WEAKNESSES

I. Program Cost Allocation (Modified Repeat Finding) 

The FEC has made significant progress in the area of cost accounting. In the last half of 

FY 2006, the FEC implemented a new cost accounting system called the Time Reporting 

System (TRS). The TRS automates and standardizes the cost accumulation and the 

allocation of program costs. Training on the new cost system was conducted, and a 

memorandum from the Chief Financial Officer was issued to ensure that employees 

understand and know the importance of and how to use the new system. Also, towards 

the end of the fiscal year, the FEC has identified its responsibility segments and the need 

for re-alignment of its organizational structure for performance costing, has identified the 

outputs of its responsibility segments and is in the process of revising its cost accounting 

policies and procedures. 

The FEC program costs are driven by hours charged by each employee to activity codes 

that roll up to the specific FEC programs. The results of our tests disclosed that 

completeness, timeliness and discrepancies between the source data and the system data 

are the key deficiencies identified in the new cost system. As a result, we were not able 

to obtain reasonable assurance on the costs reported for each program on the statement of 

net cost. We understand that the FEC is still in the process of fine tuning its processes 

and controls to ensure that data input into the system are complete, timely, and are 

supported by an audit trail that agrees with the source data coming from the employees. 

Other system deficiencies and exceptions noted, which may or may not have been 

corrected during the audit process are as follows: 

• The new cost system password settings do not follow the FEC’s password standards. 

The account lockout threshold is set at seven invalid attempts instead of five invalid 

attempts. 
Page 6 of 30

• The FEC does not have a formal process for ensuring that hours are entered in the 

system timely and correctly, that is, to the correct activity codes that will correspond 

to the correct program codes. Further, a review process is not implemented 

Commission-wide. 

• The cost allocation percentages used in preparing the initial statement of net costs 

were incorrect because the FEC did not follow the reallocation process outlined in the 

system conceptual design document. Specifically, hours which should have been 

reallocated to the division only were reallocated Commission-wide. 

• The system default allocation for the Information Division improperly allocated hours 

to the Compliance program when the hours should have been allocated to the Public 

Financing program. 

Recommendations: 

1. Revise the account lockout threshold in TRS to five invalid attempts. 

2. Establish written policies and procedures to ensure that employees enter their time in 

the cost system timely and properly and the results are supported by source data 

which is reviewed and approved by management. 

3. Ensure correct and consistent application of the cost allocation process in accordance 

with the cost system user manual and conceptual design document. 

4. Ensure errors in TRS causing the system to allocate hours for the Information 

Division to the wrong program are resolved. 

Management Response

Overall, the FEC agrees with this finding. Management will change the lockout threshold 

in TRS to five invalid attempts (#1 above). The FEC will also strengthen written policies 

and procedures, including management approval to ensure data is entered correctly in 

TRS (#2). Guidance will also be issued to ensure operators understand the sequence of 

steps necessary to perform the allocations correctly (#3). Further, the FEC will consider 

building controls into the software to prevent errors in performing the steps. If cost 

effective, the FEC will implement the changes in FY 2007. The errors in TRS related to 

the allocation of errors for the Information Division were corrected prior to the 

conclusion of the audit (#4). 

The audit finding acknowledges considerable progress in the area of cost accounting in 

FY 2006. However, the FEC is disappointed that CG did not raise issues with the source 

data until late in the audit. If the issues had been raised earlier, steps would have been 

taken to correct the data. 
Page 7 of 30

Auditor’s Response 

The FEC delayed full implementation of the new cost allocation process until the fourth 

quarter of 2006. As a result, the auditors and management came to an understanding that 

the substantive testing would be performed at year end, when the program costs are 

reported on the statement of net cost using the new cost system, rather than testing at 

interim (ending June 2006). The auditors believe concerns regarding the cost allocation 

process were promptly communicated to management once weaknesses were discovered. 

II. General Property and Equipment (Property) (Modified Repeat Finding) 

As noted in the prior year, the FEC’s accounting for property involves a time-consuming 

effort that increases the risk of errors due to the FEC’s process of expensing its property 

at the time of acquisition and preparing a journal voucher to reclassify the expense to an 

asset account for reporting purposes. 

Our audit disclosed deficiencies, errors or omissions that question the effectiveness of the 

FEC’s internal control on property. The weaknesses identified below collectively 

resulted in a material weakness in the FEC’s general property and equipment. 

• Management’s periodic property reconciliation process and review of related 

subsidiary schedules and journal vouchers did not uncover errors during the year. 

These errors were uncovered during the audit process. Specifically, the errors 

included duplicate entries to record first quarter additions to leasehold improvements 

and adjustments needed to accrue costs. 

• Additionally, journal entries to transfer property amounts from the expense to asset 

accounts were posted to the wrong United States Standard General Ledger (USSGL) 

account. The posting errors were detected during the interim testing phase of the 

audit process. The posting errors continued into the fourth quarter of the fiscal year 

(FY) and were again detected as part of the audit process. Journal entries to correct 

the aforementioned errors were posted to the general ledger more than once or were 

done incorrectly. 

• Although the number of the FEC’s capitalized assets reported in the financial 

statements is not many, most of these assets are bulk purchases comprised of many 

individual items which are individually entered into the property system for 

accountability purposes. The information contained in the property system is not 

always complete. We found that some items in the property system did not have the 

bar code identification, serial number and location of the asset. 

• Although we were informed a physical inventory of capitalized assets had been 

performed, the FEC did not provide: the instructions used to complete the annual 

inventory of assets; complete results; and reconciliation of the physical inventory to 

the property system and the general ledger balance. 

• The FEC has not established a standard process, mechanism or policy to ensure that 

program offices notify the Finance Office of the acquisition or disposition of property 

assets to ensure that the accounting impact of the transaction is recorded timely and 

properly. 
Page 8 of 30

• Management’s monthly analysis of financial activities did not show an analysis of 

property. 

Recommendations: 

5. Improve analytical and quality control review of subsidiary schedules, journal 

vouchers and property reconciliation to ensure material errors and differences are 

identified and resolved timely. 

 

6. Use correct USSGL accounts. 

7. Develop a mechanism for reconciling individual property items in the property 

system to the bulk purchases recorded in the general ledger to ensure completeness of 

the property system records. Also, ensure that the property management system has 

complete information, such as bar code identification, serial number and location of 

the asset. 

8. Clearly document physical inventory procedures, results of the physical inventory, 

and the reconciliation performed. Maintain the documentation for audit trail and 

management review purposes. 

9. Establish a standard process, mechanism or policy to ensure program offices notify 

the Finance Office of the acquisition and disposition of property assets. 

10. Perform a monthly analysis of property as part of the monthly analysis of financial 

activities. 

Management Response 

The FEC agrees with findings and recommendations but not its classification as a 

Material Weakness. In FY 2007, the FEC will make an effort to review spreadsheets (#1 

above) and journals (#2) more thoroughly to catch errors. The FEC will update its 

internal directive on property for the custodians to prescribe forms to assist with the 

reconciling of detailed records to the property system (#3), taking of physical inventory 

(#4) and the acquisition and disposal of assets (#5). Also, management will consider 

adding property reports to the monthly analysis prepared by the Accounting Officer (#6). 

Auditor’s Response 

We have carefully reviewed the FEC management response, however we have not 

changed our conclusion that the general property and equipment weaknesses evaluated 

collectively is a material weakness. 
Page 9 of 30

REPORTABLE CONDITIONS

III. Information Technology (IT) 

A. Entity-Wide Security Program 

The Government Accountability Office (GAO) reported in July 2005 that the 

underlying cause for information security weaknesses is that agencies have not yet 

fully implemented entity-wide information security programs. An entity-wide 

security program provides a framework and continuing cycle of activity for managing 

risk, developing security policies, assigning responsibilities, and monitoring the 

adequacy of the entity’s computer-related controls. Without a well-designed 

program, security controls may be inadequate; responsibilities may be unclear, 

misunderstood, and improperly implemented; and controls may be inconsistently 

applied. Such conditions may lead to insufficient protection of sensitive or critical 

resources and disproportionately high expenditures for controls over low-risk 

resources. (U.S. Government Accountability Office, Weaknesses Persist at Federal 

Agencies Despite Progress Made in Implementing Related Statutory Requirements, 

GAO-05-552 [Washington, D.C. July 2005]). 

Improvement is needed in the FEC’s enterprise-wide security management program 

as indicated in the prior year audit. During our FY 2006 review of the FEC's existing 

security program, we noted that the FEC made the following progress: 

• The FEC’s management solicited bids for risk assessments. The risk assessment 

and business impact analysis are key components in the development of security 

plans and disaster recovery plans. In FY 2006, the FEC’s management 

determined that it did not have the funds available to conduct risk assessments or 

a business impact analysis. The FEC’s management is currently allocating funds 

in its FY 2007 budget to complete these tasks. 

• The FEC’s management revised its Security Review Policy. The revised policy 

calls on management to perform annual external penetration tests, disaster 

recovery tests, incidence response tests, network vulnerability studies and a 

review of access control procedures. Additionally, the FEC performed a review 

of its firewall rule-set to identify and modify/delete obsolete rules. 

Our review of the FEC's existing security program revealed continuing weaknesses in 

controls that expose the FEC's significant financial management systems and data to 

unauthorized access and/or modification. Weaknesses included the following: 

• The FEC has not completed the documentation, approval and implementation of 

its entity-wide security program plan. (Repeat Finding)

• The FEC has not fully implemented its framework of policies and standards to 

mitigate risks associated with the management of its information resources. 

Although the FEC has implemented the majority of its information security 

policies, it has not fully implemented all of the related policies and standards. 
Page 10 of 30

The FEC has not finalized and implemented an information classification policy 

or its certification and accreditation policy. Management is currently not ready to 

implement these policies and is in the process of reviewing and revising them. 

(Repeat Finding) 

• Risk assessments, as part of the FEC’s overall strategy to mitigate risks associated 

with its information technology environment, have not been conducted for more 

than three years. Therefore, resource classifications in the FEC’s completed 

security plans are not based on risk assessments. The FEC informed us that it is 

currently waiting for the availability of funds to complete a risk assessment. 

(Repeat Finding)

• The FEC has created security plans for all of its major applications and mission 

critical general support systems. However, the security plans are not viable 

because they are not based on an assessment of the risks to the FEC’s systems. 

Accordingly, these major applications and mission critical general support 

systems have not been certified and accredited to ensure that they are operating 

according to the FEC’s security requirements. (Modified Repeat Finding)

• There are weaknesses in the FEC’s program for the continuous monitoring and 

evaluation of the computer security policy and control effectiveness. The FEC 

has implemented its security review policy and performed all of the review steps 

outlined in the policy. However, a key part of a continuous monitoring program 

is a process for documenting and monitoring the status of corrective actions. 

Although the FEC has a corrective action plan for the CFO audit, the corrective 

action plan is not being applied to all reviews of security controls. (Modified 

Repeat Finding)

• The FEC needs to strengthen its process of documenting corrective actions. A 

corrective action plan should identify the task to be completed in addition to 

identifying the resources required to accomplish the elements of the plan, any 

milestones in meeting the tasks, and scheduled completion dates for the 

milestones. The FEC’s corrective action plans identify the issue that needs to be 

addressed, but does not always include the persons assigned to the task, estimated 

completion dates, and steps or milestones necessary to complete the task. 

(Modified Repeat Finding)

Recommendations: 

11. Complete the documentation, approval and implementation of an entity-wide 

security program plan. 

Management Response 

In November 1997, the FEC established Directive 58, outlining the Commission 

policy on the control of commission software, and the use of agency computers. This 

directive formed the basis of the agency’s computer security program. This directive 

has been enhanced and expanded incorporating the latest guidance and best 

practices provided by NIST in detail, and issued in policy 58A. The updating of 

Directive 58 was initiated in December 2001 with the establishment of an agency 
Page 11 of 30

Information Systems Security Officer. This was followed with the establishment of an 

interim Information System Security Program Policy 58A dated April 2004. This 

interim policy became final in September 2004 as approved by the agency’s Chief 

Information Officer (CIO). The implementation of the FEC entity wide security 

program plan occurred on October 2004, when the FEC issued a memo informing all 

employees/contractors that “Information System Security Program Policy” Policy 

Number: 58A was approved and should be adhered to by all employees/contractors. 

12. Finalize and implement the FEC’s information classification policy and 

certification and accreditation policy along with any accompanying standards. 

Management Response 

The FEC reserves the right to review, rescind, and modify any existing and/or 

proposed policy within its IT security program policy. The Information Classification 

and Certification and Accreditation policies were rescinded from the implementation 

process to study their suitability and feasibility within the FEC information 

technology environment. In addition, both policies are heavily dependent upon the 

completion of a third party risk assessment prior to implementation. In absence of 

these assessments a management decision was made to rescind these policies until 

such time as to their successful implementation can be reasonably assured. 

13. Perform risk assessments, as part of the FEC’s overall strategy to mitigate risks 

associated with its information technology environment. 

Management Response 

As a vital component of the Information Systems Security Program Policy (ISSPP) 

58A, the FEC has developed and approved sub-policy 58-2.1: Risk Management 

policy. This policy establishes a framework of procedures and standards to mitigate 

risks associated with the management of information resources. 58-2.1 Risk 

Management Policy states that external risk assessments should be performed within 

the recommended 3 year period; however, current budgetary restraints have 

prevented this. 

The FEC management has completed the Statement of Work (SOW) and the FEC 

management has received proposals from three vendors and is currently reviewing 

the proposals. In addition, the FEC has allocated funds in fiscal 2007 (pending no 

further budgetary constraints) to partially accomplish this goal. Until greater 

resources are allocated toward this project, the FEC shall continue to conduct its 

own internal reviews such as those specified in its Security Review Policy. 

14. Incorporate the results of the risk assessments into the FEC’s security plans. 

15. Classify information resources in accordance with the risk assessments. 
Page 12 of 30

Management Response 

The FEC has created security plans, which document the security safeguards for its 

major applications and general support system. As stated in previous responses the 

FEC was unable to conduct third-party risk assessments due to budgetary restraints, 

however in the absence of such assessments the Commission has leveraged the 

considerable knowledge, skills, and experience of the Information Technology 

Division senior management to create security plans based upon appropriate levels 

of risk 

16. Utilize corrective action plans for all reviews of security controls whether 

performed internally or by a third-party. 

17. Ensure that corrective action plans identify the task to be completed in addition to 

identifying the resources required to accomplish the elements of the plan, any 

milestones in meeting the tasks, and scheduled completion dates for the 

milestones. 

Management Response 

The FEC has instituted a comprehensive process for the continuous monitoring and 

evaluation of the computer security policy and control effectiveness that it believes is 

sufficient for an effective review and appraisal of its policy and procedures. 

However, in an effort to enhance the financial auditors understanding of the FEC 

Information Technology Division’s internal work processes, the FEC will review and 

consider a revised format. 

18. Certify and accredit all major applications and mission critical general support 

systems. 

Management Response 

Same response as in recommendations 14 and 15. 

B. Contingency Plan 

Losing the capability to process and protect information maintained on the FEC’s 

computer systems can significantly impact the FEC’s ability to accomplish its 

mission to serve the public. The purpose of service continuity controls is to ensure 

that, when unexpected events occur, critical operations continue without interruption 

or critical operations are promptly resumed. 

To achieve this objective, the FEC should have procedures in place to protect 

information resources and minimize the risk of unplanned interruptions and a plan to 

recover critical operations should interruptions occur. These plans should consider 

activities performed at the FEC’s general support facilities (e.g. the FEC’s local area 
Page 13 of 30

network, wide area network, and telecommunications facilities), as well as the 

activities performed by users of specific applications. To determine whether the 

disaster recovery plans will work as intended, the FEC should establish and 

periodically test the capability to perform its functions in disaster simulation 

exercises. 

Our review of the service continuity controls identified deficiencies that could affect 

the FEC’s ability to respond to a disruption in business operations as a result of a 

disaster or other long-term emergency. The deficiencies were as follows: 

• The FEC has not performed a Business Impact Analysis (BIA) to formally 

identify and prioritize all critical data and operations on its networks and the 

resources needed to recover them if there is a major interruption or disaster. In 

addition, we could not determine whether the FEC had established emergency 

processing priorities that will help manage disaster situations more effectively for 

the network. The FEC also has not included business owners in the discussion to 

determine how much backup data is needed on-hand to minimize the impact of a 

disaster. The FEC is currently waiting for the budgetary funds to complete a BIA. 

(Repeat Finding)

• The FEC has not established an alternate processing site for its operations in the 

event of a disaster, including its general ledger system. Additionally, the FEC’s 

disclosure database is replicated at an off-site location as a web-enabled read-only 

database the public can access. In the event that data cannot be updated at the 

FEC and then replicated to the off-site location, there is no operational 

mechanism to update the disclosure database at the off-site location. The FEC has 

developed a cost analysis of establishing an alternate site and is currently pursuing 

interagency agreements to address this issue. (Repeat Finding)

• The FEC has not developed and documented a comprehensive contingency plan 

of its data centers, networks and telecommunication facilities. The plan does not 

include steps for recovering all of the FEC’s major applications and mission 

critical general support systems. Additionally, the comprehensive contingency 

plan does not prioritize resources or set a timeframe for recovery. However, the 

FEC has updated the disaster recovery plan to include both a power failure 

scenario and a data center air-condition failure scenario. (Repeat Finding)

• The FEC has not developed a Continuity of Operations Plan (COOP) to support 

the continuation of its core mission in the event of a disaster that renders the 

FEC’s facilities unusable. (Repeat Finding)

Recommendations: 

19. Perform a BIA to formally identify and prioritize all critical data and operations 

on the FEC’s networks and the resources needed to recover them if there is a 

major interruption or disaster. 
Page 14 of 30

Management Response 

The FEC agrees that a formal business impact analysis would be useful and it is 

currently awaiting funds to complete the project. In lieu of a formal BIA the FEC has 

leveraged its own internal expertise to identify and prioritize its critical data and 

operations on the FEC’s networks and the resources needed to recover them if there 

is a major interruption or disaster. 

20. Ensure that emergency processing priorities are established to assist in managing 

disaster situations more effectively for the network and include business owners 

in the discussion to determine how much backup data is needed on-hand to 

minimize the impact of a disaster. 

Management Response 

The FEC has developed emergency processing priorities. These emergency process 

priorities have been outlined in the FEC’s Disaster Recovery Plan. 

21. Establish an alternative processing site for the FEC’s operations in the event of a 

disaster and ensure that an operational mechanism exists to update the disclosure 

database in the event that the FEC’s database is unavailable to replicate the 

disclosure database resident at the off-site location. 

Management Response 

The FEC believes that the cost to establish an alternative processing site would be 

cost prohibitive and would not be cost effective. Therefore, an alternative processing 

site is not part of the FEC budget request.

22. Develop and document a comprehensive COOP of the FEC’s data centers, 

networks, and telecommunication facilities. 

23. Develop a COOP to support the continuation of the FEC’s core mission in the 

event of a disaster that renders the FEC’s facilities unusable. 

Management Response 

The FEC agrees that a Continuity of Operations Plan would be useful and it is 

currently awaiting funds to complete the project. 

C. Controls to Protect Information 

For a computerized organization like the FEC, achieving an adequate level of 

information protection is highly dependent upon maintaining consistently effective 

access controls and system software controls. Access controls limit and monitor 

access to computer resources (i.e., data files, application programs, and computerrelated facilities and equipment) to the extent necessary to provide reasonable 
Page 15 of 30

assurance that these resources are protected against waste, loss, unauthorized 

modification, disclosure, or misappropriation. Access controls include logical 

controls, such as security software programs designed to prevent or detect 

unauthorized access to sensitive files. Similarly, system software controls limit and 

monitor access to powerful programs and sensitive files that control computer 

processing and secure the application and data supported by the system. 

Our limited testing of internal controls identified weaknesses related to the 

information protection in the FEC’s information systems environment. Impacted 

areas included the local area and wide area networks as well as its midrange computer 

systems (e.g. servers). These vulnerabilities expose the FEC and its computer 

systems to risks of external and internal intrusion, and subject sensitive information 

related to its major applications to potential unauthorized access, modification, and/or 

disclosure. 

Current weaknesses in access controls include the following: 

• The FEC is not actively monitoring the use of budgetary overrides in the general 

ledger (GL) application. The FEC is currently finalizing a process where the 

chief financial officer will review the use of overrides on a monthly basis and 

initial the override log to show that overrides have been reviewed. (Repeat 

Finding)

• The PeopleSoft application does not have the built in functionality to enforce the 

FEC’s password policy. Additionally, the mitigating controls implemented by the 

FEC do not address the following weaknesses: (Modified Repeat Finding)

o PeopleSoft does not have an account lockout policy.

o PeopleSoft does not prevent users from using previous passwords. 

o PeopleSoft does not have the ability to enforce strong password requirements. 

• Oracle audit trails were not maintained on the FEC’s servers. The FEC maintains 

audit trails at the application level, but not the database level because of the 

potential impact to production. However, we have not been provided any 

documentation to show that the FEC has conducted a test to determine what the 

impact on processing would be. 

• The FEC’s procedure for granting access to its networks, systems, and physical 

facility through access authorization e-mails needs improvement. Additionally, 

the FEC’s procedure for reviewing and recertifying user access rights needs 

improvement. We noted the following weaknesses in the access reauthorization 

process, in addition to weaknesses in the access authorization e-mails used to 

document and grant access rights and privileges: (Modified Repeat Finding)

o Seven out of 30 individuals reviewed did not have e-mails to document their 

network access. 

o Seven out of 30 individuals have network access rights that did not match 

their access requests. 
Page 16 of 30

o Thirteen of 30 individuals’ network access e-mails did not identify the 

network groupings that the user should have access to. 

o Four dial-in users did not have access documentation on file and were not on 

the list of users with laptops. 

o Two VPN users were not on the list of users with laptops. Additionally, these 

two users are employees of the FEC that should have the FEC’s laptops. 

o All 17 of the dial-in users did not have their access periodically recertified. 

o One separated employee still had a dial-in account.

o Data center access documentation was not available for 19 users. 

Additionally, there was no evidence that data center access was periodically 

recertified. 

o Access documentation was not maintained for system administrators and 

database administrators. The FEC’s current policy is to grant employees 

access based on their positions. According to the FEC, only employees hired 

to perform administrative functions are granted administrative access. 

However, “best practices” state that access forms should be maintained. 

o There were 21 individuals with access to the data center that did not have a 

justifiable need (based on job functionality) to have data center access. 

Recommendations: 

24. Finalize and implement the FEC’s process to manually review logs of users using 

budgetary overrides where the reviewer is an individual who does not have access 

to utilize the overrides. 

Management Response 

Budget overrides are rarely used by the FEC. They are only used when transactions 

cannot be processed any other way. In most cases budget errors result in funds being 

moved from another object class. This eliminates the error rather than overrides the 

control. Effective with the August reports, the CFO began signing off on a control 

report that lists all budget overrides used. The Accounting Officer and Budget Officer 

run reports independently for the CFO to approve. The FEC agrees this is an 

important safeguard. No budgets have been exceeded without management approval. 

25. Develop mitigating controls to ensure that PeopleSoft passwords are in agreement 

with the FEC’s policy or ensure that when PeopleSoft processing is outsourced, 

the third-party maintains password controls that comply with the FEC’s password 

policies. 

Management Response 

The current version of PeopleSoft does not contain any mechanisms for the 

automated enforcement of passwords. The FEC is aware of this vulnerability and the 

risk associated with this version of PeopleSoft’s lack of automated authentication 

enforcement. The FEC has implemented a series of compensating controls consisting 
Page 17 of 30

of additional user awareness training, policy issuance, and manual enforcement to 

mitigate associated risk. The FEC understands and accepts the residual risk until an 

automated solution can be found. In addition, the FEC plans to ensure that 

automated password enforcement is either native or a third-party maintains password 

controls that comply with the FEC’s password policy when PeopleSoft Processing is 

outsourced. 

26. Use access request forms that identify the user’s access level to document user 

access rights to all the FEC’s systems. Additionally, the FEC should periodically 

review the appropriateness of access granted and recertify user access rights. 

Management Response 

The FEC utilizes either an email from management or the new hire report from 

Human Resources as user access request forms. In addition, the FEC periodically 

revalidates all network access for appropriateness as dictated by 58-2.11 Security 

Review Policy 

27. Investigate to determine a baseline level of auditing that can be performed without 

causing a detrimental impact to the performance of the Oracle databases and the 

applications that they support. 

Management Response

In the normal course of business, performance indicators are monitored to ensure 

application stability. This constant monitoring provided the FEC with the 

information needed to determine that the enabling of Oracle audit trails would prove 

an unnecessary hindrance to system performance. The FEC recognizes the risk 

associated with not enabling Oracle audit trails and has initiated audit trails at the 

application level and limited database access to a select number of persons as two 

compensating controls. The FEC understands and accepts any residual risk left from 

this process. 

28. Periodically review data center access and remove unnecessary access rights. 

Management Response

Although the FEC maintains an accurate list of those persons requiring access to its 

Datacenter the requirement for maintaining supporting documentation is a recent 

one. The FEC is currently evaluating the necessity of adding the Datacenter access 

list to its 58-2.11 Security Review Policy to ensure that periodic recertification will 

occur. 

D. Software Development and Change Controls 

Establishing controls over the modification of application software programs helps to 

ensure that only authorized programs and authorized modifications are implemented. 
Page 18 of 30

This is accomplished by instituting policies, procedures, and techniques that help 

make sure all programs and program modifications are properly authorized, tested, 

and approved, and that access to and distribution of programs is carefully controlled. 

Without proper controls, there is a risk that security features could be inadvertently or 

deliberately omitted or "turned off" or that processing irregularities or malicious code 

could be introduced. 

Our review of the software development and change controls identified deficiencies 

that could affect the FEC’s ability to ensure that only authorized programs and 

authorized modifications are implemented. The deficiencies were as follows: 

• The FEC has not implemented a formal process for identifying, documenting, 

testing and installing security patches and updates to its Oracle, UNIX and 

Windows environments. 

• The FEC does not maintain documentation evidencing that Oracle and Solaris 

patches are tested and approved before being installed into production. 

• The PeopleSoft application is currently supported by an Oracle 8 database that is 

no longer supported by the vendor. 

Recommendations: 

29. Implement formal policies and procedures for managing system software changes. 

30. Maintain documentation to support the testing and approval of system software 

changes. 

Management Response

The FEC has developed and implemented a comprehensive set of policies and 

procedures for managing system changes. These include 58-2.3 Change 

Management Policy and the FEC Change Management Standard. In addition, based 

upon early feedback from the financial auditors the FEC instituted the FEC Patch 

Management Standard on 10/04/06. 

31. Complete the migration of financial processing to a third-party service provider 

and verify that the service provider is utilizing vendor supported system software 

versions. 

Management Response

Due to legacy issues associated with some of the FEC applications the current 

version of Oracle 8 is required. Although the vendor no longer provides patches for 

this version of Oracle it does provide limited support, which includes assisting 

customers with work-arounds to issues that may arise. In addition, the FEC has built 

a considerable amount of experience and internal expertise over the years that this 

product has been in its inventory. 
Page 19 of 30

The FEC recognizes the risk associated with maintaining a product with limited 

support. Accordingly, the FEC is relying upon its considerable internal expertise, 

restricted access to only a few persons and Oracle’s limited support as compensating 

factors until the migration of financial processing to a third-party service provider is 

implemented. The FEC understands and accepts any residual risk left from this 

situation. Additionally, the FEC plans to verify that any third party service provider 

has adequate support during the migration of its financial processing. 

IV. Integrated Financial Management System (Repeat Finding)

The FEC does not have an integrated financial management system. Significant financial 

management systems, such as the cost system, accounts receivable system and the 

property and equipment system do not interface with the general ledger system. 

A single, integrated financial management system is a unified set of financial systems 

linked together electronically in an efficient and effective manner to provide agency-wide 

financial system support. Integration means that the user is able to have one view into 

systems such that, at whatever level the individual is using the system, he or she can 

obtain necessary information efficiently and effectively through electronic means. It does 

not necessarily mean having only one software application covering all financial 

management system needs within an agency. Interfaces are acceptable as long as the 

supporting details are maintained and accessible to managers. Interface linkages must be 

electronic unless the number of transactions is so small that it is not cost beneficial to 

automate the interface. Easy reconciliation between systems, where interface linkage is 

appropriate, must be maintained to ensure data accuracy. 

Recommendation: 

32. Evaluate the extent of systems integration needed for existing systems when 

considering the outsourcing of the FEC’s accounting services to a shared service 

provider. 

Management Response

The FEC agrees with this finding and recommendation. The FEC is actively pursuing 

securing the services of a financial line of business provider in FY 2007 or early FY 

2008. 

V. Administrative Fines, Civil Penalties and Miscellaneous Receipts (Modified Repeat 

Finding) 

The program offices serve as the primary source of information related to accounts 

receivable transactions which should be recorded in the general ledger by the Finance 

Office. Accounting events requiring recordation in the general ledger include assessment 

of administrative fines and civil penalties, determination of an uncollectible debt and 

payment by a respondent. On a monthly basis, civil penalty and administrative fine 
Page 20 of 30

activities are initially reported to the Finance Office by the program offices in a memo. 

These memos are used by the Finance Office to update the accounts receivable subsidiary 

schedule that serves as the basis for accounts receivable transactions recorded in the 

general ledger. The information submitted by the program offices is augmented by more 

detailed information obtained from the FEC website and collection reports prepared by 

the Finance Office. The schedules are reconciled to the program offices’ records and 

submitted to management for review and approval. 

Our audit found the aforementioned reconciliation and management review were 

ineffective in detecting: mathematical or classification errors; and accounts receivable 

balances recorded for the wrong amount. 

Further, the methodology used to determine allowance for doubtful accounts is not 

formally documented or fully disclosed in the financial statements. 

Recommendations: 

33. Implement policies and procedures for reviewing the accounts receivable schedules 

for reasonableness and accuracy prior to recording related account transactions in the 

general ledger. 

34. Formalize policies and procedures for performing accounts receivable reconciliations. 

While developing these procedures, the FEC should consider establishing a timeline 

for when the reconciliations should be finalized by the program offices and forwarded 

to the Finance Office. 

35. Document all the methodologies applied in calculating allowance for uncollectible 

accounts. Periodically review the methodologies against actual procedures performed 

and revise them as necessary. 

Management Response

The FEC agrees with these findings and recommendations 33, 34, and 35. Significant 

progress was made in the receivables area in FY 2006. The findings in this area were 

mainly the result of errors in cells of the new spreadsheets and have been corrected. In 

FY 2007, we intend to improve further by: a) issuing a directive for receivables 

management; b) review the spreadsheets more thoroughly; c) working with Treasury to 

ensure better reports and; d) improve documentation of the allowance for uncollectible 

accounts. 

VI. Controls Over Procurement and Disbursement Transactions 

 

The weaknesses identified below collectively resulted in a reportable condition in the 

FEC’s procurement processes. 

• Several procurement documents meeting the criteria for approval by the 

Commissioners were not submitted to the Commission for approval or the 
Page 21 of 30

Commissioners’ approval was not clearly documented or provided to us for review. 

Other procurement transactions were not approved by all the individuals in the 

approval chain or were signed by the same individual for more than one position in 

the approval chain. 

• For one of 45 sample items the total obligations and disbursements exceeded the 

contract amount. Although the disbursements were determined to be legitimate, the 

contract was not modified for the increase in obligation. 

• There were several incidents where documents intended to support approval of 

procurement and disbursement actions were not properly submitted for approval, 

supported or maintained by the agency. 

• Accounts payable reconciliations were not always timely prepared by the FEC’s 

personnel and approved by management. 

GAO Standards for Internal Control in the Federal Government states that transactions 

and other significant events should be authorized and executed by persons acting within 

the scope of their authority. This is a principal means of assuring that only valid 

transactions to exchange, transfer, use or commit resources and other events are initiated 

or entered into. Evidence of approval should be clearly documented and readily available 

for examination. Further, key duties and responsibilities need to be divided or segregated 

among different people to reduce the risk of error or fraud. 

Recommendations: 

 

36. Issue formal guidance for performing corrective action when negative obligation 

balances occur. Procedures should describe the conditions when corrective action is 

needed, corrective actions to perform and the individuals responsible for resolving the 

error. The timely response and clear communication on corrective action should also 

be included in the procedures. 

37. Ensure documentation related to procurement and disbursement actions are properly 

approved and supported. Procurement policies and procedures should be enhanced to 

document, completely and clearly, operating procedures for the procurement cycle 

and should include procedures for documenting justification when exceptions are 

made to established procedures. 

38. Ensure reconciliations are consistently performed, reviewed and approved in a timely 

manner. 

Management Response

The FEC agrees with these findings and recommendations 36, 37, and 38. The FEC will 

issue additional internal guidance on how to handle negative obligations (#36). The 

Administrative Officer issued updated guidance to clarify signatures needed on 

procurement documents in early FY 2007. The FEC Procurement Directive will be 

updated in FY 2007 to reflect this change (#37). The FEC will address the timeliness of 

reconciliations with appropriate staff members (#38). 
Page 22 of 30

VII. Audit Follow-up 

Establishing a comprehensive system for audit follow-up helps to ensure prompt and 

proper implementation of corrective action on identified internal control deficiencies. 

Accordingly, OMB Circular A-50, Audit Follow-up, requires an agency to establish an 

audit follow-up system which includes, among other provisions: 1) resolution and 

corrective action on audit recommendations within six months following final report 

issuance; 2) specific and written plans for corrective action with specified action dates; 3) 

a complete and accurate record of the status of audit reports or recommendations through 

the entire process of resolution and corrective action and 4) semi-annual report to the 

agency head on the status of audit report recommendations. 

The FEC was not able to provide the May 2006 report detailing the status of audit 

recommendation submitted to the Commissioners as required by the FEC Directive 50 

Audit Follow-up, revised April 2006. During the audit period, we recognized that the 

Audit Follow-up Official for the financial audit was in the process of establishing a 

follow-up system. However, we identified deficiencies in the follow-up system that 

could affect the FEC’s ability to ensure prompt and proper resolution of audit findings 

and recommendations. The deficiencies were as follows: 

• Sections of the audit follow-up matrix for the financial statement audit are maintained 

in various locations within the agency. A separate matrix for Information 

Technology and non-Information Technology related recommendations are 

maintained by the Chief Information Officer and Accounting Officer, respectively. 

The financial audit Audit Follow-up Official does not maintain a consolidated matrix 

nor does he have ready access to the matrix for Information Technology related audit 

findings. During the FY 2006 financial statement audit, significant effort on the part 

of the FEC personnel and multiple requests from the auditors was needed to 

determine the status of FY 2005 financial statement audit recommendations. The 

FEC’s procedures for the corrective action matrix compromises the financial 

statement Audit Follow-up Official’s ability to monitor the remediation process for 

audit findings and implement additional corrective action, where necessary. 

• The matrix for the FY 2005 financial statement audit findings was not complete. It 

did not include the corrective action plan, or targeted and actual completion dates 

and/or responsible party for several recommendations. 

• The FEC has not formalized a methodology or timetable for updating the matrix with 

the current status of corrective action plans and/or revised targeted and/or completion 

dates. During the FY 2006 audit, we noted the current status of the corrective action 

plan or target date of completion was not always updated in the matrices provided to 

the auditors. As such, management’s assertion regarding the status of audit 

recommendations was not always correct. 

Recommendation: 

39. Formalize the remediation process related to audit findings and recommendations that 

is consistent with OMB Circular A-50 guidelines. 
Page 23 of 30

Management Response

The FEC agrees with the finding and the recommendation. In FY 2006, the FEC 

developed a detailed matrix for ITD and accounting findings which will be monitored 

closely by the CFO. The first follow-up report is expected to be sent to the Commission 

through the Staff Director in November 2006.

OTHER MATTER 

OMB Bulletin No. 06-03 requires that the auditor’s report on internal control “identify those 

material weaknesses disclosed by the audit that were not reported in the reporting entity’s 

Federal Managers’ Financial Integrity Act (FMFIA) report.” The FEC’s schedule of material 

weaknesses and non-conformances included in the PAR did not identify the material weaknesses 

noted in the FY 2006 Independent Auditor’s Report on Internal Control. We do not believe, 

however, that failure to report these material weaknesses in FMFIA constitutes a separate 

reportable condition or a material weakness because different criteria are used by management 

and the auditors in determining material weaknesses. 

STATUS OF PRIOR YEAR CONDITIONS 

As required by Government Auditing Standards and OMB Bulletin No. 06-03, we have reviewed 

the status of the FEC’s corrective actions with respect to the findings and recommendations from 

the previous year’s report on internal controls. We have attached Appendix A to our report that 

presents the status of prior year findings and recommendations. 

******************************** 

In addition to the material weaknesses and reportable conditions described above, we noted 

certain matters involving internal control and its operation that we reported to the management of 

the FEC in a separate letter dated November 7, 2006. 

This report is intended solely for the information and use of the management of the FEC, the 

FEC Office of Inspector General, GAO, OMB, and Congress, and is not intended to be and 

should not be used by anyone other than these speci

a1

fied parties. 

Calverton, Maryland 

November 7, 2006 
APPENDIX A 

FEDERAL ELECTION COMMISSION 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS 

September 30, 2006 

Page 24 of 30

Recommendation No. Condition/Audit Area Recommendation Current Status 

Material Weaknesses 

I. Cost Accounting System and Processes

1 Cost Allocation 

Methodology 

Establish formal and 

comprehensive cost 

allocation methodology 

and related policy and 

procedures. 

Open 

2 Cost Allocation 

Methodology 

Cross-train employees to 

minimize the risks of 

major interruptions in 

normal business 

operations. 

Closed 

3 Cost Allocation 

Methodology 

Establish a review process 

wherein a person, other 

than the preparer, reviews 

the work performed to 

ensure accuracy and 

propriety. 

Open 

4 Cost Allocation 

Methodology 

Maintain audit trials to 

support the allocation 

methodology and amounts. 

Open. 

5 Managerial Cost 

Accounting 

Evaluate the functional 

requirements for the new 

cost accounting system to 

ensure that the minimum 

level of cost accounting 

required in SFFAS No. 4 

is attained. 

Closed 

II. Administrative Fines, Civil Penalties and Miscellaneous Receipts

6 Administrative Fines, 

Civil Penalties and Misc. 

Receipts 

Establish and implement 

policy and procedures 

ensuring communication 

and coordination between 

program offices and 

Finance Office on 

activities with financial 

impact. The policy should 

also clearly establish the 

FEC's revenue recognition 

policy. The Finance 

Office should design a 

standard report outlining 

all the necessary 

information to record the 

financial activities. The 

report should be prepared 

and submitted timely at 

least monthly by the 

program offices to the 

Finance Office. 

Open. Now a reportable 

condition. 
APPENDIX A 

FEDERAL ELECTION COMMISSION 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS 

September 30, 2006 

Page 25 of 30

Recommendation No. Condition/Audit Area Recommendation Current Status 

II. Administrative Fines, Civil Penalties and Miscellaneous Receipts

7 Administrative Fines, 

Civil Penalties and Misc. 

Receipts 

Document the policy and 

basis for the allowance for 

uncollectible accounts. 

Partially closed. Although 

the FEC had documented 

the policy, the 

documentation for the 

basis for the allowance for 

uncollectible accounts was 

not complete. The FEC 

uses other methodologies 

that were not documented. 

III. General Property and Equipment

8 Property, Plant and 

Equipment 

Reconcile the total of the 

individual property items 

in the property system to 

the bulk purchase total 

recorded in the books to 

ensure completeness of the 

property system records. 

Open 

9 Property, Plant and 

Equipment 

Document physical 

inventory procedures, 

results, and reconciliation 

and maintain the 

documentation for audit 

trail purposes. 

Open 

10 Property, Plant and 

Equipment 

Revise the software 

capitalization policy to 

comply with SFFAS No. 

10. 

Closed 

11 Property, Plant and 

Equipment 

Enforce compliance and 

consistent implementation 

of policies and procedures 

related to completing 

receiving reports and the 

review and approval of 

obligating memos or 

documents. 

Open – Now a reportable 

condition reported under 

Controls Over 

Procurement and 

Disbursement 

Transactions. 

12 Property, Plant and 

Equipment 

Establish a standard 

process and policy where 

program offices are 

required to notify the 

Finance Office of any 

property acquisition or 

disposition with 

accounting impact to 

ensure proper and timely 

recording of the 

transaction. 

Open 
APPENDIX A 

FEDERAL ELECTION COMMISSION 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS 

September 30, 2006 

Page 26 of 30

Recommendation No. Condition/Audit Area Recommendation Current Status 

IV. Information Technology

13 Entity-Wide Security 

Program 

Implement a framework of 

policies and standards to 

mitigate risks associated 

with the information 

resources management. 

Open. Now a reportable 

condition. 

14 Entity-Wide Security 

Program 

Complete the 

documentation, approval, 

and implementation of an 

entity-wide security 

program plan. 

Open. Now a reportable 

condition. 

15 Entity-Wide Security 

Program 

Develop and implement 

security plans for all major 

applications and MCGSS 

as part of a risk mitigation 

strategy. 

Open. Now a reportable 

condition. 

16 Entity-Wide Security 

Program 

Ensure that Resource 

Classifications in the 

FEC's security plans 

accurately reflect the risk 

and vulnerability of the 

FEC systems. 

Open. Now a reportable 

condition. 

17 Entity-Wide Security 

Program 

Complete the 

implementation of the 

program for the 

continuous monitoring and 

evaluation of the computer 

security policy and control 

effectiveness. 

Open. Now a reportable 

condition. 

18 Entity-Wide Security 

Program 

Conduct risk assessments 

at least every three years 

as part of an overall 

strategy to mitigate risks 

associated with its 

information technology 

environment. 

Open. Now a reportable 

condition. 

19 Entity-Wide Security 

Program 

Certify that the major 

applications and MCGSS 

are operating according to 

the FEC's security 

requirements. 

Open. Now a reportable 

condition. 
APPENDIX A 

FEDERAL ELECTION COMMISSION 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS 

September 30, 2006 

Page 27 of 30

Recommendation No. Condition/Audit Area Recommendation Current Status 

20 Entity-Wide Security 

Program 

Strengthen the FEC's 

program to document 

corrective actions and 

verify that weaknesses 

identified have been 

addressed. Ensure and 

document that 

recommendations from the 

most recent network 

security review have been 

implemented. 

Open. Now a reportable 

condition. 

21 Controls to Protect 

Information 

Create a new GL system 

application role to give 

employees with necessary 

and appropriate access 

rights to fulfill their job 

responsibility. 

Closed 

22 Controls to Protect 

Information 

Monitor and record visitor 

access to the data center. 

Closed 

23 Controls to Protect 

Information 

Use access request forms 

to document user access 

rights and periodically 

review the access for 

appropriateness. 

Open. Now a reportable 

condition. 

24 Controls to Protect 

Information 

Develop mitigating 

controls to ensure that GL 

system passwords are in 

agreement with the FEC 

policy. 

Open. Now a reportable 

condition. 

25 Controls to Protect 

Information 

Automatically log network 

activity as required by the 

Audit Events Standards. 

Closed 

26 Controls to Protect 

Information 

Institute a process to 

manually review logs of 

users using budgetary 

overrides where the 

reviewer is an individual 

who does not have access 

to utilize the overrides. 

Open. Now a reportable 

condition. 

27 Controls to Protect 

Information 

Periodically review the 

firewall rule set for 

appropriateness. 

Closed 

28 Controls to Protect 

Information 

Periodically review LAN 

user accounts and disable 

unnecessary user accounts. 

Open. Now a reportable 

condition. 
APPENDIX A 

FEDERAL ELECTION COMMISSION 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS 

September 30, 2006 

Page 28 of 30

Recommendation No. Condition/Audit Area Recommendation Current Status 

29 Contingency Plan Perform a Business Impact 

Analysis to formally 

identify and prioritize all 

critical data and operations 

on the FEC's networks and 

the resources needed to 

recover them if there is a 

major interruption or 

disaster. Ensure that 

emergency processing 

priorities are established to 

assist in managing disaster 

situations more effectively 

for the network and 

include business owners in 

the discussion to 

determine how much 

backup data is needed onhand to minimize the 

impact of a disaster. 

Open. Now a reportable 

condition. 

30 Contingency Plan Establish alternative 

processing site for the 

FEC's operations in the 

event of a disaster and 

ensure that an operational 

mechanism exists to 

update the disclosure 

database in the event that 

the FEC database is 

unavailable to replicate the 

disclosure database 

resident at the off-site 

location. 

Open. Now a reportable 

condition. 

31 Contingency Plan Develop a Continuity of 

Operations Plan (COOP) 

to support the continuation 

of the FEC's core mission 

in the event of a disaster 

that renders the FEC's 

facilities unusable. 

Open. Now a reportable 

condition. 

32 Contingency Plan Develop and document a 

comprehensive 

contingency of operations 

plan of the FEC's data 

centers, networks, and 

telecommunication 

facilities. 

Open. Now a reportable 

condition. 
APPENDIX A 

FEDERAL ELECTION COMMISSION 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS 

September 30, 2006 

Page 29 of 30

Recommendation No. Condition/Audit Area Recommendation Current Status 

33 Software Development 

and Change Control 

Fully implement the 

System Development Life 

Cycle Methodology. 

Closed 

Reportable Conditions 

V. Financial Reporting 

34 General Ledger System 

Setup and Posting Model 

Definition 

Ensure that corrections 

made to the posting logic 

comply with the USSGL 

and that the USSGL 

accounts and posting logic 

are updated as changes to 

USSGL are issued. 

Closed 

35 Continuing Resolution 

Accounting 

Comply with the 

continuing resolution 

accounting scenario 

prescribed by the US 

Treasury in accordance 

with memorandum issued 

by OMB. 

Closed 

36 Integrated Financial 

Management 

Continue to assess the 

degree of integration 

necessary to have a single, 

unified financial system by 

evaluating the functional 

requirements and the costs 

and benefits of integrating 

the financial reporting, 

property and equipment, 

receivable and the cost 

systems with the GL 

system. 

Open 

VI. Payroll

37 Payroll Implement procedures to 

ensure that leave 

adjustments are 

completely processed and 

transmitted to the service 

provider. 

Closed 

38 Payroll Maintain in the personnel 

files all payroll deduction 

authorization forms 

initiated through the FEC, 

i.e. not done directly by 

the employee with the 

service provider. 

Closed 
APPENDIX A 

FEDERAL ELECTION COMMISSION 

STATUS OF PRIOR YEAR FINDINGS AND RECOMMENDATIONS 

September 30, 2006 

Page 30 of 30

Recommendation No. Condition/Audit Area Recommendation Current Status 

39 Payroll Ensure that timekeepers: 

perform the bi-weekly 

reconciliation between 

leave balances reported in 

its records and the service 

provider's records; and 

submit the bi-weekly leave 

balance certification to the 

Finance Office timely. 

Closed 

40 Payroll Implement procedures for 

ensuring all payroll and 

personnel documents are 

properly completed and 

authorized before payroll 

data is transmitted to the 

payroll service provider 

for processing. 

Closed 

41 Payroll Consider automating 

payroll processing to 

decrease the risk of error. 

Closed. Now in 

Management Letter.