Federal Election Commission

Office of Inspector General

Final Report

Review of Outstanding 

Recommendations as of 

February 2015

March 2015

Assignment No. OIG-15-02
 Office of Inspector General’s

 Review of

Outstanding Recommendations as of

February 2015

The Office of Inspector General (OIG) semiannually provides to the Federal Election 

Commission (FEC) the status of outstanding recommendations. The OIG has recently revised its 

policies and procedures to provide these status reports in February and August of each year. 

This revision will provide sufficient time for management to include any updates from the OIG 

in their semiannual corrective action plans to the Commission in May and November. Since the 

June 2014 report was issued, the Inspection of FEC’s Compliance with FMFIA/OMB1Circular 

A-123 report (which was released in June 2014) has been included in the audit follow-up process 

because the recommendations have been outstanding for more than six months. For this reporting 

period, we reviewed six (6) audits and inspections that had a total of 95 recommendations 

outstanding as of June 2014. The OIG was able to collectively close fourteen (14) 

recommendations from four (4) of the six (6) audits and inspections (See table on page 2).

 Noteworthy Accomplishments

• The Office of Human Resources (OHR) closed an additional six (6) audit 

recommendations from the Audit of the Federal Election Commission’s Office of Human 

Resources, implementing more than half of the outstanding recommendations within the 

first year of the follow-up process. The OIG appreciates the dedication management is 

putting forth to improve the agency’s Human Resource processes.

 OIG Concerns

• The OIG continues to be concerned with the agency’s position to operate with two CoChief Privacy Officers (the Deputy Chief Information Officer (CIO) of Operations and

Deputy General Counsel) to oversee the agency’s privacy programs.

• FEC needs to improve the accountability of management officials to ensure compliance 

with all aspects of Directive 50: Audit Follow-up.

For further details, please see page 7.

 1 FMFIA stands for the Federal Managers’ Financial Integrity Act, and OMB stands for the Office of Management 

and Budget.
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 2 | Page

Table Summary of Results

The table below summarizes the progress made by FEC management since the OIG’s last 

reporting period and the total outstanding recommendations as of February 2015.

Title & Report Date 

of OIG 

Audits/Inspection

Total Outstanding 

Recommendations 

as of June 2014

Total Closed 

and Verified 

by OIG

Total Open 

as of

February 20152

Audit of the Commission’s

Property Management

Controls (3/2010)

2 1 1

2010 Follow-up Audit of

Privacy and Data Protection

(3/2011)

29 1

3

28

2010 Follow-up Audit of

Procurement and Contract

Management (6/2011)

9 6 3

Inspection of the FEC’s

Disaster Recovery Plan and

Continuity of Operations

Plans (1/2013)

30 0 30

Audit of the FEC’s Office of 

Human Resources (7/2013) 17 6 11

Inspection of FEC’s 

Compliance with FMFIAOMB A-123 (6/2014)

8 0 8

Total Outstanding Recommendations

81

 2 “Total Open as of February 2015” column includes recommendations that management has disagreed with or has 

not adequately implemented, and the OIG concludes that these recommendations are still open. 3 Recommendation was closed based on a duplicate recommendation in the FEC’s annual financial statement audit 

that was closed during the FY 2014 audit.
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 3 | Page

Audit Follow-up Meetings/Communications

Closed Audits

The Office of Inspector General did not close any audits for this review period.

Open Audits

A. Audit of the Commission’s Property Management Controls

The OIG’s Review of Outstanding Recommendations as of June 2014 report identified 

two open recommendations for the Audit of the FEC’s Property Management Controls

(Property Audit): 

• Recommendation 2a: “All unassigned Blackberry devices should be suspended 

or service should be terminated if the device cannot be immediately transferred to 

another user (no active spares kept in ITD)” and

• Recommendation 2f: “Blackberry user information should be kept up to date and 

adjusted in a timely manner on the ITD master Blackberry listing and the AT&T 

Premier website for employee separations and new assignment of devices.”

For this current follow-up review, management identified that corrective actions had been 

made to adequately close both recommendations. Management provided the OIG with 

the Information Technology Division’s (ITD) iPhone inventory list4 as of January 7, 

2015, along with the AT&T Premier Billing Statement for November and December 

2014. During the audit follow-up meeting for the Property Audit, the Deputy CIO of 

Operations identified two known inventory recording errors that management needed to 

correct. The OIG excluded the two known errors, and compared the most recent agency 

iPhone inventory list to the billing statements for November and December to ensure the 

accuracy of ITD’s inventory data. 

The OIG’s review identified that corrective actions had been made by management to 

resolve recommendation 2a, as the number of active spare devices have been reduced. In 

addition, the specific issues the OIG outlined in our prior report (as of June 2014)

regarding recommendation 2f had also been resolved. However, beyond the two issues 

that were identified by the Deputy CIO of Operations regarding the accuracy of the 

agency’s iPhone inventory data, the OIG identified several other inaccuracies with the 

current inventory listing. 

 4 The FEC upgraded from Blackberry phones to iPhones in 2014.
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 4 | Page

Some of the issues that were identified included:

• active iPhone devices on the billing statement not recorded on the agency’s 

iPhone inventory listing;

• users assigned to more than one iPhone on the inventory listing; and

• telephone numbers on the billing statement and the inventory list for the same 

user do not match.

The OIG provided the Deputy CIO of Operations with our review results and comments, 

noting the inaccuracies found. Thus, the OIG continues to report recommendation 2f as 

an outstanding recommendation for this reporting period.

B. 2010 Follow-up Audit of Privacy and Data Protection

For the 2010 Follow-up Audit of Privacy and Data Protection, the OIG’s June 2014

report identified 29 open recommendations. FEC management noted that no progress has 

been made to address any of the open findings for this review period. Specifically, the 

Office of General Counsel has had to focus significant resources on responding to recent 

Congressional request, along with completing normal FEC business in regards to the 

agency’s mission. However, management has committed to fully revising and updating

management’s responses to the next corrective action plan (CAP) to be submitted to the 

Commission in May 2015 to provide an accurate status update of the open 

recommendations. 

Also, in reviewing the prior CAP submitted by management, the OIG noted that one of 

the open recommendations was the same recommendation included in the FEC’s annual 

financial statement audit, which was verified and closed during FY 2014. Therefore, the 

OIG has closed recommendation 6a: Modify the Federal Election Commission Mobile 

Computing Security Policy to require all mobile devices, including Blackberrys [iPhones]

be encyrpted. However, recommendation 6e: Include a record in the inventory lising of 

whether the device is encrypted or not, remains open as management has yet to provide 

adequate documentation that ensures all FEC devices are encrypted in accordance with 

policy. 

See the OIG Concerns section on page 7 for further details regarding recommendations 

from this audit.
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 5 | Page

C. 2010 Follow-up of Procurement and Contract Management

The OIG’s Review of Outstanding Recommendations as of June 2014 report identified 

nine open recommendations for the 2010 Follow-up Audit of Procurement and Contract 

Management. In November 2014, the OIG met with the Acting Chief Financial Officer 

(CFO) and the Director of Procurement to discuss the status of outstanding 

recommendations. The OIG then reviewed supporting documentation to support 

corrective actions by the Office of the Chief Financial Officer (OCFO) to determine if 

certain recommendations could be closed. 

Based on the OIG’s review, six of the nine outstanding recommendations have been 

closed, leaving only three open recommendations as of February 2015.

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

The Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans 

(COOP Inspection) report was released in January 2013. The OIG contacted the Deputy 

Chief Information Officer of Operations to provide a status of the open 

recommendations. The Deputy CIO notified the OIG that there have been no significant 

changes to the status of the thirty (30) outstanding recommendations; however, 

management is currently working on a few tasks to address the agency’s COOP. 

Management identified that:

• management received approval to purchase computer hardware for FEC 

employees to use for purposes of the COOP and the hardware (tablets) are 

scheduled to be distributed by December 2014;

• revsions are being made to the COOP by management to have one overall agency 

plan, and the draft plan is scheduled to be completed by the end of January 2015; 

and

• testing of the revised COOP is scheduled for February 2015.

The OIG recognizes that management is making strides to satisfy this government 

requirement; however, as distribution of the hardware has yet to be completed, which 

delays testing of a revised plan, the FEC is still not in compliance with the required 

Presidential Directive: Homeland Security Presidential Directive (HSPD-20), section 

19(d).

5 Therefore, the FEC would not be able to properly respond in the event of a 

localized emergency or disaster to the FEC building (i.e., fire, flooding, etc.). The OIG 

encourages management to properly plan and staff this project to be completed in a 

 5 “Heads of executive departments and agencies shall execute their respective department or agency COOP plans in 

response to a localized emergency and shall: (d) “Plan, conduct and support annual tests and training....”
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 6 | Page

timely manner to ensure the agency’s mission can still be achieved in the event of an 

unforeseen disruption to the FEC’s normal course of business. 

E. Audit of the FEC’s Office of Human Resources 

The Audit of the Federal Election Commission’s Office of Human Resources (OHR)

report was issued in July 2013. The OIG’s Review of Outstanding Recommendations as 

of June 2014 report identified 17 open recommendations for the OHR audit report. 

In December 2014, the OIG met with the Director of Human Resources to discuss 

corrective actions taken to address the outstanding recommendations. The OIG then 

reviewed the updated OHR CAP and requested supporting documentation required to 

close certain recommendations. Based on the OIG’s review of documentation to support 

corrective actions by the OHR, the OIG closed six of the 17 outstanding 

recommendations. Therefore, the OHR audit has 11 open audit recommendations as of 

February 2015.

F. Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123

The Inspection of FEC’s Compliance with FMFIA/ OMB Circular A-123 was released in 

June 2014. The OIG’s June 2014 inspection report identified eight outstanding 

recommendations. In December 2014, the OIG contacted the OCFO to provide a status of 

the open recommendations. Per discussion with the Acting CFO and the Director of 

Accounting, the OIG was informed that Management still plans to wait until OMB 

releases new guidance on internal controls before making any major changes to the 

annual internal control review (ICR) process. However, OCFO did state that corrective 

action has been made related to two of the recommendations:

• Recommendation 1: “The Office of the Chief Financial Officer (OCFO) should 

ensure sufficient information is included in the internal control review (ICR) 

packages submitted by program offices by making the ICR report mandatory.”

• Recommendation 2: “As a best practice, the ICR report should be 

standardized....”

Until OIG can review a sample of FY 2014 ICR packages to confirm that corrective 

action has been adequately implemented to address the two applicable recommendations, 

these recommendations cannot be closed. Therefore, all eight recommendations remain 

open. 
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 7 | Page

OIG Concerns

FEC Privacy Program

Many of the critical outstanding recommendations from the 2010 Follow-up Audit of Privacy 

and Data Protection have not been implemented since the release of the report in March 2011 

due to the full time responsibilities of each Co-Chief Privacy Officer and their office staff. The 

Information Technology Division and the Office of General Counsel are two offices that are 

critical to the agency’s mission and require their staffing resources to be dedicated to achieving 

the mission of the agency. In recent months, the OGC has had to balance their full-time 

responsibilities while responding to multiple Congressional requests. 

The OIG encourages management to reconsider their position6 to the outstanding 

recommendation 1a of the Privacy Audit: 

Assign privacy roles and responsibilities to one individual CPO [Chief Privacy Officer] 

with high level sponsorship in the Commission, to ensure any sensitive data and/or 

personally identifiable information within the agency is properly recorded, safeguarded, 

and distributed.

The lack of one fully dedicated Privacy Officer has delayed progress in improving the agency’s 

overall Privacy Program. The agency is at high risk of not being up to date with required 

government privacy requirements, ensuring that proper privacy protocols and processes are 

enforced within the agency, and meeting deadlines for privacy reporting requirements. 

FEC Directive 50: Audit Follow-up

FEC needs to improve the accountability of management officials to ensure compliance with all 

aspects of Directive 50: Audit Follow-up. It is essential that the Commission not only requires 

management to report on semi-annual basis the status of outstanding recommendations, but also 

develops a process to ensure the Audit Follow-up Officials are being held accountable for 

implementing outstanding recommendations in a timely manner that are beneficial to the 

agency’s mission and will improve agency programs. The Office of Management and Budget 

Circular No. A-50 states:

Agency heads are responsible for (2) Assuring that management officials throughout the 

agency understand the value of the audit process and are responsive to audit 

recommendations. 

 6 “Management does not concur with this audit recommendation.”
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 8 | Page

Without accountability necessary to ensure that corrective actions are taken by management, the 

agency is consistently operating under weaker controls that can increase cost, expose the agency 

to risks, and increase the potential of fraud waste, and abuse to agency programs.
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 9 | Page

Background

As required by the Inspector General Act of 1978, as amended, the Office of Inspector

General is responsible for conducting audits of the Federal Election Commission’s 

programs and operations. In addition to conducting and supervising audits, the OIG

also has the responsibility to conduct audit follow-ups to ensure that management has 

effectively implemented OIG recommendations. Audit follow-up, including the timely

implementation of audit recommendations by FEC management, is required by Office

of Management and Budget Circular A-50, Audit Follow- up, as revised, and FEC

Directive 50: Audit Follow-up.

At the conclusion of each OIG audit and inspection, it is management’s responsibility to 

develop a corrective action plan. The CAP identifies the plan management has developed to 

address the OIG’s findings and recommendations. The CAP should detail the following:

1. assignment of Audit Follow-up Official, who is responsible for overseeing the 

corrective action;

2. OIG finding(s);

3. OIG recommendation(s);

4. detailed corrective action to implement the OIG’s recommendation(s);

5. FEC staff person with responsibility to implement each task; and

6. expected completion dates.

Once management drafts the CAP, the OIG then reviews the CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the

final CAP to the Commission with a courtesy copy to the OIG.

FEC Directive 50 requires management to:

(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission...;

In order to work effectively with FEC management in adhering to FEC Directive 50, 

and to ensure continuous monitoring and adequate and timely audit resolution, the

OIG communicates with management at least semiannually to discuss the status of

outstanding OIG recommendations. If management has implemented any corrective

action(s), the OIG schedules a meeting with management to discuss the

implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (i.e. new/updated policies, procedures, and processes to improve

internal controls).
Office of Inspector General’s Review of Outstanding Recommendations as of February 2015 10 | Page

To provide management with timely feedback and the results of our review prior to 

management’s reporting deadlines to the Commission in May and November, the OIG 

reports on our review of outstanding recommendations in February and August. The

semiannual meetings are also intended to assist the audit follow-up official in following

provisions 4 through 6 of Directive 50, which are listed as follows:

(4) Respond in a timely manner to all audit reports;

(5) Engage in a good faith effort to resolve all disagreements; and

(6) Produce semi-annual reports that are submitted to the agency head.

The official status (open/closed) of OIG recommendations is determined by the OIG 

once the OIG has verified that management has adequately implemented the corrective 

actions. The Inspector General can also make a decision to close recommendations or 

seek resolution from the Commission for recommendations where the OIG and 

management disagree. Lastly, the number of outstanding recommendations is also 

reported to the Commission and Congress in the OIG’s Semiannual Reports to Congress.
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015