OFFICE OF

INSPECTOR GENERAL

Semiannual Report to Congress

April 1, 1999 - September 30, 1999

Federal Election Commission

999 E Street, N.W.

Suite 940

Washington, D.C.

November 1999
TABLE OF CONTENTS 

SUBJECT PAGE 

EXECUTIVE SUMMARY.......................................................... 1

FEDERAL ELECTION COMMISSION..................................... 8

YEAR 2000 (Y2K)..................................................................... 10

AUDITS................................................................................... 22

AUDIT FOLLOW-UP............................................................... 23

INVESTIGATIONS.................................................................. 34

ADDITIONAL OFFICE OF INSPECTOR GENERAL

ACTIVITY......................................................................... 35

ECIE AND PCIE ACTIVITY..................................................... 38

REPORTING REQUIREMENTS.............................................. 39

TABLE I - QUESTIONED COSTS........................................... 40

TABLE II - FUNDS PUT TO BETTER USE............................. 41

TABLE III - SUMMARY OF AUDIT REPORTS WITH

CORRECTIVE ACTIONS OUTSTANDING

FOR MORE THAN SIX MONTHS....................... 42

OFFICE OF INSPECTOR GENERAL HOTLINE..................... 43

April 1, 1999 - September 30, 1999 
EXECUTIVE SUMMARY 

This report is submitted pursuant to the Inspector General Act of 

1978, as amended, and includes a summary of the Office of Inspector 

General’s (OIG) activities for the period April 1, 1999 through September 30, 

1999. 

A significant amount of available OIG resources have been committed 

to the Y2K issue, not only during this reporting period, but during the past 

calendar year. The main focus of this report will be on that effort. 

During this reporting period, a real-time audit was conducted on the 

agency’s Y2K effort resulting in nine constructive recommendations. 

However, issuance of the audit report did not end OIG involvement. We 

immediately followed up and tracked the agency’s progress in implementing 

our audit recommendations, and continue to evaluate and report on the 

agency’s Y2K progress as regularly reported by the FEC to OMB. In 

addition, an OIG review for Y2K renovation of the agency’s embedded chip 

technology has been scheduled during the next reporting period. 

We have continued to keep the Commissioners and management 

apprised of agency progress in the Y2K area by a series of advisory 

memorandums. In an advisory memorandum dated April 20, 1999, the OIG 

identified two high risk conditions relating to the agency’s Y2K renovation 

April 1, 1999 - September 30, 1999 Page 1 
efforts. In another memorandum dated July 20, 1999, the OIG identified 

conditions which continue to pose a high risk to the FEC. Further details 

concerning these memorandums can be found in the Y2K section of this 

report. 

As a consequence of our audit report and advisory letters, the IG and 

the Director of Data Systems Development Division (DSDD) were 

subsequently asked to give testimony before the FEC Commissioners, 

appraising agency progress in the Y2K renovation project. The Director of 

DSDD expressed confidence that under his leadership the agency’s Y2K 

problems would be fully resolved. Contrary to the positive assurance 

expressed by the Director of DSDD, the IG reported that based on evidence 

gathered during the Y2K audit, along with results from a follow-up 

evaluation, the FEC remains highly vulnerable to the Y2K problem. 

The Commissioners showed particular concern for the degree of 

assurance the agency’s Y2K project could provide that our computer systems 

and related technology will be prepared for January 1, 2000. The 

Commissioners have scheduled another open discussion regarding the Y2K 

issue for November 10, 1999. Details concerning the original hearing can be 

found in the Y2K section of this report. The OIG will continue to monitor the 

Commissions progress in addressing its Y2K responsibilities. 

April 1, 1999 - September 30, 1999 Page 2 
Also during this reporting period, follow-up work was done on three 

audits and two cash counts of the FEC’s imprest fund were performed. The 

audit and follow-up work are summarized below: 

Audit of Agency Year 2000 (Y2K) Renovations - OIG 98-08: 

The primary objectives of the audit were to 1) verify the reported 

progress of the FEC’s Y2K renovation project; and 2) evaluate 

compliance with applicable laws & regulations. Agency progress was 

evaluated using OMB’s milestone dates and GAO’s methodology. The 

Y2K team was regularly updated on all project risk identified during 

the audit fieldwork and provided specific recommendations to reduce 

exposure to those risks. 

During the audit agency computer systems were identified, assigning 

the highest priority to those systems which transfer data and systems 

that receive electronic data from outside sources. The audit assessed 

the risk associated with the Y2K renovation of the computer systems 

within these critical areas and recommendations were offered which 

we felt would reduce the agency’s exposure to the Y2K problem. 

We found, among other things, that the agency’s computer hardware, 

3rd party software, and supporting communications network were not 

yet Y2K compliant. In addition, while system renovation work and 

April 1, 1999 - September 30, 1999 Page 3 
unit testing had been performed, other testing on the agency’s most 

important computer system had yet to be completed. 

Based on the audit work, we concluded that the progress reported by 

the FEC is consistent with the actual Y2K project results achieved. 

However, there are still major issues to be addressed before the 

Commission can be Y2K compliant. 

The audit report contained nine constructive recommendations for 

project improvement. Details concerning this audit are discussed in 

the Y2K section of this report. 

Follow-up work on the audit of the Commission’s Management 

of Computer Software - OIG 98-05, was conducted during this 

reporting period. The original audit report was released March 1999. 

The primary objectives of the audit were to 1) verify that the 

Commission’s computer software was in compliance with applicable 

copyright laws and Commission policies and procedures; 2) determine 

that adequate policies and procedures are in place to prevent 

unauthorized software use by Commission employees; and 3) ensure 

that adequate controls are in place to detect and prevent computer 

April 1, 1999 - September 30, 1999 Page 4 
viruses. The original report contained one finding and three 

recommendations. 

We inspected documents and contacted the Data Systems 

Development Division (DSDD) in order to determine whether 

corrective action has been taken to resolve the audit finding and 

recommendations. Based on our review of documents and 

correspondence with the DSDD staff, we found that DSDD has not 

completely resolved two of the three audit recommendations contained 

in our original report. Details of the follow-up work are discussed in 

the Audit Follow-up section of this report. 

Follow-up work on the audit of the FEC Property Management 

(Computer Inventory) - OIG 97-03, was conducted during this 

reporting period. The original audit was released January 1998. The 

primary objectives of the audit were to 1) identify and evaluate the 

adequacy of internal controls over desktop and laptop computers; and 

2) evaluate the procedures in place to ensure that computer equipment 

having an acquisition cost over $5,000 is capitalized and that there is 

documentation to support the unit cost of computers under $5,000. 

April 1, 1999 - September 30, 1999 Page 5 
We inspected documents and contacted the Data Systems 

Development Division in order to determine whether corrective action 

has been taken to resolve the audit findings and recommendations. 

Based on our review of documents and correspondence with the DSDD 

staff, we found that although some action had been taken by the 

DSDD to correct the weaknesses cited in our report, the action taken 

was not sufficient enough to resolve the audit findings. Details of the 

follow-up work are discussed in the Audit Follow-up section of this 

report. 

Follow-up work on the audit of the Review of the Commission’s 

Employee Appraisal Process - OIG 97-02, was conducted during 

this reporting period. The original audit was released January 1998. 

The primary objectives of the audit were to 1) determine whether the 

Commission’s Employee Appraisal Process was in compliance with 

applicable Federal Regulations and Commission Personnel instructions; 

and 2) determine whether the Commission’s monetary incentive 

process is in compliance with applicable Federal Regulations and 

Commission Personnel Instructions. 

The original report contained four audit recommendations. After 

follow-up work was completed, it was discovered that one 

recommendation had been implemented, leaving three 

April 1, 1999 - September 30, 1999 Page 6 
recommendations open. We would like to note that the Personnel 

office has had a significant staff turnover in the past two years. The 

current Director of Personnel has been working on the remaining open 

recommendations. Details of the follow-up work, as well as the status 

of the remaining open recommendations, are discussed in the Audit 

Follow-up section of this report. 

Also during this reporting period, a peer review of the office was 

conducted by the Appalachian Regional Commission, Office of Inspector 

General. The objectives of the peer review were to 1) determine whether an 

effective internal quality control system had been established in the office; 

and 2) established policies and procedures and applicable Government 

Auditing Standards, as promulgated by the Comptroller General of the 

United States (GAO), are being followed in practice. 

The review concluded that a system of internal controls is in place and 

operating effectively and that the audits performed by the office are being 

carried out in accordance with GAO Government Auditing Standards. 

Details concerning the peer review are discussed in the Additional Office of 

Inspector General Activity section of this report. 

April 1, 1999 - September 30, 1999 Page 7 
THE FEDERAL ELECTION COMMISSION 

The Federal Election Commission (FEC) is an independent, regulatory 

agency responsible for administering and implementing the Federal Election 

Campaign Act (FECA). The FEC is composed of six Commissioners who are 

appointed for six year terms by the President of the United States, with the 

advice and consent of the Senate. The FECA likewise established the 

positions of Staff Director and General Counsel, who are appointed by the 

Commissioners. 

OFFICE OF INSPECTOR GENERAL 

The Federal Election Commission is one of the thirty-three designated 

agencies required to have an Inspector General under the 1988 amendments 

to the Inspector General Act of 1978 (P.L. 100-504). 

The responsibilities of the Inspector General as stated in P.L. 100-504 

are as follows: 

o conduct and supervise audits and investigations relating 

to the Federal Election Commission’s programs and 

operations; 

o provide leadership, coordination, and to recommend 

April 1, 1999 - September 30, 1999 Page 8 
policies for activities designed to promote economy, 

efficiency and effectiveness in the administration of 

Commission programs and operations. To prevent and 

detect fraud, waste and abuse in these programs and 

operations, and; 

o keep the Commissioners and Congress fully and currently 

informed about problems and deficiencies and the need for 

and progress of corrective actions. 

The OIG staffing level for FY 2000 is 4 FTE. The staff consists of the 

Inspector General, the Special Assistant to the Inspector General and two 

Senior Auditors. 

April 1, 1999 - September 30, 1999 Page 9 
YEAR 2000 (Y2K) 

Early awareness of the size and scope of the Y2K problem, prompted 

the OIG to commit a significant amount of available resources to assist the 

FEC in addressing this vital issue. Early in 1998, the Staff Director was 

notified of our interest in staying abreast of agency progress in making 

computer systems Y2K compliant. Based on feedback from this request, the 

OIG subsequently conducted a real-time audit resulting in nine constructive 

recommendations for project improvement. However, issuance of our audit 

report did not end OIG involvement. We immediately followed up and 

tracked the agency’s progress in implementing our audit recommendations, 

and we continue to evaluate and report on the agency’s Y2K progress as 

regularly reported by the FEC to OMB. In addition, an OIG review has been 

scheduled for Y2K renovation of the agency’s embedded chip technology. 

As mentioned, one of the major projects the OIG accomplished was a 

real-time audit of the FEC’s Y2K Renovations. The audit, titled Audit of the 

Agency Year 2000 Renovations, was released in May 1999. The primary 

objectives of the audit were to 1) verify the reported progress of the FEC’s 

Y2K renovation project; and 2) evaluate compliance with applicable laws and 

regulations. 

April 1, 1999 - September 30, 1999 Page 10 
(Y2K Continued) 

The audit was conducted to assess whether the progress reported by 

the FEC matched its overall state of readiness. Special emphasis was placed 

on two priority areas: 1) systems that provide and receive electronic data 

from outside parties; and 2) core business functions that rely on computer 

processed data. To accomplish the objectives, various methods of data 

collection were used, including interviews, surveys, and review of documents. 

The audit was not limited solely to evaluating the agency’s progress for 

preparing its mission critical systems, a cursory review of the agency’s 

overall state of readiness was also performed. To obtain a perspective on the 

adequacy of the FEC’s Y2K project OMB directives were used, as well as 

guidance issued by GAO. As part of the audit, the system of management 

controls, policies, procedures, and practices applicable to the FEC’s 

management of the Y2K project were assessed. During the course of the 

audit, FEC officials were regularly briefed on audit results and suggestions 

for improvement were offered. 

Based on our audit work, it was concluded that project status as 

reported by the FEC was consistent with its actual progress. However, 

reportable conditions were identified and nine recommendations for project 

improvement were provided. Listed below are those recommendations, as 

April 1, 1999 - September 30, 1999 Page 11 
(Y2K Continued) 

well as actions taken by Y2K project management since the release of the 

audit report. The OIG recommended that: 

1) The Y2K team inventory and document internal and external 

data exchange dependency links. Project management has 

implemented this recommendation. 

2) The FEC should communicate with each external data 

exchange partner regarding the Y2K issue. Project 

management has reported that they implemented this 

recommendation. 

3) Project management issue the statement of work for 

external communication services, complete work on the 

internal communications network, and perform end-to-end 

testing for the mission critical communication network. The 

Information Technology contract has been signed, and project 

management has reported that work is progressing on the 

internal communication system, and system testing has been 

scheduled. 

4) the FEC improve the accuracy of its progress reports 

submitted to the U.S. Office of Management and Budget 

April 1, 1999 - September 30, 1999 Page 12 
(Y2K Continued) 

regarding the agency’s Y2K project. Management has 

implemented this recommendation. 

5) a contingency plan be developed and tested in the event that 

a mission critical system fails. Management has begun work 

implementing this recommendation. 

6) a thorough testing for the mission critical FEC Faxline 

System should be performed. During October 1999, project 

management successfully tested this system for Y2K 

compliance. 

7) the statement of work for independent verification of the 

renovation of the agency’s internally developed software 

should be issued. Management has signed a contract with an 

outside vendor for these services. 

8) if project management is to rely on user acceptance testing 

as stated in agency Y2K project progress reports, then 

project management should conduct meetings with each 

division/office to assess whether user acceptance testing has 

been completed. This audit recommendation has not been 

implemented. 

9) a listing of agency-wide computer technology contracts 

should be prepared and evaluated to ensure that 

April 1, 1999 - September 30, 1999 Page 13 
(Y2K Continued) 

Y2K provisions have been added to comply with Federal 

regulations. Management has begun work implementing this 

recommendation. 

Out of those nine recommendations - three recommendations have 

been implemented; four recommendations are in different stages of 

completion; one recommendation has not been implemented, and the OIG is 

following up on one recommendation reported as implemented. 

The audit process has not been the only vehicle the OIG has used to 

provide information to management and the Commission. For example, early 

in the audit process the OIG provided the Y2K project team with an 

electronic draft copy of a Y2K plan developed by the Department of 

Education/Office of Post Secondary Education. This was done after the Y2K 

project team repeatedly set deadline dates for the completion of a 

comprehensive Y2K management plan and a plan was still not developed. 

It was recommended that the plan from the Department of Education, 

be used as a benchmark guideline for developing the FEC Y2K management 

plan. In addition, we suggested sending the final version of the FEC 

April 1, 1999 - September 30, 1999 Page 14 
(Y2K Continued) 

comprehensive Y2K management plan, by way of a memorandum, to each 

division/office in order to raise awareness and disseminate pertinent 

information regarding the Y2K project. It was also suggested that the cover 

memorandum request the submission of contingency plans for any high level 

business function relying on data processed through a mission critical 

computer system. The OIG felt that these suggestions and contributions 

would increase an overall understanding of the problem and facilitate staff 

involvement, helping to foster an agency-wide team effort. 

In another advisory memorandum to management, dated April 20, 

1999, the OIG identified the following two high risk conditions relating to the 

agency’s Y2K efforts: 

• The Y2K project team had not prepared or documented a 

comprehensive Year 2000 management plan. We suggested that 

the FEC 1) immediately complete and distribute the agency-wide 

comprehensive Y2K management plan, and 2) establish timely 

delivery dates for receiving crucial information from the division 

offices regarding Y2K preparation. Project management has not 

implemented the OIG suggestion to develop and document a 

comprehensive set of plans for the Y2K Project. 

April 1, 1999 - September 30, 1999 Page 15 
(Y2K Continued) 

• Y2K conversions have been made without the Y2K project team 

documenting the changes made to the programming code. It was 

suggested that the FEC should develop and follow standardized 

procedures requiring documentation for any and all program 

software changes. Documentation should identify the types of 

changes made in the programs, the location of the changes or new 

code, the location of bridge programs and the technique being used 

to convert dates between files, applications, and data exchanges. It 

was further suggested that the Y2K project team document all 

changes to the software programs. Management has not 

implemented the OIG suggestions to have agency programmers 

document their Y2K repairs to the internally developed 

programming code. 

The OIG has also kept the Commission apprised of the status of the 

Y2K project. In a memorandum to the Commission, dated July 20, 1999, the 

OIG identified conditions which continued to pose a high risk to the FEC as a 

result of the Y2K problem. We offered our suggestions for mitigating those 

risks: 

• According to the agency’s May 1999 Y2K progress report to OMB, 

as amended, the internal communications network is only 50% Y2K 

April 1, 1999 - September 30, 1999 Page 16 
(Y2K Continued) 

compliant and not scheduled to be completely renovated until 

November 30, 1999. This late renovation will allow little time for 

corrective action in the event that further efforts are proven 

necessary from either renovation or testing. The OIG suggested 

that the Commission follow guidelines developed by the General 

Accounting Office (GAO) in its publication, “Year 2000 Crisis: A 

Testing Guide” for designing a comprehensive Y2K testing plan. To 

date, no comprehensive Y2K testing plan has been distributed. 

• Inadequate validation for Y2K renovations reduces the assurance 

that systems will operate properly when called upon to process 

critical future dates after January 1, 2000. Future progress reports 

should explain whether project management will contract for 

services to validate its Y2K testing techniques and procedures, and 

if not, then explain how validation of Y2K testing for the agency’s 

mission critical systems is to be achieved. Although, agency 

contracts show that the FEC has acquired verification of 

approximately 1.5 million lines of internally developed computer 

programming code, and issued purchase orders to perform 

April 1, 1999 - September 30, 1999 Page 17 
(Y2K Continued) 

independent verification of Y2K renovations on a limited selection of 

internal hardware and software; no evidence has been provided to 

indicate either independent validation of testing procedures or 

verification of system testing results. 

• The FEC had no documented business continuity and contingency 

plan. Some assurance that compensating controls are in place to 

offset the risk associated with late Y2K renovation and testing of 

mission critical systems could be obtained, if the Y2K project team 

would develop a business continuity and contingency plan. We 

understand that an internal memorandum was distributed during 

October 1999, to agency division directors requesting that each 

division with a core mission critical responsibility submit detailed 

contingency plans. In addition, project management has recently 

submitted to the U.S. Office of Management and Budget a high level 

contingency plan, including a Day One plan. 

• Whether or not Y2K compliance for embedded chip technology is 

being adequately addressed by the Y2K project team could not be 

determined from reading the agency’s progress report. For the next 

April 1, 1999 - September 30, 1999 Page 18 
(Y2K Continued) 

progress report, it was suggested that project management describe 

the specific methods used to assess compliance for embedded chip 

technology, the overall efforts taking place to repair non-compliant 

chips, and the details regarding the impact of embedded chip 

technology on agency equipment and building facilities. Based on 

documentation and information received by the OIG during October 

1999, it appears that the Y2K team has obtained sufficient evidence 

to provide a reasonable assurance that embedded chip technologies, 

including building and infrastructures, will not present a problem 

for the FEC on January 1, 2000. 

Involvement by Federal Inspectors General in their agency’s Year 2000 

(Y2K) renovation projects, we believe illustrates the latest accomplishment 

by the IG community in achieving reengineering goals established for the 

1990’s. The IG audit community has turned from its traditional role as a 

messenger, primarily reporting on past practices, to becoming an informed 

intermediary, communicating the current status of agency affairs to agency 

heads. This was recently demonstrated at the Federal Election Commission. 

The Chairman of the FEC asked the OIG, along with the Director of 

Data Systems Development Division to discuss at an open meeting, the 

April 1, 1999 - September 30, 1999 Page 19 
(Y2K Continued) 

agency’s progress in the renovation of its computer technology to be Y2K 

compliant. Public meetings at the FEC are presided over by six 

Commissioners, who are appointed by the President of the United States and 

confirmed by the Senate. Open meetings at the FEC closely resemble the 

proceedings of a public Congressional hearing. The seating layout is similar 

to that found in a Congressional hearing room, including space reserved for 

media coverage. Additionally, agenda documents are submitted in advance 

and all open meetings are taped with copies of the tapes available to the 

public. 

This was the setting on September 16, 1999 when the IG and the 

Director of DSDD gave testimony before the Commissioners, appraising 

progress in the FEC’s Y2K renovation project. The Director of DSDD 

expressed confidence that the agency’s Y2K problems would be fully resolved. 

However, the Director also acknowledged that major tasks remain before the 

FEC would be Y2K compliant. For instance, the Director reported that 

system testing of mission critical computer systems would not be completed 

before November 30, 1999. 

Contrary to the positive assurances expressed by the Director of 

DSDD, the IG reported that based on evidence gathered during a recent OIG 

audit with results from a follow-up evaluation, the FEC remained highly 

April 1, 1999 - September 30, 1999 Page 20 
(Y2K Continued) 

vulnerable to the Y2K problem. Although, the IG recognized and applauded 

accomplishments by project management, it was pointed out that in light of 

the agency’s slow progress in testing computer systems; performance criteria 

established to claim Y2K compliance for mission critical systems with 

external data exchanges most likely could not be completed prior to late 

December 1999. 

Consequently, at the conclusion of the September 16th meeting, the 

Commissioners made an impromptu decision to have the IG return and 

discuss the agency’s progress at another open meeting, which has been 

scheduled for November. Hopefully, in this new role, the IG community can 

help prevent high risk conditions from becoming future OIG audit report 

findings. 

April 1, 1999 - September 30, 1999 Page 21 
AUDITS 

TITLE: Agency Year 2000 Renovations

ASSIGNMENT #: 98-08

RELEASE DATE: May, 1999

PURPOSE: The primary objectives of our audit were to 1)

verify the reported progress of the FEC’s Y2K renovation project; and 2)

evaluate compliance with applicable laws & regulations.

Detailed information concerning this audit can be found in the Y2K 

section of this report, pages 11 to 15. 

April 1, 1999 - September 30, 1999 Page 22 
AUDIT FOLLOW-UP 

TITLE: Review of the Commission’s Employee 

Appraisal Process 

ASSIGNMENT #: 97-02 

RELEASE DATE: January 1998 

(audit report) 

PURPOSE: The OIG continued to follow-up on the status of the 

four audit recommendations contained in the audit report on the 

Commission’s employee appraisal process. The OIG conducted the first audit 

follow-up in a prior reporting period to determine whether corrective action 

had been taken by management to resolve the audit findings and 

recommendations. The results of the prior audit follow-up were issued to the 

Commission on March 31, 1999. The OIG concluded, in our memorandum to 

the Commission in March of 1999, that the Personnel Office had not resolved 

the four audit recommendations contained in the January 1998 audit report. 

The objectives of the audit of the Commission’s employee appraisal 

process were to 1) determine whether the Commission’s employee appraisal 

process was in compliance with applicable Federal regulations and 

Commission Personnel Instructions; and 2) determine whether the 

Commission’s monetary incentive process was in compliance with applicable 

Federal regulations and Commission Personnel Instructions. 

April 1, 1999 - September 30, 1999 Page 23 
(Audit Follow-up Continued) 

The audit addressed compliance with the Commission’s Personnel 

Instructions and Federal regulations as they related to the employee 

appraisal process. The audit included a review of employee performance 

folders and performance plans. The OIG also verified that appraisals were 

properly reviewed and submitted timely to the Personnel Office. In addition, 

the audit included a review of performance and incentive awards to verify 

that the awards were granted in accordance with Commission policy and 

Federal regulations and processed in a timely manner. The audit report 

included four recommendations to the Personnel Office to address 

weaknesses in the Commission’s employee appraisal process. 

The OIG contacted the Personnel Office to determine whether the 

Personnel Office had implemented the audit recommendations. The OIG 

concluded that the Personnel Office had implemented one of the four 

recommendations. 

The audit report included a finding that the retention of performance 

related documents contained in the employee performance files (EPFs) 

exceeded the time period allowed by the Code of Federal Regulations (CFR). 

The OIG recommended that the Personnel Office retain performance related 

documents in accordance with the CFR and amend a Personnel Instruction on 

April 1, 1999 - September 30, 1999 Page 24 
(Audit Follow-up Continued) 

EPF procedures to comply with the CFR. The OIG inspected the employee 

performance files (EPFs) and the revised Personnel Instruction and 

confirmed that the Personnel Office had implemented the audit 

recommendation. 

The Personnel Office has not implemented the remaining three audit 

recommendations that have been outstanding since January 1998. The OIG 

recognizes that the Personnel Office has experienced a significant staff 

turnover within the past two years. In addition, one of the three audit 

recommendations which remain outstanding would require negotiations and 

an amendment to the National Treasury Employees Union/FEC Labor 

Management Agreement. The OIG will continue to monitor the status of the 

recommendations and is encouraged with the Personnel Office’s commitment 

to correct the weaknesses identified by the OIG. 

The OIG intends to provide the Commission and the Personnel Office 

the results of our continued audit follow-up. 

April 1, 1999 - September 30, 1999 Page 25 
(Audit Follow-up Continued) 

TITLE: Audit of the Commission’s Management of 

Desktop and Laptop Computers 

ASSIGNMENT # 97-03 

RELEASE DATE: January 1998 

PURPOSE: The audit follow-up was conducted to determine 

whether corrective action had been taken by management to resolve the 

audit findings and recommendations contained in the audit report on the 

Commission’s management of desktop and laptop computers. The audit 

report was released on January 14, 1998. 

The objectives of the audit of the Commission’s management of 

desktop and laptop computers were to 1) identify and evaluate the adequacy 

of internal controls over desktop and laptop computers; and 2) evaluate the 

procedures in place to ensure that computer equipment having an acquisition 

cost over $5,000 is capitalized and computer equipment with unit costs under 

$5,000 are supported. 

The audit was designed to address the adequacy of the FEC’s 

management of desktop and laptop computers and the accuracy and 

reliability of inventory listings which are used by the FEC to assess needs, 

support procurement action and manage and service the equipment. The 

April 1, 1999 - September 30, 1999 Page 26 
(Audit Follow-up Continued) 

audit also included a review of the adequacy of internal procedures used to 

identify and capitalize automated data processing (ADP) equipment. Manual 

or automated accounting procedures must ensure that all equipment with an 

acquisition cost over $5,000 must be capitalized and reported to the U.S. 

Department of Treasury. Equipment under $5,000 is expensed and reported 

as such to Treasury. 

The audit report included two recommendations to improve the 

management of ADP equipment. First, the OIG recommended that divisions 

take an annual physical inventory of laptop computers and forward the 

results to the Data Systems Development Division (DSDD) to be reconciled 

with the DSDD’s inventory database. The OIG recommended that the 

DSDD be responsible for documenting the results of the inventory on an 

annual basis. Second, the OIG recommended that written policies and 

procedures should be established for the accountability and control of 

personal computer property. The OIG recommended that the policies and 

procedures should be disseminated to all agency personnel engaged in 

personal property management functions and that appropriate policies, 

procedures, and training are provided to involved personnel. 

The audit follow-up consisted of correspondence with the DSDD and 

the inspection of documents to determine whether corrective action had been 

April 1, 1999 - September 30, 1999 Page 27 
(Audit Follow-up Continued) 

taken to resolve the audit findings and recommendations. The OIG 

acknowledges the efforts of the DSDD to address the OIG’s audit 

recommendations. The DSDD worked on accounting for the Commission’s 

laptops and prepared and issued guidelines on the management of desktop 

and laptop computers. However, the OIG believes additional steps are 

necessary by the DSDD in order for the OIG to close the two 

recommendations. 

The DSDD provided the OIG with documentation of their completed 

inventory of laptop computers for the audit follow-up. The OIG reviewed the 

listing and concluded that several Commission laptops that had been retired 

were not reflected on the inventory list. The retired laptops are Commission 

property and according to the DSDD are stored in a secure area. The OIG 

believes the inventory listing should include a complete accountability of all 

Commission owned laptop computers. Therefore, the OIG concluded that the 

DSDD had not adequately implemented the recommendation. 

The DSDD also provided the OIG with a copy of a policies and 

procedures document titled “Management of Desktop and Laptop Computers” 

which was issued by the DSDD to the head of each Commission division. The 

policies and procedures address the accountability and control of personal 

computer property. The OIG reviewed the policies and procedures and found 

April 1, 1999 - September 30, 1999 Page 28 
(Audit Follow-up Continued) 

that the document does not address procedures on two important areas that 

were addressed by the OIG in the audit report, lost or stolen equipment and 

obsolete equipment. The policies and procedures should include the 

Commission’s procedures for employees to report lost or stolen equipment and 

guidance on the procedures for disposing of obsolete or excess equipment. 

Therefore, the OIG did not close the recommendation. 

The OIG intends to provide the Commission and the DSDD the results 

of the audit follow-up. 

April 1, 1999 - September 30, 1999 Page 29 
(Audit Follow-up Continued) 

TITLE: Audit of the Commission’s Management of 

Computer Software 

ASSIGNMENT # 98-05 

RELEASE DATE: March 1999 

(Audit Report) 

PURPOSE: The audit follow-up was conducted to determine 

whether corrective action had been taken by management to resolve the 

audit finding and recommendations contained in the audit report on the 

Commission’s management of computer software. The audit report was 

released on March 31, 1999. 

The objectives of the audit of the Commission’s management of 

computer software were to 1) verify that Commission computer software 

was in compliance with applicable copyright laws and Commission policies 

and procedures; 2) determine that adequate policies and procedures were in 

place to prevent unauthorized software use by Commission employees; and 3) 

ensure that adequate controls were in place to detect and prevent computer 

viruses. 

The audit included a review of computer software programs installed 

on Commission computers to ensure that software complied with applicable 

software copyright laws and Commission policies and procedures. The OIG 

April 1, 1999 - September 30, 1999 Page 30 
(Audit Follow-up Continued) 

reviewed the Commission’s policies and procedures related to computer 

software to determine whether adequate policies were in place to prevent 

unauthorized software use by employees. Lastly, a review of the 

Commission’s anti-virus software system was performed to ensure adequate 

controls were in place to detect and prevent computer viruses. The audit 

report released in March of 1999 contained one audit finding that controls 

needed to be strengthened to ensure the Commission’s computers are 

adequately protected against computer viruses. Two recommendations were 

directed to the Data Systems Development Division (DSDD) and one to the 

Accounting Office to strengthen controls. 

The audit follow-up consisted of correspondence with the DSDD and 

the inspection of documents to determine whether corrective action had been 

taken to resolve the audit finding and recommendations. In addition, a 

review of information received by the Accounting Office was performed to 

determine whether existing controls in the Accounting Office would be 

sufficient to address our recommendation. 

The OIG concluded that the DSDD had not completely resolved the 

two audit recommendations based on the inspection of documents and 

correspondence with the DSDD. The OIG recognizes the efforts of the 

DSDD to address the recommendations and should be commended for their 

April 1, 1999 - September 30, 1999 Page 31 
(Audit Follow-up Continued) 

work. However, the actions taken were not sufficient to resolve the audit 

finding and recommendations. Therefore, the two recommendations remain 

open. 

The OIG concluded that the Accounting Office’s response to the audit 

recommendation to strengthen controls adequately addressed the weakness 

regarding anti-virus software and several Accounting Office computers. 

Therefore, the recommendation directed to the Accounting Office was closed. 

The DSDD is involved in a project to install the latest anti-virus 

software and the current virus data files on all Commission desktop and 

laptop computers with an anticipated completion date of September 30, 1999. 

In order to close a recommendation, the OIG must verify that the DSDD has 

implemented the recommendation prior to the close of the reporting period. 

Therefore, the OIG was unable to verify that the DSDD had installed antivirus software and the current virus data files on all Commission desktop and 

laptop computers prior to the close of the reporting period ending September 

30, 1999. The OIG plans to review the DSDD’s implementation of the audit 

recommendation during our next reporting period. The recommendation will 

be closed upon verification that anti-virus software and the current virus 

data files have been installed on all desktop and laptop computers. 

April 1, 1999 - September 30, 1999 Page 32 
(Audit Follow-up Continued) 

The DSDD also issued a procedures memorandum titled “FEC 

Computer Virus Protection Guidelines” to several DSDD staff to help ensure 

that the Commission’s computers are protected from computer viruses. 

However, in order to ensure that the Commission’s computers are adequately 

protected, it is imperative that all Commission employees are aware of their 

responsibilities to protect the Commission’s computers from computer 

viruses. Therefore, the OIG believes the DSDD should issue guidelines to all 

staff. The DSDD has stated their intentions to issue guidelines to all staff 

during the next reporting period which the OIG will verify in order to close 

the recommendation. 

The OIG intends to provide the Commission, the DSDD, and the 

Accounting Office with the results of the audit follow-up. 

April 1, 1999 - September 30, 1999 Page 33 
INVESTIGATIONS 

No new investigations were opened during this reporting period. 

April 1, 1999 - September 30, 1999 Page 34
ADDITIONAL OFFICE OF INSPECTOR GENERAL ACTIVITY 

All legislation, as compiled by the Commission’s Congressional Affairs 

Office, was reviewed by the Inspector General, as required by the Inspector 

General Act of 1978, as amended. The Inspector General also routinely reads 

all Commission agenda items and attends Finance Committee Meetings. 

During this reporting period, a peer review of the office was conducted 

by the Appalachian Regional Commission’s (ARC) Office of Inspector General. 

A peer review, by definition, is a review of an audit organization by an 

organization not affiliated with the audit organization being reviewed. The 

objectives of a peer review are to foster quality audits by OIGs through an 

independent assessment of their audit functions. This is accomplished by 

determining whether 1) an effective internal quality control system has been 

established in the office; and 2) established policies and procedures and 

applicable Government Auditing Standards, as promulgated by the 

Comptroller General of the United States, are being followed in practice. 

The scope of this review included 1) selected reports and working 

papers for audits completed during the past two years; 2) audit universe and 

planning documents; 3) documents describing auditor experience and 

training, security practices over audits and related records; and 4) policies 

and procedures used to carry out the audit function. Additionally, OIG staff 

April 1, 1999 - September 30, 1999 Page 35 
were interviewed to verify the actual practices of audit control and follow-up 

procedures. 

The peer review was completed in accordance with the bylaws for peer 

review evaluations adopted by the Inspectors General of Designated Agencies 

of the Executive Council on Integrity and Efficiency. The peer review 

conducted by ARC’s OIG concluded that a system of internal controls is in 

place and operating effectively and that all audits performed by the office are 

being carried out in accordance with GAO Government Auditing Standards. 

In addition, the office was found to possess the necessary professional 

requirements to perform our duties. Furthermore, all continuing education 

requirements have been met. 

The Inspector General served on the evaluation panel for the Inspector 

General position in the Office of Inspector General, National Archives and 

Records Administration. The heads of agencies experiencing a vacancy in the 

IG position will, on occasion, contact the Vice Chair of the Executive Council 

on Integrity and Efficiency requesting assistance from the community in the 

selection process. Thirty-five applicants were evaluated by the panel. 

As an ongoing project, the Special Assistant to the Inspector General 

performed two unannounced cash counts of the FEC’s imprest fund (#OIG99-02 and #OIG-99-03). The imprest fund consists of three drawers totaling 

April 1, 1999 - September 30, 1999 Page 36 
$2,500. The results of the cash counts revealed no overage or underage and 

all cash was accounted for. In addition, our reviews revealed that cash 

disbursements from the imprest fund were reasonable and consistent with 

FEC imprest fund policy. 

April 1, 1999 - September 30, 1999 Page 37 
ECIE AND PCIE ACTIVITY 

The executive Council on Integrity and Efficiency was established by 

Executive Order on May 11, 1992. It consists of Designated Federal Entity 

Inspectors General and representatives of the Office of Government Ethics, 

the Office of Special Counsel, the Federal Bureau of Investigation and the 

Office of Management and Budget. 

The Inspector General (or staff) attending the following training, 

programs and/or conferences during this reporting period: 

• IGATI - Fraud Auditing - Theory and Application 

• Management Concepts - The Professional Woman Manager 

• Management Concepts - Introduction to Federal Contracting 

• Management Concepts - Writing Winning Reports 

• PCIE Professional Development Forum - The Aftermath of the 

Supreme Court’s Decision in NASA v. FLRA 

• U.S. Department of Education - Moving to the next GPRA 

Level - Using the Plans for Decision Making 

• ECIE - Formal and Informal Meetings 

• PCIE Professional Development Forum - The Honorable 

Christopher Shays 

• PCIE Professional Development Forum - The Honorable 

George Nethercult 

• PCIE/ECIE - Joint Annual Meeting 

April 1, 1999 - September 30, 1999 Page 38 
IG ACT REPORTING REQUIREMENTS PAGE 

Reporting requirements required by the Inspector General Act of 1978, as amended by 

the Inspector General Act Amendments of 1988 are listed below: 

Section 4(a)(2) Review of Legislation-----------------------------------------------35 

Section 5(a)(1) Significant Problems, Abuses, and 

Deficiencies---------------------------------------------------------None 

Section 5(a)(2) Recommendations with Respect to 

Significant Problems, Abuses, and 

Deficiencies---------------------------------------------------------None 

Section 5(a)(3) Recommendations Included in Previous 

Reports on Which Corrective Action Has 

Not Been Completed-----------------------------------------------42 

Section 5(a)(4) Matters Referred to Prosecutive 

Authorities---------------------------------------------------------None 

Section 5(a)(5) Summary of Instances Where Information 

was Refused-------------------------------------------------------None 

Section 5(a)(6) List of Audit Reports----------------------------------------------22 

Section 5(a)(7) Summary of Significant Reports------------------------------22 

Section 5(a)(8) Questioned and Unsupported Costs--------------------------40 

Section 5(a)(9) Recommendations that Funds be put 

to Better Use--------------------------------------------------------41 

Section 5(a)(10) Summary of Audit Reports issued before 

the start of the Reporting Period for which 

no Management Decision has been made----------------N/A 

Section 5(a)(11) Significant revised Management Decisions-------------N/A 

Section 5(a)(12) Management Decisions with which the 

Inspector General is in Disagreement-------------------None 

April 1, 1999 - September 30, 1999 Page 39 
TABLE I 

INSPECTOR 

WITH 

DOLLAR VALUE (in thousands) 

QUESTIONED UNSUPPORTED 

NUMBER COSTS COSTS 

GENERAL ISSUED REPORTS 

QUESTIONED COSTS 

A. For which no management 0 0 [0] 

decision has been made by 

commencement of the reporting 

period 

B. Which were issued during the 0 0 [0] 

reporting period 

Sub-Totals (A&B) 0 0 [0] 

C. For which a management 0 0 [0] 

decision was made during 

the reporting period 

(i) Dollar value of disallowed 0 0 [0] 

costs 

(ii) Dollar value of costs 0 0 [0] 

not disallowed 

D. For which no management 0 0 [0] 

decision has been made by the 

end of the reporting period 

E. Reports for which no management 0 0 [0] 

decision was made within 

six months of issuance 

April 1, 1999 - September 30, 1999 Page 40 
TABLE II 

INSPECTOR 

RECOMMENDATIONS THAT FUNDS BE PUT TO BETTER USE 

NUMBER DOLLAR VALUE 

(in thousands 

GENERAL ISSUED REPORTS WITH 

A. For which no management 

decision has been made by 

the commencement of the 

reporting period 

B. Which were issued during 

the reporting period 

C. For which a management 

decision was made during 

the reporting period 

(i) dollar value of 

recommendations 

were agreed to by 

management 

based on proposed 

management action 

based on proposed 

legislative action 

(ii) dollar value of 

recommendations 

that were not agreed 

to by management 

D. For which no management 

decision has been made by 

the end of the reporting period 

E. Reports for which no 

management decision 

was made within six months 

of issuance 

0 0 

0 0 

0 0 

0 0 

0 0 

0 0 

0 0 

0 0 

0 0 

April 1, 1999 - September 30, 1999 Page 41 
TABLE III 

SUMMARY OF AUDIT REPORTS WITH CORRECTIVE ACTIONS 

OUTSTANDING FOR MORE THAN SIX MONTHS 

Recommendations 

Audit Report 

Report Issue 

Number Date 

97-02 01/98 

97-03 01/98 

98-05 03/99 

Management 

Response 

Date 

01/98 

03/98 

03/99 

Number Closed Open 

4 1 3

2 0 2

3 1 2

April 1, 1999 - September 30, 1999 Page 42
April 1, 1999 - September 30, 1999 Page 43