Federal Election Commission 

Office of Inspector General 

Review of Outstanding Recommendations 

As of March 2018 

April 2018 

Assignment No. OIG-18-02 
Office of Inspector General’s

Review of

Outstanding Recommendations as of

March2018

 Summary of Review

The Office of Inspector General (OIG) semiannually provides to the Commission a report on the 

status of outstanding recommendations. The OIG provides these status reports as of February and 

August of each year. For this reporting period, we extended our review period to the month of 

March due to the extensive move of the agency’s headquarters that started in February of this 

year. 

We continued our review of the previous seven audits and inspections with outstanding 

recommendations as of August 2017. Collectively, these 7 audits and inspections had 55

outstanding recommendations that required follow-up for this review period of September 2017 

to March 2018. Based on the results of the follow-up review, the OIG was only able to close 1

of the 55 outstanding recommendations, which was based on management’s acceptance of risk.

OIG Concerns

The overarching concern of the OIG is the lack of governance accountability for ensuring that

management enforces the required internal control to assure outstanding recommendations that 

are intended to improve agency programs and prevent fraud, waste, and abuse are timely and 

sufficiently implemented. This management control is mandated by the Office of Management 

and Budget’s (OMB) Circulars A-123 and A-50, and also is required by the Federal Election 

Commission’s (FEC) own policy, Commission Directive 50: Audit Follow-up. Governance must 

hold management accountable for promptly addressing outstanding recommendations to 

decrease the agency’s risk exposure, effectively manage resources, and ensure cost control. Per 

OMB’s Circular A-123, deficiencies reported “...through internal review or by an external audit, 

should be evaluated and corrected. A systematic process should be in place for addressing 

deficiencies.”
Office of Inspector General’s Review of Outstanding Recommendations as of March 2018 2 | Page

Table Summary of Results

The table below summarizes the progress made by FEC management since the OIG’s last 

reporting period and the total outstanding recommendations as of March 2018.

OIG Audits/Inspection

Total Outstanding 

Recommendations 

as of August 2017

Total Closed Total Open as of 

March 20181

Audit of the Commission’s 

Property Management Controls - 

8 years outstanding

1 12 0

2010 Follow-up Audit of Privacy 

and Data Protection

7 years outstanding 

25 0 25

2010 Follow-up Audit of 

Procurement and Contract 

Management

6 years outstanding

1 0 1

Inspection of the FEC’s

Disaster Recovery Plan and

Continuity of Operations Plans

5 years outstanding

9 0 9

Audit of the FEC’s Office of 

Human Resources 

4 years outstanding

5 0 5

Inspection of FEC’s Compliance 

with FMFIA/OMB A-123 

3 years outstanding

5 0 5

Audit of the FEC Telework 

Programs 

1 year outstanding

9 0 9

Total Outstanding Recommendations 54

 1 Column numbers may include recommendations that management has disagreed with or has not adequately 

implemented, and the OIG concludes that these recommendations are still open.

2 The remaining recommendation was closed due to the Chief Information Officer accepting the risk of not 

implementing the OIG’s recommendation.
Office of Inspector General’s Review of Outstanding Recommendations as of March 2018 3 | Page

Audit Follow-up Meetings/Communications

Closed Audits/Inspections3

A. Audit of the Commission’s Property Management Controls

The remaining outstanding recommendation for the Audit of the Commission’s Property 

Management Controls (Property Audit) is related to the Office of the Chief Information 

Officer’s (OCIO) inventory records for cellular devices. The OIG has followed up on 

this recommendation since the release of the report in March of 2010, and each follow-up 

review has noted several issues with OCIO’s inventory records. In our August 2017 

report, the OIG expressed to the Commission our concerns regarding the risks to agency 

assets based on OCIO’s current inventory processes. Specifically, we stated that the 

failure to adequately record assets causes the agency to have incomplete inventory 

records and greatly exposes the agency to potential theft without detection from 

management, as having inadequate inventory records prevents proper safeguarding of the 

physical asset.

Having reviewed the OCIO’s inventory records and 

processes for the past eight years and reporting on the same 

weaknesses during each review with no major 

improvements or agreements from management to revise its 

processes, on March 12, 2018 the OIG issued a 

Management Risk Acceptance Memorandum to the 

Commission and the Chief Information Officer (CIO). The 

memorandum requested that the CIO confirm that the OCIO accepts the risk of not 

implementing the OIG’s recommendation, and the CIO signed to accept the risk. See the 

Management Risk Acceptance Memorandum and signed letter by the OCIO as an 

attachment to this report. Therefore, the Property Audit has been closed out by the OIG. 

However, the recommendation may be re-opened upon receipt of any new information to 

improve the FEC’s processes in this area.

 3 An audit or inspection is closed when the OIG determines that all applicable recommendations have been 

adequately addressed and/or management has determined that it will accept the risks of not implementing the OIG’s 

recommendation. 

The Chief Information 

Officer has accepted 

the risk of inadequate 

agency inventory 

records for agency 

issued cellular devices
Office of Inspector General’s Review of Outstanding Recommendations as of March 2018 4 | Page

Open Audits/Inspections

B. 2010 Follow-up Audit of Privacy and Data Protection

For the 2010 Follow-up Audit of Privacy and Data Protection (Privacy Audit), the OIG’s 

Review of Outstanding Recommendations as of August 2017 report identified 25 open 

recommendations. For this review period, the Privacy Team 

noted that “Although OGC is working with OCIO on 

completing these outstanding recommendations, we do not 

currently have anything to update. However, we are in the 

process of hiring an attorney whose responsibilities will be 

entirely devoted to FOIA and the Privacy Act. We believe that 

with that position established and filled, the Agency will be able 

to move rapidly towards completion.” As the Privacy Team had 

no updates for this follow-up period, the 25 recommendations 

remain outstanding. 

C. 2010 Follow-up Audit of Procurement and Contract Management

The 2010 Follow-up Audit of Procurement and Contract Management was issued in June 

2011. The OIG’s Review of Outstanding Recommendations as of February 2017 report 

identified only one open recommendation related to the updated Directive 66, which is 

the overarching agency-wide policy for procurement and acquisitions. This one 

recommendation is still open for this follow-up review period.

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

The Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

(COOP Inspection) report was released in January 2013. The OIG’s Review of 

Outstanding Recommendations as of August 2017 report identified nine outstanding 

recommendations. The Acting Deputy Chief Information Officer of Operations provided 

a status update for the outstanding recommendations. The OIG reviewed the information 

provided and conducted some sample testing. The results are as 

follows: 

Sample Verification

As the FEC has made the determination to leverage the agency’s 

Telework Program for executing the agency’s COOP, the OIG 

selected 32 people from the OCIO’s COOP listing of Key 

Personnel to verify if these individuals would be capable of 

complying with their designated COOP role based on the 

There has been no 

progress from the 

Privacy Team on

outstanding 

recommendations 

since February 2015.

A critical 

management level 

position has not 

been properly 

equipped to 

perform COOP 

duties
Office of Inspector General’s Review of Outstanding Recommendations as of March 2018 5 | Page

Telework Program. 

Out of the 32 selected, the OIG received a response from 16 people. Verification was 

performed on the 16 responses the OIG received, and the following was noted:

• 6 of the 16 Key Personnel, including a critical management level position, have

not been provided an agency tablet necessary to perform their COOP duties; and

• 1 of the 16 Key Personnel listed was issued a tablet but has not been approved for 

telework; therefore, the ability of this person being able to work from home to 

carry out COOP responsibilities has not been properly verified (see second bullet 

point in next section). 

COOP Training Review 

The OIG reviewed the planned annual COOP training and noted the following:

• The FEC does not have an annual testing exercise scheduled for the COOP plan to 

ensure Key Personnel are aware and capable of carrying out their duties.

• The FEC’s plan to use unscheduled telework during instances of inclement 

weather to support periodic testing of the COOP plan is insufficient:

o The scenario to support testing would not be an unplanned event.

o Unscheduled telework is optional rather than mandatory for all COOP Key 

Personnel based on OPM guidance during inclement weather.

o All COOP Key Personnel do not participate in the FEC’s telework 

program.

o The Crisis Management Team is not required to test the call-tree process 

during unscheduled telework, which should include staff, contractors, and 

vendors, to ensure the appropriate personnel can be reached via the correct 

contact information on record.

o COOP devices are not always used or mandatory when exercising the 

option of unscheduled telework to ensure proper network connection and 

functionality.

o Assessment Reports are not developed or reviewed to ensure the agency’s 

current COOP process is adequate.

It has been reported to the Commission for almost 14 years that the agency is operating 

without an approved and tested contingency plan to ensure that in the event of a local or 

agency specific disaster, the Commission would have the ability to continue normal business 

operations within a reasonable timeframe. Based on the OIG’s above reviews and many of 

the outstanding recommendations being extended due to further actions needed from 

management, the nine recommendations remain open. 
Office of Inspector General’s Review of Outstanding Recommendations as of March 2018 6 | Page

E. Audit of the FEC’s Office of Human Resources 

The Audit of the Federal Election Commission’s Office of Human Resources (OHR

Audit) report was issued in July 2013. The OIG’s Review of Outstanding 

Recommendations as of August 2017 report identified five open recommendations for the 

OHR audit report. The OIG sent an email to the Director of OHR in January 2018 

inquiring about the status of the five outstanding audit recommendations as well as to 

discuss any additional corrective actions since the last follow-up review was conducted in 

August 2017. The OIG did not receive any updates. Therefore, the five outstanding 

recommendations will remain open for this follow-up period. 

F. Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123

The Inspection of FEC’s Compliance with FMFIA/OMB Circular A-123 (A-123 

Inspection) was released in June 2014. The OIG’s Review of Outstanding 

Recommendations as of August 2017 report identified five open recommendations for the 

A-123 Inspection report. Since the August 2017 follow-up review period, the Office of 

the Chief Financial Officer (OCFO), in cooperation with the FEC A-123 Task Force and 

the Senior Management Council (SMC), drafted the FEC’s initial risk profile which is a 

new requirement related to A-123. The OIG notes that other OMB requirements related 

to submitting Enterprise Risk Management (ERM) and Fraud Reduction plans by June 4, 

2017, were postponed and a new date has not yet been issued. The OIG will be unable to 

close the remaining five recommendations until the FEC fully implements ERM and 

fraud risk assessments into the internal control reporting process, and the OIG can verify 

that the new processes are operating effectively. Therefore, the five outstanding 

recommendations remain open for this follow-up review period.

G. Audit of the FEC’s Telework Programs

The Audit of the FEC’s Telework Programs (Telework Audit) was released in June 2016. 

The OIG’s Review of Outstanding Recommendations as of August 2017 report identified 

nine open recommendations for the Telework Audit report. The OIG contacted the 

Telework Management Official and was informed there are no additional updates to 

report at this time. Therefore, the nine outstanding recommendations remain open for this 

follow-up review period.
Office of Inspector General’s Review of Outstanding Recommendations as of March 2018 7 | Page

Background

As required by the Inspector General Act of 1978, as amended, the OIG is responsible

for conducting audits of the FEC’s programs and operations. In addition to conducting 

and supervising audits, the OIG also has the responsibility to conduct audit follow-ups

to ensure that management has effectively implemented OIG recommendations. Audit

follow-up, including the timely implementation of audit recommendations by FEC

management, is required by Office of Management and Budget Circular A-50, Audit 

Follow-up, as revised, and FEC Directive 50: Audit Follow-up.

At the conclusion of each OIG audit and inspection, it is management’s responsibility to 

develop a corrective action plan (CAP). The CAP identifies the plan management has

developed to address the OIG’s findings and recommendations. The CAP should detail the

following:

1. assignment of Audit Follow-up Official, who is responsible for overseeing the 

corrective action;

2. OIG finding(s);

3. OIG recommendation(s);

4. detailed corrective action to implement the OIG’s recommendation(s);

5. FEC staff person with responsibility to implement each task; and

6. expected completion dates.

Once management drafts the CAP, the OIG then reviews the CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s 

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the

final CAP to the Commission with a courtesy copy to the OIG.

FEC Directive 50 requires management to:

(3) Conduct regular meetings with the Inspector General throughout the year to followup on outstanding findings and recommendations, and include reports of these meetings 

in the written corrective action plan and semi-annual reports required to be presented to 

the Commission...;

In order to work effectively with FEC management in adhering to FEC Directive 50, 

and to ensure continuous monitoring and adequate and timely audit resolution, the

OIG communicates with management at least semiannually to discuss the status of

outstanding OIG recommendations. If management has implemented any corrective

action(s), the OIG schedules a meeting with management to discuss the

implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (e.g., new/updated policies, procedures, and processes to improve

internal controls).
Office of Inspector General’s Review of Outstanding Recommendations as of March 2018 8 | Page

To provide management with timely feedback and the results of our review prior to 

management’s reporting deadlines to the Commission in May and November, the OIG 

reports on our review of outstanding recommendations as of February and August of each 

year. The semiannual meetings are also intended to assist the audit follow-up official in 

following provisions 4 through 6 of Directive 50, which are listed as follows:

(4) Respond in a timely manner to all audit reports;

(5) Engage in a good faith effort to resolve all disagreements; and

(6) Produce semi-annual reports that are submitted to the agency head.

The official status (open/closed) of OIG recommendations is determined by the OIG 

once the OIG has verified that management has adequately implemented the corrective 

actions. The Inspector General can also make a decision to close recommendations or 

seek resolution from the Commission for recommendations where the OIG and 

management disagree. Lastly, the number of outstanding recommendations is also 

reported to the Commission and Congress in the OIG’s Semiannual Reports to Congress.
FEDERAL ELECTION COMMISSION 

WASHINGTON , D.C. 20463 

Office of Inspector General 

MEMORANDUM 

TO: Alec Palmer 

Staff Director\Chief Information Officer 

The Commission 

J. Cameron Thurber James ;·~~~i;:,!; 'ignedbyJame, 

ON: c=US, o=U.S. Government, Deputy Inspector General h b OU= C, cn=James lhurber T ur err.: . ~:'.~~~01803 12 11 :4806 

FROM: 

SUBJECT: Management Risk Acceptance Memorandum 

DATE: March 12, 2018 

The Office oflnspector General (OIG) released the Audit of the Commission's Property 

Management Controls (Property Audit) report in March 2010. Since that time, the OIG 

has consistently followed up with management on the outstanding recommendations to 

ensure all reported findings were adequately addressed. Eight years later, there is still 

one recommendation that has remained open since the initial report was released: 

Personal cellular device user information should be kept up to date and adjusted 

in a timely manner on the Information Technology Division's master inventory 

listing and the AT&T Premier website for employee separations and new 

assignment of devices (revised)1. 

This recommendation references the inadequate inventory records maintained by the 

Office of the Chieflnformation Officer (OCIO) for tracking and safeguarding agency 

issued cellular devices, currently iPhones. The issue of inadequate record keeping was 

first reported after the OIG reviewed the agency's records for the prior BlackBerry 

devices in 2009. These problems have remain consistent even through two separate 

upgrades to the use of iPhones for all staff. 

Each follow-up review of outstanding recommendations since 20 IO has reflected several 

repeat issues with the OCIO's inventory records. Our most recent review of agency 

inventory records for iPhones in August 2017 revealed the following issues: 

• iPhone devices missing from the master inventory listing; 

• devices logged as purchased according to vendor records but could not be 

accounted for on OCIO's master inventory listing; and 

1 The recommendation has been revised to reflect that the agency no longer uses BlackBerry devices. 
Office of Inspector General 

Management Risk Acceptance Letter

2

 OCIO’s inventory listing not reflective of all staff who are issued devices.

The OIG is concerned that if management does not have adequate record keeping of 

agency devices, the agency is exposed to the risk of fraud. Agency devices can be easily 

removed from inventory and go undetected for long lengths of time, making the device 

difficult to track and/or recover because management’s inventory records are not 

complete or consistently kept up to date.

We have reviewed management’s inventory process and records for cellular devices for 

the past eight years with no major improvements or agreements from management to 

revise its process. Therefore, pursuant to the OIG’s recommendation resolution process, 

the OIG requests signed confirmation from the Chief Information Officer that 

management accepts the level of exposed risk to the agency in accordance with their 

current inventory process in order for the OIG to close the current outstanding 

recommendation, specifically noting that management accepts the risk. To confirm

management’s acceptance of the risk regarding this recommendation, please sign, date,

and return the attached document to the OIG by March 21, 2018.

Thank you,

Attachment
::- Office of Inspector General 

Management Risk Acceptance Letter 

As the Federal Election Commission's Chieflnformation Officer (CIO), I confirm that 

my office, which is responsible for the tracking and safeguarding of agency issued 

cellular devices, accepts the risk of not implementing the Office of Inspector General's 

(OIG) recommendation reported in the March 2010 Audit of the Commission's Property 

Management Controls report: 

Personal cellular device user information should be kept up to date and adjusted 

in a timely manner on the Information Technology Division's master inventory 

listing and the AT&T Premier website for employee separations and new 

assignment of devices (revised). 

I believe the risk level is acceptable for the agency, and concur to have the OIG close the 

above recommendation, noting risk acceptance, with no further corrective action taken by 

the OCIO. 

Alec Palmer Date 

Chief Information Officer 

3 
or toll free at 1-800-424-9530 (press 0; then dial 1015)

Fax us at 202-501-8134 or e-mail us at oig@fec.gov

Visit or write to us at 1050 First Street, N.E., Suite 1010, Washington DC 20463

Federal Election Commission

Office of Inspector General

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to fraud, waste, abuse, 

and mismanagement of agency programs and operations. Individuals who contact the OIG can remain anonymous. 

However, persons who report allegations are encouraged to provide their contact information in the event additional 

questions arise as the OIG evaluates the allegations. Allegations with limited details or merit may be held in 

abeyance until further specific details are reported or obtained. Pursuant to the Inspector General Act of 1978, as 

amended, the Inspector General will not disclose the identity of an individual who provides information without the 

consent of that individual, unless the Inspector General determines that such disclosure is unavoidable during the 

course of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference.

Fraud Hotline

202-694-1015