Federal Election Commission 

Office of Inspector General

Final Report

Review of Outstanding Recommendations 

as of December 2013

February 2014

Assignment No. OIG-14-02
Office of Inspector General’s

Review of Outstanding Recommendations

December 2013 Report

The Office of Inspector General (OIG) semiannually provides to the Commission the status of 

outstanding recommendations. We reviewed seven audits and inspections that had a total of 96 

recommendations still outstanding. A total of 20 recommendations were closed. Three of the seven 

audits had no recommendations closed during this reporting period.

Noteworthy Accomplishments

• The OIG was able to close the last eight recommendations from the 2009 Follow-up of the 

Transit Benefit program

• The last outstanding recommendation from the 2011 Inspection of the Kastle Key Program 

was closed

• The final three open recommendations from the 2012 Quality Assessment of the Audit 

Division are closed

• Tremendous progress has been made by the OCFO under the leadership of the Acting CFO to 

close the outstanding recommendations from the 2011 Follow-up Audit of Procurement and 

Contract Management

OIG Concerns

• FEC needs to improve the accountability of management officials to ensure compliance with 

all aspects of Directive 50: Audit Follow-up

• Lack of progress by ITD in addressing outstanding recommendations for the Audit of the 

FEC’s Property Management Controls and the Inspection of the FEC’s Disaster Recovery 

Plan and Continuity of Operations Plan

More detailed information regarding the OIG concerns can be found in the remainder of this report 

along with the audit follow-up meetings/communications, report overview, and background. At the 

end of the report, we have attached the memo we sent to the Staff Director requesting a written 

statement accepting the risks involved in not implementing certain OIG recommendations. We have 

been informed by the Deputy CIO that these recommendations are not going to be implemented.
_________________________________________________________________________________

Office of Inspector General’s Review of Outstanding Recommendations December 2013 Report 2 | Page

Audit Division 

has strong 

commitment to 

a quality audit 

process. 

Audit Follow-up Meetings/Communications

Closed Recommendations

A. Audit Follow-up Review of the FEC’s Employee Transit Benefit Program

The June 2013 Review of Outstanding Audit Recommendations report identified eight (8)

open recommendations. During the period ending December 31, 2013, the OIG was able to 

confirm that standard operating procedures, frequently asked questions, and training to reflect 

the new FEC Directive 54 on the transit benefit program have been fully implemented. As a 

result, we were able to close the remaining eight (8) open recommendations. 

B. Inspection of the FEC’s Kastle Key Program

The June 2013 Review of Outstanding Recommendations report noted one outstanding 

recommendation for the Inspection of the FEC’s Kastle Key Program. During this follow-up 

review period, the OIG conducted follow-up testing on the remaining open 

recommendation to verify if the Administrative Services Division 

adequately implemented this recommendation. The follow-up results 

identified that the remaining recommendation was properly implemented, 

and all findings and recommendations for this inspection have been 

officially closed by the OIG. The OIG appreciates the ASD’s commitment to improving 

internal controls and their responsiveness to the OIG during the follow-up process.

C. Quality Assessment Audit of the Audit Division

The June 2013 Review of Outstanding Recommendations report noted Audit Division

management had taken corrective action that resulted in eight (8) of the 

eleven (11) recommendations being closed. However, there was not enough 

evidence to confirm that three (3) recommendations were fully implemented. 

Thus three (3) remained open. In November 2013, OIG met with the Audit 

Division Program Manager to determine if sufficient evidence was available 

related to the open recommendations. Based on the OIG review of 

supporting documentation, we were able to close the remaining three (3) 

recommendations. 

The OIG would like to recognize the Audit Division management for making it a priority of 

the division to address the findings included in the audit. We specifically would like to give 

special recognition to the Audit Division Program Manager for her dedication to promptly 

and adequately facilitate implementation of the audit recommendations. These efforts by the 

Audit Division have demonstrated a strong commitment to ensure a quality audit process.

Congratulations 

to ASD for their 

commitment to 

internal controls.
_________________________________________________________________________________

Office of Inspector General’s Review of Outstanding Recommendations December 2013 Report 3 | Page

ITD 

Management 

states no 

corrective 

actions 

completed.

Management 

should be 

more focused 

to ensure 

proper 

controls are 

in place.

Open Recommendations

A. Audit of the Commission’s Property Management Controls

The Audit of the Commission’s Property Management Controls (Property Audit) audit report 

was released in March 2010. The responsibility of implementing the audit recommendations

for the Property Audit is shared by the Administrative Services Division (ASD) and the 

Information Technology Division (ITD). The OIG has worked with the ASD Managers1 and 

the Deputy Chief Information Officer of Operations (Deputy CIO) to receive any updates 

regarding the implementation of audit recommendations. The Property Audit report identified 

36 audit recommendations; ASD is responsible for the implementation of 10 

recommendations, and the ITD 26 of the 36 recommendations. 

In the OIG’s June 2013 outstanding recommendations report, we reported that ASD 

completed the implementation of all the outstanding recommendations that were 

assigned to their office and the related findings have been officially closed. 

However, for several follow-up review periods, the OIG has expressed concern with 

ITD’s lack of progress in implementing their outstanding recommendations to 

improve their management controls over FEC property. The OIG contacted ITD 

management this review period, and was notified that management had not 

implemented any corrective actions since the last review period. 

As reported in our prior audit, ITD has a non personnel budget of approximately 

seven million dollars ($7 million), the largest budget (excluding personnel costs) in 

the entire agency, and the OIG believes that management should be more focused to 

ensure that the proper controls are in place to reduce the risk of any excessive cost, 

waste, or abuse to the agency and its programs. The OIG has reported in other audits

(2010 Follow-up Audit of Privacy and Data Protection; FEC’s Annual Financial

Statement Audits), that IT controls are not adequate, however ITD has failed to 

properly address the reported recommendations that are intended to improve the 

agency’s IT controls. 

ITD management has decided not to implement the remaining outstanding recommendations 

for the Audit of the Commission’s Property Management Controls. Therefore, a written 

response from the Staff Director confirming that management agrees to accept the risk 

of not implementing the remaining recommendations is required in order for the OIG to 

consider closing the remaining outstanding recommendations, and conclude audit follow-up. 

Please see attachment 1 for Management’s Acceptance of Risk for Outstanding 

Recommendations for a list of the seven outstanding recommendations along with their

potential risk to the agency if not implemented. 

 1 The OIG has worked with one acting ASD manager and two permanent ASD managers since the completion of the 

Property Audit due to frequent turnover in this position.
_________________________________________________________________________________

Office of Inspector General’s Review of Outstanding Recommendations December 2013 Report 4 | Page

CAP provided 

late to 

Commission.

OCFO making 

progress on 

addressing 

recommendations.

B. 2010 Follow-up Audit of Privacy and Data Protection

For the 2010 Follow-up Audit of Privacy and Data Protection, the OIG’s June 2013 report

identified 30 open recommendations. During this review period, the OIG noted that the CoChief Privacy Officer’s did not provide a CAP to the Commission in November 

2013 in accordance with Directive 50. The OIG contacted the Staff Director’s 

Office, who manages the CAPs submitted by FEC management to the Commission, 

and confirmed that a CAP was not provided. The OIG contacted the Co-Chief 

Privacy Officers via email on December 18, 2013 regarding audit follow-up, but did 

not receive a response. At the conclusion of the OIG’s review period, the Office of the Staff 

Director identified that the Privacy Team provided their November 2013 CAP update to the 

Commission on December 23, 2013, nearly a month late. 

The OIG reviewed the CAP submitted to the Commission and noted the memo stated that 

“...the Privacy Team closed recommendations 8b and 10c of the corrective action plan.”

However, the OIG reviewed and verified the closures of these two items during the prior 

review period and reported them closed in the June 2013 report. In addition, the Privacy 

Team stated that they, “...completed task items for recommendations 4a and 4c, and 

anticipates that these recommendations will soon be closed.” Due to the late submission and 

update of the Privacy CAP, the OIG was not able to review or verify the work completed. The 

OIG will review the items noted in the memo to the Commission regarding activity completed 

for recommendations 4a and 4c, and any additional corrective actions during the next review 

period.

C. 2010 Follow-up of Procurement and Contract Management

The June 2013 Review of Outstanding Recommendations report noted 17 outstanding 

recommendations. At the request of the Office of the Chief Financial Officer 

(OCFO), the OIG met with the acting Chief Financial Officer (CFO) and other 

OCFO staff members in November 2013 prior to their reporting to the 

Commission. The purpose of the meeting was to discuss the remaining outstanding 

audit recommendations, as well as additional progress made since the June 2013 

meeting. Subsequent to the meeting, the OIG reviewed documentation obtained 

during the meeting to support corrective actions related to some of the open recommendations

and updated the OIG comment section of the CAP. The OIG also met with the procurement 

contractor in December 2013 to discuss additional progress made since November and to 

confirm what recommendations would be officially closed by the OIG. As of December 31, 

2013, the OIG has closed an additional eight (8) recommendations. The OIG would like to 

note that the OCFO, under the leadership of the acting CFO, has been working 

diligently over the past year to address the outstanding recommendations. As a result, 20

of 29 total recommendations originally reported in the 2010 Follow-up Audit of Procurement 

and Contract Management have been closed over the past 12 months. 
_________________________________________________________________________________

Office of Inspector General’s Review of Outstanding Recommendations December 2013 Report 5 | Page

Management 

aware of 

issues for 

several years.

D. Inspection of the FEC’s Disaster Recovery Plan and Continuity of Operations Plans

The OIG initiated the Inspection of the FEC’s Disaster Recovery Plan and Continuity of 

Operations Plans (COOP Inspection) due to:

• repeat findings related to the agency’s contingency plan in the FEC’s annual financial 

statement audit since FY 2004;

• the agency hiring a contractor for approximately $277,000 in FY 2008 to assist with 

the development of contingency plans for the FEC program offices that where never 

fully tested; and

• management’s non-compliance with applicable laws and regulations for properly 

training FEC personnel on their COOP plans.

Since the inspection report was released in January 2013, this review period is the first 

follow-up for the COOP Inspection. However, the OIG did not verify implementation of any 

corrective actions because management has not made any progress. In November 2013, the 

Deputy Chief Information Officer stated in a memo to the Commission that “There have been 

no updates since the last circulation [of the CAP] due to budget constraints but it is our goal 

to revise and update the current plan during FY 2014.”

The OIG is concerned with the lack of progress and commitment by the 

Information Technology Division to address the numerous problems found 

during our inspection. Further, the OIG would like to note that our office has 

reported on weaknesses in this area since FY 2004 in the agency’s annual financial 

statement audits. Management has been aware of the agency’s issues for several years, 

and neglected to promptly implement corrective actions.
_________________________________________________________________________________

Office of Inspector General’s Review of Outstanding Recommendations December 2013 Report 6 | Page

The table below summarizes the progress made by FEC management during the past six months and 

the outstanding recommendations as of December 2013.

Title & Report Date

of OIG

Audits/Inspection

Total Outstanding 

Recommendations

as of June 2013

Total Closed 

and Verified 

by OIG

2

Total Open

as of

December 2013

Audit Follow-up Review of the 

FEC’s Employee Transit 

Benefit Program (7/2009)

8 8 0

Audit of the Commission’s 

Property Management Controls 

(3/2010)

7 0 7

2010 Follow-up Audit of 

Privacy and Data Protection 

(3/2011)

30 0 30

2010 Follow-up Audit of 

Procurement and Contract 

Management (6/2011)

17 8 9

Inspection of the FEC’s Kastle 

Key Program (12/2011) 1 1 0

Quality Assessment Audit of 

the Audit Division (9/2012) 3 3 0

Inspection of the FEC’s 

Disaster Recovery Plan and 

Continuity of Operations Plans 

(1/2013)

30 0 30

Total Outstanding Recommendations 76

 2 “Total Open as of December 2013” column includes recommendations that management has disagreed with or has not 

adequately implemented, and the OIG concludes that these recommendations are still ‘open.’
_________________________________________________________________________________

Office of Inspector General’s Review of Outstanding Recommendations December 2013 Report 7 | Page

Accountability 

of management 

officials needs 

improvement.

Pattern of lack of 

progress by ITD 

on outstanding 

recommendations.

OIG Concerns 

As reported in our June 2013 Review of Outstanding Recommendations report, the FEC

needs to improve the accountability of management officials necessary to ensure 

compliance with all aspects of Directive 50: Audit Follow-up. It is essential that the 

Commission not only requires management to report on a semi-annual basis the status of 

outstanding recommendations, but also develops a process to ensure the Audit Follow-up 

Officials are being held accountable for implementing outstanding recommendations in a timely 

manner that are beneficial to the agency’s mission and will improve agency programs. Without the 

accountability necessary to ensure corrective actions are taken by management, the mission of the 

agency is consistently operating under weaker controls that can increase cost, expose the agency to 

risks, and increase the potential of fraud, waste, and abuse to agency programs. 

In addition, the OIG is concerned with the lack of progress by the Information 

Technology Division to address outstanding recommendations for the Audit of the FEC’s 

Property Management Controls and the Inspection of the FEC’s Disaster Recovery Plan 

and Continuity of Operations Plan. 

Report Overview

This report provides the Commission and management the results of the Office of Inspector 

General’s (OIG) review of outstanding OIG recommendations as of December 2013. 

As required by the Inspector General Act of 1978, as amended, the Office of Inspector General (OIG) 

is responsible for conducting audits of the Federal Election Commission’s (FEC) programs and 

operations. In addition to conducting and supervising audits, the OIG also has the responsibility to 

conduct audit follow-ups to ensure that management has effectively implemented OIG 

recommendations. Audit follow-up, to include the timely implementation of audit recommendations

by FEC management, is required by Office of Management and Budget Circular A-50, Audit Followup, as revised, and FEC Directive 50: Audit Follow-up.

In order to work effectively with FEC management in adhering to FEC Directive 50, and to ensure 

continuous monitoring and adequate and timely audit resolution, the OIG communicates with 

management at least semiannually to discuss the status of outstanding OIG recommendations. If 

management has implemented any corrective actions, the OIG schedules a meeting with management 

to discuss the implementation of the corrective action(s), and the OIG then reviews evidence of the 

corrective action (i.e. new/updated policies, procedures, and processes to improve internal controls). 

Based on management’s availability, the OIG strives to schedule these meetings to provide 

management with the results of our review prior to management’s reporting deadlines to the 

Commission in May and November. These meetings can provide management with timely OIG 

feedback for their semiannual reports to the Commission and enables the OIG to keep abreast of 
_________________________________________________________________________________

Office of Inspector General’s Review of Outstanding Recommendations December 2013 Report 8 | Page

management’s progress. The semiannual meetings are also intended to assist the audit follow-up 

official in following provisions 4 through 6 of Directive 50, which are listed as follows:

“(4) Respond in a timely manner to all audit reports;

 (5) Engage in a good faith effort to resolve all disagreements; and

 (6) Produce semi-annual reports that are submitted to the agency head.”

FEC management is required by FEC Directive 50 to provide semiannual status reports (May and 

November) to the Commission of their progress concerning outstanding OIG recommendations. The 

official status (open/closed) of OIG recommendations is determined by the OIG once the OIG has 

verified that management has adequately implemented the corrective actions. The Inspector General 

can also make a decision to close recommendations or seek resolution from the Commission for 

recommendations where the OIG and management disagree. Lastly, the number of outstanding 

recommendations is reported to the Commission and Congress in the OIG’s Semiannual Reports to 

Congress.

Background

At the conclusion of each OIG audit and inspection, it is management’s responsibility to develop a 

corrective action plan (CAP). The CAP identifies the plan management has developed to address the 

OIG’s findings and recommendations. The CAP should detail the following: 

1. assignment of Audit Follow-up Official (AFO), who is responsible for overseeing the 

corrective action;

2. OIG finding(s); 

3. OIG recommendation(s); 

4. detailed corrective action to implement the OIG’s recommendation(s); 

5. FEC staff person with responsibility to implement each task; and 

6. expected completion dates.

Once management drafts the CAP, the OIG then reviews their CAP and provides comments to 

management regarding the sufficiency of their planned corrective actions to address the OIG’s

findings. Management reviews the OIG’s comments, finalizes the CAP, and then provides the final 

CAP to the Commission with a courtesy copy to the OIG.

FEC Directive 50 requires management to:

“(3) Conduct regular meetings with the Inspector General throughout the year to follow-up 

on outstanding findings and recommendations, and include reports of these meetings in the 

written corrective action plan and semi-annual reports required to be presented to the 

Commission...;”
 FEDERAL ELECTION COMMISSION

WASHINGTON, D.C. 20463

Office of Inspector General

MEMORANDUM

TO: Alec Palmer

Staff Director/Chief Information Officer

FROM: Lynne A. McFarland

Inspector General

SUBJECT: Risk Acceptance Statement: December 2013 Review of Outstanding 

Recommendations Report

DATE: February 10, 2014

The Office of Inspector General (OIG) is finalizing the December 2013 Review of 

Outstanding Recommendations Report to be released February 2014. As you know, the 

OIG’s outstanding recommendations report details the results of the OIG’s follow-up 

reviews for audit and inspections that have outstanding recommendations for six months 

or more.

As of December 2013, the Audit of the FEC’s Property Management Controls has several 

recommendations that have been outstanding for over three years. The OIG has reported 

on our concern with the lack of progress from ITD management since June 2012, and our

soon to be released report on outstanding recommendations reiterates the OIG’s concern. 

The audit follow-up official has stated during OIG follow-up reviews that no further 

corrective actions will be implemented to address the remaining recommendations and 

management considers the recommendations closed. Therefore, the OIG’s December 

2013 Review of Outstanding Recommendations Report is requesting a written statement 

from the Staff Director accepting the risk of the outstanding recommendations in order 

for the OIG to officially close the open recommendations. A list of the outstanding 

recommendations, and the risks associated with not implementing the recommendations,

is attached with this memo and will also be included in the final report. 

In addition, the OIG is aware that ITD is in the process of replacing the Blackberry 

devices with iPhones. The OIG would like to note that the outstanding recommendations 

are applicable to the iPhone and any other cellular phone device the agency may procure. 

Based on the OIG’s knowledge of the agency’s lack of controls in this area, the OIG 

believes the roll-out of the new iPhone devices would be the opportune time for 

management to implement the remaining outstanding recommendations to improve the 

agency’s controls. 
2

The OIG is requesting a written statement from the Staff Director by March 3, 2014 in

response to accepting the risk of the outstanding recommendations for the Audit of the 

Property Management Controls in order for the OIG to properly plan for the next audit 

follow-up review period. If you decide to implement one or more of the outstanding 

recommendations, based on the risks outlined in this memorandum, please let me know 

by March 3, 2014 so that I can schedule a review of the corrective action(s) at a future 

date.

Thank you.

Attachment
3

Management’s Acceptance of Risk for the Audit of the FEC’s Property Management 

Controls Outstanding Recommendations

The Office of Inspector General is requesting a written statement from the Staff Director 

in regards to the remaining open recommendations from the Audit of the FEC’s Property 

Management Controls that are listed below. In order to close these recommendations and 

conclude the follow-up process, the Staff Director should state that management will 

accept the risk of not implementing the outstanding recommendations. Below are the 

outstanding recommendations and their associated risks.

1. Recommendation 1h: Document the ITD re-authorization process of PCD

[personal communication device/Blackberry] users in ITD's Policy 58-4.4

• Risk: Waste of agency funding. 

 The re-authorization of PCD users is an internal control to help 

ensure that staff provided a Blackberry continue to have a need for 

the device. Staffs’ job responsibilities change over time, and their 

need for a Blackberry can change. Therefore, it is important to 

periodically review the staff assigned a Blackberry to make sure 

the expenditure of funds for the Blackberry service is still required. 

As ITD is the office with oversight of the Blackberry devices, 

ITD’s refusal to periodically re-authorize the users means ITD may 

be unaware if the agency is wasting funds on FEC personnel or 

contractors who no longer have a business need for an FEC issued 

Blackberry. 

2. Recommendation 1k: Provide the policies and procedures for the use of 

Blackberry devices to all users when issuing the Blackberry.

• Risk: Abuse of government property.

 Blackberry devices issued to authorized users have the potential to 

be misused (excessive personal use, downloading of unauthorized 

applications, viewing prohibited information on a government 

issued device, etc.) if users are not aware of polices and procedures 

for using an FEC issued Blackberry. 

3. Recommendation 2a: All unassigned Blackberry devices should be suspended or 

service should be terminated if the device can not be immediately transferred to 

another user (no active spares kept in ITD). At the time of our inspection, ITD 

retained a minimum of 10 inactive spare devices (many of the spares were left 

active incurring monthly charges) and a spare Subscriber Identity Module (SIM) 

card (portable memory chip). If required, a device could be activated within 24 

hours.

• Risk: Fraud and no internal control.

 In a prior audit follow-up, management stated that they have 

decreased the number of spare devices on hand to three. Although 

the OIG agrees that three spare devices is more reasonable than the 

previous 10 spares, the OIG reviewed devices listed as unassigned

(spare) on the agency’s AT&T monthly bill and they showed 

activity (in use) and were listed as assigned to FEC personnel on 
4

the inventory list. As a result, ITD is not maintaining accurate 

records of the unassigned Blackberry devices. Because these 

devices are not properly tracked, management runs the risk of 

potential fraud (stolen devices, unauthorized activity) because ITD 

does not maintain proper records of spare devices.

4. Recommendation 2f: Blackberry user information should be kept up to date and 

adjusted in a timely manner on the ITD master Blackberry listing and the AT&T 

Premier website for employee separations and new assignment of devices.

• Risk: Fraud and no internal control.

 Because these devices are not properly tracked, management runs 

the risk of potential fraud (stolen devices) because ITD does not 

maintain proper inventory records, and it’s likely these devices 

would not be detected as missing.

5. Recommendation 2g: Management should educate Blackberry users of all features 

that incur additional cost to the agency, such as: roaming charges that result when 

employees place calls outside AT&T service areas; texting; directory assistance;

unauthorized software, and voice use over the pooled plan limits.

• Risk: Waste of agency funding and abuse of government property.

 The agency is at risk of wasting funds on unauthorized device 

features that cost additional money beyond the agency’s plan. 

There is also potential for abuse by users in using their agency 

issued devices for excessive personal use. Both instances have 

been identified by the OIG and reported to management during the 

initial audit and in prior follow-up reviews.

6. Recommendation 3: ITD should implement a form and process such as the NIST 

Sample Sanitization Validation form, to record sanitization (wiping) of devices, 

disposal and/or destruction, as appropriate.

• Risk: Data breaches and fraud.

 Old devices that are no longer in use run the risk of containing 

sensitive information from emails/attachments if management has 

no record that the device has been properly sanitized prior to 

transferring the device as surplus to the General Services 

Administration. In addition, if the device is to be destroyed and 

there is no record of the destruction, there is a risk that the device 

can be removed from the agency and used for personal use or 

prohibited activity (selling an agency issued device).
5

7. Recommendation 3e: Segregate the following program functions among three or 

more ITD staff: Purchasing/ordering and recording assets; Authorization for 

purchases, including devices received free under upgrade promotion; Receipt, 

storage, and distributing of assets; and Destruction or disposal of surplus PCDs.

• Risk: Waste of agency funds and fraud.

 Having one person to oversee all purchasing, recording, and storage 

responsibilities for Blackberry devices presents the risk of a) wasting 

agency funds on additional devices that are purchased for prohibited 

activity; b) abuse of agency devices being used as personal use; and c) 

creating fraudulent documentation and records to prevent the detection 

of prohibited activity of agency issued devices.
 

or toll free at 1-800-424-9530 (press 0; then dial 1015) 

Fax us at 202-501-8134 or e-mail us at oig@fec.gov 

Visit or write to us at 999 E Street, N.W., Suite 940, Washington DC 20463 

Federal Election Commission 

Office of Inspector General 

Individuals including FEC and FEC contractor employees are encouraged to alert the OIG to 

fraud, waste, abuse, and mismanagement of agency programs and operations. Individuals 

who contact the OIG can remain anonymous. However, persons who report allegations are encouraged 

to provide their contact information in the event additional questions arise as the OIG evaluates the 

allegations. Allegations with limited details or merit may be held in abeyance until further specific details 

are reported or obtained. Pursuant to the Inspector General Act of 1978, as amended, the Inspector 

General will not disclose the identity of an individual who provides information without the consent of that 

individual, unless the Inspector General determines that such disclosure is unavoidable during the course 

of an investigation. To learn more about the OIG, visit our Website at: http://www.fec.gov/fecig/fecig.shtml 

Together we can make a difference. 

Fraud Hotline 

202-694-1015