FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

Washington, DC 20463 

March 31, 2011 

A. Roy Lavik, Inspector General 

U.S. Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street, NW 

Washington, DC 20581 

Subject: Final report and comment letter for the Audit Peer Review of the Commodity 

Futures Trading Commission’s Office of Inspector General

Dear Mr. Lavik: 

Attached is the final report of the System Review report (peer review) of the U.S. 

Commodity Futures Trading Commission’s Office of Inspector General conducted in 

accordance with Government Auditing Standards and Council of the Inspectors General 

on Integrity and Efficiency guidelines. Also included is a comment letter associated with 

the System Review report. 

If you have any questions, please contact me on 202-694-1015. Thank you. 

Lynne A. McFarland 

Inspector General 

Attachments 
1 

FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

Washington, DC 20463 

March 31, 2011 

To A. Roy Lavik, Inspector General 

Commodity Futures Trading Commission 

We have reviewed the system of quality control for the audit organization of the 

Commodity Futures Trading Commission (CFTC) Office of Inspector General (OIG) in 

effect for the period October 1, 2006 through March 31, 2010, and have issued our final 

report thereon dated March 31, 2011, in which the CFTC OIG received a rating of fail. 

That report should be read in conjunction with the comments in this letter, which were 

considered in determining our opinion. The findings described below were not 

considered to be of sufficient significance to affect the opinion expressed in that report. 

Finding 1. Independence

OIG Advisory Role - Federal Managers’ Financial Integrity Act (FMFIA) 

The OIG performs an annual audit of the agency prepared control assessments in 

accordance with FMFIA and the Office of Management and Budget Circular A-123, 

“Management’s Responsibility for Internal Control,” revised December 21, 2004. The 

CFTC OIG Semiannual Reports to Congress consistently refer to the work as 

“consulting” and “advisory,” rather than attestation engagements or performance audits. 

The OIG has performed this work for nine years and the OIG’s planning documents 

specify the work will be performed in accordance with generally accepted government 

auditing standards (GAGAS). Because it is performed as an audit under GAGAS, no 

additional independence impairment assessment is required. However, if the work is not 

conducted in accordance with GAGAS, the OIG would need to assess and document the 

independence of the OIG in the performance of the work, as well as report the 

performance standards under which the work was conducted and the level of assurance 

provided. 

Recommendation 

The OIG should ensure Semiannual Reports to Congress clearly and consistently describe 

the work performed by the OIG, to include the type of professional standards followed in 

the performance of the work assignments. 

CFTC OIG Response

We will implement the recommendation and intend to amend our policies and procedures 

as necessary to assure compliance with the recommendation within six months. 
2 

FEC OIG Analysis of Response

FEC OIG believes that this recommendation when implemented will address the 

weakness identified. 

OIG Budget Process 

Currently, the CFTC OIG budget request process is informal and not well documented. 

Both the Inspector General (IG) and the agency’s Budget Officer describe the OIG as 

having access to ample funds to fulfill OIG organization needs, and there have been no 

financial impairments for the OIG. We were unable to locate a budget certification 

signed by the IG that complies with Section 6 (f)(1) of the Inspector General Act of 1978 

(5 U.S.C. App.), as amended, to show that “...the amount requested satisfies all training 

requirements for the Inspector General's office for that fiscal year....” 

In addition, currently, the method used by the agency to develop and report budget values 

allocates all costs, except salaries, as overhead based on the number of full time 

equivalents (FTEs). The IG could better demonstrate its financial independence by 

preparing a detailed budget request based on actual funding levels needed to meet its 

business needs, including training and contract funds, and retaining the information to 

show compliance with the Inspector General Act, as amended (IG Act). Once the 

agency’s allocation of overhead has been performed, the IG should then certify that the 

final budget values meet or exceed the initial request. 

 

Recommendation

The IG should prepare and certify requests for funds in accordance with the IG Act and 

formalize the OIG’s budget process with the agency to help ensure an independent and 

transparent budget process. 

 

CFTC OIG Response

We will implement the recommendation and intend to amend our policies and procedures 

as necessary to assure compliance with the recommendation within six months. 

FEC OIG Analysis of Response

FEC OIG believes that this recommendation when implemented will address the 

weakness identified. 

Finding 2. IPA Monitoring

In addition to reviewing its system of quality control to ensure adherence with 

Government Auditing Standards, we applied certain limited procedures in accordance 

with guidance established by the Council of the Inspectors General on Integrity and 

Efficiency related to the OIG’s monitoring of audit work performed by independent 

public accountants (IPA) under OIG contract, where the IPA served as the principal 

auditor. The matters described below were identified based on a review of the OIG’s 

monitoring of the 2009 financial statement audit contract: 
3 

Independence 

The CFTC OIG did not require the IPA firm selected to perform the 2009 financial 

statement audit to supply independence forms or other written assurance of the IPA’s 

independence from the CFTC. 

GAS 3.05, Independence, provides for the following: "When auditors use the work of a 

specialist, auditors should assess the specialist's ability to perform the work and report 

results impartially as it relates to their relationship with the program or entity under audit. 

If the specialist’s independence is impaired, auditors should not use the work of that 

specialist." 

For peer review purposes, the Assistant Inspector General for Audit requested a copy of 

the independence statement from the IPA. Although the independence statement was 

provided by the IPA during the audit planning phase, and signed by only one of the IPA's 

audit staff, the documentation was not included in the final workpapers maintained by the 

CFTC OIG. 

Recommendation 

We recommend that the CFTC OIG should adhere to the GAGAS requirements for 

assessing independence of OIG contractors. Specifically, the OIG should obtain 

independence statements from all proposed staff of the IPA, or from the partner staffed 

on the engagement to represent the firm, during the contracting process. If contract 

option years are exercised, the IPA should provide independence statements for each 

option year exercised. 

CFTC OIG Response

We will implement the recommendation and intend to amend our policies and procedures 

as necessary to assure compliance with the recommendation within six months. 

FEC OIG Analysis of Response

FEC OIG believes that this recommendation when implemented will address the 

weakness identified. 

Documentation of IPA Monitoring Activities 

The CFTC OIG has not defined how it will perform and document its monitoring of IPA 

audit activities and does not maintain an audit file to document the monitoring and 

reviews performed. According to the Financial Audit Manual, Section 650 (FAM 650), 

even in low level review procedures, there are several IPA audit documents that should 

be reviewed. Some of these documents include the IPA’s audit strategy, audit summary 

memo, and audit completion checklist. FAM 650 also lists documentation that should be 

considered for retention in the IPA monitoring file including, but not limited to:

• The IPA’s most recent peer review report; 

• Independence statement from personnel staffed by the IPA; 

• OIG review and approval of the IPA’s planning documents; 
4 

• OIG review of the IPA’s audit workpapers; 

• Comments provided to the IPA regarding notice of findings and 

 recommendations (NFRs); and 

• OIG review of the draft and final reports. 

As evidence of IPA monitoring, the OIG provided copies of various e-mail 

communications with the IPA and a copy of the final audit workpapers provided as an 

audit deliverable. The e-mail communications indicate that the OIG was provided audit 

deliverables for review; however, without documented evidence of OIG review, the peer 

review team could not determine if the minimum review procedures were met. 

Recommendation 

The CFTC OIG should maintain an audit file (hard copy or electronic) for each financial 

statement audit or other contracted audit. The file should contain adequate 

documentation of the OIG’s review process for monitoring of the IPA according to the 

detailed guidance in FAM 650 and GAGAS. 

CFTC OIG Response

We will implement the recommendation and intend to amend our policies and procedures 

as necessary to assure compliance with the recommendation within six months. 

FEC OIG Analysis of Response

FEC OIG believes that this recommendation when implemented will address the 

weakness identified. 

Finding 3. Audit Follow-up

We noted the audit follow-up monitoring is not compliant with internal policies. CFTC 

OIG Directive 40, Audit Follow-up Control, provides the following background and 

procedures for verifying whether or not recommendations for audits and reviews have 

been implemented, as follows: 

“BACKGROUND

The Agency’s Audit Follow-up Official (AFO1

) is responsible for follow up on all 

agreed upon actions and/or recommendations made to the Commodity Futures 

Trading Commission (CFTC, Agency) management by the Office of the Inspector 

General. The AFO will inform the OIG whether or not the agreed upon actions 

and/or recommendations have been completed. Such follow-up also applies to 

reports issued by external auditors, for example, financial auditors contracted by 

the OIG. 

 

 

1

 Currently the Chief Financial Officer. 
5 

PROCEDURES

The AIC is responsible for reviewing and evaluating the reasonableness of 

information received for purposes of audit, review, or inspection follow-up and 

keeps the IG appropriately informed. This review by the AIC should also assess 

the lack of agreement, if any, with the AFO’s determinations. 

A follow-up file will be created and maintained by the AIC for all audit, review 

and inspection reports. This file will include all relevant information on the open 

or closed recommendations. 

At least quarterly, the AIC will ascertain the status of any open recommendations 

made in an OIG report. Any open and unresolved OIG recommendations will be 

reported in the semi-annual report to Congress for that relevant period.” 

For the 2008 Use of Contractors Audit, we were not able to locate a follow-up file or 

documentation in the audit file indicating management had agreed with the 

recommendations and had taken action to implement the recommendations. No audit 

recommendation tracking document for this audit or other OIG audits was provided. 

Instead, a document (Word table) was provided, but it only listed the audits and number 

of recommendations. The table did not allow for the tracking of individual 

recommendations, or include fields to document the status as completed, fully 

implemented, or date completed. The Semiannual Reports to Congress for September 

2008 and forward indicate all recommendations made by the OIG were completed or 

fully implemented. 

Recommendation 

The CFTC should implement a more formal recommendation tracking system and 

document audit follow-up activity performed by OIG staff, as described in Directive 40. 

At a minimum, documentation from management providing assurance that OIG 

recommendations have been fully implemented should be obtained and retained by the 

OIG, prior to making statements to that fact in the OIG’s Semiannual Reports to 

Congress. 

CFTC OIG Response

We will implement the recommendation and intend to amend our policies and procedures 

as necessary to assure compliance with the recommendation within six months. 

FEC OIG Analysis of Response

FEC OIG believes that this recommendation when implemented will address the 

weakness identified. 

Finding 4. Documented Policies and Procedures

As indicated in this comment letter and the main peer review report, many of CFTC 

OIG’s documented quality control processes are not always followed. Examples include 
6 

failure to comply with the documented standards to make audit reports available to the 

public via the CFTC OIG internet site and failure to adequately document the IG’s final 

review of the workpapers. 

Most of the peer review Appendix A Policy and Procedures responses prepared by the 

CFTC OIG lacked specific references to documented policies and procedures. For 

example, the CFTC OIG has directives covering Quality Control (Directive No. 1), Work 

Papers (Directive No. 30), Audit/Review Follow-Up Control (Directive No. 40), and 

Reporting (Directive No. 50), but these were not referenced in the Appendix A provided 

for peer review. Instead, general descriptions of procedures were provided that were not 

aligned to the written directives. For example, the following two responses were 

provided to the peer review team in reference to documented policies and procedures to 

ensure performance audit reporting and recommendation tracking comply with GAGAS. 

Audit reports are issued in a standard format and any open recommendations are 

tracked. Generally the agency has concurred with our recommendations and 

implemented the change by the time of the final audit report. 

Due to the small size of the OIG multiple reviews of audit reports by all available 

staff generally detect any errors and/or omissions. 

These undocumented processes described by staff during the peer review did not ensure 

work performed met minimum quality standards based on the peer review results. Refer 

to Finding 2f, Reporting is not compliant with GAGAS, of the peer review report and 

Finding 3, Audit Follow-up, of this comment letter. A stronger adherence to the 

documented policies and procedures would have increased compliance with GAGAS. As 

noted in this comment letter and the peer review report, the CFTC OIG directives could 

be strengthened by including additional procedures and controls to ensure compliance 

with GAGAS and FAM 650. These include, but are not limited to, additional procedures 

to assess and document auditor independence, additional detail on performing and 

documenting supervisory review, report referencing, and IPA monitoring activities. 

Recommendation 

The CFTC OIG should review the Appendix A provided to the peer review team and 

identify areas where responses do not reflect quality processes. Using that review, the 

peer review report and this letter of comment, the members of the OIG should evaluate 

the weaknesses and issue or update operating procedures for the office to ensure work 

performed meets minimum quality standards. 

CFTC OIG Response

We will implement the recommendation and intend to amend our policies and procedures 

as necessary to assure compliance with the recommendation within six months. 

 
7 

FEC OIG Analysis of Response

FEC OIG believes that this recommendation when implemented will address the 

weakness identified. 

Lynne A. McFarland, Inspector General 

Federal Election Commission 
1

FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

Washington, DC 20463 

System Review Report 

March 31, 2011 

To A. Roy Lavik, Inspector General 

U. S. Commodity Futures Trading Commission 

We have reviewed the system of quality control for the audit organization of the U.S. 

Commodity Futures Trading Commission Office of the Inspector General (CFTC OIG) in effect 

for the period October 1, 2006 through March 31, 2010. A system of quality control 

encompasses the CFTC OIG’s organizational structure and the policies adopted and procedures 

established to provide it with reasonable assurance of conforming with Government Auditing 

Standards (GAS). The elements of quality control are described in GAS. The CFTC OIG is 

responsible for designing a system of quality control and complying with it to provide the CFTC 

OIG with reasonable assurance of performing and reporting in conformity with applicable 

professional standards in all material respects. Our responsibility is to express an opinion on the 

design of the system of quality control and the CFTC OIG’s compliance therewith based on our 

review. 

Our review was conducted in accordance with Government Auditing Standards and guidelines 

established by the Council of the Inspectors General on Integrity and Efficiency (CIGIE). 

During our review, we interviewed CFTC OIG personnel and obtained an understanding of the 

nature of the CFTC OIG audit organization, and the design of the CFTC OIG’s system of quality 

control sufficient to assess the risks implicit in its audit function. Based on our assessments, we 

selected engagements and administrative files to test for conformity with professional standards 

and compliance with the CFTC OIG’s system of quality control. Except as discussed below in 

the paragraph on scope limitations on page two, the engagements selected represented a 

reasonable cross-section of the CFTC OIG’s audit organization, with an emphasis on higher-risk 

engagements. Prior to concluding the review, we reassessed the adequacy of the scope of the 

peer review procedures and met with CFTC OIG management to discuss the results of our 

review. We believe that the procedures we performed provide a reasonable basis for our 

opinion. 

In performing our review, we obtained an understanding of the system of quality control for the 

CFTC OIG’s audit organization. In addition, we tested compliance with the CFTC OIG’s quality 

control policies and procedures to the extent we considered appropriate. These tests covered the 

application of the CFTC OIG’s policies and procedures on selected engagements. Our review 
2

was based on selected tests; therefore, it would not necessarily detect all weaknesses in the 

system of quality control or all instances of noncompliance with it. 

There are inherent limitations in the effectiveness of any system of quality control and therefore 

noncompliance with the system of quality control may occur and not be detected. Projection of 

any evaluation of a system of quality control to future periods is subject to the risk that the 

system of quality control may become inadequate because of changes in conditions, or because 

the degree of compliance with the policies or procedures may deteriorate. 

Results of this peer review indicated that three of the four findings reported by the National 

Endowment for the Humanities (NEH) OIG in the September 27, 2007 peer review report have 

not been corrected by the CFTC OIG. The findings relate to 1) meeting continuing professional 

education (CPE) requirements and maintaining adequate documentation to support training 

attended, 2) performing and documenting control assessments, and 3) performing and 

documenting independent referencing of audit reports. The three unresolved findings are 

annotated as “repeat finding” in this report. 

In our opinion, as a result of the significant deficiencies described below, the system of quality 

control for the audit organization of CFTC OIG in effect for the period ended March 31, 2010, 

was not suitably designed and complied with to provide CFTC OIG with reasonable assurance of 

performing and/or reporting in conformity with applicable professional standards in all material 

respects. Federal audit organizations can receive a rating of pass, pass with deficiencies, or fail. 

The CFTC OIG has received a peer review rating of fail with a scope limitation. As is 

customary, we have issued a letter dated March 31, 2011, that sets forth findings that were not 

considered to be of sufficient significance to affect our opinion expressed in this report. 

To ensure the objectivity, accuracy, and completeness of the findings, the FEC OIG peer review 

team provided written preliminary draft findings and conclusions during a meeting with CFTC 

OIG on August 27, 2010. In addition, a discussion draft report was provided to the CFTC OIG 

on December 9, 2010, the exit conference was held on January 6, 2011, and the draft report was 

provided to the CFTC OIG on February 9, 2011. The CFTC OIG provided written comments on 

the draft report on March 14, 2011, and these comments have been included in this report in their 

entirety. 

The CFTC OIG notified us that there were no manual or electronic workpaper files for the 

Government Performance and Results Act (GPRA) reviews conducted on CFTC performance 

data submitted to the Office of Management and Budget (OMB) and Congress. According to 

Semiannual Reports to Congress, the work was planned and performed by the CFTC OIG 

annually from 2001 through 2007. As a result, we were unable to review these engagements to 

determine whether the role of the CFTC OIG in “consulting” and “advising” the agency, as 

described in the semiannual reports, was subject to additional independence impairment 

assessment as defined in GAS 3.25 through 3.30. We considered this to be a scope limitation in 

this peer review. 

Enclosure 1 to this report identifies the engagements that we reviewed. 

 
3

We noted the following significant deficiencies during our review. 

1. Deficiency – System of Quality Control Design and Evaluation 

The CFTC OIG is responsible for designing a system of quality control and complying with that 

system to provide the agency with reasonable assurance of performing and reporting in 

conformity with all applicable professional standards. Currently, the quality control processes, 

as designed, fail to ensure work is planned, performed and reported in accordance with Generally 

Accepted Government Auditing Standards (GAGAS or Yellow Book). Our reviews of the eight 

(8) directives provided by the CFTC OIG to document and evaluate its quality control processes 

identified the following weaknesses: 

a. Work planned and reported as GAGAS was performed under standards other than 

GAGAS 

The CFTC OIG policies and procedures indicate that audit and attestation engagements are 

performed to GAGAS standards, however, CFTC OIG quality processes are not designed to 

ensure the work was actually performed to those standards. The CFTC OIG quality control 

processes do not include a section on planning or guidance that the OIG staff must first consider 

and document the standard under which the work will be planned, performed and reported before 

commencing fieldwork. The policies do not include instruction that if a decision is made to 

change the engagement standard, it must be fully documented in the audit files. Further, CFTC 

OIG quality processes did not detect or correct instances where work planned and reported as 

GAGAS failed to meet the standard. GAS section 1.11 states, “When auditors are required to 

follow GAGAS or are representing to others that they followed GAGAS, they should follow all 

applicable GAGAS requirements and should refer to compliance with GAGAS in the auditors’ 

report as set forth in paragraph 1.12 and 1.13.” 

In order to determine which OIG work products could be selected for peer review, the peer 

review team first reviewed the CFTC OIG Semiannual Reports to Congress available on the 

CFTC OIG’s internet site for the periods September 2006 through March 2010. The team then 

reviewed the listings of annual “audit programs” provided by the CFTC OIG for fiscal years 

2007 through 2010. The audit programs were a listing of CFTC OIG work in progress for each 

fiscal year. The review of semiannual reports and audit programs was performed during the peer 

review planning phase and prior to fieldwork. Because the listings of annual audit programs did 

not specify which work was performed as GAGAS, we requested the OIG staff respond “yes” or 

“no” as to whether the listed work products were a) performed under GAGAS, and b) the audit 

report included a statement that the engagement was performed in accordance with GAGAS. 

The peer review team then interviewed CFTC OIG staff regarding the yes and no responses 

provided to the annual audit programs and also reviewed the workpaper binders of audits 

completed in fiscal years 2008 and 2009. 
4

The table on the following page presents the results of an assessment of the CFTC OIG work 

products by the peer review team using six criteria: 

• description in Semiannual Reports to Congress during the planning phase; 

• planning documents located in audit files presented for peer review; 

• final report or memorandum; 

• description in Semiannual Reports to Congress after work completed; 

• workpapers or results documents for items where a memorandum was used as the report 

to the CFTC Chairman; and 

• CFTC OIG tables of audit programs and corresponding questions/responses on whether 

the work was planned and reported under GAGAS. 

The assessment was performed to determine whether or not the work products were planned, 

performed and reported as GAGAS audits, reviews, or attestation engagements, and thus 

selectable for peer review testing. 
1 The 2007 and 2008 FISMA files were not available for review. It does not appear the workpaper files were prepared or reviewed.2 The 2007 FMFIA file was reviewed by the Inspector General who did not meet CPE requirements to perform the role. The 2008 file was not subject to supervisory review at the tim

during peer review fieldwork in August 2010. The 2009 file was reviewed prior to peer review fieldwork commencing. The IG Counsel performed the reviews of the 2008 and 2009 fcompliance with GAGAS. 

3 No manual or electronic workpaper files were available for peer review on the annual compliance audit performed by the OIG from 2001 through 2007. 4 None of the semiannual reports reviewed for March 2006 through March 2010 explicitly stated whether OIG work products were planned or performed under GAGAS, but primarily 5 The 2009 FISMA package was submitted electronically to OMB using data transfer portal. The template report/submission packet does not contain a GAGAS reference. 6GAGAS section 1.23(b) relates to attestation engagements defined as a review that “Consists of sufficient testing to express a conclusion about whether any information came to the 

performed that indicates the subject matter is not based on (or not in conformity with) the criteria or the assertion is not presented (or not fairly stated) in all material respects based on prepared for the peer review, the CFTC OIG staff stated repeatedly that they do not perform attestation engagements. 

Assessment Table 

2009 Annual 

Financial 

Statement Audit 

2009 Annual FISMA 

Evaluation1

2009 Annual FMFIA 

Compliance Audit2

2008 Review of 

Agency Use of 

Contractors 

2006 and 2007 Revie

1. Semiannual reports prior to work (planning phase)4. Annual Audit Annual Audit Annual Audit Audit 

2007 rev

2. Planning documents located in the files presented for peer review. 

Includes reference 

to GAAS, GAS, 

and OMB guidance 

GAGAS 

GAGAS (twice) and 

describes the limitation 

on controls testing 

performed 

GAGAS 

3. Final report or memorandum. 

Audit opinion 

references US 

GAAS, GAS and 

OMB guidance 

No reference to GAGAS 

in OIG template 

submitted to OMB as 

part of agency reporting 

package5

No reference to GAGAS 

in 2 sentence 

memorandum. Refers to 

“limited review” 

GAGAS 

4. Semiannual reports after completed (reporting phase). 

Annual Audit Annual Audit Annual Audit Completed Audits 

and Reviews 

5. CFTC OIG workpapers (results documents) for items that only included transmittal memos as official report to Chairman. 

Not applicable 

GAGAS section 1.23(b)6

for the one IT system 

selected for detailed 

review 

GAGAS (twice) and 

describes the limitation 

on controls testing 

performed 

Not applicable 

6. CFTC OIG tables of work products and corresponding questions on whether GAGAS planned and GAGAS reported. 

Planned: Yes 

Reported: No 

Response 

Planned: No Response 

Reported: Yes 

Planned: No Response 

Reported: Yes 

Planned: No 

Response 

Reported: Yes 

Not included on 200

have been. The 2008 

GAGAS audit, but 

annual audits are 

reported in the Ma

reports. OIG provid

agency c
6

Based on the work product assessment, we selected two audits for peer review testing; the 

Review of Agency’s Use of Contractors (Use of Contractors) and the 2009 FMFIA (Federal 

Managers’ Financial Integrity Act) A-123 Review. 7 Both audits contained statements in the 

audit planning documents that the work would be planned and performed in accordance with 

generally accepted government auditing standards. The Use of Contractors report included the 

statement that “We conducted this audit in accordance with generally accepted government 

auditing standards.” In addition, the FEC OIG’s review of the CFTC OIG’s Semiannual Reports 

to Congress shows that in March and September of 2007, CFTC OIG reported the Use of 

Contractors as a current audit. 8 In March 2008, the assignment was identified in the CFTC 

OIG’s semiannual report as a current review. When the assignment was completed, the CFTC 

OIG’s September 2008 semiannual report identified the Use of Contractors as completed under a 

heading labeled “Completed Audits and Reviews.” The 2009 FMFIA A-123 Review planning 

and results documents included the statement “We are planning and performing this review in 

accordance with generally accepted government auditing standards.” Further, the CFTC OIG’s 

March 2009 Semiannual Report to Congress listed the FMFIA A-123 Review on the OIG’s audit 

agenda. In September 2009, CFTC OIG’s semiannual report labels the FMFIA A-123 Review as 

a current audit, and then in March 2010 as a completed audit. 

Detailed review of the two audits showed deficiencies in complying with GAGAS. The CFTC 

OIG was notified of the peer review team’s intent to select these two audits for peer review at the 

beginning of fieldwork, August 4, 2010, and formally notified the IG prior to the conclusion of 

fieldwork on August 18, 2010. During a meeting to discuss the results of this peer review and 

interim findings, a CFTC staff member explained that the Use of Contractors work was 

performed as “GAGAS-like.” The IG explained that a decision had been made to change the 

work from a GAGAS audit to a review not subject to full “Yellow Book” (GAS) audit standards 

and that the inclusion of the GAGAS performance standard statement in the final report was an 

error that was not detected during supervisory review. We did not find any documentation in the 

workpapers to indicate a decision by the OIG to change from GAGAS to another engagement 

standard. Further, during an interview, the CFTC OIG Assistant Inspector General for Audit 

(AIGA) stated the decision to perform work in accordance with GAGAS is made at the audit 

planning stage, and documented in the audit plan. The AIGA asserted no audits were planned as 

GAGAS and not completed as GAGAS. 

CFTC Directive No. 50, Reporting, lists “OIG Observations” as one of six report types that may 

be produced by the OIG which differs from Formal Reporting of Audit Results because:

“OIG observations are the result of very limited scope reviews. When a weakness or 

other concern comes to the attention of the OIG, the IG may determine that a quick 

review and notification to Agency management is appropriate, rather than an audit or 

inspection.” 

 

7

 The 2009 annual financial statement audit was also selected to test monitoring of independent public accounting 

(IPA) firm monitoring. 

8

 This naming and presentation is consistent with a prior audit, Review of the Need for a Los Angeles Office, which 

was reported as an audit in the March and September 2006 semiannual reports, and selected for peer review in 2007. 
7

We note that the Use of Contractors audit was neither a limited scope nor a quick review. The 

audit was conducted over a fifteen month period from March 2007 through July 2008. The final 

report was issued August 1, 2008. The executive summary of the final report contains the 

following audit objectives: 

“The objective of this audit was to provide the Chairman with a complete picture of the 

Commission's use of contractors and to determine whether the Agency has effectively 

employed contractors to replace and complement its staff. More specifically, we sought 

to ensure that the Agency was not employing contractors to perform inherently 

governmental functions and, for the two largest contracts, was not employing contractors 

to perform work that could be performed by agency employees at lesser cost." 

Based on planning documents, the stated objectives, and the time taken to plan, perform and 

report the results, we believe the Use of Contractors audit was intended to be performed to 

GAGAS standards as indicated in CFTC OIG directives, planning documents, and the final 

report. Due to quality control deficiencies, however, the audit failed to meet the stated standards. 

The 2009 FMFIA A-123 review planning and results document stated the work would be 

performed as a limited review, but also referenced GAGAS performance standards as follows: 

• “We are planning and performing this review in accordance with generally accepted 

government auditing standards, and 

• We will follow Generally Accepted Government Auditing Standards during this review.” 

Again, the CFTC OIG referenced the plan to perform work in accordance with GAGAS 

standards, but quality processes failed to detect variances from the standards in documenting and 

communicating findings, reporting the complete results of the audit, and the views of responsible 

officials. 

Recommendations – The CFTC OIG should: 

1.a.1 improve its quality control processes, including documented policies and procedures, to 

ensure that initial and subsequent assessments and decisions to perform work as audits, 

inspections, investigations or limited reviews are adequately documented and retained in 

the audit file; and 

1.a.2 ensure audit reports fully and accurately reflect the performance standards and include 

modified or unmodified GAGAS compliance statements, as appropriate. 

CFTC OIG Response

FEC OIG concluded that Use of Contractors was a GAGAS audit. First, FEC OIG based their 

conclusion on the planning documents and the initially stated objectives. Secondly, they based 

their conclusion on the amount of time taken to plan, perform and report the results of this 

review. 
8

We disagree with FEC OIG’s characterization of the Use of Contractors audit as a GAGAS 

audit; however, we take responsibility for any confusion regarding the identity of this report. 

Although Use of Contractors was initially intended as a GAGAS audit, we later decided to 

perform this project as a review that would not be GAGAS-compliant. This decision was 

motivated by the passage of time caused by staff turnover and the distraction of higher 

priorities.9 The decision to conduct Use of Contractors as a non-GAGAS review, instead of a 

GAGAS audit, is evidenced in our Semiannual Reports. We initially described the project as an 

audit (September 2007 CFTC OIG Semiannual Report), but changed the description in the 

March 2008 Semiannual Report to “review.”10 The September 2008 CFTC OIG SAR contains 

the only public description of the completed and final Use of Contractors report issued to 

Congress or to the public, and it describes the work performed for this review (as well as our 

conclusions) in some detail, and neither mentions nor describes compliance with GAGAS.11 

With regard to the time taken to plan, perform and report results, FEC OIG does not discuss 

applicable GAGAS provisions imposing time limitations for non-GAGAS audits and we are not 

aware of any provisions in GAGAS (or in our own policies/procedures) that would require a 

project to comply with GAGAS due to the passage of time. The project was intended to be a 

quick turn-around, but both staff turnover and higher priorities, including multiple interactions 

with the Congress, resulted in the IG extending the completion date, and the Use of Contractors 

took fifteen months. 

CFTC OIG’s error was not properly amending the final report and the planning documents. We 

regret the error, and will take steps to develop and implement policies and internal controls to 

prevent such conflicting and confusing errors in the future. 

In light of the decision not to perform Use of Contractors as a GAGAS audit, instances of noncompliance with GAGAS are numerous. However, we disagree with FEC OIG’s position that 

because of these problems that CFTC’s report findings are inaccurate or incomplete in any way. 

Specifically, the decision not to perform a comparison of contractor versus CFTC employee cost 

for the tasks under two major contracts was a conscious one made by CFTC OIG during the 

process and explained in the final report on page 12. We do not believe that FEC OIG is in an 

adequate position to second guess this CFTC OIG decision. 

FEC OIG concludes that the 2009 FMFIA A-123 review planning and results document stated 

the work would be performed as a limited review, but faults 2009 FMFIA A-123 because it also 

referenced GAGAS performance standards. CFTC OIG’s error was in not fully describing in 

detail the scope of the limited review. To generally reference GAGAS standards without stating 

any planned limitations, even in the context of the performance of a limited review, was error. 

 

9

 CFTC OIG Response: Specifically, in the weeks leading up to issuance of the Use of Contractors report, we 

anticipated a Senate request that would require extensive resources. 10 CFTC OIG Response: The decision to alter the original audit plan was also documented informally in an email 

between OIG staff that was recently uncovered and previously not provided to FEC OIG. 11 CFTC OIG Response: This review has never been requested under FOIA nor otherwise made public. If so 

requested, we will provide an updated version that removes the statement regarding GAGAS compliance, with an 

explanation citing this peer review. 
9

We regret these errors. Aside from the comments noted above, we otherwise agree with the 

findings and recommendations and have initiated steps to improve CFTC OIG internal controls 

to prevent these errors in the future. These steps include revising our policies and procedures 

providing for detailed independent referencing of all audits. 

FEC OIG Analysis of Response

Due to the CFTC OIG staff’s inability at the beginning of the peer review to clearly identify 

which work assignments were conducted in accordance with GAGAS, the FEC OIG conducted a 

work product analysis to determine the GAGAS audit population for testing. The basis of the 

FEC OIG’s conclusion for the selected audits is outlined in the table on page five and includes 

six criteria. Contrary to CFTC OIG’s response above, the timeframe in which the audit was 

conducted was not one of the six criteria considered for selecting audits for peer review testing; 

rather the decision was based on a preponderance of evidence. We would also like to reiterate 

that we gave notice to the CFTC OIG at the start of fieldwork concerning which audits had been 

selected for review, and formally notified the Inspector General prior to the end of fieldwork, 

and no concerns or objections were made following these notifications. 

In regards to the CFTC’s conscious decision to not perform a cost comparison in the 2008 

Review of Agency Use of Contractors, the audit work performed by the CFTC OIG was 

insufficient to support assertions made to the CFTC Chairman and Congress regarding the cost 

analysis of CFTC contracts. Specifically, the audit report and a SAR to Congress states the 

CFTC OIG: “. . . chose to examine in detail the two largest Agency contracts resulting in the 

greatest influx of contract employees to ensure that these tasks could not be performed by 

Agency employees at lesser cost” [emphasis added]. CFTC OIG’s workpapers identified this 

objective was achieved based on interviews. In our professional judgment, the CFTC OIG could 

not properly perform an assessment of contractor costs based on interviews alone, but would 

have required some cost analysis by the OIG, which was not performed. 

The CFTC OIG has agreed to implement the recommendations, and the FEC OIG believes that 

these recommendations when implemented will address the weaknesses identified. 

b. Policies and procedures for supervisory review and independent referencing are not 

adequate (repeat finding) 

In the previous peer review, the team identified that policies on workpaper supervisory review 

did not detail what specific actions would be performed by the reviewer or that independent 

referencing would be performed as one of the steps. Our review of the CFTC OIG directives and 

detailed testing of audits selected for peer review testing show this finding has not been 

addressed. According to GAS section 7.80c, auditors should document “evidence of supervisory 

review, before the audit report is issued, of the work performed that supports findings, 

conclusions, and recommendations contained in the audit report.”

OIG Directive No. 1, Quality Control Policies and Procedures, describes workpaper review as 

follows: 
10

“3) Review of work papers and report. Prior to issuance of the final report, the AIG-A 

should provide all work papers and cross referenced report to the Inspector General or 

designee for review and comment. In some instances, work paper review can occur after 

a draft of the report is issued to management. The purpose of this review is to assist the 

Inspector General in ensuring that the audit work meets all auditing standards and that 

findings and recommendations in the report are sufficiently supported by evidence in the 

work papers. The Inspector General’s work paper review should be documented and, if 

the review was completed by the Inspector General’s designee, the Inspector of [sic] 

General shall provide the final clearance of the designee’s review of the work papers. 

The Inspector General’s initial on the cover sheet is sufficient evidence that the Inspector 

General reviewed the work paper binder.” 

The documented review process still does not describe what steps the reviewer will perform to 

ensure that “the audit work meets all auditing standards,” or how, other than initials on a cover 

sheet, the Inspector General (IG) will evidence review occurred at all. Further, the process 

described does not require documenting the date supervisory review was performed and evidence 

it occurred prior to issuing the final report. Directive No. 30, Work Papers, states, “Should the 

Inspector General review work papers during the audit process a listing of comments could be 

included in the work paper file.” This instruction indicates that performing or documenting 

supervisory review of the workpapers is optional. There is no instruction requiring OIG staff 

review and to document the steps taken to resolve each comment prior to issuing the final report. 

Directive No. 1, however, does include a Work Paper and Audit Report Quality Control Review 

Checklist with instructions that state: 

“OIG Directive No. 1 has an attachment which is a review guide that the IG or designee 

could use to document the review of work papers or the report (task number three in the 

QC Policies and Procedures section). This checklist is NOT intended to be all inclusive- 

- reviewers are encouraged to supplement the checklist.” [Emphasis added] 

The checklist contains questions to help identify whether the audit was performed in accordance 

with GAGAS. Item number 29 of 30 on the checklist asks “Is the report adequately cross 

referenced to supporting workpapers?” There are no checklist items or instructions in the 

policies and procedures directing how independent referencing should be performed and 

documented, who performed it, how it was determined the person was independent of the audit, 

or that the independent referencing must be completed prior to issuing the final report. 

According to the directive instructions, use of the term “could” indicates the checklist is not 

mandatory and we noted a lack of data fields to record the date the review was performed or 

name of the person performing the review. Further, interview with CFTC OIG staff during peer 

review fieldwork highlighted that the checklist was used by the person preparing the workpapers 

and not completed by the reviewer. 

In order to illustrate good quality control standards, supervisory review and quality control 

checklist completion must be performed independently from those who conducted the audit. The 

current policies and procedures allow the IG to delegate supervisory review, but also notes that 

“the CFTC OIG consists of 4 employees. Therefore most audits are conducted by one or two 

individuals.” The quality control directive does not document a process to ensure adequate 
11

segregation of duties between those performing audits and those responsible for conducting 

supervisory review. We noted the OIG staff member who performed supervisory review and 

independent referencing of the Use of Contractors audit performed significant work on the audit 

and composed all of the report from an outline prepared by the AIGA. The supervision and 

referencing were therefore not independent of the work performed and should not have been 

conducted by that individual. GAS, Appendix I, Supplementary Guidance, section A8.02a states 

“Referencing is a process in which an experienced auditor who is independent of the audit 

checks that statements of facts, figures, and dates are correctly reported, that the findings are 

adequately supported by the evidence in the audit documentation, and that the conclusions and 

recommendations flow logically from the evidence.” 

For the Use of Contractors audit, we noted the documented supervisory review process of 

initialing workpaper binder tabs failed to detect missing and incomplete workpapers, incomplete 

and inadequate report referencing, and factual error and internal inconsistencies in the final 

report. The reviewer did not adequately assess and determine whether the audit evidence 

obtained was sufficient to support conclusions and recommendations in the report. None of the 

audit work performed by the reviewer was included in the audit file in paper or electronic form, 

therefore the reviewer did not initial any workpaper tabs as preparer. When questioned, the 

person who performed the supervisory review stated they had not received any instruction on 

workpaper preparation, supervisory review or report referencing. The person further explained 

that workpaper binder and report review “does not include any analysis of compliance with 

auditing standards,” rather the work is reviewed “for clarity and legal cites.” 

Recommendations – The CFTC OIG should: 

1.b.1 amend current policies and procedures to better define supervisory review processes, 

including which are optional and which are mandatory, to ensure compliance with 

GAGAS; 

1.b.2 document and enforce control processes to ensure supervisory review is performed 

independently of those planning, performing and reporting audit results; 

1.b.3 ensure staff assigned supervisory review responsibilities have adequate knowledge, skills, 

ability and training to perform the task; 

1.b.4 document and enforce quality processes to ensure independent referencing is performed 

and all comments or questions resolved prior to final report release; 

1.b.5 ensure adequate documentation is retained to support the fact that independent 

referencing was performed; 

1.b.6 consider outsourcing independent referencing to another OIG or contractor to ensure 

adequate separation between those performing audit work and referencing of reports; and 

1.b.7 consider transitioning to electronic workpapers to support adequate segregation of duties 

between those conducting audits and those performing supervisory review. 
12

CFTC OIG Response

FEC OIG states that, for the Use of Contractors report, the supervisory review process pertaining 

to workpaper binder tabs “failed to detect missing and incomplete workpapers, incomplete and 

inadequate report referencing, and factual error and internal inconsistencies in the final audit.” 

FEC OIG supplied no details to CFTC OIG in this report or any other means regarding what 

workpapers were missing/incomplete, or regarding what factual errors and internal consistencies 

were found. Therefore we cannot respond to these assertions. 

Due to low staffing levels, everyone assisted with the completion of the Review of Contractors, 

and independent referencing was not performed for this non-GAGAS project. The binders 

created for this non-GAGAS report were never reviewed for compliance with GAGAS.12 We did 

not believe these processes would be necessary for this non-GAGAS review. We determined that 

this level of effort was not warranted given staffing levels, and by the issues addressed in this 

project. 

We will perform independent referencing for all future audits through the use of another OIG or 

contractors. Moreover, we will seek to increase staff sufficient to achieve these and other goals. 

We have obtained an electronic workpaper system and will transition to this system immediately. 

We are working with a former Inspector General who was head of the Peer Review Committee 

for the Executive Council on Integrity and Efficiency to enhance and implement our remediation 

plan. We will update and improve our policies and procedures as part of our remediation. 

We agree with the recommendations under section 1.b, except for 1.b.2. At item 1.b.2, FEC OIG 

recommends that supervisory review be performed independently of those planning, performing 

and reporting audit results. We agree that GAGAS requires independent referencing to be 

performed by a qualified reviewer who has not participated in the audit; however, we believe 

supervision should be ongoing throughout the audit process, with the supervisor actively 

overseeing (i.e., supervising) the planning, performing and reporting of audit results. We believe 

that GAGAS does not require audit supervision to be conducted by someone with no 

involvement with the audit, and FEC OIG does not provide a citation to GAGAS for this 

recommendation. 

FEC OIG Analysis of Response

CFTC OIG states in their response that the FEC OIG “supplied no details to CFTC OIG . . . 

regarding what workpapers were missing/incomplete, or regarding what factual errors and 

internal [in]consistencies were found.” In fact, the FEC OIG did provide to the CFTC OIG 

specific examples during the peer review fieldwork on the lack of documentation regarding 

interview write-ups, sampling methodology, sample selection, and reporting discrepancies. In 

addition, repeated attempts were made to obtain an understanding of the reason for missing 

and/or incomplete workpapers through direct interviews with the CFTC AIGA and Counsel. 

Further, these issues were brought to the CFTC OIG’s attention and provided in writing during 

our peer review discussion meeting held on August 27, 2010 with the CFTC’s IG, AIGA, and 

 

12 CFTC OIG Response: Our practice is to create and maintain electronic workpapers for all OIG projects, and to 

print the electronic workpapers prior to issuance. Consistent with this practice, electronic workpapers were created 

during 2007-2008 for the Use of Contractors review, In preparation for the peer review, we could not locate the 

printed and bound copies of the workpapers so new copies were printed and bound in 2010 for this peer review. 
13

Counsel, as well as the peer review exit conference. Unfortunately, for reasons unknown to the 

FEC OIG, the CFTC OIG was ill prepared to discuss the details of the peer review results at 

these meetings, even though the CFTC OIG had been provided written documentation by the 

peer review team in advance of the meetings. 

In regards to CFTC’s exception to recommendation 1.b.2, this recommendation refers to 

supervisory review rather than independent referencing. The FEC OIG agrees that supervisory 

review should be ongoing throughout the audit process. GAGAS 7.53 states: “Audit supervision 

involves providing sufficient guidance and direction to staff ...reviewing the work performed, 

and providing effective on-the-job training.” To comply with GAGAS 7.53 in reviewing the 

work performed by the staff (supervisory review), the reviewer should be independent of the 

staff performing the audit. As with the Review of Agency Use of Contractors audit, the CFTC 

OIG staff person who performed supervisory review also performed detailed testing and played a 

significant role in composing the audit report. Simply stated, supervisory review is the 

supervision of others responsible for conducting the audit. Although we recognize the CFTC 

OIG is a small office, we believe appropriate supervision could have been performed to adhere to 

GAGAS. 

The FEC OIG encourages the CFTC OIG to take all recommendations in consideration to 

improve the indentified weaknesses. 

c. Policies and procedures do not reference independence standards 

The CFTC OIG had an actual impairment to independence during this peer review period 

relating to its ability to independently select the independent public accounting (IPA) firm to 

perform the Commission’s annual financial statement audit. For the fiscal year (FY) 2009 audit, 

the CFTC Contacting Officer and Chairman selected an IPA firm against the recommendation of 

the Inspector General (IG). The external impairment restricting the OIG from selecting the IPA 

was cured in FY 2010 by outsourcing OIG contracting officer support to the Department of 

Interior. Currently, the CFTC OIG policies and procedures are silent with respect to assessing 

both internal and external independence impairments. 

GAS section 3.53b states, “An audit organization should include policies and procedures in its 

system of quality control that collectively address: Independence, legal, and ethical 

requirements: Policies and procedures designed to provide reasonable assurance that the audit 

organization and its personnel maintain independence, and comply with applicable legal and 

ethical requirements.” 

Recommendations – We note that corrective actions have been taken by the CFTC to ensure OIG 

independence in selecting the IPA to perform the annual financial statement audit in 2010. The 

contract option years do not require competition for IPA selection until 2014. To ensure future 

independence impairments are adequately assessed and addressed, we recommend that CFTC 

OIG: 
14

1.c.1 comply with GAS 3.11 and “include policies and procedures for identifying and 

resolving external impairments as part of their quality control system for compliance with 

GAS independence requirements;” and 

1.c.2 formally document its policies and procedures for assessing and reporting potential 

internal independence impairments in accordance with GAS 3.08. 

CFTC OIG Response

We are pleased that FEC OIG found that CFTC OIG cured an external impediment to OIG 

independence. Our efforts to alleviate the impairment included the submission of memos to 

Agency and Congressional staff, as well as meetings and discussions with Agency staff and 

Congressional staff. We agree to the findings and recommendations and will include policies and 

procedures for identifying and resolving external impairments as part of our quality control 

system and will formally document policies and procedures for assessing and reporting potential 

internal impairments in accordance with GAS requirements. 

FEC OIG Analysis of Response

The CFTC OIG has agreed to implement the recommendations, and the FEC OIG believes that 

these recommendations when implemented will address the weaknesses identified. 

d. Reporting on annual analysis of monitoring processes 

GAS 3.54 states audit organizations should “analyze and summarize the results of its monitoring 

procedures at least annually, with identification of systemic issues needing improvement, along 

with recommendations for corrective action.” According to CFTC OIG staff, the analysis was 

performed and no systemic issues were identified; however, a summary or report of analysis was 

not prepared due to competing priorities. 

Recommendation – The CFTC OIG should: 

1.d.1 plan, conduct, and monitor analysis of monitoring procedures, at least annually, to 

evaluate: 

• adherence to professional standards; 

• whether the quality control system has been appropriately designed; and 

• whether quality policies and procedures are operating effectively and complied with 

in practice. 

CFTC OIG Response

We agree with the findings and consistent with GAS 3.54 we will implement the recommendation. 

FEC OIG Analysis of Response

The CFTC OIG has agreed to implement the recommendation, and the FEC OIG believes that 

this recommendation when implemented will address the weakness identified. 

 
15

2. Deficiency – System of Quality Control Compliance 

The CFTC OIG staff did not comply with its documented quality control procedures. We noted 

the following compliance deficiencies during peer review testing:

a. Preparing and retaining workpapers 

The CFTC OIG does not use electronic audit software to create and maintain workpapers and 

audit files. Instead workpapers are prepared electronically and then printed and consolidated into 

audit files. The CFTC OIG Directive 30, Work Papers, defines the policies and procedures for 

both manual and electronic workpaper creation, audit file preparation and indexing. Directive 

70, Recordkeeping, Retention Schedule, and FOIA, describes audit file retention and disclosure 

processes. We found that the OIG did not comply with the directives and failed to prepare 

workpaper files for several audits. GAS section 7.80a-c states, “Under GAGAS, auditors should 

document the following: a) the objectives, scope, and methodology of the audit; b) the work 

performed to support significant judgments and conclusions, including descriptions of 

transactions and records examined; and c) evidence of supervisory review, before the audit report 

is issued, of the work performed that supports findings, conclusions, and recommendations 

contained in the audit report.” 

After being informed that there were no workpaper files for the GPRA reviews performed 

annually from 2001 through 2007, we asked to see other workpaper files that might have been 

subject to our peer review testing. The CFTC OIG was unable to provide the 2007 and 2008 

FISMA (Federal Information Security Management Act) files and volunteered that the 2008 

FMFIA A-123 review had not been subject to supervisory review. When questioned about when 

the workpaper folders presented for peer review were physically assembled and signed as 

prepared and reviewed, a CFTC OIG staff member informed us that the files were prepared “a 

couple of weeks” prior to the start of the peer review fieldwork, 13 and also stated another OIG 

member worked on the weekends prior to peer review fieldwork commencing to get the 

workpapers printed, filed in folders, and prepared for supervisory review. The individual then 

provided an email which showed the Use of Contractors file had supervisory review performed 

by the OIG’s Attorney-Advisor on August 2, 2010, the day before peer review fieldwork 

commenced. The staff member also stated that both the 2009 FMFIA and 2009 FISMA folders 

were recently signed as reviewed. The 2009 FMFIA workpapers were augmented in June and 

July 2010 to document the work performed by the OIG in September and October 2009. Based 

on the information provided, it is evident the CFTC OIG is not compliant with its policies and 

procedures and did not prepare workpaper files as a standard practice. 

As stated previously, supervisory review by the CFTC OIG is evidenced by manually signing 

workpaper folder tabs. If the OIG does not prepare manual workpaper files and include all 

supporting records of work performed, then the OIG cannot ensure adequate supervisory review 

is performed or that all official records are retained. 

 

13 The CFTC OIG was contacted on May 27, 2010 to communicate the FEC OIG’s assignment as peer reviewer and 

to discuss the timing of fieldwork. 
16

Recommendations – The CFTC OIG should: 

2.a.1 prepare workpaper files for all OIG work products at the time work is performed and 

retain them in accordance with OIG and National Archives and Records Administration 

(NARA) record retention standards; 

2.a.2 obtain and maintain adequate documentation on the dates workpapers are prepared and 

reviewed; and 

2.a.3 ensure all workpapers are prepared and approved prior to the issuance of the final reports 

to the CFTC. 

CFTC OIG Response

We agree with the findings and will implement the recommendations for all future audits. 

However, several FEC OIG statements are incorrect, or not apt. Specifically: 

- While CFTC OIG did not comply with internal policies and procedures pertaining to 

workpapers before issuing reports, workpapers needed to support each report were 

created as part of ongoing fieldwork and completed before each report was issued. 

- Except for the workpapers for the 2007 and 2008 FISMA reports, workpapers were 

provided to FEC OIG when requested. We have since located the original 2007 FISMA 

file – a 2 inch binder of workpapers. The workpaper binder for the 2008 FISMA Audit – 

also a two inch binder –was not located, and has been constructed from the existing 

electronic files created in 2008. 

- With regard to GPRA we would note that our GPRA work was not presented to FEC 

OIG as a GAGAS audit subject to peer review under GAS. The time period cited by FEC 

OIG – 2001 to 2007 – includes several years outside the scope of this peer review. (We 

would note that our GPRA work was neither addressed nor criticized in the peer reviews 

performed on CFTC OIG in 2001, 2004, and 2007). 

- CFTC OIG’s GPRA work was the responsibility of the former CFTC Deputy Inspector 

General. He retired in 2007. We did not believe it advisable to present the GRPA work 

that was completed during the period of this review (October 2006-March 2007) mainly 

because, as non-GAGAS work, it fell outside the scope of this peer review. 

FEC OIG Analysis of Response

During the peer review fieldwork, the CFTC OIG failed to provide workpapers of two interviews 

conducted during the Use of Contractors audit; six other interview workpapers were not filed in 

the official audit file for review by the peer review team, but were later provided by the AIGA 

when requested by the FEC OIG. Based on these examples and the work we performed during 

the peer review, we stand by our statement that workpapers were not prepared in a timely 

manner. 
17

The 2007 GPRA report prepared for the March 2008 Semiannual Report (SAR) to Congress was 

within the scope of the current peer review. As presented in the SAR, the FEC OIG believed the 

work could be subject to GAGAS testing as an attestation engagement due to the CFTC OIG’s 

reporting statement to Congress: “Based upon those reviews, the OIG has determined that the 

Commission has complied with GPRA’s terms.” The lack of files to support the positive 

assurance presented in the SAR to Congress raised additional concerns with respect to the CFTC 

OIG’s ability to determine the type of work performed and minimum quality standards under 

which it could be performed. 

The CFTC OIG has agreed to implement the recommendations, and the FEC OIG believes that 

these recommendations when implemented will address the weaknesses identified.

b. Continuing professional education (CPE) requirements and documentation (repeat 

finding) 

GAS states in section 3.48 that “The audit organization should have quality control procedures to 

help ensure that auditors meet the continuing education requirements, including documentation 

of the CPE completed.” The Inspector General (IG) did not meet the GAS 80 hour CPE 

requirement for the two year period January 1, 2007 through December 31, 2008. Further, the 

IG did not meet the GAS minimum requirement of 20 hours of training in 2009. Our review 

identified the IG as conducting interviews for one audit selected for peer review, as well as 

signing all reports or memoranda to management and the Chairman communicating the results of 

the audits. The IG also stated he reviews all audit files, but does not sign-off as the reviewer. 

According to GAS, these are functions that require adherence to the GAS CPE requirements. 

This was also a finding identified in the prior peer review. During the 2007 peer review, neither 

the IG nor the former Deputy Inspector General met the 80 hour CPE requirement. 

We also found the CFTC OIG did not have adequate documentation to support the CPEs 

reported for the IG or other staff. In response to the prior peer review report finding regarding 

lack of adequate documentation of CPE training attended, the CFTC OIG proposed the following 

remediation strategy: 

“The Office of Inspector General will enhance its record keeping of the Continuing 

Professional Education (CPE) courses and hours for its staff. All staff members will 

supply to the administrative person all certificates and records of attendance at all CPE 

courses. In addition, each staff member is responsible for logging into a centralized MSExcel spreadsheet all pertinent details associated with any relevant CPE course work.” 

Our review of the centralized spreadsheet and supporting documentation again identified that 

staff did not obtain or maintain adequate support for training attended. Further, the CFTC OIG 

did not establish a two year reporting cycle and staff differed in how they applied the two year 

reporting period: some reported based on a fiscal year, others on a calendar year cycle. 
18

Recommendations – The CFTC OIG should: 

2.b.1 take steps necessary to ensure the staff meets their responsibilities for CPE requirements 

and maintain documentation, as described by GAS, supporting CPE hours earned. 

Because the prior finding has not been cleared by the practice to maintain a centralized 

spreadsheet, the following additional controls are recommended for the CFTC OIG: 

2.b.2 Staff required to comply with the GAS standards should include the requirement in their 

annual performance plans and monitor progress towards meeting the training objectives 

quarterly; 

2.b.3 Staff should only record CPEs for training that qualify as CPE under GAS; 14 

2.b.4 Adequate funds for training should be requested in order to meet the training 

requirements. The current annual budget of $5,000 for all staff may not be sufficient; and 

2.b.5 The centralized spreadsheet should be reviewed quarterly to ensure staff are on track to 

meet annual and biennial training requirements, as well as verify that adequate 

documentation to support CPEs reported in the spreadsheet are maintained. 

CFTC OIG Response

We agree with the findings and will implement the recommendations. With regard to item 2.b.4., 

additional funding will be requested only to the extent we are able to document the need. We would 

point out that, although the Inspector General has not participated in an abundance of classroom 

training during the peer review period, he has attended numerous professional meetings, including 

monthly meetings for the Inspectors General for the financial regulators (both prior and subsequent 

to passage of the Dodd-Frank Act), in which ongoing legal and regulatory issues applicable to the 

agency and the IG community were discussed. 

FEC OIG Analysis of Response

The CFTC OIG has agreed to implement the recommendations, and the FEC OIG believes that 

these recommendations when implemented will address the weaknesses identified. Further, the 

FEC OIG believes the results of this peer review are a reasonable basis to document the need for 

additional funding to ensure the CFTC OIG complies with the GAGAS CPE requirements. 

c. Reports made available to the public 

The CFTC OIG does not make audit reports available to the public via the internet when the 

reports are issued to the public, as required by the IG Reform Act of 2008 (IG Act). Specifically, 

the OIG’s contracted annual financial statement audit reports are not available on the OIG’s 

website. These annual audit reports are included in the agency’s annual Performance and 

Accountability Reports, which are made available to the public. As a result, the OIG has failed 

to adhere to the IG Act requirement that “not later than 3 days after any report or audit (or 

 

14 GAS, Guidance on GAGAS Requirements for Continuing Professional Education,” GAO-05-568G, April 2005. 
19

portion of any report or audit) is made publicly available, post that report or audit (or portion of 

that report or audit) on the website of the Office of Inspector General.” We noted that other 

reports are available on the OIG’s website, primarily Semiannual Reports to Congress, but no 

audit reports are available on the OIG’s publicly accessible internet website. 

CFTC OIG Directive No. 50 states: 

“The Administrative Assistant will distribute the final audit report to the auditee, the 

Chairman, and other appropriate members of CFTC management. Audit reports are 

written with disclosure to the public in mind; see section 8.05 of the Government 

Auditing Standards, July 2007 Revision. In accordance with the IG Reform Act of 2008, 

an audit is posted to the CFTC OIG website not later than 3 days after the report is made 

publicly available. 5 U.S.C. App. 3 Sec. 8L.” 

Based on these facts, the CFTC OIG is not compliant with its own policies and procedures for 

making reports available in accordance with the IG Reform Act. 

Recommendation – The CFTC OIG should: 

2.c.1 make its reports available to the public in accordance with internal policies, procedures, 

and the IG Reform Act of 2008. 

CFTC OIG Response

We agree with the findings and recommendations. A link to the financial statement audit has 

been added to the CFTC OIG webpage. 

FEC OIG Analysis of Response

The FEC OIG believes the CFTC OIG has taken steps in the right direction to implement this 

recommendation. 

d. Audit planning control assessment was not performed or documented (repeat finding) 

GAS section 7.16, Field Work Standards for Performance Audits, indicate that auditors should 

obtain an understanding of internal controls significant to the audit objective. If the auditor 

determines that certain standards do not apply, or if an applicable standard is not followed, the 

reason therefore, and the known effects of not following the applicable standard should be 

documented. The GAS Reporting Standard for Performance Audits states that auditors should 

include in the audit report, the scope of their work on internal controls, any significant 

deficiencies found during the audit and any departures from GAS. During our review of the 

workpapers for the Use of Contractors audit we found that the CFTC OIG did not document an 

assessment of internal controls. Further, it was not documented in the workpapers or the audit 

report that internal controls were not assessed. This finding was also reported in the prior peer 

review conducted by the NEH OIG in 2007. 

The Use of Contractors audit “sought to ensure that the Agency was not employing contractors 

to perform inherently governmental functions and, for the two largest contracts, was not 
20

employing contractors to perform work that could be performed by agency employees at lesser 

cost.” Both the Executive Summary and the Objectives, Scope and Methodology sections of the 

final audit report indicated that a detailed cost benefit analysis would be, and had been 

performed, for the two contracts selected for detailed review. The Conclusion section of the 

audit report, however, stated that a detailed analysis was not performed based on opinions of 

those interviewed. Legal criteria is documented in the audit report and file, however OIG staff 

did not use that criteria to assess whether or not the agency had adequate internal controls to 

ensure services that were considered “inherently governmental” were not contracted to external 

providers. 

Recommendations – The CFTC OIG should: 

2.d.1 conduct adequate audit planning and sufficiently assess internal controls, audit risk, and 

user needs; 

2.d.2 plan and perform audit testing to meet GAS requirements and user needs; 

2.d.3 clearly document planning decisions and deviations from GAS in the audit file and 

report; and 

2.d.4 employ an experienced auditor to augment the current non-audit OIG staff. 

CFTC OIG Response

The Executive Summary for the Use of Contractors report stated that OIG sought to “ensure that 

the Agency. . . for the two largest contracts, was not employing contractors to perform work that 

could be performed by agency employees at lesser cost.” The Objectives, Scope and 

Methodology section stated that OIG sought “to ascertain whether the services obtained through 

[the two largest contracts] could be obtained in equal measure through CFTC full time 

employees and, if so, whether the use of contractors in place of full time employees was costeffective.” The Report made clear that cost was a concern to be addressed, but did not state that a 

detailed cost benefit analysis had been performed, and though we were aware that examination 

of the Agency’s use of contractors may require a cost comparison – not cost benefit analysis -, 

ultimately we concluded that even a cost comparison was not needed. We fail to understand how 

FEC OIG can claim that both the Executive Summary and the Objectives, Scope and 

Methodology sections of the final audit report indicated that a detailed cost benefit analysis 

would be, and had been performed, because they do not provide any reference to the text. 

However, we agree that our decision not to perform a cost comparison should have been 

documented in the work papers even though the decision was clearly explained in the report. 

The Report explained: 

If the task requires unusual expertise such that qualified individuals cannot be obtained at CT 

pay levels, or if the work is temporary in nature, it may be impossible or impracticable to find 

individuals willing to work for CT pay or on a temporary basis. If that is the case, it will be 

appropriate to hire contract employees. 
21

With regard to the two largest contracts, CFTC OIG concluded that the services procured required 

sufficiently unusual expertise (i.e., computer programming) or work of a temporary nature (i.e., both 

computer programming and help desk services for successive IT systems and processes used at 

CFTC), to warrant treatment of both services as necessitating the use of contractors rather than full 

time employees. That is, in order to transition to successive systems for programming and help desk 

services, contractors would be able to provide constant and rapidly evolving services, while full time 

employees would require constant retraining that would result in a sacrifice of speed and efficiency, 

with little to no benefit associated with prior experience with defunct Agency IT systems. 

Consequently, we determined that the Agency’s need to be able to quickly transition to new systems 

mandated the use of contract employees and that the work performed under these contracts could 

NOT be provided in equal measure by full time employees,15 and stated our conclusion in the section 

titled “Conclusions.” We disagree with the FEC’s statement that a cost-benefit analysis was 

necessary. 

Use of Contractors ultimately was not conducted as a GAGAS audit. Accordingly, at footnote 18, the 

Report stated: “During this review we chose not to examine the internal controls associated with 

producing help-desk data such as frequency of service calls.” We did not address our decision 

whether to examine controls associated with other Agency functions involved with our review, and 

agree that standards applicable to GAGAS-compliant audits would require more detailed treatment of 

Agency controls. During our field work for Agency Use of Contractors, we determined the level of 

effort necessary to test Agency controls would not bring value to the project, which had a narrow 

purpose. 

We agree with the findings (as tempered by our comments, above) and will implement the 

recommendations for all future audits. 

FEC OIG Analysis of Response

We acknowledge the Use of Contractors audit report did not specifically indicate that a detailed 

cost-benefit analysis would be performed. However, our conclusion remains unchanged; the 

audit work performed was insufficient to achieve the stated objectives, as required by GAGAS. 

The CFTC OIG’s Semiannual Report to Congress at the completion of the audit stated that 

CFTC OIG “. . . chose to examine in detail the two largest Agency contracts resulting in the 

greatest influx of contract employees to ensure that these tasks could not be performed by 

Agency employees at lesser cost” [emphasis added]. In addition, the Objectives, Scope, and 

Methodology section of the audit report for the Use of Contractors states “. . . ascertain whether 

the services obtained through these contracts could be obtained in equal measure through CFTC 

full time employees and, if so, whether the use of contractors . . . was cost effective.” In order 

to be in compliance with GAGAS 1.29, which states, “Audit objectives that focus on economy 

 

15 CFTC OIG Response: Granted, our analysis was based mostly on interviews of CFTC employees; however, we 

did not limit our interviews to CFTC employees with an interest in the outcome of our review. In addition to CFTC 

IT managers (who arguably might seek affirmation that the use contract employees was proper), we interviewed 

users who depend on CFTC IT services to monitor the markets and enforce the Commodity Exchange Act. We also 

interviewed current CFTC employees who had previously performed the same services now performed under the 

two largest contracts (starting either as full time or contract employees), but had transitioned to other full-time work 

at CFTC. 
22

and efficiency address the costs and resources used to achieve program results,” a cost 

comparison or analysis should have been performed to achieve the CFTC OIG’s audit objective. 

In regards to the intended scope of the Use of Contractors audit, based on the CFTC OIG’s 

planning documents and Executive Summary of the audit report, CFTC OIG’s objective “. . . 

was to provide the Chairman with a complete picture of the Agency’s use of contractors . . .” 

[emphasis added]. This objective concludes that the audit was not intended to have a narrow 

purpose. 

The FEC OIG encourages the CFTC OIG to take all recommendations in consideration to 

improve the indentified weaknesses, and to also comply with GAGAS 1.29 for future audits that 

include objectives related to economy and efficiency. 

e. Audit evidence and documentation 

Numerous deficiencies in audit evidence and documentation were noted in the Agency’s Use of 

Contractors audit workpapers. First, the audit relied nearly exclusively on testimonial evidence. 

The audit planning for the Use of Contractors audit did not identify sources of audit evidence and 

determine the amount and type of evidence needed given audit risk and significance. GAS 

section 7.55 requires auditors to “... obtain sufficient, appropriate evidence to provide a 

reasonable basis for their findings and conclusions.” It does not appear the audit team 

adequately assessed the nature and profile of the program and the needs of potential users of the 

audit report. For the two contracts selected for detailed review by the CFTC OIG, the report did 

not convey the relative costs and staffing levels for the periods when CFTC employees were 

used compared to the current model of fully contracted services. Further, the report did not 

describe current and forward year contract costs or staffing levels compared to projected costs if 

CFTC had retained employees or chose to convert the contracts back to the federal employees. 

The information on number of employees, relative costs of employees compared to contractors, 

current and forward year contract costs, and analysis between the two options was necessary to 

meet the stated audit objective that “for the two largest contracts, was not employing contractors 

to perform work that could be performed by agency employees at lesser cost.”

The team did not perform sufficient work to evaluate the objectivity, credibility, and reliability of 

testimonial evidence. Some of the testimonial evidence was not located in the audit file, but was 

produced during the peer review. Other testimonial evidence referenced in the audit file could 

not be located. Detailed review of some interviews by the peer review team showed 

inconsistencies between information presented as fact in interviews, compared to contract 

information and summary schedules present in the workpapers. 

The audit workpapers did not include documentation to describe the sampling method used and 

whether or not the method was appropriate for the audit objectives. Further, the audit file did not 

include documentation describing the analysis or testing performed on 235 contracts initially 

reviewed to obtain the sample of 65 contracts described in the audit report. There is also no 

documentation in the file to support that the OIG staff performed sufficient work to determine 

the reliability of information obtained from the Contracting Officer used as the initial population 

for detailed testing. In addition, OIG staff did not clearly document the work performed to 
23

support significant judgments and conclusions, including descriptions of transactions and records 

examined. The detail on whether or not the 65 contracts were tested as inherently governmental 

is not documented in the workpapers. 

The workpapers did not include internal referencing or summary workpapers to enable an 

experienced auditor to understand the nature, timing, and extent of work performed. Only by 

performing a detailed review of the limited audit file and holding repeated interviews with OIG 

staff was the peer review team able to understand the extent of work performed for the Use of 

Contractors audit. 

OIG staff did not ensure all mandatory or presumptively mandatory16 GAGAS requirements 

were met or achieved by alternate procedures in accordance with GAS section 1.12a. In 

addition, the reasons for departures from GAGAS requirements were not documented in 

accordance with GAS section 1.12b. 

For the 2009 FMFIA A-123 audit, findings and recommendations were not developed for the 

audit. Instead, the OIG staff member documented comments on CFTC control assessments 

where exceptions were noted, and the OIG communicated them verbally to management. 

Responses from management to the OIG were also received verbally and not documented in the 

audit file. The OIG staff member did not prepare a comment sheet on each control assessment 

reviewed. Instead, comment sheets were only prepared for control assessments if a deficiency 

was noted. This practice could not allow the person conducting supervisory review to determine 

whether all control assessments had been reviewed by the OIG and that the testing was complete. 

Recommendations – The CFTC OIG should: 

2.e.1 require staff attend audit training to ensure they plan for, obtain, and prepare adequate 

audit evidence to comply with the GAS standards; 

2.e.2 develop findings and clearly document the communication of the findings to 

management, and management’s agreement or disagreement with the findings; 

2.e.3 retain the information on communicated findings, management’s response, corrective 

actions taken by management, and OIG verification of corrective actions in the audit file, 

and also include the information in the audit report, where applicable. 

 

 

16 GAS 1.07 defines the two categories of professional requirements, identified by specific terms, to describe the 

degree of responsibility they impose on auditors as follows: a) unconditional requirements associated with the words 

must or is required, and b) presumptively mandatory requirements associated with the word should. Under the 

standard, “Auditors and audit organizations are required to comply with presumptively mandatory requirements in 

all cases where the requirement applies; however, in rare circumstances, auditors and audit organizations may depart 

from a presumptively mandatory requirement provided they document their justification for the departure and how 

the alternative procedures performed in the circumstances were sufficient to achieve the objectives of the 

presumptively mandatory requirement.” 
24

CFTC OIG Response

FEC OIG states: “[t]he team did not perform sufficient work to evaluate the objectivity, 

credibility, and reliability of testimonial evidence.” We would point out that we did note in the 

report the unanimity among help desk users, all of whom stated they were satisfied with the level 

of assistance obtained from the contract help desk workers, as well as the unanimity among 

former help desk employees who had transitioned to other Agency jobs and uniformly opined the 

job was more suitable for contractors due to the need to update the skill set on the help desk to 

keep pace with evolving Agency systems. Certainly help desk users and former help desk 

employees were questioned in order to, among other things, reveal inaccuracies and any possible 

bias in the statements given by IT management (who might be presumed to harbor a bias in favor 

of the correctness of their contracting decisions in the IT area). In the absence of disagreement 

across the various players (help desk users, IT management and former help desk employees), 

which we believed to be an indicator of credibility, we were not inclined to devote further 

resources to test credibility and reliability. 

FEC OIG states: “[d]etailed review of some interviews by the peer review team showed 

inconsistencies between information presented as fact in interviews, compared to contract 

information and summary schedules present in the workpapers.” Because FEC OIG did not 

describe the substance of any interview they believed to be inaccurate, and did not describe the 

materials in the record that, in their mind, created an inconsistency, we disagree and cannot 

respond. We interviewed over 30 people for this review, and do not know which ones FEC OIG 

oppose. We also note FEC OIG does not indicate whether the perceived inaccuracies were 

relevant and material to the findings and recommendations in the report. 

FEC OIG states: “[t]here is ...no documentation in the file to support that the OIG staff 

performed sufficient work to determine the reliability of information obtained from the 

Contracting Officer used as the initial population for testing.” We would note that FEC OIG was 

incorrect that the initial population for our testing was provided by the Contracting Officer. We 

directly accessed the CFTC contracts data base to select our initial sample. Moreover, the 

population of CFTC contracts is reviewed each year as part of the financial statement audit. We 

did not believe it necessary or efficient to repeat the exercise for this review. However, we agree 

that our decision not to perform additional work to determine the reliability of information 

obtained from the CFTC contracts data base and reasons therefore should have been documented 

in the work papers. 

To the extent FEC OIG addresses the lack of a cost-benefit analysis in the Use of Contractors 

report, we repeat our previous statements regarding this issue. 

We agree (except as noted above) with the findings and will implement the recommendations for 

all future audits. 

FEC OIG Analysis of Response

The FEC OIG is encouraged by the CFTC’s agreement to implement improvements to their audit 

process. It is our professional judgment that the CFTC OIG did not perform sufficient work to 

evaluate the objectivity, credibility, and reliability of testimonial evidence to achieve their stated 

objective: “...for the two largest contracts, was not employing contractors to perform work that 
25

could be performed by agency employees at lesser cost.” When using testimonial evidence, 

GAGAS states: 

• 7.61- Testimonial evidence may be useful in interpreting or corroborating documentary 

or physical information. Auditors should evaluate the objectivity, credibility, and 

reliability of the testimonial evidence. Documentary evidence may be used to help verify, 

support, or challenge testimonial evidence. 

• 7.68- Auditors should determine the overall sufficiency and appropriateness of evidence 

to provide a reasonable basis for the findings and conclusions, within the context of the 

audit objectives. 

• 7.70 b (3)- Evidence is not sufficient or not appropriate when . . . the evidence does not 

provide an adequate basis for addressing the audit objectives or supporting the findings 

and conclusions. Auditors should not use such evidence as support for findings and 

conclusions. 

In addition, based on the sole use of interviews to achieve the CFTC OIG’s stated objective, the 

failure to produce all interviews to the FEC OIG; the lack of workpaper support maintained in 

the official audit file; and the inconsistencies of documented information continues to support the 

FEC OIG’s statement that sufficient work was not performed and documented to support the 

findings and conclusions. The substance of these instances was discussed with the CFTC OIG 

during fieldwork and at the August 27, 2010 discussion meeting, and we were prepared to 

discuss them further during the exit conference, but as previously mentioned, the CFTC OIG was 

ill prepared to discuss the report in any detail. No concerns relating to the above were brought to 

our attention during the exit conference. 

f. Reporting is not compliant with GAGAS 

The CFTC OIG failed to meet GAGAS reporting standards in the Use of Contractors audit 

report. The report failed to disclose or clearly explain the relationship between the population 

and the items tested, and how the audit’s methodology and the completed audit work supports 

the audit objectives. According to GAS section 8.13, “In reporting audit methodology, auditors 

should explain how the completed audit work supports the audit objectives, including the 

evidence gathering and analysis techniques, in sufficient detail to allow knowledgeable users of 

their reports to understand how the auditors addressed the audit objectives.” 

Further, the final report did not contain the views of the responsible officials, evaluation of 

management comments, a copy of the responsible officials’ written comments (or a summary), 

or any information on whether or not management comments were requested or provided, in 

accordance with GAS sections 8.33 and 8.43. The audit file indicates management did provide 

some comment on the draft report. 

The CFTC OIG provided a draft report to management but did not provide a final report. The 

OIG indicated to the peer review team a final report was not provided because there were no 

changes between the draft and final report. However, the peer review team noted differences 

between the draft and final reports, such as the addition of two appendices, and the draft report 
26

contained a “draft” watermark throughout the written report provided to management for 

comment. 

The 2009 FMFIA A-123 Control audit report was actually a one paragraph memorandum. The 

memorandum did not explain: 

• the audit’s objectives in a clear, specific manner; 

• the reason(s) for undertaking the audit; 

• the audit’s scope, including: 

o the relationship between the population and the items tested; 

o the period covered by the audit; 

o the kinds and sources of evidence used; and 

o how the audit’s methodology and completed audit work supports the audit 

objectives. 

The audit report (memorandum) did not include the views of the responsible officials even 

though issues were identified by the OIG, and based on discussion during the peer review; the 

issues were communicated to management verbally. It appears oral comments were provided 

from management because the workpapers noted control deficiencies as “cured,” however, a 

summary of the oral comments was not prepared and provided to the responsible officials for 

verification, and no management comments were included in the memorandum or the 

workpapers. 

The purpose of the final audit is for the OIG “to ensure that Agency managers continuously 

monitor and improve effectiveness of internal control associated with their programs in 

accordance with applicable standards set by OMB.” The memorandum gave negative assurance 

but did not detail the scope of work on internal control and any deficiencies in internal control 

that were significant within the context of the audit objectives. The memorandum did not state 

that the audit was planned and conducted as a limited review and in accordance with GAGAS, 

therefore, there was no mention of GAGAS in the report (memorandum). 

The quality control checklist used to assess and ensure reporting to GAGAS standards was not 

prepared for the Use of Contractors audit. The checklist prepared for the FMFIA audit failed to 

ensure the memorandum issued to the agency Chairman complied with GAGAS reporting 

standards. 

Recommendation – The CFTC OIG should: 

2.f.1 maintain a checklist devised from the peer review guidance for each audit file to ensure 

all audit reports issued by the office contain adequate disclosures to support GAGAS 

reporting standards. 

CFTC OIG Response

We disagree with portions of the findings but will implement the recommendation for all future 

audits. We would note once more that, with regard to the Use of Contractors report, noncompliance 

with GAGAS stems from our consideration of that project as a non-GAGAS review. Prior to 

submitting Use of Contractors to the Acting Chairman, we provided a copy to the Executive Director 
27

and the Chief Information Officer (CIO). The Executive Director supervises both the contracting 

function and the IT department at the Agency. 

The Chief Information Officer requested a minor editorial change to one sentence in the draft, and we 

altered one sentence in the draft from this – 

 Furthermore, the CIO believed it possible that the help-desk may decrease in 

 size as the agency takes on younger employees who are more computer savvy 

 and less in need of frequent help-desk assistance. 

 

 to this – 

 Furthermore, the CIO believed that as the agency takes on younger 

 employees who are more computer savvy and less in need of frequent help- 

 desk assistance the demand for help-desk services may decrease. 

This process – i.e., the draft report submitted to the Executive Director and CIO, the CIO’s requested 

change, and the text of the new language we came up with to satisfy this minor concern – is 

documented in the working papers for Use of Contractors (which were supplied to FEC OIG for this 

peer review). 

Given the minor nature of the requested change, we did not believe it necessary to ask the Executive 

Director and the CIO to review and comment on the draft a second time. We surely did not believe 

they would want to review the report a second time simply to see it without a “DRAFT” watermark. 

What mattered was the Executive Director and the CIO concurred with our findings and 

recommendations. In the cover memo to the Acting Chairman accompanying the Use of Contractors 

report, the Inspector General let the Acting Chairman know that the Executive Director and Chief 

Information Officer had been consulted and both agreed with the recommendations. This cover 

memo is also contained in the working papers. Acquiescence by the Executive Director and the CIO 

was verbal and the cover memo documents the verbal consent. 

The FMFIA 2009 report was not an audit. As previously stated, CFTC OIG’s error was in describing 

the report inconsistently, as a limited review but also with reference to GAGAS compliance. We take 

this error seriously and take responsibility for creating any confusion. 

We agree with the findings (as tempered by the discussion, above) and the recommendations.

FEC OIG Analysis of Response

As stated previously, the FEC OIG conducted a work product analysis to determine the GAGAS 

audit population for testing. The basis of the FEC OIG’s conclusion for the selected audits is 

outlined in the table on page five and includes six criteria. Contrary to CFTC OIG’s response 

above that the 2009 FMFIA assignment was not an audit, we determined the assignment was an 

audit based on a preponderance of the criteria detailed on page five of this report. 

The CFTC OIG has agreed to implement the recommendation, and the FEC OIG believes that 

the recommendation when implemented will address the weakness identified.
28

In addition to reviewing its system of quality control to ensure adherence with Government 

Auditing Standards, we applied certain limited procedures in accordance with guidance 

established by the CIGIE related to CFTC OIG’s monitoring of audit engagements performed by 

independent public accountants (IPA) under contract where the IPA served as the principal 

auditor. It should be noted that monitoring of engagements performed by IPAs is not an audit 

and therefore is not subject to the requirements of Government Auditing Standards. The purpose 

of our limited procedures was to determine whether CFTC OIG had controls to ensure IPAs 

performed contracted work in accordance with professional standards. However, our objective 

was not to express an opinion and accordingly, we do not express an opinion, on CFTC OIG’s 

monitoring of work performed by IPAs. We made certain comments related to CFTC OIG’s 

monitoring of engagements performed by IPAs that are included in a separate letter dated March 

31, 2011. 

Lynne A. McFarland, Inspector General 

Federal Election Commission 

Enclosure 
29

SCOPE AND METHODOLOGY (Enclosure 1)

Scope and Methodology 

We tested compliance with the CFTC OIG’s audit organization’s system of quality 

control to the extent we considered appropriate. These tests included a review of two of 

seven audit reports issued during the semiannual reporting periods ending March 31, 

2007 through March 31, 2010. 

In addition, we reviewed the CFTC OIG’s monitoring of engagements performed by 

IPAs where the IPA served as the principal auditor during the period May 21, 2009 

through December 31, 2009. During the period, CFTC OIG contracted for the audit of its 

agency’s fiscal year 2009 financial statements. 

Reviewed Engagements Performed by CFTC OIG 

Report No. Report Date Report Title

08-01 8/1/2008 Review of Agency Use of Contractors 

09-03 10/30/2009 2009 FMFIA A-123 Review 

Reviewed Monitoring Files of CFTC OIG for Contracted Engagements 

Report No. Report Date Report Title

09-01 11/15/2009 Report of the Independent Auditors U.S. 

Commodity Futures Trading Commission 

Financial Statements for Fiscal Year 2009