Office of the Inspector General

Commodity Futures Trading Commission 

Review of Management Assurances 

for Internal Controls (2014-2015) 

June 7, 2016 
 

 

U.S. COMMODITY FUTURES TRADING COMMISSION
 

OFFICE OF INSPECTOR GENERAL
 

Three Lafayette Centre
 

1155 21st Street, NW, Washington, DC 20581
 

Telephone: (202) 418-5110
 

Facsimile: (202) 418-5522
 

Table of Contents 

Introduction ........................................................................................................................ 1
 

Office of the Inspector General (OIG) Determinations ...................................................... 1
 

Summary of Management Comments ................................................................................ 2
 

Evaluation of Management Comments .............................................................................. 2
 

Objective, Scope, and Methodology....................................................................................2
 

Appendix A - Acronyms and Abbreviations........................................................................ 4
 

Appendix B - Evaluation of Statement of Assurances ........................................................ 5
 

Appendix C - ERM Benchmarks ......................................................................................... 7
 

Appendix D - Criteria Governing Internal Control for Federal Agencies ..........................8
 

Appendix E - Management Comments............................................................................. 10
 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(Report No.: 16REV01) 

Introduction 

The Commodity Futures Trading Commission (CFTC) relies on a certified Statement of 

Assurance (SOA) produced by each of its divisions/branches/offices (reporting units) as 

the basis for the CFTC overall SOA. For fiscal year (FY) 2015, CFTC management issued 

a qualified SOA, indicating that the agency’s internal controls and financial 

management systems met the objectives of the Federal Managers' Financial Integrity 

Act (FMFIA),1 with one exception. Other than an outstanding exception related to the 

recording of lease obligations,2 the CFTC asserted its internal controls were operating 

effectively, and that no other reportable conditions presented throughout the year. For 

FY 2014, the CFTC declared that it conformed to FMFIA requirements without any 

exceptions. 

Office of the Inspector General (OIG) Determinations 

While the CFTC documented support for FMFIA section 4 assurances3 for FY 2014 and 

FY 2015, the CFTC can better document support for section 2 requirements4 associated 

with certain mission operations and supporting reporting units. As detailed in Appendix 

A, seven of 14 reporting units 5 were not able to fully support the positive assertions 

made in their FY 2014 SOAs. For FY 2015, six of 14 reporting units, all repeating from 

the prior year,6 were not able to fully support their SOAs. As such, the enterprise-wide 

assertions are also not fully supported. Currently, the CFTC Financial Management 

Branch (FMB), in coordination with a contracted subject matter expert, is deploying a 

benchmark enterprise risk management (ERM) process to establish an effective internal 

control system. As such, we are optimistic that in the near future the CFTC can serve as 

a best practice for other federal agencies. We noted three actions that would permit 

CFTC to create a structure as envisioned by the U.S. Government Accountability Office 

(GAO) Standards for Internal Control in the Federal Government (Green Book). We 

believe that the CFTC should: 

1. Establish a Chief Risk Officer (CRO) and reporting unit champions, 

2. Define roles and responsibilities for the CRO and reporting unit champions, and 

3. Develop and communicate an implementation plan. 

1 Pub. L. No. 97-255, 96 Stat. 814 (1982). FMFIA requires federal agencies to maintain administrative and financial controls and 

capable and secure financial systems. FMFIA further requires the agency head to issue the annual SOA. 2 For an explanation of the outstanding lease issue, see the FY 2015 Financial Statements Audit.
 3 Section 4 assurances are relevant for reports of controls over financial management systems. FMFIA, sec. 4, Pub. L. No. 97-255, 96
 

Stat. 814 (1982) (codified at 31 USC 3512).
 4 Section 2 requirements are relevant for reports of controls over programs and operations. FMFIA, sec. 2, Pub. L. No. 97-255, 96
 

Stat. 815 (1982) (codified at 31 USC 3512).
 5 The seven reporting units are: DCR, ESB, HR, OCO, ODT, OCE, and OED. See Appx. A for a guide to all acronyms.
 6 The six reporting units are: DCR, ESB, OCO, ODT, OCE, and OED.
 

1 | Page 
 

 

 

 

 

 

 

 

 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(Report No.: 16REV01) 

Summary of Management Comments 

Management appreciated our internal control observations and committed to improving 

the basis for underlying statements of assurance provided by each division, branch, and 

office. Management agrees that a full-time position managing the CFTC's internal 

controls and risk management program would be beneficial for the Commission. 

Although the employment of a CRO would be beneficial at a large agency to consolidate 

the agency-wide risk management effort and ensure that the agency has a strategicallyaligned portfolio view of its risks, management believes that, at a smaller agency such as 

the CFTC, the installation of an FMFIA Program Manager is more appropriate, given the 

size of the Commission and the level of maturity of our risk management program. 

Currently, the CFTC does not have the resources to hire an FMFIA Program Manager; 

however, the request has been included in the Office of the Executive Director's 

prioritization, should additional resources become available. 

Management concurred with the concept of "reporting unit champions" and noted that 

the respective Business Managers for the Commission's divisions, branches, and offices 

are currently functioning in the described role referenced in the OIG's report. The 

implementation plan referenced in the OIG's report is currently underway as part of the 

annual FMFIA assessment program and is continuing to be refined as the Commission 

matures in its risk management practices. 

Evaluation of Management Comments 

Given budgetary constraints, management’s actions are responsive to the report 

recommendations. Management’s response in its entirety is presented in Appendix E. 

Objective, Scope, and Methodology 

Our objective was to assess the CFTC’s justification for its SOA for internal controls. 

Specifically, we assessed whether each CFTC reporting unit documented evidence for 

attributes of an effective internal control system and whether annual test results 

supported the reporting units’ and enterprise-wide assertions. To do this, the Chief 

Financial Officer (CFO) office provided us with all of the 2014 and 2015 SOAs for each 

division. In addition, we requested that each division provide us the support used to 

certify their SOA. We also researched relevant benchmarks, and laws and regulations 

pertaining to the subject matter. See Appendix B and Appendix C for more detail about 

the benchmarks and legal requirements, respectively. We did not rely on system data to 

support our observations; our observations derive from in person interviews and 

document review. We conducted this review from February 2016 to April 2016 in 

accordance with the Quality Standards for Inspection and Evaluation, as published by 

the Council of the Inspectors General on Integrity and Efficiency. 

2 | Page 
 

 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(Report No.: 16REV01) 

The report will be published on the OIG webpage and a synopsis will be presented in the 

September 30, 2016 Semiannual Report to Congress. If you have any questions, please 

contact me at (202) 418-5084 or Timothy Peoples, Lead Auditor, at (202) 418-5439. 

A. Roy Lavik, Inspector General 

Judith A. Ringle, Deputy Inspector General 

Miguel A. Castillo, Assistant Inspector General for Auditing 

3 | Page 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(Report No.: 16REV01) 

Appendix A 

Acronyms and Abbreviations 

BMP Business Management and Planning 

CA Control Activities 

CE Control Environment 

DCR Division of Clearing and Risk 

DMO Division of Market Oversight 

DOE Division of Enforcement 

DSIO Division of Swap Dealer Intermediary Oversight 

ERM Enterprise Risk Management 

ESB Executive Secretary Branch 

FMB Financial Management Branch 

HRB Human Resources Branch 

IC Information and Communication 

M Monitoring 

OCE Office of the Chief Economist 

OCE Office of the Executive Director 

OCO Office of Consumer Outreach 

ODT Office of Data and Technology 

OED Office of the Executive Director 

OGC Office of the General Counsel 

RA Risk Assessment 

WBO Whistleblower Office 

4 | P age 
 

 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

Appendix B 

Evaluation of Statement of Assurances 

FY 2014 

As illustrated in Table 1, all reporting units submitted a certified SOA for FY 2014. 

However, two of 14 CFTC reporting units (HRB and ESB) did not provide support for 

their attested statements. The HRB stated that documentation substantiating their 

affirmative assertion was not available because the person previously responsible is no 

longer in that position. The ESB stated that they did not have any management control 

reports, but that they relied on several types of information to answer the internal 

control questionnaire. However, we could not map the documents provided by ESB to 

the five attributes of an effective internal control system. 

For the remaining 12 reporting units, four (DCR, OCO, ODT, and OED) did not provide 

support for statements made for RA, and four (OCE, OCO, ODT, and OED) did not 

provide support for monitoring activities. Given that the CA measures management 

responses to identified risks, we question whether the CA could accurately evaluate the 

adequacy of control activities without appropriate RA documentation. Therefore, for 

the four reporting units without RA support documentation, we could not evaluate the 

CA. 

The ODT’s CA acts to illustrate the issue. ODT’s CA identified four control activities, all 

primarily associated with budget execution. However, it did not mention an 

Information Technology (IT) governance structure or a life cycle management practice 

for information systems, which are highly important for the office. In fact, ODT is 

supposed to comply with Principle 11 of the Green Book, which has specific instructions 

for the entity design of information systems and related control activities. Rule 11 is 

meant to aid in achieving objectives and responding to risks. Specifically, the following 

attributes contribute to the design, implementation, and operating effectiveness of an IT 

governance structure, but were not discussed in ODT’s RA or CA: 

• Design of the Entity’s Information System 

• Design of Appropriate Types of Control Activities 

• Design of Information Technology Infrastructure 

• Design of Security Management 

• Design of Information Technology Acquisition, Development, and Maintenance 

5 | Page 
 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

Table 1 (See Appendix A Acronyms and Abbreviations) 

FY 2015 

Likewise for FY 2015, all reporting units submitted an affirmative SOA. However, we 

did not find much improvement in section 2 certifications from FY 2014 to FY 2015. As 

illustrated in Table 2, the results for FY 2015 remained very similar to those for FY 2014, 

with one exception; the HRB did fully support their SOA. For all reporting units where 

risk assessments were not supported, we express concern about the adequacy of 

documentation for control activities and cannot evaluate the adequacy of control 

activities. 

Table 2 (See Appendix A Acronyms and Abbreviations) 

6 | Page 
 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

Appendix C

ERM Benchmarks 

In FY 2015, the FMB committed to the ERM principles communicated in the GAO’s 

Green Book. They contracted Kearney & Company to review and update their internal 

controls process annually for FMFIA. Kearney & Company communicated findings and 

recommendations to better ensure that controls meet the ERM requirements of the 

Green book as well. Based on a draft revision of OMB Circular A-123, we note that: 

• A CRO should be established to provide continuous leadership in risk management 

for the agency. The primary purpose of this position is to function as a senior expert 

advisor and technical advisor to senior executives. They champion agency-wide 

efforts to manage risk within the organization, and they advise on creation of a 

strategically-aligned portfolio view of risks at the organization. A CRO may serve as a 

strategic advisor to the Chief Operation Officer and other staff on the integration of 

risk management practices into day-to-day business operations and decisionmaking. CROs generally work with business unit managers within their 

organizations to identify issues in a timely manner to allow for proactive 

management of programs and to facilitate informed, data-driven decision-making. 

• An implementation plan should be used to embed the ERM into management 

practices. The plan should cover, at a minimum, planned risk management 

governance structures, expected processes for developing risk awareness, 

methodologies for developing and completing risk profiles, key project phases, 

defined work streams, milestones, resources and timing. 

• Reporting unit champions act as the primary liaison between the CRO and their 

respective units. Champions also perform substantive mission-oriented work, serve 

as the senior-level expert advisor and technical staff for the unit, and assist the CRO. 

They assume primary responsibility for ensuring that regulations and policies are 

followed, and that unit request are both justified and adequately supported by 

appropriate risk analysis. 

7 | Page 
 

 

 

 

 

 

 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

Appendix D 

Criteria Governing Internal Control for Federal Agencies 

Federal Managers Financial Integrity Act of 1982 

The FMFIA of 19827 requires executive agencies, including the CFTC, to provide 

reasonable assurance that management accountability and internal controls ensure that: 

• Programs achieve their intended results; 

• Resources are used consistently with the agency's mission; 

• Resources are guarded against waste, fraud and mismanagement; 

• Information reliably and timely supports decision making; and 

• Laws and regulations are followed. 

Office of Management and Budget Circular A-123 

OMB Circular A-123, Management's Responsibility for Internal Control describes the 

requirements for compliance with FMFIA and defines management's responsibility for 

developing and monitoring an effective internal controls program. The Circular requires 

each agency to assess and report on the adequacy of internal controls over its programs 

and operations (FMFIA Section 2), and to assess, document, and report on controls over 

financial management systems to ensure conformance with government-wide 

requirements (FMFIA Section 4). 

OMB A-123 Section III A, Developing Internal Control, also states that it is 

management’s responsibility to develop and maintain effective internal control. As 

agencies develop and execute strategies for implementing or updating agency programs 

and operations, they should design management structures that help ensure 

accountability for results. As part of this process, agencies and individual Federal 

managers must take systematic and proactive measures to develop and implement 

appropriate, cost-effective internal controls. The degree to which studies and analysis 

are needed will vary depending on the complexity and risk associated with a given 

program or operation. 

Further, Section IV, Assessing Internal Control, specifies that agency managers should 

continuously monitor and improve the effectiveness of internal controls associated with 

their programs. Continuous monitoring and other periodic assessments should provide 

the basis for the agency head's annual assessment of, and report on, internal controls as 

required by FMFIA. Agency management should determine the appropriate level of 

documentation needed to support this assessment. Documentation should be 

7 31 USC § 3512(b) requires “the head of each executive agency” to establish and maintain detailed accounting and internal control 

systems. 31 USC § 102 defines “executive agency” for purposes of Title 31 as: “a department, agency, or instrumentality in the 

executive branch of the United States Government.” 

8 | Page 
 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

appropriately detailed and organized, and should contain sufficient information to 

support management’s assertion. Documentation should also include appropriate 

support from officials and personnel responsible for monitoring, improving and 

assessing internal controls. 

Standards for Internal Control in the Federal Government 

The U.S. GAO “Green Book” also provides managers criteria for designing, 

implementing, and operating an effective internal control system. The Green Book 

defines the standards through components and principles, and it explains why they are 

integral to an entity’s internal control system. The Green Book clarifies what processes 

management should consider part of the agency’s internal controls. In a mature and 

highly effective internal control system, internal controls may be indistinguishable from 

day-to-day activities that personnel perform. The Green Book identifies five components 

that represent the highest level of the hierarchy of standards for internal controls in the 

federal government. These five components are CE, RA, CA, IC, and M. The 2014 

revisions to the Green Book are expected to be effective for fiscal year 2016 and the 

FMFIA reports covering the current fiscal year. 

9 | Page 
 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

Appendix E
 

Management Comments

10 | Page 
 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

11 | Page 
 

 

 

Commodity Futures Trading Commission Management Assurances for Internal Controls 

Office of Inspector General (2014 -2015) 

(REPORT NO.: 16REV01) 

12 | Page