Office of the Inspector General

Commodity Futures Trading Commission

Semiannual Report to Congress

October 1, 2016 – March 31, 2017
I Office Of he Ins cctor General 

_AIG 

CommoJity F1lturrs Tr.tdinil Commitiion 

U.S. COMMODITY FUTURES TRADING COMMISSION 

Office of Inspector General 

Three Lafayette Centre 

1155 21st Street, NW, Washington , DC 2 0581 

Telephon e: (202) 418-5 110 

Facsimile: (20 2) 418-5522 

April 28, 2016 

TO: J. Christopher Giancarlo, Acting Chainnan 

Sharon Y. Bowen, Commissioner 

FROM: A. Roy Lavik n R ':R 

Inspector GenerY 

SUBJECT: Semiannual Repoti of the Office of the Inspector General 

Attached is the Office of the Inspector General's Semiannual Report for the period from 

October 1, 20 16, through March 30, 201 7. This report is submitted to you in accordance with 

the requirements of Section 5 of the Inspector General Act of 1978, as amended, and summarizes 

issued reports and ongoing projects during the reporting period. 

I appreciate your continuing support of this office. 
TABLE of CONTENTS

EXECUTIVE SUMMARY .......................................................................................................... 1

CFTC OIG MANAGEMENT and ADMINISTRATION......................................................... 5

AUDIT OPERATIONS ................................................................................................................ 8

Completed Audits, Inspections, Evaluations, Audit Reviews, and Other Audit Projects .............. 8

1. CFTC’s Policies and Procedures for Reviewing Registrants’ Cybersecurity Policies........ 8

2. Information Security Audit FY 2016: Compliance with Provisions of the Federal 

Information Security Modernization Act. ........................................................................... 8

3. Review of CFTC’s Defenses to Protect Sensitive Database Information. .......................... 9

4. Audit of the CFTC’s Annual Financial Report FY 2016 .................................................... 9

5. Audit of the CFTC’s Customer Protection Fund FY 2016................................................ 10

6. Readiness Review: Compliance with DATA Act of 2014 ................................................ 10

7. Audit Peer Review: Appalachian Regional Commission OIG.......................................... 11

Ongoing Audits, Inspections, Evaluations, Audit Reviews, and Other Audit Projects................ 12

1. Audit of CFTC’s Enterprise Architecture Program........................................................... 12

2. Audit of the CFTC’s FY 2017 Annual Financial Report .................................................. 12

3. Audit of the CFTC’s FY 2017 Customer Protection Fund................................................ 12

4. Audit of CFTC’s Oversight of NFA.................................................................................. 12

5. Lean Labor Audit of Division of Clearing and Risk and Division of Market Oversight 

Functions ........................................................................................................................... 13

Audit Reports and Reviews Over Six Months Old....................................................................... 13

Corrective Action Not Completed ............................................................................................ 13

Corrective Action Completed ................................................................................................... 13

Management Decision Not Made ............................................................................................. 13

Unimplemented Recommendations.......................................................................................... 13

INVESTIGATIVE OPERATIONS........................................................................................... 14

Completed Investigations.............................................................................................................. 14

1. Investigation into a Potential Information Technology Security Incident, Follow-up 

Report ............................................................................................................................... 14

2. ROI into Potential Violation of 18 U.S.C. 208: Acts Affecting a Personal Financial 

Interest ............................................................................................................................... 14

3. Preliminary Investigation into Allegation of Contractor Fraud......................................... 14

Ongoing Investigations................................................................................................................. 15

Investigative Statistics and Metrics .............................................................................................. 15

Summary of Matters Referred To Prosecutorial Authorities........................................................ 16
ECONOMIC ANALYSIS .......................................................................................................... 16

Ongoing Projects: Economic Analysis ........................................................................................ 16

1. Review of the Cost-Benefit Consideration for the Margin Rule for Uncleared Swaps .... 16

2. Economic Literature Review of OIG Reports on Agency Cost-Benefit Analysis under 

Dodd Frank, from 2011-2013............................................................................................ 16

3. Office of the Chief Economist Follow-up Review............................................................ 16

OTHER PROJECTS .................................................................................................................. 17

CFTC Lease Reviews ................................................................................................................... 17

Management Advisories ............................................................................................................... 17

Congressional Inquiries ................................................................................................................ 17

Legislative and Regulatory Projects ............................................................................................. 17

Peer Reviews................................................................................................................................. 18

Summary of Each Report Made To The Agency Head ................................................................ 19

Revised Management Decisions................................................................................................... 19

Inspector General Disagreement................................................................................................... 19

GAO Liaison................................................................................................................................. 19

STRATEGIC PLAN for the OFFICE of INSPECTOR GENERAL............................................ 20

CONTACTING the OFFICE of the INSPECTOR GENERAL ................................................... 23

TABLE 1 – Reports Issued with Questioned Costs...................................................................... 24

TABLE 2 – Reports Issued with Recommendations That Funds Be Put To Better Use.............. 25

TABLE 3 - Index of IG Act Reporting Requirements.................................................................. 26
1

EXECUTIVE SUMMARY

This semiannual report is issued by the Commodity Futures Trading 

Commission’s (CFTC’s) Office of the Inspector General (OIG) pursuant to the Inspector 

General Act of 1978, as amended.1 It summarizes OIG’s activities and accomplishments 

for the period October 1, 2016, through March 31, 2017. During this period, OIG 

completed four audits, two audit reviews, one investigation, and one follow up report for 

an investigation completed in the prior reporting period. OIG began or continued work 

on five audits, eight investigations, one economic literature review, and a review of 

CFTC’s consideration of costs and benefits in connection with its Margin Rule on 

Uncleared Swaps. In addition, the OIG Office of Audit peer reviewed audits of the 

Appalachian Regional Commission, Office of the Inspector General.

Highlights of completed and ongoing audits, investigations, economic 

analysis projects, and other projects include:

AUDIT OPERATIONS

Information Security

• CFTC’s Policies and Procedures for Reviewing Registrants’ Cybersecurity 

Policies. (October 11, 2016)

We found that CFTC and its oversight divisions have developed policies and 

procedures to address cybersecurity risks for CFTC registrants and identified five 

areas with recommendations where the CFTC could improve its policies and 

procedures toward reducing these cybersecurity risks.

• Information Security Audit FY 2016: Compliance with Provisions of the Federal 

Information Security Modernization Act.2 (February 28, 2017)

We found that CFTC demonstrated a re-energized focus resulting in an improved

cybersecurity posture. Most notable were the implementation of a vulnerability 

program and security monitoring tools. While CFTC’s information security 

program surpasses standards prescribed by FISMA at an “Effective” level, we 

suggested improvements for access controls and insider threats. This report is 

not public.

 1 P.L. 95-452, 92 STAT. 1101 (1978). 

2 P.L. 107-347, 116 STAT. 2946 (2002).
2

• Review of CFTC’s Defenses to Protect Sensitive Database Information.

(February 28, 2017)

ODT demonstrated compensating controls in place to mitigate high and medium 

risks identified. Therefore, we concluded that database security controls were 

likely effective in mitigating the risk of data loss or misuse. This report is not 

public.

Financial Management

• Audit of the CFTC’s FY 2016 Annual Financial Report (November 14, 2016)

Allmond & Co. presented an unqualified (clean) opinion on CFTC’s financial 

statements as of September 30, 2016, and determined its net costs, changes in 

net position, custodial activity, and budgetary resources for the year then ended 

were presented fairly in accordance with U.S. generally accepted accounting 

principles (GAAP).

• Audit of the CFTC Customer Protection Fund (October 28, 2016)

In its audit of the Fund, Allmond & Co. found the financial statements were fairly 

presented, in all material respects, in conformity with U.S. GAAP.

• Readiness Review: Compliance with DATA Act of 2014 (November 29, 2016)

Our review noted that under an interagency agreement, the Department of 

Transportation’s Enterprise Service Center is implementing the DATA Act 

requirements on behalf of CFTC and is on schedule to meet its first reporting 

deadline of May 2017.

Other Reports

• Audit Peer Review: Appalachian Regional Commission OIG (March 6, 2017)

We reviewed the system of quality control for the audit organization of the 

Appalachian Regional Commission (ARC) Office of the Inspector General (OIG) 

in effect for the three years ended September 30, 2016. In our opinion, the 

system of quality control for the audit organization of ARC OIG has been suitably 

designed and provides ARC OIG with reasonable assurance of performing and 

reporting in conformity with applicable professional standards in all material 

respects.
3

Ongoing

• Audit of CFTC’s Oversight of NFA. OIG continued an audit to examine CFTC 

oversight activities of the National Futures Association (NFA). The audit was 

nearing completion at the close of the reporting period; we issued a draft report 

to management for comment after the close of the reporting period.

• Audit of CFTC’s Enterprise Architecture (EA) Program. OIG initiated this audit to 

determine if CFTC (1) has established adequate baseline and target architectures; 

(2) has effective management practices, policies, and processes for the 

development, implementation, maintenance, and oversight of the EA program; 

and (3) has adequate resources to realize target architectures.

• Lean Labor Audit of CFTC’s Division of Clearing and Risk and Division of Market 

Oversight. OIG initiated this audit to determine if these Divisions could more 

efficiently balance labor and workload.

• Audit of the CFTC’s FY 2017 Annual Financial Report (AFR) The objective of this

Congressionally mandated audit is to render an opinion on the agency financial 

report (financial statements) in accordance with Generally Accepted Government 

Auditing Standards (GAGAS). 

• Audit of the CFTC’s FY 2017 Customer Protection Fund (CPF). The objective of 

this Congressionally mandated audit is to render an opinion on customer 

protection fund financial statements in accordance with GAGAS. 

Investigative Operations

Completed Investigations

• Investigation into a Potential Information Technology Security Incident,

Follow-up Report (December 16, 2016). In June 2016, we issued an investigative 

report which found that a CFTC IT administrator exposed the CFTC to potential 

data loss by establishing frequent network connections to a personal server 

located at his private residence for “testing.” No data loss was uncovered. 

However, our investigation found that that CFTC management, including senior 

management, withheld information from internal investigators. We 

recommended that management take the appropriate steps to address the 

employee misconduct, and implement policies to prevent retaliation against 

contractors. Our follow-up report determined that, with regard to the employee 

misconduct, the CFTC’s response was to issue a letter of warning to each subject 

named in our ROI, and to note that the letter would not be placed in any 

personnel file. However, CFTC did take steps to begin amending agency-wide 

policy to prohibit retaliation against contractors. 
4

• Investigation into Potential Violation of 18 U.S.C. § 208 – Acts Affecting a 

Personal Financial Interest. On March 30, 2017, we issued a report of 

investigation addressing a self-reported assertion that a CFTC employee may 

have a possible conflict between his duties and his financial interests. The 

investigation resolved in favor of the employee; however, we did recommend 

certain enhancements to the financial disclosure review process. This report will 

be published. 

Ongoing

• CFTC OIG currently has eight open investigations. They are ongoing and 

therefore confidential at this time. 

Economic Analysis

Ongoing

• CFTC’s Consideration of Costs and Benefits for the Rule Establishing Margin 

Requirements for Uncleared Swaps. During this reporting period we began a 

review of the CFTC’s consideration of costs and benefits with regard to its rule 

imposing margin on uncleared swaps.3 Our work was ongoing at the close of the 

reporting period, and delivered to the Commission on April 6, 2017.

• Literature Review: During this reporting period we began a literature review of 

government reports assessing the consideration of costs and benefits in 

connection with the Dodd-Frank Wall Street Reform and Consumer Protection 

Act.4 Our work was ongoing at the close of the reporting period.

• Office of the Chief Economist Follow-up Review. In January of 2016, we 

published our second review of the Office of the Chief Economist. We noted that 

staffing levels remain depressed and that the visiting scholar program – in which 

academics from outside the CFTC would research and publish on topics relevant 

to the CFTC’s mission for free – remained defunct. We highlighted that certain 

research topics for full time staff were off-limits due to apparent political 

sensitivity. We began our follow-up in September 2016. Due to competing 

priorities, and because OCE role and staffing will be discussed in our review of 

the consideration of costs and benefits in connection with the margin 

requirement for uncleared swaps, we determined to not follow up our prior OCE 

reports at this time. 

 3 CFTC, Final Rule, Margin Requirements for Uncleared Swaps for Swap Dealers and Major Swap 

Participants, 81 Fed. Reg. 636 (January 6, 2016).

4 Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), Pub.L. 111-203, 124 Stat. 

1376 (2010).
5

CFTC OIG MANAGEMENT and ADMINISTRATION

1. CFTC Programs and Operations

Congress created the CFTC in 1974 as an independent agency with the mandate 

to regulate commodity futures and options markets in the United States. The 

Commission’s mandate was renewed and/or expanded in 1978, 1982, 1986, 1992, and 

1995. In December 2000, the Commission was reauthorized by Congress and the 

President through Fiscal Year 2005 with the passage of the Commodity Futures 

Modernization Act of 2000 (CFMA). In May of 2008, Congress reauthorized the CFTC 

through Fiscal Year 2013. On July 21, 2010, the President signed into law the DoddFrank Act,5 which expanded the CFTC’s jurisdiction and authorities. 

The CFTC is responsible for fostering the economic utility of futures markets by 

encouraging their competitiveness and efficiency, ensuring their integrity, and 

protecting market participants against manipulation, abusive trade practices, and fraud.

Through effective oversight regulation, the CFTC enables the commodity futures 

markets better to serve their vital function in the nation’s economy—providing a 

mechanism for price discovery and a means of offsetting price risks. The Dodd-Frank 

Act authorized the CFTC to regulate swap dealers and increase transparency in the 

derivatives marketplace. 

The CFTC operating divisions are: Office of the Chairman, Division of Clearing 

and Risk, Division of Swap Dealer and Intermediary Oversight, Division of 

Enforcement, Division of Market Oversight, Office of the Chief Economist, Office of the 

Executive Director, Office of General Counsel, Office of International Affairs, and Office 

of Data and Technology. Within the Office of the Chairman there are Offices of Minority 

and Women Inclusion, Legislative Affairs, and Public Affairs. In addition to its 

headquarters office in Washington, D.C., the CFTC maintains offices in Chicago, Illinois; 

Kansas City, Missouri; and New York, New York. 

 5 See fn. 4.
6

2. OIG Responsibilities

The CFTC OIG was created in 1989 in accordance with the 1988 amendments to 

the Inspector General Act of 1978.6 OIG was established as an independent unit to:

• Promote economy, efficiency, and effectiveness in the administration of CFTC 

programs and operations, and detect and prevent fraud, waste, and abuse in such 

programs and operations;

• Conduct and supervise audits and, where necessary, investigations relating to the 

administration of CFTC programs and operations; 

• Review existing and proposed legislation, regulations, and exchange rules and 

make recommendations concerning their impact on the economy and efficiency 

of CFTC programs and operations or the prevention and detection of fraud and 

abuse; 

• Recommend policies for, and conduct, supervise, or coordinate other activities 

carried out or financed by such establishment for the purpose of promoting 

economy and efficiency in the administration of, or preventing and detecting 

fraud and abuse in, its programs and operations; and

• Keep the Commission and Congress fully informed about any problems or 

deficiencies in the administration of CFTC programs and operations and provide 

recommendations for correction of these problems or deficiencies.

The IG is appointed by the full Commission and may be removed only upon the 

written concurrence of a 2/3 majority of the full Commission.7

OIG is a member of the Counsels of Inspectors General on Financial Oversight 

(CIGFO), created under the Dodd-Frank Act to examine the work of the Financial 

Stability Oversight Council (FSOC).

OIG is required to conduct, supervise, and coordinate audits of CFTC programs 

and operations in accordance with Generally Accepted Government Auditing 

Standards. OIG conducts inspections, evaluations, and reviews in accordance with the

Quality Standards for Inspection and Evaluation issued by the Council of Inspectors 

General for Integrity and Efficiency (CIGIE). OIG is required to recommend changes to 

existing and proposed CFTC programs and operations to promote economy, efficiency, 

and effectiveness and to prevent and detect fraud and abuse.

OIG investigations are performed in accordance with the Quality Standards for 

Investigations issued by the CIGIE. Investigations are performed in response to 

 6 Inspector General Act Amendments of 1988, P.L. 100-504, 102 Stat. 2515 (1988). 7 5 U.S.C. § 8G.
7

allegations and/or evidence indicating possible violations of law, regulations, or 

applicable standards, as well as other alleged or suspected improper conduct in 

connection with the programs and operations of the Agency.

3. Interference with OIG Independence

OIG operates independently of the Agency and has not experienced any interference 

from the CFTC Chairman or Commissioners in connection with the conduct of any 

investigation, inspection, evaluation, review, or audit. Our investigations have been 

pursued regardless of the rank or party affiliation of the target. OIG also has conducted 

audits, inspections, evaluations, and reviews without interference where it has perceived 

the opportunity to recommend improvement to futures regulation efforts, again without 

regard to the party affiliation of any Chairman or Commissioner.8 During the 

semimanual reporting period, there were/were no attempts by CFTC to interfere with

inspector general independence through:

Type Number Explanation

Budget constraints 0 N/A

Resistance to oversight 0 N/A

Delayed information access 0 N/A

Other 0 N/A

4. OIG Resources

At the end of the reporting period, the CFTC OIG consisted of 8.5 full time 

equivalents—the Inspector General, Deputy Inspector General/Chief Counsel, Assistant 

Inspector General for Auditing, three Attorney-Advisors (one part time), two Auditors, 

and one Senior Program Analyst.

 8 The Inspector General Act of 1978, as amended, states: “Neither the head of the establishment nor the 

officer next in rank below such head shall prevent or prohibit the Inspector General from initiating, 

carrying out, or completing any audit or investigation....” 5 U.S.C. App. 3 sec. 3(a).
8

AUDIT OPERATIONS

Completed Audits, Inspections, Evaluations, Audit Reviews, and 

Other Audit Projects

Information Security

1. CFTC’s Policies and Procedures for Reviewing Registrants’ Cybersecurity 

Policies. (October 11, 2016)

We found that CFTC and its oversight divisions have developed policies and 

procedures to address cybersecurity risks for CFTC registrants and identified five 

areas with recommendations where the CFTC could improve its policies and 

procedures toward reducing these cybersecurity risks. Specifically, the CFTC has 

the opportunity to improve data transfer protocols by ceasing the use of nonsecure file transfer protocols (FTP), frequency of registrant internal and external 

penetration, vulnerability testing, oversight assessments, and intelligence and 

information sharing. 

In response to the report, CFTC notified all entities who continue to use nonsecure FTP that it will no longer allow these connections. In addition CFTC 

issued two parallel final rules regarding cybersecurity testing by registrants. 

These final rules require external and internal penetration and vulnerability 

testing at a frequency determined by appropriate risk analysis. Management did 

not concur with the recommendation to use a risk-based approach to 

independently test the results of the assessments of cybersecurity preparedness 

for certain registrants and stated that extensive information sharing 

arrangements were already in place. Looking to federal assurance standards as a 

benchmark, CFTC could assess whether the evidence is relevant, valid, and 

reliable and we recognize that budget constraints limit intelligence sharing

opportunities. We closed out all recommendations; however, we plan to monitor 

CFTC’s actions regarding our recommendation to use a risk-based approach to 

independently test the results of the assessments of cybersecurity preparedness 

(for a follow up audit).

2. Information Security Audit FY 2016: Compliance with Provisions of the Federal 

Information Security Modernization Act.9 (February 28, 2017)

The Office of the Inspector General witnessed a re-energized focus by CFTC to 

improve its cybersecurity posture. Most notable was CFTC’s implementation of 

its vulnerability program and security monitoring tools. While CFTC’s 

 9 P.L. 107-347, 116 STAT. 2946 (2002).
9

information security program surpasses standards prescribed by FISMA at an 

“Effective” level, we noted it can better:

• Follow policies and procedures for physical access controls; 

• Follow security policies and procedures for the use of PIV card as it relates to 

external systems serviced by federal partners;

• Mature an insider threat program; and 

• Include the proper information technology security clauses in system support 

contracts with federal partners.

CFTC concurred with the four recommendations. In reference to 

recommendation 1, corrective action was completed. The CFO and CIO are 

coordinating an action plan for recommendations 2 and 4. For recommendation 

3, the CIO is formalizing an implementation plan by the end of FY 2017, with FY 

2018 implementation remaining budget dependent. Management’s actions are 

responsive to the report’s recommendations.

3. Review of CFTC’s Defenses to Protect Sensitive Database Information. (February 

28, 2017)

ODT had compensating controls in place to mitigate the high and medium risks 

identified. Therefore, we inferred that database security controls were effective to 

mitigate the risk of data loss or misuse. Given the nature of database 

vulnerabilities, we determined CFTC would benefit from continuous database 

auditing and encrypting database files at rest. Continuous database auditing 

involves observing a database to be aware of the actions of database users in real 

time. We recommend that the Chief Information Officer:

• Implement enterprise software to promote continuous database auditing.

• Evaluate encrypting database files at rest.

ODT will review the two recommendations by the close of FY 2017 and assess the 

feasibility of implementing them in their environment. Management’s actions 

were responsive to the report’s recommendations.

Financial Management

4. Audit of the CFTC’s Annual Financial Report FY 2016 (November 14, 2016)

We contracted with the independent certified public accounting firm Allmond & 

Company, LLC (Allmond & Co.) to conduct this audit. The contract required that 

the audit be done in accordance with U.S. GAGAS, the standards issued by the 

Comptroller General of the United States, and Office of Management and Budget 

(OMB) Bulletin No. 15-02, Audit Requirements for Federal Financial Statements.
10

Allmond & Co. communicated an unqualified (clean) opinion on CFTC’s financial 

statements as of September 30, 2016, and determined its net costs, changes in 

net position, custodial activity, and budgetary resources for the year then ended 

were presented fairly in accordance with U.S. GAAP.

Allmond & Co. also communicated that CFTC’s internal controls over financial 

reporting and compliance are sufficiently designed to detect and correct material 

errors in its financial statements and closed the material weaknesses reported in 

the FY 2015 financial statement audit (relating to the recording of lease 

obligations).

In reference to compliance with laws and regulations, Allmond & Co. disclosed an 

instance of noncompliance previously addressed in the FY 2015 financial 

statement audit, and recommended that CFTC complete the investigation into 

the potential Anti Deficiency Act violations associated with the recording of lease 

obligations. Management concurred with the recommendation and finalized its 

investigation.

5. Audit of the CFTC’s Customer Protection Fund FY 2016. (October 28, 2016)

We contracted with the independent certified public accounting firm Allmond & 

Company, LLC (Allmond & Co.) to audit the financial statements of the Fund as 

of September 30, 2016, and for the year then ended, to provide negative 

assurance on internal control and compliance with laws and regulations for 

financial reporting. We required that the audit be done in accordance with U.S. 

GAAP. In its audit of the Fund, Allmond & Co. found:

• The financial statements were fairly presented, in all material respects, in 

conformity with U.S. GAAP.

• There were no material weaknesses in internal control identified for the Fund.

• No instances in which the financial management systems did not substantially 

comply with the requirements of the Federal Financial Management 

Improvement Act of 1996.10

6. Readiness Review: Compliance with DATA Act of 2014 (November 29, 2016)

Treasury and OMB have issued guidance to Federal agencies for implementing 

the DATA Act.11 The IG of each Federal agency must 1) review statistical samples 

of data submitted by the agency under the DATA Act, and 2) report on the 

completeness, timeliness, quality, and accuracy of the sampled data and the 

agency’s use of the data standards. To fulfill our modified reporting obligation, 

 10 Federal Financial Management Improvement Act of 1996 (FFMIA), P.L. 104-208, 110 Stat. 3009 

(1996).

11 Pub. L. No. 113-101, 128 Stat. 1146 (May 9, 2014). The DATA Act amended the Federal Funding 

Accountability and Transparency Act of 2006. Pub. L. No. 109-282, 120 Stat. 1186 (Sept. 26, 2006), 

codified at 31 U.S.C. § 6101, note.
11

we conducted a readiness review of the CFTC’s progress toward compliance with 

the DATA Act, and we plan to provide Congress with the first required report in 

November 2017, with subsequent reports following on a two year cycle, in 

November 2019 and November 2021 as mandated by the DATA Act.

Under an interagency agreement, the Department of Transportation’s Enterprise 

Service Center is implementing the DATA Act requirements on behalf of CFTC 

and is on schedule to meet its first reporting deadline of May 2017. CFTC and 

ESC’s implementation of the DATA Act have followed the eight-step 

implementation plan from the “playbook”. ESC has a comprehensive technical 

plan for complying with the DATA Act and is working seamlessly with the CFTC. 

Those tasks that the CFTC cannot perform are delegated to ESC, monitored by an 

internal working group, and discussed monthly with the Chief Financial 

Officer/Senior Accountable Officer.

Other Reports

7. Audit Peer Review: Appalachian Regional Commission OIG. (March 6, 2017)

We reviewed the system of quality control for the audit organization of the 

Appalachian Regional Commission (ARC) Office of the Inspector General (OIG) 

in effect for the three years ended September 30, 2016. A system of quality 

control encompasses ARC OIG’s organizational structure and the policies 

adopted and procedures established to provide it with reasonable assurance of 

conforming to Generally Accepted Government Auditing Standards (GAGAS). 

The elements of quality control are described in GAGAS. ARC OIG is responsible 

for establishing and maintaining a system of quality control that is designed to 

provide ARC OIG with reasonable assurance that the organization and its 

personnel comply with professional standards and applicable legal and regulatory 

requirements in all material respects. Our responsibility is to express an opinion 

on the design of the system of quality control and ARC OIG’s compliance 

therewith based on our modified review.

In our opinion, the system of quality control for the audit organization of ARC 

OIG in effect for the year ending September 30, 2016 has been suitably designed 

and provides ARC OIG with reasonable assurance of performing and reporting in 

conformity with applicable professional standards in all material respects. Audit 

organizations can receive a rating of pass; pass with deficiencies; or fail. ARC 

OIG has received an external peer review rating of “pass”. However as an 

observation, we note ARC OIG transmittal letters need to clearly delineate 

responsibilities between the ARC OIG and contractor reports.
12

Ongoing Audits, Inspections, Evaluations, Audit Reviews, and 

Other Audit Projects 

Information Security

1. Audit of CFTC’s Enterprise Architecture Program 

In 1996, Congress enacted the Information Technology Management Reform Act, 

known as the Clinger-Cohen Act,12 which requires each agency’s CIO to develop, 

maintain, and facilitate the implementation of the agency’s enterprise architecture (EA). 

By implementing EA, agencies can ensure that they efficiently spend limited 

information technology resources on well integrated systems that support agency 

mission and strategic goals. OIG initiated this audit to determine if CFTC (1) has 

established adequate baseline and target architectures; (2) has effective management 

practices, policies, and processes for the development, implementation, maintenance, 

and oversight of the EA program; and (3) has adequate resources to realize target 

architectures.

Financial Management

2. Audit of the CFTC’s FY 2017 Annual Financial Report (AFR)

The objective of this Congressionally mandated audit is to render an opinion on 

the agency financial statement in accordance with Generally Accepted Government 

Auditing Standards.13

3. Audit of the CFTC’s FY 2017 Customer Protection Fund (CPF)

The objective of this Congressionally mandated audit is to render an opinion on 

the CPF financial statement in accordance with Generally Accepted Government 

Auditing Standards. 

Performance Audits

4. Audit of CFTC’s Oversight of NFA. 

The Office of the Inspector General evaluated CFTC’s oversight of NFA’s 

registration and examination of Futures Commission Merchants and Swap Dealers, 

 12 P.L. 104-106, 110 STAT. 202 (1996). 

13 The Accountability of Tax Dollars Act, P.L. 107-289, § 2, 116 STAT. 2049 (2002), requires our annual 

audit of the AFR. Section 748 of the Dodd-Frank Act (see fn.4) requires our annual audit of the CPF. 
13

formal written reviews of NFA operations, and follow-up of recommendations contained 

in formal reviews. In addition, we evaluated the impact of NFA’s efforts on CFTC 

staffing levels and the extent to which CFTC is able to leverage NFA’s staff. A discussion

draft report was presented to management for formal comment after the close of the 

reporting period.

5. Lean Labor Audit of Division of Clearing and Risk and Division of Market 

Oversight Functions

Lean labor focuses on the workforce and its interaction with other resources 

required for output. It seeks out inefficiencies such as overproduction, waiting, and 

unused employee potential to maximize the value of human capital assets. Given 

mission similarities, our objective is to assess the effectiveness of balancing labor and 

workload for CFTC’s Division of Clearing and Risk and Division of Market Oversight.

Audit Reports and Reviews Over Six Months Old

Corrective Action Not Completed

There are no audit reports over six months old where corrective action had not 

been completed by the planned action date. 

 

Corrective Action Completed

There were no instances of audit reports issued before the commencement of the 

reporting period for which corrective action had been completed by the end of the 

reporting period. 

Management Decision Not Made

There are no instances of an audit report issued before the commencement of the 

reporting period for which a management decision had not been made by the end of the 

reporting period. 

Unimplemented Recommendations

Fiscal

Year

Number of Reports with 

Unimplemented 

Recommendations

Number of 

Unimplemented 

Recommendations

Dollar Value of Aggregate 

Potential Cost Savings

2017 3 8 0

2016 0 0 0
14

INVESTIGATIVE OPERATIONS

Completed Investigations

1. Investigation into a Potential Information Technology Security Incident, Follow-up

Report (December 16, 2016)

Senior CFTC management referred this matter to our office after a brief internal 

investigation. We contracted with USPS OIG for special agents trained in computer 

forensics to assist with our investigation. In June 2016, we issued an investigative report

which found that a CFTC IT administrator exposed the CFTC to potential data loss by 

establishing frequent network connections to a personal server located at his private 

residence for “testing.” No data loss was uncovered; however, our investigation found 

additional misconduct by IT employees, including acts of a retaliatory nature against a 

contractor. We further found that CFTC management, including senior management, 

withheld information from internal investigators. We recommended that management 

take the appropriate steps to address the employee misconduct, and implement policies 

to prevent retaliation against contractors. 

Our follow-up report determined that in response to findings of misleading the 

OIG investigation and retaliation against a contractor, the CFTC’s response was to issue 

a letter of warning to each subject named in our ROI, and to note that the letter would 

not be placed in any personnel file. However, CFTC did take steps to begin amending 

agency-wide policy to prohibit retaliation against contractors. 

2. ROI into Potential Violation of 18 U.S.C. 208: Acts Affecting a Personal Financial 

Interest

On March 30, 2017, we issued a report of investigation addressing a self-reported 

assertion that a CFTC employee may have a possible conflict between his duties and his 

financial interests. The investigation resolved in favor of the employee; however, we did 

recommend certain enhancements to the financial disclosure review process. This 

report will be published. 

3. Preliminary Investigation into Allegation of Contractor Fraud

 

We received an allegation of misconduct by a contractor. A preliminary 

investigation determined that these allegations were beyond the jurisdiction of the CFTC 

OIG. We closed the matter with a memo to the file. 
15

Ongoing Investigations

Confidential Investigations

We began work on eight investigations during the reporting period that were 

ongoing at the close of the reporting period. These ongoing investigations are 

confidential. It is the policy of CFTC OIG to not disclose details regarding ongoing 

investigations absent good cause; when investigations are disclosed to the public they 

will be listed here.

Investigative Statistics and Metrics

There were no pending investigations at the start of the reporting period. During 

this period, the OIG engaged in the following investigative activity:

 Received 18 allegations from the OIG hotline and from CFTC employees. 

 Referred two allegations to the CFTC Division of Enforcement

 Referred one allegation to the Office of General Counsel ethics team

 Referred one allegation to the Office of General Counsel FOIA team

 Referred one complainant to the Consumer Financial Protection Bureau

 Tentatively closed two allegations with a memo to file (because the conduct 

complained of was not a violation or appeared to have already been corrected),

pending possible receipt of additional information

 Began ten investigations

 Completed one investigation (see page 14, item 2)

 Completed one preliminary investigation with a memo to file (see page 14, item 

3) 

 Continued eight ongoing confidential investigations (described above)

 Completed one follow up report from an ROI issued in June 2016 (see page 14, item 

1).

Investigative Metrics

October 1, 2016 – March 31, 2017

A. Issued investigative reports 1

B. Referrals to prosecuting authorities for criminal prosecution 0

C. Indictments from prior referrals 0

During this period, there were no new investigative reports involving a senior 

government employee where allegations of misconduct were substantiated, nor any 

whistle-blower retaliation, nor any investigations that were closed and were not 

disclosed to the public.
16

Summary of Matters Referred To Prosecutorial Authorities

No matters were referred to prosecutorial authorities during the reporting period. 

ECONOMIC ANALYSIS

Ongoing Projects: Economic Analysis

1. Review of the Cost-Benefit Consideration for the Margin Rule for Uncleared 

Swaps 

During this reporting period we began a review of the CFTC’s consideration of 

costs and benefits of its margin rule for uncleared swaps.14 This project was nearing 

completion at the close of the reporting period and was delivered to the Commission on 

April 6, 2017.

2. Economic Literature Review of OIG Reports on Agency Cost-Benefit Analysis 

under Dodd Frank, from 2011-2013

From 2011 to 2013, FIRREA OIGs issued audits/reviews of each agency’s cost 

benefit analyses. These reports differ markedly in structure and scope. We began a 

literature review in October 2016 with the goal of synthesizing these reports to identify 

common challenges and best practices for agency cost-benefit analysis. Our work was 

ongoing at the close of the reporting period. 

3. Office of the Chief Economist Follow-up Review 

In January 2016, we published our second review of the Office of the Chief 

Economist. We noted that staffing levels remain depressed and that the visiting scholar

program – in which outside work with OCE economists and use CFTC data to research 

and publish on topics relevant to the CFTC’s mission – remained defunct. We 

highlighted that certain research topics for full time staff were off-limits due to apparent 

political sensitivity. We began our follow-up in September 2016. Due to competing 

priorities, and because OCE’ role and staffing will be discussed in our forthcoming 

Review of the Cost-Benefit consideration for the Margin Rule for Uncleared Swaps, we 

determined not to follow up on our prior OCE reports at this time. 

 14 CFTC, Final Rule, Margin Requirements for Uncleared Swaps for Swap Dealers and Major Swap 

Participants, 81 Fed. Reg. 636 (January 6, 2016).
17

OTHER PROJECTS

CFTC Lease Reviews

On June 4, 2014, we issued a review of CFTC leasing that focused on Kansas City. 

We determined that approximately two-thirds of the offices in the CFTC Kansas City 

field office were vacant, and that spending on vacant offices over the life of the lease (at 

current occupancy) would approximate $3.6 million. Since that time, the CFTC has 

consolidated its staff on one floor with a view to returning vacated space to the landlord 

or otherwise reducing the expense for vacated offices. In addition, on June 18, 2015, we 

issued a review of CFTC leasing that focused on New York City, noting that CFTC was 

also paying for vacant offices in that field office. We also published lease reviews for 

CFTC headquarters (April 25, 2016) and the CFTC field office in Chicago, Illinois 

(February 26, 2015), both with recommendations to better use existing space and, for 

headquarters, to decrease expenditures on unused space. We are continuing to monitor 

the management response to our recommendations. 

Management Advisories

In our Semiannual Report for the period ending September 30, 2015, we reported 

the issuance of a non-public Management Advisory that addressed allegations of 

unprofessional conduct by a CFTC manager, and stated our intent to follow up during 

the next reporting period. Due to competing priorities, as well as personnel changes 

within the relevant CFTC unit, we did not begin our follow up. 

Congressional Inquiries

OIG fielded multiple requests for assistance from members of Congress and staff 

during the reporting period. Issues addressed included recent OIG and Agency

activities. 

Legislative and Regulatory Projects

1. Introduction and Summary

As specified in Section 4(a)(2) of the Inspector General Act of 1978, OIG reviews 

the impact of existing and proposed legislation and regulations on CFTC programs and 

operations and makes recommendations regarding more effective or efficient 
18

alternatives or protections against fraud and abuse. OIG also reviews exchange rule 

proposals circulated to senior staff at the CFTC. 

OIG notified the responsible Divisions as to any concerns with draft and final 

documents relating to legislation, rules or investigations. Formal comments were not 

filed with the Commission during this reporting period.

2. Legislative Activities

OIG tracked legislation impacting programs and operations of the CFTC, and 

made contact with Congressional staff concerning various Agency and IG issues as 

appropriate. The IG serves on the legislation committee for the Council of Inspectors 

General on Integrity and Efficiency, which comments on proposed amendments to the 

IG Act and other legislation affecting the IG community. 

Peer Reviews

An important function in each Agency OIG is the peer review process. The 

Council of Inspectors General on Integrity and Efficiency describes the processes for 

audits and investigative peer reviews on its website as follows:

• Government Auditing Standards require that audit organizations conducting 

audits of Federal agencies undergo peer reviews every 3 years. The IG community 

has implemented a process to meet this requirement. The purpose of the peer 

review is to determine whether the reviewed audit organization’s internal quality 

control systems are adequate and provide reasonable assurance that applicable 

auditing standards, policies and procedures are met.

• Similarly, investigative peer reviews are conducted to ensure compliance with the 

requirements of the Quality Standards for Investigations and determine 

whether adequate internal safeguards and management procedures exist to 

ensure that law enforcement powers are properly exercised.

Section 989C of the Dodd-Frank Act15 implemented a requirement to include in 

each OIG semiannual report an appendix containing:

• The results of any peer review conducted by another Office of Inspector General

during the reporting period; or if no peer review was conducted within that 

reporting period, a statement identifying the date of the last peer review 

conducted by another Office of Inspector General;

 15 See fn. 4.
19

• A list of any outstanding recommendations from any peer review conducted by 

another Office of Inspector General that have not been fully implemented, 

including a statement describing the status of the implementation and why 

implementation is not complete; and

• A list of any peer reviews conducted by the Inspector General of another Office of 

the Inspector General during the reporting period, including a list of any 

outstanding recommendations made from any previous peer review (including 

any peer review conducted before the reporting period) that remain outstanding 

or have not been fully implemented.

A peer review was completed on August 16, 2016 and our Office of Audit received 

a rating of “pass”; the highest rating.

 

Summary of Each Report Made To The Agency Head

No reports were made to the Agency head under section 6(b)(2) of the Act 

concerning information or assistance unreasonably refused or not provided (mandated 

under section 5(a)(5) of the Act).16

Revised Management Decisions

No management decisions were revised during the reporting period.

Inspector General Disagreement

The Inspector General did not disagree with any management decisions on OIG

recommendations during the reporting period.

GAO Liaison

OIG is charged with providing policy direction for, and conducting, supervising, 

and coordinating audits and investigations relating to CFTC programs and operations. 

In addition, OIG is required to recommend policies for, and conduct, supervise, and 

coordinate with other Federal agencies, state and local governmental agencies, and 

nongovernmental entities, audits, investigations, and evaluations regarding the 

economy, efficiency, and effectiveness of CFTC programs and operations.

 16 5 USC App. 3 §§ 5(a)(5), 6(b)(2).
20

GAO also conducts audits of CFTC activities, and OIG plans its audits, 

inspections, evaluations, reviews, and investigations so as not to duplicate GAO's efforts. 

Moreover, OIG in its audit activities identifies the goals of each audit and the methods of 

reaching the goals so as to minimize the requirements placed on CFTC resources. 

STRATEGIC PLAN for the OFFICE of INSPECTOR GENERAL

1. Investigative Agenda

The Inspector General Act of 1978, as amended, provides that the Inspector 

General may receive and investigate complaints or information from the Commission's 

employees concerning the possible existence of an activity constituting a violation of 

law, rules or regulations, or mismanagement, gross waste of funds, abuse of authority or 

a substantial and specific danger to the public health and safety.

OIG has to date conducted only a reactive investigative program chiefly relying 

on unsolicited employee complaints as the source of investigative leads. However, 

allegations and complaints are also received from the general public and Congress. This 

reactive program has resulted in only a handful of investigations per year. This strategy 

was followed because OIG believed that an independent regulatory Agency such as the 

CFTC, without grant money or substantial contracts to award, was not likely to generate 

a substantial investigative workload.

To insure that employee complaints could easily reach OIG, a 24-hour hotline 

was established in February 1993 to receive complaints. The hotline phone number is 

(202)418-5510.

Because of the necessarily reactive nature of OIG's investigative program, no 

investigative agenda has been established.

2. Legislative and Regulatory Review Agenda

Because of the importance of this activity in a financial and economic regulatory 

Agency, OIG reviews proposed and final CFTC regulations, legislation and selected 

exchange rules using six basic criteria: Whether the Agency: (1) has identified 

specifically the problem(s) to be addressed by the proposal; (2) has defined through case 

study or data analysis a clear link between the proposed solution and the identified 

problem(s); (3) has clearly specified the means to effectively and efficiently enforce the 

proposal; (4) has assessed the likely efficiency and effectiveness of alternative solutions; 

(5) can reasonably document that the proposal will yield positive net benefits over the 

long term; and (6) has met the requirements of the Regulatory Flexibility Act and the 

Paperwork Reduction Act.
21

The Regulatory Flexibility Act17 requires the Agency to evaluate the impact of its 

regulations on small entities. The Paperwork Reduction Act18 requires the Agency to 

manage effectively and efficiently its information collections so that they are the least 

burdensome necessary to achieve the stipulated objectives.

Because OIG does not initiate legislation or, generally, regulations, OIG

legislative and regulatory review program is reactive to the legislative and regulatory 

proposals developed by others. Accordingly, no independent legislative and regulatory 

review agenda has been established. 

3. Audit, Inspection, Evaluation, and Review Agenda

a. Introduction

The primary objectives of OIG’s audit, inspection, evaluation, and review agenda 

are to promote long-term efficiency and effectiveness in the administration and 

operation of the Commission and to protect against fraud and abuse. The audit, review, 

evaluation, and inspection agenda and priorities for OIG are determined based on the 

following factors: 

• Adequacy of internal control systems as indicated by vulnerability 

assessments and internal control reviews recommended by OMB Circular A123;

• Changes in the program conditions or particular vulnerability of the 

organization, program, activity, or function to problems or deficiencies;

• Current and potential dollar magnitude and likely benefits of a review on the 

efficiency or effectiveness of CFTC programs and operations;

• Management priorities and improvements that may be possible;

• Results of audits of CFTC programs and operations by other Federal agencies; 

and

• Availability of audit resources and the potential opportunity costs to the 

agency.

 17 The Regulatory Flexibility Act was originally passed in 1980 (P.L. 96-354). The act was amended by the 

Small Business Regulatory Enforcement Fairness Act of 1996 (P.L. 104-121), the Dodd-Frank Act (see 

fn.4), and the Small Business Jobs Act of 2010 (P.L. 111-240). It is codified at 5 USC §§601-612.

18 P.L. 96-511, codified at 44 USC §§3501-3521.
22

b. Annual Audits

The following required audits are performed on an annual basis.

Audit of CFTC Financial Statements

In FY 2002, Congress passed the Accountability of Tax Dollars Act.19 The Act 

requires the CFTC, along with numerous other Federal entities, to have its financial 

statements audited annually. To this end, OIG has engaged a contractor to provide the 

audit effort required to enable the contractor to render an opinion on the Agency’s 

financial statements for each fiscal year in accordance with generally accepted auditing 

standards, Government Auditing Standards and OMB Bulletin 07-04.

Audit of the CFTC Customer Protection Fund

Section 745(g)(5)(I) of the Dodd-Frank Act20 requires the Agency to submit to 

Congress a yearly report on the Commission’s whistleblower award program that 

includes a complete set of audited financial statements, including a balance sheet, 

income statement, and cash flow analysis. To this end, OIG has engaged a contractor to 

perform the audit.

c. Annual Reviews and Compliance Letters

OIG will perform the following reviews and evaluations on an annual basis:

Inspector General’s Assessment of the CFTC’s Management Challenges

The Reports Consolidation Act of 2000 requires the Inspector General to 

summarize the most serious management and performance challenges facing the CFTC 

and to assess the Agency’s progress in addressing those challenges.

Review of Compliance with the Federal Managers' Financial Integrity Act, FMFIA

In support of OMB Circular A-123 (Revised), the Inspector General will evaluate, 

provide technical assistance and advise the Agency head as to whether the Agency's 

review and evaluation process was conducted in accordance with the circular's 

requirements.

Evaluation of the CFTC Information Security Management Act, FISMA

The Federal Information Security Management Act requires the Inspector 

General or his designee to perform annual independent evaluations of the information 

 19 P.L. 107-289, 116 Stat. 2049 (2002). 

20 See fn.4.
23

security program and practices of the Agency. This compliance may also be performed 

through an audit. 

d. Other Audits, Inspections, Evaluations, Reviews and Projects

Looking to the long term, OIG intends to focus the balance of its resources on the 

review of the management and operation of the agency and compliance with 

Congressional mandates. OIG plans to concentrate its efforts in reviewing activities 

relating to the most serious management challenges facing the CFTC. 

In addition, OIG is aware of the immense regulatory undertaking required under 

the Dodd-Frank Act. OIG will seek to identify issues and to conduct inspections, 

reviews, investigations, and other activities relating to these management and 

regulatory challenges. Finally, OIG will stand ready to respond to issues and requests as 

they are received from Congress, the Agency, members of the public, or any other 

source. 

e. Resources Required

OIG estimates that approximately four staff years of effort will be devoted over 

each of the next five years to the annual audit, the annual review, and the annual 

evaluation described above. However, OIG continuously updates its audit universe in 

view of the CFTC’s increased responsibilities under the Dodd-Frank Act and will 

reevaluate its staffing needs once each update is complete. OIG estimates three staff 

years of effort will be devoted over each of the next five years to the investigative, 

legislative and regulatory review functions. OIG estimates one staff year for 

management, administrative, and outreach efforts. Because OIG resources can be 

diverted at any time to an investigation, audit, inspection, evaluation, review, or other 

project that responds to current concerns or allegations, and must be completed in a 

timely fashion in order to be of assistance to the Agency or Congress, it is not possible to 

forecast with complete accuracy how resources will be utilized from year to year. 

CONTACTING the OFFICE of the INSPECTOR GENERAL

OIG is located at 1155 21st Street, N.W., Washington, D.C. 20581. Regular 

business hours are between 8:30 AM and 5:00 PM, Monday through Friday, except 

Federal holidays. The telephone number is (202) 418-5110. The facsimile number is 

(202) 418-5522. The hotline number is (202)418-5510. OIG’s web page is located at 

http://www.cftc.gov/About/OfficeoftheInspectorGeneral/index.htm. 
24

TABLE 1 – Reports Issued with Questioned Costs

October 1, 2016 – March 31, 2017

Dollar Value

Thousands

Number Questioned Unsupported

A. For which no management decision 

has been made by the commencement 

of the reporting period 0 0 0

B. Which were issued during the 

reporting period 0 0 0

Subtotals (A + B) 0 0 0

C. For which a management decision was 

made during the reporting period 0 0 0

( I ) dollar value of 

disallowed costs 0 0 0

( ii ) dollar value of costs not 

disallowed 0 0 0

D. For which no management decision

has been made by the end of the

reporting period 0 0 0
25

TABLE 2 – Reports Issued with Recommendations That Funds Be 

Put To Better Use

October 1, 2016 – March 31, 2017

Dollar Value

Number Thousands

A. For which no management decision 

has been made by the 

commencement of the reporting 

period 0 0

B. Which were issued during the 

reporting period 0 0

Subtotals (A + B) 0 0

C. For which a management decision 

was made during the reporting 

period

0 0

( i ) dollar value of 

recommendations that

were agreed to by 

management 0 0

( ii ) dollar value of 

recommendations that

were not agreed to by

management 0 0

D. For which no management decision

has been made by the end of the

reporting period 0 0
26

TABLE 3 - Index of IG Act Reporting Requirements

Section 4(a)(2) Review of legislation and regulations...............................................17

Section 5(a)(1) Significant problems, abuses and deficiencies...................................1

Section 5(a)(2) Recommendations with respect to significant problems.............8-11

Section 5(a)(3) Significant recommendations that have not been completed..........13

Section 5(a)(4) Matters referred to prosecutorial authorities...................................16

Section 5(a)(5) Summary of instances where information was refused ..................19

Section 5(a)(6) Completed audit reports................................................................8-11

Section 5(a)(7) Significant audit reports................................................................8-11

Section 5(a)(8) Statistical Table—Questioned Costs.................................................24

Section 5(a)(9) Statistical Table—Funds Recommended for Better Use .................25

Section 5(a)(10) Audit reports lacking management decision ...................................13

Section 5(a)(11) Significant revised management decisions .....................................19

Section 5(a)(12) Significant management decisions where the IG disagrees............19

Section 6(b)(2) Summary of reports to Chairman where assistance was refused....19