U.S. COMMODITY FUTURES TRADING COMMISSION 

OFFICE OF INSPECTOR GENERAL 

Three Lafayette Centre 

1155 21st Street, NW, Washington, DC 20581 

Telephone: (202) 418-5000 

Facsimile: (202) 418-5522

TO: Timothy Massad 

Chairman

FROM:

 

A. Roy Lavik 

Inspector General

DATE: October 26, 2015

SUBJECT:

 

Inspector General’s Assessment of The Most Serious Management 

Challenges Facing the Commodity Futures Trading Commission 

(CFTC)

Summary

The Reports Consolidation Act of 2000 (RCA)1 authorizes the CFTC to provide financial 

and performance information in a meaningful and useful format for Congress, the 

President, and the public. The RCA requires the Inspector General to summarize the 

“most serious” management and performance challenges facing the Agency and to 

assess the Agency’s progress in addressing those challenges.2 This memorandum fulfills 

our duties under the RCA.

In order to identify and describe the most serious management challenges, as well as the 

Agency’s progress in addressing them, we relied on data contained in the CFTC financial 

statement audit and Annual Financial Report, representations by agency management, 

and our knowledge of industry trends and CFTC operations. Since Congress left the 

determination and threshold of what constitutes a most serious challenge to the 

discretion of the Inspector General, we applied the following definition in preparing this 

statement: 

Serious management challenges are mission critical areas or programs 

that have the potential for a perennial weakness or vulnerability that, 

without substantial management attention, would seriously impact 

Agency operations or strategic goals.

 

 

1 Public Law 106-531, sec 3, 114 STAT. 2537 (Nov. 22, 2000), codified at 31 USC § 3516(a). 2 Id. 
Page | 2 

For Fiscal Year (FY) 2016, the most serious management challenges are for CFTC to: 

• Minimize information security vulnerabilities in its network. In light of the extent 

of information security vulnerabilities we identified this period, the Chief 

Information Security Officer is using his authority and resources to drive actions 

for effective vulnerability management.

• Stimulate registrants towards enhancing their cyber security controls over vital 

client information so as to reduce the impact of any future information 

technology breach.

• Effectively triage oversight tasks in order to execute its strategic plan with limited 

budgetary resources.

CFTC’s Progress on Last Year’s Challenges 

 

For FY2015 the OIG identified management challenge was for the CFTC to: 

• Deliver on Congressional expectations embedded in the Dodd-Frank Wall Street 

Reform and Consumer Protection Act (Dodd-Frank Act), including expansion of 

the CFTC’s regulatory footprint to the swaps markets, while adhering to 

government-wide budgetary constraints.

Last year’s OIG identified management challenge is being addressed by the agency. We 

reviewed management’s actions taken during FY2015 and note management’s diligent 

effort to address our expressed concerns. On the fifth year anniversary of the passage of 

the Dodd-Frank Act3, it is fitting that we continue to monitor CFTC’s progress in 

implementing this legislation. Fundamentally, the Dodd-Frank Act sought to expand 

CFTC regulatory oversight to the swaps markets and empower market users with 

valuable information that could reduce or thwart incidence of fraud towards derivatives 

market participants. During FY2015, we observed the agency’s progress on ensuring 

centralized clearing of standardized swaps, transparent trading of swaps on a swap 

execution facility, refining swap dealer registration, continued improvements in 

operationalizing swap data repositories, rollout of the SmartChek database for investors 

to verify registrants’ background, successfully prosecuting violators of the Commodity 

Exchange Act, and performing other essential regulatory tasks. Consequently, we are 

encouraged that stakeholders, e.g. Congress, registrants, and derivatives market users 

can be assured that Dodd-Frank inspired policies are gaining traction in the industry. 

 

3 Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. Law 111-203, 124 Stat. 1376 (2010). 
Page | 3 

Fiscal Year 2016 Management Challenges

Our management follow-up of initial Federal Information Security Management Act 

(FISMA) audit findings highlighted the extent of vulnerabilities associated with the vast 

majority of servers and network users, including the Chairman and Commissioners, and 

that the leadership structure for the Chief Information Security Officer (CISO) could 

better align to meet FISMA requirements. We recommended the Chief Information 

Officer provide the CISO the authority and resources to drive actions that mitigate 

medium, high and critical, vulnerabilities identified and ensure the appropriate 

leadership structure is in place for effective vulnerability management. CFTC 

management concurred with both recommendations and is making progress to 

minimize vulnerabilities identified. My office will continue to assess vulnerabilities in 

CFTC’s network as part of its annual audit program.

Looking forward we also view cybersecurity issues as an ongoing operational threat to 

the derivatives industry and an immediate challenge to CFTC’s oversight4 should a 

disruptive technological event occur in the coming year. Currently, over ninety-five5

percent of futures transactions across all products occur electronically. High frequency 

automated trades account for over sixty percent6 of transactions in the more active 

futures markets. Due to the magnitude of electronic transactions the agency must rely 

on improved software, knowledgeable analysts, and, when necessary, inter-agency 

coordination to secure data. Earlier this year, the CFTC launched a roundtable 

discussion on Cybersecurity and System Safeguards Testing, thus elevating the 

significance of this operational risk discussion among registrants. My office recognized 

the significance of this cybersecurity challenge by launching an independent 

examination of CFTC’s policies and procedures for reviewing registrants’ cybersecurity 

policies. The objective of this audit is to identify the current state of cybersecurity 

readiness and identify opportunities for reducing this risk among CFTC registrants.

A third management challenge for the CFTC is to effectively triage operational tasks in 

order to deliver on its strategic mission with limited budgetary resources. Management 

must more efficiently manage its limited financial resources. During the past year, my 

staff continued to analyze underutilization of leased real estate7. Any realized savings 

 

4 CFTC Strategic Goal #2 is Financial Integrity and Avoidance of Systemic Risk. 

http://www.cftc.gov/reports/strategicplan/2018/. 5 See Automated Trading in Futures Markets Richard Haynes and John S. Roberts March 13, 2015 page 3 regarding 

futures trading on the Chicago Mercantile Exchange the largest US derivatives exchange 

http://www.cftc.gov/idc/groups/public/@economicanalysis/documents/file/oce_automatedtrading.pdf

6 Calculated by OIG staff from Remarks of Chairman Timothy Massad before the Conference on the Evolving 

Structure of the U.S. Treasury Market Chairman Timothy Massad October paragraph 9 line 4

7 CFTC-OIG review of NY Lease and Occupancy 

http://www.cftc.gov/idc/groups/public/@aboutcftc/documents/file/oig_rny061815.pdf
Page | 4 

from renegotiating leases may at-the-margin assist the agency to further deliver 

expected regulatory oversight services to stakeholders. 

Conclusion

The CFTC management challenges for FY2016 are cybersecurity and resource

constraints. My office will continue to undertake audits, reviews, and investigations that 

address these challenges.