U.S. COMMODITY FUTURES TRADING COMMISSION 

Three Lafayette Centre 

1155 21st Street, NW, Washington, DC 20581 

Telephone: (202) 418-5000 

Facsimile: (202) 418-5521 

www.cftc.gov 

Office of the 

Inspector General 

MEMORANDUM 

TO: 

I FROM: 

DATE: 

Chairman Timothy Massad, 

Commissioners: Scott O'Malia, Mark Wetjen, Sharon Bowen, and J. Christopher 

Giancarlo 

A. Roy Lavik a R --£.__ 

Inspector General 

July 17, 2014 

SUBJECT: Performance Audit Report# 14-P-05-DSIO 

Attached is the Commodity Futures Trading Commission (CFTC) Office of the Inspector General 

(OIG) audit report on: 

"CFTC 's Management Controls and Procedures for Evaluating Futures Commission 

Merchants'(FCM) and Retail Foreign Exchange Dealers'(RFED) Compliance with 

CFTC Financial Reporting Requirements Mandated by the Commodity Exchange Act and 

the Dodd Frank Act" 

The CFTC-OIG contracted with an independent public accounting firm, CliftonLarsonAllen to 

conduct this audit. The OIG monitored this audit and concurs with CliftonLarsonAllen's findings 

in the attached audit report. The findings were discussed with management in the Division of 

Swap Dealer and Intermediary Oversight; their comments are attached to the final report. 

Should you have any questions regarding this report, please do not hesitate to contact me. 

Attachments 
·, 

17 

CliftonlarsonAllen 

U.S. COMMODITY FUTURES TRADING COMMISSION 

Report on 

Management's Procedures for Evaluating 

Futures Commission Merchants and Retail Foreign Exchange Dealers 

Compliance with Financial Reporting Requirements 
TABLE OF CONTENTS 

INTRODUCTION .......................................................................................................................... 1 

BACKGROUND ............................................................................................................................ 1 

SUMMARY OF RESULTS ............................................................................................................ 1 

SCOPE AND METHODOLOGY ................................................................................................... 2 

ABBREVIATIONS 

CFTC 

CLA 

CEA 

Dodd-Frank Act 

FCM 

FY 

OIG 

RFED 

RSR 

U.S. Commodity Futures Trading Commission 

CliftonLarsonAIIen LLP 

Commodity Exchange Act 

Dodd-Frank Wall Street Reform and Consumer Protection Act 

Futures Commission Merchants 

Fiscal Year 

Office of the Inspector General 

Retail Foreign Exchange Dealers 

Regulatory Statement Review 
.. :.. 

INTRODUCTION 

The U.S. Commodity Futures Trading Commission {CFTC) was created by the Congress in 

1974 as an independent agency with a mandate to regulate commodity futures and option 

markets in the United States. Its mission is to protect market participants and the public from 

fraud, manipulation, abusive practices, and systemic risk related to derivatives-both futures 

and swaps-and to foster transparent, open, competitive, and financially sound markets. In 

carrying out its mission and to promote market integrity, CFTC polices the derivatives markets 

for various abuses and works to ensure the protection of customer funds. The agency also 

seeks to lower the risk of the futures and swaps markets to the economy and the public. CFTC's 

fiscal years {FYs) 2012 and 2013 budgets were about $205 million and $308 million, 

respectively. 

CliftonlarsonAIIen LLP {CLA) was engaged by CFTG's Office of the Inspector General {OIG) to 

conduct an audit of CFTC's management controls and procedures for evaluating Futures 

Commission Merchants' {FCMs') and Retail Foreign Exchange Dealers' {RFEDs') compliance 

with CFTC financial reporting requirements mandated by the Commodity Exchange Act {CEA) 

and Dodd-Frank Wall Street Reform and Consumer Protection Act {Dodd-Frank Act). The 

objective of this audit was to assist OIG in evaluating CFTC's management controls relating to 

its regulatory oversight of FCMs' and RFEDs' compliance with financial reporting requirements 

during FYs 2012 and 2013. Our audit was limited to CFTC's oversight of FCMs and RFEDs 

holding customer funds. 

BACKGROUND 

CFTC's Division of Swap Dealer and Intermediary Oversight {DSIO) has responsibility for 

overseeing the registration and compliance of intermediaries and futures industry self-regulatory 

organizations, including U.S. derivatives exchanges and the National Futures Associations. 

Under Dodd-Frank Act, DSIO is responsible for developing and monitoring compliance with 

regulations addressing registration, business conduct standards, capital adequacy, and margin 

requirements for swap dealers and major swap participants. OSlO's New York Regional Office 

has primary responsibility for ensuring and conducting reviews of FCMs' and RFEDs' 

compliance with CFTC financial reporting requirements. 

As required under CEA, FCMs and RFEDs are required to periodically file a variety of audited 

and unaudited financial reports and other information with CFTC each year. Such reports and 

information include statements of financial condition, computation of minimum capital 

requirements, income, changes in ownership equity, changes in subordinated liabilities, and . 

cash flows. 

SUMMARY OF RESULTS 

Our audit found that CFTC had management controls to help achieve its regulatory oversight of 

FCMs' and RFEDs' compliance with CFTC financial reporting requirements during FYs 2012 

and 2013. Our analysis of a sample of FCMs and RFEDs reviewed by DSIO indicated that 

CFTC's prescribed procedures for conducting its reviews were generally followed. We identified, 

and communicated separately to management, certain matters about CFTC's control 

deficiencies for which CFTC could take measures to strengthen its controls. 

1 
·' 

SCOPE AND METHODOLOGY 

Our audit scope was limited to evaluating CFTC's management controls toward achieving its 

regulatory oversight of FCMs' and RFEDs' compliance with financial reporting requirements 

during FYs 2012 and 2013. Our audit was limited to CFTC's reviews of FCMs and RFEDs 

holding customer funds. 

We reviewed CEA and Dodd-Frank Act provisions; CFTC financial rules, regulations, and 

procedures, and specifically CFTC management contrQis and reviews of FCMs' and RFEDs' 

compliance with financial reporting requirements. In addition, we interviewed CFTC 

headquarters and OSlO's New York regional office officials about the management controls, 

policies, and procedures used in reviewing FCMs' and RFEDs' compliance with financial 

reporting requirements. We also analyzed the reports and workpapers of a sample of FCMs and 

RFEDs reviewed by OSlO in FYs 2012 and 2013, and determined their compliance with 

financial reporting requirements. Regulatory Statement Re~iew (RSR) express is an internally 

developed system used ~y CFTC to process and verify financial reports submitted by the FCMs 

and RFEDs. This system utilizes comprehensive edit and logic checks to analyze the financial 

reports for specific financial ratios and/or reportable events. CLA did not perform an Information 

Technology system and security assessment or conduct an evaluation of the RSR express's 

functionality and capability. 

We conducted this performance audit in accordance with Government Auditing Standards, 

issued by the Comptroller General of the United States. Those standards require that we plan 

and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for 

our conclusion based on our audit objective. We believe that the evidence obtained provides a 

reasonable basis for our conclusion. · 

This report is intended solely for the information and use of CFTC's management and OIG, and 

is not intended to be, and should not be, used by anyone other than these specified parties. 

Calverton, Maryland 

April 25, 2014 

2 
CliftonlarsonAllen • 

Inspector General 

U.S. Commodity Futures Trading Commission 

CliftonlarsonAIIen LLP 

www.cliftonlarsonallen.com 

In planning and performing our performance audit of the U.S. Commodity Futures Trading Commission's 

(CFTC's) management controls and procedures for evaluating Futures Commission Merchants' (FCMs') 

and Retail Foreign Exchange Dealers' (RFEDs') compliance with CFTC financial reporting requirements 

mandated by the Commodity Exchange Act (CEA) and Dodd-Frank Wall Street Reform and Consumer 

Protection Act (Dodd-Frank Act) for fiscal years·2012 and 2013 in accordance with Government Auditing 

Standards, issued by the Comptroller General of the United States, we considered the entity's internal 

control as a basis for designing procedures that are appropriate for this engagement. 

During our audit, we became aware of deficiencies in internal control other than significant deficiencies 

and material weaknesses and other matters that are opportunities to strengthen management's internal 

control and improve the efficiency of CFTC's operations related to its oversight of the FCMs' and RFEDs' 

compliance with the mandated financial reporting requirements referred to above. 

While the nature and magnitude of these other deficiencies in internal control were not considered 

important enough to merit the attention of those charged with governance, they are considered of 

sufficient importance to merit management's attention. 

We did not audit CFTC's responses and, accordingly, we express no opinion on them. 

This letter is intended solely for the information and use of the management of CFTC and its Office of 

the Inspector General, and is not intended to be, and should not be, used by anyone other than these 

specified parties. 

Calverton, Maryland 

April 25, 2014 

1 
U.S. COMMODITY FUTURES TRADING COMMISSION 

MANAGEMENT LETTER COMMENTS 

September 30, 2013 

FISCAL YEAR 2013 FINDINGS 

EXHIBIT I 

1. DIVISION OF SWAP DEALER AND INTERMEDIARY OVERSIGHT (DSIO) POLICIES AND PROCEDURES 

FOR EVALUATING FCMs AND RFEDs COMPLIANCE WITH FINANCIAL REPORTING REQUIREMENTS 

Conditions- During our review of the CFTC's assessment process used to monitor the FCMs' and 

RFEDs' compliance with financial reporting requirements mandated by the CEA, we noted that OSlO 

management did not have a formal policy in place to establish the staff hierarchy for OSlO reviews 

of FCMs and RFEDs until June 2013. The policy required that a CT level 14 or above perform the 

second review and approval of the FCMs' and RFEDs' compliance with the financial reporting 

requirements. We examined the reviews conducted by OSlO staff and noted the following 

• In 2 of the 32 FCMs/RFEDs financial statements examined, the second/supervisory review 

was performed by an auditor at a CT grade level13 or lower subsequent to the date of the 

new policy. 

• In 13 of the 32 FCMs/RFEDs financial statements examined, the second/supervisory review 

was performed by an auditor at a CT grade level 13 or below before the policy was 

established. 

In addition, we noted instances that the OSlO policies and procedures did not contain clear and 

concise instructions to ensure the objectives of the review procedures were met. For example, 

management's policy contained a procedure for its staff to investigate and document the cause of 

material changes to specific line items during the examination of the FCMs and RFEDs financial 

statements. However, the manual did not include a provision and/or parameter on what constitutes 

a material change. 

Recommendations- We recommend that CFTC: 

1. Develop a documented monitoring process of control activities related to the supervisory review 

of FCMs' and RFEDs' financial reporting compliance to ensure that the process is operating as 

management intended to accomplish its control objective. The results of the monitoring 

activities should be evaluated and any deficiency identified should be corrected by management 

in a timely manner. 

Management Response: 

CFTC management concurred with Recommendation 1. However, management indicated a 

monitoring process and controls have been in place since December 2013. Only the appropriate, 

assigned staff can perform an initial and supervisory review of the financial statements. This is 

controlled in two ways. First, the names of the staff and supervisors assigned to a particular firm are 

coded directly into RSRexpress by the System Administrator (upon the request from an Associate 

Director) thereby ensuring that only assigned individuals can sign off a supervisor review. Second, a 

monthly report is generated for each Associate Director detailing the status of the monthly financial 

review process and resolution of any issues noted. This report is summarized and presented to the 

Deputy Director in a monthly status report highlighting any issues and reviews outstanding more 

2 
·, U.S. COMMODITY FUTURES TRADING COMMISSION 

MANAGEMENT lETTER COMMENTS 

September 30, 2013 

EXHIBIT I 

than 30 days. If a financial review is outstanding for an extended period of time, appropriate actions 

are taken by management. 

Auditors Comments: 

Management stated that a monitoring process and controls were placed in operations as of 

December 31, 2013, approximately two months subsequent to the audit periods. As a result, we 

could not determine the adequacy of control design or operating effectiveness of management's 

corrective actions. 

2. Refine current policies and/or procedures manual to incorporate the review and/or research 

criteria for material variances in all places mentioned in the manual. In addition, management 

should review and determine whether any other vague criteria exist and update accordingly. All 

documented policies and procedures should be clear, concise, and descriptive. 

Management Response: 

CFTC management did not concur with Recommendation 2. Management indicated that the 

definition for materiality is set forth in CFTC interpretation 4-1 dated July 29, 1985, which clearly and 

concisely states the definition in terms of a percentage. This definition has been readily accepted 

and applied in practice by the Commission Staff, the Division of Enforcement and by the DSROs. This 

definition was reviewed as recently as June 2013 in discussions with the DSROs and was reaffirmed 

as appropriate at that time. Additionally, management performed a review of its procedures and 

identified no "vague criteria" in its procedures. 

Auditors Comments: 

Management stated that a definition for materiality was set forth in CFTC interpretation 4-1. 

However, the aforementioned interpretation addresses material error. The specific research 

criterion for material variance was not defined in OSlO's policies and procedures. Such vague criteria 

allows for inconsistent application of the procedure performed by staff. 

2. REGUlATORY STATEMENT REVIEW (RSR) EXPRESS 

Condition- CFTC uses RSRexpress as an essential application to process and verify financial reports 

submitted by the FCMs and RFEDs. RSRexpress is an internally modified information technology 

system that utilizes comprehensive edit and logic checks to analyze the financial reports for specific 

financial ratios and/or reportable events. The Office of Data and Technology management stated 

that the RSRexpress system operates under the overall structure of the General Support System 

{GSS) and has inherited all the information technology controls associated with GSS. However, 

management was not able to provide documentation that supports the above assertion or 

documentation that a security assessment was performed on RSRexpress. 

Recommendation- We recommend that that CFTC management: 

Review the current classification of RSRexpress as a minor application1 and reevaluate the Federal 

Information Processing System 199 categorization of RSRexpress. A further review of the data types 

1 See OMB Circular A-130 Appendix Ill for a discussion on major vs. minor system. 

3 
U.S. COMMODITY FUTURES TRAQING COMMISSION 

MANAGEMENT LETTER COMMENTS 

September 30, 2013 

EXHIBIT I 

housed in RSRexpress by the Office of Data and Technology will assist management in evaluating 

security risks associated with the system. Once the assessment is performed, management should 

implement the necessary controls to mitigate security risks identified with this system. 

Management Response: 

Management concurred with our recommendation. However, management stated that RSRexpress 

inherits controls from the CFTC General Support System (GSS or CFTC Network) for NIST 800-53 

Revision 3. The GSS is rated as a moderate impact system, as are all the other major CFTC systems. 

Changes to RSRexpress have been and will continue to be evaluated by the CFTC Security Impact 

Analysis (SIA) component of the change management process, which considers controls for all of the 

NIST 800-53 Revision 3 control families. Eight such SIA reviews of RSRexpress changes have been 

conducted in FY 2013. However, management will reconsider, during its transition to compliance 

with NIST 800-53 Revision 4, current Certification and Accreditation (C&A) boundaries and may 

adjust them in order to identify and manage risk as efficiently as possible. 

Auditor's Comments: 

Management comments appear to be responsive to our recommendation. The CFTC Office of the 

Inspector General should follow-up with management to ensure that the corrective action 

implemented by management is effective 

4 
U.S. COMMODITY FUTURES TRADING COMMISSION 

Division of Swap Dealer and Intermediary Oversight 

140 Broadway, New York, NY 10005 

To: 

From: 

Cc: 

Date: 

Subject: 

Telephone: (646) 746-9834 

Facsimile: (646) 746-9937 

E-Mail: kpiccoli@cftc.gov 

Tony Baptiste - OIG 

Kevin Piccoli - DSIO Examinations 

Gary Barnett 

May 28,2014 

Audit Report Management Comments 

Kevin C. Piccoli 

Deputy Director 

Tony- as requested, please find below our response to the Management Letter 

Comments we received from your recent review of DSIO- Examinations group. Please 

let me know if you have any comments or questions. 

Recommendation # 1.1 

Management Response: 

A monitoring process and controls have been in place since December 2013. Only the 

appropriate, assigned staff can perform an initial and supervisory review of the financial 

statements. This is controlled in two ways. First, the names of the staff and supervisors 

assigned to a particular firm are coded directly into RSRexpress by the System 

Administrator (upon the request from an Associate Director) thereby ensuring that only 

assigned individuals can sign off a supervisor review. Second, a monthly report is 

generated for each Associate Director detailing the status of the monthly financial 

review process and resolution of any issues noted. This report is summarized and 

presented to the Deputy Director in a monthly status report highlighting any issues and 

reviews outstanding more than 30 days. If a financial review is outstanding for an 

extended period of time, appropriate actions are taken by management. 

Concur: Yes _X_ No 

Recommendation #1.2 

Management Response: 

The definition for materiality is set forth in CFTC interpretation 4-1 dated July 29, 1985 

which clearly and concisely states the definition in terms of a percentage. This 

definition has been readily accepted and applied in practice by the Commission Staff, 

the Division of Enforcement and by the DSROs. This definition was reviewed as 

recently as June 2013 in discussions with the DSROs and was reaffirmed as 

appropriate at that time. Additionally, we have performed a review of our procedures 

and identified no "vague criteria" in our procedures. 

Concur: Yes No_X_ 
Recommendation #2.1 

Management Response: 

RSRexpress inherits controls from the CFTC General Support System (GSS or CFTC 

Network) for NIST 800-53 Revision 3. The GSS is rated as a moderate impact system, 

as are all the other major CFTC systems. Changes to RSRexpress have been and will 

continue to be evaluated by the CFTC Security Impact Analysis (SIA) component of the 

change management process, which considers controls for all of the NIST 800-53 

Revision 3 control families. Eight such SIA reviews of RSRexpress changes have been 

conducted in FY 2013. However, the CFTC will reconsider, during its transition to 

compliance with NIST 800-53 Revision 4, current Certification and Accreditation (C&A) 

boundaries and may adjust them in order to identify and manage risk as efficiently as 

possible. 

Concur: Yes X No