Office of the Inspector General 

Commodity Futures Trading Commission 

Semiannual Report to Congress 

April 1, 2016 – September 30, 2016 
--Blank Page--
Commodity Futures Tnding CommU-s;on 

TO: 

FROM: 

SUBJECT: 

U.S. COMMODITY FUTURES TRADING COMMISSION 

Office of Inspector General 

Three Lafayette Centre 

1155 2 1st Street, NW, Washington, DC 2 058 1 

Telephone : (202) 4 18-5110 

Facsimile : (202) 418-5522 

Timothy G. Massad, Chairman 

Commissioner Sharon Y. Bowen 

October 28, 2016 

Commissioner J. hri top~ car o 

A. Roy Lavik n ( ( Inspector Generaμ 

Semiannual Report of the Office of the Inspector General 

Attached is the Office of the Inspector General's Semiannual Report for the period from 

April 1, 2016, through September 30, 20 16. This report is submitted to you in accordance with 

the requirements of Section 5 of the Inspector General Act of 1978, as amended, and summarizes 

issued reports and ongoing proj ects during the reporting period. 

I appreciate your continuing support of this office. 
--Blank Page--
TABLE of CONTENTS 

EXECUTIVE SUMMARY ............................................................................................................ 1

MANAGEMENT and ADMINISTRATION ............................................................................... 6

1. CFTC Programs and Operations .......................................................................................... 6

2. OIG Responsibilities ............................................................................................................ 7

3. OIG Resources ..................................................................................................................... 8

COMPLETED AUDITS, INSPECTIONS, EVALUATIONS, REVIEWS and OTHER 

PROJECTS .................................................................................................................................... 9

1. Cybersecurity Act of 2015 - Section 406 ............................................................................ 9

2. FY 2015 Compliance with the Improper Payments Elimination and Recovery 

Improvement Act ................................................................................................................. 9

3. Review of the CFTC Travel Card Program ......................................................................... 9

4. Review of Management Assurances for Internal Controls (2014-2015) ........................... 10

5. Whistleblower Office Review. .......................................................................................... 11

6. Review of Space Utilization of the Washington D.C. Office ............................................ 11

7. External Peer Review of the CFTC OIG Audit Organization ........................................... 11

8. Most Serious Management Challenges Facing the CFTC ............................................... 12

CURRENT AUDITS, INSPECTIONS, EVALUATIONS, REVIEWS, and OTHER 

PROJECTS .................................................................................................................................. 13

1. Audit of CFTC’s Enterprise Architecture Program ........................................................... 13

2. Lean Labor Audit of Division of Clearing and Risk 

and Division of Market Oversight Functions .................................................................... 13

3. Audits of the CFTC’s FY 2016 Annual Financial Report 

and Customer Protection Fund .......................................................................................... 13

4. CFTC’s Policies and Procedures for Reviewing Registrants’ Cybersecurity Policies ...... 13

5. Information Security Audit FY 2016: Compliance with Provisions of the Federal 

Information Security Modernization Act (FISMA) ........................................................... 14

6. Review of CFTC’s Defenses to Protect Sensitive Database Information ......................... 14

7. Audit of CFTC’s Oversight of NFA .................................................................................. 14

8. Office of the Chief Economist Follow-up Review. ........................................................... 15

9. Economic Analysis of Dodd-Frank Rules ......................................................................... 15

10. Office of General Counsel Follow-up Review. ................................................................. 15

AUDIT REPORTS and REVIEWS ........................................................................................... 16

OVER SIX MONTHS OLD ........................................................................................................ 16

1. Corrective Action Not Completed ..................................................................................... 16

2. Corrective Action Completed ............................................................................................ 16

3. Management Decision Not Made ...................................................................................... 16

INVESTIGATIONS .................................................................................................................... 17

1. Investigation into a Potential Information Technology Security Incident ........................ 17

2. Time and Attendance Allegation ....................................................................................... 17

3. Allegation of Improper Treatment of Dodd-Frank Commenter ........................................ 17
SUMMARY of MATTERS REFERRED to PROSECUTORIAL AUTHORITIES ............... 18

CONGRESSIONAL INQUIRIES .............................................................................................. 18

LEGISLATIVE, REGULATORY, and RULE REVIEWS ....................................................... 18

PEER REVIEWS ......................................................................................................................... 19

SUMMARY of EACH REPORT MADE to the AGENCY HEAD .......................................... 20

REVISED MANAGEMENT DECISIONS ................................................................................ 20

INSPECTOR GENERAL DISAGREEMENT .......................................................................... 20

GAO LIAISON ............................................................................................................................ 20

STRATEGIC PLAN for the OFFICE of the INSPECTOR GENERAL .................................. 21

1. Investigative Agenda ......................................................................................................... 21

2. Legislative and Regulatory Review Agenda ..................................................................... 21

3. Audit, Inspection, Evaluation, and Review Agenda .......................................................... 22

CONTACTING the OFFICE of the INSPECTOR GENERAL ............................................... 24

TABLE 1 – Reports Issued with Questioned Costs ................................................................ 25

TABLE 2 – Reports Issued with Recommendations Funds Be Put To Better Use ........... 26

TABLE 3 - Index of IG Act Reporting Requirements ............................................................ 27
1

EXECUTIVE SUMMARY 

This semiannual report is issued by the Commodity Futures Trading 

Commission’s (CFTC’s) Office of the Inspector General (OIG) pursuant to the Inspector 

General Act of 1978, as amended.1 It summarizes OIG’s activities and accomplishments 

for the period April 1, 2016, through September 30, 2016. During this period, OIG 

completed two audits, two audit reviews, and two investigative reviews. OIG began or 

continued work on seven audits, one audit review, two investigative reviews, and one 

investigation. In addition, the OIG closed two allegations of misconduct by CFTC 

employees, and issued its annual assessment of the most serious management 

challenges facing CFTC. Finally, the OIG Office of Audit successfully passed a peer 

review. 

Highlights of audits, reviews, and investigations completed this period 

include: 

Information Security 

 Covered Federal Computer Systems Pursuant to the Cybersecurity Act of 2015 - 

Section 406, (August 12, 2016). The Cybersecurity Act of 2015, Section 406,2

requires the Inspectors General to submit reports to Congress on information 

collected on national security systems and/or Federal computer systems that 

provide access to personally identifiable information. Our report concluded that 

appropriate logical access standards and guidance were generally in practice, as 

required. We highlighted that CFTC needs to focus more of its cybersecurity 

program efforts on monitoring and detecting exfiltration. 

Financial Management 

 FY 2015 Compliance with the Improper Payments Elimination and Recovery 

Improvement Act of 2010 (IPERA), (May 16, 2016). For the fiscal year ended 

September 30, 2015, the OIG audited the CFTC’s compliance with the IPERA3

and Office of Management and Budget (OMB) reporting requirements for 

improper payments. We concluded that the CFTC complied, in all material 

respects, with OMB requirements for the fiscal year ended September 30, 2015, 

and its improper payment assertion made in their respective agency financial 

report is fairly stated. 

 Review of the CFTC Travel Card Program, (September 19, 2016). The OIG 

assessed whether the CFTC complied with its travel card policy. Federal travel 

regulations require employees to use their travel cards for all travel-related 

expenses while on official travel unless exempted. We concluded that CFTC’s 

 

1 P.L. 95-452, 92 STAT. 1101 (1978). 

2 P.L. 114-113, 129 STAT. 2935 (2015). 

3 P.L. 111-204, 124 STAT. 2224 (2010). 
2

travel card program is generally effective in minimizing non-compliance with its 

travel policy (misuse of the card was detected in approximately 3.3% of our 

sample, totaling approximately 1% of the value of transactions reviewed). 

However, adherence to current CFTC policy requiring written notification to 

employees and supervisors of suspected unauthorized transactions, so that the 

appropriate steps can be taken to address any suspected misuse, would further 

strengthen its travel card program. 

Performance 

 Whistleblower Office Review (September 29, 2016). This review initially began 

in September 2014, but was halted in November 2014 due to competing 

priorities. It was reopened in FY2015 and completed this reporting period. The 

review discussed the Whistleblower Program in light of recently proposed 

amendments to the CFTC Whistleblower Program regulations, and 

recommended enhanced protection for the identities of whistleblowers, 

specifically that access to whistleblower identities be restricted within CFTC’s 

Enforcement case management system. (Investigative Review). 

 Review of Management Assurances for Internal Controls (2014-2015), (June 7, 

2016). The CFTC relies on a certified Statement of Assurance (SOA) produced by 

each of its divisions/branches/offices (reporting units) as the basis for the CFTC 

overall SOA. Our review noted that while the CFTC documented support for 

Federal Managers' Financial Integrity Act (FMFIA) section 4 assurances for FY 

2014 and FY 2015, the CFTC can better document support for section 2 

requirements associated with certain mission operations and supporting 

reporting units.4 As such, the enterprise-wide assertions were not fully 

supported. 

 Review of Space Utilization of the Washington D.C. Office of the CFTC, April 25, 

2016. In the last of a series of space utilization reviews, we found that the CFTC 

spends approximately $2.0–2.8 million per year on empty office space in D.C.. 

We estimated that the CFTC will spend, throughout all four of its offices, over the 

terms of its current leases, between $44.7 and $56.6 million on empty office 

space. (Investigative Review.) 

Other Reports 

 External Peer Review Report of the CFTC OIG Audit Organization, (August 16, 

2016). The Architect of the Capitol, Office of the Inspector General, reviewed the 

system of quality control for the CFTC OIG audit organization in effect for the 

year ending March 31, 2016. In their opinion, the system of quality control for the 

 

4 Section 4 assurances address controls over financial management systems while section 2 requirements 

address reports of controls over programs and operations. FMFIA, §§2, 4, P.L.97-255, 96 STAT. 815-816 

(codified at 31 USC 3512). 
3

audit organization of CFTC in effect for the year ending March 31, 2016, has been 

suitably designed and complied with to provide CFTC with reasonable assurance 

of performing and reporting in conformity with applicable professional standards 

in all material respects. CFTC OIG received the highest external peer review 

rating of “pass.” 

 Inspector General’s Assessment of the Most Serious Management Challenges 

Facing the CFTC, (September 20, 2016). The OIG highlighted 4 management 

challenges for 2017 in the areas of cyber security (two challenges), agency budget 

constraints, and financial reporting. 

Closed Allegations 

 Allegation of time and attendance fraud. OIG began a preliminary investigation 

after receiving an anonymous allegation of time and attendance infractions. Our 

preliminary investigation found no evidence of the alleged infractions and is now 

concluded. 

 Allegation of improper treatment of Dodd-Frank5 commenter. OIG began a 

preliminary investigation after receiving a complaint that CFTC improperly 

refused to consider a public comment submitted in response to a Dodd-Frank 

proposed rule after the deadline to submit comments. Our preliminary 

investigation found no evidence of misconduct by CFTC officials and is now 

concluded. 

Audits, reviews, and investigations started or continued this period 

includes: 

Investigation 

 Investigation into a Potential Information Technology Security Incident (June 

27, 2016). A CFTC IT administrator exposed the CFTC to potential data loss by 

establishing frequent network connections to a personal server located at his 

private residence for “testing.” No data loss was uncovered. However, our 

investigation found that that senior management, lower level management, and 

staff in the CFTC Office of Data and Technology withheld information from 

internal investigators. In addition, various officials within the organization 

considered different retaliatory actions against a contractor who reported the 

improper network activity. The Chief Information Officer (CIO), to his credit, did 

not permit them to go forward. We referred our findings to the CFTC for action, 

and were considering our response to the implemented actions at the end of the 

reporting period.

 

 

5 Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act” or “Dodd-Frank”), 

P.L. 111-203, 124 Stat. 1376 (2010). 
4

Strategic 

 Audit of CFTC’s Enterprise Architecture (EA) Program. OIG initiated the audit to 

determine if CFTC (1) has established adequate baseline and target architectures; 

(2) has effective management practices, policies, and processes for the 

development, implementation, maintenance, and oversight of the EA program; 

and (3) has adequate resources to realize target architectures. 

 Lean Labor Audit of CFTC’s Division of Clearing and Risk and Division of Market 

Oversight. OIG initiated this audit to determine if these two CFTC Divisions 

could more efficiently balance labor and demand. 

Financial Reporting 

 Audits of the CFTC’s FY 2016 Annual Financial Report and of the CFTC Customer 

Protection Fund. The objective of these audits is to render an opinion on the 

respective financial statements in accordance with Generally Accepted 

Government Auditing Standards. 

Information Security 

 CFTC’s Policies and Procedures for Reviewing Registrants’ Cybersecurity Policies. 

The OIG contracted Brown & Company to review existing CFTC policies and 

procedures toward reducing cybersecurity risks of CFTC registrants. 

 Information Security Audit FY 2016: Compliance with Provisions of the Federal 

Information Security Modernization Act.6 The objective of the audit is to conduct 

an independent evaluation of CFTC’s information security program, and practices 

as required by FISMA. 

 Review of CFTC’s Defenses to Protect Sensitive Database Information. This 

review focuses on protection controls over databases containing sensitive 

information entrusted to the Commission. 

CFTC Oversight (Performance Audit) 

 Audit of CFTC’s Oversight of NFA. OIG initiated an audit to examine CFTC 

oversight activities of the National Futures Association (NFA). 

Reviews (Investigative) 

 Office of the Chief Economist Follow-up Review. In January of 2016, we 

published our second review of the Office of the Chief Economist. We noted that 

staffing levels remain depressed and that the visiting scholar program – in which 

 

6 P.L. 107-347, 116 STAT. 2946 (2002). 
5

academics from outside the CFTC would research and publish on topics relevant 

to the CFTC’s mission for free – remained defunct. We highlighted that certain 

research topics for full time staff were off-limits due to apparent political 

sensitivity. We began our follow-up in September 2016. 

 We began research on cost-benefit analyses in connection with proposed and 

final rules under the Dodd-Frank Act. It has been over five years since we issued 

two reports addressing CFTC’s consideration of costs and benefits in connection 

with proposed Dodd-Frank rules. We intend to publish further on this topic in 

the coming months. 
6

MANAGEMENT and ADMINISTRATION 

1. CFTC Programs and Operations 

Congress created the CFTC in 1974 as an independent agency with the mandate 

to regulate commodity futures and options markets in the United States. The 

Commission’s mandate was renewed and/or expanded in 1978, 1982, 1986, 1992, and 

1995. In December 2000, the Commission was reauthorized by Congress and the 

President through Fiscal Year 2005 with the passage of the Commodity Futures 

Modernization Act of 2000 (CFMA). In May of 2008, Congress reauthorized the CFTC 

through Fiscal Year 2013. On July 21, 2010, the President signed into law the DoddFrank Act,1 which expanded the CFTC’s jurisdiction and authorities. 

 The CFTC is responsible for fostering the economic utility of futures markets by 

encouraging their competitiveness and efficiency, ensuring their integrity, and 

protecting market participants against manipulation, abusive trade practices, and fraud. 

Through effective oversight regulation, the CFTC enables the commodity futures 

markets better to serve their vital function in the nation’s economy—providing a 

mechanism for price discovery and a means of offsetting price risks. The Dodd-Frank 

Act authorized the CFTC to regulate swap dealers and increase transparency in the 

derivatives marketplace. 

The CFTC operating divisions are: Office of the Chairman, Division of Clearing 

and Risk, Division of Swap Dealer and Intermediary Oversight, Division of 

Enforcement, Division of Market Oversight, Office of the Chief Economist, Office of the 

Executive Director, Office of General Counsel, Office of International Affairs, and Office 

of Data and Technology. Within the Office of the Chairman there are Offices of Minority 

and Women Inclusion, Legislative Affairs, and Public Affairs. In addition to its 

headquarters office in Washington, D.C., the CFTC maintains offices in Chicago, Illinois; 

Kansas City, Missouri; and New York, New York. 

 

 

1

 See fn. 5. 
7

2. OIG Responsibilities 

 The CFTC OIG was created in 1989 in accordance with the 1988 amendments to 

the Inspector General Act of 1978.2 OIG was established as an independent unit to: 

 Promote economy, efficiency, and effectiveness in the administration of CFTC 

programs and operations, and detect and prevent fraud, waste, and abuse in such 

programs and operations; 

 Conduct and supervise audits and, where necessary, investigations relating to the 

administration of CFTC programs and operations; 

 Review existing and proposed legislation, regulations, and exchange rules and 

make recommendations concerning their impact on the economy and efficiency 

of CFTC programs and operations or the prevention and detection of fraud and 

abuse; 

 Recommend policies for, and conduct, supervise, or coordinate other activities 

carried out or financed by such establishment for the purpose of promoting 

economy and efficiency in the administration of, or preventing and detecting 

fraud and abuse in, its programs and operations; and 

 Keep the Commission and Congress fully informed about any problems or 

deficiencies in the administration of CFTC programs and operations and provide 

recommendations for correction of these problems or deficiencies. 

OIG is a member of the Counsels of Inspectors General on Financial Oversight 

(CIGFO), created under the Dodd-Frank Act to examine the work of the Financial 

Stability Oversight Council (FSOC). 

 OIG is required to conduct, supervise, and coordinate audits of CFTC programs 

and operations in accordance with Generally Accepted Government Auditing 

Standards. OIG is also required to recommend changes to existing and proposed CFTC 

programs and operations to promote economy, efficiency, and effectiveness and to 

prevent and detect fraud and abuse. OIG also conducts inspections, evaluations, and 

reviews in accordance with the Quality Standards for Inspection and Evaluation issued 

by the Council of Inspectors General for Integrity and Efficiency (CIGIE). 

 OIG investigations are performed in accordance with the Quality Standards for 

Investigations issued by the CIGIE. Investigations are performed in response to 

allegations and/or evidence indicating possible violations of law, regulations, or 

applicable standards, as well as other alleged or suspected improper conduct in 

connection with the programs and operations of the Agency (investigative reviews). 

 

2 Inspector General Act Amendments of 1988, P.L. 100-504, 102 Stat. 2515 (1988). 
8

 OIG operates independently of the Agency and has not experienced any 

interference from the CFTC Chairman or Commissioners in connection with the conduct 

of any investigation, inspection, evaluation, review, or audit. Our investigations have 

been pursued regardless of the rank or party affiliation of the target. OIG also has 

conducted audits, inspections, evaluations, and reviews without interference where it 

has perceived the opportunity to recommend improvement to futures regulation efforts, 

again without regard to the party affiliation of any Chairman or Commissioner.3 

3. OIG Resources 

 At the end of the reporting period, the CFTC OIG consisted of 8.5 full time 

equivalents—the Inspector General, Deputy Inspector General/Chief Counsel, Assistant 

Inspector General for Auditing, three Attorney-Advisors (one part time), two Auditors, 

and one Senior Program Analyst. 

 

3 The Inspector General Act of 1978, as amended, states: “Neither the head of the establishment nor the 

officer next in rank below such head shall prevent or prohibit the Inspector General from initiating, 

carrying out, or completing any audit or investigation....” 5 U.S.C. App. 3 sec. 3(a). 
9

COMPLETED AUDITS, INSPECTIONS, EVALUATIONS, 

REVIEWS and OTHER PROJECTS 

During this period, OIG completed two audits, two audit reviews, two audit 

compliance matters, and two investigative reviews. 

1. Covered Federal Computer Systems Pursuant to the Cybersecurity 

Act of 2015 - Section 406 (August 12, 2016)

In December 2015, President Obama signed into law the Cybersecurity Act of 

2015.1 Section 406 requires Inspectors General to submit reports to Congress on 

information collected on national security systems and/or Federal computer systems 

that provide access to personally identifiable information. Our report satisfies the 

requirement for the CFTC and concludes that appropriate logical access standards and 

guidance were generally in practice, as required. We recommended that CFTC focus 

more of its cybersecurity program efforts on monitoring and detecting exfiltration as 

reinforced by vulnerability test results. This report is not public. 

2. FY 2015 Compliance with the Improper Payments Elimination and 

Recovery Improvement Act (May 16, 2016)

For the fiscal year ended September 30, 2015, we audited CFTC’s compliance 

with OMB Circular A-136 (Financial Reporting Requirements) as they relate to the 

Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA);2

and OMB Circular A-123, Appendix C (Requirements for Effective Estimation and 

Remediation of Improper Payments). OIG’s responsibility is to express an opinion on 

the agency’s compliance with these requirements. We concluded that the CFTC 

complied, in all material respects, with the aforementioned requirements for the fiscal 

year ended September 30, 2015 and its improper payment assertion for reporting made 

in their respective agency financial report is fairly stated. 

3. Review of the CFTC Travel Card Program (September 19, 2016)

We reviewed the use of CFTC travel card holders’ US Bank transactions from 

June 1, 2015, to June 31, 2016. Our review assessed whether the CFTC complied with its 

travel card policy. Federal travel regulations require employees to use their travel cards 

for all travel-related expenses while on official travel unless exempted. CFTC policy also 

requires employees to use their government-issued travel cards for payment of expenses 

related to their official travel. CFTC travel card holders are billed directly by the travel 

card issuing bank for their charged official travel expenses, and are responsible for 

payment. Official travel expenses are separately reimbursed to the traveler. Any use of 

 

1 P.L. 114-113, 129 STAT. 2935 (2015). 

2 P.L. 112-248, 126 STAT. 2390 (2013). 
10

the travel card (including cash withdrawals) to pay expenses incurred for purposes other 

than official travel and travel-related activities are unauthorized. 

We concluded that CFTC’s travel card program is generally effective in 

minimizing non-compliance with its travel policy. However, adherence to current CFTC 

policy requiring notification to employees and supervisors of suspected unauthorized 

transactions, so that the appropriate steps can be taken to address any misuse, would 

further strengthen its travel card program. We recommended that management follow 

its review and remedial action policy so that employees and their supervisors are 

informed of instances of suspected non-compliance with its travel card program. 

Management concurred with the findings and recommendation and expressed that they 

are drafting written communications to notify (1) employees in non-compliance of travel 

regulations and policy, and (2) their supervisors to determine punitive actions, if 

necessary. 

4. Review of Management Assurances for Internal Controls (2014-2015) 

(June 7, 2016)

CFTC relies on a certified Statement of Assurance (SOA) produced by each of its 

divisions/branches/offices (reporting units) as the basis for the CFTC overall SOA. For 

fiscal year (FY) 2015, CFTC management issued a qualified SOA, indicating that the 

agency’s internal controls and financial management systems met the objectives of the 

FMFIA, with one exception. Other than an outstanding exception related to the 

recording of lease obligations, the CFTC asserted its internal controls were operating 

effectively, and that no other reportable conditions presented throughout the year. For 

FY 2014, the CFTC declared that it conformed to FMFIA requirements without any 

exceptions. 

Our audit noted that while the CFTC documented support for FMFIA section 4 

assurances for FY 2014 and FY 2015, the CFTC can better document support for section 

2 requirements associated with certain mission operations and supporting reporting 

units.3 We found seven of 14 reporting units were not able to fully support the positive 

assertions made in their FY 2014 SOAs. For FY 2015, six of 14 reporting units, all 

repeating from the prior year, were not able to fully support their SOAs. As such, the 

enterprise-wide assertions are also not fully supported. We recommended that the CFTC 

establish a Chief Risk Officer (CRO) and reporting unit champions, define roles and 

responsibilities for the CRO and reporting unit champions, and develop and 

communicate an implementation plan. Management generally concurred with 

recommendations. Given budgetary constraints, CFTC’s actions are responsive to the 

report recommendations. 

 

3 See fn.4. 
11

5. Whistleblower Office Review (September 29, 2016). 

 This review initially began in September 2014, but was halted in November 2014 

due to competing priorities. It was reopened in FY2015 and completed this reporting 

period. The review discussed the Whistleblower Program in light of recently proposed 

amendments to the CFTC Whistleblower Program regulations,4

 and recommended 

enhanced protection for the identities of whistleblowers, specifically that access to 

whistleblower identities be restricted within CFTC’s Enforcement case management 

system. (Investigative Review).

6. Review of Space Utilization of the Washington D.C. Office 

(April 25, 2016)

In this last of a series of space utilization reviews, we found that the CFTC spends 

approximately $2.0–2.8 million per year on empty office space in D.C., and that the 

D.C. office has an occupancy rate between 79% and 84%. We estimated that the CFTC 

will spend, throughout all four of its offices, over the terms of its current leases, between 

$44.7 and $56.6 million on empty office space. Although we noted several concerns 

regarding D.C. office space utilization, we chose to focus on a single recommendation 

that the Commission base all future leasing decisions and all decisions impacting the use 

of existing space on realistic expectations of current budget resources. This would lessen 

unused space. We note that the CFTC has not returned or sublet any of its excess space 

since our first review of the Kansas City office was published in June of 2014. 

7. External Peer Review of the CFTC OIG Audit Organization

(August 16, 2016)

The Architect of the Capitol, Office of the Inspector General reviewed the system 

of quality control for the audit organization of the CFTC OIG in effect for the year 

ending March 31, 2016. The peer review was conducted in accordance with Government 

Auditing Standards and the CIGIE Guide for Conducting Peer Reviews of the Audit 

Organizations of Federal Offices of Inspector General. In their opinion, the system of 

quality control for the audit organization of CFTC OIG in effect for the year ending 

March 31, 2016, has been suitably designed and complied with to provide CFTC with 

reasonable assurance of performing and reporting in conformity with applicable 

professional standards in all material respects. Audit organizations can receive a rating 

of pass, pass with deficiencies, or fail. CFTC OIG received an external peer review rating 

of pass, the highest rating. 

 

4 81 FR 59551 (Aug. 30, 2016).
12

8. Inspector General’s Assessment of the Most Serious Management 

Challenges Facing the CFTC (September 20, 2016)

 

For FY2017, the OIG identified four management challenges. Specifically, CFTC 

is challenged to: 

 Stimulate registrants towards enhancing their cyber security controls over vital client 

information so as to reduce the impact of any future information technology breach. 

Our recently issued audit of CFTC’s approach to reducing cybersecurity risks at 

registrants identified several testing and intelligence sharing opportunities to 

enhance the current approach to this threat. 

 Minimize information security vulnerabilities in its network with particular attention 

to the exfiltration of sensitive data. Results of OIG information systems reviews 

revealed that management is addressing information security vulnerabilities. 

 Effectively triage oversight tasks in order to execute its strategic plan with limited 

budgetary resources. For the second year (FY2015 and FY2016) in a row CFTC 

budget’s was flat at $250 million while certain operational costs increased. 

Therefore, CFTC must effectively triage its budgetary resources to meet its oversight 

responsibilities stated in its Strategic Plan. 

 Address findings from its FY2015 financial statement audit report. For FY2015, the 

IPA issued a qualified opinion on CFTC’s financial statements and alerted users that 

previously issued audit opinions were unreliable. The IPA identified a material 

weakness in internal controls over financial reporting related to the recording of 

lease obligations that materially affected the Statement of Budgetary Resources. 

Currently, the Government Accountability Office (GAO) and the CFTC are 

developing a suitable framework for disclosing future lease financial commitments. 

The assessment of most serious management challenges will be published with the 

CFTC financial statement audit. 

 
13

 CURRENT AUDITS, INSPECTIONS, EVALUATIONS, 

REVIEWS, and OTHER PROJECTS 

At the end of this reporting period, OIG began or continued work on seven 

audits, one audit review, two investigative reviews, and one investigation. 

1. Audit of CFTC’s Enterprise Architecture Program 

In 1996, Congress enacted the Information Technology Management Reform Act, 

known as the Clinger-Cohen Act,5 which requires each agency’s CIO to develop, 

maintain, and facilitate the implementation of the agency’s enterprise architecture (EA). 

By implementing EA, agencies can ensure that they efficiently spend limited 

information technology resources on well integrated systems that support agency 

mission and strategic goals. OIG initiated this audit to determine if CFTC (1) has 

established adequate baseline and target architectures; (2) has effective management 

practices, policies, and processes for the development, implementation, maintenance, 

and oversight of the EA program; and (3) has adequate resources to realize target 

architectures. 

2. Lean Labor Audit of Division of Clearing and Risk and Division of 

Market Oversight Functions 

Lean labor focuses on the workforce and its interaction with other resources 

required for output. It seeks out inefficiencies such as overproduction, waiting, and 

unused employee potential to maximize the value of human capital assets. Given 

mission similarities, our objective is to assess the effectiveness of balancing labor and 

workload for CFTC’s Division of Clearing and Risk and Division of Market Oversight. 

3. Audits of the CFTC’s FY 2016 Annual Financial Report (AFR) and 

Customer Protection Fund (CPF) 

 

The objective of these two Congressionally mandated audits is to render an 

opinion on the AFR and CPF financial statement in accordance with Generally Accepted 

Government Auditing Standards.6 

4. CFTC’s Policies and Procedures for Reviewing Registrants’ 

Cybersecurity Policies 

We contracted with Brown & Company to review existing CFTC policies and 

procedures toward reducing cybersecurity risks of CFTC registrants. Brown & Company 

highlighted that CFTC and its oversight divisions have developed policies and 

procedures to address cybersecurity risks at CFTC registrants and identified five areas 

 

5 P.L. 104-106, 110 STAT. 202 (1996). 

6 The Accountability of Tax Dollars Act, P.L. 107-289, § 2, 116 STAT. 2049 (2002), requires our annual 

audit of the AFR. Section 748 of the Dodd-Frank Act, (see fn.5) requires our annual audit of the CPF. 
14

with recommendations where the CFTC could improve its policies and procedures 

toward reducing cybersecurity risks of registrants. Specific areas of improvement relate 

to data transfer protocols, frequency of internal and external penetration and 

vulnerability testing, oversight assessments, and intelligence and information sharing. 

We provided our discussion draft to Management on September 2, 2016, received the 

management response on September 28, 2016. At the close of the reporting period OIG 

and Brown and Company were reviewing the management response.7 

5. Information Security Audit FY 2016: Compliance with Provisions of 

the Federal Information Security Modernization Act (FISMA) 

The objective of this audit is to conduct an independent evaluation of CFTC’s 

information security program and practices as required by FISMA.8 The scope of the 

work covers the requirements of Federal Information Systems Modernization Act of 

20149 and OMB reporting guidance provided in the OMB FY 2015-2016 publication, 

Reporting Instructions for the Federal Information Security Management Act and 

Agency Privacy Management. 

6. Review of CFTC’s Defenses to Protect Sensitive Database Information 

 

The OIG contracted with staff from Department of Transportation-Enterprise 

Service Center (ESC) to conduct vulnerability scans of all databases under the control of 

the CFTC. This is a follow-on review to our prior year network vulnerability scans 

performed by the ESC team. However, during this review the team will employ 

standard non-destructive forensic software to explore access controls and procedures 

employed by Office of Data and Technology (ODT) to identify potential compromise 

vectors to commercially sensitive and/or personally identifiable information resident on 

selected databases. 

7. Audit of CFTC’s Oversight of NFA 

OIG initiated a review to examine CFTC’s oversight activities of the NFA. 

Specifically, OIG is assessing the nature of reviews performed by the CFTC, frequency of 

reviews, and effectiveness of CFTC management in achieving its desired outcomes from 

the NFA. We are reviewing data provided by management, anticipate completing 

necessary analyses during the first quarter of FY2017, and thereafter plan to issue a 

draft report. 

 

 

7 We issued our final report on October 12, 2016. This report is not published. 

8 See fn.6. 

9 P.L. 113-283, 128 STAT. 3073 (2014). 
15

8. Office of the Chief Economist Follow-up Review. 

In January of 2016, we published our second review of the Office of the Chief 

Economist. We noted that staffing levels remain depressed and that the visiting scholar 

program – in which academics from outside the CFTC would research and publish on 

topics relevant to the CFTC’s mission for free – remained defunct. We highlighted that 

certain research topics for full time staff were off-limits due to apparent political 

sensitivity. We stated our intent to follow up this report, and we began our follow-up in 

September 2016. 

9. Economic Analysis of Dodd-Frank Rules 

We began research on cost-benefit analyses in connection with proposed and 

final rules under the Dodd-Frank Act. It has been over five years since we issued two 

reports addressing CFTC’s consideration of costs and benefits in connection with 

proposed Dodd-Frank rules.10 We intend to publish further on this topic in the coming 

months. 

10. Office of General Counsel Follow-up Review. 

Follow-up to Management Letter. In our Semiannual Report for the period 

ending September 30, 2015, we reported the issuance of a Management Letter that 

addressed allegations of unprofessional conduct by a CFTC manager, and stated our 

intent to follow up during the next reporting period. Due to competing priorities, as 

well as personnel changes within the relevant CFTC unit, we were not able to begin our 

follow up. 

 

 

10 An Investigation Regarding Cost-Benefit Analyses Performed by the Commodity Futures Trading 

Commission in Connection with Rulemakings Undertaken Pursuant to the Dodd-Frank Act (April 15, 

2011); A Review of Cost-Benefit Analyses Performed by the Commodity Futures Trading Commission in 

Connection with Rulemakings Undertaken Pursuant to the Dodd-Frank Act (June 13, 2011). 
16

AUDIT REPORTS and REVIEWS 

OVER SIX MONTHS OLD 

1. Corrective Action Not Completed

 There is one audit report over six months old where corrective action had not 

been completed by the planned action date. Specifically, on November 23, 2015, we 

recommended that management update its plans to ensure logical access security 

policies are in place for the Personal Identity Verification cards as part of its rollout. 

Management’s initial date of completion was extended from March 2016 to December 

2016. As of August 2016, 245 or 32% of total CFTC employees (759) and 69 or 22% of 

contractors (305) were using PIV credentials including all employees of the Inspector 

General. 

 

2. Corrective Action Completed

 There were no instances of reports issued before the commencement of the 

reporting period for which corrective action had been completed by the end of the 

reporting period. 

3. Management Decision Not Made

 There are no instances of a report issued before the commencement of the 

reporting period for which a management decision had not been made by the end of the 

reporting period. 

 
17

INVESTIGATIONS 

The Inspector General Act of 1978, as amended, provides that the Inspector 

General may receive and investigate complaints or information from the Commission's 

employees and other sources concerning the possible existence of an activity 

constituting a violation of law, rules or regulations, or mismanagement, abuse of 

authority, or gross waste of funds, or a substantial and specific danger to the public 

health and safety. During this period, the OIG engaged in the following investigative 

activity: 

1. Investigation into a Potential Information Technology Security 

Incident 

Senior CFTC management referred this matter to our office after a brief internal 

investigation. We contracted with USPS OIG for special agents trained in computer 

forensics to assist with our investigation. We found that a CFTC IT administrator had 

exposed the CFTC to potential data loss by establishing frequent network connections to 

a personal server located at his private residence for “testing.” No data loss was 

uncovered. No data loss was uncovered. However, our investigation found that that 

senior management, lower level management, and staff in the CFTC Office of Data and 

Technology withheld information from internal investigators. In addition, various 

officials within the organization considered different retaliatory actions against a 

contractor who reported the improper network activity. The Chief Information Officer 

(CIO), to his credit, did not permit them to go forward. We referred our findings to the 

CFTC for action, and were considering our response to the implemented actions at the 

end of the reporting period. 

2. Time and Attendance Allegation 

OIG concluded a preliminary investigation after receiving anonymous allegations of 

potential time and attendance infractions. We found no evidence of the alleged 

infractions. 

3. Allegation of Improper Treatment of Dodd-Frank Commenter 

OIG began and concluded a preliminary investigation after receiving a complaint 

that CFTC improperly refused to consider a public comment submitted in response to a 

Dodd-Frank proposed rule after the deadline to submit comments. Our preliminary 

investigation found no evidence of misconduct by CFTC officials and is now concluded. 

There were no open investigations at the close of the reporting period. 

 
18

SUMMARY of MATTERS REFERRED to 

PROSECUTORIAL AUTHORITIES 

 

No matters were referred to prosecutorial authorities during the reporting period. 

CONGRESSIONAL INQUIRIES 

OIG fielded multiple requests for assistance from members of Congress and staff 

during the reporting period. Issues addressed included recent OIG and Agency 

activities. 

LEGISLATIVE, REGULATORY, and RULE REVIEWS 

1. Introduction and Summary

 As specified in Section 4(a)(2) of the Inspector General Act of 1978, OIG reviews 

the impact of existing and proposed legislation and regulations on CFTC programs and 

operations and makes recommendations regarding more effective or efficient 

alternatives or protections against fraud and abuse. OIG also reviews exchange rule 

proposals circulated to senior staff at the CFTC. 

OIG notified the responsible Divisions as to any concerns with draft and final 

documents relating to legislation, rules or investigations. Formal comments were not 

filed with the Commission during this reporting period. 

2. Rule Reviews Initiated in Previous Reporting Periods

 There were no rule reviews initiated in previous reporting periods which were 

continued into this reporting period. 

3. Rule Reviews Initiated this Reporting Period 

 No rule reviews were initiated during this reporting period. 

4. Legislative Activities 

OIG tracked legislation impacting programs and operations of the CFTC, and 

made contact with Congressional staff concerning various Agency and IG issues as 

appropriate. The IG serves on the legislation committee for the Council of Inspectors 

General on Integrity and Efficiency, which comments on proposed amendments to the 

IG Act and other legislation affecting the IG community. 
19

PEER REVIEWS 

An important function in each Agency OIG is the peer review process. The 

Council of Inspectors General on Integrity and Efficiency describes the processes for 

audits and investigative peer reviews on its website as follows:

 Government Auditing Standards require that audit organizations conducting 

audits of Federal agencies undergo peer reviews every 3 years. The IG community 

has implemented a process to meet this requirement. The purpose of the peer 

review is to determine whether the reviewed audit organization’s internal quality 

control systems are adequate and provide reasonable assurance that applicable 

auditing standards, policies and procedures are met. 

 Similarly, investigative peer reviews are conducted to ensure compliance with the 

requirements of the Quality Standards for Investigations and determine 

whether adequate internal safeguards and management procedures exist to 

ensure that law enforcement powers are properly exercised. 

 Section 989C of the Dodd-Frank Act11 implemented a requirement to include in 

each OIG semiannual report an appendix containing: 

 The results of any peer review conducted by another Office of Inspector General 

during the reporting period; or if no peer review was conducted within that 

reporting period, a statement identifying the date of the last peer review 

conducted by another Office of Inspector General; 

 A list of any outstanding recommendations from any peer review conducted by 

another Office of Inspector General that have not been fully implemented, 

including a statement describing the status of the implementation and why 

implementation is not complete; and 

 A list of any peer reviews conducted by the Inspector General of another Office of 

the Inspector General during the reporting period, including a list of any 

outstanding recommendations made from any previous peer review (including 

any peer review conducted before the reporting period) that remain outstanding 

or have not been fully implemented. 

In accordance with Section 989C of the Dodd-Frank Act, please be advised that 

the Architect of the Capitol Office of Inspector General completed a peer review of the 

CFTC OIG Office of Audit. The peer review was completed on August 16, 2016 and our 

Office of Audit received a rating of “pass”; the highest rating. 

 

11 See fn. 5. 
20

SUMMARY of EACH REPORT MADE to the 

AGENCY HEAD 

 No reports were made to the Agency head under section 6(b)(2) concerning 

information or assistance unreasonably refused or not provided (mandated under 

section 5(a)(5) of the Act). 

REVISED MANAGEMENT DECISIONS 

No management decisions were revised during the reporting period. 

INSPECTOR GENERAL DISAGREEMENT 

The Inspector General did not disagree with any management decisions on OIG 

recommendations during the reporting period. 

GAO LIAISON 

OIG is charged with providing policy direction for, and conducting, supervising, 

and coordinating audits and investigations relating to CFTC programs and operations. 

In addition, OIG is required to recommend policies for, and conduct, supervise, and 

coordinate with other Federal agencies, state and local governmental agencies, and 

nongovernmental entities, audits, investigations, and evaluations regarding the 

economy, efficiency, and effectiveness of CFTC programs and operations. 

 GAO also conducts audits of CFTC activities, and OIG plans its audits, 

inspections, evaluations, reviews, and investigations so as not to duplicate GAO's efforts. 

Moreover, OIG in its audit activities identifies the goals of each audit and the methods of 

reaching the goals so as to minimize the requirements placed on CFTC resources. 

 
21

STRATEGIC PLAN for the OFFICE of the INSPECTOR 

GENERAL 

1. Investigative Agenda 

 The Inspector General Act of 1978, as amended, provides that the Inspector 

General may receive and investigate complaints or information from the Commission's 

employees concerning the possible existence of an activity constituting a violation of 

law, rules or regulations, or mismanagement, gross waste of funds, abuse of authority or 

a substantial and specific danger to the public health and safety. 

 OIG has to date conducted only a reactive investigative program chiefly relying 

on unsolicited employee complaints as the source of investigative leads. However, 

allegations and complaints are also received from the general public and Congress. This 

reactive program has resulted in only a handful of investigations per year. This strategy 

was followed because OIG believed that an independent regulatory Agency such as the 

CFTC, without grant money or substantial contracts to award, was not likely to generate 

a substantial investigative workload. 

 To insure that employee complaints could easily reach OIG, a 24-hour hotline 

was established in February 1993 to receive complaints. The hotline phone number is 

(202)418-5510. 

 Because of the necessarily reactive nature of OIG's investigative program, no 

investigative agenda has been established. 

2. Legislative and Regulatory Review Agenda 

 Because of the importance of this activity in a financial and economic regulatory 

Agency, OIG reviews proposed and final CFTC regulations, legislation and selected 

exchange rules using six basic criteria: Whether the Agency: (1) has identified 

specifically the problem(s) to be addressed by the proposal; (2) has defined through case 

study or data analysis a clear link between the proposed solution and the identified 

problem(s); (3) has specified clearly the means to effectively and efficiently enforce the 

proposal; (4) has assessed the likely efficiency and effectiveness of alternative solutions; 

(5) can reasonably document that the proposal will yield positive net benefits over the 

long term; and (6) has met the requirements of the Regulatory Flexibility Act and the 

Paperwork Reduction Act. 

 The Regulatory Flexibility Act requires the Agency to evaluate the impact of its 

regulations on small entities. The Paperwork Reduction Act requires the Agency to 

manage effectively and efficiently its information collections so that they are the least 

burdensome necessary to achieve the stipulated objectives. 
22

 Because OIG does not initiate legislation or, generally, regulations, OIG 

legislative and regulatory review program is reactive to the legislative and regulatory 

proposals developed by others. Accordingly, no independent legislative and regulatory 

review agenda has been established. 

3. Audit, Inspection, Evaluation, and Review Agenda 

a. Introduction 

 The primary objectives of OIG’s audit, inspection, evaluation, and review agenda 

are to promote long-term efficiency and effectiveness in the administration and 

operation of the Commission and to protect against fraud and abuse. The audit, review, 

evaluation, and inspection agenda and priorities for OIG are determined based on the 

following factors: 

 Adequacy of internal control systems as indicated by vulnerability 

assessments and internal control reviews recommended by OMB Circular A123; 

 Changes in the program conditions or particular vulnerability of the 

organization, program, activity, or function to problems or deficiencies; 

 Current and potential dollar magnitude and likely benefits of a review on the 

efficiency or effectiveness of CFTC programs and operations; 

 Management priorities and improvements that may be possible; 

 Results of audits of CFTC programs and operations by other Federal agencies; 

and 

 Availability of audit resources and the potential opportunity costs to the 

agency. 

b. Annual Audits 

 The following required audits are performed on an annual basis. 

Audit of CFTC Financial Statements 

 In FY 2002, Congress passed the Accountability of Tax Dollars Act.12 The Act 

requires the CFTC, along with numerous other Federal entities, to have its financial 

statements audited annually. To this end, OIG has engaged a contractor to provide the 

audit effort required to enable the contractor to render an opinion on the Agency’s 

 

12 See fn.15. 
23

financial statements for each fiscal year in accordance with generally accepted auditing 

standards, Government Auditing Standards and OMB Bulletin 07-04. 

Audit of the CFTC Customer Protection Fund 

Section 745(g)(5)(I) of the Dodd-Frank Act13 requires the Agency to submit to 

Congress a yearly report on the Commission’s whistleblower award program that 

includes a complete set of audited financial statements, including a balance sheet, 

income statement, and cash flow analysis. To this end, OIG has engaged a contractor to 

perform the audit. 

c. Annual Reviews and Compliance Letters 

OIG will perform the following reviews and evaluations on an annual basis: 

Inspector General’s Assessment of the CFTC’s Management Challenges 

The Reports Consolidation Act of 2000 requires the Inspector General to 

summarize the most serious management and performance challenges facing the CFTC 

and to assess the Agency’s progress in addressing those challenges. 

Review of Compliance with the Federal Managers' Financial Integrity Act, FMFIA

 In support of OMB Circular A-123 (Revised), the Inspector General will evaluate, 

provide technical assistance and advise the Agency head as to whether the Agency's 

review and evaluation process was conducted in accordance with the circular's 

requirements. 

Evaluation of the CFTC Information Security Management Act, FISMA 

 The Federal Information Security Management Act requires the Inspector 

General or his designee to perform annual independent evaluations of the information 

security program and practices of the Agency. This compliance may also be performed 

through an audit. 

d. Other Audits, Inspections, Evaluations, Reviews and Projects

 Looking to the long term, OIG intends to focus the balance of its resources on the 

review of the management and operation of the agency and compliance with 

Congressional mandates. OIG plans to concentrate its efforts in reviewing activities 

relating to the most serious management challenges facing the CFTC. 

 In addition, OIG is aware of the immense regulatory undertaking required under 

the Dodd-Frank Act. OIG will seek to identify issues and to conduct inspections, 

 

13 See fn.5. 
24

reviews, investigations, and other activities relating to these management and 

regulatory challenges. Finally, OIG will stand ready to respond to issues and requests as 

they are received from Congress, the Agency, members of the public, or any other 

source. 

e. Resources Required

 OIG estimates that approximately four staff years of effort will be devoted over 

each of the next five years to the annual audit, the annual review, and the annual 

evaluation described above. However, OIG continuously updates its audit universe in 

view of the CFTC’s increased responsibilities under the Dodd-Frank Act and will 

reevaluate its staffing needs once each update is complete. OIG estimates three staff 

years of effort will be devoted over each of the next five years to the investigative, 

legislative and regulatory review functions. OIG estimates one staff year for 

management, administrative, and outreach efforts. Because OIG resources can be 

diverted at any time to an investigation, audit, inspection, evaluation, review, or other 

project that responds to current concerns or allegations, and must be completed in a 

timely fashion in order to be of assistance to the Agency or Congress, it is not possible to 

forecast with complete accuracy how resources will be utilized from year to year. 

CONTACTING the OFFICE of the INSPECTOR 

GENERAL 

OIG is located at 1155 21st Street, N.W., Washington, D.C. 20581. Regular 

business hours are between 8:30 AM and 5:00 PM, Monday through Friday, except 

Federal holidays. The telephone number is (202) 418-5110. The facsimile number is 

(202) 418-5522. The hotline number is (202)418-5510. OIG’s web page is located at 

http://www.cftc.gov/About/OfficeoftheInspectorGeneral/index.htm. 
25

TABLE 1 – Reports Issued with Questioned Costs 

April 1, 2016 – September 30, 2016 

 Dollar Value 

Thousands 

 Number Questioned Unsupported 

 

A. For which no management decision 

has been made by the commencement 

of the reporting period 0 0 0 

 

B. Which were issued during the 

reporting period 0 0 0 

 

 Subtotals (A + B) 0 0 0 

C. For which a management decision was 

made during the reporting period 0 0 0 

 

 ( I ) dollar value of 

disallowed costs 0 0 0 

 

 ( ii ) dollar value of costs not 

disallowed 0 0 0 

 

D. For which no management decision 

has been made by the end of the 

reporting period 0 0 0 

 
26

TABLE 2 – Reports Issued with Recommendations That 

Funds Be Put To Better Use 

April 1, 2016 – September 30, 2016 

 Dollar Value 

 Number Thousands 

 

A. For which no management decision 

has been made by the 

commencement of the reporting 

period 0 0 

 

B. Which were issued during the 

reporting period 0 0 

 

 Subtotals (A + B) 0 0 

C. For which a management decision 

was made during the reporting 

period 

0 0 

 

 ( i ) dollar value of 

recommendations that 

were agreed to by 

management 0 0 

 

 ( ii ) dollar value of 

recommendations that 

were not agreed to by 

management 0 0 

 

D. For which no management decision 

has been made by the end of the 

reporting period 0 0 
27

TABLE 3 - Index of IG Act Reporting Requirements 

Section 4(a)(2) Review of legislation and regulations...............................................18 

Section 5(a)(1) Significant problems, abuses and deficiencies...................................1 

Section 5(a)(2) Recommendations with respect to significant problems.............9-12 

Section 5(a)(3) Significant recommendations that have not been completed..........16 

Section 5(a)(4) Matters referred to prosecutorial authorities...................................18 

Section 5(a)(5) Summary of instances where information was refused...................20 

Section 5(a)(6) Completed audit reports................................................................9-12 

Section 5(a)(7) Significant audit reports................................................................9-12 

Section 5(a)(8) Statistical Table—Questioned Costs.................................................25 

Section 5(a)(9) Statistical Table—Funds Recommended for Better Use .................26 

Section 5(a)(10) Audit reports lacking management decision....................................16 

Section 5(a)(11) Significant revised management decisions.. ...................................20 

Section 5(a)(12) Significant management decisions where the IG disagrees............20 

Section 6(b)(2) Summary of reports to Chairman where assistance was refused....18