1

-J 

~1 

Apri l 22, 2014 

A. Roy Lavik 

Inspector General 

U.S. Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street, NW 

Washington, DC 20581 

Dear Mr. Lavik: 

We have reviewed the system of quality control for the audit organization of 

Commodity Futures Trading Commission Office of the Inspector General (CFTC OIG) in 

effect for the period Aprill, 2010, through March 31, 2013, and have issued our report 

thereon dated April 22, 2014, in which CFTC OIG received a rating of pass with 

deficiencies. That report should be read in conjunction with the comments in this letter, 

which were considered in determining our opinion. The findings below were not 

considered to be of sufficient significance to affect the opinion expressed in that report. 

Finding 1 - Policies and Procedures 

GAS 3.92 states "When performing GAGAS audits, audit organizations should have 

policies and procedures for the safe custody and retention of audit documentation for a 

time sufficient to satisfy legal, regulatory, and administrative requirements for records 

retention. Whether audit documentation is in paper, electronic, or other media, the 

integrity, accessibility, and retrievability of the underlying information could be 

compromised if the documentation is altered, added to, or deleted without the 

auditors' knowledge, or if the documentation is lost or damaged. For audit 

documentation that is retained electronically, the audit organization should establish 

effective information systems controls concerning accessing and updating the audit 

documentation." We found that CFTC's policies do not address electronic media. 

Majority of workpapers were electronic and they are working on transitioning to 

TeamMate for workpaper storage. Their policies and procedures should reflect their 

current practices. 

GAS 3.95 states "The audit organization should analyze and summarize the results of its 

monitoring process at least annually, with identification of any systemic or repetitive 

issues needing improvement, along with recommendations for corrective action. The 

audit organization should communicate to appropriate personnel any deficiencies noted 

OFFICE OF INSPECTOR GENERAL 

EXPORT-IMPORT BAJ'IK oftbe UNITED STATES 
during the monitoring process and make recommendations for appropriate remedial 

action." We found that CFTC's policies and procedures do not address annual 

summaries of the results of its monitoring process. 

GAS 3.105 "An external audit organization should make its most recent peer review 

report publicly available. For example, an audit organization may satisfy this 

requirement by posting the peer review report on a publicly available web site or to a 

publicly available file designed for public transparency of peer review results." We 

found that CFTC GIG's policy does not address the posting of the peer review report for 

the public. 

In addition, CFTC GIG's policy does no reference GAS 6.23 through 6.27 to ensure 

auditors obtain an understanding of information systems controls when information 

systems are used extensively throughout the program under audit and the fundamental 

business processes related to the audit objectives rely on information systems. 

GAS 6.50 states; "If an audit is terminated before it is completed and an audit report is 

not issued, auditors should document the results of the work to the date of termination 

and why the audit was terminated. Determining whether and how to communicate the 

reason for terminating the audit to those charged with governance, appropriate officials 

of the audited entity, the entity contracting for or requesting the audit, and other 

appropriate officials will depend on the facts and circumstances." We found that there 

is no terminology in CFTC GIG's policies and procedures regarding the preparation of 

appropriate documentation for engagements terminated prior to completion. 

We also found that CFTC GIG's policy does not address if and how attestation 

engagements or non-audit services would be performed. In addition, the overall policy 

is not up to date with Government Auditing Standards 2011 revision. 

Recommendation 

1. CFTC GIG should update their policy and procedures to addresses the findings 

identified and ensure compliance with GAS 2011 revision. 

CFTC OIG Response. The six comments provided by Ex-lm GIG, all address CFTC-GIG 

audit policies and procedures manual. Four of the issues raised were not presented 

to us before issuance of the draft peer review report. We agree with one of the four 

issues along with the two other issues raised. Changes have been made to our 

policies and procedures manual to address these three issues. 

Three of the comments in the letter incorrectly state that the policies and 

procedures manual we provided was missing certain guidance. During the exit 

conference Ex-1m GIG staff was advised where the guidance was located in the 

policies and procedures manual we had provided them. However the letter was not 

2 
-1 

~ 

corrected. Specifically: 1) guidance on summarizing CFTC-OIG monitoring process is 

located at sections 402.00 and 900.06; 2) guidance on auditors' reliance on 

electronic information systems is located at section 400.06; and 3) guidance on 

documenting the termination of a GAGAS audit is located at 400.07. 

Evaluation of CFTC OIG's Response. A draft report and the comment letter were 

provided on two separate occasions. The first preliminary copy was provided to 

CFTC OIG on February 6, 2014 and on March 5, 2014, the official draft was issued to 

CFTc-OIG for comments. The commenrlefter aldnorchange in either velsion 

provided. In addition, we concur that their policy sections 402.00 and 900.06 

mentions CFTC's OIG monitoring process but Government Auditing Standards also 

requires an annual analysis and summary of those results. The annual analysis and 

summary should be included. We also concur that Section 400.06 provides guidance 

on auditor's reliance on electronic information systems; however, we suggest that 

CFTC OIG's policy reference GAS 6.23 through 6.27. Finally, the original reference 

that CFTC provided Ex-lm OIG to their policy did not reference termination of GAGAS 

audits. During our review we identified this issue to CFTC OIG to include providing a 

copy of the comment letter on two separate occasions. The reference to 400.07 

does mention termination and we consider this issue resolved. 

If CFTC OIG takes steps to update their policy and addresses the findings it will 

resolve this recommendation. 

Osvald~~

~~ ---

Inspector General 

3