Office of the Inspector General

Commodity Futures Trading Commission

Semiannual Report to Congress 

October 1, 2015 – March 31, 2016
i 

EXECUTIVE SUMMARY

This semiannual report is issued by the Commodity Futures Trading 

Commission’s (CFTC’s) Office of the Inspector General (OIG) pursuant to the Inspector 

General Act of 1978, as amended.1

 It summarizes OIG’s activities and accomplishments 

for the period October 1, 2015, through March 31, 2016. During this period, OIG 

completed 3 audits, 2 reviews, 2 compliance management letters, and one follow-up 

report. OIG also began or continued work on 2 audits, 2 evaluations, 4 reviews, and two 

investigations. Highlights of OIG completed evaluations and other projects include:

Financial Reporting

• Audit of the CFTC Customer Protection Fund (the Fund) Financial Statements 

for Fiscal Year 2015 (October 30, 2015). OIG contracted with the independent 

certified public accounting firm of Williams Adley & Company-DC, LLP to 

conduct a required yearly audit of the financial statements of the Fund as of 

September 30, 2015. The audit concluded that the financial statements were 

presented, in all material respects, in conformity with U.S. generally accepted 

accounting principles, with no material weaknesses in internal control, and no 

instances in which financial management systems did not substantially comply 

with the Federal Financial Management Improvement Act of 1996.

• Financial Statements Audit FY 2015 (January 15, 2016). OIG contracted with the 

independent certified public accounting firm KPMG LLP (KPMG) to conduct this

required yearly audit. KPMG found that, “except for the Statement of Budgetary 

Resources (SBR), the financial statements were fairly presented, in all material 

respects, in conformity with US GAAP.” However, KPMG determined that the 

CFTC’s recordation of multi-year lease contracts resulted in misstatements 

(underreporting) of obligations totaling $194 million and $212 million, 

respectively, in FY2015 and FY2014, and resulted in a potential violation of the 

Anti-Deficiency Act (ADA). Additionally, KPMG communicated material 

weaknesses in internal control over financial reporting and non-compliance with 

applicable laws and regulations. KPMG issued a qualified opinion for the CFTC’s 

financial position as of September 30, 2015 and 2014, and its net costs, changes 

in net position, custodial activity, and budgetary resources for those years, and 

requested removal of eight prior financial statement audits it performed, due to 

the lease issue. OIG honored the request.

• Custodial Receivables Financial Reporting Challenges (March 23, 2016). This 

report highlights challenges regarding the presentation of Custodial Receivables 

in the CFTC’s Agency Financial Report and regarding collection efforts, and 

recommends improvements. 

 

1 P.L. 95-452, 92 Stat. 1101 (1987). 
ii

Information Security

• Information Security Audit FY 2015: Compliance with Provisions of the Federal 

Information Security Modernization Act (November 23, 2015). OIG contracted 

with the independent firm of Brown & Co. to audit FISMA compliance as of 

September 30, 2015. Brown & Co. concluded that the CFTC had sound controls 

for its information security program; however, weaknesses were noted in the area 

of security-relevant software and firmware updates. This report is not public.

• Information Security Vulnerability Assessment 2015 (February 24, 2016). OIG

contracted with the U.S. Department of Transportation, Enterprise Services 

Center (ESC), to perform a “Red Team” penetration test against the CFTC’s 

network and vulnerability assessment. ESC highlighted several successes, noted 

improvement following a 2014 assessment, and noted where improvements could 

be made. This report is not public.

Other Compliance and Follow-up 

• Inspector General’s Assessment of the Most Serious Management Challenges 

Facing the CFTC (October 26, 2015). OIG is required by statute yearly to 

summarize the “most serious” management and performance challenges facing 

the Agency. This year OIG determined the most serious management challenges 

were to: 1) Minimize information security vulnerabilities in its network; 2) 

Stimulate registrants towards enhancing their cyber security controls over vital 

client information so as to reduce the impact of any future information 

technology breach; and 3) Effectively triage oversight tasks in order to execute its 

strategic plan with limited budgetary resources.

• OIG Risk Assessment of the CFTC’s Purchase Card and Convenience Check 

Program (FY 2015) (February 19, 2016). During the relevant period, OIG 

received no allegations regarding improper use of purchase cards or convenience 

checks. OIG performed the required FY15 assessment based on the CFTC FY15 

financial statement audit (which uncovered no weaknesses in this area) as well as 

existing CFTC audits performed by contracted auditors, and assessed the risk of 

illegal, improper, or erroneous purchases as low.

• Follow-Up Report on the CFTC’s Office of the Chief Economist (January 13, 

2015). This report, which revisited issues first addressed in our 2014 review of the

Office of the Chief Economist (OCE), found that OCE has made progress on 

recommendations from our 2014 review. However, OIG also found that OCE 

restricted potentially controversial research, that OCE has had difficulty filling 

open economist positions, and that the process for approving papers for 

publication is inconsistent. We recommended that the CFTC re-establish the

Visiting Scholars Program, provide OCE economists with protected research 

time, not prohibit research topics relevant to the CFTC mission, adopt 

standardized publication-review deadlines, and prepare quarterly research 

reports to inform the Commission of ongoing research.
iii

Audits, reviews, and investigations started or continued this period includes: 

Financial Reporting 

• Audits of the CFTC’s FY 2016 Annual Financial Report and Customer Protection 

Fund. The objective of these audits is to render an opinion on the respective 

financial statements in accordance with Generally Accepted Government 

Auditing Standards.

• Review of Management’s Statement of Assurance for FY 2014 and FY 2015. OIG 

will assess the CFTC’s justification for its overall assertion over internal controls. 

• Improper Payment Review FY 2015. OIG will review the CFTC’s compliance with 

the Improper Payments Act for Fiscal Year (FY) 2015. 

CFTC Oversight

• Evaluation of Market Cybersecurity. The objective is to conduct an independent 

audit of the CFTC's performance in reviewing information technology system 

safeguards in place at entities subject to CFTC regulatory oversight.

• Evaluation of the CFTC Oversight of NFA. OIG initiated an audit to examine 

CFTC oversight activities of the National Futures Association (NFA). 

Reviews (Investigative)

• Review of Space Utilization of the Washington, D.C., Office of the CFTC. The

main objective of this review is to evaluate whether the CFTC is wasting money 

on unused space in its Washington, D.C., office. OIG issued a draft to 

management and requested a response on or before March 31, 2016. 

Management requested an extension prior to the close of the reporting period.

• Whistleblower Office Review. This review initially began in September 2014, but 

was halted in November 2014 due to competing priorities. It was reopened this 

reporting period and remains pending. The review seeks to determine the reason

for the limited number of CFTC whistleblower awards compared to the SEC, and 

to recommend best practices in this area.

Investigations

• Computer Security Investigation. OIG continued its investigation of an alleged 

incident pertaining to network security.

• Time and Attendance Investigation. OIG began an investigation after receiving 

allegations of potential time and attendance infractions. 
iv

TABLE OF CONTENTS

EXECUTIVE SUMMARY..................................................................................................... i

TABLE OF CONTENTS...................................................................................................... iv

INDEX OF IG ACT REPORTING REQUIREMENTS ....................................................... vi

MANAGEMENT AND ADMINISTRATION....................................................................... 1

1. CFTC Programs and Operations............................................................................... 1

2. OIG Responsibilities ................................................................................................. 1

3. OIG Resources .......................................................................................................... 3

COMPLETED AUDITS, INSPECTIONS, EVALUATIONS, REVIEWS and OTHER 

PROJECTS........................................................................................................................... 3

1. Audit of the CFTC Customer Protection Fund Financial 

Statements for Fiscal Year 2015 ............................................................................... 3

2. Financial Statements Audit FY 2015: Compliance with Provisions of the 

Comptroller General of the United States and Office of Management 

and Budget (OMB) Bulletin No. 15-02, Audit Requirements for 

Federal Financial Statements ................................................................................... 4

3. Custodial Receivables Financial Reporting Challenges ........................................... 5

4. Information Security Audit FY 2015: Compliance with Provisions of 

the Federal Information Security Modernization Act.............................................. 6

5. Information Security Vulnerability Assessment 2015 ............................................. 6

6. Inspector General’s Assessment of The Most Serious Management 

Challenges Facing the CFTC..................................................................................... 6

7. OIG Risk Assessment of the CFTC’s Purchase Card and Convenience Check 

Program (FY 2015).................................................................................................... 7

CURRENT AUDITS, INSPECTIONS, EVALUATIONS, REVIEWS, and OTHER 

PROJECTS........................................................................................................................... 9

1. Audits of the CFTC’s FY 2016 Agency Financial Report and 

Customer Protection Fund ....................................................................................... 9

2. Review of Statement of Management Assurance for FY 2014 and FY 2015............ 9

3. Improper Payment Review FY 2015....................................................................... 10

4. Evaluation of Market Cybersecurity....................................................................... 10

5. Evaluation of the CFTC Oversight of NFA .............................................................. 11

6. Review of Space Utilization of the Washington, D.C., Office of the CFTC ............. 11

7. Whistleblower Office Review................................................................................... 11

AUDIT REPORTS and REVIEWS..................................................................................... 12

OVER SIX MONTHS OLD ................................................................................................ 12

1. Corrective Action not Completed ........................................................................... 12

2. Corrective Action Completed.................................................................................. 12

3. Management Decision not Made............................................................................ 12
v 

INVESTIGATIONS ............................................................................................................ 12

SUMMARY OF MATTERS REFERRED TO PROSECUTORIAL AUTHORITIES .......... 13

CONGRESSIONAL INQUIRIES....................................................................................... 13

LEGISLATIVE, REGULATORY, AND RULE REVIEWS ................................................. 13

PEER REVIEWS................................................................................................................ 14

SUMMARY OF EACH REPORT MADE ........................................................................... 15

TO THE AGENCY HEAD.................................................................................................. 15

REVISED MANAGEMENT DECISIONS.......................................................................... 15

INSPECTOR GENERAL DISAGREEMENT..................................................................... 15

GAO LIASON..................................................................................................................... 15

STRATEGIC PLAN FOR THE OFFICE OF THE INSPECTOR GENERAL ..................... 16

1. Investigative Agenda............................................................................................... 16

2. Legislative and Regulatory Review Agenda ........................................................... 16

3. Audit, Inspection, Evaluation and Review Agenda................................................. 17

CONTACTING THE OFFICE OF THE INSPECTOR GENERAL..................................... 19

TABLE 1 – REPORTS ISSUED WITH QUESTIONED COSTS ........................................20

TABLE 2 – REPORTS ISSUED WITH RECOMMENDATIONS THAT 

FUNDS BE PUT TO BETTER USE ................................................................................... 21
vi 

INDEX OF IG ACT REPORTING REQUIREMENTS

Section 4(a)(2) Review of legislation and regulations...............................................13

Section 5(a)(1) Significant problems, abuses and deficiencies...................................3 

Section 5(a)(2) Recommendations with respect to significant problems...................3 

Section 5(a)(3) Significant recommendations that have not been completed..........12 

Section 5(a)(4) Matters referred to prosecutorial authorities...................................13 

Section 5(a)(5) Summary of instances where information was refused...................15 

Section 5(a)(6) Completed audit reports....................................................................3 

Section 5(a)(7) Significant audit reports....................................................................3 

Section 5(a)(8) Statistical Table—Questioned Costs................................................20

Section 5(a)(9) Statistical Table—Funds Recommended for Better Use.................21

Section 5(a)(10) Audit reports lacking management decision...................................12

Section 5(a)(11) Significant revised management decisions......................................15

Section 5(a)(12) Significant management decisions where the IG disagrees.............15 

Section 6(b)(2) Summary of reports to Chairman where assistance was refused....15 
1 

MANAGEMENT AND ADMINISTRATION

1. CFTC Programs and Operations

Congress created the Commodity Futures Trading Commission in 1974 as an 

independent agency with the mandate to regulate commodity futures and options 

markets in the United States. The Commission’s mandate was renewed and/or 

expanded in 1978, 1982, 1986, 1992, and 1995. In December 2000, the Commission was 

reauthorized by Congress and the President through Fiscal Year 2005 with the passage 

of the Commodity Futures Modernization Act of 2000 (CFMA). In May of 2008, 

Congress reauthorized the CFTC through Fiscal Year 2013. On July 21, 2010, the 

President signed into law the Dodd-Frank Act,1 which expanded the CFTC’s jurisdiction 

and authorities. 

The CFTC is responsible for fostering the economic utility of futures markets by 

encouraging their competitiveness and efficiency, ensuring their integrity, and 

protecting market participants against manipulation, abusive trade practices, and fraud. 

Through effective oversight regulation, the CFTC enables the commodity futures 

markets better to serve their vital function in the nation’s economy—providing a 

mechanism for price discovery and a means of offsetting price risks. The Dodd-Frank 

Act authorized the CFTC to regulate swap dealers and increase transparency in the 

derivatives marketplace. 

The CFTC operating divisions are: Office of the Chairman, Division of Clearing 

and Risk, Division of Swap Dealer and Intermediary Oversight, Division of 

Enforcement, Division of Market Oversight, Office of the Chief Economist, Office of the 

Executive Director, Office of General Counsel, Office of International Affairs, and Office 

of Data and Technology. Within the Office of the Chairman there are Offices of Minority 

and Women Inclusion, Legislative Affairs, and Public Affairs. In addition to its 

headquarters office in Washington, D.C., the CFTC maintains offices in Chicago, Illinois; 

Kansas City, Missouri; and New York, New York. 

 

2. OIG Responsibilities

The CFTC OIG was created in 1989 in accordance with the 1988 amendments to 

the Inspector General Act of 1978.2 OIG was established as an independent unit to:

• Promote economy, efficiency, and effectiveness in the administration of CFTC 

programs and operations, and detect and prevent fraud, waste, and abuse in such 

programs and operations;

 

1 Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), Pub. L. 111-203, 124 Stat. 

1376 (2010).

2 Inspector General Act Amendments of 1988, P.L. 100-504, 102 Stat. 2515 (1988). 
2 

• Conduct and supervise audits and, where necessary, investigations relating to the 

administration of CFTC programs and operations; 

• Review existing and proposed legislation, regulations, and exchange rules and 

make recommendations concerning their impact on the economy and efficiency 

of CFTC programs and operations or the prevention and detection of fraud and 

abuse; 

• Recommend policies for, and conduct, supervise, or coordinate other activities 

carried out or financed by such establishment for the purpose of promoting 

economy and efficiency in the administration of, or preventing and detecting 

fraud and abuse in, its programs and operations; and

• Keep the Commission and Congress fully informed about any problems or 

deficiencies in the administration of CFTC programs and operations and provide 

recommendations for correction of these problems or deficiencies.

OIG is a member of the Counsels of Inspectors General on Financial Oversight 

(CIGFO), created under the Dodd-Frank Act to examine the work of the Financial 

Stability Oversight Council (FSOC).

OIG is required to conduct, supervise, and coordinate audits of CFTC programs 

and operations in accordance with Generally Accepted Government Auditing 

Standards.3 OIG is also required to recommend changes to existing and proposed CFTC 

programs and operations to promote economy, efficiency, and effectiveness and to 

prevent and detect fraud and abuse. OIG also conducts inspections, evaluations, and 

reviews in accordance with the Quality Standards for Inspection and Evaluation4

issued by the Council of Inspectors General for Integrity and Efficiency (CIGIE). 

OIG investigations are performed in accordance with the Quality Standards for 

Investigations5 issued by the President’s Council on Integrity and Efficiency and the 

Executive Council on Integrity and Efficiency and are performed in response to 

allegations and/or evidence indicating possible violations of law, regulations, or 

applicable standards, as well as other improper conduct in connection with the 

programs and operations of the Agency. 

 OIG operates independently of the Agency and has not experienced any 

interference from the CFTC Chairman or Commissioners in connection with the conduct 

of any investigation, inspection, evaluation, review, or audit. Our investigations have 

been pursued regardless of the rank or party affiliation of the target. OIG also has 

conducted audits, inspections, evaluations, and reviews without interference where it 

 

3 The US Government Accountability Office issues the Government Auditing Standards (December 2011). The

standards are available at: http://gao.gov/assets/590/587281.pdf. 4 Available at: https://www.ignet.gov/sites/default/files/files/committees/inspect-eval/iestds12r.pdf. 5 Available at https://www.ignet.gov/sites/default/files/files/invstds2011.pdf. 
3 

has perceived the opportunity to recommend improvement to futures regulation efforts, 

again without regard to the party affiliation of any Chairman or Commissioner.6 

3. OIG Resources

At the end of the reporting period, the CFTC OIG consisted of 9.5 full time 

equivalents—the Inspector General, Deputy Inspector General/Chief Counsel, Assistant 

Inspector General for Auditing, three Attorney-Advisors (one part time), two Auditors, 

one Senior Program Analyst, and an Audit Management Analyst. 

COMPLETED AUDITS, INSPECTIONS, EVALUATIONS, 

REVIEWS and OTHER PROJECTS

During this period, OIG completed 3 audits, 2 reviews, 2 compliance 

management letters, and 1 follow-up report. 

1. Audit of the CFTC Customer Protection Fund Financial Statements for 

Fiscal Year 2015

Annually, OIG conducts an audit of the CFTC Customer Protection Fund (Fund) 

financial statements.7 The Fund’s balance as of September 30, 2015 was $268,809,520. 

OIG contracted with the independent certified public accounting firm of Williams Adley 

& Company-DC, LLP (Williams Adley) to audit the financial statements of the Fund as 

of September 30, 2015, and for the year then ended, to provide negative assurance on 

internal control and compliance with laws and regulations for financial reporting. In its 

audit of the Fund, Williams Adley found: 

• The financial statements were fairly presented, in all material respects, in 

conformity with U.S. generally accepted accounting principles. 

• There were no material weaknesses in internal control identified for the Fund. 

Williams Adley did provide a comment in the form of a management letter for 

improving the preparation of the financial statements. 

• There were no instances in which the financial management systems did not 

substantially comply with the requirements of the Federal Financial Management 

Improvement Act of 1996.

 

6 The Inspector General Act of 1978, as amended, states: “Neither the head of the establishment nor the officer next 

in rank below such head shall prevent or prohibit the Inspector General from initiating, carrying out, or completing 

any audit or investigation....” 5 U.S.C. App. 3 sec. 3(a). 7 Section 748 of the Dodd-Frank Act added section 23(g) to the Commodity Exchange Act requiring the Agency to 

submit to Congress a yearly report on the Commission’s whistleblower award program that includes a complete set 

of audited financial statements including a balance sheet, income statement, and cash flow analysis. P.L. 111-203, 

124 Stat. 1739 (2010) (codified at 7 U.S.C. § 26). 
4 

2. Financial Statements Audit FY 2015: Compliance with Provisions of 

the Comptroller General of the United States and Office of 

Management and Budget (OMB) Bulletin No. 15-02, Audit 

Requirements for Federal Financial Statements

OIG contracted with the independent certified public accounting firm KPMG LLP 

(KPMG) to conduct this required annual audit.8 KPMG communicated a qualified 

opinion for the CFTC's financial position as of September 30, 2015 and 2014, and its net 

costs, changes in net position, custodial activity, and budgetary resources for the years 

then ended. Additionally, KPMG communicated material weaknesses in internal control 

over financial reporting and non-compliance with applicable laws and regulations. 

KPMG found that, "except for the Statement of Budgetary Resources (SBR), the 

financial statements were fairly presented, in all material respects, in conformity with 

US GAAP." Specifically, KPMG found that "the CFTC's budgetary accounting for 

recording of lease obligations [in the SBR] in prior years [FY 2005 through FY 2014] 

and in the current year is not in accordance with US GAAP."

With regard to the recording of lease obligations, KPMG found:

• CFTC's FY 2015 and FY 2014 financial statements contained misstatements 

related to the understatement of obligations of approximately $194 million and 

$212 million, respectively, as of September 30, 2015 and 2014, which impacts a 

number of amounts on the CFTC's combined statements of budgetary resources 

and related notes including financial statement captions such as Total Budgetary 

Resources, Obligations Incurred, Total Unobligated Balance, End of Year, and 

Obligated Balance, End of Year. 

• The CFTC's historical practice of entering into lease contracts and recording 

related obligations resulted in a potential violation of the Anti-Deficiency Act 

(ADA). In reference to internal controls over financial reporting, KPMG 

communicated the CFTC's internal controls are not sufficiently designed to detect 

and correct material errors in its financial statements. In reference to compliance 

with laws and regulations, the CFTC's historical practice of entering into lease 

contracts and recording related obligations resulted in a potential violation of the 

Anti-Deficiency Act (ADA). KPMG noted the CFTC lacked controls to prevent 

violations and were not sufficiently designed to prevent violations in the [two] 

instances [the CFTC reported] for FY 2015.

• The CFTC agreed to recommendations made by KPMG except for one relating to 

the recording of lease obligations. After the release of the report, the General 

Accountability Office ruled that the recording of lease obligations [as described 

 

8 The Accountability of Tax Dollars Act, P.L. 107-289, 116 Stat. 2049 (2002), codified at Title 31 U.S.C. § 3515, 

requires the CFTC and other federal agencies to have its financial statements audited annually. 
5 

by KPMG] was appropriate and the CFTC acknowledged that it would correct the 

matter.

3. Custodial Receivables Financial Reporting Challenges 

On March 24, 2016, OIG highlighted challenges regarding the presentation of 

Custodial Receivables in the CFTC Agency Financial Report (AFR), and regarding 

collection efforts. OIG noted the CFTC’s Financial Management Branch (FMB) policy 

deems all civil monetary sanctions (CMS) resulting from Division of Enforcement 

(Enforcement) efforts uncollectable unless there is evidence to the contrary. FMB relies 

on Enforcement collectability assessments to provide such evidence. Enforcement does 

not document use of a consistent standard for its collectability determinations, and only 

documents the basis for collectability determinations if a CMS is determined to be 

collectable. Enforcement and FMB’s practices together do not document reliable 

collectability determinations. Also, FMB reports certain CMS penalties in the CFTC AFR 

as Custodial Receivables, net of any Allowance for Loss for uncollectable amounts 

determined through the procedures described above. In the CFTC FY 2014 and FY 2015 

financial statements, FMB reduced Custodial Receivables by an Allowance for Loss 

(amounts deemed uncollectable) exceeding $1.4 billion, each year. Because 

Enforcement and FMB’s practices together do not document reliable collectability 

determinations, they also do not support reliable Custodial Receivables Allowances for 

Loss reported in the AFR. 

In addition, FMB refers all outstanding debts initially to the U.S. Department of 

Treasury (Treasury) for collection. Enforcement or Treasury may also refer debts to the 

Department of Justice (DoJ) for more robust collection efforts. Due to the failure to 

support reliable collectability determinations, the decision to forego early referral to DoJ 

in favor of Treasury is not supported. Lastly, Federal policies call for agencies to collect 

data for performance measures in order to provide relevant information to decisionmakers. The CFTC historically has not provided comprehensive CMS data and 

performance information in its AFR. 

OIG recommended the Office of the Executive Director, in consultation with the 

Director of Enforcement, standardize procedures for collectability determinations, 

identify cases for routing first to the Department of Justice, and provide additional 

Enforcement information in the AFR. Management did not dispute that certain 

collectability determinations are not documented and agreed with the 

recommendations, but and expressed concerns about the underlying premise of the 

report, specifically that financial reporting of custodial receivables are unreliable or 

unsupported due to the lack of documentation, or that current practices may have 

diminished the collection potential of debts or collection rates. 
6 

4. Information Security Audit FY 2015: Compliance with Provisions of 

the Federal Information Security Modernization Act

OIG completed an audit of the CFTC’s compliance with the provisions of the 

Federal Information Security Modernization Act of 2014 (FISMA). OIG contracted with 

the independent firm of Brown & Co. to audit FISMA compliance as of September 30, 

2015.

Brown & Co. found the CFTC has not installed all security-relevant software 

updates promptly. They recommended improvements to the agency’s policy and 

procedures and that the CFTC implement an update tracking program. In addition to 

recommendations made by Brown & Co, OIG recommended an access security policy 

improvement. This report is not public.

5. Information Security Vulnerability Assessment 2015 

OIG completed a vulnerability assessment of the CFTC’s information technology 

(IT) network. OIG contracted with the U.S. Department of Transportation, Enterprise 

Services Center (ESC), to perform a “Red Team”9 penetration test against the CFTC’s 

network and vulnerability assessment. ESC highlighted successes in the areas of alerts, 

mitigating vulnerabilities, and U.S. Government Configuration Baselines. ESC also 

highlighted challenges for inventory and patch management, and the risk of exfiltration 

of sensitive data stored on the network. This report is not public.

Other Compliance and Follow-up 

6. Inspector General’s Assessment of The Most Serious Management 

Challenges Facing the CFTC

The Reports Consolidation Act of 2000 (RCA)10 authorizes the CFTC to provide 

financial and performance information in a meaningful and useful format for Congress, 

the President, and the public. The RCA requires the Inspectors General to summarize 

the “most serious” management and performance challenges facing each Agency and to 

assess the Agency’s progress in addressing those challenges. For Fiscal Year (FY) 2016, 

OIG reported that the CFTC’s most serious management challenges are to:

• Minimize information security vulnerabilities in its network. 

• Stimulate registrants towards enhancing their cyber security controls over vital 

client information so as to reduce the impact of any future information 

technology breach.

 

9 Penetration testers assess organization security unbeknownst to CFTC staff. For this project, few CFTC staff 

members were given prior notice of internal vulnerability scans. 10 P.L. 106-531, 114 Stat. 2537 (2000).
7 

• Effectively triage oversight tasks in order to execute its strategic plan with limited 

budgetary resources.

7. OIG Risk Assessment of the CFTC’s Purchase Card and Convenience 

Check Program (FY 2015)

The Government Charge Card Abuse Prevention Act of 201211 requires the 

Inspector General to report to the head of the agency the results of analyses or audits of 

the agency's purchase card or convenience check programs, to conduct periodic 

assessments, and to conduct analyses and audits as necessary. During the relevant 

period, OIG received no allegations regarding improper use of purchase cards or 

convenience checks. OIG performed the required FY15 assessment based on the CFTC 

FY15 financial statement audit (which uncovered no weaknesses in this area) as well as 

its review of an existing internal evaluation conducted by the CFTC. The CFTC

contracted an internal control evaluation for FY 2015 that determined that controls over 

purchase cards were generally adequate, but recommended improvements in document 

retention protocols, communication and oversight, and electronic archiving. Since 

management has corrective actions in place to address these recommendations and 

considering the independent auditor's conclusion in connection with the FY2015 

financial statement audit, OIG assessed the current risk of illegal, improper, or 

erroneous purchases as low.

8. Follow-Up Report on the Office of the Chief Economist (OCE)

This report, which revisited issues first addressed in our 2014 review of OCE, set 

out to: (l) review the efficiency and effectiveness of current publication procedures for 

OCE research papers; (2) determine if staffing issues in OCE have been resolved, 

including whether outside academics have been allowed to return to pursue research; 

and (3) determine if OCE economists have the IT infrastructure-both hardware and 

software necessary to do their jobs efficiently.

OIG found that review procedures for research papers, including clearance times, 

have improved, but recommended further improvement to the review process. In 

addition, OIG found that OCE: 

 Restricted relevant but potentially controversial research regarding the effect of 

position limits on the markets; 

 Can better inform the CFTC about ongoing research; 

 Has not fully restarted the Visiting Scholars Program; and

 Has had difficulty filling available positions. 

 

11 P.L. 112-194, 126 Stat. 1445 (2012).
8 

Between December 2012 and January 2014, OIG estimates OCE economists 

(including contractors and consultants who perform research on a visiting basis) 

decreased from 39 to 11, a decrease of 72%. The Chief Economist was allotted $200,000 

in FY2015 to hire outside academics as contractors, but chose to allocate the funds 

elsewhere. OIG recommended that the CFTC fully reestablish the Visiting Scholars 

Program. The Chief Economist informed OIG that eight additional outside academic 

economists are anticipated to be added to the OCE within the next few months. 

In addition, OIG recommended that the CFTC provide OCE economists with 

protected research time, that the CFTC adopt standardized review deadlines, that OCE 

prepare a quarterly report to inform the Commission of ongoing research, and that OCE 

not prohibit research into economic topics relevant to the CFTC mission. OIG will 

follow up on the issues raised in this report, including the anticipated expansion of 

research economists in OCE. 
9 

CURRENT AUDITS, INSPECTIONS, EVALUATIONS, 

REVIEWS, and OTHER PROJECTS

At the end of this reporting period, OIG began or continued work on 2 audits, 2 

evaluations, 4 reviews, and two investigations. 

Financial Reporting

1. Audits of the CFTC’s FY 2016 Agency Financial Report and Customer 

Protection Fund 

Allmond and Company LLC was contracted to perform the annual financial 

statement audits of the FY2016 CFTC financial statements and Customer Protection 

Fund. The objectives of the audits are to: 

• Express an opinion on whether CFTC fiscal year 2016 financial statements are 

fairly presented, in all material respects, in conformity with U.S. generally 

accepted accounting principles.

• Report on internal controls over financial reporting (including safeguarding 

assets) and compliance in place as of September 30, 2016 to provide reasonable 

assurance that misstatements, losses, or noncompliance material in relation to 

the financial statements would be prevented or detected on a timely basis.

• Report on CFTC compliance with selected provisions of laws and regulations.

2. Review of Statement of Management Assurance for FY 2014 and FY 

2015

The Federal Managers’ Financial Integrity Act of 1982 (FMFIA)12 requires 

agencies to establish internal control and financial systems that provide reasonable 

assurance of achieving the three objectives of internal control, which are:

 Effectiveness and efficiency of operations;

 Compliance with regulations and applicable laws; and

 Reliability of financial reporting.

FMFIA requires the agency head to provide an annual Statement of Assurance on 

whether the agency has met these requirements. The Office of Management and Budget 

(OMB) Circular A-123, Management’s Responsibility for Internal Control, implements 

the FMFIA and defines management’s responsibility for internal control in federal 

agencies. FMFIA requires agencies to establish internal control over their programs, 

financial reporting, and financial management systems. For FY 2014 the CFTC issued a 

 

12 P.L. 97-255, 96 STAT. 814 (1982). 
10 

statement of assurance stating, “the CFTC can provide reasonable assurance that its 

internal controls over financial reporting as of June 30, 2014 were operating effectively 

and no material weaknesses were found in the design or operation of the internal 

controls over financial reporting.”13 For FY 2015, the CFTC issued a statement of 

assurance stating: 

[T]he CFTC identified one material weakness in its internal control over

the effectiveness and efficiency of operations and compliance with 

applicable laws and regulations as of September 30, 2015 as previously 

referenced. Other than the exception noted, the internal controls were 

operating effectively and no other reportable conditions were found in the 

design or operation of the internal controls.14 

OIG will assess whether each CFTC division has documented control activities, 

monitored them, and whether annual test results support the Divisions’ and enterprisewide assertions. 

OIG last audited CFTC’s statement of assurance for FY 2012.15 

3. Improper Payment Review FY 2015

OIG will review of the CFTC’s compliance with the Improper Payments 

Information Act of 200216 and Improper Payments Elimination and Recovery Act of 

201017 for Fiscal Year (FY) 2015. Specifically, OIG will review the adequacy of the 

CFTC's methods and reporting of improper payments, if any. 

CFTC Oversight

4. Evaluation of Market Cybersecurity

OIG contracted Brown and Company LLC to evaluate the CFTC's performance in 

reviewing information technology system safeguards in place at entities subject to CFTC 

regulatory oversight.

 

13 CFTC Agency Financial Report, FY 2014, page 52 (2014). 

http://www.cftc.gov/About/CFTCReports/ssLINK/2014afr. 14 CFTC Agency Financial Report, FY 2015, page 59 (2015). 

http://www.cftc.gov/About/CFTCReports/ssLINK/2015afr. 15 Independent Auditor’s Report on Internal Control Assessment Process Used by Management in Support of its FY 

2012 Federal Managers’ Financial Integrity Act (FMFIA), Section 2, Statement of Assurance, November 16, 2012. 

http://www.cftc.gov/idc/groups/public/@aboutcftc/documents/file/fmfia2012.pdf. CFTC OIG conducted a limited 

review of CFTC’s FFMIA compliance for FY 2014. 

http://www.cftc.gov/idc/groups/public/@aboutcftc/documents/file/oig_fmfia2014.pdf

16 P.L. 107-300, 116 STAT. 2350 (2002). 17 P.L. 111-204, 124 STAT. 2224 (2010).
11 

5. Evaluation of CFTC Oversight of NFA

OIG initiated a review to examine CFTC oversight activities of the NFA. 

Specifically, OIG is assessing the nature of reviews performed by the CFTC, frequency of 

reviews, and effectiveness of CFTC management in achieving its desired outcomes from 

the NFA.

Reviews (Investigative)

6. Review of Space Utilization of the Washington, D.C., Office of the 

CFTC 

This review is the fourth in a series assessing the use of space in the CFTC’s four 

offices. The main objective is simple: To evaluate whether the CFTC is wasting money 

on unused space in its Washington, D.C., office. OIG issued a draft to management and 

requested a response on or before March 31, 2016. Management requested an extension 

prior to the close of the reporting period.

7. Whistleblower Office Review 

This review was initially begun in September 2014, halted in November 2014 due 

to competing priorities, and reopened during the present reporting period. Our goal is 

to determine the reason, if any, for the limited number of CFTC whistleblower awards 

compared to the SEC, and to recommend best practices in this area.

Peer Reviews 

There was no peer review activity during the reporting period. 
12 

AUDIT REPORTS and REVIEWS 

OVER SIX MONTHS OLD

1. Corrective Action Not Completed

There are no audit reports over six months old where corrective action had not 

been completed by the planned action date. 

2. Corrective Action Completed

There were no instances of reports issued before the commencement of the 

reporting period for which corrective action had been completed by the end of the 

reporting period. 

3. Management Decision Not Made

There are no instances of a report issued before the commencement of the 

reporting period for which a management decision had not been made by the end of the 

reporting period. 

INVESTIGATIONS

The Inspector General Act of 1978, as amended, provides that the Inspector 

General may receive and investigate complaints or information from the Commission's 

employees and other sources concerning the possible existence of an activity 

constituting a violation of law, rules or regulations, or mismanagement, abuse of 

authority, or gross waste of funds, or a substantial and specific danger to the public 

health and safety. There are currently two ongoing investigations:

• Information Security Incident Investigation

In June 2015, at the request of the CFTC’s management, OIG initiated an 

investigation of an alleged internal information security incident and response. 

This investigation was ongoing at the end of the reporting period.

• Time and Attendance Investigation

During the current reporting period, OIG initiated an investigation into alleged 

misconduct relating to time and attendance. This investigation remained ongoing 

at the close of the reporting period.
13 

SUMMARY OF MATTERS REFERRED TO

PROSECUTORIAL AUTHORITIES

 

No matters were referred to prosecutorial authorities during the reporting period. 

CONGRESSIONAL INQUIRIES

OIG fielded multiple requests for assistance from members of Congress and staff 

during the reporting period. Issues addressed included recent OIG and Agency

activities. 

LEGISLATIVE, REGULATORY, AND RULE REVIEWS

1. Introduction and Summary

As specified in Section 4(a)(2) of the Inspector General Act of 1978, OIG reviews 

the impact of existing and proposed legislation and regulations on CFTC programs and 

operations and makes recommendations regarding more effective or efficient 

alternatives or protections against fraud and abuse. OIG also reviews exchange rule 

proposals circulated to senior staff at the CFTC. 

OIG notified the responsible Divisions as to any concerns with draft and final 

documents relating to legislation, rules or investigations. Formal comments were not 

filed with the Commission during this reporting period. 

2. Rule Reviews Initiated in Previous Reporting Periods

There were no rule reviews initiated in previous reporting periods which were 

continued into this reporting period.

3. Rule Reviews Initiated this Reporting Period

No rule reviews were initiated during this reporting period.

4. Legislative Activities

OIG tracked legislation impacting programs and operations of the CFTC, and 

made contact with Congressional staff concerning various Agency and IG issues as 

appropriate. The IG serves on the legislation committee for the Council of Inspectors 

General on Integrity and Efficiency, which comments on proposed amendments to the 

IG Act and other legislation affecting the IG community. 
14 

PEER REVIEWS

An important function in each Agency OIG is the peer review process. The 

Council of Inspectors General on Integrity and Efficiency describes the processes for 

audits and investigative peer reviews on its website as follows:

• Government Auditing Standards require that audit organizations conducting 

audits of Federal agencies undergo peer reviews every 3 years. The IG community 

has implemented a process to meet this requirement. The purpose of the peer 

review is to determine whether the reviewed audit organization’s internal quality 

control systems are adequate and provide reasonable assurance that applicable 

auditing standards, policies and procedures are met.

• Similarly, investigative peer reviews are conducted to ensure compliance with the 

requirements of the Quality Standards for Investigations and determine 

whether adequate internal safeguards and management procedures exist to 

ensure that law enforcement powers are properly exercised.18

Section 989C of the Dodd-Frank Act implemented a requirement to include in 

each OIG semiannual report an appendix containing: 

• The results of any peer review conducted by another Office of Inspector General 

during the reporting period; or if no peer review was conducted within that 

reporting period, a statement identifying the date of the last peer review 

conducted by another Office of Inspector General;

• A list of any outstanding recommendations from any peer review conducted by 

another Office of Inspector General that have not been fully implemented, 

including a statement describing the status of the implementation and why 

implementation is not complete; and

• A list of any peer reviews conducted by the Inspector General of another Office of 

the Inspector General during the reporting period, including a list of any 

outstanding recommendations made from any previous peer review (including 

any peer review conducted before the reporting period) that remain outstanding 

or have not been fully implemented. 

In accordance with Section 989C of the Dodd-Frank Act, please be advised that 

no peer review activities took place during the reporting period and there are no 

outstanding recommendations from prior peer reviews that have not been implemented. 

 

18 Id. at p.19. 
15 

The most recent peer review of CFTC OIG’s audit operations was completed on 

April 22, 2014. OIG received a rating of pass with deficiencies. The most recent peer 

review of OIG’s investigative function was completed on March 27, 2013. OIG received 

a rating of pass. 

CFTC OIG neither performed nor underwent peer reviews during the reporting 

period. During this reporting period, OIG continued to monitor the government-wide 

OIG peer review schedules as communicated by the Council of the Inspectors General 

on Integrity and Efficiency. 

SUMMARY OF EACH REPORT MADE 

TO THE AGENCY HEAD

No reports were made to the Agency head under section 6(b)(2) concerning 

information or assistance unreasonably refused or not provided (mandated under 

section 5(a)(5) of the Act). 

REVISED MANAGEMENT DECISIONS

No management decisions were revised during the reporting period.

INSPECTOR GENERAL DISAGREEMENT

The Inspector General did not disagree with any management decisions on OIG

recommendations during the reporting period. 

GAO LIAISON

OIG is charged with providing policy direction for, and conducting, supervising, 

and coordinating audits and investigations relating to CFTC programs and operations. 

In addition, OIG is required to recommend policies for, and conduct, supervise, and 

coordinate with other Federal agencies, state and local governmental agencies, and 

nongovernmental entities, audits, investigations, and evaluations regarding the 

economy, efficiency, and effectiveness of CFTC programs and operations.

GAO also conducts audits of CFTC activities, and OIG plans its audits, 

inspections, evaluations, reviews, and investigations so as not to duplicate GAO's efforts. 

Moreover, OIG in its audit activities identifies the goals of each audit and the methods of 

reaching the goals so as to minimize the requirements placed on CFTC resources. 
16 

STRATEGIC PLAN FOR THE OFFICE OF THE 

INSPECTOR GENERAL

1. Investigative Agenda

The Inspector General Act of 1978, as amended, provides that the Inspector 

General may receive and investigate complaints or information from the Commission's 

employees concerning the possible existence of an activity constituting a violation of 

law, rules or regulations, or mismanagement, gross waste of funds, abuse of authority or 

a substantial and specific danger to the public health and safety.

OIG has to date conducted only a reactive investigative program chiefly relying 

on unsolicited employee complaints as the source of investigative leads. However, 

allegations and complaints are also received from the general public and Congress. This 

reactive program has resulted in only a handful of investigations per year. This strategy 

was followed because OIG believed that an independent regulatory Agency such as the 

CFTC, without grant money or substantial contracts to award, was not likely to generate 

a substantial investigative workload.

To insure that employee complaints could easily reach OIG, a 24-hour hotline 

was established in February 1993 to receive complaints. The hotline phone number is 

(202)418-5510. 

Because of the necessarily reactive nature of OIG's investigative program, no 

investigative agenda has been established.

2. Legislative and Regulatory Review Agenda

Because of the importance of this activity in a financial and economic regulatory 

Agency, OIG reviews proposed and final CFTC regulations, legislation and selected 

exchange rules using six basic criteria: Whether the Agency: (1) has identified 

specifically the problem(s) to be addressed by the proposal; (2) has defined through case 

study or data analysis a clear link between the proposed solution and the identified 

problem(s); (3) has specified clearly the means to effectively and efficiently enforce the 

proposal; (4) has assessed the likely efficiency and effectiveness of alternative solutions; 

(5) can reasonably document that the proposal will yield positive net benefits over the 

long term; and (6) has met the requirements of the Regulatory Flexibility Act and the 

Paperwork Reduction Act.

The Regulatory Flexibility Act requires the Agency to evaluate the impact of its 

regulations on small entities. The Paperwork Reduction Act requires the Agency to 

manage effectively and efficiently its information collections so that they are the least 

burdensome necessary to achieve the stipulated objectives.
17 

Because OIG does not initiate legislation or, generally, regulations, OIG

legislative and regulatory review program is reactive to the legislative and regulatory 

proposals developed by others. Accordingly, no independent legislative and regulatory 

review agenda has been established. 

3. Audit, Inspection, Evaluation, and Review Agenda

a. Introduction

The primary objectives of OIG’s audit, inspection, evaluation, and review agenda 

are to promote long-term efficiency and effectiveness in the administration and 

operation of the Commission and to protect against fraud and abuse. The audit, review, 

evaluation, and inspection agenda and priorities for OIG are determined based on the 

following factors: 

• Adequacy of internal control systems as indicated by vulnerability 

assessments and internal control reviews recommended by OMB Circular A123;

• Changes in the program conditions or particular vulnerability of the 

organization, program, activity, or function to problems or deficiencies;

• Current and potential dollar magnitude and likely benefits of a review on the 

efficiency or effectiveness of CFTC programs and operations;

• Management priorities and improvements that may be possible;

• Results of audits of CFTC programs and operations by other Federal agencies; 

and

• Availability of audit resources and the potential opportunity costs to the 

agency.
18 

b. Annual Audits 

The following required audits are performed on an annual basis.

Audit of CFTC Financial Statements

In FY 2002, Congress passed the Accountability of Tax Dollars Act.19 The Act 

requires the CFTC, along with numerous other Federal entities, to have its financial 

statements audited annually. To this end, OIG has engaged a contractor to provide the 

audit effort required to enable the contractor to render an opinion on the Agency’s 

financial statements for each fiscal year in accordance with generally accepted auditing 

standards, Government Auditing Standards and OMB Bulletin 07-04.

Audit of the CFTC Customer Protection Fund

Section 745(g)(5)(I) of the Dodd-Frank Act requires the Agency to submit to 

Congress a yearly report on the Commission’s whistleblower award program that 

includes a complete set of audited financial statements, including a balance sheet, 

income statement, and cash flow analysis. To this end, OIG has engaged a contractor to 

perform the audit.

c. Annual Reviews and Compliance Letters

OIG will perform the following reviews and evaluations on an annual basis:

Inspector General’s Assessment of the CFTC’s Management Challenges

The Reports Consolidation Act of 2000 requires the Inspector General to 

summarize the most serious management and performance challenges facing the CFTC 

and to assess the Agency’s progress in addressing those challenges.

Review of Compliance with the Federal Managers' Financial Integrity Act, FMFIA

In support of OMB Circular A-123 (Revised), the Inspector General will evaluate, 

provide technical assistance and advise the Agency head as to whether the Agency's 

review and evaluation process was conducted in accordance with the circular's 

requirements.

Evaluation of the CFTC Information Security Management Act, FISMA

 The Federal Information Security Management Act requires the Inspector 

General or his designee to perform annual independent evaluations of the information 

security program and practices of the Agency. This compliance may also be performed 

through an audit. 

 

19 See fn. 8.
19 

d. Other Audits, Inspections, Evaluations, Reviews and Projects

Looking to the long term, OIG intends to focus the balance of its resources on the 

review of the management and operation of the agency and compliance with 

Congressional mandates. OIG plans to concentrate its efforts in reviewing activities 

relating to the most serious management challenges facing the CFTC. 

In addition, OIG is aware of the immense regulatory undertaking required under 

the Dodd-Frank Act. OIG will seek to identify issues and to conduct inspections, 

reviews, investigations, and other activities relating to these management and 

regulatory challenges. Finally, OIG will stand ready to respond to issues and requests as 

they are received from Congress, the Agency, members of the public, or any other 

source. 

e. Resources Required

OIG estimates that approximately five staff years of effort will be devoted over 

each of the next five years to the annual audit, the annual review, and the annual 

evaluation described above. However, OIG continuously updates its audit universe in 

view of the CFTC’s increased responsibilities under the Dodd-Frank Act and will 

reevaluate its staffing needs once each update is complete. OIG estimates four staff 

years of effort will be devoted over each of the next five years to the investigative, 

legislative and regulatory review functions. OIG estimates one staff year for 

management, administrative, and outreach efforts. Because OIG resources can be 

diverted at any time to an investigation, audit, inspection, evaluation, review, or other 

project that responds to current concerns or allegations, and must be completed in a 

timely fashion in order to be of assistance to the Agency or Congress, it is not possible to 

forecast with complete accuracy how resources will be utilized from year to year. 

CONTACTING THE OFFICE OF THE INSPECTOR 

GENERAL

OIG is located at 1155 21st Street, N.W., Washington, D.C. 20581. Regular 

business hours are between 8:30 AM and 5:00 PM, Monday through Friday, except 

Federal holidays. The telephone number is (202) 418-5110. The facsimile number is 

(202) 418-5522. The hotline number is (202)418-5510. OIG’s web page is located at 

http://www.cftc.gov/About/OfficeoftheInspectorGeneral/index.htm. 
20 

TABLE 1 – REPORTS ISSUED WITH QUESTIONED 

COSTS

October 1, 2015 – March 31, 2016 

Dollar Value

Thousands

Number Questioned Unsupported

 

A. For which no management decision 

has been made by the commencement 

of the reporting period 0 0 0 

 

B. Which were issued during the 

reporting period 0 0 0 

Subtotals (A + B) 0 0 0 

C. For which a management decision was 

made during the reporting period 0 0 0 

 

( I ) dollar value of 

disallowed costs 0 0 0 

( ii ) dollar value of costs not 

disallowed 0 0 0 

 

D. For which no management decision

has been made by the end of the

reporting period 0 0 0 
21 

TABLE 2 – REPORTS ISSUED WITH 

RECOMMENDATIONS THAT FUNDS BE PUT TO 

BETTER USE

October 1, 2015 – March 31, 2015 

Number

Dollar Value

Thousands

 

A. For which no management decision 

has been made by the 

commencement of the reporting 

period 0 0 

B. Which were issued during the 

reporting period 0 0 

Subtotals (A + B) 0 0 

C. For which a management decision 

was made during the reporting 

period

0 0 

( i ) dollar value of 

recommendations that

were agreed to by 

management 0 0 

( ii ) dollar value of 

recommendations that

were not agreed to by

management 0 0 

D. For which no management decision

has been made by the end of the

reporting period 0 0