U.S. COMMODITY FUTURES TRADING COMMISSION

Office of the Inspector General

Office of Audits

Audit of CFTC’s Enterprise Architecture Program 

Report Number: 17-AU-03
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

3

TO: J. Christopher Giancarlo, Chairman

Brian D. Quintenz, Commissioner 

Rostin Behnam, Commissioner 

FROM: Miguel A. Castillo, CPA, CRMA 

Assistant Inspector General, Auditing

DATE: December 18, 2017

SUBJECT: Audit of CFTC’s Enterprise Architecture 

Program 

INTRODUCTION

Since Fiscal Year 2011 (FY2011), Congress has annually 

earmarked $35 million to $50 million of CFTC’s total 

appropriation for information technology (IT) spending (IT 

earmark). CFTC IT earmarks total $277 million.1 

Appropriations language for the IT earmark has varied. 

Congress has appropriated the IT earmark “for the highest 

priority information technology activities” (FY2011),2 “for 

information technology investments” (FY2012, FY2013),3

and, most recently, “for the purchase of information 

technology” (FY2014-FY2017).4 

Throughout this period, appropriations explanatory 

language indicates that Congress intended the IT earmarks 

to be used for investments in information technology 

necessary to monitor markets under jurisdiction of the 

CFTC.5

 

1 However, for FY2012, Congress authorized the transfer of $10 million from the IT 

earmark to pay CFTC salaries and benefits. P.L. 112-74, § 744 (Dec. 23, 2011). 2 P.L. 112-10 (Apr. 15, 2011) 3 P.L. 112-55 (Nov. 18, 2011); P.L. 113-6, § 1313 (Mar. 26, 2013) (continuing resolution). 4 P.L. 113-76 (Jan. 17, 2014); P.L. 113-235 (Dec. 16, 2014); P.L. 114-113 (Dec. 18, 2015);

P.L. 115-31 (May 5, 2017). 5 See Appendix E for a discussion of legislative intent.

 

TABLE OF CONTENTS

INTRODUCTION.......................3

CONCLUSIONS........................3

RECOMMENDATIONS..............4

SUMMARY MANAGEMENT 

COMMENTS............................6

EVALUATION OF MANAGEMENT 

COMMENTS............................6

APPENDIX A............................7

EA MATURITY 

ASSSESSMENT....................7

APPENDIX B..........................14

POLICIES AND PROCEDURES 

ARE LACKING....................14

APPENDIX C..........................16

IT INVESTMENT EARMARKS 

SPENT ON 

OPERATIONS....................16

APPENDIX D.........................19

OBJECTIVE, SCOPE AND 

METHODOLOGY...............19

APPENDIX E.........................20

OIG LEGAL ANALYSIS OF 

CFTC IT EARMARKS.........20

APPENDIX F.........................27

ENTERPRISE ARCHITECTURE

REFERENCES..................27

APPENDIX G........................28

MANAGEMENT 

COMMENTS.....................28

APPENDIX H........................33

CFTC OFFICE OF DATA 

TECHNOLOGY (ODT)........33
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

2

Audit of CFTC’s Enterprise Architecture Program

In addition, discrete former CFTC Commissioners, including one former 

Commissioner who had been heavily involved with CFTC information 

technology issues both while working in Congress and while serving as a CFTC 

Commissioner, expressed strong views in line with the legislative history.6 

In order to, among other things, evaluate how CFTC spent and planned to 

invest the FY 2017 IT earmark, the Office of Inspector General (OIG) initiated 

an audit of the U.S. Commodity Futures Trading Commission (CFTC) 

Enterprise Architecture (EA) program required under the Clinger-Cohen Act 

(CCA).7 EA is the description and documentation of the current and desired 

relationships among program, business, and management processes, and IT 

processes. It describes the “as is” (current state) architecture and the "to be” 

(future state) architecture, and includes the rules, standards, and systems life 

cycle information to optimize and maintain the environment which the agency 

creates and maintains by managing its IT portfolio. It is approved by an EA 

steering committee, an investment review board, or the Chairman. We 

anticipated the CFTC EA Program would explain how and why the IT earmark 

was spent. 

Our audit objective(s) were to assess and evaluate EA program practices. We 

examined EA program practices in detail to determine whether CFTC: (1) 

established an adequate baseline and a target enterprise architecture; (2) 

implemented effective management practices, policies, and processes for the 

development, implementation, maintenance, and oversight of the EA program; 

and, given annual Congressional IT earmarks, (3) reported IT investment 

results from this program. 

 

6 Testimony of CFTC Commissioner Scott D. O’Malia Before the US House Committee on Appropriations, Subcommittee 

on Agriculture, Rural Development, Food and Drug Administration, and Related Agencies (April 12, 2013)(“I appreciate 

Congress setting aside specific funding levels since FY 2011 to encourage the Commission to focus on technology as a 

key component of its surveillance and oversight program, but we have a very long way to go to develop a credible, 

detailed business plan that focuses on how both staff and technology resources are integrated to meet mission 

objectives.” Commissioner O’Malia also asserted that most of the IT earmark for FY2012 through FY2014 was not 

spent on “new cutting-edge technology”); Keynote Address by Commissioner Scott D. O’Malia at the Federal Reserve 

Bank of New York (July 15, 2014)(“I am pleased that the House Appropriations Subcommittee on Agriculture provided 

the CFTC with $52.6 million for technology investments for Fiscal Year (FY) 2015. Such an investment would allow the 

CFTC to begin making the necessary investments to keep up with technological innovation in today’s electronic and 

highly automated markets”). We note two former Commissioners dissented to CFTC’s reported FY2011 technology 

spending; see, CFTC, Fiscal Year 2011 Annual Performance Report, Statement of Dissent by Commissioner Jill E. 

Sommers and Commissioner Scott D. O’Malia (Feb. 3, 2012)(“Some of the most notable goals which have been missed 

are in the areas of technology.... Due to the massive growth in the speed and volume of trades the Commission must 

embrace technology or risk being unable to effectively monitor futures, options and swaps markets”).

7 Clinger-Cohen Act (a.k.a. the Information Technology Management Reform Act of 1996), P.L. 104-106, 110 STAT. 679 

(1996).
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

3

Audit of CFTC’s Enterprise Architecture Program

CONCLUSIONS

CFTC does not have a formal EA program. In 2003, management hired an 

enterprise architect for program development and reassigned him to another 

ODT branch in 2015. To date, CFTC has not reestablished an EA leadership 

position to fulfill program responsibilities and agency compliance. 

The lack of an organizational commitment to an EA program is long-standing,8

and limits CFTC’s ability to ensure that IT initiatives are properly planned, 

selected, prioritized, justified, and cost-beneficial, and in compliance with 

applicable statutes and directives. These challenges may be especially 

significant given ODT currently operates with 279 staff and contractors.9 Refer 

to APPENDIX A for EA background and our assessment of CFTC’s enterprise 

architecture maturity. 

While CFTC does not have a formal EA program, its Office of Data and 

Technology (ODT) uses basic standards of governance such as project 

investment review and lifecycle management that are steps in the right 

direction. ODT’s efforts, however, do not fulfill the requirements of an EA 

program because CFTC has not formalized an EA program and technology 

capital planning,10 policies, and procedures at appropriate levels that permit 

description of current and future state architectures and associated funding. 

Thus, this limits the reach of CFTC to effectively govern an EA program; CFTC 

will not be able to readily measure how IT spending benefits its mission, rightsize cyber-security investment costs, or quantify program benefits achieved. 

Refer to APPENDIX B for further details. 

Lastly, given the lack of an EA program with investments directed toward a 

target architecture, CFTC may not applicably report that it has complied with 

the CCA, nor that it spent the $50 million FY2017 IT earmark consistent with 

Congress’ apparent intent. While the FY2017 IT earmark was “for the purpose 

of information technology,”11 we note the relevant legislative history: 

The Committee highlights the crucial need for the CFTC to make 

mission-critical investments in technology to sort through the vast 

 

8See, Opening Statement of Commissioner Scott D. O’Malia, 12th Meeting of the Technology Advisory Committee, 

Washington, DC (June 3, 2014)(“So far, the Commission has had little luck in developing its own strategic plan to

implement a mission-specific technology roadmap that takes into account this trading reality [‘evolving and complex 

market structures related to automated trading’]”). 

9 Refer to APPENDIX H for a recent ODT organizational chart showing 87 CFTC staff and 212 contractors. 10 OMB A-11 Section 31.8, Management Improvement Initiatives and Policies, Capital Planning and Investment Control. 11 P.L. 115-31 (May 5, 2017). 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

4

Audit of CFTC’s Enterprise Architecture Program

volume of data and information generated daily by markets. The CFTC’s 

responsibilities to conduct effective oversight and analysis of the swaps 

and futures markets requires greater attention to and investments in its 

information technology systems.12 

The legislative history suggested the FY2017 IT earmark was for IT investments 

and did not suggest its expenditure for daily IT operations. We analyzed actual 

spending of the FY2017 earmark and learned that 61% percent of CFTC’s FY 

2017 IT earmark supported daily IT operations. Refer to APPENDIX C for 

further details. 

ODT management conveyed that prior Commission leadership prioritized the 

hiring and assignment of staff to focus on writing and implementing DoddFrank13 rules. Given limited resources, ODT management focused on IT 

security at the expense of maturing an EA program. 

RECOMMENDATIONS 

To establish accountability for Congressional appropriations earmarked for IT 

spending, we recommend the Commission comply with CCA as follows: 

1. Formalize leadership for an EA program with responsibilities for a futurestate roadmap that aligns with mission operations; 

2. Establish a review board made up of the Chairman, Commissioners, and 

Division Directors, to prioritize and approve IT investments; and 

3. Establish IT investment performance measures to monitor investment 

status, and periodically report progress to Congress. 

We prepared this audit in accordance with Generally Accepted Government 

Auditing Standards14 issued by the Government Accountability Office (GAO). A 

detailed description of the objective, scope and methodology can be found in 

 

12 U.S. Senate Committee on Appropriations, Subcommittee on Financial Services and General Government, S. Rpt. 

114-280, page 74-75, 114th Cong. 2d Sess (June 16, 2016). Similar IT earmark legislative history exists for FY2011 

through FY2016, as detailed in Appendix E. 13 Dodd-Frank Wall Street Reform and Consumer Protection Act, P.L. 111-203 (July 21, 2010). We note that Congress 

established the requirement to establish an EA Program in 1996. 

14 Government Accountability Office (GAO) Generally Accepted Government Auditing Standards (GAGAS) Revision 

2011.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

5

Audit of CFTC’s Enterprise Architecture Program

APPENDIX D. We will publish this report on the Office of the Inspector 

General’s web page and the report will be summarized in our March 2018 

Semiannual Report to Congress. If you have any questions, please contact me 

at (202) 418-5084 or Branco Garcia, lead auditor, at (202) 418-5013. 

CC: 

Michael Gill, Chief of Staff 

Kevin S. Webb, Chief of Staff 

John Dunfee, Acting Special Counsel 

Anthony C. Thompson, Executive Director 

John L. Rogers, Chief Information Officer 

Daniel J. Davis, General Counsel 

Mary Jean Buhler, Chief Financial Officer 

Naeem Musa, Deputy Director 

Melissa Jurgens, Acting Chief Privacy Officer 

Joan Fina, Counsel 

A. Roy Lavik, Inspector General 

Judith A. Ringle, Deputy Inspector General 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

6

Audit of CFTC’s Enterprise Architecture Program

SUMMARY MANAGEMENT COMMENTS 

In principal, management concurred with the general findings and 

recommendations recognizing the value of Enterprise Architecture (EA) as 

enacted in the Clinger-Cohen Act and the E-Government Act of 2002. While 

management concurs that it does not have a formal EA program, it asserts it 

has implemented key EA functions and governance to ensure alignment of 

Information Technology (IT) investments with mission objectives. Thus, these 

efforts have enabled the Commission to function in compliance with the spirit 

of the Clinger-Cohen Act and consistent with the goals of a formal EA program. 

During the fieldwork for our audit, and perhaps in anticipation of our 

recommendations, management established an IT Investment Review Board 

(ITIRB) comprised of Division Directors, leadership from supporting offices, and 

senior leaders. The ITIRB will provide executive decision-making on, and 

oversight of, CFTC IT investment planning and management and to ensure 

compliance with the statutory and regulatory direction from Congress, the 

Office of Management and Budget (OMB) and other applicable Federal oversight 

entities. The ITIRB will prioritize and approve IT investments, which is a core 

part of a formal EA program. The first ITIRB meeting is planned for January 

2018. 

Management also plans to submit an unfunded request to staff an Enterprise 

Architect position that, if funded, will lead the formal documentation of the 

future state roadmap that aligns with mission operations. Lastly, management 

conveyed that it is actively developing the FY19-FY23 IT Strategic Plan, and will 

define performance measures necessary to achieve strategic objectives. 

Management comments in its entirety are presented in Appendix G. 

EVALUATION OF MANAGEMENT COMMENTS 

Management’s actions and plans are responsive to the recommendations made 

in the report. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

7

Audit of CFTC’s Enterprise Architecture Program

APPENDIX A 

EA MATURITY ASSSESSMENT

BACKGROUND: THE CLINGER-COHEN ACT, ENTERPRISE ARCHITECTURE

REQUIREMENTS, AND EVALUATION CRITERIA 

In 1996, Congress enacted the Clinger-Cohen Act (CCA),15 and later passed the 

E-Government Act of 2002,16 which requires executive agencies17 to develop, 

maintain, and facilitate the implementation of an effective EA program. By 

doing so, agencies can ensure that they efficiently spend limited information 

technology (IT) resources on systems that best support the executive agency’s 

mission and strategic goals.18 

In September 1999, the Federal Chief Information Officers (CIO) Council19

published the Federal Enterprise Architecture Framework (FEAF)20 to provide 

agencies with a common construct for their architectures, and to facilitate the 

coordination of system investments across agencies. In May 2012, the Office of 

Management and Budget (OMB) Common Approach to Federal Enterprise 

Architecture Framework (Common Approach)21 elaborated that the ClingerCohen Act and OMB policies require executive agency heads to develop and 

maintain an agency-wide enterprise architecture that integrates strategic 

drivers, business requirements, and technology solutions. The Common 

Approach promotes increased levels of mission effectiveness by standardizing 

the development and use of architectures within and between agencies. This 

includes principles for using EA to help agencies eliminate waste and 

duplication, increase shared services, close performance gaps, and promote 

engagement among government, industry, and citizens. 

 

15 Clinger-Cohen Act (a.k.a. the Information Technology Management Reform Act of 1996), P.L. 104-106, 110 STAT. 

679 (1996).

16 E-Government Act of 2002, P.L. 107-347, 116 STAT. 2899 (2002). 17 Per CCA, “executive agency” is defined as follows: The term ‘‘executive agency’’ has the meaning given that term in 

section 4(1) of the Office of Federal Procurement Policy Act (41 U.S.C. 403(1)). We interpret CCA’s definition to include 

CFTC. 

18 The Government Performance and Results Modernization Act of 2010, P.L. 111-352, 124 STAT. 3866 (2011), 

addresses agency strategic plans.

19 The Federal CIO Council is the principal interagency forum on the improvement of agency practices related to use of 

Federal information resources.

20 A framework is a high-level process that is not prescriptive, but that provides a method for the implementation of EA 

in a uniform way. FEAF includes requirements for change drivers—business needs, such as new missions or 

assumption of large plans, and technical needs, such as unsupported platforms or obsolescence. FEAF was most 

recently updated in 2013. 

21 US Executive Office of the President, Common Approach to Federal Enterprise Architecture, page 3, n.1 (and 

accompanying text) (May 2012).
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

8

Audit of CFTC’s Enterprise Architecture Program

OMB made clear that an overall EA program also should support all program 

offices in meeting strategic objectives by enhancing flexibility and 

interoperability across information systems, reducing redundancies, and 

improving access to accurate, timely, and consistent information. An EA 

program establishes a baseline and target architecture, and transition plans for 

program management and investment decisions. Sections 53 and 300 of OMB 

Circular A-11, Preparation, Submission, and Execution of the Budget,22 and 

Circular A-130, Management of Federal Information Resources,23 establish 

policy for the management of Federal information resources, and require 

agencies to align their IT investments to their EA. 

CFTC LACKS AN EA PROGRAM

Using GAO’s evaluation criteria,24 we concluded that CFTC lacks an EA 

program. As depicted in Table 1, there are some ad hoc EA activities, albeit 

unstructured and lacking institutional leadership. This result corresponds to 

Maturity Stage 0 - Creating EA Awareness, given that CFTC does not 

demonstrate an awareness of the management discipline needed to 

successfully develop, maintain, and use an EA. 

 

22 OMB Circular A-11, Preparation, Submission and Execution of the Budget. 23 OMB Circular A-130, Management of Federal Information Resources. 24 Government Accountability Office (GAO) – Organizational Transformation, A Framework for Assessing and Improving 

Enterprise Architecture Management (Version 2.0) (GAO 10-846G).
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

9

Audit of CFTC’s Enterprise Architecture Program

Table 1: Assessment Results of CFTC’s Enterprise Architecture (EA) 

Efforts against GAO’s EA Management Maturity Framework.25

GAO 

Maturity 

Stage

GAO Core 

Element

OMB Capability 

Area26

Description Assessment 

Satisfied? 

(Yes/No)27

0 Creating EA Awareness

While Stage “0” organizations may have initiated some EA activity; their efforts are largely ad hoc 

and unstructured and lack the institutional leadership necessary for successful EA development, 

maintenance, and use as defined in Stage 1. Therefore, Stage 0 has no associated core elements.

1 Establishing EA Institutional Commitment and Direction

1 Use Written and approved organization policy 

exists for EA development, maintenance, and 

use.

No

2 Use Executive committee representing the 

enterprise exists and is responsible and 

accountable for EA.

No

3 Use Executive committee is taking proactive 

steps to address EA cultural barriers.

No

4 Use Executive committee members are trained in 

EA principles and concepts.

No

5 Use Chief architect exists.

OIG Evaluation: Architect on staff not 

assigned program responsibility.

No

6 Use EA purpose is clearly stated. No

7 Use EA framework(s) is adopted. No

8 Results EA performance and accountability 

framework is established.

No

2 Creating the Management Foundation for EA Development and Use

9 Use EA budgetary needs are justified and 

funded.

No

10 Use EA program office exists. No

11 Use Key program office leadership positions are 

filled.

No

12 Use Program office human capital plans exist. No

 

25 Id. 26 OMB Capability Area column represents the three capability areas (Completion, Use, Results) described in OMB’s EA 

Assessment Framework (2009). Therefore, this attribute demonstrates how GAO and OMB’s EA frameworks are 

fundamentally aligned and substantially consistent. 

OMB’s definition of each of the capability areas are summarized as follows: 

Completion: The extent to which an agency has developed an integrated, organization wide architecture, in terms of 

business, performance, data, services, technology, and security, as well as a comprehensive enterprise transition plan. 

Use: The extent to which the agency has established key management practices, processes, and policies needed for 

developing, maintaining, and overseeing its architecture, and for demonstrating both the importance of architecture 

awareness and the value of employing architecture practices; it also assesses the extent of the agency’s use of its 

architecture to inform strategic planning, program performance improvement planning, information resources 

management, IT management, and capital planning and investment control processes. 

Results: The extent to which the agency is measuring the effectiveness and value of its architecture activities by 

assigning performance measurements to its architecture and related processes, and reporting on actual results to 

demonstrate architecture success. 

27 To determine the assessment results (Yes/No), we compared CFTC’s existing elements of EA (see column title 

“Description”) against GAO’s core elements and OMB capability area(s).
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

10

Audit of CFTC’s Enterprise Architecture Program

GAO 

Maturity 

Stage

GAO Core 

Element

OMB Capability 

Area26

Description Assessment 

Satisfied? 

(Yes/No)27

13 Use EA development and maintenance 

methodology exists.

No

14 Use Automated EA tools exist. No

15 Use EA program management plan exists and 

reflects relationships with other 

management disciplines.

No

16 Use Work breakdown structure and schedule to 

develop EA exist.

No

17 Completion EA segments, federation members, and/or 

extended members have been identified and 

prioritized.

No

18 Results Program office readiness is measured and 

reported.

No

3 Developing Initial EA Versions

19 Use Organization business owner and CIO 

representatives are actively engaged in 

architecture development.

ODT Note: The most developed parts are the 

physical infrastructure architecture and data 

architecture. There are several architectural 

deliverables that have either been developed 

or being developed such as target state 

network diagrams, database configurations, 

data dictionaries and guidebooks as well as 

current state data models.

OIG Evaluation: Approved EA plan with 

mission input not designed.

No

20 Use EA human capital plans are being 

implemented.

No

21 Use Program office contractor support needs are 

being met.

No

22 Use Program office staff is trained in EA 

framework, methodology, and tools.

No

23 Use Methodologies and tools exist to determine 

investment compliance with corporate and 

subordinate architectures.

ODT Note: Using the practically developed 

architecture, all investments and spends are 

analyzed on an ongoing basis by the IT 

Leadership to ensure that the investments 

are aligned with the long-term strategic goals 

as outlined the Agency’s strategic plan as 

well as the IT strategic plan. 

OIG Evaluation: Our review of the CFTC 

Information Technology Strategic Plan 2014-

2018, December 2014, acknowledges that 

projects are listed by goal. The plan does not 

identify Capital Planning Investment 

Controls (CPIC) or Key Performance 

Measures (KPI). CPIC ensures requirements 

are driven by mission rather than IT 

Leadership and KPIs provide for technology 

investment accountability.

No
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

11

Audit of CFTC’s Enterprise Architecture Program

GAO 

Maturity 

Stage

GAO Core 

Element

OMB Capability 

Area26

Description Assessment 

Satisfied? 

(Yes/No)27

24 Use Methodologies and tools exist to determine 

subordinate architecture alignment with the 

corporate EA.

No

25 Use EA-related risks are proactively identified, 

reported, and mitigated.

No

26 Completion Initial versions of corporate “as-is” and “tobe” EA and sequencing plan are being 

developed.

ODT Note: The CFTC has a large cache of 

“to-be” documents, including data models, 

network and database diagrams and several 

as-is artifacts including database diagrams 

and data models.

OIG Evaluation: An EA program would 

organize the above artifacts, if relevant to 

meeting an approved mission goal. 

No

27 Completion Initial version of corporate EA describing the 

enterprise in terms of performance, 

business, data, services, technology, and 

security is being developed.

No

28 Completion One or more segment and/or federation 

member architectures are being developed.

ODT Note: CFTC is too small to develop 

segment architectures. All mission areas are 

very intertwined in terms of business 

process and data.

OIG Evaluation: An EA program with CPIC 

would allow mission areas to drive 

requirements suitable to their needs.

No

29 Completion Architecture products are being developed 

according to the EA content framework.

No

30 Completion Architecture products are being developed 

according to a defined EA methodology.

No

31 Completion Architecture products are being developed 

using EA tools.

ODT Note: CFTC has not designated any 

tools specifically as EA tools given that 

appropriate management oversight is 

exercised to ensure that the right tools are 

used for the right job.

OIG Evaluation: No comment.

No

32 Results Architecture development progress is 

measured and reported.

No

4 Completing and Using an Initial EA Version for Targeted Results

33 Use Executive committee has approved the initial 

version of corporate EA.

No

34 Use Key stakeholders have approved the current 

version of subordinate architectures.

No

35 Use EA is integral to the execution of other 

institutional management disciplines.

No
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

12

Audit of CFTC’s Enterprise Architecture Program

GAO 

Maturity 

Stage

GAO Core 

Element

OMB Capability 

Area26

Description Assessment 

Satisfied? 

(Yes/No)27

36 Use Program office human capital needs are met. No

37 Completion Initial versions of corporate “as-is” (current 

state) and “to-be” (future state) EA and 

sequencing plan exist.

No

38 Completion Initial version of corporate EA captures 

performance, business, data, services, 

technology, and security views.

No

39 Completion One or more segment and/or federation 

member architectures exist and are being 

implemented.

No

40 Results EA product quality is measured and 

reported.

No

41 Results EA results and outcomes are measured and 

reported.

No

42 Results Investment compliance with corporate and 

subordinate architectures is measured and 

reported.

No

43 Results Subordinate architecture alignment with the 

corporate EA is measured and reported.

No

5 Expanding and Evolving the EA and Its Use for Institutional Transformation

44 Use Organization head has approved current 

version of the corporate EA.

No

45 Use Organization component heads or segment 

owners have approved current version of 

their respective subordinate architectures.

No

46 Use Integrated repository tools and common EA 

framework and methodology are used across 

the enterprise.

No

47 Use Corporate and subordinate architecture 

program offices operate as a single virtual 

office that shares resources enterprise wide.

No

48 Completion Corporate EA and sequencing plan are 

enterprise wide in scope.

No

49 Completion Corporate EA and sequencing plan are 

aligned with subordinate architectures.

No

50 Completion All segment and/or federated architectures 

exist and are horizontally and vertically 

integrated

No

51 Completion Corporate and subordinate architectures are 

extended to align with external partner 

architectures.

No

52 Results EA products and management processes are 

subject to independent assessment.

No

6 Continuously Improving the EA and Its Use to Achieve Corporate Optimization

53 Use EA is used by executive leadership to inform 

organization strategic planning and policy 

formulation.

No

54 Use EA human capital capabilities are 

continuously improved.

No

55 Use EA methodologies and tools are continuously 

improved.

No

56 Use EA management processes are continuously 

improved and reflect the results of external 

assessments.

No
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

13

Audit of CFTC’s Enterprise Architecture Program

GAO 

Maturity 

Stage

GAO Core 

Element

OMB Capability 

Area26

Description Assessment 

Satisfied? 

(Yes/No)27

57 Completion EA products are continuously improved and 

updated.

No

58 Results EA quality and results measurement 

methods are continuously improved.

No

59 Results EA continuous improvement efforts reflect 

the results of external assessments.

No

EA PROGRAMS NEED TO CONSIDER SECURITY REQUIREMENTS

The National Institute Standards and Technology (NIST) Special Publication (SP) 

800-53A Revision 4, Project Management Control Family (PM-7 Enterprise 

Architecture)28 requires agencies to integrate IT security into their capital 

planning and EA processes. Furthermore, GAO29 and OMB30 recognize security 

as one of the core elements that measures the effectiveness of EA and IT 

investment programs. However, management does not have a methodology for 

estimating, tracking, and reporting return on IT security investments to 

determine which IT security controls to fund. The lack of IT investment policies 

and practices, including an agency-wide methodology for security funding 

estimations, makes it more challenging to support resources for its mission 

and business needs. 

 

28 NIST, Security and Privacy Controls for Federal Information Systems and Organizations, SP 800-53 (Rev. 4), PM-7 

Enterprise Architecture (Gaithersburg, Md., Dec. 2014). 29 OMB Circular A-11, Preparation, Submission and Execution of the Budget. 30 OMB Circular A-11, Preparation, Submission and Execution of the Budget; OMB Circular A-130, Management of 

Federal Information Resources.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

14

Audit of CFTC’s Enterprise Architecture Program

APPENDIX B

POLICIES AND PROCEDURES ARE LACKING

As illustrated in Table 1, CFTC does not have formal policies and procedures 

for an EA program, and consequently will not be able to create and measure 

the status and progress of an EA. OMB and GAO have noted that, as with any 

investment, EA should produce benefits, or returns on investment that can be 

measured against costs.31 OMB’s guidance states that each executive agency 

should measure its EA activities against quality standards—metrics defined in 

an EA development and maintenance methodology that assess an EA 

program’s ability to assist management’s decisions on IT changes and 

investments.32 

OMB further states that, in order for management to benefit from EA, each 

agency should regularly report EA quality measurements to appropriate agency 

officials.33 However, CFTC does not have an agency-wide program for EA 

activity monitoring, and does not require components to report EA performance 

measures, plans for improvement of EA programs, or EA’s cost savings. Also, 

management has not formalized capital planning34 policies and procedures 

that expand vision setting and investment decision making to mission 

operations. In January 2017 hired a program analyst with enterprise 

architecture experience, but to date there is no EA program in place. 

Federal agencies such as the U.S. Environmental Protection Agency and the 

U.S. Social Security Administration have made transparent their policy and 

procedures for IT investment controls.35 They segregate investment by size and 

portfolios. Also smaller agencies such as the U.S. Federal Election Commission 

recognizes that when it makes capital investment, especially on Information 

Technology investments, a net return on investment is expected. 

We do recognize that internally ODT performs the following activities: 

• Project Investment Reviews – Prior to investing in any new IT initiative or 

prior to expanding an existing IT initiative, an investment review is 

performed by the IT Leadership Team, which includes the CIO and 

 

31 Common Approach to Federal Enterprise Architecture, page 3, n.1 (and accompanying text) (May 2012). 32 OMB Circular A-11, Preparation, Submission and Execution of the Budget. 33 OMB Circular A-11, Preparation, Submission and Execution of the Budget. 34 OMB A-11 Section 31.8, Management Improvement Initiatives and Policies, Capital Planning and Investment Control. 35 Environmental Protection Agency, Information Policy (Dec. 2015)(EPA CPIC), Social Security Administration, Capital 

Planning and Investment Control (Jan. 2016)(SSA CPIC), Federal Election Commission, Performance and Accountability 

Report (FY2006)(FEC PAR).
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

15

Audit of CFTC’s Enterprise Architecture Program

branch chiefs that cover Enterprise Infrastructure, Enterprise 

Applications, Enterprise Data Management and Enterprise Security. 

• Project Management Lifecycle – IT investments are required to operate 

under the Project Management Lifecycle, which requires: 

o Enterprise alignment and conformance with standards; 

o Alignment and conformance with federal security standards; 

o Inter-divisional coordination around data standards; and 

o Supporting Commission-wide priorities for data. 

While useful, these ODT efforts do not satisfy the requirements of the CCA. The 

required “as is” (current state) architecture and the "to be” (future state) 

architecture, with related policies and procedures, all approved at appropriate 

levels, do not exist. Even though we regard as positive the fact that ODT IT 

leadership team performs a review prior to investing in any new IT initiative or 

prior to expanding an existing IT initiative, under a CCA-compliant EA these 

decisions should be made at higher (mission) levels. The current process does 

not provide an outline of roles and responsibilities for CFTC leadership, and 

does not cover all of the elements specified by OMB. 

The lack of an agency-wide performance measurement program and 

accountability inhibits CFTC’s ability to achieve or document cost savings or to 

measure the direct benefits of EA value to stakeholders. Consequently, 

management cannot track architecture development and use; or evaluate the 

benefits versus costs of various IT investment decisions, that is, monitor the 

impact and resulting savings of EA products and services on IT and business 

investment decisions, collaboration, and reuse. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

16

Audit of CFTC’s Enterprise Architecture Program

APPENDIX C

IT INVESTMENT EARMARKS SPENT ON OPERATIONS

Since 2011, Congress has annually earmarked between $35 and $50 million in 

the CFTC’s appropriated budget for information technology, most recently 

using this statement: “...of which not less than $50,000,000 ... shall be for the 

purchase of information technology.”36 The exact appropriations language has 

varied by year, but legislative history has consistently described the earmarks 

as being for “investments in technology.”37 The Government Accountability 

Office defines the relevant terms Information Technology (IT) and IT Investment 

used by Congress as follows: 

• Information Technology: The computers, ancillary equipment, software, 

firmware, and related procedures, services (including support services), and 

other resources that are used by an organization to accomplish a function.38 

 

• IT Investment: The expenditure of resources on selected information 

technology or IT-related initiatives with the expectation that the benefits

from the expenditure will exceed the value of the resources expended.39

 

As presented in Table 2 below, our analysis of cost categories for CFTC’s FY 

2017 earmark shows that 61% or $30,390,896 of $50,000,000 40 are 

questionable as these costs were for routine information technology needs 

rather than IT investment. 

Table 2: CFTC FY 2017 Earmark ($50 Million) By Cost Category

Cost Category Acquisition Type Acquisition Sub-Type Information 

Technology $ 

IT Investment $

Workforce and 

Mission 

Support

Mission System

Support (MSS)

Law Offices Services (eLaw) (MSS1) 4,090,090

Computer Forensics (MSS2) 839,204

Market and Financial Oversight

Support (MSS3) 

1,844,910

 

36 P.L. 115-31 (2017). Congress has also in the past authorized the transfer of funds from the IT earmark to pay CFTC 

salaries and benefits. See, P.L. 112-74, § 744, 125 STAT. 939 (Dec. 23, 2011); see also, GAO, B-325351, Commodity 

Futures Trading Commission – Fiscal Year 2013 Transfer Authority (April 25, 2014). 37 See discussion of appropriations language and legislative history, Appendix E. 38 Government Accountability Office (GAO) – Information Technology Investment Management, A Framework for 

Assessing and Improving Process Maturity (GAO-04-394G), page 115.

39 Government Accountability Office (GAO) – Information Technology Investment Management, A Framework for 

Assessing and Improving Process Maturity (GAO-04-394G), page 116.

40 As of September 29, 2017, $49,907,239 of $50,000,000 was obligated. Source: CFTC Daily Status of Funds report.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

17

Audit of CFTC’s Enterprise Architecture Program

Cost Category Acquisition Type Acquisition Sub-Type Information 

Technology $ 

IT Investment $ 

Data Harmonization and Quality

(MSS4) 

3,270,000 3,270,000

Data Ingest and Analysis (MSS5) 5,912,700 5,912,700

CFTC Portal/ Cloud Hosting 

(MSS6) 

1,775,000

Statistical Analysis Software

(MSS7) 

1,220,735

System Operations and

Maintenance (MSS8) 

3,336,168

Audio Visual (AV) Cable TV Subscriptions for 

HQ/Regions (AV1) 

56,651

Conference Room Software and 

Maintenance (AV2) 

286,443

Live Internet Broadcasting for 

Open CFTC Meetings/Events (AV3)

270,000

Mobile 

Communications

(MC)

Mobile Wireless Services (MC1) 744,850

Mobile Equipment/Maintenance

(MC2) 

-

Mobile Software and Maintenance

Services (MC3) 

58,390

Agency 

Management 

and 

Compliance

Agency 

Management and 

Compliance (AMC)

Financial Management (AMC1) 419,438

Human Resources (AMC2) 686,561

Training (AMC3) 227,810

CFTC.gov Website (AMC4) 2,010,611

Records 

Management/Documentation 

Support (AMC5) 

1,500,126

Logistics Services (AMC6) 504,754

Core System

Operations

Business 

Continuity (BC)

Emergency Communications 

Operations and Maintenance (BC1) 

388,500 388,500

Business Continuity

Equipment/Refresh (BC2) 

1,752,620 1,752,620

Information 

Technology 

Security (ITS)

Cybersecurity Program 

Management and Operations (ITS1) 

3,671,023 3,671,023

Cybersecurity Equipment and 

Maintenance Services (ITS2) 

612,479 612,023

Cybersecurity Software and 

Maintenance Services (ITS3)

321,051 321,051

Enterprise 

Network 

Operations and 

Maintenance 

Enterprise Network Software and 

Maintenance Services (NOM1) 

2,495,890
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

18

Audit of CFTC’s Enterprise Architecture Program

Cost Category Acquisition Type Acquisition Sub-Type Information 

Technology $ 

IT Investment $

(NOM) Enterprise Network Hardware and 

Maintenance Services (NOM2) 

3,014,479

IT Help Desk Operations and 

Maintenance (NOM3) 

2,810,928

Enterprise network Multi-Function 

Printers (NOM4) 

127,500

TeleCommunications 

(TC)

TC Operations and Maintenance 

Services (TC1) 

1,721,730

Equipment Tech/Refresh (TC2) 60,000

Software and Hardware 

Maintenance/License Renewals 

(TC3) 

288,171

Technology 

Refresh (TR)

Core System Technology Refresh 

(TR1) 

3,681,187 3,681,187

Total $50,000,000

(A)

$19,609,104

(B)

Amount Related to Routine 

IT Operations 

(A)-(B) $ 30,390,896

61%

This means CFTC spent only $19,609,104 for IT investments with the majority 

of the IT earmark spent on day to day IT operations. In evaluating CFTC’s 

compliance with the FY2017 appropriations language, our legal analysis41

concluded that it is very unlikely that CFTC has violated the Anti Deficiency 

Act as the appropriations language for the earmark states it “shall be for the 

purchase of information technology.” That language is very broad, and should 

encompass all spending related to information technology use. The fact that 

reports from Committees of Congress indicate some intent to limit the IT 

earmark to “mission-critical investments in technology,” does not mean the full 

Congress shared that intent, especially given the appropriations language. If 

Congress determines that the IT earmark is not being spent appropriately, it 

may wish to alter the appropriations language to assure it is spent 

appropriately in the future. 

 

41 APPENDIX E presents our legal analysis in its entirety.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

19

Audit of CFTC’s Enterprise Architecture Program

APPENDIX D 

OBJECTIVE, SCOPE AND METHODOLOGY

Our audit objective(s) were to assess and evaluate EA program practices. We 

assessed and evaluated EA program practices in detail to determine whether 

CFTC: (1) established an adequate baseline and a target enterprise 

architecture; (2) implemented effective management practices, policies, and 

processes for the development, implementation, maintenance, and oversight of 

the EA program; and, given annual Congressional IT earmarks, (3) reported IT 

investment results from this program. 

To answer our objectives we relied on CFTC documentation, as well as 

interviews with CFTC personnel, in formulating our assessments with respect 

to the CFTC’s progress towards obtaining stakeholder support of the current 

state “as is,” the establishment of an EA program plan to ensure adequate 

compliance with EA policies and procedures, and the development of a 

complete future state “to be” architecture with parallel mappings to the 

requirements of the GAO EA Maturity reference model. 

In our evaluation of current and target EA development, and quality of the EA 

program, we used OMB and GAO guidance, and NIST Special Publication 

series. For instance, we used as a benchmark GAO’s Framework for Assessing 

and Improving Enterprise Architecture Management42 to determine if CFTC 

satisfied all 59 core elements for the development, maintenance, and use of an 

EA. We also used OMB’s EA Framework, which consists of three capability 

areas: 1) completion, 2) use, and 3) results. OMB’s capability area 

representations of the critical success attributes are fundamentally aligned and 

substantially consistent to GAO’s core elements. 

This performance audit was conducted at CFTC Headquarters in Washington, 

D.C., in accordance with Generally Accepted Government Auditing Standards.43

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our findings 

and conclusions based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions based on 

our audit objectives. 

 

42 Government Accountability Office (GAO) Generally Accepted Government Auditing Standards (GAGAS) Revision 

2011.

43 Refer to Appendix H for ODT structure.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

20

Audit of CFTC’s Enterprise Architecture Program

APPENDIX E 

OIG LEGAL ANALYSIS OF CFTC IT EARMARKS 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

21

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

22

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

23

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

24

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

25

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

26

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

27

Audit of CFTC’s Enterprise Architecture Program

APPENDIX F 

ENTERPRISE ARCHITECTURE REFERENCES 

We determined the following laws and regulations relevant and applicable to 

federal enterprise architecture audit. 

• The Clinger-Cohen Act, (a.k.a. the Information Technology Management 

Reform Act of 1996), P.L. 104-106, Division E, 110 STAT. 679 (1996). 

• E-Government Act of 2002, (a.k.a. e-Government Act), H.R. 2458, P.L. 

107-347, 116 STAT. 2899 (2002). 

• The Government Performance and Results Modernization Act of 2010, 

(a.k.a. GPRA Modernization Act of 2010), H.R. 2142, P.L. 111-352, 124 

STAT. 3866 (2011). 

• Federal Information Technology Acquisition Reform Act, (a.k.a. FITARA), 

H.R. 1232, Became part of the National Defense Authorization Act for 

Fiscal Year 2015, Title VIII, Subtitle D, H.R. 3979, P.L. 113-291, 128 

STAT. 3438 (2014). 

• Federal Information Security Modernization Act of 2014, (a.k.a. FISMA), 

S. 2521, P.L. 113-283, 128 STAT. 3073 (2014). 

• NIST, Security and Privacy Controls for Federal Information Systems and 

Organizations, SP 800-53 (Rev. 4), PM-7 Enterprise Architecture

(Gaithersburg, Md., Dec. 2014). 

• OMB Circular A-11, Preparation, Submission and Execution of the 

Budget. 

• OMB Circular A-130, Management of Federal Information Resources. 

• Federal Enterprise Architecture Framework, Version 2, Office of 

Management and Budget (Jan. 2013). 

• Federal Transition Framework, Office of Management and Budget 

webpage. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

28

Audit of CFTC’s Enterprise Architecture Program

APPENDIX G

MANAGEMENT COMMENTS 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

29

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

30

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

31

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

32

Audit of CFTC’s Enterprise Architecture Program
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

33

Audit of CFTC’s Enterprise Architecture Program

APPENDIX H