U.S. COMMODITY FUTURES TRADING COMMISSION 


OFFICE OF INSPECTOR GENERAL 


Three Lafayette Centre 


1155 21st Street, NW, Washington, DC 20581 


Telephone: (202) 4 18-51 10 


TO: 	 Timothy G. Massad, Chairman 

Sharon Y. Bmven, Commissioner 

J. Christopher Giancarlo, Comm ner \. () 

FROM: 	 A. Roy Lavik, Inspector General\..__). f( 0-­

DATE: 	 September 20, 2016 

SUBJECT: 	 Inspector General's Assessment ofthe Most Serious Management 

Challenges Facing the Commodity Futures Trading Commission 

Summary 

The Reports Consolidation Act of 2000 (RCA) 1 authorizes the CFfC to provide financial 

and performance information in a meaningful and useful format for Congress, the 

President, and the public. The RCA requires the Inspector General to summarize the 

"most serious" management and performance challenges facing the Agency and to 

assess the Agency's progress in addressing those challenges.2 This memorandum fulfills 

our duties under the RCA. 

To complete our assessment we relied on data contained in the CFfC financial 

statement audit and Annual Financial Report, representations by agency management, 

and our knowledge ofindustry trends and CFfC operations. Since Congress left the 

determination ofwhat constitutes a most serious challenge to the discretion ofthe 

Inspector General, we applied the following definition in preparing this statement: 

Serious management challenges are mission critical areas or programs 

that have the potential for a perennial weakness or vulnerability that, 

without substantial management attention, would seriously impact 

Agency operations or strategic goals. 

1 Public Law 106-531, sec 3, 114 STAT. 2537 (No\·. 22, 2000), codified at 31 USC§ 3516(:1). 

Id. 2 
CFfC's Progress on LastYear's Challenges 

For FY2016 the OIG identified three management challenges, they were: 

1. 	 Stimulate registrants towards enhancing their cyber securi"ty controls over vital 

client information so as to reduce the impact ofanyfuture information technology 

breach. 

Management's public comments3 indicate awareness ofthe disruptive impact of cyber 

security breaches ofregistrant networks. CFfC is uniquely positioned to share cyber risk 

intelligence and mitigation best practices among its registrants. The QI G's recently issued 

audit ofCFTC's approach to reducing cybersecurity risks at registrants identified several 

testing and intelligence sharing opportunities to enhance the current approach to this 

threat. We look forward to evaluating additional management actions to reduce cyber 

security risk among registrants. 

2. 	Minimize information security vulnerabilities in its network with particular 

attention to the ex.filtration ofsensitive data. 

Results ofOIG information systems reviews revealed that management is addressing 

information security vulnerabilities. This increase in competency is demonstrated by the 

Office of Data and Technology's (ODT) approach of reallocating staff, increasing the 

frequency of network scans, and patching vulnerabilities accordingly. During the coming 

year, we will scan sensitive databases to identify vulnerabilities for data loss. 

3. 	 Effectively Triage Oversight Tasks In Order To Execute Its Strategic Plan with 

LimitedBudgetary Resources. 

For the second year (FY2015 and FY2016) in a row CFTC budget's was flat at $250 

million while certain operational costs increased. Therefore, the agency must effectively 

triage its budgetary resources to meet its oversight responsibilities stated in its Strategic 

Plan. 

Statement ofChairman Timothy Massad on the System Safeguards Testing Final Rules 

September 8, 2016 available at http://www.cftc.gov/PressRoom/SpeechesTestimony /massadstatemento90816b 

Page I2 

3 
Fiscal Year 2017 Management Challenges 

Due to the complexity, persistence, and ongoing nature ofthe management challenges 

identified in FY 2016, we restate their importance for FY2017. Enterprise wide IT 

security, cybersecurity at registrants, and budget constraints remain significant for 

FY2017. To the aforementioned group we identify another major management challenge 

for FY2017 as: 

4. 	 Management's Effort to Address Findings From its FY2015 Financial Statement 

AuditReport 

As background, the OIG contracts an independent public accounting (IPA) firm to audit 

CFTC's financial statements. For FY2015, the IPA issued a qualified opinion on CFTC's 

financial statements and alerted users that previously issued audit opinions were 

unreliable. The IP A identified a material weakness in internal controls over financial 

reporting related to the recording oflease obligations that materially affected the 

Statement of Budgetary Resources. Currently, the Government Accountability Office 

(GAO) and the CFTC are developing a suitable framework for disclosing future lease 

financial commitments. 

My office will continue to undertake audits, reviews, and investigations that illuminate 

aspects ofthese challenges. 

Cc: 	 Anthony Thompson, Executive Director 

Judith Ringle, Deputy Inspector General and Chief Counsel 

Miguel Castillo, Assistant Inspector General, Auditing 

Page 13