OFFICE OF INSPECTOR GENERAL 


EXPORT-IMPORT BANK ofthe UNITED STATES 


System Review Report 

OIG-AR-14-03 

To Mr. A Roy Lavik, Inspector General 

Commodity Futures Trading Commission 

We have reviewed the system of quality control for the audit organization of the 

Commodity Futures Trading Commission Office of the Inspector General (CFTC OIG) 

in effect for period ended March 31, 2013. A system of quality control encompasses 

CFTC OIG's organizational structure and the policies adopted and procedures 

established to provide it with reasonable assurance of conforming with Government 

Auditing Standards. The elements of quality control are described in Government 

Auditing Standards. CFTC OIG is responsible for designing a system of quality 

control and complying with it to provide CFTC OIG with reasonable assurance of 

performing and reporting in conformity with applicable professional standards in 

all material respects. Our responsibility is to express an opinion on the design of the 

system of quality control and CFTC OIG's compliance therewith based on our 

review. 

Our review was conducted in accordance with Government Auditing Standards and 

guidelines established by the Council of the Inspectors General on Integrity and 

Efficiency (CIGIE). During our review, we interviewed CFTC OIG personnel and 

obtained an understanding of the nature of the CFTC OIG's audit organization, and 

the design of CFTC OIG's system of quality control sufficient to assess the risks 

implicit in its audit function. Based on our assessments, we selected engagements 

and administrative files to test for conformity with professional standards and 

compliance with CFTC OIG's system of quality control. The engagements selected 

represented a reasonable cross-section of the CFTC OIG's audit organization, with 

emphasis on higher-risk engagements audits. Prior to concluding the review, we 

reassessed the adequacy of the scope of the peer review procedures and met with 

CFTC OIG management to discuss the results of our review. We believe that the 

procedures we performed provide a reasonable basis for our opinion. 

In performing our review, we obtained an understanding of the system of quality 

control for the CFTC OIG's audit organization. In addition, we tested compliance 

with CFTC OIG's quality control policies and procedures to the extent we considered 

appropriate. These tests covered the application of CFTC OIG's policies and 

procedures on selected engagements. Our review was based on selected tests; 

therefore, it would not necessarily detect all weaknesses in the system of quality 

control or all instances of noncompliance with it. 

811 Vermont Avenue, NW Washington, D.C. 20571 
OFFICE OF INSPECTOR GENERAL 


EXPORT-IMPORT BAJ;Koftbe UNITED STATES 


April22, 2014 

A. Roy Lavik 

Inspector General 

U.S. Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street, NW 

Washington, DC 20581 

Dear Mr. Lavik: 

Enclosed is our fmal report on the system of quality control for your audit organization 

conducted in accordance with Government Auditing Standards and Council of the 

Inspectors General on Integrity and Efficiency guidelines. Your response to the draft 

report is included in Enclosure 2 with excerpts and our evaluation of your response 

incorporated into the relevant sections ofthe report. 

After carefully considering your responses, we respectfully disagree with the 

responses to the recommendations submitted by your office. We thank you and all 

your staff for your assistance and cooperation during the review. 

Osvaldo Gratacos 


Inspector General 


Enclosure 

811 Vermont Ave nu e, NW Washington, D.C. 20571 
2 

There are inherent limitations in the effectiveness of any system of quality control 

and therefore noncompliance with the system of quality control may occur and not 

be detected. Projection of any evaluation of a system of quality control to future 

periods is subject to the risk that the system of quality control may become 

inadequate because of changes in conditions, or because the degree of compliance 

with the policies or procedures may deteriorate. 

The Enclosure to this report identifies the engagement performed by CFTC OIG and 

monitoring files of CFTC OIG's contracted engagement that we reviewed. 

CFTC has made many positive strides since their last peer review. The last peer 

review had 29 recommendations which 25 involved updating policy. These 

recommendations for the most part have been incorporated into draft policies. 

CFTC has also created many internal control forms that are used for every GAGAS 

audit and is incorporated into their draft policy. CFTC has also been proactive on 

obtaining an automated workpaper system (TeamMate) to improve workpaper 

documentation. 

We noted the following deficiencies during our review. 

1. Deficiency- Continuing Professional Education (CPE) (repeat finding) 

Government Auditing Standards, Section 3.76, states that "Auditors performing work 

in accordance with [Generally Accepted Government Auditing Standards (GAGAS)], 

including planning, directing, performing audit procedures, or reporting on an audit 

conducted in accordance with GAGAS, should maintain their professional 

competence through continuing professional education (CPE). Therefore, each 

auditor performing work in accordance with GAGAS should complete, every 2 years, 

at least 24 hours of CPE that directly relates to government auditing, the 

government environment, or the specific or unique environment in which the 

audited entity operates... Auditors required to take the total 80 hours of CPE should 

complete at least 20 hours of CPE in each year of the 2-year periods." We found that 

the Acting Assistant Inspector General for Audit (AlGA) did not meet the 

Government Auditing Standards 80 hour CPE requirement for the two-year period 

January 1, 2011, through December 31, 2012. Further, the Acting AlGA did not meet 

the Government Auditing Standards minimum requirement of 20 hours of training in 

2011. 

Recommendation 

1. CFTC OIG should ensure that all audit staff performing work in accordance with 

GAGAS meet the CPE requirements and maintain appropriate documentation, as 

described by Government Auditing Standards. 

CFTC OIG Response. We disagree with this finding, conclusion, and resulting 

recommendation because the supporting information is not accurate. 

811 Vermont Avenue, N.W. Washington, D.C. 20571 
I 

3 

II 

I 

I Specifically, the CPE requirement for the Acting AlGA for calendar years 2011 

thru 2012 was 40 hours- not 80 hours. Consistent with Government Auditing 

Standards, 2011 Revision, the Acting AlGA completed 41.5 hours of CPEs during 

the CPE period. The Acting AlGA performed no GAGAS related duties during 

calendar year 2011. During calendar year 2011, CFTC-OIG only performed 

contract GAGAS audits under the technical supervision of the GS-15 Supervisory 

Auditor. The Acting AlGA initially participated in GAGAS audits in March 2012. 

Consequently, the Acting AlGA participated in GAGAS audits for only half (50%) 

of the 2-year CPE period. The Government Auditing Standards section 3.7 6 

states that "Auditors hired or initially assigned [underline added] to GAGAS 

audits after the beginning of an audit organization's 2-year CPE period should 

complete a prorated number of CPE hours." Consequently, as we advised your 

staff prior to and during the exit conference, the CPE requirement for the Acting 

AlGA was 40 hours- not 80 hours. 

Evaluation ofCFTC OIG's Response. We do not agree with CFTC OIG's 

interpretation ofthe GAGAS CPE requirements. In addition, according to the 

GAO report Interpretation ofContinuing Education and Training Requirements, 

"audit organizations should have its auditors complete those requirements 

(CPE) if it is reasonably possible that it will be doing yellow book audits in the 

future." 1 Due to the small size of CFTC OIG Audit office, we find it very 

reasonably possible that they may need to engage in yellow book audits and with 

only two personnel it would indicate that both would need to be up to date on 

CPEs. Furthermore, during the 2011 and 2012 period, the Supervisor Auditor 

meet all CPE requirements and through discussions it was determined that CFTC 

OIG's intentions are for all auditors to meet the 80 hour CPE requirement. We 

believe CFTC auditors have taken the necessary steps to ensure compliance with 

CPE requirements in the future. These actions will resolve this recommendation. 

2. Deficiency - Independence 

Government Auditing Standards, Section 3.59, states that "Documentation of 

independence considerations provides evidence of the auditor's judgments in 

forming conclusions regarding compliance with independence requirements. 

GAGAS contains specific requirements for documentation related to independence 

which may be in addition to the documentation that auditors have previously 

maintained. While insufficient documentation of an auditor's compliance with the 

independence standard does not impair independence, appropriate documentation 

is required under the GAGAS quality control and assurance requirements." 

Additionally Government Auditing Standards, Section 3.84, states that "The audit 

organization should document compliance with its quality control policies and 

procedures and maintain such documentation for a period of time sufficient to 

enable those performing monitoring procedures and peer reviews to evaluate the 

1 "Interpretation ofContinuing Education and Training Requirements" (GAO, Aprill991). 

811 Vermont Avenue, N.W. Washington, D.C. 20571 
4 

extent of the audit organization's compliance with its quality control policies and 

procedures." In addition, according to Section 300.01 ofthe CFTC OIG policy 

manual; "Consistent with [Government Auditing Standards], OIG staff prepares 

annual confidentiality and conflicts of interest certifications." We received no 

documentation of the Acting AlGA's independence for fiscal year 2012. When 

questioned, the Acting AlGA stated that he completed the required certification; 

however he was unable to provide a copy. Based on this finding the CFTC OIG is not 

compliant with Government Auditing Standards and its own policies and procedures. 

Recommendation 

2. CFTC OIG should ensure that all staff prepare annual confidentiality and conflicts 

of interest certifications and maintain the required documentation in accordance 

with Government Auditing Standards and Section 300.01 ofthe CFTC OIG policy 

manual. 

CFTC OIG Response. We agree that consistent with CFTC-OIG policies and 

procedures, all certifications of independence should be documented in CFTCOIG files and we have taken steps to do so. It should be noted, however, that our 

policies and procedures requirement is redundant for the Acting AlGA because 

the Acting AlGA did have documentation of independence on file with CFTC's 

ethics office which meets GAGAS requirements. Specifically, the Government 

Auditing Standards 3.59 state that "GAGAS contains specific requirements for 

documentation related to independence which may [underline added] be in 

addition to the documentation that auditors have previously maintained." As we 

advised your staff, for calendar years 2011, and 2012, the Acting AlGA 

completed OGE Form 278s- Public Financial Disclosure Report - which do meet 

GAGAS standards in documenting his independence. 

Evaluation of CFTC OIG's Response. Managements proposed action of 

documenting certifications of independence in its OIG files will resolve this 

recommendation. However, it should be noted, that we do not consider the 

"Public Financial Disclosure Form" as a substitute for the confidentiality and 

conflicts of interest certification. The "Public Financial Disclosure Form" is 

specifically for financial disclosure while the confidentiality and conflicts of 

interest certification provides evidence of the judgment in forming conclusions 

regarding compliance with independence requirements. In addition, we found 

that an independence statement is maintained for the Supervisory Auditor in 

accordance to CFTC policy. 

3. Deficiency- Policy and Procedures 

According to GAS 3.84 "Each audit organization should document its quality control 

policies and procedures and communicate those policies and procedures to its 

personnel. The audit organization should document compliance with its quality 

control policies and procedures and maintain such documentation for a period of 

811 Vermont Avenue, N.W. Washington, D.C. 20571 
5 

time sufficient to enable those performing monitoring procedures and peer reviews 

to evaluate the extent of the audit organization's compliance with its quality control 

policies and procedures." We found that CFTC OIG lacked an official policy as 

required by GAS 3.84. When we requested a copy of the official policy, CFTC OIG 

provided a copy that was not dated or signed. In addition, the document was 

marked "Draft" and contained editing marks such as highlighting and comments in 

the margin. The lack of an official policy hinders the ability of those performing 

monitoring procedures and peer reviews to evaluate the extent of the audit 

organization's compliance with its quality control policies and procedures. 

Recommendation 

3. CFTC OIG should finalize the audit organization policies and procedures, including 

addressing any outstanding editing remarks, clearly identifying the effective date of 

the policies and procedures, and obtaining the signature ofthe responsible official. 

CFTC OIG Response. We agree that CFTC-OIG policies and procedures should 

be finalized and we have done so. However, any suggestion that the audit 

function was operating without guidance is not accurate. First, as we advised 

your staff, the CFTC Inspector General issued a memorandum on October 7, 

2011 that stated that the audit related portions ofthe draft policies and 

procedures were final. The Inspector General affirmed this in a memorandum to 

your staff on November 26, 2013. Secondly, CFTC-OIG has an audit staff oftwo. 

Both staff were involved in revising the audit policies and procedures after the 

2011 peer review and as a result are both thoroughly familiar with its contents. 

Finally, the copy of the policies and procedures provided your staff did not 

include "editing marks". It only contained cross references to the 2011 CFTCOIG Peer Review Enclosure remediation plan. These cross references were 

included to facilitate your staffs review of CFTC-OIG's efforts to revise the audit 

policies and procedures as we committed to in the remediation plan. 

Evaluation of CFTC OIG's Response. Managements proposed action of 

finalizing their policies and procedures will resolve this recommendation. We 

are not stating that the audit function was operating without guidance only that 

they did not have an official policy as required by GAS 3.84. Furthermore, the 

policy provided to Ex-Im OIG contained the statement "draft" in the header of 

each page. In addition, per our conversations and a memorandum from the 

CFTC IG, the policy manual is used as a living document. 

Enclosure 2 to this report includes the response by CFTC OIG to the above 

deficiencies. 

In our opinion, except for the deficiencies described above, the system of quality 

control for the audit organization of CFTC OIG in effect for the period ended March 

31, 2013, has been suitably designed and complied with to provide CFTC OIG with 

reasonable assurance of performing and reporting in conformity with applicable 

811 Vermont Avenue, N.W. Washington, D.C. 20571 
6 

professional standards in all material respects. Federal audit organizations can 

receive a rating of pass, pass with deficiencies, orJail. CFTC OIG has received a peer 

review rating of pass with deficiencies. 

As is customary, we have issued a letter dated April 22, 2014 that sets forth findings 

that were not considered to be of sufficient significance to affect our opinion 

expressed in this report. 

In addition to reviewing its system of quality control to ensure adherence with 

Government Auditing Standards, we applied certain limited procedures in 

accordance with guidance established by the CIGIE related to CFTC OIG's monitoring 

of audit engagements performed by Independent Public Accountants (IPA) under 

contract where the IPA served as the principal auditor. It should be noted that 

monitoring of engagements performed by IPAs is not an audit and therefore is not 

subject to the requirements of Government Auditing Standards. The purpose of our 

limited procedures was to determine whether CFTC OIG had controls to ensure IPAs 

performed contracted work in accordance with professional standards. However, 

our objective was not to express an opinion and accordingly, we do not express an 

opinion, on CFTC OIG's monitoring of work performed by IPAs. 

811 Vermont Avenue, N.W. Washington, D.C. 20571 
7 

SCOPE AND METHODOLOGY (Enclosure 1) 

Scope and Methodology 

We tested compliance with the CFTC OIG audit organization's system of quality 

control to the extent we considered appropriate. These tests included a review of 

one of one audit report issued April1, 2010, through March 31, 2013. 

In addition, we reviewed CFTC OIG's monitoring of engagements performed by IPAs 

where the IPA served as the principal auditor during the period April1, 2010, 

through March 31, 2013. During the period, CFTC OIG contracted for the audit of its 

agency's fiscal year 2012 financial statements. CFTC OIG also contracted for certain 

other engagements that were to be performed in accordance with Government 

Auditing Standards. 

Reviewed Engagements Performed by CFTC OIG 

Report Date Report Title 

06/22/2012 Audit ofthe Financial Stability Oversight 

Council's Controls over Non-public 

Information* 

*This report was published by The Council ofInspectors General on Financial 

Oversight (CIGFO). Although, CFTC OIG only participated in a portion of this audit, 

CFTC OIG certified that they performed the work in accordance with GAGAS. CIGFO 

completed all planning and reporting. CFTC completed a template spreadsheet for 

the fieldwork phase that was incorporated into CIGFO's report. 

Reviewed Monitoring Files of CFTC OIG for Contracted Engagements 

Report Date Report Title 

11/15/2012 Review of the Independent Auditors CFTC 

Financial Statements for Fiscal Year 2012 

811 Vermont Avenue, N.W. Washington, D.C. 20571 
8 

l 

I 

CFTC OIG Comments (Enclosure 2) 

811 Vermont Avenue, N.W. Washington, D.C. 20571 

U.S. COMMODITY FUTURES TRADING COMMISSION 

Three Lafayette Centre 


1155 21st Street, NW, Washington, DC 20581 


Telephone: (202) 418-5000 


Facsimile: (202) 418-5521 


www.eftc. gov 

March 14, 2014 

Office of the 

Inspector General 

The Honorable Osvaldo Gratacos 

Inspector General 

Export-Import Bank 

Office of Inspector General 

811 Vermont A venue, NW 

Washington, DC 20571 

Re: 	 CFTC-OIG Conm1ents On the Report And Comment Letter on the U.S. Commodity 

Futures Trading Commission Office ofthe Inspector General Audit Organization System 

ofQuality Control 

Dear Mr. Gratacos: 

We have completed our review of the subject documents prepared by your office. Corrective 

actions have been completed for those findings with which we are in agreement. However, as 

pointed out to your staff before and during the exit conference, the report and comment letter 

include several inaccurate findings for which we believe no corrective action is required. Our 

comments on the report, the comment letter, and these inaccuracies are enclosed. 

Thank you for your assistance in identifying areas of our operations that needed improving. If you 

have any questions , please contact me at (202) 418-5110. 

Sincerely, 

Roy Lavik 

Inspector General 

Enclosure 
Enclosure 

Comments on Export-Import Bank OIG Peer Review Report 

I. Deficiency- Continuing Professional Education (CPE) (repeat finding) 

We disagree with this finding, conclusion, and resulting recommendation because the supporting 

information is not accurate. Specifically, the CPE requirement for the Acting AlGA for calendar 

years 20 II thru 20 I2 was 40 hours - not 80 hours. Consistent with Government Auditing 

Standards, 2011 Revision, the Acting AlGA completed 41.5 hours ofCPEs during the CPE 

period. The Acting AlGA performed no GAGAS related duties during calendar year 2011 . 

During calendar year 2011, CFTC-OIG only performed contract GAGAS audits under the 

technical supervision of the GS-15 Supervisory Auditor. The Acting AlGA initially participated 

in GAGAS audits in March 2012. Consequently, the Acting AlGA participated in GAGAS 

audits for only half(50%) ofthe 2-year CPE period. The Government Auditing Standards 

section 3.76 state that "Auditors hired or initially assigned [underline added] to GAGAS audits 

after the beginning of an audit organization's 2-year CPE period should complete a prorated 

number ofCPE hours." Consequently, as we advised your staff prior to and during the exit 

conference, the CPE requirement for the Acting AlGA was 40 hours- not 80 hours. 

2. Deficiency- Independence 

We agree that consistent with CFTC-OIG policies and procedures, all certifications of 

independence should be documented in CFTC-OIG files and we have taken steps to do so. It 

should be noted, however, that our policies and procedures requirement is redundant for the 

Acting AlGA because the Acting AlGA did have documentation ofindependence on file with 

CFTC's ethics office which meets GAGAS requirements. Specifically, the Government 

Auditing Standards 3.59 state that "GAGAS contains specific requirements for documentation 

related to independence which may [underline added] be in addition to the documentation that 

auditors have previously maintained". As we advised your staff, for calendar years 2011, and 

2012, the Acting AlGA completed OGE Form 278s- Public Financial Disclosure Report- which 

do meet GAGAS standards in documenting his independence. 

3. Deficiency- Policy and Procedures 

We agree that CFTC-OIG policies and procedures should be finalized and we have done so. 

However, any suggestion that the audit function was operating without guidance is not accurate. 

First, as we advised your staff, the CFTC Inspector General issued a memorandum on October 7, 

2011 that stated that the audit related portions of the draft policies and procedures were final. 

The Inspector General affirmed this in a memorandum to your staffon November 26, 2013 . 

Secondly, CFTC-OIG has an audit staff oftwo. Both staff were involved in revising the audit 

policies and procedures after the 2011 peer review and as a result are both thoroughly familiar 

with its contents. Finally, the copy of the policies and procedures provided your staff did not 

include "editing marks". It only contained cross references to the 2011 CFTC-OIG Peer Review 
Enclosure 

remediation plan. These cross references were included to facilitate your staffs review of 

CFTC-OIG's efforts to revise the audit policies and procedures as we committed to in the 

remediation plan. 

Comments on Export-Import Bank OIG Peer Review Comment Letter 

The six comments provided by Exllm-OIG, all address CFTC-OIG audit policies and procedures 

manual. Four ofthe issues raised were not presented to us before issuance ofthe draft peer 

review report. We agree with one ofthe four issues along with the two other issues raised. 

Changes have been made to our policies and procedures manual to address these three issues. 

Three ofthe comments in the letter incorrectly state that the policies and procedures manual we 

provided was missing certain guidance. During the exit conference Exllm-OIG staffwas advised 

where the guidance was located in the policies and procedures manual we had provided them. 

However the letter was not corrected. Specifically: 1) guidance on summarizing CFTC-OIG 

monitoring process is located at sections 402.00 and 900.06; 2) guidance on auditors' reliance on 

electronic information systems is located at section 400.06; and 3) guidance on documenting the 

termination of a GAGAS audit is located at 400.07. 

2