U.S. COMMODITY FUTURES TRADING COMMISSION

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

Office of the Inspector General

Semiannual Report to Congress

April 1, 2020 –September 30, 2020

U.S. Commodity Futures Trading Commission
U.S. COMMODITY FUTURES TRADING COMMISSION

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

October 30, 2020

TO: Heath P. Tarbert, Chairman

Brian Quintenz, Commissioner

Rostin Behnam, Commissioner 

Dawn Stump, Commissioner

Dan Berkovitz, Commissioner

FROM: A. Roy Lavik

Inspector General

SUBJECT: Semiannual Report of the Office of the Inspector General

Attached is the Office of the Inspector General’s Semiannual Report for the period from 

April 1, 2020, through September 30, 2020. This report is submitted to you in accordance with 

the requirements of Section 5 of the Inspector General Act of 1978, as amended, and summarizes 

issued reports and ongoing projects during the reporting period. 

I appreciate your continuing support of this office. 
i

SEMIANNUAL REPORT OF THE U.S. COMMODITY FUTURES TRADING 

COMMISSION OFFICE OF THE INSPECTOR GENERAL

TABLE OF CONTENTS

EXECUTIVE SUMMARY .......................................................................................................... 1

CFTC PROGRAMS and OPERATIONS .................................................................................. 3

CFTC OIG RESPONSIBILITIES, RESOURCES, ORGANIZATION, and 

INDEPENDENCE......................................................................................................................... 4

CFTC OIG RESPONSIBILITIES ..................................................................................................... 4

CFTC OIG RESOURCES ............................................................................................................... 5

OIG INDEPENDENCE .................................................................................................................... 6

REQUIRED STATEMENT REGARDING INFORMATION ACCESS AND ASSISTANCE ........................... 7

AUDIT OPERATIONS ................................................................................................................ 7

COMPLETED AUDITS, INSPECTIONS, EVALUATIONS, AUDIT REVIEWS, AND OTHER AUDIT 

PROJECTS ..................................................................................................................................... 7

CFTC’s Policies and Procedures Regarding Oversight of Cybersecurity Safeguards by 

Registered Entities.................................................................................................................. 7

FY 2020 FISMA Audit: Order Book On-Demand System Penetration Testing Results......... 8

FY 2020 Management Challenges.......................................................................................... 9

ONGOING AUDITS, INSPECTIONS, EVALUATIONS, AUDIT REVIEWS, AND OTHER AUDIT PROJECTS

..................................................................................................................................................... 9

Audit of the CFTC’s FY 2020 Annual Financial Report ........................................................ 9

Audit of the CFTC’s FY 2020 Customer Protection Fund Financial Statements Report....... 9

Federal Information Security Management Act Review: FY 2020........................................ 9

Council of Inspectors General on Financial Oversight (CIGFO)........................................ 10

AUDIT REPORTS AND REVIEWS OVER SIX MONTHS OLD; REQUIRED STATEMENTS .................. 10

Required Statements Regarding Commission Response Exceeding 60 Days, and Regarding 

Management Decisions Not Made ........................................................................................ 10

Required Statements Regarding Revised Management Decisions, and Regarding Inspector 

General Disagreement.......................................................................................................... 10

Required Statements Regarding Significant Recommendations that have not been 

Completed; and Audit Reports for which there are any Outstanding Unimplemented 

Recommendations, Including Aggregate Potential Cost Savings......................................... 10

Table 1: Unimplemented Recommendations................................................................... 11

Table 2: Detail of Unimplemented Recommendations.................................................... 11

INVESTIGATIVE OPERATIONS........................................................................................... 12

SUMMARY.................................................................................................................................. 12

ONGOING INVESTIGATIVE MATTERS AND REQUIRED DISCLOSURES .......................................... 13
ii

Table 3: Investigative Statistics for Referrals and Whistleblower Retaliation ................ 13

INDEPENDENT STUDY........................................................................................................... 13

Review of Policies and Procedures for Calculating Overhead ............................................ 13

LEGAL AND ECONOMIC REVIEW ..................................................................................... 14

LEGISLATIVE and REGULATORY PROJECTS................................................................ 14

PEER REVIEWS........................................................................................................................ 15

Peer Review Report of CFTC OIG Audit Function .............................................................. 15

SUMMARY of FINAL REPORTS NOT MADE PUBLIC .................................................... 16

GAO LIAISON............................................................................................................................ 16

STRATEGIC PLAN for the OFFICE of INSPECTOR GENERAL..................................... 17

MISSION, VISION, AND VALUES ................................................................................................. 17

STRATEGIC GOALS FOR THE COMING YEAR............................................................................... 18

STRATEGIC GOAL 1: EVALUATE THE ECONOMIC IMPACT OF CFTC REGULATORY ACTIONS 

THROUGH LEGAL ANALYSIS, WHITE PAPERS, INSPECTIONS AND EVALUATIONS, MANAGEMENT 

REVIEWS, AND OTHER PRODUCTS .............................................................................................. 18

Office of Legal and Economic Review (OLER): Legislative, Economic, and Regulatory 

Review Agenda...................................................................................................................... 18

STRATEGIC GOAL 2: ADDRESS HIGH IMPACT ISSUES IN CFTC ADMINISTRATIVE AND MISSION 

PERFORMANCE........................................................................................................................... 18

Office of Audits: Audit and Review Agenda.......................................................................... 18

STRATEGIC GOAL 3: ADDRESS EMPLOYEE AND CONTRACTOR MISCONDUCT PROMPTLY,

THOROUGHLY, AND RELIABLY .................................................................................................. 20

Office of Investigations: Investigative Agenda ..................................................................... 20

CONTACTING the OFFICE of the INSPECTOR GENERAL............................................. 21

APPENDICES............................................................................................................................. 22

Appendix 1 – Reports Issued with Questioned Costs.............................................................. 22

Appendix 2 – Reports Issued with Recommendations That Funds Be Put to Better Use.... 23

Appendix 3 - Index of IG Act Reporting Requirements ......................................................... 24
1

EXECUTIVE SUMMARY

This semiannual report (SAR) is issued by the Commodity Futures Trading Commission 

(CFTC) Office of the Inspector General (OIG) pursuant to the Inspector General Act of 1978, as 

amended.1It summarizes OIG’s activities and accomplishments for the period April 1, 2020, 

through September 30, 2020. During this period, the OIG Office of Audits completed one audit

and one technical assessment. With the exception of information security reports, they are posted 

to our webpage. In addition, we began or continued work on three audits, three technical 

assessments, and a collaborative survey. On the investigations side, we began the reporting 

period with 14 allegations pending development. During this reporting period we received 50

new allegations, closed 57 allegations, and opened one investigation. We finished the reporting 

period with one pending investigation and seven allegations under development. Finally, we 

concluded a contracted study of policies and procedures for calculating overhead expenses at the 

CFTC. 

Highlights of all completed and ongoing audits, investigations, and other projects follow

as listed below: 

AUDIT OPERATIONS

Completed

Information Technology Management and Security 

• CFTC’s Policies and Procedures Regarding Oversight of Cybersecurity Safeguard by 

Registered Entities - We contracted an independent public account (IPA) to conduct a 

performance audit of CFTC policies and procedures to evaluate registrants’ cybersecurity 

safeguards. The report included four recommendations; the Chairman’s comments and 

planned actions were fully responsive.

• Fiscal Year (FY) 2020 FISMA Audit: Order Book On-Demand (OBOD) System 

Penetration Testing Results - We contracted independent information security 

professionals to evaluate database controls for OBOD market data stored by a cloud 

service provider. Our report was positive on the assessment of the security controls for 

the OBOD system environment. This report is not public due to information technology 

sensitivity concerns.

Other

• FY 2020 Management Challenges – For FY 2020, we reiterated our FY 2019 

management challenges for information technology (IT) modernization and data 

governance and further recognize newly established positions for a Chief Information 

Officer and a Chief Data Officer.

 

1 P.L. 95-452, 92 Stat. 1101 (1978). 
2

Ongoing

Information Technology Management and Security 

• Federal Information Security Management Act (FISMA) Review: FY 2020 – The 

objective of this review is to evaluate CFTC’s information security program and practices 

as required by FISMA.2 This report is not made public due to information technology 

sensitivity concerns. The following topic engagements will be completed by contracted 

information security professionals in coordination with OIG:

• Cyber Testing: New York File Servers – We contracted independent information 

security professionals to evaluate backup and recovery IT controls of New York 

file servers given loss of data and availability incidents.

• Cyber Testing: Active Directory Controls – We contracted independent 

information security professionals to evaluate the Microsoft Server Active 

Directory program.

• Cyber Testing: FY 2019 Information Security Continuous Monitoring (ISCM) 

follow-up. We contracted independent information security professionals to 

evaluate the management response and follow-up to FY 2019 ISCM findings.

Financial

• Audit of the CFTC’s FY 2020 Annual Financial Report (AFR) – The objective of this 

Congressionally mandated audit3is to render an opinion on the agency financial report 

(financial statements) in accordance with Generally Accepted Government Auditing 

Standards (GAGAS). 

• Audit of the CFTC’s FY 2020 Customer Protection Fund (CPF) – The objective of this 

Congressionally mandated audit4is to render an opinion on customer protection fund 

financial statements in accordance with GAGAS. 

Other

• Council of Inspectors General on Financial Oversight (CIGFO) – The Dodd-Frank Act 

Wall Street Reform and Consumer Protection Act5created the Financial Stability 

Oversight Council (FSOC),6as well as the Council of Inspectors General on Financial 

Oversight (CIGFO).7 CIGFO is charged with evaluating the effectiveness and internal 

operations of FSOC. The Dodd-Frank Act authorizes the Council of Inspectors General 

on Financial Oversight (CIGFO) to convene a working group of its members. During this 

reporting period CIGFO convened a Working Group to compile guidance for preparing 

 

2 P.L. 107-347, 116 Stat. 2946 (2002).

3 The Accountability of Tax Dollars Act, P.L. 107-289, 116 Stat. 2049 (2002). 

4 P.L. 111-203, § 748, 124 Stat. 1739 (2010).

5 Dodd-Frank Wall Street Reform and Consumer Protection Act, P.L.111-203, 124 Stat. 1376 (2010) (“Dodd-Frank 

Act” or “Dodd-Frank”). The text is available here: http://www.cftc.gov/LawRegulation/DoddFrankAct/index.htm.

6 P.L. 111-203, § 111, 124 Stat. 1392 (2010). 

7 P.L. 111-203, § 989E, 124 Stat. 1946 (2010). 
3

for a crisis, along with crisis response lessons learned, based on detailed survey responses 

from the FSOC member agencies. Field work was underway at the close of this reporting 

period.

INVESTIGATIVE OPERATIONS

We began the reporting period with 14 allegations pending development, and no open 

investigations. We opened one investigation following development of one allegation pending at 

the close of the last reporting period (which closed that allegation), and in total closed 10 of the 

14 allegations pending at the close of the prior reporting period. During this reporting period we 

received 50 new allegations, of which 47 were closed during this reporting period. We finished 

the reporting period with one pending investigation and seven allegations pending development 

(four from the prior reporting period and three from the present reporting period). 

INDEPENDENT STUDY

Review of Policies and Procedures for Calculating Overhead – During FY2019 we

engaged an independent organization to conduct a study of CFTC’s overhead calculation 

policies, procedures, and practices, and to identify best practices and opportunities for 

maximizing mission resources. The study was provided to management for consideration during 

the prior reporting period, and we closed out the study during this reporting period.

LEGAL AND ECONOMIC REVIEW

Due to a staff detail and turnover, there were no completed projects and no new projects 

begun by the OIG Office of Legal and Economic Review (OLER). During this reporting period 

we continued to recruit attorneys with a strong background in economic analysis necessary to 

evaluate the economy and efficiency of market regulation. We hope to resume operations in 

OLER during the next reporting period.

CFTC PROGRAMS and OPERATIONS

Established by statute as an independent agency in 1974, the CFTC assumed 

responsibilities previously belonging to the U.S. Department of Agriculture since the 1920s.8

The mission of the Commodity Futures Trading Commission is: “To promote the integrity, 

resilience, and vibrancy of the U.S. derivatives markets through sound regulation.”

9

 Its mandate 

was renewed and/or expanded in 1978, 1982, 1986, 1992, 1995, 2000, 2008, and 2010. The 

CFTC and its predecessor were established to protect market participants and the public from 

fraud, manipulation, and other abusive practices in the commodity futures and options markets. 

 

8 U.S. Commodity Futures Trading Commission, Strategic Plan FY 2020-2024 (May 2020), page 4, available at: 

https://www.cftc.gov/media/3871/CFTC202024_2024StrategicPlan/download . 

9

Id., page 3. 
4

After the 2008 financial crises and the subsequent enactment of the Dodd-Frank Act, the CFTC’s 

mission expanded to include oversight of the swaps marketplace.10

The Commission consists of five Commissioners appointed by the President, with the 

advice and consent of the Senate, to serve staggered five-year terms. The President appoints one 

of the Commissioners to serve as Chairman. No more than three Commissioners may be from the 

same political party.11 The CFTC maintains offices in Washington, D.C.; New York, NY; 

Chicago, IL; and Kansas City, MO. As of September 30, 2020, the CFTC organization consisted 

of the following Divisions and Offices (not including OIG):

12

• Division of Clearing and Risk

• Division of Swap Dealer and Intermediary Oversight

• Division of Enforcement (which includes the CFTC Whistleblower Office)

• Division of Market Oversight. 

• Office of the Chairman and Commissioners (which includes LabCFTC, as well as the

Offices of Minority and Women Inclusion, Legislative and Intergovernmental Affairs, 

and Public Affairs)

• Office of the Chief Economist

• Office of International Affairs

• Office of Data and Technology

• Office of General Counsel

• Office of the Executive Director

CFTC OIG RESPONSIBILITIES, RESOURCES, ORGANIZATION, 

and INDEPENDENCE

CFTC OIG RESPONSIBILITIES

The CFTC OIG was created in 1989 in accordance with the 1988 amendments to the 

Inspector General Act of 1978.13 OIG was established as an independent unit to:

• Promote economy, efficiency, and effectiveness in the administration of CFTC programs 

and operations, and detect and prevent fraud, waste, and abuse in such programs and 

operations;

• Conduct and supervise audits and, where necessary, investigations relating to the 

administration of CFTC programs and operations; 

 

10 Id., page 4.

11 7 U.S.C. § 2(a)(2). 

12 U.S. Commodity Futures Trading Commission, FY 2021 President’s Budget (Feb. 2020), available at: 

https://www.cftc.gov/cj. But see, CFTC reorganization announcement, Release Number 8297-20, October 28, 2020. 

13 P.L. 100-504, 102 Stat. 2515 (1988). 
5

• Review existing and proposed legislation, regulations, and exchange rules and make 

recommendations concerning their impact on the economy and efficiency of CFTC 

programs and operations or the prevention and detection of fraud and abuse; 

• Recommend policies for, and conduct, supervise, or coordinate other activities carried out 

or financed by such establishment for the purpose of promoting economy and efficiency 

in the administration of, or preventing and detecting fraud and abuse in, its programs and 

operations; and

• Keep the Commission and Congress fully informed about any problems or deficiencies in 

the administration of CFTC programs and operations and provide recommendations for 

correction of these problems or deficiencies.

The IG is appointed by the full Commission in accordance with the applicable laws and 

regulations governing appointments within the CFTC, and may be removed upon the written 

concurrence of a 2/3 majority of the full Commission.14

The IG is a member of the Counsels of Inspectors General on Financial Oversight 

(CIGFO), created under the Dodd-Frank Act to examine the work of the Financial Stability 

Oversight Council (FSOC).

The IG is also member of the Counsel of the Inspectors General on Integrity and 

Efficiency (CIGIE), an independent entity established within the executive branch to address 

integrity, economy and effectiveness issues that transcend individual Government agencies and 

to aid in the establishment of a professional, well-trained and highly skilled workforce in the 

Offices of Inspectors General.

CFTC OIG conducts audits engagement in accordance with the Generally Accepted 

Government Auditing Standards (GAGAS) issued by the Government Accountability Office

(GAO). OIG conducts inspections, evaluations, and other covered products in accordance with 

the Quality Standards for Inspection and Evaluation issued by the CIGIE. OIG investigations are 

performed in accordance with the Quality Standards for Investigations issued by the CIGIE. 

CFTC OIG RESOURCES

CFTC OIG maintains an Office of Audits, Office of Investigations, and Office of 

Legal and Economic Review (OLER). At the end of the reporting period, the CFTC OIG 

consisted of nine FTEs (including two vacancies), and we were in the process of backfilling the 

OLER Attorney/Economist, which will restore OLER to 2017 staffing levels. Our webpage is 

located at https://www.cftc.gov/About/OfficeoftheInspectorGeneral/index.htm.

 

14 5 U.S.C. App. §§ 8G(c), 8G(e)(1).
6

Our organizational chart follows with OIG staff as of September 30, 2020 (vacant 

positions are noted): 

OIG INDEPENDENCE

OIG operates independently of the Agency and has not experienced any interference from 

the CFTC Chairman or Commissioners in connection with the conduct of any investigation, 

inspection, evaluation, review, or audit. Our investigations have been pursued regardless of the 

rank or party affiliation of the target. OIG also has conducted audits, inspections, evaluations, 

and reviews without interference where it has perceived the opportunity to recommend 
7

improvement to futures regulation efforts, again without regard to the party affiliation of any 

Chairman or Commissioner.15

REQUIRED STATEMENT REGARDING INFORMATION ACCESS AND ASSISTANCE 

No reports were made to the Agency head under section 6(b)(2) concerning information 

or assistance unreasonably refused or not provided (mandated under section 5(a)(5) of the Act).

During the semimanual reporting period, there were no direct or intentional attempts by 

CFTC to interfere with Inspector General independence through:

Type Number Explanation

Budget constraints 0 N/A

Resistance to oversight 0 N/A

Delayed information access 0 N/A

Other 0 N/A

AUDIT OPERATIONS

COMPLETED AUDITS, INSPECTIONS, EVALUATIONS, AUDIT REVIEWS, AND OTHER

AUDIT PROJECTS

Information Technology Management and Security 

CFTC’s Policies and Procedures Regarding Oversight of Cybersecurity Safeguards by 

Registered Entities

The CFTC Office of Inspector General (OIG) evaluated the Commission’s 

policies and procedures for reviewing registrants’ cybersecurity policies in 2016.16 At 

that time, the CFTC Rules on System Safeguards Testing Requirements were not final. 

While the rule became effective on September 19, 2016, the compliance dates were 

section specific with the last compliance date being September 19, 2017.17 We contracted 

an independent public accountant (IPA) to conduct a performance audit of CFTC policies 

and procedures for conducting cybersecurity safeguard oversight of certain registered 

 

15 The Inspector General Act of 1978, as amended, states: “[T]he head of the designated Federal entity shall not 

prevent or prohibit the Inspector General from initiating, carrying out, or completing any audit or investigation....” 5 

U.S.C. App. 3 § 8G(d)(1). 

16

 CFTC OIG, Audit of Commodity Futures Trading Commission’s Policies and Procedures For Reviewing 

Registrants’ Cybersecurity, October 11, 2016 (available here: 

https://www.cftc.gov/idc/groups/public/@aboutcftc/documents/file/oig_rrcp2016.pdf). 

17 CFTC, System Safeguards Testing Requirements; Final Rule, September 19, 2016

(available here: http://www.cftc.gov/ucm/groups/public/@lrfederalregister/documents/file/2016-22174a.pdf ).
8

entities. This audit was conducted in accordance with Government Auditing Standards 

(2018 revision), also known as the “Yellow Book.” 

We concluded that CFTC and two oversight divisions – Division of Clearing and 

Risk, and Division of Market Oversight – have developed sufficient and adequate 

policies and procedures to address proper cybersecurity safeguards at certain CFTC 

registered entities. While we recognized the adequacy of policies and procedures, the 

following recommendations we made: 

 Increase the number of dedicated employees to the divisions’ System Safeguard 

Examination (SSE) teams, in order to continuously assess cybersecurity risks at 

CFTC registrants.

 Conduct more thorough and in-depth testing of registrants in order to validate that 

their cybersecurity policies and procedures are being adhered to.

 Implement better data tracking and data analytics tools in order to use available 

registrant’s incident data to analyze and predict trends of potential cybersecurity 

threats, and to keep track of registrant communication with CFTC personnel.

 Emphasize to CFTC registrants’ usage of information sharing facilities so as to 

promote rapid awareness of emerging cyber threats.

Management agreed with the four recommendations; their planned actions were deemed 

responsive.

FY 2020 FISMA Audit: Order Book On-Demand System Penetration Testing Results

Annually the OIG reviews the Commodity Futures Trading Commission’s information 

security program and practices as required by the Federal Information Security Modernization 

Act of 2014.18 For FY 2020, this year’s scope included a concentrated assessment of order book 

on-demand system security controls hosted on a public cloud. We contracted information 

security professionals to assist in the technical control review.

In its review, the security experts observed that the eleven controls under evaluation were 

effective and operating as designed with no exceptions. While the testing team noted a positive 

assessment conclusion, they conveyed one Process Improvement Opportunity. This report is not 

published on our webpage due to information technology sensitivity concerns.

 

18 P.L. 113-283, 128 Stat. 3073 (2014).
9

Other

FY 2020 Management Challenges

For FY 2020, we reiterated our FY 2019 Management Challenges for information technology 

(IT) modernization and data governance, and further recognized the newly established positions 

for a Chief Information Officer and a Chief Data Officer.

ONGOING AUDITS, INSPECTIONS, EVALUATIONS, AUDIT REVIEWS, AND OTHER

AUDIT PROJECTS

Financial

Audit of the CFTC’s FY 2020 Annual Financial Report

The objective of this Congressionally mandated audit19 is to render an opinion on the 

agency financial report (financial statements) in accordance with Generally Accepted 

Government Auditing Standards (GAGAS). 

Audit of the CFTC’s FY 2020 Customer Protection Fund Financial Statements Report

The objective of this Congressionally mandated audit20 is to render an opinion on 

customer protection fund financial statements in accordance with GAGAS. 

Information Technology Management and Security 

Federal Information Security Management Act21 Review: FY 2020

The objective of this audit is to determine CFTC’s compliance with select information 

security controls prescribed by the National Institute of Standards and Technology (NIST) and as 

outlined by the Inspector General Federal Information Security Modernization Act of 2014 

Reporting Metrics.

22 This year’s scope also includes a concentrated assessment of New York file 

servers, active directory program management, and follow-up to FY 2019 ISCM findings. We 

have contracted information security professionals to assist in these areas of focus. 

 

19 See fn. 3.

20 See fn. 4.

21 See fn.2.

22 The Inspector General Federal Information Security Modernization Act of 2014 (P.L. 113-283, 128 Stat. 3073 

(2014)) Reporting Metrics for FY2020 are available here: 

https://www.cisa.gov/sites/default/files/publications/FY_2020_IG_FISMA_Metrics.pdf. 
10

Other

Council of Inspectors General on Financial Oversight (CIGFO) 

The Dodd-Frank Act created the Financial Stability Oversight Council (FSOC),23 as well 

as the Council of Inspectors General on Financial Oversight (CIGFO).24 CIGFO is charged with 

evaluating the effectiveness and internal operations of FSOC. The Dodd-Frank Act authorizes 

the Council of Inspectors General on Financial Oversight (CIGFO) to convene a working group 

of its members. For FY 2020 CIGFO has convened a Working Group to conduct a detailed 

survey of the FSOC member agencies in order to compile forward-looking guidance for 

preparing for a crisis, along with crisis response lessons learned. Field work was underway at the 

close of this reporting period.

AUDIT REPORTS AND REVIEWS OVER SIX MONTHS OLD; REQUIRED STATEMENTS

Required Statements Regarding Commission Response Exceeding 60 Days, and Regarding 

Management Decisions Not Made

There were no audit reports issued during the reporting period lacking Commission 

response within 60 days, and no instances of an audit report issued before the commencement of 

the reporting period for which a management decision had not been made by the end of the 

reporting period. 

Required Statements Regarding Revised Management Decisions, and Regarding Inspector 

General Disagreement

No management decisions were revised during the reporting period, and the Inspector 

General did not disagree with any management decisions on OIG audit recommendations during 

the reporting period.

Required Statements Regarding Significant Recommendations that have not been 

Completed; and Audit Reports for which there are any Outstanding Unimplemented 

Recommendations, Including Aggregate Potential Cost Savings

There were no audit reports, with a management action date over six months old, where 

the recommendation for corrective action had not been completed. Outstanding 

recommendations are relayed in the two tables that follow, with explanatory text.

 

23 See fn.6. 

24 See fn.7. 
11

Table 1: Unimplemented Recommendations 

Fiscal

Year

Number of Reports 

with Unimplemented 

Recommendations

Number of 

Unimplemented 

Recommendations

Dollar Value of 

Aggregate 

Potential Cost 

Savings

No Comment 

Returned 

w/in 60 days

2020 1 4 0 0

2019 1 1

Totals 2 5 0 0

Table 2: Detail of Unimplemented Recommendations

Fiscal 

Year

Audit Report Unimplemented Recommendations

2020 CFTC’s Policies and 

Procedures Regarding 

Oversight of Cybersecurity 

Safeguards by Registered 

Entities

▪ Increase the number of dedicated employees to the 

divisions’ System Safeguard Examination (SSE) 

teams, in order to continuously assess 

cybersecurity risks at CFTC registrants.

▪ Conduct more thorough and in-depth testing of 

registrants in order to validate that their 

cybersecurity policies and procedures are being 

adhered to.

▪ Implement better data tracking and data analytics 

tools in order to use available registrant’s incident 

data to analyze and predict trends of potential 

cybersecurity threats, and to keep track of 

registrant communication with CFTC personnel.

▪ Emphasize to CFTC registrants’ usage of 

information sharing facilities so as to promote 

rapid awareness of emerging cyber threats.

2020 FY 2020 FISMA Audit: 

Order Book On-Demand 

System Penetration Testing 

Results

▪ None. One process improvement opportunity is

not yet completed.

2019 CFTC Financial Statements 

Audit: Fiscal Year (FY) 

2018

▪ Complete an investigation into a potential Antideficiency Act (ADA) violation noted and make 

any required reports.* The current target 

completion date is November 30, 2020.

 In FY2014, CFTC did not freeze the pay of certain senior officials pursuant to an FY 2014 government wide 

appropriation provision (P.L. 113–76, 128 Stat. 241, §741 (2014)), that has remained in each subsequent 

appropriation including the FY 2020 appropriation (P.L. 116–93, 133 Stat. 2496, §748 (2019)). The FY2017

CFTC financial statement audit identified a pending CFTC management review of this issue, and 

recommended any identified ADA violation be addressed. Management concurred with the recommendation, 

and extended the original target completion date of July 31, 2020, to November 30, 2020. 
12

INVESTIGATIVE OPERATIONS

SUMMARY

We began the reporting period with 14 allegations pending development. We opened one 

investigation following development of one allegation pending at the close of the last reporting 

period (which closed that allegaetion). In total we closed 10 of the 14 allegations pending at the 

close of the prior reporting period. During this reporting period we received 50 allegations, of 

which 47 were closed during this reporting period. We finished the reporting period with one 

pending investigation and seven allegations under development (three from this reporting period 

and four from the prior reporting period). Here is a summary of our investigative activity:

▪ Opened one investigation during the reporting period (following development of an 

allegation pending at the close of the prior reporting period, which closed that allegation)

▪ Closed nine additional allegations pending at the close of the prior reporting period as 

follows: 

o Referred the source or one allegation to private counsel or another regulatory entity

o Closed one allegation upon learning the allegation had previously been addressed by 

the Department of Justice

o Closed one general inquiry with a referral to CFTC for assistance 

o Closed six allegations due to inadequate information upon which to proceed.25

▪ Received 50 new allegations through the OIG email hotline (40), OIG phone hotline (7), 

by other OIG phone (2), or by fax (1), addressed as follows:

o Referred 31 allegations to the CFTC Division of Enforcement

o Referred five allegations to another entity for possible investigation

o Recommended (for four allegations) that the source reach out to another entity for 

possible assistance or investigation

o Referred four general inquiries or allegations of minor management issues to be 

answered or addressed by CFTC staff or management (with no further complaints 

received)

o Closed two allegations due to inadequate information upon which to proceed.26

o Held 3 allegations open for consideration in FY2020, pending further development by 

OIG or receipt of additional information or similar allegations

o Closed one allegation with the opening of an investigation

At the close of this reporting period there remained one open investigation and seven open 

allegations, which included four pending from the close of the prior reporting period. 

 

25 Please know that OIG retains all investigation, preliminary investigation, and allegation files for a period of 10 

years; therefore, if additional information or allegations are received in the future, a closed matter can be reopened. 

26 See fn. 25.
13

ONGOING INVESTIGATIVE MATTERS AND REQUIRED DISCLOSURES

All open investigations and preliminary investigations are confidential, as are the content 

of incoming allegations. It is the policy of CFTC OIG to not disclose details regarding open

investigations absent good cause; if an ongoing investigation is disclosed to the public it will be 

listed here. 

The Office of Investigations began this reporting period with no pending investigations or 

preliminary investigations, and currently has one open investigation (opened during this 

reporting period).

Table 3: Investigative Statistics for Referrals and Whistleblower Retaliation

April 1, 2020 – September 30, 2020

A. Completed investigations and preliminary investigations 0

B. Referrals to prosecuting authorities for criminal prosecution 0

C. Indictments from prior referrals 0

D. Whistleblower retaliation findings 0

We compiled these statistics from a review of our digital files.

It is our practice to discuss potentially criminal investigations early with an Assistant 

United States Attorney (AUSA) to ensure matters of interest are coordinated from the outset. 

While we engaged with AUSAs during the reporting period as necessary to complete our work, 

no formal referrals for prosecution were made.

There were no findings of whistleblower retaliation during this reporting period. There 

were no reports of investigation involving a senior Government employee where allegations of 

misconduct were substantiated.

INDEPENDENT STUDY

Review of Policies and Procedures for Calculating Overhead 

We engaged an independent organization to conduct a study of CFTC overhead with the 

following objectives:

• Evaluate CFTC overhead policies, procedures, and practices, and

• Identify best practices and opportunities for maximizing mission resources.

The scope of the study was CFTC’s overhead calculation methodologies for purposes of budget 

submissions for FY 2015 through FY 2019, a comparison of the calculation methodologies to 

similar federal or private entities (normalized based on budget object class), and best practices 

for managing overhead.
14

The contractor completed a 70-page management draft in February 2020. The management draft 

identified no potential instances of noncompliance by CFTC with regard to overhead calculation, 

reporting, or management, but did include four suggestions, mostly focused on increasing detail, 

transparency and consistency in overhead calculation (and reporting) across budget products. 

There were no recommendations. 

Management responded with detailed comments on June 20, 2020. Management remarked on 

some statements in the study, but overall expressed a commitment to considering improvements 

to overhead processes, especially as CFTC concludes its current reorganization. We agree with 

management that a cost-benefit analysis must support internal overhead processes. 

While the study originally was intended as an Inspection and Evaluation (I&E) under established 

CIGIE I&E standards, we closed out the contract prior to our receipt of the management 

response, and therefore did not consult with the contractor as necessary to address all of 

management’s observations. We therefore could not issue the report in final as a compliant I&E. 

We provided to management and to staff for the Chairman and Commissioners a memo 

explaining the change in status of this project. For informational purposes we attached the 

management draft, management’s comment, and our comment in response (detailing our 

comments where possible, as well as our limitations). 

LEGAL AND ECONOMIC REVIEW

There were no Office of Legal and Economic Review projects pending at the start of this 

reporting period. Due to previous staff turnover, there were no completed projects and no new 

projects begun. We replaced one attorney who separated during the prior reporting period, and at 

the end of the reporting period were in the process of hiring an additional attorney with a 

background in law and in economics, in order to restore OLER legal staff to 2017 levels. 

LEGISLATIVE and REGULATORY PROJECTS

1. Introduction and Summary

As specified in Section 4(a)(2) of the Inspector General Act of 1978,27 the Office of 

Legal and Economic Review within OIG reviews the impact of existing and proposed legislation 

and regulations on CFTC programs and operations and makes recommendations regarding more 

effective or efficient alternatives or protections against fraud and abuse. The OIG also reviews

exchange rule proposals circulated to senior staff at the CFTC. 

OIG notifies the responsible Divisions as to any concerns with draft and final documents 

relating to legislation, rules or investigations. Formal comments were not submitted to the 

Commission during this reporting period.

 

27 5 USC App. § 4(a)(2) (made applicable to CFTC OIG at 5 USC App. § 8G(g)). 
15

2. Legislative Activities

OIG reviews legislation impacting programs and operations of the CFTC, and makes

contact with Congressional staff concerning various Agency and IG issues as appropriate. This 

work is performed by the Office of Legal and Economic Review within OIG. The IG serves on 

the legislation committee for the Council of Inspectors General on Integrity and Efficiency, 

which comments on proposed amendments to the IG Act and other legislation affecting the IG 

community. No formal projects were undertaken during this reporting period.

PEER REVIEWS

An important function in each agency OIG is the peer review process. Government

Auditing Standards (GAS) require that audit organizations conducting audits of Federal agencies 

undergo peer reviews every three years. The IG community has implemented a process to meet 

this requirement and, in accordance with GAS and CIGIE peer review quality control and 

assurance standards, an OIG audit team assesses other OIGs’ audit functions. The purpose of the 

peer review is to determine whether the reviewed audit organization’s internal quality control 

systems are adequate and provide reasonable assurance that applicable auditing standards, 

policies and procedures are met. We are required to include in each OIG semiannual report:

• The results of any peer review conducted by another Office of Inspector General during the 

reporting period; or if no peer review was conducted within that reporting period, a statement 

identifying the date of the last peer review conducted by another Office of Inspector General;

• A list of any outstanding recommendations from any peer review conducted by another 

Office of Inspector General that have not been fully implemented, including a statement 

describing the status of the implementation and why implementation is not complete; and

• A list of any peer reviews conducted by the Inspector General of another Office of the 

Inspector General during the reporting period, including a list of any outstanding 

recommendations made from any previous peer review (including any peer review conducted 

before the reporting period) that remain outstanding or have not been fully implemented.

The required information follows:

Peer Review Report of CFTC OIG Audit Function

The Federal Maritime Commission, Office of the Inspector General, reviewed the system of 

quality control for the CFTC OIG audit organization in effect for the year ending March 31, 

2019. In their opinion, the system of quality control for the audit organization of CFTC has been 

suitably designed and complied with to provide CFTC with reasonable assurance of performing 
16

and reporting in conformity with applicable professional standards in all material respects. CFTC 

OIG received the highest external peer review rating of “pass.”

Similarly, investigative peer reviews are conducted under CIGIE standards to ensure 

compliance with the requirements of the CIGIE Quality Standards for Investigations and to 

determine whether adequate internal safeguards and management procedures exist. Because it is 

a Designated Federal Entity Inspector General, the CFTC OIG is not required to undergo a peer 

review of its investigative function. CFTC OIG passed its last investigative peer review on 

March 27, 2013. It has not undergone a peer review since 2013 due to staff turnover in the 

Office of Investigations. 

SUMMARY of FINAL REPORTS NOT MADE PUBLIC

No reports of investigation were completed during this reporting period. 

During the reporting period, one audit report – CFTC’s Policies and Procedures Regarding 

Oversight of Cybersecurity Safeguard by Registered Entities – was completed and published, 

and one audit report – Fiscal Year (FY) 2020 FISMA Audit: Order Book On-Demand (OBOD) 

System Penetration Testing Results – was completed and not published, due to information 

technology sensitivity concerns. 

GAO LIAISON

OIG is charged with providing policy direction for, and conducting, supervising, and 

coordinating audits, investigations, and other projects relating to CFTC programs and operations. 

In addition, OIG is required to recommend policies for, and conduct, supervise, and coordinate 

with other federal agencies, state and local governmental agencies, and nongovernmental 

entities, audits, investigations, and evaluations regarding the economy, efficiency, and 

effectiveness of CFTC programs and operations.

GAO also conducts audits of CFTC activities, and OIG plans its audits, inspections, 

evaluations, reviews, and investigations so as not to duplicate GAO's efforts. Moreover, OIG in 

its audit activities identifies the goals of each audit and the methods of reaching the goals so as to 

minimize the requirements placed on CFTC resources. 
17

STRATEGIC PLAN for the OFFICE of INSPECTOR GENERAL

MISSION, VISION, AND VALUES

Mission

Our mission is to promote integrity, efficiency, and effectiveness by promoting for 

continuous improvement in our agencies' management and program operations of the CFTC. To

accomplish our mission, we: 

• Conduct independent and objective audits, reviews, and other types of engagements of the 

CFTC programs and operations;

• Conduct independent and objective investigations of potential criminal, civil, and 

administrative violations that could undermine the ability of the CFTC perform its mandated 

mission;

• Conduct independent and objective reviews of regulatory economic laws under the 

jurisdiction of the CFTC programs and operations;

• Identify maturity challenges in IT programs and make attainable recommendations to further 

mature them;

• Prevent and detect fraud, waste and abuse in CFTC programs and operations;

• Communicate timely and efficiently with CFTC programs and operations stakeholders by 

providing quick responses with value added results; and 

• Keep agency chairperson, commissioners and Congress fully and currently informed of 

significant issues and developments.

Vision Statement 

The OIG is an independent, professional organization that contributes to the success of 

the CFTC through audits, investigations, economic analysis, and other activities, and thereby acts 

as a champion for positive change in the CFTC’s programs and operations. 

Values Statement 

We most value integrity, accuracy, accountability, effective communication, and efficient 

operations. These values are fundamental to the accomplishment of our mission and our daily 

operations.
18

STRATEGIC GOALS FOR THE COMING YEAR

STRATEGIC GOAL 1: EVALUATE THE ECONOMIC IMPACT OF CFTC REGULATORY 

ACTIONS THROUGH LEGAL ANALYSIS, WHITE PAPERS, INSPECTIONS AND 

EVALUATIONS, MANAGEMENT REVIEWS, AND OTHER PRODUCTS

Office of Legal and Economic Review (OLER): Legislative, Economic, and Regulatory 

Review Agenda

OLER plans to continue to identify and explore areas where OIG legal and/or economic 

review might aid the CFTC in improving the economy and efficiency of its programs. OLER 

products may include white papers, management reviews, legal opinion, and other products.

28

These efforts are particularly important since the CFTC is an economic regulatory agency. We 

plan to replace an attorney/economist who departed in August 2019, and to add an attorney; this 

will restore OLER legal staff to 2017 levels. We will continue to seek staff that possesses

exceptional expertise in relevant law and economics.

STRATEGIC GOAL 2: ADDRESS HIGH IMPACT ISSUES IN CFTC ADMINISTRATIVE 

AND MISSION PERFORMANCE

Office of Audits: Audit and Review Agenda

A. Introduction

The primary objectives of OIG’s audit and review agenda are to promote long-term 

efficiency and effectiveness in the administration and operation of the Commission and to 

protect against fraud and abuse. The agenda and priorities for OIG are determined based on the 

following factors: 

• Adequacy of internal control systems as indicated by vulnerability assessments and 

internal control reviews recommended by OMB Circular A-123;

• Changes in the program conditions or particular vulnerability of the organization, 

program, activity, or function to problems or deficiencies;

• Current and potential dollar magnitude and likely benefits of a review on the efficiency or 

effectiveness of CFTC programs and operations;

• Management priorities and improvements that may be possible;

 

28 As stated in the Inspector General Act, it is our duty and responsibility to continually review existing and 

proposed legislation and regulations relating to CFTC programs and operations, and to make recommendations 

concerning the impact of such legislation or regulations on the economy and efficiency in the administration of such 

programs. 5 U.S.C. App. § 4(a)(2) (made applicable to the designated federal entity IGs at 5 U.S.C. App. §8G(g)).
19

• Results of audits of CFTC programs and operations by other federal agencies; and

• Availability of audit resources and the potential opportunity costs to the agency.

B. Annual Audits. The following required audits are performed on an annual basis.

Audit of CFTC Financial Statements

In FY 2002, Congress passed the Accountability of Tax Dollars Act.29 The Act requires 

the CFTC, along with numerous other Federal entities, to have its financial statements audited 

annually. To this end, OIG has engaged a contractor to provide the audit effort required to 

enable the contractor to render an opinion on the Agency’s financial statements for each fiscal 

year in accordance with generally accepted auditing standards, Government Auditing Standards

and OMB Bulletin 19-01.

Audit of the CFTC Customer Protection Fund

Section 748 of the Dodd-Frank Act30 requires the Agency to submit to Congress a yearly 

report on the Commission’s whistleblower award program that includes a complete set of audited 

financial statements, including a balance sheet, income statement, and cash flow analysis. To this 

end, OIG has engaged a contractor to perform the audit.

C. Annual Reviews. OIG will perform the following reviews and evaluations annually.

Inspector General’s Assessment of the CFTC’s Management Challenges

The Reports Consolidation Act of 200031 requires the Inspector General to summarize the 

most serious management and performance challenges facing the CFTC and to assess the 

Agency’s progress in addressing those challenges.

Review of Compliance with the Federal Managers' Financial Integrity Act, FMFIA32

In support of OMB Circular A-123, the Inspector General will evaluate, provide technical 

assistance and advise the Agency head as to whether the Agency's review and evaluation process 

was conducted in accordance with the circular's requirements.

 

29 See fn. 3. 

30 See fn. 4. 

31 P.L. 106-531, 114 Stat. 2537 (2000). 

32 P.L. 97-255, 96 Stat. 814 (1982). 
20

Evaluation of Compliance with Federal Information Security Management Act, FISMA

The Federal Information Security Management Act33 requires the Inspector General or 

his designee to perform annual independent evaluations of the information security program and 

practices of the Agency. This compliance may also be performed through an audit. 

D. Other Audits, Reviews, and Audit Projects; Data Analytics

OIG will focus the balance of its resources on the review of CFTC program and 

management operations (giving priority to activities relating to the most serious management 

challenges facing the CFTC), and compliance with Congressional mandates. Toward that end, 

OIG intends to increase the use of data analytics to enable audit operations. Data Analytics 

within the Office of Inspector General supports data services and analyses, and provides the 

competency to deliver short-turnaround projects that produce quick, valuable successes. Finally, 

OIG will stand ready to respond to issues and requests as they are received from Congress, the 

Agency, members of the public, or any other source. 

STRATEGIC GOAL 3: ADDRESS EMPLOYEE AND CONTRACTOR MISCONDUCT 

PROMPTLY, THOROUGHLY, AND RELIABLY

As a chain is only as strong as its weakest link, CFTC likewise depends on each and 

every employee and contractor to perform with competence, and to refrain from misconduct. 

CFTC OIG considers and investigates every credible allegation to ensure that CFTC employees 

and contractors uphold the public trust and perform their work with integrity and competence.

Office of Investigations: Investigative Agenda 

The Inspector General Act of 1978, as amended, provides that the Inspector General may 

receive and investigate complaints or information from the Commission's employees concerning 

the possible existence of an activity constituting a violation of law, rules or regulations; or 

mismanagement, gross waste of funds, or abuse of authority; or a substantial and specific danger 

to the public health and safety.

CFTC is an independent regulator with a mission that does not involve grants, substantial 

contracts, or other benefits to administer, and is therefore less likely than some agencies to 

generate a substantial investigative workload. Historically, OIG has conducted only a reactive 

investigative program, chiefly relying on unsolicited complaints as the source of investigative 

leads. Allegations and complaints are received primarily from CFTC staff and management, 

CFTC ethics officials, the general public, and Congress. We also receive referrals from law 

enforcement officers at other agencies. Should further experience show areas at CFTC on which 

to focus proactively, we will consider establishing an investigative agenda. To ensure that 

employee complaints easily reach OIG, we maintain a 24-hour hotline. The hotline phone 

number is (202) 418-5510. We also maintain an email address, oig@cftc.gov.

 

33 See fn. 2.
21

RESOURCES REQUIRED

OIG estimates that approximately four staff years of effort will be devoted over each of 

the next five years to the annual audit, the annual review, and the annual evaluation described 

above. OIG estimates three staff years of effort will be devoted over each of the next five years 

to the investigative, and legal and economic (legislative and regulatory) review functions. OIG 

estimates two staff years for management, administrative, and outreach efforts. Because OIG 

resources can be diverted at any time to an investigation, audit, inspection, evaluation, review, or 

other project that responds to current concerns or allegations, and must be completed in a timely 

fashion in order to be of assistance to the Agency or Congress, it is not possible to forecast with 

complete accuracy how resources will be utilized from year to year. 

CONTACTING the OFFICE of the INSPECTOR GENERAL

OIG is located at 1155 21st Street, N.W., Washington, D.C. 20581. Regular business 

hours are between 8:30 AM and 5:00 PM, Monday through Friday, except federal holidays. Our

general telephone number is (202)418-5110. Our facsimile number is (202)418-5522. The 

hotline email is OIG@cftc.gov. The hotline phone number is (202)418-5510. OIG’s web page is 

located at http://www.cftc.gov/About/OfficeoftheInspectorGeneral/index.htm. 
22

APPENDICES

Appendix 1 – Reports Issued with Questioned Costs

April 1, 2020 – September 30, 2020

Dollar Value

Thousands

Number Questioned Unsupported

A. For which no management decision has 

been made by the commencement of the

reporting period 0 0 0

B. Which were issued during the reporting 

period 0 0 0

Subtotals (A + B) 0 0 0

C. For which a management decision was 

made during the reporting period 0 0 0

( I ) dollar value of 

disallowed costs 0 0 0

( ii ) dollar value of costs not 

disallowed 0 0 0

D. For which no management decision

has been made by the end of the

reporting period 0 0 0
23

Appendix 2 – Reports Issued with Recommendations That Funds Be 

Put to Better Use

April 1, 2020 – September 30, 2020

Dollar Value

Number Thousands

A. For which no management decision has 

been made by the commencement of the

reporting period 0 0

B. Which were issued during the reporting 

period 0 0

Subtotals (A + B) 0 0

C. For which a management decision was 

made during the reporting period 0 0

( i ) dollar value of 

recommendations that

were agreed to by management

0 0

( ii ) dollar value of 

recommendations that

were not agreed to by

management 0 0

D. For which no management decision

has been made by the end of the

reporting period 0 0
24

Appendix 3 - Index of IG Act Reporting Requirements

Section 4(a)(2) Review of legislation and regulations..............................................14

Section 5(a)(1) Significant problems, abuses and deficiencies....................................7

Section 5(a)(2) Recommendations with respect to significant problems............................7

Section 5(a)(3) Significant recommendations that have not been completed..................10

Section 5(a)(4) Matters referred to prosecutorial authorities....................................13

Section 5(a)(5) Summary of instances where information was refused ..........................7

Section 5(a)(6) Completed audit reports................................................................7

Section 5(a)(7) Significant audit reports..............................................................7

Section 5(a)(8) Statistical Table—Questioned Costs.............................................22

Section 5(a)(9) Statistical Table—Funds Recommended for Better Use .....................23

Section 5(a)(10) Audit reports lacking management decision ...................................10

Section 5(a)(10) Audit reports without Commission response after 60 days..................10

Section 5(a)(10) Audit reports for which there are any outstanding unimplemented 

recommendations, including the aggregate potential cost savings .........10

Section 5(a)(11) Significant revised management decisions .....................................10

Section 5(a)(12) Significant management decisions where the IG disagrees..................10

Section 5(a)(13) Information described under § 804(b) of the Federal Financial 

Management Improvement Act of 1996 .....................................N/A

Section 5(a)(14)-(16) Peer Review information ........................................................15

Section 5(a)(17) Statistical tables for investigations.............................................13

Section 5(a)(18) Description of metrics used to develop the statistical tables for 

investigations......................................................................13

Section 5(a)(19) Report on each investigation involving a senior Government employee 

where allegations of misconduct were substantiated .........................13

Section 5(a)(20) Whistleblower retaliation findings ..............................................13

Section 5(a)(21) Attempts to interfere with OIG independence .................................6

Section 5(a)(22) Summary of final reports not made public.....................................16

Section 6(b)(2) Summary of reports to Chairman where assistance was refused.............7