U.S. COMMODITY FUTURES TRADING COMMISSION

OFFICE OF INSPECTOR GENERAL

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

TO: Rostin Behnam, Chairman

Kristin Johnson, Commissioner

Christy Goldsmith Romero, Commissioner

Summer Mersinger, Commissioner

Caroline Pham, Commissioner

FROM: A. Roy Lavik, Inspector General 

DATE: September 26, 2022 

SUBJECT: Inspector General’s Assessment of the Most Serious 

Management and Performance Challenges Facing 

the Commodity Futures Trading Commission FY

2022 

The Reports Consolidation Act of 2000 (RCA)1 requires the Inspector General to 

summarize the “most serious management and performance challenges facing the

agency” and briefly assess the Agency’s progress in addressing those 

challenges.2 Management challenges are “programs or management functions, 

within or across agencies, that have greater vulnerability to waste, fraud, abuse, 

and mismanagement (such as issues identified by the Government Accountability 

Office as high risk or issues identified by an Inspector General) where failure to 

perform well could seriously affect the ability of an agency to achieve its mission or 

goals.”3 This memorandum fulfills our duties under the RCA. 

To complete our assessment, we relied on data contained in the CFTC financial 

statement audit and Agency Financial Report, representations by agency 

management, and our knowledge of industry trends and CFTC operations. 

 1 P.L. 106-531, § 3, 114 STAT. 2537 (Nov. 22, 2000), codified at 31 U.S.C. § 3516(a). All links last accessed 

on September 26, 2022.

2 Id.

3 Government Performance and Results Modernization Act of 2010, P.L. 111-352, § 3, 124 STAT. 3866 

(Jan. 4, 2011), codified at 31 U.S.C. § 1115(h)(5). 
2 

CFTC’s Progress on FY 2021 Management and Performance Challenges

For FY 2021, we highlighted information technology (IT) modernization and data 

governance as management challenges, and recognized the Agency appointed

a new Chief Information Officer (CIO) and established the position of Chief Data 

Officer (CDO). During FY 2022, we recognize that the CIO is completing CFTC’s

migration to a cloud environment and the CDO is advancing the analytic use of

structured and unstructured data to detect potential misconduct, including 

manipulation of markets. We will continue to monitor the progress of CFTC’s

technological initiatives. 

Fiscal Year (FY) 2022 Management and Performance Challenges

We also highlighted three other management challenges for FY 2021 which 

remain for FY 2022, as discussed below.

Climate Change

Climate change impacts the CFTC’s mission, its physical assets and 

infrastructure, as well as the businesses of market participants. In this regard, 

we note Chairman Behnam launched the CFTC Climate Risk Unit (CRU) in 

March 20214 and is evaluating the Financial Stability Oversight Council 

recommendations5 related to climate change financial risks in collaboration with 

the Commission. We recognize that CFTC is currently evaluating responses to

its June 2022 Request for Information on Climate-Related Financial Risk.6 We 

also recognize the Supreme Court’s recent holding that, under the "major 

questions doctrine," a federal regulatory agency may not adopt rules that are 

"transformational" to the economy unless Congress has specifically authorized 

such a transformative rule to address a specific problem, like climate change.7

Management of IT (Cybersecurity)

Threats to system information, including Personally Identifiable Information 

(PII), are a continuing management challenge. CFTC is updating its security 

 

4 CFTC Release No. 8368-21, CFTC Acting Chairman Behnam Establishes New Climate Risk Unit, March 

17, 2021. 

5 FSOC Report on Climate-Related Risk, October 21, 2021. 6 87 FR 34856, June 8, 2022. 7 West Virginia v. Environmental Protection Agency, No. 20-1530, p. 20, 597 U.S. ___ (June 2022). 
3 

policies to comply with new requirements and continues to devote resources to 

its real-time cyber threat response program. 

Emerging in this area are the intersections of privacy and enterprise risk 

management requirements that integrates them into business objectives. We 

recognize that CFTC is integrating privacy controls with systems controls to 

prevent loss. However, we believe the Privacy Office may be challenged by 

staffing shortages for an increasing workload. 

Enterprise Risk Management

As it relates to Enterprise Risk Management (ERM), CFTC’s ERM program can 

become an operational asset for the Commission to prioritize and respond to a 

variety of internal and external risks, including cyber related risks. In March 

2021, the CFTC hired its first Chief Risk Officer (CRO), who reports directly to 

the head of the Division of Administration (DA). We recognize that CFTC’s 

2022-2026 Strategic Plan shows a commitment to ERM. However, the CRO is 

organizationally distant from the Commission, and may be under resourced, 

which may challenge the program’s governance, culture, and operational 

success. We will continue to monitor this area. 

Efficient Leased Space Following the Establishment of Post-Pandemic Telework 

and Remote Work Policies

The fourth management challenge is new for FY 2022. CFTC’s four leased 

facilities have been underutilized since March 2020.8 We note that until the 

Chairman finalizes a post-pandemic policy for telework and remote work, and 

updates office space requirements accordingly, taxpayers continue to 

needlessly pay for unused space. Space needs may decrease as a result of 

expanded post-Pandemic telework/remote work policy following negotiations 

with the Union.9 While space utilization may return to prior levels, or even 

increase, if CFTC is given additional regulatory responsibilities, that is not the 

 

8 On March 13, 2020, the CFTC Office of the Executive Director (OED) announced that, effective March 16, 

2020, and until further notice, all CFTC offices will be open and all employees will have the option of 

unscheduled leave or unscheduled telework until further notice. CFTC began a Phase I reopening on 

October 1, 2021, with participation 100% voluntary. In June 2022, OED announced a Phase II reopening, 

which “allows the 100% voluntary return to the CFTC’s office of a limited number of staff, and provides 

procedures in limited cases where staff may be directed to a CFTC office to perform a specific task.” 

However, the June 2022 communication stated that Phase II will only take place “following negotiations with 

the Union.” Negotiations were not completed (and announced to staff) as of Friday, September 23, 2022. 9 See fn.8.
4 

current situation and we note that CFTC has a history of spending taxpayer 

funds on underutilized lease space.10 We are currently conducting an inspection 

and evaluation of leased space utilization at CFTC, and will continue our work 

in what may be a period of significant change for CFTC’s space needs. 

The management challenges relating to CFTC’s cloud migration, ERM efforts, 

cyber response program, establishment of the CRU, and its evolving space 

needs, all address risk-related priorities communicated in several Executive 

Orders.11 We will continue to monitor the progress of CFTC’s risk related 

programs as they mature.

Cc: 

David Gillers, Chief of Staff

Bruce Fekrat, Chief Counsel

Joseph R. Cisewski, Chief of Staff and Senior Counsel

Chris Lucas, Chief of Staff and Counsel 

Meghan Tente, Chief of Staff

Laura Gardy, Acting Executive Director

Janaka Perera, Acting Executive Director

Robert Schwartz, General Counsel

Joel Mattingley, Chief Financial Officer

John Rogers, Senior Advisor

 

10 In 2016 GAO reported: “CFTC did not make cost-effective decisions consistent with leading government 

guidance for lease procurement and internal controls when planning for additional space in fiscal years 

2008–2015.” GAO, Commodity Futures Trading Commission Needs Better Guidance to Improve CostEffectiveness, GAO-16-434 (April 18, 2016). See also, CFTC OIG, A Review of Leasing and Occupancy 

Levels of the Kansas City Regional Office of the Commodity Futures Trading Commission, June 2014

(between 2010 and at least June 2014, CFTC leased space for 75 workers in one field office while 

maintaining only approximately 27 workers). 11 Executive Order on Protecting Americans’ Sensitive Data from Foreign Adversaries, EO 14034, June 9, 

2021; Executive Order on Improving the Nation’s Cybersecurity, EO 14028, May 12, 2021; Executive Order 

on Climate-Related Financial Risk, EO 14030, May 2021; and OMB M-21-25, Integrating Planning for A 

Safe Increased Return of Federal Employees and Contractors to Physical Workplaces with Post-Reentry 

Personnel Policies and Work Environment, June 21, 2021.