Inspector General’s Semiannual Report to Congress

Access to Information
The IG is to be provided with ready access to all agency records, information or assistance
when conducting an investigation or audit. Section 6(b)(2) of the IG Act requires the IG to report to
the agency head, without delay, if the IG believes that access to required information, records or
assistance has been unreasonably refused, or otherwise has not been provided. A summary of each
report submitted to the agency head in compliance with Section 6(b)(2) must be-provided in the

semiannual report in accordance with Section 5(a)(5) of the Act.

During the reporting period, the OIG did not encounter any difficulties in obtaining assistance
or access to agency records. Consequently, no report was issued by the IG to the agency head in
accordance with Section 6(b)(2) of the IG Act.

Audit Resolution
As of the end of this reporting period, all OIG audit recommendations for reports issued in
prior periods have been resolved. That is, management and the OIG have reached agreement on

what actions need to be taken.

Contacting the Office of Inspector General
Employees and the public are encouraged to contact the OIG regarding any incidents of

possible waste, fraud or abuse occurring within FMC programs and operations. The OIG telephone
number is (202) 523-5863. To report suspected wrongdoing, employees or the public may call the
OIG Hotline on (202) 523-5865. A confidential or anonymous message can be left 24 hours a day.

Complaints or allegations of fraud, waste or abuse can also be emailed to OIG@FMC.GOV.

—— oer
October 1, 2006 - March 31, 2007 Page 11


Inspector General's Semiannual Report to Congress

SS a

BACKGROUND
The FMC is an independent agency responsible for the regulation of oceanborne
transportation in the foreign commerce of the United States. The principal statutes or statutory
provisions administered by the Commission are the Shipping Act of 1984, as amended by the Ocean
Shipping Reform Act of 1998; the Foreign Shipping Practices Act of 1988; and Section 19 of the
Merchant Marine Act of 1920.

The FMC is currently headed by four Commissioners nominated by the President and
confirmed by the Senate, each serving five-year terms. During this reporting period the Chairman
resigned. A new Chairman has not been appointed as of this writing. As a result, the remaining
members of the Commission are jointly serving as the agency’s chief executive and administrative

officer.

In Fiscal Year (FY) 2007, the Commission was authorized a total of 125 full-time equivalent
positions with a total appropriation of $20,427,910. Although the majority of the Commission’s
personnel are located in Washington, DC., the Commission also maintains a presence in Los
Angeles, South Florida, Seattle/Tacoma, New York and New Orleans through area representatives
who serve the major ports and transportation centers within their respective geographic areas. In

addition, two at-large area representatives operate out of Washington, DC.

The FMC’s Office of Inspector General (OIG) was established in 1989 as required by the
Inspector General Act Amendments of 1988 (5 U.S.C. app.). The OIG is an independent audit and
investigative unit headed by an Inspector General (IG) who reports directly to the Chairman of the
FMC.

The OIG is responsible for conducting audits and investigations relating to the programs and

operations of the FMC. Audits are conducted for the purpose of finding and preventing fraud, waste

a — == a oe
October 1, 2006 — March 31, 2007 Page 2



HOTLINE COMPLAINTS

The success of the OIG mission to prevent fraud, waste and abuse
depends on the cooperation of FMC employees and the public.

A ComPLainT CAN BE REPORTED By CALLING Our 24-HR DIRECT LINE

’ (202) 523-5865

E-mail ADDRESS:

oig@fmc.gov

To PLAcE A CompPLaInT IN WRITING PLEASE MAIL To:

Federal Maritime Commission
Office of Inspector General
Room 1054

800 North Capitol Street, NW
Washington, DC 20573

the IG Onl

THE INFORMATION You PROVIDE Is CONFIDENTIAL AND You CAN BE ANONYMOUS

However, EACH GaLver Is ENCOURAGED To ASSIST THE INSPECTOR GENERAL BY
SUPPLYING INFORMATION AS To How THEY May Be CONTACTED FOR ADDITIONAL INFORMATION


Inspector General's Semiannual Report to Congress

statement of work, including deliverables, (iii) the selection process, evaluation criteria and scoring,
(iv) contract award, (v) contract monitoring, (vi) approval of invoices, including all supporting
documentation for days worked, mileage, lodging and other billed expenses, and (vii) the
justification and timing of contract modifications. The draft report was issued to management for

comment at the end of the reporting period.

The OIG completed its review of data accuracy in the FY 2006 Performance and
Accountability Report (PAR). The objectives of this review were to (i) determine whether
information externally reported in the FY 2006 PAR is accurate and (ii) assess, on a sample basis,

whether processes in place used to compile the data are reliable.

The OIG also began planning activities and preliminary fieldwork associated with performing
a penetration test of the FMC’s outward-facing network. The objectives of the test are to (i)
determine whether the FMC network can be accessed by unauthorized users; (ii) document the risks
to FMC’s network caused by threats from the Internet; and (iii) identify vulnerabilities (if any)
residing on the FMC’s firewall.

Finally, the OIG selected a new independent auditor to assist the IG with the office’s annual

financial statement audit.

INVESTIGATIVE ACTIVITIES
The Inspector General Act of 1978, as amended, provides that the IG may receive and
investigate complaints or information concerning the possible allegations of fraud, waste and abuse
occurring within FMC programs and operations. Matters of possible wrongdoing are referred to the
OIG in the form of allegations or complaints from a variety of sources, including FMC employees,

other government agencies and the general public.

———— worse
October 1, 2006 — March 31, 2007 Page 7


Inspector General's Semiannual Report to Congress

ORO7-01 Review of FMC’s Information Technology Plan
of Actions and Milestones

Summary of Audits Issued During the Current Period

In A07-01, Audit of the Federal Maritime Commission’s Financial Statements for the
Fiscal Year Ending September 30, 2006, the objective was to determine whether the agency’s
financial statements present fairly the financial position of the agency. The statements audited were
the Balance Sheets as of September 30, 2006 and 2005, and the related statements of Net Cost,
Statements of Changes in Net Position, Statements of Budgetary Resources, Statements of Financing
and Statements of Custodial Activity for the years then ended. The FMC’s accounting services
provider, the Bureau of Public Debt, prepared the agency’s financial statements in accordance with
OMB Circular A-136, Form and Content of Agency Financial Statements (08/23/05). This was the
third consecutive year that the FMC submitted financial statements for audit. As in the two prior

years, the agency received an unqualified opinion, the highest opinion given by independent auditors.

The FY 2006 audited statements provide insight into the mission and operations of the
Federal Maritime Commission. The FMC had total assets of $2.7 million and $2.3 million as of
September 30, 2006 and 2005, respectively. The FMC has a single source of funds, Salaries and
Expenses, funded by an annual appropriation that is available for commitments and obligations
incurred during the fiscal year in which the authority was granted. The FMC’s budget authority for
fiscal year 2006 was $20.5 million. This represents a net increase in budget authority over fiscal year
2005 of $1 million. Although the FMC collects remittances for “user fees” and “fines and
penalties,” the agency is not authorized to offset any of its budget authority by utilizing these funds.
The collections, totaling $1.6 million in FY 2006, are deposited directly into the Treasury General
Fund.

seceemc = anes
October 1, 2006 - March 31, 2007 Page 4


Inspector General's Semiannual Report to Congress

and abuse and to promote economy, efficiency and effectiveness within the agency. OIG
investigations seek out facts related to allegations of wrongdoing on the part of FMC employees and
individuals or entities having contracts with or obtaining benefits from the agency. The Inspector
General Act provides that the OIG shall have access to all agency records and may subpoena records

from entities outside of the agency in connection with an audit or investigation.

The OIG is required by law to prepare a semiannual report summarizing its audits and
investigations during the immediately preceding six-month period. The report is sent to the FMC
Chairman, the President of the Senate, the Speaker of the House and FMC’s appropriating and
authorizing committees. This dual reporting requirement facilitates and ensures the independence of

the Office.

AUDITS/EVALUATIONS
During this semiannual period, the OIG issued an audit of the FMC’s FY 2006 financial
statements and a companion report to management on financial-related findings and
recommendations resulting from the audit. We also issued an operational review (OR) of actions
taken by management to mitigate previously-identified IT security vulnerabilities. Finally, we
completed two draft audit reports and began planning for a penetration test of the agency’s outward-

facing IT network.

Issued Audits and Reviews

Audit Report Number Subject of Audit
A07-01 Audit of the Federal Maritime Commission’s
Financial Statements for the Fiscal Year Ending
September 30, 2006
A07-01A Management Letter to the FY 2006 Audited

Financial Statements

a
October 1, 2006 — March 31, 2007 Page 3



Inspector General's Semiannual Report to Congress

Milestones (POA&M) report to the Office of Management and Budget and (ii) its progress in

correcting information security weaknesses identified on the POA&M.

The POA&M is the authoritative and comprehensive agency management mechanism used to
prioritize, track and manage all agency efforts to close security performance gaps. In addition to
identifying tasks that need to be accomplished, it also details resources required to accomplish the
elements of the plan, significant milestones associated with implementing the corrective actions and
scheduled completion dates for the milestones. The POA&M is used, in part, as a basis for OMB’s
assessment of agency information technology (IT) security status as part of the President’s

Management Agenda Scorecard under the e-Government score.

In our FY 2006 FISMA Report (A06-04, October 2, 2006), the OIG found that the FMC had
been inaccurately reporting to OMB the results of its POA&M process. Based on our more recent
operational review, it appears that the agency has made the necessary changes in its processes to

ensure accurate reporting.

To test the effectiveness of agency actions to IT security weaknesses, the OIG selected 11
weaknesses tracked on the POA&M as of December 31, 2006. The OIG identified the weaknesses,
the OIG-recommended actions to address the weaknesses, the status of corrective actions and the
estimated completion dates. As a result of our analysis, the OIG concluded that the agency made

substantial progress in prioritizing, tracking, and managing weaknesses and corrective actions.

Audits and Reviews in Process
The OIG completed a draft report on the administration of a large contract with one
individual for organizational development-type services. The objective of the audit was to determine
whether Federal Acquisition Regulation (FAR) provisions were followed throughout all phases of

the contract. To meet this objective, the OIG reviewed (i) how the need was determined, (ii) the

October 1, 2006 - March 31, 2007 Page 6


Office of Inspector General

Semiannual Report
To the Congress

Covering the Period
October 1, 2006 to March 31, 2007

FEDERAL MARITIME COMMISSION



Inspector General's Semiannual Report to Congress

Executive Council on Integrity and Efficiency Activities

The Executive Council on Integrity and Efficiency (ECIE) was established by Executive
Order 12805 on May 11, 1992, to:

¢ address integrity, economy and effectiveness issues that transcend individual government

agencies, and

e enhance the professionalism and effectiveness of IG personnel throughout the

government.

To accomplish its mission, the ECIE members participate in interagency and inter-entity
audit, inspection and investigation projects to promote economy and efficiency in Federal programs
and operations and address more effectively government-wide issues of fraud, waste and abUse TDG
Council members also develop policies, standards and approaches to aid in the establishment of a

well-trained and highly skilled IG workforce.

The inspector general and assistant inspector general continued to serve on the Executive
Council on Integrity and Efficiency and Federal Audit Executive Council (FAEC). The ECIE serves
as a forum for the exchange of views for the inspector general community and provides a base for the
establishment of joint inspector general projects. The FAEC is comprised of senior audit staff who
discuss and coordinate issues affecting the Federal audit community with special emphasis on audit

policy and operations of common interest to FAEC members.

Peer Review Activities
Federal Offices of Inspector General are required by the IG Act to have a peer review

performed on their organization once every three years. These reviews are to be performed only by

—— were
October 1, 2006 — March 31, 2007 Page 9


Inspector General's Semiannual Report to Congress

During this reporting period, the OIG closed a preliminary investigation that was opened in
the prior reporting period concerning the agency’s granting of an ocean transportation intermediary
license to one particular applicant. The OIG met with managers in the affected bureau and reviewed
the criteria and procedures behind the approval of this license. Based on this review, we closed the

preliminary investigation.

The OIG also responded to two hotline complaints regarding various port and shipping-related
issues. After preliminary fieldwork, the OIG closed both preliminary investigations. The OIG also
referred questions raised by an industry representative about FMC enforcement processes to
appropriate FMC enforcement staff. Near the end of the reporting period, the OIG opened a
preliminary investigation into possible wrongdoing by an agency contractor. Fieldwork was still

ongoing at the conclusion of the reporting period.

The OIG referred no matters to prosecutorial authorities during the period.

OTHER OIG ACTIVITIES
Review of Legislation
As required by the Inspector General Act of 1978, as amended, the Office of Inspector
General routinely reviews proposed legislation and regulations. The purpose of these reviews is to
assess whether the proposed legislation or regulation (1) impacts on the economy and efficiency of
FMC programs and operations, and (2) contains adequate internal controls to prevent and detect

fraud and abuse.

During this period, a number of legislative proposals as well as Commission Orders/policy
guidelines were reviewed by this Office. The OIG also worked with Office of Administration staff

to update three agency procedures regarding agency/OIG interaction.

a= —
October 1, 2006 — March 31, 2007 Page 8


Inspector General's Semiannual Report to Congress

As part of the audit, the OIG reviewed and tested the Commission’s compliance with laws
and regulations. The review disclosed no instances of noncompliance that are required to be
reported under Government Auditing Standards (GAS) or OMB Bulletin 06-03, Audit Requirements
for Federal Financial Statements (08/23/05). In addition, the OIG examined compliance with the
Federal Financial Management Improvement Act (FFMIA) of 1996. Our review disclosed no
instances in which FMC’s financial management systems did not comply substantially with FFMIA,
GAS or OMB.

The OIG review of internal control over financial reporting did not find any matters involving
the internal control and its operations that were considered material weakness in the systems and
processes we tested. On the other hand, the OIG did identify vulnerabilities in agency financial

systems that warranted some corrective actions.

These findings are presented in AO7-01A, FY 2006 Management Letter to the Financial
Statements. The identified vulnerabilities involved insufficient (i) follow up with service providers
to ensure that security-related vulnerabilities are addressed and (ii) reconciliations between annual

and sick leave balances on employee leave records and System Time and Attendance Reporting.

The Commission’s management addressed these vulnerabilities by (i) sending letters to its
service providers requesting information relating to information security-related weaknesses and
addressing other IT security weaknesses made in A06-04, Review of FMC Implementation of
FISMA for FY 2006; and (ii) instructing employees to verify their accrued annual and sick leave
balances and their pay and deductions periodically to ensure their accuracy. Managers also sent

instructions to timekeepers and supervisors to assist them with leave reconciliations.

In ORO7-1, Review of FMC’s Information Technology Plan of Actions and Milestones, the

objectives were to assess (i) the accuracy of the agency’s December 1, 2006, Plan of Action &

— = —
October 1, 2006 - March 31, 2007 Page5


Inspector General's Semiannual Report to Congress

EXECUTIVE SUMMARY

This Semiannual Report to the Congress summarizes the activities and accomplishments of
the Federal Maritime Commission (FMC or Commission), Office of Inspector General (OIG) for the
period October 1, 2006 through March 31, 2007. During this period we issued two audit reports to
the Commission on the FMC’s FY 2006 financial statements and a companion report to management
containing financial-related findings and recommendations resulting from the audit. The OIG also
issued an evaluation of actions taken by system administrators to address prior information
technology (IT) security weaknesses. The OIG completed draft reports on the agency’s administration
of a contract for organization development consulting services and on the accuracy of information
reported to Congress, the Office of Management and Budget and agency stakeholders in the FY 2006
Performance and Accountability Report (PAR). We also commenced planning for a penetration test

of the agency’s firewall.

On the investigative side, we closed a preliminary investigation that was opened in the prior
reporting period, opened a preliminary investigation into possible wrongdoing by an agency

contractor and responded to three hotline complaints from the public.

We underwent a peer review of our (OIG) audit quality control program and performed an
identical review of a sister OIG. We also prepared a narrative summary of “management challenges”
facing the FMC as it moves forward into the 21* century for inclusion in the FY 2006 PAR. Finally,
the OIG contracted with a new independent public accounting firm to assist the IG in issuing an

opinion of the agency’s FY 2007 financial statements.

Details on these and other activities are provided below.

== — Sciam
October 1, 2006 - March 31, 2007 Page 1


Inspector General's Semiannual Report to Congress

SUMMARY OF INSPECTOR GENERAL’S REPORTING REQUIREMENTS

IG Act
Reference Reporting Requirement Page(s)

Section 4(a)(2) Review of legislation and regulations 8

Section 5(a)(1) Significant problems, abuses and deficiencies None

Section 5(a)(3) Prior significant recommendations on which 11
corrective actions have not been made

Section 5(a)(4) Matters referred to prosecutive authorities 8

Section 5(a)(5) Summary of instances where information was 10
refused

Section 5(a)(6) List of audit reports by subject matter, showing 13-14
dollar value of questioned costs and funds put to
better use

Section 5(a)(7) Summary of each particularly significant report 4

Section 5(a)(8) Statistical tables showing number of reports and 13
dollar value of questioned costs

Section 5(a)(9) Statistical tables showing number of reports and 14
dollar value of recommendations that funds be put
to better use

Section 5(a)(10) Summary of each audit issued before this reporting 13-14
period for which no management decision was
made by the end of the reporting period

Section 5(a)(11) Significant revised management decisions 10

Section 5(a)(12) Significant management decisions with which the 10
inspector general disagrees

== ee somes
October 1, 2006 — March 31, 2007

Page 12


Inspector General's Semiannual Report to Congress

ssssaseeses ass SUE EEE
TABLE IT

INSPECTOR GENERAL ISSUED REPORTS
WITH RECOMMENDATIONS
THAT FUNDS BE PUT TO BETTER USE

Number Dollar Value
. For which no management decision has been made 0 0
by the commencement of the reporting period
. Which were issued during the reporting period 0 0
Subtotal (A plus B) 0 0
. For which a management decision was made during 0 0
the reporting period
(i) dollar value of recommendations that were 0 0
agreed to by management
(ii) dollar value of recommendations that were 0 0
not agreed to by management
. For which no management decision has been made 0 0
by the end of the reporting period
Reports for which no management decision was 0 0

made within six months of issuance

ee a ae
October 1, 2006 - March 31, 2007 Page 14


TABLE OF CONTENTS

Transmittal Letter

Executive Summary...

WO NGI spec ccasacxccccanae iii pmabban ic eaecebSN Nieto eavonenenaanen anernenouensnengnnendveantereesannsnenes 2

Summary of Audits Issued During the Current Period
Audits and Reviews in Process

Investigative Activities

Other OIG Activities ........sceccccssesssssssecsssseesessnsesssssseccsssscessssecessssssesssssssssssuscesrsueeeessnusessssnsessssaseceens 8
Summary of Inspector General’s Reporting Requirements..............0..cccsscseccecseeseeseesenseeseee 12
Table I. IG Issued Reports with Questioned Costs ........sssssssssesssssssessscsesssssseesssesssssaneeeeees 13

Table Il. IG Issued Reports with Recommendations That Funds Put to Better Use


FEDERAL MARITIME COMMISSION
Office of Inspector General
Washington, DC 20573-0001

April 30, 2007

Tel: (202) 523-5863

Office of Inspector General Fax: — (202) 566-0043
E-mail: oig@fme.gov

Federal Maritime Commission
Washington, DC 20573

Dear Commissioners:

The attached report is submitted in accordance with Section 5 of the Inspector General
Act of 1978, as amended by the Inspector General Act amendments of 1988. It
summarizes the activities of the Office for the period October 1, 2006 to March 31, 2007.
The Act requires that you transmit the report to the appropriate committees of the
Congress within 30 days of receipt. Your transmittal should also include any comments
you consider appropriate and other statistical tables and reports required by law.

During this period, the Office of Inspector General (OIG) issued two audit reports to the
Commission on the FMC’s FY 2006 financial statements and financial-related activities.
The OIG also issued an evaluation of corrective actions to address previously-identified IT
security issues and completed draft reports on contract administration and on the accuracy
of information reported in the FY 2006 Performance and Accountability Report (PAR).
We also commenced planning for a penetration test of the agency’s firewall.

On the investigative side, we closed a preliminary investigation that was opened in the
prior reporting period, opened a preliminary investigation into possible wrongdoing by an
agency contractor and responded to three hotline complaints from the public.

We underwent a peer review of our (OIG) audit quality control program and performed an
identical review of a sister OIG. We also prepared a narrative summary of “management
challenges” facing the FMC for inclusion in the FY 2006 PAR.

During the reporting period, the OIG’s assistant inspector general served a two-month
rotational assignment in the agency’s Bureau of Certification & Licensing as part of the
FMC’s Emerging Leaders Program.

As in the past, management has been responsive in attempting to implement all OIG

recommendations. I appreciate management’s support and I look forward to working
with you in our ongoing efforts to promote economy and efficiency in agency programs.

4225,

Inspector Geni


Inspector General's Semiannual Report to Congress

Federal auditors. A committee of the ECIE schedules the review to ensure that resources are

available to perform them and that OIG’s do not conduct reciprocal reviews.

The objectives of a peer review are to determine for the audit function whether an effective
quality control system has been established in the office and if policies, procedures and applicable

government auditing standards are being followed.

Against this background, the FMC/OIG was reviewed by the inspector general and staff from
the National Credit Union Association (NCUA). In the opinion of the NCUA IG, the system of
quality control for the FMC/OIG audit function in effect for the year ended September 30, 2006, was
designed to meet the requirements of the quality control standards established by the Comptroller
General of the United States for a Federal Government audit organization and was complied with
during the year ended to provide the OIG with reasonable assurance of conforming with applicable
auditing standards, policies and procedures. The report in its entirety is posted on the FMC/OIG web

Site.

Also during this reporting period, the OIG performed an identical review of the

Appalachian Regional Commission and issued an opinion of its quality control program.

Significant Management Decisions
Section 5(a)(12) of the Inspector General Act requires that if the IG disagrees with any

significant management decision, such disagreement must be reported in the semiannual report.
Further, SectionS(a)(11) of the Act requires that any decision by management to change its response
to a significant resolved audit finding must also be disclosed in the semiannual report. For this
reporting period, there were no significant management decisions made on which the IG disagreed

and management did not revise an earlier decision on an OIG audit recommendation.

= = ce a
October 1, 2006 - March 31, 2007 Page 10


Inspector General's Semiannual Report to Congress

TABLEI
INSPECTOR GENERAL ISSUED REPORTS
WITH QUESTIONED COSTS
Dollar Value

Questioned ~— Unsupported

Number Cost Costs

A. For which no management decision has been

made by the commencement of the reporting

period 0 0 0
B. Which were issued during the reporting 0 0 0

period?

Subtotal (A + B) 0 0 0
C. For which a management decision was made 0 0 0

during the reporting period

@ dollar value of disallowed costs 0 0 0

(ii) dollar value of costs not disallowed

0 0 0

D. For which no management decision has been

made by the end of the reporting period 0 0 0
E. Reports for which no management decision

was made within six months of issuance 0 0 0

= ere —
October 1, 2006 — March 31, 2007 Page 13