FEDERAL MARITIME COMMISSION 

Office of Inspector General 

Semiannual Report to Congress 

Covering the Period 

 

April 1, 2023 – September 30, 2023 
FEDERAL MARITIME COMMISSION

Washington, DC 20573

Office of Inspector General

October 31, 2023 

Dear Chairman Maffei and Commissioners Dye, Sola, Bentzel and Vekich: 

The following report is submitted in accordance with Section 5 of the Inspector General 

Act of 1978, as amended. This report summarizes the activities of the Federal Maritime 

Commission (FMC) Office of Inspector General (OIG) for the period April 1, 2023 to September 

30, 2023. 

During this reporting period, the OIG completed two audits and one review, and initiated 

another audit. Additional details on these assignments can be found in the enclosed report. The 

OIG continues to appreciate the cooperation and commitment to integrity and ethical values 

demonstrated by FMC’s leadership and staff.

 Respectfully submitted,

 Jon Hatfield 

 Inspector General

Enclosure 

CC: Office of the Managing Director

Office of the General Counsel
TABLE OF CONTENTS

Transmittal Letter

EXECUTIVE SUMMARY ....................................................................................................................... 1

FEDERAL MARITIME COMMISSION..................................................................................................... 1

OFFICE OF INSPECTOR GENERAL ......................................................................................................... 2

OFFICE OF INSPECTOR GENERAL ACTIVITIES........................................................................................ 3

Completed Assignments ...................................................................................................................................... 3

Open Audit........................................................................................................................................................... 5

Hotline and Investigations ................................................................................................................................... 5

Review of Legislation ........................................................................................................................................... 6

Council of the Inspectors General on Integrity and Efficiency (CIGIE) Activities ................................................. 6

SUMMARY OF INSPECTOR GENERAL REPORTING REQUIREMENTS....................................................... 7

TABLE I - Summary of Reports with Corrective Actions Outstanding for More than 6 Months............. 8

TABLE II - Listing of Reports Issued.................................................................................................... 8

TABLE III - Reports with Questioned Costs......................................................................................... 9

TABLE IV - Recommendations that Funds be Put to Better Use ........................................................10

Appendix A - Peer Review Activity ..................................................................................................11

Pictured: Seagirt Marine Terminal, Port of Baltimore, Maryland

 
1 

EXECUTIVE SUMMARY

This semiannual report summarizes the activities and accomplishments of the Federal 

Maritime Commission (FMC), Office of Inspector General (OIG) for the six-month reporting 

period April 1, 2023 through September 30, 2023. During this reporting period, the OIG 

completed two audits and one review, and initiated another audit. Specifically, the OIG completed 

an audit of the FMC’s compliance with the Federal Information Security Modernization Act 

(FISMA) and an Information Technology Vulnerability Audit. The OIG also completed a review 

of the FMC’s compliance with reporting and performance requirements regarding improper 

payments required by the Payment Integrity Information Act of 2019 (PIIA). During this period, 

the OIG initiated the annual audit of the agency’s financial statements. The details on these 

assignments can be found in subsequent sections of this report. 

Two new hotline complaints were received, and two hotline complaints were closed during 

the reporting period. Four hotline complaints were open at the end of this reporting period and 

there were no open investigations or matters referred to prosecutorial authorities during this period. 

FEDERAL MARITIME COMMISSION

The FMC is an independent Federal agency responsible for ensuring a competitive and 

reliable ocean transportation supply system that supports the U.S. economy and protects the public 

from unfair and deceptive practices. The agency regulates the international ocean transportation 

supply system (vessel liner carriers, ocean transportation intermediaries, and marine terminal 

operators). 

The FMC is composed of five Commissioners nominated by the President and confirmed 

by the Senate, each serving a staggered five-year term. The Commission is a bipartisan body; no 

more than three members of the Commission may be of the same political party. One 

Commissioner, designated by the President, serves as the Chairman, Chief Executive, and Chief 

Administrative Officer of the Commission. The Inspector General reports to all five 

Commissioners. Although most FMC personnel are in Washington, D.C., the FMC also has 

investigative staff located in major port and transportation centers. The Commission’s 

Investigators focus on enforcement activity in one of the three regions: the Northeast and Midwest; 

Southeast and Gulf; and West Coast. 
2

OFFICE OF INSPECTOR GENERAL

The OIG was established in 1989 by the Inspector General (IG) Act of 1978, as amended 

(5 U.S.C. app.). The OIG is an independent audit and investigative unit headed by an IG who 

reports to the FMC Commissioners and Congress. The OIG is responsible for conducting audits 

and investigations relating to the programs and operations of the FMC. Audits are conducted for 

the purpose of detecting and preventing fraud, waste, and abuse, and promoting economy, 

efficiency, and effectiveness within the agency. The OIG investigations seek out facts related to 

allegations of wrongdoing on the part of FMC employees and individuals, or entities contracting 

with, or obtaining benefits from, the agency. The IG Act provides that the OIG shall have access 

to all agency records and may subpoena records from entities outside of the agency in connection 

with an audit or investigation. 

The IG is required by law to prepare this report summarizing OIG audits and investigations 

during the immediately preceding six-month period. The report is sent to the FMC 

Commissioners, the President of the Senate, the Speaker of the House and FMC’s Congressional 

appropriating and authorizing committees. This dual reporting requirement helps to ensure the 

independence of the OIG.

To aid the FMC in accomplishing its mission, the OIG is provided two full-time positions, 

the IG and an auditor. In addition, the OIG has a memorandum of understanding (MOU) with the 

Treasury Inspector General for Tax Administration for the FMC OIG to obtain legal advice 

services to carry out the FMC OIG’s responsibilities under the Inspector General Act. During this 

period, the FMC OIG also had an MOU with the Appalachian Regional Commission OIG to obtain 

investigative services, as needed. 
3

OFFICE OF INSPECTOR GENERAL ACTIVITIES

Completed Assignments

Improper Payments Compliance Report for Fiscal Year 2022. The OIG completed the 

annual review of the FMC’s compliance with reporting and performance requirements regarding 

improper payments required by the Payment Integrity Information Act of 2019 (PIIA) (Public Law 

116-117). PIIA sets forth improper payment reporting requirements, including an annual 

compliance report by Inspectors General.

The purpose of PIIA is to improve the Federal government’s efforts to reduce and recover 

improper payments. Each agency Inspector General is required to review improper payment 

reporting in their agency’s annual Performance and Accountability Report (PAR) or Agency 

Financial Report (AFR) and any accompanying materials to determine if the agency follows PIIA. 

The OIG reviewed the agency’s Improper Payments Information Act section of FMC’s FY 2022 

PAR posted on the agency’s website for compliance with PIIA, as well as the FMC’s 

PaymentAccuracy.gov data call submission.

For FY 2022, the OIG concluded the FMC complied with all the requirements that are 

applicable to the agency for improper payment reporting. However, during our review, we noted 

an issue where the FMC could improve its improper payment reporting process. The OIG 

concluded that the issue neither affected compliance nor significantly altered the payment integrity 

information reported by the FMC. The OIG issued a separate management letter to the FMC Office 

of Budget and Finance to address the issue for future reporting.

Audit of FMC’s Compliance with the Federal Information Security Modernization Act 

(FISMA) FY 2023, A23-03. The objective of the independent audit of the FMC’s information 

security program was to identify improvements for the agency’s information technology security 

program. The audit assesses compliance with FISMA and related information security policies, 

procedures, and practices. The scope of the audit included general controls of the FMC network 

and applications housing service contracts, tariff location filings, and FMC license applications. 

The OIG also evaluated potential system vulnerabilities and assessed management actions to 

implement prior-year recommendations. 
4

The results of the OIG’s FISMA audit found the FMC resolved one of the prior year audit 

recommendations and made progress towards implementing the other audit recommendation. In 

addition, this year’s audit included three new audit recommendations for weaknesses that existed 

during FY 2023. 

First, the FMC experienced a security incident on January 11, 2023, however this incident 

was not reported to the United States Computer Emergency Readiness Team (US-CERT) until 

March 29, 2023. The OIG recommended all security incidents shall be reported to the US-CERT 

within one hour of an incident being discovered. Second, the OIG found the agency does not 

have an approved log retention policy detailing the necessary computer system events occurring 

within the FMC’s systems and networks to be logged and retained. Log management is essential 

to ensuring that computer security records are stored in sufficient detail for an appropriate period

for analysis of security incidents, policy violations, fraudulent activity, and operational problems. 

The OIG recommended the FMC develop, document, and approve a Log Retention Policy. 

Lastly, the OIG recommended the agency update the Risk Assessment Policy to adhere to the 

most recent computer security standards. FMC management agreed with all three 

recommendations. The final audit report was issued on July 28, 2023.

Information Technology Vulnerability Audit, 2023, A23-04. The OIG completed an 

audit of the FMC’s information technology (IT) vulnerability assessment program to identify any 

critical IT security weaknesses. The OIG contracted with Dembo Jones, PC, CPAs & Advisors, 

and their approved subcontractor FYRM Associates, Inc., to perform the audit. The scope of our 

testing encompassed the FMC’s IT systems and IT security. More specifically, our testing 

included security testing of multiple FMC Network targets within the external (Internet-facing) 

and internal network environments. The OIG employed testing scenarios that were intended to 

provide real world examples of what a knowledgeable and motivated hacker could achieve if 

focused on the FMC. The simulated external attack scenario did not lead to unauthorized access 

within the testing timeframe. Multiple vulnerabilities were identified in FMC IT systems and 

applications. 
5

Eight (8) recommendations were provided to address four (4) findings. The 4 findings 

included insufficient software management; default authentication credentials are utilized; 

insufficient configuration management; and flaws in custom-developed application functionality. 

FMC management agreed with all 8 recommendations. The final audit report was issued on 

September 28, 2023.

Open Audit

Independent Auditors’ Report of FMC’s FY 2023 Financial Statements, A23-02. The 

audit objectives are to opine on whether the FMC’s FY 2023 financial statements follow U.S. 

Generally Accepted Accounting Principles and present fairly the financial position of the agency. 

The audit will also review internal controls over financial reporting, and agency compliance with 

financial related laws and regulations. The statements to be audited are the Balance Sheet as of 

September 30, 2023, and the related Statement of Net Cost, Statement of Changes in Net Position, 

Statement of Budgetary Resources, and Statement of Custodial Activity. The final audit report 

will be issued by November 15, 2023.

Hotline and Investigations

The Inspector General Act of 1978, as amended, provides that the IG may receive and 

investigate complaints or information concerning possible allegations of fraud, waste, and abuse 

occurring within FMC programs and operations by employees or contractors. Matters of possible 

wrongdoing are referred to the OIG in the form of allegations or complaints from a variety of 

sources, including FMC employees, other government agencies and the public. 

Two new hotline complaints were received, and two hotline complaints were closed during 

the reporting period. Four hotline complaints were open at the end of this reporting period and 

there were no open investigations or matters referred to prosecutorial authorities during this period. 
6

Review of Legislation

As required by the Inspector General Act of 1978, as amended, the OIG routinely reviews 

proposed legislation and regulations. The purpose of these reviews is to assess whether the 

proposed legislation or regulation: (1) impacts the economy and efficiency of FMC programs and 

operations; and (2) contains adequate internal controls to prevent and detect fraud, waste, and 

abuse. 

Council of the Inspectors General on Integrity and Efficiency (CIGIE) Activities

The CIGIE was established by law as an independent entity by the Inspector General 

Reform Act of 2008 (P.L. 110-409) to:

• address integrity, economy and effectiveness issues that transcend individual government 

agencies; and 

• increase the professionalism and effectiveness of personnel by developing policies, standards, 

and approaches to aid in the establishment of a well-trained and highly skilled workforce in 

the Offices of Inspectors General.

The CIGIE is comprised of all Inspectors General that are Presidentially-appointed / Senate 

confirmed and those that are appointed by agency heads. The FMC OIG remains active in CIGIE 

operations. Specifically, the OIG is a member of CIGIE, participates in the monthly CIGIE 

meetings, and periodically assists CIGIE on special projects. 

The IG continues to serve in the position of Chair of the CIGIE Audit Peer Review 

Subcommittee. The subcommittee is responsible for maintaining the CIGIE audit peer review 

schedule, managing requests for extensions and substitutions, coordinating amongst dispute 

resolution panels, as well as answering questions about conducting audit peer reviews. The 

subcommittee is composed of dedicated volunteers from the CIGIE oversight community. Parker 

Skaats, the OIG’s Auditor, is one of these dedicated volunteers and he serves on the 

subcommittee’s frequently asked questions workgroup. 
7

SUMMARY OF INSPECTOR GENERAL REPORTING REQUIREMENTS

IG Act Reference Reporting Requirement Pages

Section 5(a)(1) Significant problems, abuses and deficiencies None

Section 5(a)(2) Recommendations with respect to significant problems, 

abuses, or deficiencies

None

Section 5(a)(3) Prior recommendations on which corrective actions have not 

been completed

8

Section 5(a)(4) Matters referred to prosecutorial authorities and results None

Section 5(a)(5) Summary of instances where information was refused None

Section 5(a)(6) List of audit, inspection, and evaluation reports by subject 

matter, and where applicable, the value of questioned costs, 

unsupported costs, and funds put to better use

None

Section 5(a)(7) Summary of each report 3-5

Section 5(a)(8) Audit, inspection, and evaluation reports with questioned 

and unsupported costs

None

Section 5(a)(9) Audit, inspection, and evaluation report recommendations 

that funds be put to better use

None

Section 5(a)(10) Summary of each audit, inspection, and evaluation report

issued before the commencement of this reporting period for 

which no management decision was made by the end of the 

reporting period; for which comments were not returned 

within 60 days of report issuance; and for which there are 

any outstanding unimplemented recommendations

None

Section 5(a)(11) Description and explanation of significant revised 

management decisions

None

Section 5(a)(12) Significant management decisions with which the Inspector 

General disagrees

None

Section 5(a)(13) Information under Section 804(b) of the Federal Financial 

Management Improvement Act (FFMIA) of 1996

None

Section 5(a)(14)(15) Peer review activity on FMC OIG 11, App. A

Section 5(a)(16) Peer review activity by FMC OIG on another OIG 11, App. A

Section 5(a)(17) Statistical tables on investigative activities None

Section 5(a)(18) Description of metrics used for developing the data for the 

statistical table under Section 5(a)(17)

None

Section 5(a)(19) Report on each investigation involving a senior Government 

employee where allegations of misconduct were 

substantiated

None

Section 5(a)(20) Description of whistleblower retaliation None

Section 5(a)(21) Description of any attempt by the establishment to interfere 

with the independence of the OIG

None

Section 5(a)(22) Description of particular circumstances of each inspection, 

evaluation, and audit conducted that is closed and was not 

disclosed to the public; and investigation conducted by the 

OIG involving a senior Government employee that is closed 

and was not disclosed to the public

None
8

TABLE I - Summary of Reports with Corrective Actions Outstanding for More 

than 6 Months

Recommendations

Report Title Report 

Number

Issue 

Date Number Open Closed

Audit of the FMC’s Compliance 

with the Federal Information 

Security Modernization Act, FY 

2022

A23-01 10/7/22 2 1 * 1

*In a memorandum dated October 5, 2023, the Managing Director informed the IG that the 

new supply chain policy for IT is under review by the Director, Office of Information 

Technology (OIT), and the FMC anticipates that it will be effective no later than the end of the 

2nd quarter of 2024. The OIG plans to follow-up on the audit recommendation to verify the 

actions taken by management have addressed the issue identified during the audit. The OIG 

plans to complete the follow-up review during the next audit to enable the OIG to close the 

recommendation.

TABLE II - Listing of Reports Issued

Report Title Assignment 

Number

Issue 

Date 

Questioned 

Costs

Unsupported 

Costs

Funds 

Put to 

Better 

Use

Audit of FMC’s 

Compliance with the 

Federal Information 

Security Modernization

Act, FY 2023

A23-03 7/28/23 $0 $0 $0

Information Technology 

Vulnerability Audit, 2023

A23-04 9/28/23 $0 $0 $0
9

TABLE III - Reports with Questioned Costs

Number

of 

Reports

Questioned 

Costs

Unsupported 

Costs

A. For which no management decision has been 

made by the commencement of the reporting 

period.

0 $0 $0

B. Which were issued during the reporting period. 0 $0 $0

Subtotal (A + B) 0 $0 $0

C. For which a management decision was made 

during the reporting period.

0 $0 $0

(i) dollar value of disallowed costs; and 0 $0 $0

(ii) dollar value of costs not disallowed. 0 $0 $0

D. For which no management decision has been 

made by the end of the reporting period.

0 $0 $0

E. Reports for which no management decision 

was made within six months of issuance.

0 $0 $0
10

TABLE IV - Recommendations that Funds be Put to Better Use

Number

of 

Reports Dollar Value

A. For which no management decision has been made 

by the commencement of the reporting period. 0 $0

B. Which were issued during the reporting period. 0 $0

Subtotal (A + B) 0 $0

C. For which a management decision was made during 

the reporting period. 0 $0

(i) dollar value of recommendations that were 

agreed to by management; and

0 $0

(ii) dollar value of recommendations that were not 

agreed to by management.

0 $0

D. For which no management decision has been made 

by the end of the reporting period. 0 $0

E. Reports for which no management decision was 

made within six months of issuance. 0 $0
11

Appendix A - Peer Review Activity

In accordance with the Dodd-Frank Wall Street Reform and Consumer Protection Act of 

2010 (Section 989C of P.L. 111-203), which amended Section 5 of the Inspector General Act of 

1978, OIGs are required to include in their semiannual reports (SAR) to Congress the results of 

peer reviews of their offices, as well as outstanding and not fully implemented recommendations 

from peer reviews the OIG received from another OIG, and outstanding and not fully implemented 

recommendations the OIG made in any peer review it performed for another OIG.

An external audit peer review of the FMC OIG audit office was completed in the prior 

reporting period on March 23, 2022, by the Corporation for Public Broadcasting OIG. A pass

rating was issued and there were no recommendations contained in the system review report. 

In addition, the OIG completed an audit peer review of the Architect of the Capitol OIG 

during a prior reporting period and issued the peer review report on September 1, 2021. The FMC 

OIG issued a pass rating and there were no recommendations contained in the system review 

report.

During this reporting period, the OIG initiated an audit peer review of the Equal

Employment Opportunity Commission OIG. The OIG expects to issue the final report in the next 

reporting period.
HOTLINE COMPLAINTS

The success of the OIG mission to prevent fraud, waste and abuse 

depends on the cooperation of FMC employees and the public. 

Employees and the public are encouraged to contact the OIG regarding 

any incidents of possible waste, fraud or abuse occurring within FMC 

programs and operations.

A COMPLAINT CAN BE REPORTED BY CALLING OUR 24-HR DIRECT LINE:

(202) 523-5865

ONLINE COMPLAINT FORM:

https://www2.fmc.gov/oigcomplaints/

TO PLACE A COMPLAINT IN WRITING PLEASE MAIL TO:

Federal Maritime Commission

Office of Inspector General

Suite 1054

800 North Capitol Street, NW

Washington, DC 20573

To Be Opened By the IG Only

THE INFORMATION YOU PROVIDE IS CONFIDENTIAL. YOU CAN CHOOSE TO REMAIN 

ANONYMOUS; HOWEVER, INDIVIDUALS ARE ENCOURAGED TO ASSIST THE INSPECTOR 

GENERAL BY SUPPLYING INFORMATION AS TO HOW THEY MAY BE CONTACTED FOR 

ADDITIONAL INFORMATION.