A Direct Examination (Attestation) Report to evaluate the design and implementation of the FEC’s internal control and enterprise risk management processes and determine whether the programs were operating in accordance with applicable criteria, including OMB Circular A-123, OMB Circular A-11 Section 200, the GAO Standards for Internal Control in the Federal Government (Green Book) and applicable provisions of the Government Performance and Results Modernization Act 2010 (GPRAMA), and Federal Managers’ Financial Integrity Act of 1982 (FMFIA).
Open Recommendations
| Recommendation Number | Significant Recommendation | Recommended Questioned Costs | Recommended Funds for Better Use | Additional Details | |
|---|---|---|---|---|---|
| 1 | No | $0 | $0 | ||
| We recommend the FEC formally designate a COO role in accordance with the statutory requirements of GPRAMA and the implementing guidance in OMB Circular A‑11, Part 6. This includes ensuring that the COO is the deputy agency head or equivalent. | |||||
| 2 | No | $0 | $0 | ||
| We recommend the FEC formally document the COO designation through an internal directive, organizational order, memorandum, or leadership charter, and notify OMB of the designations as required by OMB Circular A‑11. Documentation should clearly define the responsibilities, reporting relationships, and authority of the role to ensure compliance with federal performance governance requirements. | |||||
| 3 | No | $0 | $0 | ||
| We recommend the FEC ensure the COO role is integrated into the agency’s enterprise performance framework, including participation in strategic planning, development of Annual Performance Plans and Reports, leadership of data‑driven performance reviews, and coordination of performance improvement activities. This integration should support effective execution of GPRAMA and OMB Circular A‑11 performance requirements and strengthen accountability for agency‑wide performance. | |||||
| 4 | No | $0 | $0 | ||
| We recommend the FEC establish and implement a formal fraud risk assessment process aligned with OMB Circular A-123 and the GAO Green Book. The process should include identifying and assessing fraud risks, evaluating related control activities, assessing residual fraud risk, documenting results within the annual ICR, establishing formal governance and recurring assessment procedures, and providing fraud risk management training to responsible personnel. | |||||
| 5 | No | $0 | $0 | ||
| We recommend the FEC establish and document an enterprise-wide policy governance framework that defines ownership, accountability, and requirements for periodic review and updating of directives, policies, and procedures, including mandatory review upon significant legal or regulatory changes. | |||||
| 6 | No | $0 | $0 | ||
| We recommend the FEC update the identified directives, policies, and procedures to align with current statutes, regulations, OMB guidance, and National Archives and Records Administration approved records schedules. | |||||
| 7 | No | $0 | $0 | ||
| We recommend the FEC integrate policy governance with internal control and ERM processes to ensure outdated or noncompliant policies are identified, tracked, and addressed as part of the Agency’s risk management and internal control monitoring activities. | |||||
| 8 | No | $0 | $0 | ||
| We recommend the FEC establish and implement a formal, risk-based methodology for evaluating internal control deficiencies, including defined criteria for assessing magnitude, likelihood, and impact, and require consistent application of this methodology to assess deficiencies identified through the ICR process and determine their significance and impact on agency objectives. | |||||
| 9 | No | $0 | $0 | ||
| We recommend the FEC redesign the ICR template to improve clarity, completeness, and usability by ensuring a logical linkage between control objectives, associated risks (including fraud risks), control activities, and the evaluation of control effectiveness. The revised template should also require documentation of identified control deficiencies and planned corrective actions to support consistent, risk-based internal control assessments in accordance with OMB Circular A-123 and GAO Green Book. | |||||
| 10 | No | $0 | $0 | ||
| We recommend the FEC implement a quality assurance review process over ICR submissions to ensure documentation is sufficient, complete, and in compliance with OMB Circular A 123 and GAO Green Book requirements, prior to acceptance. | |||||
| 11 | No | $0 | $0 | ||
| We recommend the FEC provide formal training and detailed guidance to assessable unit staff on how to properly document internal control assessment worksheets in accordance with OMB Circular A-123 and GAO Green Book requirements. | |||||