Pension Benefit Guaranty Corporation Office of Inspector General Semiannual Report to the Congress April 1, 2003 - September 30, 2003 Pension Benefit Guaranty Corporation Office of Inspector General 1200 K Street, N.W., Washington, D.C. 20005-4026 The Honorable Elaine L. Chao Chairman, PBGC Board of Directors On behalf of the Office of the Inspector General (OIG) for the Pension Benefit Guaranty Corporation, I am pleased to submit this Semiannual Report to the U.S. Congress. The report summarizes OIG activities for the sixth-month period ending September 30, 2003. As we celebrate the 25th anniversary of the Inspector General Act of 1978, I am convinced that the IG community has a vital role to play in the future of the federal government. IG’s are guardians of integrity and efficiency, protectors of the public trust against fraud, waste and abuse, and a catalyst for positive change. For 25 years, IGs have served as an independent voice to agency heads and to the Congress by identifying opportunities to improve performance. Now, more than ever, IG’s are a vital source of objective information that is critical for decision-makers. This has been a challenging year for the Corporation. The recent terminations of several large under funded pension plans has resulted in a sharp deterioration in PBGC’s financial condition, and the funding status of defined benefit pension plans has dropped dramatically. The General Accounting Office placed the single-employer insurance program on the high risk list in July. Congress and the Administration are considering reforms to the defined benefit system to strengthen retirement security and protect the financial integrity of the Corporation. These events emphasize the importance of promoting accountability so that today’s pension problems are not passed on to future generations. Looking back at our work over the last six months, I am proud of the contributions we have made to the Corporation. In my first year as the PBGC Inspector General, I have focused OIG efforts on improving our value to decision-makers. We have made a great deal of progress by improving communication, collaborating with stakeholders to identify issues that add value, and reengineering our processes to improve accountability. Based on the input we received from key stakeholders and the knowledge we have gained from our work, we have identified what we believe are the most important challenges the Corporation faces. These issues, as well as the work we have accomplished to address the issues are discussed in the body of this report. During this reporting period, we worked closely with the Board of Directors and management to improve accountability and performance. We made recommendations to improve the Board’s oversight of the corporation, integrate financial systems to enhance financial reporting, protect security and privacy, and improve internal controls over premium accounting. Finally, I would like to express my appreciation to the Board of Directors, as well as the senior management of the Corporation, for their support to the mission of the OIG and their collaborative work in improving operations. I also want to express my appreciation for the accomplishments of all OIG employees for their continued professionalism, dedication and willingness to accept new challenges. Robert L. Emmons EXECUTIVE SUMMARY This semiannual report to the Congress summarizes the activities and accomplishments of the Pension Benefit Guaranty Corporation (PBGC) Office of Inspector General (OIG) for the period April 1, 2003 through September 30, 2003. When planning and accomplishing our work, our new Inspector General challenged staff to consider how our audit and investigative reports will be used by management to improve PBGC’s programs and operations. We renewed our focus to identify the challenges facing PBGC, conduct work to address them and provide timely information. The OIG’s mission is to be a catalyst for positive change and we can do that through audit, evaluation and investigative reports, as well as consulting with PBGC and participating on Corporate teams and working groups. In the audit area, we solicited input from the Board of Directors and senior managers when planning our work. The management challenges we worked on this period include: • Governance issues, working with the Board of Directors, Executive management and the General Accounting Office (see page 3); • Financial Management, focusing on the Financial Statement Management Letter and accelerated financial statement reporting (see page 4); • Program Operations, identifying and participating on teams to address premium accounting issues and beginning work to review field benefit administrators offices (see page 6); • Information Technology Security, submitting the OMB-mandated response on the agency’s progress and internal network penetration testing (see page 7); and • Continuity of Operations, finding significant progress (see page 8). In the investigative area, we developed a new investigative process. Acknowledging that with a small investigative staff we cannot conduct a full investigation of every allegation reported to the OIG, we developed new case criteria. Every allegation will be assigned an “Inquiry” number and reviewed to determine whether we can refer the matter to management to address and report back to the OIG on its actions. Our goal is to systematically and timely address each allegation, open only the highest priority cases that we agree should be worked based on our criteria, and for which we have the resources to conduct a full investigation. Using our new process, we closed a number of old cases. We received thirty-three (33) Inquiries, of which one became a case. We closed twenty-three (23) cases and eight (8) inquiries during the reporting period. Among the significant investigative work conducted this period, we: • Found that a senior level employee engaged in a pattern ethics violations and misconduct (see page 14); • Found that a participant’s monthly pension check had been diverted for 9 years after he moved to Jamaica, resulting in his receiving more than $16,000 in back pay (see page 14); • Closed five cases related to pension benefit fraud, among which we referred two cases for criminal prosecution, one of which involved an estate executor who failed to notify PBGC of the beneficiary’s death (see page 14). TABLE OF CONTENTS LETTER TO THE CHAIRMAN EXECUTIVE SUMMARY i TABLE OF CONTENTS ii INTRODUCTION 1 The Pension Benefit Guaranty Corporation The Office of Inspector General AUDIT ACTIVITIES 3 Overview Management Challenges Governance Financial Management Program Operations Information Technology Security Continuity of Operations Other Audit Activity Audit Follow-up and Resolution Access to Information PBGC Management - Inspector General Disagreements Table of Audit Reports INVESTIGATORY ACTIVITIES 13 Overview Activity This Period Significant Investigations Table of Investigative Activities OTHER OFFICE OF INSPECTOR GENERAL ACTIVITIES 17 Review of Proposed Statutory and Regulatory Changes OIG Participation in Mentoring 25th Anniversary PCIE/ECIE Awards APPENDIX 19 Cross-Reference to Reporting Requirements of the Inspector General Act Reports Issued With Questioned Costs Reports Issued With Recommendations That Funds Be Put to Better Use Open Recommendations GLOSSARY 27 INTRODUCTION THE PENSION BENEFIT GUARANTY CORPORATION The Pension Benefit Guaranty Corporation (PBGC or Corporation) was established under Title IV of the Employee Retirement Income Security Act of 1974 (ERISA), as amended, 5 U.S.C. § 1301-1461, as a self-financing, wholly owned federal government corporation to administer the pension insurance program. ERISA requires that PBGC: (1) encourage the continuation and maintenance of voluntary private pension plans; (2) provide for the timely and uninterrupted payment of pension benefits to participants and beneficiaries; and (3) maintain premiums at the lowest level consistent with carrying out PBGC's obligations. For about 44 million Americans, the PBGC provides assurance that their retirement benefits are safe now and for the future. The PBGC protects the pensions of participants in certain defined benefit pension plans, i.e., plans that promise to pay definitely determinable retirement benefits. Such defined benefit pension plans may be sponsored individually or jointly by employers and unions. In recent testimony, PBGC reported that it insures pension benefits worth $1.5 trillion and is responsible for paying benefits to nearly 1 million people in over 3200 terminated defined benefit plans. Benefit payments totaled about $2.5 billion in FY 2003, and are expected to grow to nearly $3 billion in FY 2004. In its fiscal year 2002 financial statement, the PBGC reported that it has assets of about $26.4 billion and liabilities of $29.9 billion, which represented a single-year loss of over $11 billion. PBGC’s Executive Director testified before the United States Senate’s Special Committee on Aging that PBGC’s unaudited deficit was $8.8 billion as of August 31, 2003. THE OFFICE OF INSPECTOR GENERAL One of the goals of the Office of Inspector General (OIG) is to assist the PBGC in operating more efficiently and effectively by identifying ways to improve PBGC's programs. To accomplish this goal, the OIG conducts agency audits, inspections, and investigations, and makes recommendations to and consults with PBGC management on findings and systemic issues. In addition, the OIG is required statutorily to inform the agency head of fraud and other serious problems, abuses and deficiencies relating to the programs and operations administered or financed by the PBGC, recommend corrective action concerning such problems, and report on the progress made in implementing corrective actions. Our OIG staff consists of twelve (12) employees, of which two are investigators and one is an administrative assistant. Major change continued during this reporting period. At the Inspector General’s direction, the OIG has adjusted its focus on how it will accomplish its statutory mission. Our goal for audits and investigations is to provide timely, relevant information that PBGC can use in making its decisions. We understand that we can foster change not only by issuing audit, evaluation and investigative reports but also by consulting with PBGC and participating on various teams and working groups. As such, we altered our approach to audit planning and concentrated our efforts on identifying issues that are important to PBGC. We gathered information from various sources and solicited input from the Board of Directors and PBGC’s senior managers. We then applied risk-based criteria such as impact on operations, resources involved, sensitivity, potential for embarrassment or adverse publicity, and security to formulate the challenges facing PBGC. For this reporting period, the major challenges that we addressed were: corporate governance, financial management, premiums and insurance operations, information technology security, and continuity of operations. As required by the Chief Financial Officers Act, we continue to audit PBGC’s financial statements. The OIG has a multi-year contract with an Independent Public Accountant (IPA) to perform the audit of the Corporation’s FY 2002 and FY 2003 financial statements. We have also restructured our approach to investigations. In our attempt to maximize limited resources, we are applying stricter criteria in evaluating the quality of the allegations received. For example, we evaluate allegations against the potential criminal and civil violations, the statute of limitations, potential for negative publicity for PBGC, and the total assets involved. This will allow us to concentrate on investigative issues that are most relevant to PBGC. The OIG follows the standards contained in the Quality Standards for Federal Offices of Inspector General published by the President’s Council on Integrity and Efficiency (PCIE) and the Executive Council on Integrity and Efficiency (ECIE). Those standards require audits to be conducted in accordance with Government Auditing Standards issued by the General Accounting Office. Evaluations comply with Quality Standards for Inspections, and, investigations comply with Quality Standards for Investigations, both of which have been accepted by the PCIE and ECIE. AUDIT ACTIVITIES OVERVIEW We changed our approach to audits of Corporate programs and operations by focusing our work on major management challenges. Using our past work and input from the Board of Directors and senior managers, we identified what we believe are the most important challenges facing the Corporation: corporate governance, financial management, program operations, information technology security, and continuity of operations. In addition to conducting traditional audits and evaluations in these challenge areas, the OIG staff participated on corporate-wide teams addressing various issues of joint concern. Our goal is to have a positive impact on the decision-making process of the Board of Directors and PBGC management. MANAGEMENT CHALLENGES 1. GOVERNANCE In the aftermath of Enron, WorldCom, and other corporate meltdowns, Congress passed the Sarbanes-Oxley Act in an effort to regain public trust. While Sarbanes-Oxley does not apply to PBGC, the underlying principles do. The Board of Directors, senior management, and the Office of Inspector General play a critical role in overseeing the Corporation to ensure reliable and complete financial reporting, effective customer service, and ethical business dealings. To assist the Corporation in addressing the challenge of corporate governance, the OIG is working with the Board of Directors and management to identify ways to improve its governance. BOARD OF DIRECTORS Since January, OIG has worked with the Board and management to reassess the Board’s process for overseeing the Corporation. In July, the OIG attended a Board meeting where we: • Outlined the role of the OIG and its relationship with the Board, • Presented the results of the annual financial audit, and • Met in executive session. As a result, the Board plans to meet with the Inspector General regularly to discuss significant findings and, if needed, resolve OIG disagreements with management. We believe this routine communication will allow the Board to use the independent work of the OIG to assess performance and hold managers accountable for implementing audit recommendations. MANAGEMENT Governance is not an exclusive responsibility of the Board. PBGC management is responsible for implementing an internal governance model that ensures effective and ethical operations. A major aspect of this responsibility is identifying business risks and implementing controls to mitigate those risks. OIG is working with management to reassess organizational structure and business processes to improve oversight of programs and operations. During the reporting period, we: • Participated in a working group charged with assessing the Corporation’s governance. • Suggested several changes in organizational structure to enhance governance. • Provided advice in developing a process to routinely assess internal controls in major business areas. • Made recommendations to ensure review and oversight of systems for compliance with financial standards. Management has already taken action to implement some of our suggestions and is considering several changes in organizational structure to address other issues. We believe these actions will improve management oversight over the operations and programs of the Corporation. INDEPENDENCE OIG engages outside auditors to conduct audits of the Corporation’s financial statements. In doing so, OIG is responsible for ensuring that the public accounting firm is independent. Recent changes in audit standards impacted on the types of audit-related and consulting services auditors can provide without impacting independence. OIG worked with the General Accounting Office to determine if non-audit related services provided by our contracted auditors were consistent with the revised government audit standards. Based on this assessment, the outside auditors discontinued a contract for consulting services. 2. FINANCIAL MANAGEMENT PBGC is a major government enterprise that manages assets of over $26 billion. In FY 2003, the corporation paid out about $2.5 billion to retirees. For this reason, strong financial management controls are needed to protect assets and minimize cost. OIG continues to focus much of its work on financial management issues to help management address this challenge. FISCAL YEAR 2002 FINANCIAL STATEMENT – MANAGEMENT LETTER (2003-7/23168-5) The OIG engaged PricewaterhouseCoopers, LLP to audit PBGC’s financial statements of the Single-Employer and the Multiemployer Fund for the fiscal years (FY) ended September 30, 2002 and 2001. In the previous reporting period, the OIG issued opinions on the financial statements and management’s assertion concerning the system of internal control, and a report on compliance with laws and regulations. As follow-on to the financial statement audit, we issued a management letter report with findings concerning several control conditions, including the need to: • Improve management’s process for identifying key controls, self-assessing those controls and monitoring the effectiveness of the controls. • Develop, document and implement policies and procedures for documenting settlements with plan sponsors in a timely manner. • Implement a valuation process for estimated recovery balances recorded in the trust accounting system. • Develop and implement a policy on the accounting for internally developed software. • Strengthen information security policies for access controls, change management, and controls over system software. Management agreed with all of our recommendations and plans to implement corrective actions. We briefed the Board of Directors on the results of the financial audit and the management letter on July 23, 2003. ACCELERATED FINANCIAL REPORTING PBGC is committed to complying with the Federal Government’s mandate for accelerated reporting on audited financial statements. The Executive Director established a goal of issuing PBGC’s annual report by December 31, 2003, one month before the goal established by the Office of Management and Budget (OMB). To assist management in achieving this goal, OIG and our contracted auditors worked with management to identify audit processes that could be accelerated. Based on this joint effort, we initiated EDP testing, internal control testing, site visits to investment managers, field benefit offices, and State Street Bank earlier in the year to accommodate accelerated reporting. OIG and management attended seminars on accelerated reporting hosted by the Treasury Department to benchmark with other agencies and identify best practices. Our communication with management continues to improve with weekly meetings to identify issues quickly and work collaboratively to resolve them. This has resulted in numerous suggestions from our auditors to improve operational processes for accelerated financial reporting. We applaud management’s aggressive approach to meeting the Federal mandate to issue FY 2004 audited financial statements by November 15, 2004. We will continue to work with management to identify ways to improve business systems and processes to accommodate accelerated financial reporting. PROGRAM ASSESSMENT RATING TOOL TEAM During the reporting period, OIG participated as a consultant to an agency team that completed a self-assessment of operations using the Program Assessment Rating Tool (PART). PART is a diagnostic tool designed by the OMB to rate federal programs and assist OMB and Congress in making funding decisions. It addresses the President's Management Agenda initiative to integrate budget and performance and the Government Performance Results Act requirements. The PART team identified several gaps that need to be addressed to improve performance. The results of the assessment will be used to prepare for a program assessment by OMB scheduled for next year. We believe OIG participation benefited the PART Team by leveraging our audit work to identify areas for improvement and providing a better understanding of how management could support initiatives with objective evidence. 3. PROGRAM OPERATIONS PBGC is constantly facing the challenge of balancing operational efficiency with providing optimal customer service, while at the same time protecting Corporate resources. During the reporting period, management requested OIG work in two areas to address this challenge and provide objective information needed for management decisions -- the premium accounting system and field benefit administration. PREMIUM ACCOUNTING REVIEW OF PBGC’S PREMIUM ACCOUNTING PROCESS (2003-8/23177-1) The Premium Accounting System (PAS) is used to process and record filings, correspondence, and premium payments received from sponsors of single-employer and multiemployer pension plans. OIG has conducted a number of audits and reviews of PAS that identified numerous errors in the premium accounting database. PBGC recognized problems with the premium accounting system and has attempted to correct the problem with several initiatives since 1995. However, these initiatives have not resulted in a long-term solution to the reliability of premium data. The most recent initiative is a major systems development effort that will totally redesign PAS. In March 2003, PBGC’s Executive Director asked us to identify control weaknesses with the premium accounting process and quantify the potential impact. We issued an interim report in April 2003 to alert management of issues that required their immediate attention. Based on the interim report, management took prompt action to verify account balances by mailing Statements of Account and Past Due Filing Notices to plan sponsors. In August 2003, we completed our work and briefed the Executive Director on our conclusions, findings and recommendations. We concluded that there were significant control weaknesses in the premium accounting process that undermined the quality and integrity of reported premium revenues. These control weaknesses resulted in unreliable and inaccurate premium data in PAS. Because system data was unreliable, we were unable to determine with certainty the potential monetary impact of the control weaknesses on premiums. We also questioned whether the ongoing initiative to redesign PAS would be successful unless a common set of financial requirements for all financial systems is developed. We concluded that the underlying cause of problems with premium accounting related to a broader issue that was previously reported in our annual financial audit --- integration of financial systems. We believe that a common framework of financial controls needs to be developed for all systems that impact the general ledger, not just the premium accounting system. Management agreed with our recommendations and developed action plans to address the issues identified by December 2004. The Executive Director recently announced that integration of financial systems is a top priority, and a working group was established to develop an action plan for integrating systems that impact financial statements. PREMIUM ACCOUNTING BUSINESS PROCESS REENGINEERING The OIG is serving as an advisor to a project team that is responsible for reengineering the premium accounting process. The focus of the OIG effort has been to acquaint the project team with OIG audits and reviews and to provide advice on controls needed to prevent, detect and correct errors in the premium accounting database. Among the controls suggested by the OIG are: 1) electronic filing to eliminate data capture errors, 2) interactive prompting of electronic filers to eliminate filing errors, and 3) electronic linkage of e-filings and e-payments to eliminate errors due to mismatching wire payments. OIG participation benefits the team by providing a better understanding of our audit work and the controls that are needed to address issues in our reports. FIELD BENEFIT ADMINISTRATOR REVIEW PBGC operates 11 Field Benefit Administrator offices (FBAs) that are staffed by contractors to assist in administering pension plans PBGC has terminated. At the request of management, we initiated an evaluation of the FBAs in September 2003. The objective of this evaluation is to determine if the current FBA concept optimizes customer service at the lowest possible cost. OIG contracted with an independent public accounting firm to complete the requested work. Preliminary planning began in September with an anticipated report for issue expected in April 2004. We expect that the report will provide management with objective information needed to improve the operations of FBAs. 4. INFORMATION TECHNOLOGY SECURITY PBGC has major initiatives to enhance customer service by providing access to information through web-based applications. Protecting the privacy and integrity of customer information is a major challenge for PBGC. OIG continues to accomplish numerous audits to assist the Corporation in meeting this challenge. FEDERAL INFORMATION SECURITY MANAGEMENT ACT REPORT TO OMB As part of our financial audit, we conduct information and technology security reviews to evaluate the effectiveness of the Corporations information security program. Our work follows the guidance in GAO’s Federal Information System Controls Audit Manual and reflects the impact of these general controls on PBGC’s significant financial systems. During the reporting period, we completed reviews of: • Entity Wide Security (overall security program), • Access Control (authorization, authentication, monitoring, and integrity), • Service Continuity (contingency and business recovery planning), • Systems Software (security and operational controls related to the computer platforms on which the business systems operate, i.e., UNIX, Windows NT, Novell, etc.), and • Application Development and Change Control (system life cycle management, new system development, and maintenance to existing systems). In past financial statement audits, the OIG reported information security and business continuity as reportable conditions. These issues, as well as other issues related to security that were identified in the FY 2002 financial statement audit, were included in the Plan of Action & Milestones for PBGC’s FY 2003 Federal Information Security Management Act Report submitted to OMB in September 2003. This provides PBGC with another mechanism to monitor progress on and final disposition of corrective actions for these issues. As a result of our work, PBGC has developed and implemented written policies and procedures addressing operational and physical controls that promote a strong security-related environment. Although weaknesses were identified in the enforcement of these policies, we are encouraged with the progress PBGC has made in addressing the issues in our reports. NETWORK PENETRATION TESTING (Internal) Using a technical team from PricewaterhouseCoopers, we performed an internal attack and penetration test of security controls specifically related to access control, entitywide security, and system software. As part of this work, we conducted a physical walkthrough of PBGC’s more sensitive areas. We also conducted social engineering testing and contacted a sample of employees and contractors by phone requesting security information such as IDs and passwords. Our work found that PBGC made significant progress in its ability to monitor and detect unauthorized intrusions to its networks, which assures PBGC that it is reasonably protecting its information. We also noted improvements were needed in its security awareness training program to strengthen employee and contractor knowledge of and accountability for information security. 5. CONTINUITY OF OPERATIONS PLAN Planning for continuity of operations (COOP) in the event of an emergency is a major challenge for PBGC. COOP has been a reportable condition in the Financial Statement internal control report for the last three years. During that time, we have worked with PBGC to address COOP as an enterprise-wide process. We reviewed planning documents and observed COOP tests on July 22, August 16, and September 10, 2003. Overall, we concluded that the results of PBGC’s efforts to address its outstanding issues related to business recovery were encouraging. Senior management support was evident, as well as the effort put forth by all participants in each of the COOP testing exercises. We are discussing potential improvements with management and anticipate issuing a report next period. Although all of these exercises were completed with a high level of satisfaction, the process of maintaining a current workable business recovery plan is an ongoing process requiring a great deal of attention and support. PBGC has laid the groundwork and created a process that it can build on to achieve a very successful COOP program. PBGC should continue to keep its focus and full-time commitment to the COOP through unannounced tests that are closely aligned with real world scenarios. OTHER AUDIT ACTIVITY AUDIT RESOLUTION AND FOLLOW-UP TEAM A major initiative of OIG is to promote accountability for implementing audit recommendations. The Inspector General and the Chief Financial Officer co-sponsored an Audit Resolution and Follow-up Team that was tasked to develop a policy for audit resolution and follow-up that encouraged: • Accountability for responding to and implementing audit recommendations at the lowest organizational level; • Mutual agreement by management and OIG on findings, recommendations, and action plans following issuance of draft reports, but before final reports are published; • Disagreements to be addressed at the lowest possible organizational level; • Flexibility in managing corrective actions; and • Effective communication and a cooperative spirit between OIG and management to improve operations. The Team, which was composed of members from management and OIG, benchmarked with other Federal agencies to identify best practices. Using this data, they reengineered the existing process to encourage resolution of disagreements as early in the process as possible, improve communication between PBGC and the OIG, and improve accountability for implementing audit recommendations. The success of the team’s effort was recognized recently with an award for excellence from the Executive Council on Integrity and Efficiency. AUDIT MANUAL Another major effort involved updating the OIG Audit Manual. Revisions to Government Auditing Standards, as well as our desire to incorporate our new vision for accomplishing our mission, necessitated the changes. The Audit Staff has been meeting regularly to review and edit the current Audit Manual. The revision was nearing completion at the end of the reporting period and will be implemented during the next reporting period. AUDIT FOLLOW-UP AND RESOLUTION The audit follow-up system at PBGC is integral to effective management and is a shared responsibility of PBGC management and the OIG. The OIG’s audit follow-up system documents and reports on management's actions to encourage prompt resolution of audit recommendations. We follow the Office of Management and Budget (OMB) Circular A-50 guidance that audit recommendations be resolved within six (6) months of issuance. An audit recommendation is resolved when agency management and the OIG reach agreement on firm plans of action to correct reported weaknesses. Resolution does not mean an audit recommendation is closed. The OIG closes audit recommendations only when it determines that corrective actions have been completed by the agency. In our Semiannual Listing of Audit Recommendations (OIG Report 2003-9/3210) we reported that, as of August 31, 2003, there were: • One hundred-nine (109) open audit recommendations, the majority of which were new recommendations from the Financial Statement Audit Management Letter. • Thirty-nine (39) were outstanding audit recommendations from prior reporting periods. During this FY, one of management’s strategic objectives was to implement and close 50% of the audit recommendations outstanding as of October 2002. We frequently met with management during this reporting period, discussed documentation of corrective actions, and resolved issues regarding closure. • The OIG concurred that management had presented sufficient evidence to close forty-six (46) audit recommendations. • Of the sixty-three (63) audit recommendations that remain open, only thirty-three (33) are outstanding from prior periods. A number of recommendations remain open pending review during this year’s financial statement audit. We continue to meet with departmental officials to discuss the outstanding recommendations and provide guidance on actions necessary to close them. ACCESS TO INFORMATION Under the Inspectors General Act, the Inspector General is to have unfettered access to all agency records, information, or assistance when engaged in an investigation or audit. Whenever access to requested records, information, or assistance is unreasonably refused or not provided, the Inspector General must promptly report the denial to the agency head. During this six-month reporting period, the Inspector General’s access to information was not restricted. PBGC MANAGEMENT - INSPECTOR GENERAL DISAGREEMENTS Semiannually, the OIG reports on the status of all unresolved audit reports that are more than six months old. These reports include: (1) reason(s) for unresolved reports and a timetable for their resolution; (2) actions taken or proposed on all unresolved reports or recommendations; and (3) age of unresolved recommendations. For this reporting period, there were no unresolved audit reports in which PBGC management decisions are pending. As reported in prior periods, PBGC had disagreed with a recommendation contained in the Fiscal Year 1998 Financial Statement – Management Letter (99-8/23132-3). PBGC management commented on the Report and concurred “with its recommendations except for one item.” PBGC disagreed with a recommendation which states that PBGC should “modify existing Insurance Operations Department (IOD) procedures to require retention of source documentation generated as a result of the participant data audits and used to calculate benefit payments and value the PVFB (Present Value of Future Benefits) liability.” During this reporting period, we closed the recommendation after reviewing the elements surrounding the condition and the underlying cause. We determined that additional work was required to confirm the underlying cause of the condition. In addition, our recommendation to develop procedures for retaining and archiving the database from which audit samples are selected was addressed by management. This change would allow retesting of the database to confirm the original results. We plan to address the data retention requirements for critical data elements in future audits. INSPECTOR GENERAL REPORTS* For The Six-month Period Ending SEPTEMBER 30, 2003 REPORT NUMBER REPORT TITLE DATE ISSUED DOLLAR VALUE OF QUESTIONED COSTS DOLLAR VALUE OF BETTER USED FUNDS DOLLAR VALUE OF UNSUPPORTED COSTS NUMBER OF NON-MONETARY RECOMMENDATIONS Audits 2003-7/23168-5 Fiscal Year 2002 Financial Statement Audit-Management Letter 7/03/2003 46 Evaluations 2003-8/23177-1 Evaluation Premium Accounting System & Associated Business Process 4/16/2003 2003-9/32109 Semiannual Listing of Audit Recommendations 7/30/2003 * This statistical information is required by section 5 (a)(6) of the Inspector General Act of 1978, as amended. INVESTIGATORY ACTIVITIES OVERVIEW The Inspector General is authorized to receive and investigate complaints from PBGC employees, the public and other sources concerning violations of law, rule, or regulation; mismanagement; gross waste of funds; abuse of authority; or a substantial and specific danger to the public health and safety. Individuals may disclose information or make complaints to the Inspector General through the OIG "Hotline." (See announcement on back cover page.) The Inspector General has a policy to protect the legal rights of whistleblowers and complainants. At all times, the Inspector General takes reasonable precautions not to disclose the identity of the complainant without that person's consent. OIG HOTLINE The OIG operates a separate "1-800" hotline telephone number and a confidential Hotline post office box. The Hotline telephone is answered by an investigative staff assistant for a two-hour period, Monday through Friday; at all other times there is a message that provides information about the Hotline service and refers callers to our main telephone number. ACTIVITY THIS PERIOD NEW INVESTIGATIVE CASE PROCESS A major initiative of the investigative unit was the re-engineering of our process for intake of allegations and determination of what will be investigated. The Inspector General challenged the investigative staff to re-examine our criteria for opening cases, acknowledging that with limited staff resources, we cannot investigate every allegation that is brought to the OIG. We developed a new process to ensure that we open cases only for those allegations for which we will undertake a full investigation. Every allegation we receive is assigned an inquiry number and initial review is performed to determine how the allegation will be addressed. Unless the allegation clearly presents serious criminal violations, ethical violations, or other significant issues, it will be handled as an inquiry. On a regular basis, we review the status of open investigations, and pending inquiries to establish investigative priorities. The goal of the new process is to systematically assign priorities for investigations. This will focus our work on the most important cases and maximize the use our limited investigative resources. SIGNIFICANT INVESTIGATIONS ETHICAL MISCONDUCT We issued a Report of Investigation that closed investigations into multiple allegations of wrongdoing by a senior PBGC manager. We found that this employee had engaged in a pattern of ethics violations and misconduct involving contracting irregularities, improper business relationships with employees and contractors, and failing to comply with ethics rules for disclosing business relationships. The U.S. Attorney’s office declined criminal prosecution and referred the matter back to OIG for pursuit of administrative action in lieu of prosecution. We issued an investigative report for disciplinary action, and management is considering the actions they will take. The U.S Attorney’s office is currently reviewing portions of the case for civil prosecution. DEFRAUDED PARTICIPANT GETS MONEY BACK We closed a case involving a plan participant who had not received his pension check from PBGC for over nine (9) years. We determined that since the time the participant moved out of the country in 1994, the checks had been diverted to a Post Office Box in Connecticut. The participant was due over $16,000 in pension payments. We found that a husband and wife conspired to divert the payments, the wife took actions to have the checks re-directed to a post office box she controlled, and her husband fraudulently signed the checks. We determined that these individuals used all of the proceeds from these checks for their personal use. Once we determined the participant received no proceeds from the diverted checks, we notified PBGC and the participant was repaid all monies due plus interest. The husband and wife have not yet been prosecuted for the theft. As the wife is an employee of another Federal agency, we made a referral to that agency. THEFT OF PREMIUM PAYMENT CHECK Last period, we reported that we had recovered more than $250,000 for PBGC from the diversion of a pension plan sponsor’s premium payment to a foreign bank. We worked with other law enforcement agencies; however, we were unable to identify the perpetrator. As a result of our investigation, an employee of the plan sponsor was fired. PENSION FRAUD CASES During this period, we closed five cases that raised issues of fraud relating to pension plans and benefits. Our investigations resulted in the following: • Two prosecution referrals, one of which involved an estate executor who failed to notify PBGC of the beneficiary’s death and continued to use pension payments for 18 months. • Notice to PBGC not to replace an alleged missing benefit check because the participant had falsely represented to PBGC that he had not received his lump sum pension benefit. • Participant received lump sum check of $2,500. SUMMARY OF INVESTIGATIVE ACTIVITIES For The Six-month Period Ending SEPTEMBER 3O, 2003 ALLEGATIONS INTAKE STATISTICS CASES Pending beginning of period 43 Opened 1 Closed 23 Pending end of period 21 INQUIRIES Received this period 33 Converted to a Case 1 Closed 8 Pending end of period 24 WRONGDOING ALLEGED (INQUIRIES RECEIVED) Fraud, Waste & Abuse 6 Wrongdoing 4Threats Against PBGC 1 Ethics 2 Improprieties Relating to Pension Benefits 20 INQUIRIES RECEIVED THROUGH HOTLINE Received this period 10 Referrals to agency 6OIG Customer Assistance 4Cases opened 0 RESULTS OF CASES AND INQUIRIES CLOSED Matters Referred for Prosecution Prosecution Declined – Referred for Discipline Prosecution Declined – Closed 2 2 Removal from position 1 Pension Fraud Fraud Substantiated – Participant Repaid Fraud Unsubstantiated 2 2 Threat Against Employee – Referred Law Enforcement 1 Referred to Agency for Disciplinary/Corrective Action 4 Customer Service 7 Allegation disproved or not substantiated 2 Administrative Closing 8 TOTAL 31 OTHER OFFICE OF INSPECTOR GENERAL ACTIVITIES REVIEW OF PROPOSED STATUTORY AND REGULATORY CHANGES To comply with the IG Act, the OIG Legal Counsel is notified by the Office of the General Counsel when the agency is proposing legislative and regulatory changes. During this period, we reviewed and commented on final regulations concerning required filings, PBGC issuances, and records retention that will provide PBGC flexibility to use new technology in the future without amending its regulations. OIG PARTICIPATION IN MENTORING Both the Inspector General and the Deputy Inspector General are participating in special mentoring programs: • The Inspector General was invited to be a mentor in PBGC’s “Leaders Growing Leaders” Program, which was recently cited by the General Accounting Office as a model of innovation for succession planning. The Inspector General is sponsoring a high potential candidate in developing leadership skills that are needed to achieve results for PBGC. • The Deputy IG helped design a new training program as follow-on leadership development for employees who have completed a PBGC nine-month mentor program. The “Leadership Toolkit” is divided into 4 modules of leadership areas, with two PBGC leaders working with a group of 7 mentorees on each topic area. Both the Inspector General and Deputy Inspector General were invited to lead sessions, one in Oral Communications and one in Leadership Attributes. CELEBRATION OF 25TH ANNIVERSARY OIG celebrated the 25th Anniversary of the law establishing the position of Federal Inspectors General with an Open House on October 15. The event, which was held in the OIG’s office and attended by more than 200 PBGC staff, was designed to promote a better understanding of the role of the OIG and the accomplishments of the inspector general community. Attendees met the staff and learned of OIG efforts to promote economy and efficiency and prevent fraud, waste and abuse in PBGC programs and operations. The event also showcased OIG contributions over the years to the Corporation and the Federal government. PCIE/ECIE AWARDS The President's Council on Integrity and Efficiency (PCIE) and the Executive Council on Integrity and Efficiency (ECIE) recently presented five (5) awards to employees of the OIG at the PCIE/ECIE Sixth Annual Awards Ceremony. One of the awards was shared by members of the Resolution and Audit Follow-up Team, which included members representing both management and the OIG. The PCIE is primarily comprised of the Presidentially-appointed IGs and the ECIE is primarily comprised of IGs appointed by agency heads. Officials from OMB, the FBI, the Office of Government Ethics, Office of Special Counsel, and OPM serve on both Councils. Our awards included awards for excellence in audit, in investigations, in administrative support, and a special act award for fraud alerts to PBGC employees. APPENDIX CROSS-REFERENCE TO REPORTING REQUIREMENTS OF THE INSPECTOR GENERAL ACT The table below cross-references the reporting requirements prescribed by the Inspector General Act of 1978, as amended, to the specific pages in the report where they are addressed. Inspector General Act Reference Reporting Requirements Page Section 4 (a) (2) Review of legislation and regulations. 10 Section 5 (a) (1) Significant problems, abuses, and deficiencies. 2 – 3, 6 Section 5 (a) (2) Recommendations with respect to significant problems, abuses, and deficiencies. 2 – 3, 6 Section 5 (a) (3) Prior significant recommendations on which corrective actions has not been completed. 4 15-19 Section 5 (a) (4) Matters referred to prosecutive authorities. 9 Section 5 (a) (5) Summary of instances where information was refused. 5 Section 5 (a) (6) List of audit reports by subject matter, showing dollar value of questioned costs and funds put to better use. 6 Section 5 (a) (7) Summary of each particularly significant report. 2 – 3, 6 Section 5 (a) (8) Statistical table showing number of reports and dollar value of questioned costs. 12 Section 5 (a) (9) Statistical table showing number of reports and dollar value of recommendations that funds be put to better use. 13 Section 5 (a) (10) Summary of each audit issued before this reporting period for which no management decision was made by end of reporting period. None Section 5 (a) (11) Significant revised management decisions. None Section 5 (a) (12) Significant management decisions with which the Inspector General disagrees. 5 REPORTS ISSUED WITH QUESTIONED COSTS * For The Six-month Period Ending SEPTEMBER 30, 2003 NUMBER OF REPORTS QUESTIONED COSTS UNSUPPORTED COSTS A. For which no management decision has been made by the commencement of the reporting period 0 -0- -0- B. Which were issued during the reporting period 0 -0- -0- Subtotal (Add A & B) 0 -0- -0- C. For which a management decision was made during the reporting period 0 -0- -0- (i) dollar value of disallowed costs 0 -0- -0- (ii) dollar value of costs not disallowed 0 -0- - 0- D. For which no management decision has been made by the end of the reporting period 0 -0- -0- E. Reports for which no management decision was made within six months of issuance 0 -0- -0- * This statistical information is required by section 5(a)(8) of the Inspector General Act of 1978, as amended. REPORTS ISSUED WITH RECOMMENDATIONS THAT FUNDS BE PUT TO BETTER USE * For The Six-month Period Ending SEPTEMBER 30, 2003 NUMBER OF REPORTS DOLLAR VALUE A. For which no management decision has been made by the commencement of the reporting period 0 -0- B. Which were issued during the reporting period 0 -0- Subtotal (Add A & B) 0 -0- C. For which a management decision was made during the reporting period 0 -0- (i) dollar value of recommendations that were agreed to by management 0 -0- -- based on proposed management action 0 -0- -- based on proposed legislative action 0 -0- (ii) dollar value of recommendations that were not agreed to by management 0 -0- D. For which no management decision has been made by the end of the reporting period 0 -0- Reports for which no management decision was made within six months of issuance 0 -0- * This statistical information is required by section 5(a)(9) of the Inspector General Act of 1978, as amended. OPEN RECOMMENDATIONS For The Six-month Period Ending SEPTEMBER 30, 2003 Report Report Number Date Issued Recommendation Number Recommendation Audit of the Pension Benefit Guaranty Corporation’s Fiscal Years 1997 and 1996 Financial Statements 98-3/ 23126-2 3/23/98 FOD-268 Complete its efforts to integrate its financial management systems, in accordance with OMB Circular A-127 and its Five-Year Financial Management Systems Plan. Improvements Are Needed To Achieve Better Efficiency And Effectiveness In PBGC’s Benefit Determination Process 99-2/ 23128-1 3/2/99 IOD-168 Enforce compliance with time accounting requirements established in IOD’s Procedures Manual. Fiscal Year 1998 Financial Statement Audit-Management Report 99-8/ 23132-3 9/23/99 FOD-274 Enhance financial reporting controls surrounding PAS to improve the system’s ability to accurately track premiums receivable on a plan basis. FOD-275 Analyze the existing year-end processes surrounding PAS and identify improvements that will reduce the necessity of manual adjustments, validity testing, and reclassifications at year-end. IOD-181 Establish a formal reconciliation process for the plans assumed from the prior paying agents whereby reconciliations are reviewed and approved by an appropriate level of management. Audit of the Pension Benefit Guaranty Corporation’s Fiscal Years 1999 and 1998 Financial Statements 2000-7/ 23138-2 3/31/00 IRMD-118 Finalize accreditation and certification of systems. Audit of the Pension Benefit Guaranty Corporation’s Fiscal Years 2000 and 1999 Financial Statements 2001-9/ 23149-2 3/29/01 IOD-197 Reassess use of the Authorizer Administration inclusion function. This functionality should be limited to special usage, logged and reviewed by PBGC management. OPEN RECOMMENDATIONS For The Six-month Period Ending SEPTEMBER 30, 2003 Report Report Number Date Issued Recommendation Number Recommendation Fiscal Year 2001 Financial Statement Audit-Management Letter 2002-6/ 23157-5 08/29/02 BD-2 Develop a system to specifically identify limitation administrative expenses and develop fiscal year budgets using the specific identification methods. BD-3 Provide documentation to support the accuracy of the allocation ratio and the propriety of designating administrative expenses as not being subject to limitation as defined in the appropriation law. IOD-204 Amend PRISM Trial Balance Reconciliation review procedures in TP 11.1 to require that the reconciliations be imaged in IPS after supervisory review. IOD-207 Amend TP 30.1 to include deadlines for completion of the monthly reconciliations and to require supervisory review and approval. IOD-208 Implement monthly procedures to submit a list of inactive participants to the PRISM team before the month-end cut-off to update the pay status to inactive and to verify that the submitted changes were made. IOD-209 Modify TP 12.7 and 12.8 to require that the audit working papers be imaged, including the sample selected, the database associated with the sample, all sources used to test the sample and the errors found in the sample. CTO-2 Implement the established policies and procedures for completing risk assessments to comply with OMB requirements. IRMD-131 Improve the information security structure to provide for enhanced responsibility and accountability. IRMD-132 Develop and document policies and procedures for the performance of periodic re-certifications of PBGC systems’ user accounts. OPEN RECOMMENDATIONS For The Six-month Period Ending SEPTEMBER 30, 2003 Report Report Number Date Issued Recommendation Number Recommendation IRMD-133 Implement periodic re-certifications of PBGC systems’ user accounts. IRMD-134 Establish monitoring procedures to enforce compliance with existing change control policies, procedures, and standards. IOD-210 For cases with data sources more than five years old, implement a procedure to determine whether 1) an updated data source would provide a more accurate estimate of the NRFFA liability and 2) a valuation is available or can be completed without a significant burden on resources. FOD-291 Revise the Controller Division Consolidated Procedures Manual to require that the promissory notes and financial assistance disbursement documents are timely placed in the General Accounting Branch vault, and sign-out logs are periodically reviewed to ensure documents are returned timely. FOD-293 Actively monitor derivatives activity by monitoring SSB’s accounting and reporting activities. FOD-294 Reconcile SSB and the investment managers’ derivative inventories and positions monthly. FOD-295 PBGC’s Board of Directors should review and approve PBGC’s investment policy once every two years Audit of the Pension Benefit Guaranty Corporation’s Fiscal Years 2001 and 2000 Financial Statements 2003-3/ 23168-2 01/30/03 CFND-5 Implement independent review procedures of unfunded benefit liability calculations for contingent liabilities. OPEN RECOMMENDATIONS For The Six-month Period Ending SEPTEMBER 30, 2003 Report Report Number Date Issued Recommendation Number Recommendation CFND-6 Reexamine the process for classifying and determining appropriate values of contingent liabilities to meet compressed financial reporting timeframes. CTO-5 Assign specific resources to complete the implementation of a fully functional and integrated enterprise-wide information security program, with priority given to implementation and monitoring of technical security standards. CTO-6 Develop enforcement mechanisms to ensure that all departments comply with the enterprise-wide information security program as well as consistently enforce policies and procedures for logical access to information resources that are based on the concepts of “least possible privilege.” FOD-297 Develop a systematic, reliable methodology for determining asset values of non-commingled assets of plans trusteed, pending trusteeship and probable for termination. Apply the methodology consistently in CFND, IOD, and FOD. FOD-301 Develop, document, and implement a process to track asset statements of non-commingled assets throughout PBGC as they are received. FOD-303 Document and implement a procedure to compare the asset information that is received after year-end cut-off to recorded amounts of non-commingled assets for reasonableness. OPEN RECOMMENDATIONS For The Six-month Period Ending SEPTEMBER 30, 2003 Report Report Number Date Issued Recommendation Number Recommendation IRMD-135 Update the PBGC Change Management Manual to include procedures governing the entire change management cycle, rather than limiting the focus to the usage of Peregrine Service Center. This updated manual should require all departments and users to consistently follow the same procedures and complete uniform documentation in a timely manner for the release of all changes into production. IRMD Management should establish monitoring procedures to enforce compliance with existing change control policies, procedures, and standards. IRMD-136 Develop, document, approve, and implement a security plan for all key production environments that process PBGC’s financial systems that, at a minimum, follows the guidelines and standards prescribed by NIST and OMB. GLOSSARY The following defines the terms used in this report. Questioned Cost A cost the OIG has questioned because of an alleged violation of law, regulations, contract, grant, cooperative agreement, or other agreement or document governing the expenditure of funds; such cost is not supported by adequate documentation; or the expenditure of funds for the intended purpose is unnecessary or unreasonable. Unsupported Cost A cost the OIG has questioned because of a lack of adequate documentation at time of the audit. Disallowed Cost A questioned cost that management, in a management decision, has sustained or agreed should not be charged to the government. Funds To Be Put To Better Use Funds the OIG has identified in an audit recommendation that could be used more efficiently by reducing outlays, deobligating program or operational funds, avoiding unnecessary expenditures, or taking other efficiency measures. Management Decision Management's evaluation of audit findings and recommendations and issuance of a final decision concerning management's response to such findings and recommendations. Final Action The completion of all management actions -- that are described in a management decision -- with respect to audit findings and recommendations. If management concluded no actions were necessary, final action occurs when a management decision is issued. Misconduct Action of employees or contractors that violates law, rules, or regulations for which corrective action is warranted. IF YOU WANT TO REPORT OR DISCUSS CONFIDENTIALLY ANY INSTANCE OF MISCONDUCT, FRAUD, WASTE, ABUSE, OR MISMANAGEMENT, PLEASE CONTACT THE OFFICE OF INSPECTOR GENERAL. You can telephone: The Inspector General's HOTLINE 1-800-303-9737 Or you can write: Pension Benefit Guaranty Corporation Office of Inspector General P.O. Box 34177 Washington, D.C. 20043-4177