Bureau of the Public Debt
Areas for Improvement in Information Systems Controls
Gao ID: GAO-11-528R April 27, 2011
In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2010 and 2009. As part of these audits, we performed a review of information systems controls over key BPD financial systems. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2010 and 2009, we concluded that BPD maintained, in all material respects, effective internal control over financial reporting relevant to the Schedule of Federal Debt as of September 30, 2010, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented, or detected and corrected on a timely basis. However, we identified information systems deficiencies affecting internal control over financial reporting, which, while we do not consider them to be collectively either a material weakness or significant deficiency, nevertheless warrant BPD management's attention and action. This report presents the control deficiencies we identified during our fiscal year 2010 testing of information systems controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD's corrective actions to address information systems control-related recommendations contained in our prior years' reports and open as of September 30, 2009. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to BPD management. We also assessed information systems controls over key financial systems that the Federal Reserve Banks (FRB) maintain and operate on behalf of BPD. We issued a separate report to the Board of Governors of the Federal Reserve System on the results from that assessment.
Our fiscal year 2010 audit procedures identified four new general information systems control deficiencies related to access controls, configuration management, and segregation of duties. We made six recommendations to address these control deficiencies. None of the control deficiencies we identified represented significant risks to the BPD financial systems. The potential effect of such control deficiencies on financial reporting relevant to the Schedule of Federal Debt was mitigated by BPD's physical security measures and a program of monitoring user and system activity, as well as compensating management and reconciliation controls designed to detect potential misstatements in the Schedule of Federal Debt. In addition, during our fiscal year 2010 follow-up on the status of BPD's corrective actions to address 11 open recommendations related to general information systems control deficiencies identified in prior years' audits, we determined that as of September 30, 2010, corrective action on 9 of the 11 recommendations was completed, while corrective action was in progress on the 2 remaining open recommendations related to access controls. BPD provided comments on the detailed findings and recommendations in the separately issued Limited Official Use Only report. In those comments, the Commissioner of BPD stated that of the six findings open as of September 30, 2010, one has been completely resolved and corrective actions for the remaining five are planned or in progress. The Commissioner further commented that BPD intends to implement corrective actions for two of the five remaining findings by August 2011 and for the other three by December 2011. We recommend that the Commissioner of the Bureau of the Public Debt direct the appropriate BPD officials to implement the six new detailed recommendations presented in the separately issued Limited Official Use Only report.
GAO-11-528R, Bureau of the Public Debt: Areas for Improvement in Information Systems Controls
This is the accessible text file for GAO report number GAO-11-528R
entitled 'Bureau of the Public Debt: Areas for Improvement in
Information Systems Controls' which was released on April 27, 2011.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
GAO-11-528R:
United States Government Accountability Office:
Washington, DC 20548:
April 27, 2011:
The Honorable Van Zeck:
Commissioner:
Bureau of the Public Debt:
Subject: Bureau of the Public Debt: Areas for Improvement in
Information Systems Controls:
Dear Mr. Zeck:
In connection with fulfilling our requirement to audit the financial
statements of the U.S. government,[Footnote 1] we audited and reported
on the Schedules of Federal Debt Managed by the Bureau of the Public
Debt (BPD) for the fiscal years ended September 30, 2010 and 2009.
[Footnote 2] As part of these audits, we performed a review of
information systems controls over key BPD financial systems.
As we reported in connection with our audit of the Schedules of
Federal Debt for the fiscal years ended September 30, 2010 and 2009,
we concluded that BPD maintained, in all material respects, effective
internal control over financial reporting relevant to the Schedule of
Federal Debt as of September 30, 2010, that provided reasonable
assurance that misstatements, losses, or noncompliance material in
relation to the Schedule of Federal Debt would be prevented, or
detected and corrected on a timely basis. However, we identified
information systems deficiencies affecting internal control over
financial reporting, which, while we do not consider them to be
collectively either a material weakness or significant deficiency,
nevertheless warrant BPD management's attention and action.[Footnote 3]
This report presents the control deficiencies we identified during our
fiscal year 2010 testing of information systems controls that support
key BPD automated financial systems relevant to BPD's Schedule of
Federal Debt. This report also includes the results of our follow-up
on the status of BPD's corrective actions to address information
systems control-related recommendations contained in our prior years'
reports and open as of September 30, 2009. In a separately issued
Limited Official Use Only report, we communicated detailed information
regarding our findings to BPD management. We also assessed information
systems controls over key financial systems that the Federal Reserve
Banks (FRB) maintain and operate on behalf of BPD. We issued a
separate report to the Board of Governors of the Federal Reserve
System on the results from that assessment.
Results in Brief:
Our fiscal year 2010 audit procedures identified four new general
information systems control deficiencies related to access controls,
configuration management, and segregation of duties. We made six
recommendations to address these control deficiencies.
None of the control deficiencies we identified represented significant
risks to the BPD financial systems. The potential effect of such
control deficiencies on financial reporting relevant to the Schedule
of Federal Debt was mitigated by BPD's physical security measures and
a program of monitoring user and system activity, as well as
compensating management and reconciliation controls designed to detect
potential misstatements in the Schedule of Federal Debt.
In addition, during our fiscal year 2010 follow-up on the status of
BPD's corrective actions to address 11 open recommendations related to
general information systems control deficiencies identified in prior
years' audits, we determined that as of September 30, 2010, corrective
action on 9 of the 11 recommendations was completed, while corrective
action was in progress on the 2 remaining open recommendations related
to access controls.
BPD provided comments on the detailed findings and recommendations in
the separately issued Limited Official Use Only report. In those
comments, the Commissioner of BPD stated that of the six findings open
as of September 30, 2010, one has been completely resolved and
corrective actions for the remaining five are planned or in progress.
The Commissioner further commented that BPD intends to implement
corrective actions for two of the five remaining findings by August
2011 and for the other three by December 2011.
Background:
The Department of the Treasury (Treasury) is authorized by Congress to
borrow money backed by the full faith and credit of the United States
to fund federal operations. Treasury is responsible for prescribing
the debt instruments and otherwise limiting and restricting the amount
and composition of the debt. BPD, an organizational entity within the
Fiscal Service of the Treasury, is responsible for issuing and
redeeming debt instruments, paying interest to investors, and
accounting for the resulting debt. In addition, BPD has been given the
responsibility for issuing Treasury securities to trust funds for
trust fund receipts not needed for current benefits and expenses.
As of September 30, 2010 and 2009, federal debt managed by BPD totaled
about $13.5 trillion and $11.9 trillion, respectively, primarily for
moneys borrowed to fund the federal government's operations. These
balances consisted of approximately (1) $9.0 trillion and $7.6
trillion of debt held by the public as of September 30, 2010 and 2009,
respectively, and (2) $4.5 trillion and $4.3 trillion of
intragovernmental debt holdings as of September 30, 2010 and 2009,
respectively. Total interest expense on federal debt managed by BPD
for fiscal years 2010 and 2009 was about $413 billion and $381
billion, respectively.
BPD relies on a number of interconnected financial systems and
electronic data to process and track the money that it borrows and to
account for the securities it issues. Many of the FRBs provide fiscal
agent services on behalf of BPD. Such services primarily consist of
issuing, servicing, and redeeming Treasury securities held by the
public and handling the related transfers of funds. FRBs use a number
of key financial systems to process debt-related transactions.
Detailed data initially processed at the FRBs are summarized and then
forwarded electronically to BPD's data center for matching,
verification, and posting to the general ledger.
Objectives, Scope, and Methodology:
Our objectives were to evaluate information systems controls over key
financial management systems maintained and operated by, and on behalf
of, BPD relevant to the Schedule of Federal Debt and to determine the
status of BPD's corrective actions to address information systems
control-related recommendations in our prior years' reports for which
actions were not complete as of September 30, 2009. Our evaluation of
information systems controls was conducted using the Federal Information
System Controls Audit Manual (FISCAM).[Footnote 4]
To evaluate information systems controls, we identified and reviewed
BPD's information systems control policies and procedures, observed
controls in operation, conducted tests of controls, and held
discussions with officials at the BPD data center to determine whether
controls were adequately designed, implemented, and operating
effectively.
The scope of our general information systems controls work for fiscal
year 2010 included (1) following up on open recommendations from our
prior years' reports and (2) using a risk-based approach to testing
the five FISCAM general control areas related to the systems in which
the applications operate and other critical control points in the
systems or networks that could impact the effectiveness of the
information systems controls at BPD in the current year. In addition,
we performed security diagnostics and vulnerability assessment testing
of BPD's internal information system environment.
We determined whether relevant application controls were appropriately
designed and implemented, and then performed tests to determine
whether the application controls were operating effectively. We
reviewed five key BPD applications to determine whether the
application controls were designed and operating effectively to
provide reasonable assurance that:
* all transactions that occurred were input into the system, accepted
for processing, processed once and only once by the system, and
properly included in output;
* transactions were properly recorded in the proper period, key data
elements input for transactions were accurate, data elements were
processed accurately by applications that produce reliable results,
and output was accurate;
* all recorded transactions actually occurred, related to the
organization, and were properly approved in accordance with
management's authorization, and output contained only valid data;
* application data and reports and other output were protected against
unauthorized access; and;
* application data and reports and other relevant business information
were readily available to users when needed.
We also reviewed the application information systems control audit
documentation from the work performed by the Treasury Office of
Inspector General's contractor on two other key BPD applications.
Because the FRBs are integral to the operations of BPD, we assessed
the information systems controls over financial systems that the FRBs
maintain and operate relevant to the Schedule of Federal Debt. This
included using a risk-based approach to testing the five FISCAM
general control areas related to the systems in which the
applications operate and other critical control points in the systems
or networks that could impact the effectiveness of the information
systems controls. We also evaluated the relevant application controls
over four key financial applications maintained and operated by the
FRBs. We issued a separate report to the Board of Governors of the
Federal Reserve System on the results from that assessment.
The independent public accounting (IPA) firm of Cotton and Company LLP
evaluated and tested certain BPD information systems controls,
including the follow-up on the status of BPD corrective actions during
fiscal year 2010 to address open recommendations from our prior years'
reports. We agreed on the scope of the audit work, monitored the IPA
firm's progress, and reviewed the related audit documentation to
determine that the firm's findings were adequately supported.
During the course of our work, we communicated our findings to BPD
management. We plan to follow up to determine the status of corrective
actions taken for matters open as of September 30, 2010, during our
audit of the fiscal year 2011 Schedule of Federal Debt.
We performed our work at the BPD data center where the operations of
the systems we reviewed are supported. Our work was performed from
February 2010 through October 2010 in accordance with U.S. generally
accepted government auditing standards. We believe that our audit
provided a reasonable basis for our conclusions in this report.
As noted above, we obtained agency comments on the detailed findings
and recommendations in a draft of the separately issued Limited
Official Use Only report. BPD's comments are summarized in the Agency
Comments and Our Evaluation section of this report.
Assessment of BPD's Information Systems Controls:
General information systems controls are the structure, policies, and
procedures that apply to an entity's overall computer operations.
General information systems controls establish the environment in
which application systems and controls operate. They include security
management, access controls, configuration management, segregation of
duties, and contingency planning. An effective general information
systems control environment (1) provides a framework and continuing
cycle of activity for managing risk, developing security policies,
assigning responsibilities, and monitoring the adequacy of the
entity's computer-related controls to ensure that an adequate security
management program is in place; (2) limits or detects access to
computer resources (data, programs, equipment, and facilities),
thereby protecting them against unauthorized modification, loss, and
disclosure; (3) prevents unauthorized changes to information system
resources (for example, software programs and hardware configurations)
and provides reasonable assurance that systems are configured and
operating securely and as intended; (4) includes policies, procedures,
and an organizational structure to manage who can control key aspects
of computer-related operations; and (5) protects critical and
sensitive data, and provides for critical operations to continue
without disruption or be promptly resumed when unexpected events occur.
During our fiscal year 2010 testing, we identified opportunities to
strengthen certain information systems controls that support key BPD
financial systems relevant to BPD's Schedule of Federal Debt.
Specifically, we identified four new general information systems
control deficiencies related to access controls, configuration
management, and segregation of duties.
Access controls are important because they limit access or detect
inappropriate access to computer resources (data, equipment, and
facilities), thereby protecting them from unauthorized modification,
loss, and disclosure. Such controls include logical access controls
and physical access controls. The new access control deficiencies we
identified during fiscal year 2010 related to logical access controls.
Logical access controls require users to authenticate themselves
through the use of passwords or other identifiers, and limit the files
and other resources that authenticated users can access and the
actions that they can execute based on a valid need that is determined
by assigned official duties.
Configuration management is important because it involves the
identification and management of security features for all hardware,
software, and firmware components of an information system at a given
point and systematically controls changes to that configuration during
the system's life cycle. At each system sublevel (i.e., network,
operating systems, and infrastructure applications), configuration
management controls provide reasonable assurance that only authorized
changes are made to such critical components. In addition,
configuration management controls provide reasonable assurance that
applications and changes to the applications go through a formal,
documented systems development process that identifies all changes to
the baseline configuration.
Segregation of duties is important because work responsibilities
should be segregated so that one individual does not control all
critical stages of a process. Segregation of duties is achieved by
splitting responsibilities between two or more organizational groups.
In addition, dividing duties this way diminishes the likelihood that
errors and wrongful acts will go undetected because the activities of
one group or individual will serve as a check on the activities of the
other.
In a separately issued Limited Official Use Only report, we
communicated detailed information regarding our new findings to BPD
management and made six detailed recommendations.
In addition, our fiscal year 2010 follow-up on the status of actions
taken to address unresolved general information systems control
deficiencies we identified in our prior years' audits for which
actions were not complete as of September 30, 2009, found that BPD
completed corrective actions on 9 of the 11 open recommendations,
while corrective action was in progress on the two remaining open
recommendations related to access controls. Although BPD management
has made progress in addressing the remaining two general information
systems control deficiencies, additional actions are needed.
None of the control deficiencies we identified represented significant
risks to the BPD financial systems. The potential effect of such
control deficiencies on financial reporting relevant to the Schedule
of Federal Debt was mitigated by BPD's physical security measures and
a program of monitoring user and system activity, as well as
compensating management and reconciliation controls designed to detect
potential misstatements in the Schedule of Federal Debt. Nevertheless,
these deficiencies warrant management's attention and action to limit
the risk of unauthorized access, loss, or disclosure; modification of
sensitive data and programs; and disruption of critical operations.
Assessment of FRB Information Systems Controls:
Because the FRBs are integral to the operations of BPD, we assessed
information systems controls over key financial systems maintained and
operated by the FRBs on behalf of BPD. We issued a separate report to
the Board of Governors of the Federal Reserve System on the results
from that assessment.
Conclusion:
BPD has made significant progress in addressing the open information
systems control recommendations from our prior years' audits, and
while actions are still needed in two control areas, it has corrective
actions under way or planned. Our fiscal year 2010 audit also
identified four new general information systems control deficiencies
related to access controls, configuration management, and segregation
of duties.
Recommendation for Executive Action:
We recommend that the Commissioner of the Bureau of the Public Debt
direct the appropriate BPD officials to implement the six new detailed
recommendations presented in the separately issued Limited Official
Use Only report.
Agency Comments and Our Evaluation:
BPD provided comments on the detailed findings and recommendations in
the separately issued Limited Official Use Only report. In those
comments, the Commissioner of BPD stated that of the six findings open
as of September 30, 2010, one has been completely resolved and
corrective actions for the remaining five are planned or in progress.
The Commissioner also stated that BPD intends to implement corrective
actions for two of the five remaining findings by August 2011 and for
the other three by December 2011. We plan to follow up to determine
the status of corrective actions taken for these matters during our
audit of the fiscal year 2011 Schedule of Federal Debt.
In the separately issued Limited Official Use Only report, we noted
that the head of a federal agency is required by 31 U.S.C. § 720 to
submit a written statement on actions taken on our recommendations to
the Senate Committee on Homeland Security and Governmental Affairs and
to the House Committee on Oversight and Government Reform not later
than 60 days after the date of the Limited Official Use Only report. A
written statement must also be sent to the Senate and House Committees
on Appropriations with the agency's first request for appropriations
made more than 60 days after the date of that report. In the Limited
Official Use Only report, we also requested a copy of your responses.
We are sending copies of this report to interested congressional
committees, the Secretary of the Treasury, the Inspector General of
the Department of the Treasury, and the Director of the Office of
Management and Budget. This report also is available at no charge on
the GAO's Web site at [hyperlink, http://www.gao.gov].
If you have any questions regarding this report, please contact me at
(202) 512-3406 or engelg@gao.gov. Contact points for our Offices of
Congressional Relations and Public Affairs may be found on the last
page of this report. GAO staff who made major contributions to this
report are Jeffrey L. Knott and Dawn B. Simpson, Assistant Directors;
Edmund F. Fernandez; and George C. Kovachick.
Sincerely yours,
Signed by:
Gary T. Engel:
Director:
Financial Management and Assurance:
[End of section]
Footnotes:
[1] 31 U.S.C. § 331(e)(2). As a bureau within the Department of the
Treasury, federal debt and related activity and balances are also
significant to the consolidated financial statements of the Department
of the Treasury (see 31 U.S.C. § 3515(b)).
[2] GAO, Financial Audit: Bureau of the Public Debt's Fiscal Years
2010 and 2009 Schedules of Federal Debt, [hyperlink,
http://www.gao.gov/products/GAO-11-52] (Washington, D.C.: Nov. 8,
2010).
[3] A material weakness is a deficiency, or a combination of
deficiencies, in internal control such that there is a reasonable
possibility that a material misstatement of the entity's financial
statements will not be prevented, or detected and corrected on a
timely basis. A significant deficiency is a deficiency, or combination
of deficiencies, in internal control that is less severe than a
material weakness, yet important enough to merit attention by those
charged with governance. A deficiency in internal control exists when
the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned
functions, to prevent, or detect and correct, misstatements on a
timely basis.
[4] GAO, Federal Information System Controls Audit Manual, [hyperlink,
http://www.gao.gov/products/GAO-09-232G] (Washington, D.C.: February
2009).
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548: