Financial Management Service: Areas for Improvement in Computer Controls
AIMD-99-10
Published: Oct 20, 1998. Publicly Released: Oct 20, 1998.
Skip to Highlights
Highlights
Pursuant to a legislative requirement, GAO reviewed the effectiveness of general computer controls over key financial systems used by the Financial Management Service (FMS).
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of the Treasury | To improve weaknesses in general controls cited in GAO's July 31, 1998, limited official use version of this report, the Secretary of the Treasury should direct the Commissioner of FMS, along with the FMS Information Resources Assistant Commissioner, to: (1) correct the individual weaknesses that GAO identified and communicated to FMS management during GAO's testing, which were summarized in the limited official use report; and (2) assign responsibility and accountability for correcting each weakness to designated individuals. These individuals should report to the Commissioner on the status of all weaknesses, including actions taken to correct them. |
Closed – Implemented
During GAO's fiscal year 1998 testing of the effectiveness of FMS general and application controls, GAO followed up on the status of the FMS' corrective actions to address vulnerabilities identified in GAO's audit for fiscal year 1997. GAO found that FMS had corrected or mitigated the risks associated with 24 of the 72 vulnerabilities that were identified in this report. GAO is closing this recommendation because the remaining outstanding corrective actions to correct vulnerabilities identified in this report have been included in the report on fiscal year 1998 testing results issued in October 1999 (GAO/AIMD-00-4).
|
| Department of the Treasury | To improve weaknesses in general controls cited in GAO's July 31, 1998, limited official use version of this report, the Secretary of the Treasury should direct the Commissioner of FMS, along with the FMS Information Resources Assistant Commissioner, to work with other appropriate assistant commissioners to ensure that an effective entitywide security planning and management program is in place. This program should include the following elements: (1) a strong central security management focal point to ensure that major elements of a risk management program are carried out and to provide a communications link among organizational units; (2) periodic risk assessments and needs determinations; (3) policy and controls implementation; (4) promotion of computer control awareness through training and other attention-getting techniques; and (5) evaluation and monitoring of policy and control effectiveness. |
Closed – Implemented
During the fiscal year 1998 testing of the effectiveness of FMS general and computer controls, GAO followed up on the status of implementing an effective entitywide security management program. In response to GAO's prior year recommendation, FMS officials have developed and implemented the "Project Manager's Security Handbook" which FMS has designed to provide overall guidance for the implementation and documentation of its information technology security controls. In addition, a security program manual, guidelines, detailed application handbook and user handbook are under development. However, FMS has not fully implemented its policies and procedures developed to date. GAO is closing this recommendation because the remaining outstanding corrective actions needed to correct this weakness have been included in GAO's report on fiscal 1998 testing results issued in October 1999 (GAO/AIMD-00-4).
|
| Department of the Treasury | To improve weaknesses in general controls cited in GAO's July 31, 1998, limited official use version of this report, the Secretary of the Treasury should direct the Commissioner of FMS, along with the FMS Information Resources Assistant Commissioner, to work with the Federal Reserve Banks to implement the corrective actions that GAO identified and communicated to them during GAO's testing related to FMS systems that Federal Reserve Banks support. |
Closed – Implemented
Subsequent follow-up work has shown that many of the vulnerabilities that were identified at the FRB related to FMS systems have been corrected. Specifically, corrective actions have been taken on the application control vulnerability and 4 of the 5 general controls vulnerabilities identified at the FRBs GAO visited. FRB officials informed GAO that the FRBs had corrected or mitigated the risks associated with the remaining 3 general controls vulnerabilities at the sites GAO did not visit this year. Because these sites were not subject to testing during fiscal year 1998 based on GAO's rotational audit approach, it plans to verify the corrective actions reportedly taken on these three general controls vulnerabilities by the FRBs during its audit of the U.S. government's fiscal year 1999 financial statements. The remaining open general controls vulnerability is not considered as having a significant adverse impact on the FMS systems maintained and operated by the FRBs.
|
| Department of the Treasury | To improve weaknesses in general controls cited in GAO's July 31, 1998, limited official use version of this report, the Secretary of the Treasury should direct the Commissioner of FMS, along with the FMS Information Resources Assistant Commissioner, to identify the computer control weaknesses discussed in the limited official use report as a material weakness in FMS' fiscal year 1998 Federal Managers' Financial Integrity Act report and subsequent reports until they are corrected. |
Closed – Implemented
FMS acted on this recommendation and reported that computer control weaknesses exist in its systems. Specifically, FMS reported its computer control problems as a material weakness under the Federal Managers' Financial Integrity Act (FMFIA). In addition, FMS' computer control weaknesses contributed to Treasury's reporting of a material instance of non-conformance under the Federal Financial Management Improvement Act. Both of these issues were included in the fiscal year 1998 Treasury Accountability Report.
|
Full Report
Office of Public Affairs
Topics
Computer fraudComputer security policiesComputer securityConfidential communicationsContingency plansData integrityFederal agency accounting systemsFinancial management systemsInternal controlsFinancial management