Bureau of the Public Debt:

Areas for Improvement in Information Security Controls

GAO-05-467R: Published: Apr 18, 2005. Publicly Released: Apr 18, 2005.

Additional Materials:

Contact:

Gary T. Engel
(202) 512-8815
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2004 and 2003. As part of these audits, we performed a review of the general and application information security controls over key BPD financial systems. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2004 and 2003, BPD maintained, in all material respects, effective internal control, including general and application information security controls, relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2004, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. We found matters involving information security controls that we do not consider to be reportable conditions, but that nevertheless warrant BPD management's attention and action. This report presents the results of our fiscal year 2004 testing of the general and application information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt and the results of our follow-up on the status of BPD's corrective actions to address recommendations that were contained in our prior years' audits and open as of September 30, 2003. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to BPD management. We also assessed the general and application information security controls over key BPD financial systems that the Federal Reserve Banks (FRB) maintain and operate on behalf of BPD. We have communicated the results of such testing to the Board of Governors of the Federal Reserve System.

Our fiscal year 2004 audit procedures identified opportunities to strengthen certain information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. Specifically, our audit procedures identified six new general information security control issues that relate to access controls. In the Limited Official Use Only report, we made six recommendations to address the access control issues. Our follow-up on the status of BPD's corrective actions to address seven open recommendations related to six general and application information security control issues identified in prior years' audits for which actions were not complete as of September 30, 2003, identified the following: (1) as of September 30, 2004, corrective action on four of the seven recommendations had been completed, and (2) corrective action was in progress as of September 30, 2004, on the three remaining open recommendations, which relate to two prior issues involving access controls and application controls. We reaffirm our prior years' recommendations related to these issues. BPD provided comments on the detailed findings and recommendations in the separately issued Limited Official Use Only report. In those comments, the Commissioner of the Bureau of the Public Debt stated that seven of the eight open issues have been completely resolved, and the remaining one is in progress. BPD also stated that it intends to resolve the remaining issue before the end of this year.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendation for Executive Action

    Recommendation: The Commissioner of the Bureau of the Public Debt should direct the appropriate BPD officials to implement the six new detailed recommendations set forth in the separately issued Limited Official Use Only version of this report.

    Agency Affected: Department of the Treasury: Bureau of the Public Debt

    Status: Closed - Implemented

    Comments: In connection with its ongoing requirement to audit the U.S. government's financial statements, GAO reviewed the status of actions taken to address the information security control recommendations it made. As detailed in separate accomplishment reports, GAO found that BPD management had taken steps to implement the recommendations and strengthen its information security controls.

    Mar 27, 2014

    Mar 13, 2014

    Mar 12, 2014

    Feb 27, 2014

    Dec 23, 2013

    Dec 16, 2013

    Dec 12, 2013

    Dec 11, 2013

    Looking for more? Browse all our products here