Federal Reserve Banks:

Areas for Improvement in Information Security Controls

GAO-08-836R: Published: Jun 16, 2008. Publicly Released: Jun 16, 2008.

Additional Materials:

Contact:

Gary T. Engel
(202) 512-8815
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2007 and 2006. As part of these audits, we performed a review of the general and application information security controls over key financial systems maintained and operated by the Federal Reserve Banks (FRBs) on behalf of the Department of the Treasury's BPD relevant to the Schedule of Federal Debt. In our audit report on the Schedules of Federal Debt for the fiscal years ended September 30, 2007 and 2006, we concluded that BPD maintained, in all material respects, effective internal control relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2007, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. However, we found matters involving information security controls that we do not consider to be significant deficiencies. As it relates to controls over financial reporting and compliance with applicable laws and regulations, the potential effect of such control deficiencies was mitigated by the FRBs and BPD. The FRBs mitigated the potential effect of such control deficiencies with physical security measures and a program of monitoring user and system activity, and BPD with compensating management and reconciliation controls. Nevertheless, the matters relating to key financial systems maintained and operated by the FRBs on behalf of BPD warrant FRB management's attention and action. This report presents the control deficiencies identified during our fiscal year 2007 testing of the general and application information security controls over key financial systems maintained and operated by the FRBs on behalf of the Department of theTreasury's BPD relevant to the Schedule of Federal Debt. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to FRB management.

Our fiscal year 2007 audit procedures identified 12 information security control deficiencies, all of which relate to general controls. Specifically, the control deficiencies identified were in the areas of entitywide security program planning and management, access control, and system software. In the Limited Official Use Only report, we made 14 detailed recommendations to address these control deficiencies. None of our findings pose significant risks to the FRB financial systems. As it relates to controls over financial reporting and compliance with applicable laws and regulations, the potential effect of such control deficiencies was mitigated by the FRBs and BPD. The FRBs mitigated the potential effect of such control deficiencies with physical security measures and a program of monitoring user and system activity, and BPD with compensating management and reconciliation controls that are designed to detect potential irregularities or improprieties in financial data or transactions. The Board of Governors of the Federal Reserve System provided comments on the detailed findings and recommendations in the separately issued Limited Official Use Only report. In those comments, the Director of Reserve Bank Operations and Payment Systems stated that the FRBs have already taken action on many of the recommendations and the Board of Governors will continue to work with the FRBs to determine appropriate information security controls and compensating measures to address the remaining recommendations.

Recommendation for Executive Action

  1. Status: Closed - Implemented

    Comments: In connection with our audits of the fiscal years 2008, 2009, and 2010 Schedules of Federal Debt, we reviewed the status of actions taken to address the open information security control recommendations at the Federal Reserve Banks (FRB) identified during our prior years' audit. As detailed in separate accomplishments, we found that FRB management had taken steps to implement the 14 recommendations and strengthen its information security controls.

    Recommendation: The Director of the Division of Reserve Bank Operations and Payment Systems should direct the appropriate FRB officials to implement the 14 detailed recommendations set forth in the separately issued Limited Official Use Only version of this report.

    Agency Affected: Federal Reserve System: Board of Governors: Division of Reserve Bank Operations and Payment Systems

 

Explore the full database of GAO's Open Recommendations »

Dec 18, 2014

Dec 17, 2014

Nov 20, 2014

Oct 6, 2014

Sep 17, 2014

Aug 5, 2014

Jul 31, 2014

Jun 18, 2014

Looking for more? Browse all our products here