Skip to main content

Bureau of the Public Debt: Areas for Improvement in Information Security Controls

GAO-10-517R Published: Mar 26, 2010. Publicly Released: Mar 26, 2010.
Jump To:
Skip to Highlights

Highlights

In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2009 and 2008. As part of these audits, we performed a review of the general and application information security controls over key BPD financial systems. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2009 and 2008, we concluded that BPD maintained, in all material respects, effective internal control relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2009, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. However, we found deficiencies involving information security controls that we do not consider to be significant deficiencies. With regard to financial reporting and compliance with applicable laws and regulations, BPD mitigated the potential effect of such control deficiencies with physical security measures, a program of monitoring user and system activity, and compensating management and reconciliation controls. Nevertheless, these matters warrant BPD management's attention and action. This report presents the control deficiencies we identified during our fiscal year 2009 testing of the general and application information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD's corrective actions to address recommendations that were contained in our prior years' audit reports and open as of September 30, 2008.

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
Bureau of the Public Debt The Commissioner of the Bureau of the Public Debt should direct the appropriate BPD officials to implement the seven new detailed recommendations set forth in the separately issued Limited Official Use Only version of this report.
Closed – Implemented
In connection with our audits of the fiscal years 2010 and 2011 Schedules of Federal Debt, we reviewed the status of actions taken to address the open information systems control recommendations at the Department of the Treasury's Bureau of the Public Debt (BPD) identified during our prior years' audits. As detailed in separate accomplishments, we found that BPD management had taken steps to implement the specific recommendations and strengthen its information systems controls.

Full Report

Office of Public Affairs

Topics

Auditing proceduresAuditsConfiguration controlFederal debtFinancial managementFinancial statementsInformation securityInformation security managementInformation systemsInternal controlsMaterialityOperational testingPublic debtRisk factorsSecurity policiesSystems analysisSystems designCorrective actionFinancial reporting