This is the accessible text file for GAO report number GAO-14-693R 
entitled 'Management Report: Improvements Are Needed in the Bureau of 
the Fiscal Service's Information Systems Controls' which was released 
on July 18, 2014. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

GAO-14-693R: 

United States Government Accountability Office: 
GAO:
441 G St. N.W. 
Washington, DC 20548: 

July 18, 2014: 

Ms. Sheryl Morrow: 
Commissioner: 
Bureau of the Fiscal Service: 
Department of the Treasury: 

Management Report: Improvements Are Needed in the Bureau of the Fiscal 
Service's Information Systems Controls: 

Dear Ms. Morrow: 

In connection with our audit of the consolidated financial statements 
of the U.S. government,[Footnote 1] we audited and reported on the 
Schedules of Federal Debt Managed by the Bureau of the Fiscal Service 
(Fiscal Service) for the fiscal years ended September 30, 2013, and 
2012.[Footnote 2] As part of these audits, we performed a review of 
information systems controls over key Fiscal Service financial systems 
relevant to the Schedule of Federal Debt. 

As we reported in connection with our audits of the Schedules of 
Federal Debt for the fiscal years ended September 30, 2013, and 2012, 
although internal controls could be improved, Fiscal Service 
maintained, in all material respects, effective internal control over 
financial reporting relevant to the Schedule of Federal Debt as of 
September 30, 2013, based on criteria established under 31 U.S.C. § 
3512(c), (d), commonly known as the Federal Managers' Financial 
Integrity Act. We identified a significant deficiency in Fiscal 
Service's internal control over financial reporting, which although 
not a material weakness, is important enough to merit the attention of 
those charged with governance of Fiscal Service.[Footnote 3] 
Specifically, during fiscal year 2013, we identified new deficiencies 
in Fiscal Service's information systems controls that along with 
unresolved control deficiencies from prior audits, collectively 
represent a significant deficiency in Fiscal Service's internal 
control over financial reporting. 

In late fiscal year 2011, the Department of the Treasury (Treasury) 
began consolidating the data centers and related operations of 
Treasury's Bureau of the Public Debt and Financial Management Service. 
On October 7, 2012, the Secretary of the Treasury (1) established the 
Fiscal Service as a bureau within Treasury, (2) consolidated and 
redesignated the Bureau of the Public Debt and the Financial 
Management Service as the Fiscal Service, and (3) transferred the 
duties of the Bureau of the Public Debt and Financial Management 
Service commissioners to the Commissioner of the Fiscal Service. In 
addition, in fiscal year 2013, Fiscal Service began testing a new 
general ledger system and implemented the new system in fiscal year 
2014. These continuing changes can introduce risks that require 
corresponding changes to controls and can hinder the effective 
operation of controls. Also, such changes could hamper Fiscal 
Service's ability to effectively and timely resolve the identified 
control deficiencies and could result in additional control 
deficiencies. Consequently, addressing the significant deficiency in 
this environment will require increased focus on assessing risks 
associated with these changes, monitoring the effectiveness of the 
operation of controls, and designing and implementing effective 
internal controls. 

This report presents the deficiencies we identified during our fiscal 
year 2013 testing of information systems controls over key Fiscal 
Service financial systems that are relevant to the Schedule of Federal 
Debt. This report also includes the results of our follow-up on the 
status of Fiscal Service's corrective actions to address information 
systems control-related deficiencies and associated recommendations 
contained in our prior years' reports that were open as of September 
30, 2012. In a separately issued Limited Official Use Only report, we 
communicated detailed information regarding our findings and related 
recommendations to the Commissioner of the Bureau of the Fiscal 
Service. 

We also assessed information systems controls over key financial 
systems maintained and operated by the Federal Reserve Banks (FRB) on 
behalf of Treasury relevant to the Schedule of Federal Debt. While we 
identified deficiencies in controls of information systems maintained 
and operated by the FRBs on behalf of Treasury relevant to the 
Schedule of Federal Debt, these deficiencies did not individually or 
collectively contribute to our conclusion that a significant 
deficiency exists over financial reporting relevant to the Schedule of 
Federal Debt. We issued a separate report to the Board of Governors of 
the Federal Reserve System on the results of that assessment.[Footnote 
4] 

Results in Brief: 

During fiscal year 2013, we identified 14 new information systems 
general control deficiencies related to security management,[Footnote 
5] access controls,[Footnote 6] and configuration management.[Footnote 
7] In the Limited Official Use Only report, we made 16 recommendations 
to address these control deficiencies. 

In addition, during our follow-up on the status of Fiscal Service's 
corrective actions to address information systems control-related 
deficiencies and associated recommendations contained in our prior 
years' reports that were open as of September 30, 2012, we determined 
that corrective actions were complete for 7 of the 13 open 
recommendations and corrective action was in progress for each of the 
6 remaining open recommendations related to access controls and 
configuration management. 

These new deficiencies in Fiscal Service's information systems 
controls, along with unresolved control deficiencies from prior 
audits, collectively represent a significant deficiency in Fiscal 
Service's internal control over financial reporting. The potential 
effect of these new and continuing deficiencies on the Schedule of 
Federal Debt financial reporting for fiscal year 2013 was mitigated 
primarily by Fiscal Service's physical security measures and 
compensating management and reconciliation controls designed to detect 
potential misstatements on the Schedule of Federal Debt. 

The Commissioner of the Bureau of the Fiscal Service provided comments 
on the detailed findings and recommendations in the separately issued 
Limited Official Use Only report. In those comments, the Commissioner 
stated that the Fiscal Service acknowledges the significant deficiency 
in internal control over financial reporting and continues to move 
forward to address this deficiency. The Commissioner further commented 
that the Fiscal Service is committed to having effective internal 
controls for its information technology systems. Accordingly, Fiscal 
Service will continue to look for efficient and effective ways to 
improve and ensure the consistent application of agency-wide security 
controls over all systems. 

Background: 

Treasury is authorized by Congress to borrow money backed by the full 
faith and credit of the United States to fund federal operations. 
Treasury is responsible for prescribing the debt instruments and 
otherwise limiting and restricting the amount and composition of the 
debt. Treasury is also responsible for issuing and redeeming debt 
instruments, paying interest to investors, and accounting for the 
resulting debt. In addition, Treasury maintains an investment program 
for federal government accounts, including trust funds that have 
legislative authority to invest temporary cash reserves not needed for 
current benefits and expenses. 

As of September 30, 2013, and 2012, federal debt managed by Treasury's 
Fiscal Service totaled about $16,732 billion and $16,059 billion, 
respectively, primarily for moneys borrowed to fund the federal 
government's operations. These balances consisted of approximately (1) 
$11,976 billion and $11,270 billion of debt held by the public as of 
September 30, 2013, and 2012, respectively, and (2) $4,756 billion as 
of September 30, 2013, and $4,789 billion as of September 30, 2012, of 
intragovernmental debt holdings. Total interest expense on federal 
debt managed by Fiscal Service for fiscal years 2013 and 2012 was 
about $425 billion and $432 billion, respectively. 

Treasury relies on a number of interconnected financial systems and 
electronic data to process and track the money that it borrows, to 
account for the securities it issues, and to manage the federal debt. 
Many FRBs provide fiscal agent services on behalf of Treasury. Such 
services primarily consist of issuing, servicing, and redeeming 
Treasury securities held by the public and handling the related 
transfers of funds. FRBs use a number of key financial systems to 
process debt-related transactions. Detailed data initially processed 
at FRBs are summarized and then forwarded electronically to the 
appropriate Treasury data center for matching, verification, and 
posting to Fiscal Service's general ledger. 

Information systems general controls are the structure, policies, and 
procedures that apply to an entity's overall computer operations. 
Information systems general controls establish the environment in 
which the application systems and controls operate. They include five 
general control areas--security management, access controls, 
configuration management, segregation of duties, and contingency 
planning.[Footnote 8] An effective information systems general control 
environment (1) provides a framework and continuing cycle of activity 
for managing risk, developing security policies, assigning 
responsibilities, and monitoring the adequacy of the entity's computer-
related controls (security management); (2) limits or detects access 
to computer resources, such as data, programs, equipment, and 
facilities, thereby protecting them against unauthorized modification, 
loss, and disclosure (access controls); (3) prevents unauthorized 
changes to information system resources, such as software programs and 
hardware configurations, and provides reasonable assurance that 
systems are configured and operating securely and as intended 
(configuration management); (4) includes policies, procedures, and an 
organizational structure to manage who can control key aspects of 
computer-related operations (segregation of duties); and (5) protects 
critical and sensitive data, and provides for critical operations to 
continue without disruption or be promptly resumed when unexpected 
events occur (contingency planning). 

Objectives, Scope, and Methodology: 

Our objectives were to evaluate information systems controls over key 
financial systems maintained and operated by, and on behalf of, 
Treasury that are relevant to the Schedule of Federal Debt, and to 
determine the status of Fiscal Service's corrective actions to address 
information systems control-related deficiencies and associated 
recommendations in our prior years' reports for which actions were not 
complete as of September 30, 2012. Our evaluation of information 
systems controls was conducted using the Federal Information System 
Controls Audit Manual.[Footnote 9] This work was performed in 
connection with our audit of the Schedules of Federal Debt for the 
fiscal years ended September 30, 2013, and 2012, for the purpose of 
supporting our opinion on Fiscal Service's internal control over 
financial reporting relevant to the Schedule of Federal Debt. 

To evaluate information systems controls, we identified and reviewed 
Fiscal Service's information systems control policies and procedures, 
observed controls in operation, conducted tests of controls, and held 
discussions with officials at the appropriate Treasury data center to 
determine whether controls were adequately designed, implemented, and 
operating effectively. 

The scope of our information systems general controls work for fiscal 
year 2013 included (1) following up on open recommendations from our 
prior years' reports and (2) using a risk-based approach to test the 
five general control areas related to the systems in which the 
applications operate and other critical control points in the systems 
or networks that could have an impact on the effectiveness of the 
information systems controls at Fiscal Service as they relate to 
financial reporting in the current year. In addition, we assessed 
software and network security over key Fiscal Service financial 
systems that are relevant to the Schedule of Federal Debt. 

We determined whether relevant application controls were appropriately 
designed and implemented, and then performed tests to determine 
whether the application controls were operating effectively. We 
reviewed six key Fiscal Service applications relevant to the Schedule 
of Federal Debt to determine whether the application controls were 
designed and operating effectively to provide reasonable assurance 
that: 

* all transactions that occurred were input into the system, accepted 
for processing, processed once and only once by the system, and 
properly included in output; 

* transactions were properly recorded in the proper period, key data 
elements input for transactions were accurate, data elements were 
processed accurately by applications that produce reliable results, 
and output was accurate; 

* all recorded transactions actually occurred, were related to the 
organization, and were properly approved in accordance with 
management's authorization, and output contained only valid data; 

* application data and reports and other output were protected against 
unauthorized access; and: 

* application data and reports and other relevant business information 
were readily available to users when needed. 

We also reviewed the information systems application control audit 
documentation from the work performed by the Treasury Office of 
Inspector General's contractor on two other key Fiscal Service 
applications. 

GAO used an independent public accounting (IPA) firm, under contract, 
to evaluate and test certain Fiscal Service information systems 
controls, including the follow-up on the status of Fiscal Service's 
corrective actions during fiscal year 2013 to address open 
recommendations from our prior years' reports. We agreed on the scope 
of the audit work, monitored the IPA firm's progress, and reviewed the 
related audit documentation to determine whether the firm's findings 
were adequately supported. 

During the course of our work, we communicated our findings to Fiscal 
Service management. We plan to follow up to determine the status of 
corrective actions taken for matters open as of September 30, 2013, 
during our audit of the fiscal year 2014 Schedule of Federal Debt. 

We performed our work in accordance with U.S. generally accepted 
government auditing standards. We believe that our audit provided a 
reasonable basis for our conclusions in this report. 

As noted above, we obtained agency comments on the detailed findings 
and recommendations in a draft of the separately issued Limited 
Official Use Only report. The Commissioner of the Bureau of the Fiscal 
Service's comments are summarized in the Agency Comments section of 
this report. 

Assessment of Fiscal Service's Information Systems Controls: 

During our fiscal year 2013 audit, we identified 14 new information 
systems general control deficiencies. Three of these deficiencies 
related to security management, seven related to access controls, and 
four related to configuration management. These new deficiencies in 
Fiscal Service's information systems controls, along with unresolved 
control deficiencies from prior audits, collectively represent a 
significant deficiency in Fiscal Service's internal control over 
financial reporting. 

Security management is the foundation of a security control structure 
and a reflection of senior management's commitment to addressing 
security risks. Effectively designed and implemented security 
management programs establish a framework and continuous cycle of 
activity for assessing risk, developing and implementing effective 
security procedures, and monitoring the effectiveness of these 
procedures. Without a well-designed security management program, 
security controls may be inadequate; responsibilities may be unclear, 
misunderstood, or improperly implemented; and controls may be 
inconsistently applied. Such conditions may lead to insufficient 
protection of sensitive or critical resources and disproportionately 
high expenditures for controls over low-risk resources. 

Access controls limit access or detect inappropriate access to 
computer resources (data, equipment, and facilities), thereby 
protecting them from unauthorized modification, loss, disclosure, or a 
combination of these. Such controls include logical access controls 
and physical access controls. The new access control deficiencies we 
identified during fiscal year 2013 related to logical access controls. 
Effectively designed and implemented logical access controls require 
users to authenticate themselves through the use of passwords or other 
identifiers, and limit the files and other resources that 
authenticated users can access and the actions that they can execute 
based on a valid need that is determined by assigned official duties. 

Configuration management involves the identification and management of 
security features for all hardware, software, and firmware components 
of an information system at a given point and systematically controls 
changes to that configuration during the system's life cycle. 
Effectively designed and implemented configuration management controls 
provide reasonable assurance that only authorized and fully tested 
changes are made to critical components at each system sublevel (i.e., 
network, operating systems, and infrastructure applications). In 
addition, effectively designed and implemented configuration 
management controls provide reasonable assurance that applications and 
changes to the applications go through a formal, documented systems 
development process that identifies all changes to the baseline 
configuration. To reasonably assure that changes to applications are 
necessary, work as intended, and do not result in the loss of data or 
program integrity, such changes should be documented, authorized, 
tested, and independently reviewed. 

In a separately issued Limited Official Use Only report, we 
communicated to the Commissioner of the Bureau of the Fiscal Service 
detailed information regarding the 14 new information systems general 
control deficiencies and made 16 recommendations to address these 
control deficiencies. 

In addition, our follow-up on the status of actions taken by Fiscal 
Service to address previously identified, but unresolved, information 
systems general control deficiencies as of September 30, 2012, found 
that corrective actions were complete for 7 of the 13 open 
recommendations and corrective action was in progress for each of the 
6 remaining open recommendations. 

The new deficiencies in Fiscal Service's information systems controls, 
along with unresolved control deficiencies from prior audits, 
collectively represent a significant deficiency in Fiscal Service's 
internal control over financial reporting. The potential effect of 
these new and continuing deficiencies on the Schedule of Federal Debt 
financial reporting for fiscal year 2013 was mitigated primarily by 
Fiscal Service's physical security measures and compensating 
management and reconciliation controls designed to detect potential 
misstatements on the Schedule of Federal Debt. Nevertheless, these new 
and continuing deficiencies impair management's ability to obtain 
reasonable assurance regarding the effectiveness of controls, 
including change management controls, and increase the risk of 
unauthorized access, modification, or disclosure of sensitive data and 
programs, which could result in the disruption of critical operations 
and therefore warrant the attention and action of management. 

Agency Comments: 

The Commissioner of the Bureau of the Fiscal Service provided comments 
on the detailed findings and recommendations in the separately issued 
Limited Official Use Only report. In those comments, the Commissioner 
stated that Fiscal Service acknowledges the significant deficiency in 
internal control over financial reporting and continues to move 
forward to address this deficiency. The Commissioner further commented 
that Fiscal Service is committed to having effective internal controls 
for its information technology systems. Accordingly, Fiscal Service 
will continue to look for efficient and effective ways to improve and 
ensure the consistent application of agency-wide security controls 
over all systems. We plan to follow up to determine the status of 
corrective actions taken for matters open as of September 30, 2013, 
during our audit of the fiscal year 2014 Schedule of Federal Debt. 

In the separately issued Limited Official Use Only report, we noted 
that the head of a federal agency is required by 31 U.S.C. § 720 to 
submit a written statement on actions taken on our recommendations to 
the Senate Committee on Homeland Security and Governmental Affairs and 
to the House Committee on Oversight and Government Reform not later 
than 60 days after the date of this report. A written statement must 
also be sent to the Senate and House Committees on Appropriations with 
the agency's first request for appropriations made more than 60 days 
after the date of the report. 

We are sending copies of this report to interested congressional 
committees, the Secretary of the Treasury, the Inspector General of 
the Department of the Treasury, and the Director of the Office of 
Management and Budget. In addition, this report is available at no 
charge on the GAO website at [hyperlink, http://www.gao.gov/]. 

If you have any questions regarding this report, please contact me at 
(202) 512-3406 or engelg@gao.gov. Contact points for our offices of 
Congressional Relations and Public Affairs may be found on the last 
page of this report. GAO staff members who made major contributions to 
this report include Nicole M. Burkart, Dianne D. Guensberg, David B. 
Hayes, and Jeffrey L. Knott (Assistant Directors) and Mickie E. Gray, 
Charles E. Jones, and Yiming Wu. 

Sincerely yours, 

Signed by: 

Gary T. Engel: 
Director: 
Financial Management and Assurance: 

[End of section] 

Footnotes: 

[1] 31 U.S.C. § 331(e)(2). Because the Bureau of the Fiscal Service is 
a bureau within the Department of the Treasury, federal debt and 
related activity and balances managed by it are also significant to 
the consolidated financial statements of the Department of the 
Treasury (see 31 U.S.C. § 3515(b)). 

[2] GAO, Financial Audit: Bureau of the Fiscal Service's Fiscal Years 
2013 and 2012 Schedules of Federal Debt, [hyperlink, 
http://www.gao.gov/products/GAO-14-173] (Washington, D.C.: Dec. 12, 
2013). 

[3] A significant deficiency is a deficiency, or a combination of 
deficiencies, in internal control that is less severe than a material 
weakness yet important enough to merit attention by those charged with 
governance. A material weakness is a deficiency, or a combination of 
deficiencies, in internal control such that there is a reasonable 
possibility that a material misstatement of the entity's financial 
statements will not be prevented, or detected and corrected, on a 
timely basis. A deficiency in internal control exists when the design 
or operation of a control does not allow management or employees, in 
the normal course of performing their assigned functions, to prevent, 
or detect and correct, misstatements on a timely basis. 

[4] GAO, Management Report: Areas for Improvement in the Federal 
Reserve Banks' Information Systems Controls, [hyperlink, 
http://www.gao.gov/products/GAO-14-691R] (Washington, D.C.: June 18, 
2014). 

[5] Security management provides a framework and continuing cycle of 
activity for managing risk, developing security policies, assigning 
responsibilities, and monitoring the adequacy of the entity's computer-
related controls. 

[6] Access controls limit access or detect inappropriate access to 
computer resources (data, equipment, and facilities), thereby 
protecting them from unauthorized modification, loss, disclosure, or a 
combination of these. 

[7] Configuration management involves the identification and 
management of security features for all hardware, software, and 
firmware components of an information system at a given point and 
systematically controls changes to that configuration during the 
system's life cycle. 

[8] GAO, Government Auditing Standards: 2011 Revision, [hyperlink, 
http://www.gao.gov/products/GAO-12-331G] (Washington, D.C.: December 
2011). 

[9] GAO, Federal Information System Controls Audit Manual (FISCAM), 
[hyperlink, http://www.gao.gov/products/GAO-09-232G] (Washington, 
D.C.: February 2009). 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the 
performance and accountability of the federal government for the 
American people. GAO examines the use of public funds; evaluates 
federal programs and policies; and provides analyses, recommendations, 
and other assistance to help Congress make informed oversight, policy, 
and funding decisions. GAO's commitment to good government is 
reflected in its core values of accountability, integrity, and 
reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's website [hyperlink, http://www.gao.gov]. Each 
weekday afternoon, GAO posts on its website newly released reports, 
testimony, and correspondence. To have GAO e-mail you a list of newly 
posted products, go to [hyperlink, http://www.gao.gov] and select 
"E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO's actual cost of 
production and distribution and depends on the number of pages in the 
publication and whether the publication is printed in color or black 
and white. Pricing and ordering information is posted on GAO's 
website, [hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
MasterCard, Visa, check, or money order. Call for additional 
information. 

Connect with GAO: 

Connect with GAO on facebook, flickr, twitter, and YouTube.
Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts.
Visit GAO on the web at [hyperlink, http://www.gao.gov]. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 
Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; 
E-mail: fraudnet@gao.gov; 
Automated answering system: (800) 424-5454 or (202) 512-7470. 

Congressional Relations: 

Katherine Siggerud, Managing Director, siggerudk@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, DC 20548. 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, DC 20548. 

[End of document]