This is the accessible text file for GAO report number GAO-04-672R entitled 'Federal Reserve Banks: Areas for Improvement in Computer Controls' which was released on May 12, 2004. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. May 12, 2004: Louise L. Roseman, Director, Division of Reserve Bank Operations and Payment Systems Board of Governors of the Federal Reserve System: Subject: Federal Reserve Banks: Areas for Improvement in Computer Controls: Dear Ms. Roseman: In connection with fulfilling our requirement to audit the financial statements of the U.S. government,[Footnote 1] we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2003 and 2002.[Footnote 2] As part of these audits, we performed a review of the general and application computer controls over key financial systems maintained and operated by the Federal Reserve Banks (FRB) on behalf of the Department of the Treasury's BPD. Many of the FRBs perform fiscal agent services on behalf of the U.S. government, including BPD. The debt-related services primarily consist of issuing, servicing, and redeeming Treasury securities and processing secondary market securities transfers. In fiscal year 2003, the FRBs issued about $4.1 trillion in federal debt securities to the public, redeemed about $3.8 trillion of debt held by the public, and processed about $125 billion in interest payments on debt held by the public. FRBs maintain and operate key financial applications on behalf of BPD and an array of financial and information systems to process and reconcile monies disbursed and collected on behalf of BPD. The scope of our work for fiscal year 2003 included a review of the general and application computer controls over key financial systems maintained and operated by the FRBs on behalf of BPD and follow-up on unresolved vulnerabilities identified in prior years' audits of these systems. We use a risk-based and rotation approach for testing general computer controls. Each general control area is subjected to a full- scope review, including testing, at least once every 3 years. The computer control areas we review are defined in the Federal Information System Controls Audit Manual.[Footnote 3] Areas considered to be of higher risk are subject to more frequent review. The applications are subjected to a full-scope review every year. General computer controls are intended to (1) protect data, files, and programs from unauthorized access, modification, disclosure, and destruction; (2) limit and monitor access to programs and files that control computer hardware and secure applications; (3) prevent the introduction of unauthorized changes to systems and applications software; and (4) ensure the recovery of computer processing operations in case of a disaster or other unexpected interruption. Application computer controls relate directly to the individual computer programs that are used to perform certain types of work, such as generating interest payments or recording transactions in a general ledger. In an effective general control environment, application controls help to ensure that transactions are valid, properly authorized, and completely and accurately processed and reported. Access controls for specific applications should establish individual accountability and proper segregation of duties, prevent unauthorized transactions from being entered into the application and processed by the computer, limit the processing privileges of individuals, and prevent and detect inappropriate or unauthorized activities. We performed our work at certain FRBs from April 2003 through October 2003 in accordance with U.S. generally accepted government auditing standards. We requested comments on a draft of this report from the Board of Governors of the Federal Reserve System. The comments are summarized later in this report and the written response from the Board of Governors is reprinted in the enclosure. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2003 and 2002, BPD maintained, in all material respects, effective internal control, including general and application computer controls, relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2003. BPD's internal control provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt for the fiscal year ended September 30, 2003, would be prevented or detected on a timely basis. We found matters involving computer controls that we do not consider to be reportable conditions.[Footnote 4] In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to FRB managers and made five recommendations that address application computer control vulnerabilities related to access controls. In addition, our follow-up on the status of the FRBs' corrective actions to address unresolved vulnerabilities identified in prior years' audits found that the FRBs had taken corrective action for three of the four open recommendations discussed in our prior report.[Footnote 5] The one remaining open recommendation related to access controls is now encompassed in one of the five new detailed recommendations contained in the Limited Official Use Only report. While the application computer control vulnerabilities reported do not pose significant risks to the financial systems maintained and operated by the FRBs on behalf of BPD, they warrant FRB managers' action to decrease the risk of unauthorized access or data misuse. We recommend that the Director of the Division of Reserve Bank Operations and Payment Systems assign responsibility and accountability for addressing the five recommendations to cognizant FRB officials. In commenting on a draft of this report, the Board of Governors of the Federal Reserve System stated that the information in this report and the Limited Official Use Only report will assist the FRBs in their ongoing efforts to enhance the integrity of their automated systems and information security practices. The Board of Governors also stated that the five vulnerabilities remaining as of September 30, 2003, have been or will be corrected and pledged to monitor the status of uncorrected items. We plan to follow up on these matters during our audit of the fiscal year 2004 Schedule of Federal Debt. In the separately issued Limited Official Use Only report, we requested a written statement on actions taken to address these recommendations. We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate Committee on Governmental Affairs; the Subcommittee on Transportation, Treasury and General Government, Senate Committee on Appropriations; the House Committee on Government Reform; the Subcommittee on Government Efficiency and Financial Management, House Committee on Government Reform; and the Subcommittee on Transportation and Treasury, and Independent Agencies, House Committee on Appropriations. We are also sending copies of this report to the Chairman of the Board of Governors of the Federal Reserve System and the Director of the Office of Management and Budget. Copies will also be made available to others upon request. In addition, the report will be available at no charge on GAO's Web site at http://www.gao.gov. If you have any questions regarding this report, please contact Louise DiBenedetto, Assistant Director, at (202) 512-6921. Other key contributors to this assignment were Gerald L. Barnes, Dean D. Carpenter, Mickie E. Gray, David B. Hayes, and Dawn B. Simpson. Sincerely yours, Gary T. Engel, Director, Financial Management and Assurance: Enclosure: Comments from the Board of Governors of the Federal Reserve System: BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM: WASHINGTON, DC 20551: LOUISE L. ROSEMAN: DIRECTOR DIVISION OF RESERVE BANK OPERATIONS AND PAYMENT SYSTEMS: March 18, 2004: Mr. Gary T. Engel Director: Financial Management and Assurance United States General Accounting Office 441 G Street, N.W. Washington, D.C. 20548: Dear Mr. Engel: We appreciate the opportunity to comment on the General Accounting Office's draft report assessing the Federal Reserve Banks' information security associated with the applications that support their role as fiscal agents of the United States. The GAO's review was performed as part of the audit of the U.S. government's fiscal year 2003 financial statements. Overall, we found the review and report helpful. The report provides information that will assist the Reserve Banks in their ongoing efforts to enhance the integrity of their automated systems and information security practices. The Federal Reserve shares lessons learned from this review and its internal reviews more broadly within the System to improve controls, processes, and internal audit procedures. We agree with GAO's assessment that the Reserve Banks have implemented effective controls over these applications. We also agree with the GAO's assessment that while the vulnerabilities identified in the report do not pose significant risks to the Treasury's financial systems, they still warrant management's attention. Of the five vulnerabilities in the report that require attention, we have corrected or will correct all of them. Federal Reserve Board staff will monitor the status of uncorrected items and internal auditors at the Reserve Banks will confirm all corrective measures taken. Signed by Louise L. Roseman: [End of section] (198257): FOOTNOTES [1] 31 U.S.C. § 331(e) (2000). [2] U.S. General Accounting Office, Financial Audit: Bureau of the Public Debt's Fiscal Years 2003 and 2002 Schedules of Federal Debt, GAO-04-177 (Washington, D.C.: Nov. 7, 2003). [3] U.S. General Accounting Office, Federal Information System Controls Audit Manual, GAO/AIMD-12.19.6 (Washington, D.C.: January 1999). [4] Reportable conditions are matters coming to our attention that in our judgment should be communicated because they represent significant deficiencies in the design or operation of internal control, which could adversely affect the organization's ability to meet the objectives of reliable financial reporting and compliance with applicable laws and regulations. [5] U.S. General Accounting Office, Federal Reserve Banks: Areas for Improvement in Computer Controls, GAO-03-333R (Washington, D.C.: Feb. 10, 2003).