Bureau of Public Debt:
Areas for Improvement in Information Security Controls
GAO-09-633R: Published: Apr 28, 2009. Publicly Released: Apr 28, 2009.
Additional Materials:
- Full Report:
- Accessible Text:
Contact:
(202) 512-8815
contact@gao.gov
Office of Public Affairs
(202) 512-4800
youngc1@gao.gov
In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2008 and 2007. As part of these audits, we performed a review of the general and application information security controls over key BPD financial systems. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2008 and 2007, we concluded that BPD maintained, in all material respects, effective internal control relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2008, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. However, we found deficiencies involving information security controls that we do not consider to be significant deficiencies. With regard to financial reporting and compliance with applicable laws and regulations, BPD mitigated the potential effect of such control deficiencies with physical security measures, a program of monitoring user and system activity, and compensating management and reconciliation controls. Nevertheless, these matters warrant BPD management's attention and action. This report presents the control deficiencies we identified during our fiscal year 2008 testing of the general and application information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD's corrective actions to address recommendations that were contained in our prior years' audit reports and open as of September 30, 2007.
Our fiscal year 2008 audit procedures identified three new general information security control deficiencies, related to access control and incident response. In the Limited Official Use Only report, we made three recommendations to address these control deficiencies. None of the control deficiencies we identified represented significant risks to the BPD financial systems. With regard to financial reporting and compliance with applicable laws and regulations, BPD mitigated the potential effect of such control deficiencies with physical security measures and a program of monitoring user and system activity. Further, BPD has compensating management and reconciliation controls that are designed to detect potential misstatements in the Schedule of Federal Debt. During our follow-up on the status of BPD's corrective actions to address 13 open recommendations related to general information security control deficiencies identified in prior years' audits for which actions were not complete as of September 30, 2007, we determined the following: (1) As of September 30, 2008, corrective action on 8 of the 13 recommendations was completed. (2) Corrective action was in progress as of September 30, 2008, on the five remaining open recommendations, two of which relate to system software and the other three to application software development and change control.
Recommendation for Executive Action
Status: Closed - Implemented
Comments: In connection with our audits of the fiscal years 2009, 2010, 2011, and 2012 Schedules of Federal Debt, we reviewed the status of actions taken to address the open information systems control recommendations at the Department of the Treasury's Bureau of the Public Debt (BPD) identified during our prior years' audits. As detailed in separate accomplishments, we found that BPD management had taken steps to implement the specific recommendations and strengthen its information systems controls.
Recommendation: The Commissioner of the Bureau of the Public Debt should direct the appropriate BPD officials to implement the three new detailed recommendations set forth in the separately issued Limited Official Use Only version of this report.
Agency Affected: Department of the Treasury: Bureau of the Public Debt
Explore the full database of GAO's Open Recommendations
»
Feb 18, 2021
-
Financial Audit:
Federal Deposit Insurance Corporation Funds' 2020 and 2019 Financial StatementsGAO-21-284R: Published: Feb 18, 2021. Publicly Released: Feb 18, 2021.
Nov 16, 2020
-
Financial Audit:
Bureau of Consumer Financial Protection's FY 2020 and FY 2019 Financial StatementsGAO-21-174R: Published: Nov 16, 2020. Publicly Released: Nov 16, 2020. -
Financial Audit:
Federal Housing Finance Agency's FY 2020 and FY 2019 Financial StatementsGAO-21-201R: Published: Nov 16, 2020. Publicly Released: Nov 16, 2020. -
Financial Audit:
Securities and Exchange Commission's FY 2020 and FY 2019 Financial StatementsGAO-21-192R: Published: Nov 16, 2020. Publicly Released: Nov 16, 2020.
Nov 10, 2020
-
Financial Audit:
IRS's FY 2020 and FY 2019 Financial StatementsGAO-21-162: Published: Nov 10, 2020. Publicly Released: Nov 10, 2020. -
Financial Audit:
Office of Financial Stability's (Troubled Asset Relief Program) FY 2020 and FY 2019 Financial StatementsGAO-21-173R: Published: Nov 10, 2020. Publicly Released: Nov 10, 2020.
Nov 9, 2020
-
Financial Audit:
Bureau of the Fiscal Service's FY 2020 and FY 2019 Schedules of Federal DebtGAO-21-124: Published: Nov 9, 2020. Publicly Released: Nov 9, 2020.
Nov 6, 2020
-
FY 2020 Excise Tax:
Agreed-Upon Procedures Related to Distributions to Trust FundsGAO-21-163R: Published: Nov 6, 2020. Publicly Released: Nov 6, 2020.
Oct 13, 2020
-
DOD Financial Management:
Continued Efforts Needed to Correct Material Weaknesses Identified in Financial Statement AuditsGAO-21-157: Published: Oct 13, 2020. Publicly Released: Oct 13, 2020.
Sep 30, 2020
-
Financial Management:
DOD Needs to Implement Comprehensive Plans to Improve Its Systems EnvironmentGAO-20-252: Published: Sep 30, 2020. Publicly Released: Sep 30, 2020.
Looking for more? Browse all our products here