Skip to main content

Management Report: Areas for Improvement in the Federal Reserve Banks' Information Systems Controls

GAO-14-691R Published: Jun 18, 2014. Publicly Released: Jun 18, 2014.
Jump To:
Skip to Highlights

Highlights

What GAO Found

During GAO's audit of the Schedules of Federal Debt Managed by the Department of the Treasury's (Treasury) Bureau of the Fiscal Service (Fiscal Service) for the fiscal years ended September 30, 2013, and 2012, GAO identified four new deficiencies in information systems controls over key financial systems maintained and operated by the Federal Reserve Banks (FRBs) on behalf of Treasury relevant to the Schedule of Federal Debt. These control deficiencies related to access controls and configuration management. In a separately issued Limited Official Use Only report, GAO communicated to FRB management detailed information regarding the four new information systems general control deficiencies.

None of the control deficiencies GAO identified represented significant risks to the financial systems maintained and operated by FRBs on behalf of Treasury. The potential effect of these deficiencies on the Schedule of Federal Debt financial reporting for fiscal year 2013 was mitigated primarily by FRBs' program of monitoring user and system activity and Fiscal Service's compensating management and reconciliation controls designed to detect potential misstatements of the Schedule of Federal Debt.

In addition, during GAO's follow-up on the status of FRBs' corrective actions to address information systems control-related deficiencies and associated recommendations contained in GAO's prior years' reports that were open as of September 30, 2012, GAO determined that corrective action was complete for one of the three open recommendations and corrective actions were in progress for the remaining two open recommendation related to security management. In the Limited Official Use Only report, GAO communicated detailed information regarding actions taken by FRBs to address the control deficiencies related to these open recommendations.

Why GAO Did This Study

GAO is required to audit the consolidated financial statements of the U.S. government. Because of the significance of the federal debt held by the public to the government-wide financial statements, GAO audits Fiscal Service's Schedules of Federal Debt annually. As part of these audits, GAO performs a review of information systems controls over key financial systems maintained and operated by FRBs on behalf of Treasury relevant to the Schedule of Federal Debt.

This report presents the deficiencies identified during GAO’s fiscal year 2013 testing of information systems controls over key financial systems maintained and operated by FRBs on behalf of Treasury relevant to the Schedule of Federal Debt. This report also includes the results of GAO’s follow-up on the status of FRBs’ corrective actions to address information systems control-related deficiencies and associated recommendations contained in GAO’s prior years’ reports and open as of September 30, 2012.

Recommendations

In a separately issued Limited Official Use Only report, GAO made four recommendations to address the four new information systems general control deficiencies related to access controls and configuration management. In commenting on a draft of the separately issued Limited Official Use Only report, the Director of Reserve Bank Operations and Payments Systems, on behalf of the Board of Governors of the Federal Reserve System, concurred with GAO’s conclusions.

Full Report

GAO Contacts

Topics

Access controlComputer securityConfiguration controlFederal debtFederal fundsFederal reserve banksFinancial managementFinancial statement auditsFinancial statementsInformation systemsInternal auditsInternal controlsReporting requirementsSystems design