Bureau of the Public Debt: Areas for Improvement in Information
Security Controls (18-APR-05, GAO-05-467R).
In connection with fulfilling our requirement to audit the
financial statements of the U.S. government, we audited and
reported on the Schedules of Federal Debt Managed by the Bureau
of the Public Debt (BPD) for the fiscal years ended September 30,
2004 and 2003. As part of these audits, we performed a review of
the general and application information security controls over
key BPD financial systems. As we reported in connection with our
audit of the Schedules of Federal Debt for the fiscal years ended
September 30, 2004 and 2003, BPD maintained, in all material
respects, effective internal control, including general and
application information security controls, relevant to the
Schedule of Federal Debt related to financial reporting and
compliance with applicable laws and regulations as of September
30, 2004, that provided reasonable assurance that misstatements,
losses, or noncompliance material in relation to the Schedule of
Federal Debt would be prevented or detected on a timely basis. We
found matters involving information security controls that we do
not consider to be reportable conditions3 but that nevertheless
warrant BPD management's attention and action. This report
presents the results of our fiscal year 2004 testing of the
general and application information security controls that
support key BPD automated financial systems relevant to BPD's
Schedule of Federal Debt and the results of our follow-up on the
status of BPD's corrective actions to address recommendations
that were contained in our prior years' audits and open as of
September 30, 2003. In a separately issued Limited Official Use
Only report, we communicated detailed information regarding our
findings to BPD management. We also assessed the general and
application information security controls over key BPD financial
systems that the Federal Reserve Banks (FRB) maintain and operate
on behalf of BPD. We have communicated the results of such
testing to the Board of Governors of the Federal Reserve System.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-05-467R
ACCNO: A21840
TITLE: Bureau of the Public Debt: Areas for Improvement in
Information Security Controls
DATE: 04/18/2005
SUBJECT: Audit reports
Computer security
Financial management systems
Financial statement audits
Information resources management
Information systems
Internal controls
Bureau of the Public Debt Schedule of
Federal Debt
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-05-467R
United States Government Accountability Office Washington, DC 20548
April 18, 2005
The Honorable Van Zeck
Commissioner, Bureau of the Public Debt
Subject: Bureau of the Public Debt: Areas for Improvement in Information
Security Controls
Dear Mr. Zeck:
In connection with fulfilling our requirement to audit the financial
statements of the U.S. government,1 we audited and reported on the
Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD)
for the fiscal years ended September 30, 2004 and 2003.2 As part of these
audits, we performed a review of the general and application information
security controls over key BPD financial systems.
As we reported in connection with our audit of the Schedules of Federal
Debt for the fiscal years ended September 30, 2004 and 2003, BPD
maintained, in all material respects, effective internal control,
including general and application information security controls, relevant
to the Schedule of Federal Debt related to financial reporting and
compliance with applicable laws and regulations as of September 30, 2004,
that provided reasonable assurance that misstatements, losses, or
noncompliance material in relation to the Schedule of Federal Debt would
be prevented or detected on a timely basis. We found matters involving
information security controls that we do not consider to be reportable
conditions3 but that nevertheless warrant BPD management's attention and
action.
This report presents the results of our fiscal year 2004 testing of the
general and application information security controls that support key BPD
automated financial systems relevant to BPD's Schedule of Federal Debt and
the results of our follow-up on the status of BPD's corrective actions to
address recommendations that were contained in our prior years' audits and
open as of September 30, 2003. In a separately issued Limited Official Use
Only report, we communicated detailed
131 U.S.C. S: 331(e).
2GAO, Financial Audit: Bureau of the Public Debt's Fiscal Years 2004 and
2003 Schedules of Federal
Debt, GAO-05-116 (Washington, D.C.: Nov. 5, 2004).
3Reportable conditions are matters coming to our attention that, in our
judgment, should be
communicated because they represent significant deficiencies in the design
or operation of internal
control, which could adversely affect the organization's ability to meet
the objectives of reliable
financial reporting and compliance with applicable laws and regulations.
Page 1 GAO-05-467R Information Security Controls at BPD
information regarding our findings to BPD management. We also assessed the
general and application information security controls over key BPD
financial systems that the Federal Reserve Banks (FRB) maintain and
operate on behalf of BPD. We have communicated the results of such testing
to the Board of Governors of the Federal Reserve System.
Results in Brief
Our fiscal year 2004 audit procedures identified opportunities to
strengthen certain information security controls that support key BPD
automated financial systems relevant to BPD's Schedule of Federal Debt.
Specifically, our audit procedures identified six new general information
security control issues that relate to access controls. In the Limited
Official Use Only report, we made six recommendations to address the
access control issues.
Our follow-up on the status of BPD's corrective actions to address seven
open recommendations related to six general and application information
security control issues identified in prior years' audits for which
actions were not complete as of September 30, 2003, identified the
following:
o As of September 30, 2004, corrective action on four of the seven
recommendations had been completed.
o Corrective action was in progress as of September 30, 2004, on the
three remaining open recommendations, which relate to two prior issues
involving access controls and application controls. We reaffirm our prior
years' recommendations related to these issues.
BPD provided comments on the detailed findings and recommendations in the
separately issued Limited Official Use Only report. In those comments, the
Commissioner of the Bureau of the Public Debt stated that seven of the
eight open issues have been completely resolved, and the remaining one is
in progress. BPD also stated that it intends to resolve the remaining
issue before the end of this year.
Background
The Department of the Treasury (Treasury) is authorized by the Congress to
borrow money on the credit of the United States to fund federal
operations. Treasury is responsible for prescribing the debt instruments
and otherwise limiting and restricting the amount and composition of the
debt. BPD, an organizational entity within the Fiscal Service of Treasury,
is responsible for issuing and redeeming debt instruments, paying interest
to investors, and accounting for the resulting debt. In addition, BPD has
been given the responsibility for issuing Treasury securities to trust
funds for trust fund receipts not needed for current benefits and
expenses.
As of September 30, 2004 and 2003, federal debt managed by BPD totaled
about $7.4 trillion and $6.8 trillion, respectively, for moneys borrowed
to fund the
government's operations. These balances consisted of approximately (1)
$4.3 trillion and $3.9 trillion of debt held by the public as of September
30, 2004 and 2003, respectively, and (2) $3.1 trillion and $2.9 trillion
of intragovernmental debt holdings as of September 30, 2004 and 2003,
respectively. Total interest expense on federal debt managed by BPD for
fiscal years 2004 and 2003 was about $322 billion and $315 billion,
respectively.
BPD relies on a number of interconnected financial systems and electronic
data to process and track the money that is borrowed and to account for
the securities it issues. Many of the FRBs provide fiscal agent services
on behalf of BPD, which primarily consist of issuing, servicing, and
redeeming Treasury securities held by the public and handling the related
transfers of funds. The FRB uses a number of financial systems to process
debt-related transactions throughout the country.
Objectives, Scope, and Methodology
Our objectives were to evaluate and test the general and application
information security controls over key financial management systems
maintained and operated by BPD relevant to the Schedule of Federal Debt
and to determine the status of corrective actions taken in response to the
recommendations in our prior years' audits for which actions were not
complete as of September 30, 2003. We use a riskbased, rotation approach
for testing general information security controls. Each general
information security control area is subjected to a full-scope review,
including testing, at least every 3 years. The general information
security control areas we review are defined in the Federal Information
System Controls Audit
4
Manual. Areas considered to be of higher risk are subject to more frequent
review. Each application is subjected every year to a full-scope review.
To evaluate general and application information security controls, we
identified and reviewed BPD's information system general and application
information security control policies and procedures; observed controls in
operation; conducted tests of controls, which included selecting items
using a method in which the results are not projectable to the population;
and held discussions with officials at the BPD data center to determine
whether controls were in place, adequately designed, and operating
effectively.
The scope of our work for fiscal year 2004 as it relates to general
information security controls included following up on open
recommendations from our prior years' reports and reviewing access
controls, system software controls, and application software development
and change controls.
We performed full-scope application information security control reviews
of six key BPD applications to determine whether the applications are
designed to ensure that
4GAO, Federal Information System Controls Audit Manual, GAO/AIMD-12.19.6
(Washington, D.C.: January 1999).
o access privileges (1) establish individual accountability and proper
segregation of duties, (2) limit the processing privileges of individuals,
and (3) prevent and detect inappropriate or unauthorized activities;
o data are authorized, converted to an automated form, and entered into
the application accurately, completely, and promptly;
o data are properly processed by the computer and files are updated
correctly;
o erroneous data are captured, reported, investigated, and corrected; and
o files and reports generated by the application represent transactions
that actually occur and accurately reflect the results of processing, and
reports are controlled and distributed only to authorized users.
In addition, the scope of our work as it relates to application
information security controls included following up on open
recommendations from our prior year's report for which actions were not
complete as of September 30, 2003.
We also reviewed the application information security control work
performed by the Treasury Office of Inspector General's contractor on
another key BPD application.
Because the FRBs are integral to the operations of BPD, we assessed the
general information security controls over financial systems that the FRBs
maintain and operate relevant to the Schedule of Federal Debt. We also
evaluated application information security controls over six key financial
applications maintained and operated by the FRBs. Further, we followed up
on the status of FRB corrective actions to address the open
recommendations in our fiscal year 2003 report.
The evaluation and testing of certain information security controls were
performed by the independent public accounting (IPA) firm of
PricewaterhouseCoopers LLP. We agreed on the scope of the audit work,
monitored the IPA firm's progress, and reviewed the related audit
documentation to ensure that the findings were adequately supported. In
addition, our information systems auditors performed supplemental testing
of general information security controls at BPD and followed up on the
status of BPD corrective actions to address the open recommendations in
our fiscal year 2003 report.
During the course of our work, we communicated our findings to BPD
management, who informed us that BPD has taken or plans to take corrective
action to address the control issues identified. We plan to follow up on
these matters during our audit of the fiscal year 2005 Schedule of Federal
Debt.
We performed our work at the BPD data center and certain FRBs from
February 2004 through October 2004. Our work was performed in accordance
with U.S. generally accepted government auditing standards. As noted
earlier, we obtained agency comments on the detailed findings and
recommendations in a draft of the separately issued Limited Official Use
Only report. BPD's comments are summarized in the Agency Comments and Our
Evaluation section of this report.
Assessment of BPD Information Security Controls
General information security controls are the structure, policies, and
procedures that apply to an entity's overall computer operations. General
information security controls establish the environment in which
application systems and controls operate. They include an entitywide
security management program, access controls, system software controls,
application software development and change controls, segregation of
duties, and service continuity controls. An effective general information
security control environment helps (1) ensure that an adequate entitywide
security management program is in place; (2) protect data, files, and
programs from unauthorized access, modification, disclosure, and
destruction; (3) limit and monitor access to programs and files that
control computer hardware and secure applications; (4) prevent the
introduction of unauthorized changes to systems and applications software;
(5) prevent any one individual from controlling key aspects of
computer-related operations; and (6) ensure the recovery of computer
processing operations in case of a disaster or other unexpected
interruption. Application information security controls relate directly to
the individual computer programs that are used to perform certain types of
work, such as generating interest payments or recording transactions in a
general ledger. In an effective general information security control
environment, application controls help to ensure that transactions are
valid, properly authorized, and completely and accurately processed and
reported.
Our fiscal year 2004 audit procedures identified opportunities to
strengthen certain information security controls that support key BPD
automated financial systems relevant to BPD's Schedule of Federal Debt.
Specifically, our audit procedures identified six new general information
security control issues related to access controls. Access controls are
designed to limit or detect access to computer programs, data, equipment,
and facilities to protect these resources from unauthorized modification,
disclosure, loss, or impairment. In a separately issued Limited Official
Use Only report, we communicated detailed information regarding our
findings to BPD management and made six recommendations to address the
access control issues.
Our follow-up on the status of BPD's corrective actions to address seven
open recommendations related to six general and application information
security control issues identified in prior years' audits for which
actions were not complete as of September 30, 2003, found the following:
o As of September 30, 2004, corrective action on four of the seven
recommendations had been completed.
o Corrective action was in progress as of September 30, 2004, on the
three remaining open recommendations, which relate to two prior issues
involving access controls and application controls. We reaffirm our prior
years' recommendations related to these issues.
None of our findings pose significant risks to the BPD financial systems.
In forming our conclusions, we considered the mitigating effects of
physical security measures, a program of monitoring user and system
activity, and reconciliation controls that are designed to detect
potential irregularities or improprieties in financial data or
transactions. Nevertheless, these findings warrant BPD management's
attention and action to limit the risk of unauthorized access, disclosure
and modification of sensitive data and programs, data misuse, or
disruption of critical operations.
Assessment of FRB Information Security Controls
Because the FRBs are integral to the operations of BPD, we assessed the
general and application information security controls over key financial
systems maintained and operated by the FRBs on behalf of BPD. Our fiscal
year 2004 audit procedures did not identify any new information security
control issues over such systems. During our follow-up work, we found that
the FRBs had corrected all of the issues identified in our prior years'
reports for which actions were not complete as of September 30, 2003. We
have communicated the results of our assessment over such systems to the
Board of Governors of the Federal Reserve System.
Conclusion
BPD has made significant progress in addressing open recommendations from
our prior years' audits and is taking corrective action to address the two
remaining unresolved issues.
Our fiscal year 2004 audit identified six new general information security
control issues. BPD informed us that it has taken or plans to take
corrective action to address these issues.
Recommendation for Executive Action
We recommend that the Commissioner of the Bureau of the Public Debt direct
the appropriate BPD officials to implement the six new detailed
recommendations set forth in the separately issued Limited Official Use
Only version of this report.
Agency Comments and Our Evaluation
BPD provided comments on the detailed findings and recommendations in the
Limited Official Use Only version. In those comments, the Commissioner of
the Bureau of the Public Debt stated that seven of the eight open issues
have been completely resolved, and the remaining one is in progress. BPD
also stated that it intends to resolve the remaining issue before the end
of this year. We plan to follow up on these matters during our audit of
the fiscal year 2005 Schedule of Federal Debt.
In the separately issued Limited Official Use Only report, we noted that
the head of a federal agency is required by 31 U.S.C. 720 to submit a
written statement on actions
taken on our recommendations to the Senate Committee on Homeland Security
and
Governmental Affairs and to the House Committee on Government Reform not
later
than 60 days after the date of this report. A written statement must also
be sent to
the House and Senate Committees on Appropriations with the agency's first
request
for appropriations made more than 60 days after the date of this report.
In that
report, we also requested a copy of your responses.
We are sending copies of this report to the Chairmen and Ranking Minority
Members
of the Senate Committee on Homeland Security and Governmental Affairs; the
Subcommittee on Transportation, Treasury, the Judiciary, Housing and Urban
Development, and Related Agencies, Senate Committee on Appropriations; the
House
Committee on Government Reform; the Subcommittee on Government Management,
Finance, and Accountability, House Committee on Government Reform; and the
Subcommittee on Transportation, Treasury, and Housing and Urban
Development,
The Judiciary, District of Columbia, House Committee on Appropriations. We
are also
sending copies of this report to the Secretary of the Department of the
Treasury, the
Inspector General of the Department of the Treasury, and the Director of
the Office
of Management and Budget. Copies will also be made available to others
upon
request. In addition, the report will be available at no charge on GAO's
Web site at
http://www.gao.gov.
If you have any questions regarding this report, please contact Dawn B.
Simpson,
Assistant Director, at (202) 512-9473. Other key contributors to this
assignment were
Gerald L. Barnes, Angela M. Bell, Bruce E. Cain, Mickie E. Gray, David B.
Hayes, and
Ronald E. Parker.
Sincerely yours,
Gary T. Engel
Director
Financial Management and Assurance
(198361)
GAO's Mission
Obtaining Copies of GAO Reports and Testimony
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site (www.gao.gov). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061
To Report Fraud, Contact:
Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470
Gloria Jarmon, Managing Director, [email protected] (202)
512-4400Congressional U.S. Government Accountability Office, 441 G Street
NW, Room 7125 Relations Washington, D.C. 20548
Public Affairs Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
PRINTED ON RECYCLED PAPER
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
*** End of document. ***