United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2004-05-28 monographic deposited born digital 6 p. GA 1.13:GAO-04-681R https://www.govinfo.gov/app/details/GAOREPORTS-GAO-04-681R P0b002ee180392ea8 f:d04681r DGPO 2010-08-12 2011-03-24 GAOREPORTS-GAO-04-681R machine generated eng fdlp REPORT GAOREPORTS-GAO-04-681R GAO-04-681R Auditing procedures Computer software Federal debt Financial management Financial management systems Financial statements Internal controls Public debt Trust funds Correspondence A10278

In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2003 and 2002.2 As part of these audits, we performed a review of the general and application computer controls over key BPD financial systems. The Department of the Treasury (Treasury) is authorized by the Congress to borrow money on the credit of the United States to fund federal operations. Treasury is responsible for prescribing the debt instruments and otherwise limiting and restricting the amount and composition of the debt. BPD, an organizational entity within the Fiscal Service of Treasury, is responsible for issuing and redeeming debt instruments, paying interest to investors, and accounting for the resulting debt. In addition, BPD has been given the responsibility for issuing Treasury securities to trust funds for trust fund receipts not needed for current benefits and expenses. The scope of our work for fiscal year 2003 included a review of the general and application computer controls over key financial management systems maintained and operated by BPD relevant to the Schedule of Federal Debt and follow-up on open recommendations from our prior years' reports for which actions were not complete as of September 30, 2002. We use a risk-based, rotation approach for testing general computer controls. Each general control area is subjected to a full-scope review, including testing, at least every 3 years. The computer control areas we review are defined in the Federal Information System Controls Audit Manual.3 Areas considered to be of higher risk are subject to more frequent review. Each key application is subjected every year to a full-scope review. General computer controls are the structure, policies, and procedures that apply to an entity's overall computer operations. General computer controls establish the environment in which application systems and controls operate. They include an entitywide security management program, access controls, system software controls, application software development and change controls, segregation of duties, and service continuity controls. An effective general control environment helps (1) ensure that an adequate entitywide security management program is in place; (2) protect data, files, and programs from unauthorized access, modification, disclosure, and destruction; (3) limit and monitor access to programs and files that control computer hardware and secure applications; (4) prevent the introduction of unauthorized changes to systems and applications software; (5) prevent any one individual from controlling key aspects of computer-related operations; and (6) ensure the recovery of computer processing operations in case of a disaster or other unexpected interruption. Application controls relate directly to the individual computer programs that are used to perform certain types of work, such as generating interest payments or recording transactions in a general ledger. In an effective general control environment, application controls help to ensure that transactions are valid, properly authorized, and completely and accurately processed and reported. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-04-681R/html/GAOREPORTS-GAO-04-681R.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-04-681R/pdf/GAOREPORTS-GAO-04-681R.pdf GAO-04-681R https://www.govinfo.gov/app/details/GAOREPORTS-GAO-04-681R Correspondence GAO-04-681R; Bureau of the Public Debt: Areas for Improvement in Computer Controls; Auditing procedures Computer software Federal debt Financial management Financial management systems Financial statements Internal controls Public debt Trust funds Title 31 Section 720 31 U.S.C. 720