United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2007-06-14 monographic deposited born digital 10 p. GA 1.13:GAO-07-899R https://www.govinfo.gov/app/details/GAOREPORTS-GAO-07-899R P0b002ee18039d7d1 f:d07899r DGPO 2010-08-12 2011-03-24 GAOREPORTS-GAO-07-899R machine generated eng fdlp REPORT GAOREPORTS-GAO-07-899R GAO-07-899R Accountability Computer security Databases Financial statement audits Information security Information systems Internal controls Public debt Security assessments Bureau of the Public Debt Schedule of Federal Debt Correspondence A70749

In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2006 and 2005. As part of these audits, we performed a review of the general and application information security controls over key BPD financial systems. In our audit report on the Schedules of Federal Debt for the fiscal years ended September 30, 2006 and 2005, we concluded that BPD maintained, in all material respects, effective internal control relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2006, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. We found matters involving information security controls that we do not consider to be reportable conditions but that nevertheless warrant BPD management's attention and action. BPD mitigated the potential effect of such issues with physical security measures, a program of monitoring user and system activity, and compensating management and reconciliation controls. This report presents the issues identified during our fiscal year 2006 testing of the general and application information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD's corrective actions to address recommendations that were contained in our prior years' audits and open as of September 30, 2005. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to BPD management. We also assessed the general and application information security controls over key BPD financial systems that the Federal Reserve Banks (FRB) maintain and operate on behalf of BPD. We have communicated the results of such testing to the Board of Governors of the Federal Reserve System. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-07-899R/html/GAOREPORTS-GAO-07-899R.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-07-899R/pdf/GAOREPORTS-GAO-07-899R.pdf GAO-07-899R https://www.govinfo.gov/app/details/GAOREPORTS-GAO-07-899R Correspondence GAO-07-899R; Bureau of the Public Debt: Areas for Improvement in Information Security Controls; Accountability Computer security Databases Financial statement audits Information security Information systems Internal controls Public debt Security assessments Bureau of the Public Debt Schedule of Federal Debt Title 31 Section 720 31 U.S.C. 720