United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2008-06-16 monographic deposited born digital 9 p. GA 1.13:GAO-08-836R https://www.govinfo.gov/app/details/GAOREPORTS-GAO-08-836R P0b002ee1803859d4 f:d08836r DGPO 2010-08-12 2011-03-28 GAOREPORTS-GAO-08-836R machine generated eng fdlp REPORT GAOREPORTS-GAO-08-836R GAO-08-836R Access control Accountability Computer security Federal debt Federal regulations Federal reserve banks Financial management Financial management systems Financial records Financial statement audits Financial statements Information access Information management Information security Information security management Information security regulations Information systems Internal controls Physical security Reporting requirements Risk factors Risk management System software Security standards Bureau of the Public Debt Schedule of Federal Debt Correspondence A82364 In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2007 and 2006. As part of these audits, we performed a review of the general and application information security controls over key financial systems maintained and operated by the Federal Reserve Banks (FRBs) on behalf of the Department of the Treasury's BPD relevant to the Schedule of Federal Debt. In our audit report on the Schedules of Federal Debt for the fiscal years ended September 30, 2007 and 2006, we concluded that BPD maintained, in all material respects, effective internal control relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2007, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. However, we found matters involving information security controls that we do not consider to be significant deficiencies. As it relates to controls over financial reporting and compliance with applicable laws and regulations, the potential effect of such control deficiencies was mitigated by the FRBs and BPD. The FRBs mitigated the potential effect of such control deficiencies with physical security measures and a program of monitoring user and system activity, and BPD with compensating management and reconciliation controls. Nevertheless, the matters relating to key financial systems maintained and operated by the FRBs on behalf of BPD warrant FRB management's attention and action. This report presents the control deficiencies identified during our fiscal year 2007 testing of the general and application information security controls over key financial systems maintained and operated by the FRBs on behalf of the Department of theTreasury's BPD relevant to the Schedule of Federal Debt. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to FRB management. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-836R/html/GAOREPORTS-GAO-08-836R.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-836R/pdf/GAOREPORTS-GAO-08-836R.pdf GAO-08-836R https://www.govinfo.gov/app/details/GAOREPORTS-GAO-08-836R Correspondence GAO-08-836R; Federal Reserve Banks: Areas for Improvement in Information Security Controls; Access control Accountability Computer security Federal debt Federal regulations Federal reserve banks Financial management Financial management systems Financial records Financial statement audits Financial statements Information access Information management Information security Information security management Information security regulations Information systems Internal controls Physical security Reporting requirements Risk factors Risk management System software Security standards Bureau of the Public Debt Schedule of Federal Debt