Federal Reserve Banks:

Areas for Improvement in Information Security Controls

GAO-10-640R: Published: Apr 21, 2010. Publicly Released: Apr 21, 2010.

Additional Materials:

Contact:

Gary T. Engel
(202) 512-8815
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2009 and 2008. As part of these audits, we performed a review of the general and application information security controls over key financial systems maintained and operated by the Federal Reserve Banks (FRB) on behalf of the Department of the Treasury's (Treasury) BPD relevant to the Schedule of Federal Debt. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2009 and 2008, we concluded that BPD maintained, in all material respects, effective internal control relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2009, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. However, we found deficiencies involving information security controls that we do not consider to be significant deficiencies. With regard to financial reporting and compliance with applicable laws and regulations, the potential effect of such control deficiencies was mitigated by the FRBs and BPD. The FRBs mitigated the potential effect of such control deficiencies with physical security measures and a program of monitoring user and system activity, and BPD with compensating management and reconciliation controls. Nevertheless, the control deficiencies relating to key financial systems maintained and operated by the FRBs on behalf of BPD warrant FRB management's attention and action. This report presents the control deficiencies we identified during our fiscal year 2009 testing of the general and application information security controls over key financial systems maintained and operated by the FRBs relevant to BPD's Schedule of Federal Debt.

Our fiscal year 2009 audit procedures identified four new general information security control deficiencies, related to security management and access controls. In the Limited Official Use Only report, we made five recommendations to address these control deficiencies. None of the control deficiencies we identified represented significant risks to the key financial systems maintained and operated by the FRBs on behalf of BPD. With regard to financial reporting and compliance with applicable laws and regulations, the potential effect of such control deficiencies was mitigated by the FRBs and BPD. The FRBs mitigated the potential effect of such control deficiencies with physical security measures and a program of monitoring user and system activity, and BPD with compensating management and reconciliation controls that are designed to detect potential misstatements in the Schedule of Federal Debt. Nevertheless, these findings warrant management's attention and action to limit the risk of unauthorized access, disclosure, loss, or impairment; modification of sensitive data and programs; and disruption of critical operations.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendation for Executive Action

    Recommendation: The Director of the Division of Reserve Bank Operations and Payment Systems should direct the appropriate FRB officials to implement the five detailed recommendations set forth in the separately issued Limited Official Use Only report.

    Agency Affected: Department of the Treasury: Bureau of the Public Debt

    Status: Closed - Implemented

    Comments: In connection with our audits of the fiscal years 2010, 2011, and 2012 Schedules of Federal Debt, we reviewed the status of actions taken to address the open information systems control recommendations at the Federal Reserve Banks (FRB) identified during our prior years' audits. As detailed in separate accomplishments, we found that FRB management had taken steps to implement the specific recommendations and strengthen its information systems controls.

    Aug 5, 2014

    Jul 31, 2014

    Jun 18, 2014

    Apr 29, 2014

    Apr 7, 2014

    Jan 8, 2014

    Dec 11, 2013

    Nov 14, 2013

    Oct 29, 2013

    Looking for more? Browse all our products here