Bureau of the Public Debt: Areas for Improvement in Information Systems Controls

What GAO Found

During our fiscal year 2011 audit, we identified eight new general information systems control deficiencies related to access controls, configuration management, and segregation of duties. We made nine recommendations to address these control deficiencies. In a separately issued Limited Official Use Only report, we communicated to BPD management detailed information regarding our findings and related recommendations.

None of the control deficiencies we identified represented significant risks to the BPD financial systems. The potential effect of these deficiencies on the Schedule of Federal Debt financial reporting was mitigated by BPD’s physical security measures and a program of monitoring user and system activity, as well as compensating management and reconciliation controls designed to detect potential misstatements in the Schedule of Federal Debt.

In addition, during our fiscal year 2011 follow-up on the status of BPD’s corrective actions to address information systems control-related recommendations contained in our prior years’ reports and open as of September 30, 2010, we determined that corrective action was complete for one of the eight open recommendations and corrective action was in progress for each of the seven remaining open recommendations related to access controls, configuration management, and segregation of duties.

BPD provided comments on the detailed findings and recommendations in the separately issued Limited Official Use Only report. In those comments, the Commissioner of BPD stated that, subsequent to September 30, 2011, four of the five unresolved general information systems control deficiencies contained in our prior years’ reports have been completely resolved and one has been substantially addressed with BPD accepting the residual risk. The Commissioner also cited actions taken or planned to address the eight new general information systems control deficiencies.

Why GAO Did This Study

In connection with fulfilling our requirement to audit the consolidated financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2011 and 2010. As part of these audits, we performed a review of information systems controls over key BPD financial systems.

As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2011 and 2010, we concluded that BPD maintained, in all material respects, effective internal control over financial reporting relevant to the Schedule of Federal Debt as of September 30, 2011, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected and corrected on a timely basis. However, we identified information systems deficiencies affecting internal control over financial reporting, which, while we do not consider them to be collectively either a material weakness or significant deficiency, nevertheless warrant the attention and action of management.

This report presents the deficiencies we identified during our fiscal year 2011 testing of information systems controls over key BPD financial systems relevant to the Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD’s corrective actions to address information systems control-related recommendations contained in our prior years’ reports and open as of September 30, 2010. We also assessed information systems controls over key financial systems maintained and operated by the Federal Reserve Banks (FRB) on behalf of BPD relevant to the Schedule of Federal Debt. We issued a separate report to the Board of Governors of the Federal Reserve System on the results from that assessment.

For more information, contact Gary T. Engel at (202) 512-3406 or engelg@gao.gov .