This is the accessible text file for GAO report number GAO-05-467R 
entitled 'Bureau of the Public Debt: Areas for Improvement in Information Security Controls' which was released on April 18, 2005.

This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

April 18, 2005:

The Honorable Van Zeck:

Commissioner, Bureau of the Public Debt:

Subject: Bureau of the Public Debt: Areas for Improvement in Information Security Controls:

Dear Mr. Zeck:

In connection with fulfilling our requirement to audit the financial statements of the U.S. government,[Footnote 1] we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2004 and 2003.[Footnote 2] As part of these audits, we performed a review of the general and application information security controls over key BPD financial systems.

As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2004 and 2003, BPD maintained, in all material respects, effective internal control, including general and application information security controls, relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2004, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. We found matters involving information security controls that we do not consider to be reportable conditions[Footnote 3] but that nevertheless warrant BPD management's attention and action.

This report presents the results of our fiscal year 2004 testing of the general and application information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt and the results of our follow-up on the status of BPD's corrective actions to address recommendations that were contained in our prior years' audits and open as of September 30, 2003. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to BPD management. We also assessed the general and application information security controls over key BPD financial systems that the Federal Reserve Banks (FRB) maintain and operate on behalf of BPD. We have communicated the results of such testing to the Board of Governors of the Federal Reserve System.

Results in Brief:

Our fiscal year 2004 audit procedures identified opportunities to strengthen certain information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. Specifically, our audit procedures identified six new general information security control issues that relate to access controls. In the Limited Official Use Only report, we made six recommendations to address the access control issues.

Our follow-up on the status of BPD's corrective actions to address seven open recommendations related to six general and application information security control issues identified in prior years' audits for which actions were not complete as of September 30, 2003, identified the following:

* As of September 30, 2004, corrective action on four of the seven recommendations had been completed.

* Corrective action was in progress as of September 30, 2004, on the three remaining open recommendations, which relate to two prior issues involving access controls and application controls. We reaffirm our prior years' recommendations related to these issues.

BPD provided comments on the detailed findings and recommendations in the separately issued Limited Official Use Only report. In those comments, the Commissioner of the Bureau of the Public Debt stated that seven of the eight open issues have been completely resolved, and the remaining one is in progress. BPD also stated that it intends to resolve the remaining issue before the end of this year.

Background:

The Department of the Treasury (Treasury) is authorized by the Congress to borrow money on the credit of the United States to fund federal operations. Treasury is responsible for prescribing the debt instruments and otherwise limiting and restricting the amount and composition of the debt. BPD, an organizational entity within the Fiscal Service of Treasury, is responsible for issuing and redeeming debt instruments, paying interest to investors, and accounting for the resulting debt. In addition, BPD has been given the responsibility for issuing Treasury securities to trust funds for trust fund receipts not needed for current benefits and expenses.

As of September 30, 2004 and 2003, federal debt managed by BPD totaled about $7.4 trillion and $6.8 trillion, respectively, for moneys borrowed to fund the government's operations. These balances consisted of approximately (1) $4.3 trillion and $3.9 trillion of debt held by the public as of September 30, 2004 and 2003, respectively, and (2) $3.1 trillion and $2.9 trillion of intragovernmental debt holdings as of September 30, 2004 and 2003, respectively. Total interest expense on federal debt managed by BPD for fiscal years 2004 and 2003 was about $322 billion and $315 billion, respectively.

BPD relies on a number of interconnected financial systems and electronic data to process and track the money that is borrowed and to account for the securities it issues. Many of the FRBs provide fiscal agent services on behalf of BPD, which primarily consist of issuing, servicing, and redeeming Treasury securities held by the public and handling the related transfers of funds. The FRB uses a number of financial systems to process debt-related transactions throughout the country.

Objectives, Scope, and Methodology:

Our objectives were to evaluate and test the general and application information security controls over key financial management systems maintained and operated by BPD relevant to the Schedule of Federal Debt and to determine the status of corrective actions taken in response to the recommendations in our prior years' audits for which actions were not complete as of September 30, 2003. We use a risk-based, rotation approach for testing general information security controls. Each general information security control area is subjected to a full-scope review, including testing, at least every 3 years. The general information security control areas we review are defined in the Federal Information System Controls Audit Manual.[Footnote 4] Areas considered to be of higher risk are subject to more frequent review. Each application is subjected every year to a full-scope review.

To evaluate general and application information security controls, we identified and reviewed BPD's information system general and application information security control policies and procedures; observed controls in operation; conducted tests of controls, which included selecting items using a method in which the results are not projectable to the population; and held discussions with officials at the BPD data center to determine whether controls were in place, adequately designed, and operating effectively.

The scope of our work for fiscal year 2004 as it relates to general information security controls included following up on open recommendations from our prior years' reports and reviewing access controls, system software controls, and application software development and change controls.

We performed full-scope application information security control reviews of six key BPD applications to determine whether the applications are designed to ensure that: 

* access privileges (1) establish individual accountability and proper segregation of duties, (2) limit the processing privileges of individuals, and (3) prevent and detect inappropriate or unauthorized activities;

* data are authorized, converted to an automated form, and entered into the application accurately, completely, and promptly;

* data are properly processed by the computer and files are updated correctly;

* erroneous data are captured, reported, investigated, and corrected; and:

* files and reports generated by the application represent transactions that actually occur and accurately reflect the results of processing, and reports are controlled and distributed only to authorized users.

In addition, the scope of our work as it relates to application information security controls included following up on open recommendations from our prior year's report for which actions were not complete as of September 30, 2003.

We also reviewed the application information security control work performed by the Treasury Office of Inspector General's contractor on another key BPD application.

Because the FRBs are integral to the operations of BPD, we assessed the general information security controls over financial systems that the FRBs maintain and operate relevant to the Schedule of Federal Debt. We also evaluated application information security controls over six key financial applications maintained and operated by the FRBs. Further, we followed up on the status of FRB corrective actions to address the open recommendations in our fiscal year 2003 report.

The evaluation and testing of certain information security controls were performed by the independent public accounting (IPA) firm of PricewaterhouseCoopers LLP. We agreed on the scope of the audit work, monitored the IPA firm's progress, and reviewed the related audit documentation to ensure that the findings were adequately supported. In addition, our information systems auditors performed supplemental testing of general information security controls at BPD and followed up on the status of BPD corrective actions to address the open recommendations in our fiscal year 2003 report.

During the course of our work, we communicated our findings to BPD management, who informed us that BPD has taken or plans to take corrective action to address the control issues identified. We plan to follow up on these matters during our audit of the fiscal year 2005 Schedule of Federal Debt.

We performed our work at the BPD data center and certain FRBs from February 2004 through October 2004. Our work was performed in accordance with U.S. generally accepted government auditing standards. As noted earlier, we obtained agency comments on the detailed findings and recommendations in a draft of the separately issued Limited Official Use Only report. BPD's comments are summarized in the Agency Comments and Our Evaluation section of this report.

Assessment of BPD Information Security Controls:

General information security controls are the structure, policies, and procedures that apply to an entity's overall computer operations. General information security controls establish the environment in which application systems and controls operate. They include an entitywide security management program, access controls, system software controls, application software development and change controls, segregation of duties, and service continuity controls. An effective general information security control environment helps (1) ensure that an adequate entitywide security management program is in place; (2) protect data, files, and programs from unauthorized access, modification, disclosure, and destruction; (3) limit and monitor access to programs and files that control computer hardware and secure applications; (4) prevent the introduction of unauthorized changes to systems and applications software; (5) prevent any one individual from controlling key aspects of computer- related operations; and (6) ensure the recovery of computer processing operations in case of a disaster or other unexpected interruption. Application information security controls relate directly to the individual computer programs that are used to perform certain types of work, such as generating interest payments or recording transactions in a general ledger. In an effective general information security control environment, application controls help to ensure that transactions are valid, properly authorized, and completely and accurately processed and reported.

Our fiscal year 2004 audit procedures identified opportunities to strengthen certain information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. Specifically, our audit procedures identified six new general information security control issues related to access controls. Access controls are designed to limit or detect access to computer programs, data, equipment, and facilities to protect these resources from unauthorized modification, disclosure, loss, or impairment. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to BPD management and made six recommendations to address the access control issues.

Our follow-up on the status of BPD's corrective actions to address seven open recommendations related to six general and application information security control issues identified in prior years' audits for which actions were not complete as of September 30, 2003, found the following:

* As of September 30, 2004, corrective action on four of the seven recommendations had been completed.

* Corrective action was in progress as of September 30, 2004, on the three remaining open recommendations, which relate to two prior issues involving access controls and application controls. We reaffirm our prior years' recommendations related to these issues.

None of our findings pose significant risks to the BPD financial systems. In forming our conclusions, we considered the mitigating effects of physical security measures, a program of monitoring user and system activity, and reconciliation controls that are designed to detect potential irregularities or improprieties in financial data or transactions. Nevertheless, these findings warrant BPD management's attention and action to limit the risk of unauthorized access, disclosure and modification of sensitive data and programs, data misuse, or disruption of critical operations.

Assessment of FRB Information Security Controls:

Because the FRBs are integral to the operations of BPD, we assessed the general and application information security controls over key financial systems maintained and operated by the FRBs on behalf of BPD. Our fiscal year 2004 audit procedures did not identify any new information security control issues over such systems. During our follow-up work, we found that the FRBs had corrected all of the issues identified in our prior years' reports for which actions were not complete as of September 30, 2003. We have communicated the results of our assessment over such systems to the Board of Governors of the Federal Reserve System.

Conclusion:

BPD has made significant progress in addressing open recommendations from our prior years' audits and is taking corrective action to address the two remaining unresolved issues.

Our fiscal year 2004 audit identified six new general information security control issues. BPD informed us that it has taken or plans to take corrective action to address these issues.

Recommendation for Executive Action:

We recommend that the Commissioner of the Bureau of the Public Debt direct the appropriate BPD officials to implement the six new detailed recommendations set forth in the separately issued Limited Official Use Only version of this report.

Agency Comments and Our Evaluation:

BPD provided comments on the detailed findings and recommendations in the Limited Official Use Only version. In those comments, the Commissioner of the Bureau of the Public Debt stated that seven of the eight open issues have been completely resolved, and the remaining one is in progress. BPD also stated that it intends to resolve the remaining issue before the end of this year. We plan to follow up on these matters during our audit of the fiscal year 2005 Schedule of Federal Debt.

In the separately issued Limited Official Use Only report, we noted that the head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on our recommendations to the Senate Committee on Homeland Security and Governmental Affairs and to the House Committee on Government Reform not later than 60 days after the date of this report. A written statement must also be sent to the House and Senate Committees on Appropriations with the agency's first request for appropriations made more than 60 days after the date of this report. In that report, we also requested a copy of your responses.

We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate Committee on Homeland Security and Governmental Affairs; the Subcommittee on Transportation, Treasury, the Judiciary, Housing and Urban Development, and Related Agencies, Senate Committee on Appropriations; the House Committee on Government Reform; the Subcommittee on Government Management, Finance, and Accountability, House Committee on Government Reform; and the Subcommittee on Transportation, Treasury, and Housing and Urban Development, The Judiciary, District of Columbia, House Committee on Appropriations. We are also sending copies of this report to the Secretary of the Department of the Treasury, the Inspector General of the Department of the Treasury, and the Director of the Office of Management and Budget. Copies will also be made available to others upon request. In addition, the report will be available at no charge on GAO's Web site at http:// www.gao.gov.

If you have any questions regarding this report, please contact Dawn B. Simpson, Assistant Director, at (202) 512-9473. Other key contributors to this assignment were Gerald L. Barnes, Angela M. Bell, Bruce E. Cain, Mickie E. Gray, David B. Hayes, and Ronald E. Parker.

Sincerely yours,

Signed by: 

Gary T. Engel:
Director:
Financial Management and Assurance:

(198361):

FOOTNOTES

[1] 31 U.S.C.  331(e). 

[2] GAO, Financial Audit: Bureau of the Public Debt's Fiscal Years 2004 and 2003 Schedules of Federal Debt, GAO-05-116 (Washington, D.C.: Nov. 5, 2004).

[3] Reportable conditions are matters coming to our attention that, in our judgment, should be communicated because they represent significant deficiencies in the design or operation of internal control, which could adversely affect the organization's ability to meet the objectives of reliable financial reporting and compliance with applicable laws and regulations.

[4] GAO, Federal Information System Controls Audit Manual, GAO/AIMD- 12.19.6 (Washington, D.C.: January 1999).