Page 1 GAO-05-467R Information Security Controls at BPD

United States Government Accountability Office

Washington, DC 20548 

April 18, 2005 

The Honorable Van Zeck 

Commissioner, Bureau of the Public Debt 

Subject: Bureau of the Public Debt: Areas for Improvement in Information Security 

Controls

Dear Mr. Zeck: 

In connection with fulfilling our requirement to audit the financial statements of the 

U.S. government,1 we audited and reported on the Schedules of Federal Debt 

Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended 

September 30, 2004 and 2003.2 As part of these audits, we performed a review of the 

general and application information security controls over key BPD financial 

systems. 

As we reported in connection with our audit of the Schedules of Federal Debt for the 

fiscal years ended September 30, 2004 and 2003, BPD maintained, in all material 

respects, effective internal control, including general and application information 

security controls, relevant to the Schedule of Federal Debt related to financial 

reporting and compliance with applicable laws and regulations as of September 30, 

2004, that provided reasonable assurance that misstatements, losses, or 

noncompliance material in relation to the Schedule of Federal Debt would be 

prevented or detected on a timely basis. We found matters involving information 

security controls that we do not consider to be reportable conditions3

 but that 

nevertheless warrant BPD management’s attention and action. 

This report presents the results of our fiscal year 2004 testing of the general and 

application information security controls that support key BPD automated financial 

systems relevant to BPD’s Schedule of Federal Debt and the results of our follow-up 

on the status of BPD’s corrective actions to address recommendations that were 

contained in our prior years’ audits and open as of September 30, 2003. In a 

separately issued Limited Official Use Only report, we communicated detailed 

 

1

31 U.S.C. § 331(e). 

2

GAO, Financial Audit: Bureau of the Public Debt’s Fiscal Years 2004 and 2003 Schedules of Federal 

Debt, GAO-05-116 (Washington, D.C.: Nov. 5, 2004). 3

Reportable conditions are matters coming to our attention that, in our judgment, should be 

communicated because they represent significant deficiencies in the design or operation of internal 

control, which could adversely affect the organization’s ability to meet the objectives of reliable 

financial reporting and compliance with applicable laws and regulations. 
 

 GAO-05-467R Information Security Controls at BPD 

Page 2 

information regarding our findings to BPD management. We also assessed the 

general and application information security controls over key BPD financial systems 

that the Federal Reserve Banks (FRB) maintain and operate on behalf of BPD. We 

have communicated the results of such testing to the Board of Governors of the 

Federal Reserve System. 

Results in Brief 

Our fiscal year 2004 audit procedures identified opportunities to strengthen certain 

information security controls that support key BPD automated financial systems 

relevant to BPD’s Schedule of Federal Debt. Specifically, our audit procedures 

identified six new general information security control issues that relate to access 

controls. In the Limited Official Use Only report, we made six recommendations to 

address the access control issues. 

 

Our follow-up on the status of BPD’s corrective actions to address seven open 

recommendations related to six general and application information security control 

issues identified in prior years’ audits for which actions were not complete as of 

September 30, 2003, identified the following: 

• As of September 30, 2004, corrective action on four of the seven 

recommendations had been completed. 

• Corrective action was in progress as of September 30, 2004, on the three 

remaining open recommendations, which relate to two prior issues involving 

access controls and application controls. We reaffirm our prior years’ 

recommendations related to these issues. 

BPD provided comments on the detailed findings and recommendations in the 

separately issued Limited Official Use Only report. In those comments, the 

Commissioner of the Bureau of the Public Debt stated that seven of the eight open 

issues have been completely resolved, and the remaining one is in progress. BPD 

also stated that it intends to resolve the remaining issue before the end of this year. 

Background 

The Department of the Treasury (Treasury) is authorized by the Congress to borrow 

money on the credit of the United States to fund federal operations. Treasury is 

responsible for prescribing the debt instruments and otherwise limiting and 

restricting the amount and composition of the debt. BPD, an organizational entity 

within the Fiscal Service of Treasury, is responsible for issuing and redeeming debt 

instruments, paying interest to investors, and accounting for the resulting debt. In 

addition, BPD has been given the responsibility for issuing Treasury securities to 

trust funds for trust fund receipts not needed for current benefits and expenses. 

As of September 30, 2004 and 2003, federal debt managed by BPD totaled about 

$7.4 trillion and $6.8 trillion, respectively, for moneys borrowed to fund the 
Page 3 GAO-05-467R Information Security Controls at BPD

government’s operations. These balances consisted of approximately (1) $4.3 trillion 

and $3.9 trillion of debt held by the public as of September 30, 2004 and 2003, 

respectively, and (2) $3.1 trillion and $2.9 trillion of intragovernmental debt holdings 

as of September 30, 2004 and 2003, respectively. Total interest expense on federal 

debt managed by BPD for fiscal years 2004 and 2003 was about $322 billion and 

$315 billion, respectively. 

BPD relies on a number of interconnected financial systems and electronic data to 

process and track the money that is borrowed and to account for the securities it 

issues. Many of the FRBs provide fiscal agent services on behalf of BPD, which 

primarily consist of issuing, servicing, and redeeming Treasury securities held by the 

public and handling the related transfers of funds. The FRB uses a number of 

financial systems to process debt-related transactions throughout the country. 

Objectives, Scope, and Methodology 

Our objectives were to evaluate and test the general and application information 

security controls over key financial management systems maintained and operated by 

BPD relevant to the Schedule of Federal Debt and to determine the status of 

corrective actions taken in response to the recommendations in our prior years’ 

audits for which actions were not complete as of September 30, 2003. We use a riskbased, rotation approach for testing general information security controls. Each 

general information security control area is subjected to a full-scope review, 

including testing, at least every 3 years. The general information security control 

areas we review are defined in the Federal Information System Controls Audit 

Manual.

4

 Areas considered to be of higher risk are subject to more frequent review. 

Each application is subjected every year to a full-scope review. 

To evaluate general and application information security controls, we identified and 

reviewed BPD’s information system general and application information security 

control policies and procedures; observed controls in operation; conducted tests of 

controls, which included selecting items using a method in which the results are not 

projectable to the population; and held discussions with officials at the BPD data 

center to determine whether controls were in place, adequately designed, and 

operating effectively. 

The scope of our work for fiscal year 2004 as it relates to general information security 

controls included following up on open recommendations from our prior years’ 

reports and reviewing access controls, system software controls, and application 

software development and change controls. 

We performed full-scope application information security control reviews of six key 

BPD applications to determine whether the applications are designed to ensure that 

 

4

GAO, Federal Information System Controls Audit Manual, GAO/AIMD-12.19.6 (Washington, D.C.: 

January 1999). 
 

 GAO-05-467R Information Security Controls at BPD 

Page 4 

• access privileges (1) establish individual accountability and proper segregation of 

duties, (2) limit the processing privileges of individuals, and (3) prevent and 

detect inappropriate or unauthorized activities; 

• data are authorized, converted to an automated form, and entered into the 

application accurately, completely, and promptly; 

• data are properly processed by the computer and files are updated correctly; 

• erroneous data are captured, reported, investigated, and corrected; and 

• files and reports generated by the application represent transactions that actually 

occur and accurately reflect the results of processing, and reports are controlled 

and distributed only to authorized users. 

In addition, the scope of our work as it relates to application information security 

controls included following up on open recommendations from our prior year’s 

report for which actions were not complete as of September 30, 2003. 

We also reviewed the application information security control work performed by the 

Treasury Office of Inspector General’s contractor on another key BPD application. 

Because the FRBs are integral to the operations of BPD, we assessed the general 

information security controls over financial systems that the FRBs maintain and 

operate relevant to the Schedule of Federal Debt. We also evaluated application 

information security controls over six key financial applications maintained and 

operated by the FRBs. Further, we followed up on the status of FRB corrective 

actions to address the open recommendations in our fiscal year 2003 report. 

The evaluation and testing of certain information security controls were performed 

by the independent public accounting (IPA) firm of PricewaterhouseCoopers LLP. 

We agreed on the scope of the audit work, monitored the IPA firm’s progress, and 

reviewed the related audit documentation to ensure that the findings were adequately 

supported. In addition, our information systems auditors performed supplemental 

testing of general information security controls at BPD and followed up on the status 

of BPD corrective actions to address the open recommendations in our fiscal year 

2003 report. 

During the course of our work, we communicated our findings to BPD management, 

who informed us that BPD has taken or plans to take corrective action to address the 

control issues identified. We plan to follow up on these matters during our audit of 

the fiscal year 2005 Schedule of Federal Debt. 

We performed our work at the BPD data center and certain FRBs from February 2004 

through October 2004. Our work was performed in accordance with U.S. generally 

accepted government auditing standards. As noted earlier, we obtained agency 

comments on the detailed findings and recommendations in a draft of the separately 

issued Limited Official Use Only report. BPD’s comments are summarized in the 

Agency Comments and Our Evaluation section of this report. 
Page 5 GAO-05-467R Information Security Controls at BPD

Assessment of BPD Information Security Controls 

General information security controls are the structure, policies, and procedures that 

apply to an entity’s overall computer operations. General information security 

controls establish the environment in which application systems and controls 

operate. They include an entitywide security management program, access controls, 

system software controls, application software development and change controls, 

segregation of duties, and service continuity controls. An effective general 

information security control environment helps (1) ensure that an adequate 

entitywide security management program is in place; (2) protect data, files, and 

programs from unauthorized access, modification, disclosure, and destruction; 

(3) limit and monitor access to programs and files that control computer hardware 

and secure applications; (4) prevent the introduction of unauthorized changes to 

systems and applications software; (5) prevent any one individual from controlling 

key aspects of computer-related operations; and (6) ensure the recovery of computer 

processing operations in case of a disaster or other unexpected interruption. 

Application information security controls relate directly to the individual computer 

programs that are used to perform certain types of work, such as generating interest 

payments or recording transactions in a general ledger. In an effective general 

information security control environment, application controls help to ensure that 

transactions are valid, properly authorized, and completely and accurately processed 

and reported. 

Our fiscal year 2004 audit procedures identified opportunities to strengthen certain 

information security controls that support key BPD automated financial systems 

relevant to BPD’s Schedule of Federal Debt. Specifically, our audit procedures 

identified six new general information security control issues related to access 

controls. Access controls are designed to limit or detect access to computer 

programs, data, equipment, and facilities to protect these resources from 

unauthorized modification, disclosure, loss, or impairment. In a separately issued 

Limited Official Use Only report, we communicated detailed information regarding 

our findings to BPD management and made six recommendations to address the 

access control issues. 

 

Our follow-up on the status of BPD’s corrective actions to address seven open 

recommendations related to six general and application information security control 

issues identified in prior years’ audits for which actions were not complete as of 

September 30, 2003, found the following: 

• As of September 30, 2004, corrective action on four of the seven 

recommendations had been completed. 

• Corrective action was in progress as of September 30, 2004, on the three 

remaining open recommendations, which relate to two prior issues involving 

access controls and application controls. We reaffirm our prior years’ 

recommendations related to these issues. 
 

 GAO-05-467R Information Security Controls at BPD 

Page 6 

None of our findings pose significant risks to the BPD financial systems. In forming 

our conclusions, we considered the mitigating effects of physical security measures, a 

program of monitoring user and system activity, and reconciliation controls that are 

designed to detect potential irregularities or improprieties in financial data or 

transactions. Nevertheless, these findings warrant BPD management’s attention and 

action to limit the risk of unauthorized access, disclosure and modification of 

sensitive data and programs, data misuse, or disruption of critical operations.

Assessment of FRB Information Security Controls 

Because the FRBs are integral to the operations of BPD, we assessed the general and 

application information security controls over key financial systems maintained and 

operated by the FRBs on behalf of BPD. Our fiscal year 2004 audit procedures did 

not identify any new information security control issues over such systems. During 

our follow-up work, we found that the FRBs had corrected all of the issues identified 

in our prior years’ reports for which actions were not complete as of September 30, 

2003. We have communicated the results of our assessment over such systems to the 

Board of Governors of the Federal Reserve System. 

Conclusion 

BPD has made significant progress in addressing open recommendations from our 

prior years’ audits and is taking corrective action to address the two remaining 

unresolved issues. 

Our fiscal year 2004 audit identified six new general information security control 

issues. BPD informed us that it has taken or plans to take corrective action to 

address these issues. 

Recommendation for Executive Action 

We recommend that the Commissioner of the Bureau of the Public Debt direct the 

appropriate BPD officials to implement the six new detailed recommendations set 

forth in the separately issued Limited Official Use Only version of this report. 

Agency Comments and Our Evaluation 

BPD provided comments on the detailed findings and recommendations in the 

Limited Official Use Only version. In those comments, the Commissioner of the 

Bureau of the Public Debt stated that seven of the eight open issues have been 

completely resolved, and the remaining one is in progress. BPD also stated that it 

intends to resolve the remaining issue before the end of this year. We plan to follow 

up on these matters during our audit of the fiscal year 2005 Schedule of Federal Debt. 

- - - - - 

In the separately issued Limited Official Use Only report, we noted that the head of a 

federal agency is required by 31 U.S.C. 720 to submit a written statement on actions 
Page 7 GAO-05-467R Information Security Controls at BPD

taken on our recommendations to the Senate Committee on Homeland Security and 

Governmental Affairs and to the House Committee on Government Reform not later 

than 60 days after the date of this report. A written statement must also be sent to 

the House and Senate Committees on Appropriations with the agency’s first request 

for appropriations made more than 60 days after the date of this report. In that 

report, we also requested a copy of your responses. 

We are sending copies of this report to the Chairmen and Ranking Minority Members 

of the Senate Committee on Homeland Security and Governmental Affairs; the 

Subcommittee on Transportation, Treasury, the Judiciary, Housing and Urban 

Development, and Related Agencies, Senate Committee on Appropriations; the House 

Committee on Government Reform; the Subcommittee on Government Management, 

Finance, and Accountability, House Committee on Government Reform; and the 

Subcommittee on Transportation, Treasury, and Housing and Urban Development, 

The Judiciary, District of Columbia, House Committee on Appropriations. We are also 

sending copies of this report to the Secretary of the Department of the Treasury, the 

Inspector General of the Department of the Treasury, and the Director of the Office 

of Management and Budget. Copies will also be made available to others upon 

request. In addition, the report will be available at no charge on GAO’s Web site at 

http://www.gao.gov. 

If you have any questions regarding this report, please contact Dawn B. Simpson, 

Assistant Director, at (202) 512-9473. Other key contributors to this assignment were 

Gerald L. Barnes, Angela M. Bell, Bruce E. Cain, Mickie E. Gray, David B. Hayes, and 

Ronald E. Parker. 

Sincerely yours, 

Gary T. Engel 

Director 

Financial Management and Assurance 

(198361) 
The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.