Page 1 GAO-16-655R Information Systems Controls at Fiscal Service

441 G St. N.W.

Washington, DC 20548

July 28, 2016

Ms. Sheryl Morrow

Commissioner 

Bureau of the Fiscal Service 

Department of the Treasury 

Management Report: Areas for Improvement in the Bureau of the Fiscal Service’s 

Information Systems Controls

Dear Ms. Morrow: 

In connection with our audit of the consolidated financial statements of the U.S. government,1

we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the 

Fiscal Service (Fiscal Service) for the fiscal years ended September 30, 2015, and 2014.

2 As 

part of these audits, we performed a review of information systems controls over key Fiscal 

Service financial systems relevant to the Schedule of Federal Debt.

As we reported in connection with our audits of the Schedules of Federal Debt for the fiscal 

years ended September 30, 2015, and 2014, Fiscal Service maintained, in all material respects, 

effective internal control over financial reporting relevant to the Schedule of Federal Debt as of 

September 30, 2015, based on criteria established under 31 U.S.C. § 3512(c), (d), commonly 

known as the Federal Managers’ Financial Integrity Act. Those controls provided reasonable 

assurance that misstatements material in relation to the Schedule of Federal Debt would be 

prevented, or detected and corrected, on a timely basis. While we identified control deficiencies 

relating to information systems controls relevant to the Schedule of Federal Debt, we do not 

consider them individually or collectively to be material weaknesses or significant deficiencies.3

Nevertheless, these control deficiencies warrant the attention and action of management.

This report presents the deficiencies we identified during our fiscal year 2015 testing of 

information systems controls over key Fiscal Service financial systems that are relevant to the 

Schedule of Federal Debt. This report also includes the results of our follow-up on the status of 

Fiscal Service’s corrective actions to address information systems control-related deficiencies 

and associated recommendations contained in our prior years’ reports that were open as of 

 1

31 U.S.C. § 331(e)(2). Because the Bureau of the Fiscal Service is a bureau within the Department of the Treasury, 

federal debt and related activity and balances that it manages are also significant to the consolidated financial 

statements of the Department of the Treasury (see 31 U.S.C. § 3515(b)).

2

GAO, Financial Audit: Bureau of the Fiscal Service’s Fiscal Years 2015 and 2014 Schedules of Federal Debt, GAO16-160 (Washington, D.C.: Nov. 13, 2015).

3

A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a 

reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or 

detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in 

internal control that is less severe than a material weakness yet important enough to merit attention by those charged 

with governance. A deficiency in internal control exists when the design or operation of a control does not allow 

management or employees, in the normal course of performing their assigned functions, to prevent, or detect and 

correct, misstatements on a timely basis.
Page 2 GAO-16-655R Information Systems Controls at Fiscal Service

September 30, 2014. In a separately issued Limited Official Use Only report, we 

communicated detailed information regarding our findings and related recommendations to the 

Commissioner of the Bureau of the Fiscal Service. 

We also assessed information systems controls over key financial systems maintained and 

operated by the Federal Reserve Banks (FRB) on behalf of the Department of the Treasury 

(Treasury) relevant to the Schedule of Federal Debt. We issued a separate report to the Board 

of Governors of the Federal Reserve System on the results of that assessment.4

Results in Brief

During our fiscal year 2015 audit, we identified eight new information systems general control 

deficiencies related to security management, access controls, configuration management, and 

segregation of duties. In the Limited Official Use Only report, we made eight recommendations 

to address these control deficiencies.

In addition, during our follow-up on the status of Fiscal Service’s corrective actions to address

information systems control-related deficiencies and associated recommendations contained in 

our prior years’ reports that were open as of September 30, 2014, we determined that corrective 

actions were complete for 12 of the 14 open recommendations and corrective actions were in 

progress for the 2 remaining open recommendations related to security management and

access controls. 

These new and continuing control deficiencies (1) limit management’s ability to determine 

whether controls are adequate to address security risks and meet the security requirements of 

information systems and (2) increase the risk of inadequate or missing controls over information 

systems; unauthorized access to, modification of, or disclosure of sensitive data and programs; 

unauthorized changes to critical system resources; and disruption of critical operations. The 

potential effect of these new and continuing deficiencies on the Schedule of Federal Debt 

financial reporting for fiscal year 2015 was mitigated primarily by Fiscal Service’s compensating 

management and reconciliation controls designed to detect potential misstatements on the 

Schedule of Federal Debt.

The Commissioner of the Bureau of the Fiscal Service provided comments on the detailed 

findings and recommendations in the separately issued Limited Official Use Only report. In 

those comments, the Commissioner stated that subsequent to September 30, 2015, Fiscal 

Service had taken steps to remediate the two findings that remained from our prior years’ audits 

and had actions planned or under way to address the eight new recommendations made in this 

year’s report. We plan to follow up to determine the status of corrective actions taken on these 

matters during our audit of the fiscal year 2016 Schedule of Federal Debt.

Background

Treasury is authorized by Congress to borrow money backed by the full faith and credit of the 

United States to fund federal operations. Treasury is responsible for prescribing the debt 

instruments and otherwise limiting and restricting the amount and composition of the debt. 

Treasury is also responsible for issuing and redeeming debt instruments, paying interest to 

 4

GAO, Management Report: Areas for Improvement in the Federal Reserve Banks’ Information Systems Controls, 

GAO-16-601R (Washington, D.C.: June 6, 2016).
Page 3 GAO-16-655R Information Systems Controls at Fiscal Service

investors, and accounting for the resulting debt. In addition, Treasury maintains an investment 

program for federal government accounts, including trust funds that have statutory authority to 

invest temporary cash reserves not needed for current benefits and expenses.

As of September 30, 2015, and 2014, federal debt managed by Treasury’s Fiscal Service 

totaled about $18,138 billion and $17,810 billion, respectively, primarily for moneys borrowed to 

fund the federal government’s operations. These balances consisted of approximately 

(1) $13,124 billion and $12,785 billion of debt held by the public as of September 30, 2015, and 

2014, respectively, and (2) $5,014 billion as of September 30, 2015, and $5,025 billion as of 

September 30, 2014, of intragovernmental debt holdings. Total interest expense on federal debt 

managed by Fiscal Service for fiscal years 2015 and 2014 was about $407 billion and 

$433 billion, respectively.

Treasury relies on a number of interconnected financial systems and electronic data to process 

and track the money that it borrows, to account for the securities it issues, and to manage the 

federal debt. Many FRBs provide fiscal agent services on behalf of Treasury. Such services 

primarily consist of issuing, servicing, and redeeming Treasury securities held by the public and 

handling the related transfers of funds. FRBs use a number of key financial systems to process 

debt-related transactions. Detailed data initially processed at FRBs are summarized and then 

forwarded electronically to the appropriate Treasury data center for matching, verification, and 

posting to Fiscal Service’s general ledger.

Information systems general controls are the structure, policies, and procedures that apply to an 

entity’s overall computer operations. Information systems general controls establish the 

environment in which the application systems and controls operate. They include five general 

control areas—security management, access controls, configuration management, segregation 

of duties, and contingency planning.5 An effective information systems general control 

environment (1) provides a framework and continuing cycle of activity for managing risk, 

developing security policies, assigning responsibilities, and monitoring the adequacy of the 

entity’s computer-related controls (security management); (2) limits or detects access to 

computer resources, such as data, programs, equipment, and facilities, thereby protecting them 

against unauthorized modification, loss, or disclosure (access controls); (3) prevents 

unauthorized changes to information system resources, such as software programs and 

hardware configurations, and provides reasonable assurance that systems are configured and 

operating securely and as intended (configuration management); (4) includes policies, 

procedures, and an organizational structure to manage who can control key aspects of 

computer-related operations (segregation of duties); and (5) protects critical and sensitive data, 

and provides for critical operations to continue without disruption or be promptly resumed when 

unexpected events occur (contingency planning). 

Objectives, Scope, and Methodology

Our objectives were to evaluate information systems controls over key financial systems 

maintained and operated by Fiscal Service relevant to the Schedule of Federal Debt, and to 

determine the status of Fiscal Service’s corrective actions to address information systems 

control-related deficiencies and associated recommendations contained in our prior years’ 

reports for which actions were not complete as of September 30, 2014. Our evaluation of 

information systems controls was conducted using the Federal Information System Controls 

 5

GAO, Government Auditing Standards: 2011 Revision, GAO-12-331G (Washington, D.C.: December 2011).
Page 4 GAO-16-655R Information Systems Controls at Fiscal Service

Audit Manual.

6 This work was performed in connection with our audit of the Schedules of 

Federal Debt for the fiscal years ended September 30, 2015, and 2014, for the purpose of 

supporting our opinion on Fiscal Service’s internal control over financial reporting relevant to the 

Schedule of Federal Debt.

To evaluate information systems controls, we identified and reviewed Fiscal Service’s 

information systems control policies and procedures, observed controls in operation, conducted 

tests of controls, and held discussions with officials at the appropriate Treasury data center to 

determine whether controls were adequately designed, implemented, and operating effectively. 

The scope of our information systems general controls work for fiscal year 2015 included 

(1) following up on open recommendations from our prior years’ reports and (2) using a riskbased approach to test the five general control areas related to the systems in which the 

applications operate and other critical control points in the systems or networks that could have 

an impact on the effectiveness of the information systems controls at Fiscal Service as they 

relate to financial reporting in the current year relevant to the Schedule of Federal Debt. In 

addition, we assessed software and network security over key Fiscal Service financial systems 

that are relevant to the Schedule of Federal Debt.

We determined whether relevant application controls were appropriately designed and 

implemented, and then performed tests to determine whether the application controls were 

operating effectively. We reviewed four key Fiscal Service applications relevant to the Schedule 

of Federal Debt to determine whether the application controls were designed and operating 

effectively to provide reasonable assurance that

• transactions that occurred were input into the system, accepted for processing, processed 

once and only once by the system, and properly included in output;

• transactions were properly recorded in the proper period, key data elements input for 

transactions were accurate, data elements were processed accurately by applications that 

produced reliable results, and output was accurate;

• recorded transactions actually occurred, were related to the organization, and were properly 

approved in accordance with management’s authorization, and output contained only valid 

data;

• application data and reports and other output were protected against unauthorized access; 

and

• application data and reports and other relevant business information were readily available 

to users when needed.

GAO used an independent public accounting (IPA) firm, under contract, to assist in information 

systems testing, including the follow-up on the status of Fiscal Service’s corrective actions 

during fiscal year 2015 to address open recommendations from our prior years’ reports. We 

agreed on the scope of the IPA’s work, monitored and reviewed all aspects of its work, and 

determined that the work was sufficient to satisfy our audit objectives. 

During the course of our work, we communicated our findings to Fiscal Service management. 

We plan to follow up to determine the status of corrective actions taken for matters open as of 

September 30, 2015, during our audit of the fiscal year 2016 Schedule of Federal Debt.

 6

GAO, Federal Information System Controls Audit Manual (FISCAM), GAO-09-232G (Washington, D.C.: February 

2009).
Page 5 GAO-16-655R Information Systems Controls at Fiscal Service

We performed our work in accordance with U.S. generally accepted government auditing 

standards. We believe that our audit provided a reasonable basis for our conclusions in this 

report.

Assessment of Fiscal Service’s Information Systems General Controls

During our fiscal year 2015 audit, we identified eight new information systems general control 

deficiencies. Two of these deficiencies related to security management, one related to access 

controls, four related to configuration management, and one related to segregation of duties. 

Security management is the foundation of a security control structure and a reflection of senior 

management’s commitment to addressing security risks. Effectively designed and implemented 

security management programs provide a framework and a continuing cycle of activity for 

managing risk, developing and implementing effective security policies, assigning 

responsibilities, and monitoring the adequacy of the entity’s computer-related controls. Without 

a well-designed security management program, security controls may be inadequate; 

responsibilities may be unclear, misunderstood, or improperly implemented; and controls may 

be inconsistently applied. Such conditions may lead to insufficient protection of sensitive or 

critical resources and disproportionately high expenditures for controls over low-risk resources. 

Access controls limit access or detect inappropriate access to computer resources, such as 

data, programs, equipment, and facilities, thereby protecting them from unauthorized 

modification, loss, or disclosure. Such controls include logical access controls and physical 

access controls. The new access control deficiencies we identified during fiscal year 2015 

related to logical access controls. Effectively designed and implemented logical access controls 

require users to authenticate themselves through the use of passwords or other identifiers, and 

limit the files and other resources that authenticated users can access and the actions that they 

can execute based on a valid need that is determined by assigned official duties. 

Configuration management involves the identification and management of security features for 

all hardware, software, and firmware components of an information system at a given point and 

systematically controls changes to that configuration during the system’s life cycle. Effectively 

designed and implemented configuration management controls prevent unauthorized changes 

to information system resources and provide reasonable assurance that systems are configured 

and operating securely and as intended and only authorized and fully tested changes are made 

to critical components at each system sublevel (i.e., network, operating systems, and 

infrastructure applications). In addition, effectively designed and implemented configuration 

management controls provide reasonable assurance that applications and changes to the 

applications go through a formal, documented systems development process that identifies all 

changes to the baseline configuration. To reasonably assure that changes to applications are 

necessary, work as intended, and do not result in the loss of data or program integrity, such 

changes should be authorized, documented, tested, and independently reviewed. 

Segregation of duties is important because work responsibilities should be segregated so that 

one individual does not control all critical stages of a process. An effective segregation of duties 

is achieved by splitting responsibilities between two or more organizational groups. In addition, 

dividing duties this way diminishes the likelihood that errors and wrongful acts will go 

undetected because the activities of one group or individual will serve as a check on the 

activities of the other.
Page 6 GAO-16-655R Information Systems Controls at Fiscal Service

In a separately issued Limited Official Use Only report, we communicated to the Commissioner

of the Bureau of the Fiscal Service detailed information regarding the eight new information 

systems general control deficiencies and made eight recommendations to address these control 

deficiencies.

In addition, our fiscal year 2015 follow-up on the status of actions taken by Fiscal Service to 

address previously identified, but unresolved, information systems general control deficiencies 

as of September 30, 2014, found that corrective actions were complete for 12 of the 14 open 

recommendations and corrective actions were in progress for the remaining 2 open 

recommendations. 

The potential effect of these new and continuing deficiencies on the Schedule of Federal Debt 

financial reporting for fiscal year 2015 was mitigated primarily by Fiscal Service’s compensating 

management and reconciliation controls designed to detect potential misstatements on the 

Schedule of Federal Debt. Nevertheless, these control deficiencies (1) limit management’s 

ability to determine whether controls are adequate to address security risks and meet the 

security requirements of information systems and (2) increase the risk of inadequate or missing

controls over information systems; unauthorized access to, modification of, or disclosure of 

sensitive data and programs; unauthorized changes to critical system resources; and disruption 

of critical operations, and therefore warrant the attention and action of management.

Agency Comments 

The Commissioner of the Bureau of the Fiscal Service provided comments on the detailed 

findings and recommendations in the separately issued Limited Official Use Only report. In 

those comments, the Commissioner stated that Fiscal Service is committed to having effective 

internal controls for its information technology systems. The Commissioner further stated that 

Fiscal Service will continue to look for efficient and effective ways to improve and ensure the 

consistent application of agency-wide security controls over all systems. Additionally, the 

Commissioner stated that subsequent to September 30, 2015, Fiscal Service had taken steps to 

remediate the two findings from our prior years’ audits and had actions planned or under way to 

address the eight new recommendations made in this year’s report. We plan to follow up to 

determine the status of corrective actions taken on these matters during our audit of the fiscal 

year 2016 Schedule of Federal Debt.

- - - - -

In the separately issued Limited Official Use Only report, we noted that the head of a federal 

agency is required by 31 U.S.C. § 720 to submit a written statement on actions taken on our 

recommendations to the Senate Committee on Homeland Security and Governmental Affairs 

and to the House Committee on Oversight and Government Reform not later than 60 days after 

the date of this report. A written statement must also be sent to the Senate and House 

Committees on Appropriations with the agency’s first request for appropriations made more than 

60 days after the date of this report.

We are sending copies of this report to appropriate congressional committees, the Secretary of

the Treasury, the Inspector General of the Department of the Treasury, and the Director of the 

Office of Management and Budget. In addition, this report is available at no charge on the GAO

website at http://www.gao.gov.
Page 7 GAO-16-655R Information Systems Controls at Fiscal Service

If you or your staff have any questions regarding this report, please contact me at (202) 512-

3406 or simpsondb@gao.gov. Contact points for our offices of Congressional Relations and 

Public Affairs may be found on the last page of this report. GAO staff members who made major 

contributions to this report include Nicole M. Burkart, David B. Hayes, and Jeffrey L. Knott 

(assistant directors); Ed Brown; Dean Carpenter; Mickie E. Gray; J. Andrew Long; Werner 

Miranda-Hernandez; and Ivy Wu. 

Sincerely yours,

Dawn B. Simpson

Acting Director

Financial Management and Assurance

(100459)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.