FMS is the government’s financial manager, central disburser, and collections agency as well as its accountant and reporter of financial information. For fiscal year 2000, the U.S. government disbursed over $1.9 trillion primarily for Social Security and veterans’ benefit payments, Internal Revenue Service (IRS) tax refunds, federal employee salaries, and vendor billings. With several exceptions (the largest being the Department of Defense), FMS makes disbursements for most federal agencies. FMS is also responsible for administering the federal government’s collections system. In fiscal year 2000, the government collected over $2 trillion in taxes, duties, and fines. In addition, FMS oversees the federal government’s central accounting and reporting systems used to reconcile and keep track of the federal government’s assets and liabilities. Financial and budget execution information from these central systems is used by FMS to publish financial reports that are available for use by the Congress, the Office of Management and Budget, other federal agencies, and others who make financial decisions on behalf of the U.S. government. FMS maintains multiple financial and information systems to help it process and reconcile moneys disbursed and collected by the various government agencies. These banking, collection, and disbursement systems are also used to process agency transactions, record relevant data, transfer funds to and from the Treasury, and facilitate the reconciliation of those transactions. FMS has three data centers and also has three field operations centers that are responsible for issuing paper check and electronic funds transfer payments. In addition, FMS relies on a network of four contractor data centers and the FRBs to help carry out its financial management responsibilities. Our objectives were to evaluate and test the effectiveness of the computer controls over FMS’s key financial management systems and to determine the status of the computer control weaknesses discussed in our fiscal year 1999 audit report. We used a risk-based and rotation approach for testing general and application controls. Under that methodology, every 3 years, each data center and key financial application is subjected to a full-scope review that includes testing in all of the computer control areas defined in our Federal Information System Controls Audit Manual (FISCAM).During the interim years, we focus our testing on the FISCAM areas that we have determined to be at greater risk for computer control weaknesses. See appendix I for the scope and methodology of our fiscal year 2000 review at each of the selected data centers and for the key financial applications. During the course of our work, we communicated our findings to FMS management, which informed us of the actions FMS planned or had taken to address the weaknesses we identified. We performed our work from August 2000 through February 2001 in accordance with U.S. generally accepted government auditing standards. We requested comments on a draft of this report from the Department of the Treasury. The comments are discussed in the “Agency Comments and Our Evaluation” section of this report and reprinted in appendix II. An entity-wide program for security management is the foundation of an entity’s security control structure and should establish a framework for continual (1) risk assessments, (2) development and implementation of effective security procedures, and (3) monitoring and evaluation of the effectiveness of security procedures. A well-designed entity-wide security management program helps to ensure that security controls are adequate, properly implemented, and applied consistently across the entity and that responsibilities for security are clearly understood. The overriding reason that computer control problems at FMS continued to exist during fiscal year 2000 is that FMS does not have an effective entity-wide computer security management program (security program). In response to our prior years’ recommendation that FMS establish an effective security program, FMS completed its Information Technology Security Handbook for Major Application Systems in late 1999. During fiscal year 2000, the FMS Information Technology Security Policy Manual and Entity-Wide Information Technology Security Program manuals were approved and distributed. In addition, FMS developed an Entity-Wide Information Technology Security Program Implementation Strategy in March 2001. This document discusses FMS’s high-level strategy for the full implementation of its security program by a target date of September 30, 2002. In April 2001, FMS completed an internal assessment to determine the effectiveness of its security program and its initiatives. The assessment was performed using the Federal Information Technology Security Assessment Framework (Framework). The Framework provides a method for agency officials (1) to determine the current status of their security programs relative to existing policy and (2) where necessary, establish a target for improvement. The Framework identifies five levels of security program effectiveness—Level 1, Documented Policy; Level 2, Documented Procedures; Level 3, Implemented Procedures and Controls; Level 4, Tested and Reviewed Procedures and Controls; and Level 5, Fully Integrated Procedures and Controls. The five levels measure specific management, operational, and technical control objectives. Each of the five levels contains criteria to determine whether the level is adequately implemented, with each successive level representing a more complete and effective security program. FMS’s assessment did not contain an overall determination of the level of effectiveness of its security program. Our review of its assessment found that FMS identified as not being met 29 of the 45 control objectives that should be applied to a secure system and another 15 control objectives in which some aspects of the related performance criteria were identified as being partially met. As discussed above, FMS has taken steps toward improving its security program by developing policy manuals, an implementation strategy, and an internal self-assessment. Through its self-assessment, FMS has identified areas within its existing security program that need improvement in order to achieve a fully implemented Level 5 security program. However, FMS has not yet developed a detailed plan that describes the remedial actions; resources (physical, human capital, and fiscal); target dates; and responsible agency officials needed to correct the shortcomings of its security program. A Level 5 security program is described as a comprehensive and integral part of an agency’s organizational culture. The components of a fully integrated Level 5 security program include an active entity-wide security program that achieves cost-effective security, integration of information technology security through all aspects of the information technology life-cycle, understanding and management of security vulnerabilities, continual evaluation of threats and adjustment of controls to the changing security environment, identification of additional or more cost-effective security alternatives as the need arises, measurement of the costs and benefits of security, and establishment of status metrics to assess the effectiveness of the security program that are also met. FMS’s entity-wide security control structure has yet to address many of the weaknesses and related significant risks associated with its current and evolving computing environment. Our audits for fiscal years 2000, 1999, 1998, and 1997 have identified significant general computer control weaknesses at each of the FMS data centers. As shown in table 1, these weaknesses have involved each of the six general control areas defined in FISCAM at multiple FMS data centers. If FMS had a fully developed, implemented, and effective security program, weaknesses found in prior years, such as the following, would be less likely to reoccur. For example, at one data center, we found access control weaknesses during our fiscal year 2000 audit that were the same as or very similar to issues that we reported at other data centers in previous years’ audits. Although FMS took corrective actions to address the individual prior years’ weaknesses found at those specific data centers, FMS did not determine whether these weaknesses also existed at their other data centers that were using the same type of computing platform. Another example involved a data center that performed security violation and sensitive activity monitoring procedures over its legacy environments. However, FMS did not apply these same procedures and requirements to a new computing environment introduced during fiscal year 2000. Until FMS takes a more disciplined and structured approach to computer security through a fully implemented entity-wide security program, there is a significant increased risk that controls will not be adequate, properly implemented, or applied consistently across each of its data centers. Integral to all security programs is a continuous risk assessment process for determining the sensitivity of information and systems, acceptable levels of risk, and specific controls needed to provide adequate security over computer resources and data. Our May 1998 best practices guide on information security management practices at leading nonfederal organizations found that organizations successfully managed their information security risks through an ongoing cycle of risk management activities. During our fiscal year 2000 audit, we found that FMS had not developed a comprehensive entity-wide risk assessment to be used as a basis for establishing appropriate security policies and selecting cost- effective techniques for implementing policies. Documents and approaches that FMS had already developed could be used together to form the foundation of an entity-wide risk assessment. The absence of a comprehensive risk assessment that identifies entity-wide risks could lend itself to practices that are inconsistent with acceptable standards and expose FMS to increased weaknesses and unnecessary risks. General controls are the structure, policies, and procedures that apply to an entity’s overall computer operations. General controls establish the environment in which application systems and controls operate. In addition to an entity-wide security management program discussed above, they include access controls, system software controls, application software development and change controls, segregation of duties, and service continuity controls. An effective general control environment would (1) protect data, files, and programs from unauthorized access, modification, and destruction; (2) limit and monitor access to programs and files that control computer hardware and secure applications; (3) prevent the introduction of unauthorized changes to systems and applications software; (4) prevent any one individual from controlling key aspects of computer-related operations; and (5) ensure the recovery of computer processing operations in case of a disaster or other unexpected interruption. In addition to the weaknesses in its security program discussed above, our fiscal year 2000 review of FMS’s general computer controls also identified serious new general control weaknesses in access controls and system software.