FMS is the government’s financial manager, central disburser, and collections agency as well as its accountant and reporter of financial information. For fiscal year 1997, FMS reported processing over 850 million disbursements totaling over $1 trillion for a wide variety of expenses, including Social Security and veterans benefits payments, IRS tax refunds, federal employee salaries, and vendor billings. With several exceptions (the largest being the Department of Defense), FMS makes disbursements for all federal agencies. FMS is also responsible for administering the world’s largest collections system. Each year, the government collects over $1.5 trillion from sources such as individual and corporate income tax deposits, customs duties, loan repayments, fines, and proceeds from leases. FMS maintains a network of about 18,000 financial institutions to help collect these revenues. In addition, FMS oversees the federal government’s central accounting and reporting systems to reconcile and keep track of the federal government’s assets and liabilities. Financial and budget execution information from these central systems is used by FMS to publish financial reports that are used by the Congress, the Office of Management and Budget, other federal agencies, and others who make financial decisions on behalf of the U.S. government. FMS maintains a wide array of financial and information systems to help it process and reconcile monies disbursed and collected by the various government agencies. Multiple banking, collection, and disbursement systems are also used to process agency transactions, capture relevant data, transfer funds to/from the Treasury, and facilitate the reconciliation of these transactions. FMS has data centers at six regional financial centers that are responsible for issuing paper check and electronic funds transfer payments. In addition, FMS relies on a network of contractors and FRBs to help carry out its financial management responsibilities. The FMS Commissioner and Assistant Commissioner, Information Resources, are responsible for overseeing the development, implementation, and operation of the organizationwide information data processing systems, including the establishment of appropriate general computer controls. Individual system users, such as FMS financial operations and federal finance staff located in Washington, D.C., and the six regional financial centers, civilian federal agencies, FRBs, contractor staff, and commercial bank staff are also responsible for overseeing and ensuring the security of individual systems and information under their purview. Our objectives were to evaluate and report on the general computer controls over key financial systems maintained and operated by FMS and its contractors. These systems process collections and disbursements and provide financial and budget reports for the federal government. Specifically, we evaluated general controls intended to protect data, files, programs, and equipment from unauthorized access, modification, and destruction; provide adequate segregation of (1) duties involving applications and system programmers and (2) responsibilities for computer operations, security, and quality assurance; prevent the introduction of unauthorized changes to systems and ensure recovery of computer processing operations in case of a disaster or other unexpected interruption; and ensure that an effective entitywide computer security planning and management program is in place. To evaluate general controls, we identified and reviewed FMS’ general computer control policies and procedures; conducted tests and observations of controls in operation; and held discussions with staff at the locations visited to determine whether the general controls were in place, adequately designed, and operating effectively. In addition, we attempted to obtain access to sensitive data and programs from within and outside the organization. These attempts were performed with the knowledge and cooperation of FMS officials. To assist in our evaluation and testing of computer controls, we contracted with the independent public accounting firm Price Waterhouse, LLP (now PricewaterhouseCoopers). We determined the scope of the contractor’s audit work, monitored its progress, and reviewed the related working papers to ensure that the findings were adequately supported. During the course of our work, we communicated our interim detailed findings and recommended corrective actions to FMS management and its contractors who informed us of the corrective actions they planned to take or had taken to address the findings we identified. We performed additional work to assess the status of any corrective actions taken as of September 30, 1997. These results were also communicated to FMS. We performed our work at FMS data centers located throughout the United States. We performed our work from March 1997 through January 1998 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Secretary of the Treasury or his designee. On September 24, 1998, the Assistant Fiscal Assistant Secretary provided us with oral comments. These comments are summarized in the “Agency Comments” section of this report. Our review of FMS’ general computer controls identified numerous weaknesses that place FMS’ financial systems at significant risk of unauthorized access, improper modification, loss, and disclosure. These weaknesses include inappropriate access to computer programs, data, and equipment; inadequate segregation of duties; improper application and systems software development and change control procedures; and incomplete or untested service continuity and contingency plans. Access controls are designed to limit or detect access to computer programs, data, equipment, and facilities to protect these resources from unauthorized modification, loss, and disclosure. Such controls include logical, system software, and physical controls. Logical controls include user identifications (ID), passwords, or other identifiers and security software programs. Logical controls restrict the access of legitimate users to the specific systems, programs, and files they need to conduct their work and to prevent unauthorized users from gaining access to computing resources. Controls over access to and modification of system software are essential to protect the overall integrity and reliability of information systems. Physical security controls include locks, guards, badges, alarms, and similar measures (used alone or in combination) that help to safeguard computer facilities and resources from espionage, sabotage, damage, and theft. Our review of FMS’ access controls identified a number of weaknesses at all of the sites we visited. Those weaknesses included data centers that (1) granted excessive and powerful systems privileges to users who did not need such access, (2) did not manage the administration of passwords and user IDs effectively, (3) were not applying security system parameters so as to provide optimum security or appropriate segregation of duties, and (4) were not monitoring and controlling dial-in access to local area networks and the mainframe environments. For example: System operators were given unneeded access to program utility products used to perform maintenance to operating system code, production source code, and production data, exposing the data center to the risk of unauthorized changes to system software or data. The user IDs of terminated employees were not removed from the system on the dates of termination and one showed activity after that date, thus increasing the risk of unauthorized access to system resources. A substantial number of agency user IDs have not been used for an extended period, increasing the risk that intruders could use these accounts to gain unauthorized access to system resources. All users, including programmers and computer operators at one data center, have the capability to read sensitive production data, such as security-setting tables and tax payment information, increasing the risk that sensitive information may be disclosed to unauthorized individuals. In addition, physical security controls at four of the sites we visited were not sufficient to control physical access to these centers. In particular, we found that production staff, terminated employees, vendors, and other individuals without justified business or job-related purposes had unrestricted access to computer facilities, equipment, and tape libraries. The risks created by these control weaknesses were heightened because FMS was not adequately managing and monitoring user access activities. In some instances, program managers and security personnel did not periodically monitor and evaluate user access rights, security violations, and software security settings. FMS is also at risk that unauthorized activities, such as corruption of financial data, disclosure of sensitive data, or introduction of malicious programs or unauthorized modifications of software, will go undetected. Another key control for safeguarding programs and data is to ensure that duties and responsibilities for authorizing, processing, recording, and reviewing data, as well as initiating, modifying, migrating, and testing of programs, are separated to reduce the risk that errors or fraud will occur and go undetected. Duties that should be appropriately segregated include applications and system programming and responsibilities for computer operations, security, and quality assurance. Policies outlining the assignment of these responsibilities to groups and related individuals should be documented, communicated, and enforced. We found segregation of duty weaknesses at three of the seven sites we visited. These weaknesses primarily involved programmers (both systems and applications programmers) who served as backup computer operations staff and had access rights to production data and systems programmers who served as backup security officers and could alter security functions and access system resources. Duties that are not appropriately segregated significantly increase the risk that improper program changes could be made or computer data and systems resources could be altered, damaged, or destroyed. Because FMS’ activities involve extremely large volumes of monetary transactions, erroneous or fraudulent program or data changes could potentially result in significant financial losses to the federal government. Controls over the design, development, and modification of system software help to ensure that all programs and program modifications are properly authorized, tested, and approved. Such controls also help prevent security features from being inadvertently or deliberately turned off and processing irregularities or malicious code from being introduced. We found application software development and change control procedure weaknesses at six of the seven FMS sites that we visited. A significant weakness at most of the sites we visited was that policies and procedures over system design, development, and modification were not established, were inadequate, or were simply not being followed.