The Corps acquired and owns the Corps of Engineers Enterprise  Information System (CEEIS) wide area network, which supports multiple  unclassified Corps systems, including its key financial management system,  CEFMS. An effective general controls  environment would (1) ensure that an adequate computer security  management program is in place; (2) protect data, files, and programs from  unauthorized access, modification, and destruction; (3) limit and monitor  access to programs and files that protect applications and control  computer hardware; (4) prevent unauthorized changes to systems and  applications software; (5) prevent any one individual from controlling key  aspects of computer-related operations; (6) ensure the recovery of  computer processing operations in case of a disaster or other unexpected  interruption; and (7) ensure that only authorized individuals can gain  network access to sensitive and critical agency data. Of the 75 recommendations that we made on general controls in our fiscal  year 1999 audit, the Corps had completed action on 41 and had partially  completed or was implementing action plans to correct the remaining 34. Although the Corps made substantial progress in correcting vulnerabilities,  continuing and newly identified vulnerabilities in general computer  controls continue to impair the Corps’ ability to ensure the reliability,  confidentiality, and availability of financial and sensitive data. Such access places Corps network assets at risk. The Corps did not formally  document test plans and test results for CEFMS software changes,  increasing the risk that developers might unknowingly introduce  processing anomalies or make unauthorized changes. The Corps  has determined the manual to be obsolete and is performing a functional  review. During the fiscal year 2001 audit, several instances were identified of  CEFMS users sharing their CEFMS electronic signature smartcards with  other Corps employees. Conclusions

Information system general and application controls are critical to the  Corps’ ability to manage its computer security and to ensure the reliability,  confidentiality, and availability of its financial and sensitive data. At the application control level, the Corps had  not maintained current and accurate CEFMS access authorizations and  maintained CEFMS current user manuals.
What GAO Found

GAO tested selected general and application controls of the Corps of Engineers Financial Management System (CEFMS). The Corps relies on CEFMS to perform key financial management functions supporting the Corps' military and civil works missions. The Corps has made substantial progress in improving computer controls at each of its data processing centers and other Corps sites. The Corps had completed action on 54 of GAO's 93 previous recommendations and partially completed or had action plans to correct the remainder. During the current review, nine new weaknesses were identified and corrected. Nevertheless, continuing and newly identified vulnerabilities involving general and application computer controls continue to impair the Corps' ability to ensure the reliability, confidentiality, and availability of financial and sensitive data. Such vulnerabilities increase risks to other Department of Defense networks and systems to which the Corps' network is linked. Weaknesses in general controls impaired the Corps' ability to ensure that (1) computer risks are adequately assessed, and security policies and procedures within the organization are effective and consistent with overall organizational policies and procedures; (2) users have only the access needed to perform their duties; (3) system software changes are properly documented before being placed in operation; (4) test plans and results for application changes are formally documented; (5) duties and responsibilities are adequately segregated; (6) critical applications are properly restored in the case of a disaster or interruption; and (7) the Corps has adequately protected its network from unauthorized traffic. Application control weaknesses impaired the Corps' ability to ensure that (1) current and accurate CEFMS access authorizations were maintained, (2) user manuals reflect the current CEFMS environment, and (3) the Corps is effectively using electronic signature capabilities.