It created the Bank  Insurance Fund and the Savings Association Insurance Fund, which are  responsible for protecting insured bank and thrift depositors, respectively,  from loss due to institution failures. Security Improvements Made, but System Vulnerabilities Remain

In our audit of FDIC’s calendar year 2001 financial statements, we found  that FDIC made progress in correcting previously identified weaknesses. Specifically, FDIC has not adequately limited access to data and  programs by controlling mainframe access authority, providing sufficient  network security, or establishing a comprehensive program to monitor  access activities. Other information system control weaknesses were also  identified that could likewise hinder FDIC’s ability to provide adequate  physical security for its computer facility, appropriate segregation of  computer functions, effective control of system software changes, or  ensure continuity of operations. Although progress was made in limiting access, FDIC’s information  systems controls were not adequately protecting financial and sensitive  information.
Why GAO Did This Study

GAO reviewed information systems general controls in the calendar year 2001 financial statement audits of the Federal Deposit Insurance Corporation's (FDIC) Bank Insurance Fund, Savings Association Insurance Fund, and Federal Savings and Loan Insurance Corporation Resolution Fund.

What GAO Found

FDIC made progress in correcting information security weaknesses previously identified and has taken steps to improve security. Nevertheless, GAO identified new weaknesses in its information systems controls that affect the corporation's ability to safeguard electronic access to critical financial and other sensitive information. FDIC did not adequately limit access to data and programs by controlling mainframe access authority, providing sufficient network security, or establishing a comprehensive program to monitor access activities. Further, other information systems control weaknesses were identified that could hinder FDIC's ability to provide physical security for its computer facility, appropriate segregation of computer functions, effective control of system software changes, or continuity of operations.