Objectives, Scope, and Methodology

Our objectives were to evaluate and report on the general computer controls over key financial systems maintained and operated by FMS and its contractors. Information in FMS’ Systems Is at Significant Risk Because of Serious General Control Weaknesses

Our review of FMS’ general computer controls identified numerous weaknesses that place FMS’ financial systems at significant risk of unauthorized access, improper modification, loss, and disclosure. These weaknesses include inappropriate access to computer programs, data, and equipment; inadequate segregation of duties; improper application and systems software development and change control procedures; and incomplete or untested service continuity and contingency plans. Our review of FMS’ access controls identified a number of weaknesses at all of the sites we visited. Entitywide Computer Security Planning and Management Program Is Not Effective

The overriding reason general control problems existed at FMS was because it does not have an effective entitywide computer security planning and management program to oversee organizationwide security efforts, ensure that adequate controls are established, and ensure that computer security receives adequate attention. Because of the large volume of transactions, the significance of the related amounts involved, and the number of weaknesses identified at the FMS data centers we visited, we consider FMS’ general computer control problems a material weakness. Moreover, FMS has not instituted a proactive approach for identifying, deterring, and responding to computer control weaknesses in a timely manner. Work with other appropriate assistant commissioners to ensure that an effective entitywide security planning and management program is in place.
Why GAO Did This Study

Pursuant to a legislative requirement, GAO reviewed the effectiveness of general computer controls over key financial systems used by the Financial Management Service (FMS).

What GAO Found

GAO noted that: (1) general computer control weaknesses at FMS and its contractor data centers place the data maintained in its financial systems at significant risk of unauthorized modification, disclosure, loss, or impairment; (2) because of the large volume of transactions, the significance of the related amounts involved, and the number of weaknesses identified at the FMS data centers visited, GAO considers FMS' general computer control problems a material weakness; (3) the general control weaknesses GAO found included: (a) inappropriate access to computer programs, data, and equipment; (b) inadequate segregation of duties; (c) improper application software development and change control procedures; and (d) incomplete or untested service continuity and contingency plans; (4) ineffective general computer control weaknesses place billions of dollars of payments and collections at risk of fraud; (5) these weaknesses existed primarily because FMS does not have an effective entitywide computer security planning and management program to ensure that: (a) computer controls are working and are reliable; (b) established policies and procedures are followed; (c) identified deficiencies are timely corrected; and (d) errors or fraudulent transactions are timely detected; (6) FMS has already corrected some of the weaknesses that GAO identified; (7) although FMS management is continuing to correct weaknesses GAO identified, FMS cannot ensure on an ongoing basis that weaknesses will be timely detected and corrected until it has an effective entitywide security management program; and (8) such a program, if implemented effectively across the organization, would go a long way in helping FMS to identify and promptly address its computer control weaknesses.