We also identified vulnerabilities in certain controls that detect unauthorized access to BPD’s systems. However, we verified that corrective actions resolving these vulnerabilities had been completed by BPD subsequent to September 30, 1997. Application Controls Can Be Strengthened

In addition to testing general controls, we tested application controls for two key BPD financial applications maintained and operated at the BPD data center. We identified the following areas where improvements could be made: (1) strengthening access controls by further restricting system access rights and improving security monitoring and (2) managing accuracy controls more effectively by ensuring that established procedures are followed to prevent the unauthorized deletion of exception reports. However, we found several vulnerabilities in general and application controls that require FRB management’s attention and action. We will review the status of FRBs’ other corrective actions as part of our fiscal year 1998 financial audits. The Commissioner of the Bureau of the Public Debt indicated that he was pleased that the review of BPD’s general controls over financial systems did not identify any reportable conditions. Further, he stated that in most cases, BPD has corrected or is already taking actions to resolve the vulnerabilities identified in this report.
Why GAO Did This Study

Pursuant to a legislative requirement, GAO reviewed the general and application controls that support key automated financial systems maintained and operated by the Bureau of the Public Debt (BPD).

What GAO Found

GAO noted that: (1) overall, GAO found that BPD implemented effective computer controls; however, GAO identified certain vulnerabilities in general controls involving: (a) access to data and programs; (b) physical access; (c) contingency planning; and (d) security management; (2) GAO also identified vulnerabilities in the controls for two key BPD financial applications maintained and operated at the BPD data center in Parkersburg, West Virginia; (3) addressing these vulnerabilities requires: (a) strengthening access controls by further restricting system access rights and improving security monitoring; and (b) managing accuracy controls more effectively by ensuring that established procedures are followed to prevent unauthorized deletion of exception reports; (4) in most cases, BPD has corrected or is correcting the vulnerabilities that GAO identified; (5) GAO provided a general summary of the vulnerabilities that existed on September 30, 1997; (6) those that GAO verified had been fully resolved subsequent to September 30, 1997, GAO has so noted; and (7) GAO will review the status of BPD's other corrective actions as part of its fiscal year 1998 financial audits.