Objective, Scope, and Methodology

The objective of our review was to assess the effectiveness of FDIC’s  information system general controls, including the progress the  corporation had made in correcting or mitigating weaknesses reported in  our financial statement audits for calendar years 2001 and 2002. In addition, we reviewed FDIC’s corrective actions  taken to address vulnerabilities identified in our audits for calendar years  2001 and 2002. Although FDIC has made significant progress in  correcting these weaknesses and has taken other steps to   improve security, our testing in our calendar year 2003 audit identified  additional control weaknesses. Substantial Progress Was Made in Implementing a Computer Security Program, but a Key Element Was Incomplete

A key reason for FDIC’s continuing weaknesses in information system  controls is that it has not yet fully established a comprehensive security  management program to ensure that effective controls are established and  maintained and that information security receives significant management  attention. Although FDIC has made substantial progress in each of the elements  discussed above, it only recently established a program to test and evaluate  its computer control environment, but this program was incomplete. Information security weaknesses detected are analyzed for systemic  solutions. However, we identified additional computer control weaknesses  that place critical FDIC financial and sensitive personnel and bank  examination information at risk of unauthorized disclosure, disruption of  operations, or loss of assets. Specifically, the test and evaluation program does not  include adequate provisions to ensure that (1) all key computer resources  supporting FDIC’s financial environment are routinely reviewed and tested,  (2) weaknesses detected are analyzed for systemic solutions, (3) corrective  actions are independently tested, and (4) newly identified weaknesses or  emerging security threats are incorporated into the test and evaluation  process.
Why GAO Did This Study

Effective controls over information systems are essential to ensuring the protection of financial and personnel information and the security and reliability of bank examination data maintained by the Federal Deposit Insurance Corporation (FDIC). As part of our calendar year 2003 financial statement audits of three FDIC Funds, GAO assessed the effectiveness of the corporation's general controls on its information systems. Our assessment included follow up on the progress that FDIC has made in correcting or mitigating computer security weaknesses identified in our audits for calendar years 2001 and 2002.

What GAO Found

FDIC has made significant progress in correcting prior year information security weaknesses. The corporation addressed almost all the computer security weaknesses we previously identified in our audits for calendar years 2001 and 2002. Nonetheless, testing in our calendar year 2003 audit identified additional computer control weaknesses in FDIC's information systems. These weaknesses place critical FDIC financial and sensitive examination information at risk of unauthorized disclosure, disruption of operations, or loss of assets. A key reason for FDIC's continuing weaknesses in information system controls is that it has not yet fully established a comprehensive security management program to ensure that effective controls are established and maintained and that information security receives significant management attention. The corporation only recently established a program to test and evaluate its computer control environment, and this program does not yet include adequate provisions to ensure that (1) all key computer resources supporting FDIC's financial environment are routinely reviewed and tested, (2) weaknesses detected are analyzed for systemic solutions, (3) corrective actions are independently tested, and (4) newly identified weaknesses or emerging security threats are incorporated into the test and evaluation process.