Summary: In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2002 and 2001. The review addressed both general and application computer controls. General computer controls are the structure, policies, and procedures that apply to an entity's overall computer operations. General computer controls establish the environment in which application systems and controls operate. An effective general control environment helps (1) ensure that an adequate entity-wide program for security management is in place, (2) protect data, files, and programs from unauthorized access, modification, disclosure, and destruction, (3) limit and monitor access to programs and files that control computer hardware and secure applications, (4) prevent the introduction of unauthorized changes to systems and applications software, (5) prevent any one individual from controlling key aspects of computer-related operations, and (6) ensure the recovery of computer processing operations in case of a disaster or other unexpected interruption. An effective application control environment helps ensure that transactions performed by individual computer programs are valid, properly authorized, and completely and accurately processed and reported.
As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2002 and 2001, BPD maintained, in all material respects, effective internal control, including general and application computer controls, relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2002. BPD's internal control provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt for the fiscal year ended September 30, 2002, would be prevented or detected on a timely basis. We found matters involving computer controls that we do not consider to be reportable conditions.
