Summary: In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2007 and 2006. As part of these audits, we performed a review of the general and application information security controls over key BPD financial systems. In our audit report on the Schedules of Federal Debt for the fiscal years ended September 30, 2007 and 2006, we concluded that BPD maintained, in all material respects, effective internal control relevant to the Schedule of Federal Debt related to financial reporting and compliance with applicable laws and regulations as of September 30, 2007, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected on a timely basis. However, we found matters involving information security controls that we do not consider to be significant deficiencies. As it relates to controls over financial reporting and compliance with applicable laws and regulations, BPD mitigated the potential effect of such control deficiencies with physical security measures, a program of monitoring user and system activity, and compensating management and reconciliation controls. Nevertheless, these matters warrant BPD management's attention and action. This report presents the control deficiencies identified during our fiscal year 2007 testing of the general and application information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD's corrective actions to address recommendations that were contained in our prior years' audit reports and open as of September 30, 2006.
Our fiscal year 2007 audit procedures identified 10 new information security control deficiencies, all of which relate to general controls. Specifically, the control deficiencies identified were in the areas of system software, and application software development and change control. None of our findings pose significant risks to the BPD financial systems. As it relates to controls over financial reporting and compliance with applicable laws and regulations, BPD mitigated the potential effect of these control deficiencies with physical security measures and a program of monitoring user and system activity. Further, BPD has compensating management and reconciliation controls that are designed to detect potential irregularities or improprieties in financial data or transactions. During our follow-up on the status of BPD's corrective actions to address 11 open recommendations related to general information security control deficiencies identified in prior years' audits for which actions were not complete as of September 30, 2006, we found the following: (1) as of September 30, 2007, corrective action on 9 of the 11 recommendations was completed; and (2) corrective action was in progress as of September 30, 2007, on the two remaining open recommendations, one of which relates to access control and the other to application software development and change control.
