Summary: In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2009 and 2008. As part of these audits, we performed a review of the general and application information security controls over key financial systems maintained and operated by the Federal Reserve Banks (FRB) on behalf of the Department of the Treasury's (Treasury) BPD relevant to the Schedule of Federal Debt. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2009 and 2008, we concluded that BPD maintained, in all material respects, effective internal control over financial reporting relevant to the Schedule of Federal Debt as of September 30, 2009, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented or detected and corrected on a timely basis. However, we identified information security deficiencies affecting internal control over financial reporting, which, while we do not consider them to be collectively either a material weakness or significant deficiency, nevertheless warrant FRB management's attention and action. This report presents the control deficiencies we identified during our fiscal year 2009 testing of the general and application information security controls over key financial systems maintained and operated by the FRBs relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of FRB's corrective actions to address information security control related recommendations contained in our prior years' audit reports and open as of September 30, 2008.
Our fiscal year 2009 audit procedures identified four new general information security control deficiencies related to security management and access controls. We made five recommendations to address these control deficiencies. None of the control deficiencies we identified represented significant risks to the key financial systems maintained and operated by the FRBs on behalf of BPD. The potential effect of such control deficiencies on financial reporting relevant to the Schedule of Federal Debt was mitigated by FRB's physical security measures and a program of monitoring user and system activity, and BPD's compensating management and reconciliation controls designed to detect potential misstatements in the Schedule of Federal Debt. In addition, during our fiscal year 2009 follow-up on the status of FRB's corrective actions to address 11 open recommendations related to general information security control deficiencies identified in our prior years' audits, we determined that as of September 30, 2009, corrective action on 8 of the 11 recommendations was completed, while corrective action was in progress on the 3 remaining open recommendations, which related to security management. The Board of Governors of the Federal Reserve System provided comments on the detailed findings and recommendations in the separately issued Limited Official Use Only report. In those comments, the Director of Reserve Bank Operations and Payment Systems stated that the agency takes control deficiencies, and actions to address them, seriously. The Director further commented that three deficiencies have already been addressed or remediated, and that the remainder have corrective actions planned or in progress.
