Summary: In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2010 and 2009. As part of these audits, we performed a review of information systems controls over key BPD financial systems. As we reported in connection with our audit of the Schedules of Federal Debt for the fiscal years ended September 30, 2010 and 2009, we concluded that BPD maintained, in all material respects, effective internal control over financial reporting relevant to the Schedule of Federal Debt as of September 30, 2010, that provided reasonable assurance that misstatements, losses, or noncompliance material in relation to the Schedule of Federal Debt would be prevented, or detected and corrected on a timely basis. However, we identified information systems deficiencies affecting internal control over financial reporting, which, while we do not consider them to be collectively either a material weakness or significant deficiency, nevertheless warrant BPD management's attention and action. This report presents the control deficiencies we identified during our fiscal year 2010 testing of information systems controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD's corrective actions to address information systems control-related recommendations contained in our prior years' reports and open as of September 30, 2009. In a separately issued Limited Official Use Only report, we communicated detailed information regarding our findings to BPD management. We also assessed information systems controls over key financial systems that the Federal Reserve Banks (FRB) maintain and operate on behalf of BPD. We issued a separate report to the Board of Governors of the Federal Reserve System on the results from that assessment.
Our fiscal year 2010 audit procedures identified four new general information systems control deficiencies related to access controls, configuration management, and segregation of duties. We made six recommendations to address these control deficiencies. None of the control deficiencies we identified represented significant risks to the BPD financial systems. The potential effect of such control deficiencies on financial reporting relevant to the Schedule of Federal Debt was mitigated by BPD's physical security measures and a program of monitoring user and system activity, as well as compensating management and reconciliation controls designed to detect potential misstatements in the Schedule of Federal Debt. In addition, during our fiscal year 2010 follow-up on the status of BPD's corrective actions to address 11 open recommendations related to general information systems control deficiencies identified in prior years' audits, we determined that as of September 30, 2010, corrective action on 9 of the 11 recommendations was completed, while corrective action was in progress on the 2 remaining open recommendations related to access controls. BPD provided comments on the detailed findings and recommendations in the separately issued Limited Official Use Only report. In those comments, the Commissioner of BPD stated that of the six findings open as of September 30, 2010, one has been completely resolved and corrective actions for the remaining five are planned or in progress. The Commissioner further commented that BPD intends to implement corrective actions for two of the five remaining findings by August 2011 and for the other three by December 2011. We recommend that the Commissioner of the Bureau of the Public Debt direct the appropriate BPD officials to implement the six new detailed recommendations presented in the separately issued Limited Official Use Only report.
