The Department of the Treasury’s Bureau of the Fiscal Service needs to fix weaknesses in its key controls over financial information systems that are relevant to the Schedules of Federal Debt, according to a new report from the Government Accountability Office (GAO).
The Schedules of Federal Debt are datasets that report on increases and decreases in Federal debt. GAO periodically reports on the schedules, and it issued recommendations to improve the weak controls over information systems in fiscal year (FY) 2022.
The Fiscal Service addressed eight of the FY2022 recommendations, but the recent GAO report says 15 related recommendations remain unresolved – posing cybersecurity risks.
“Fiscal Service continues to make progress in remediating internal control deficiencies underlying open recommendations,” the report says. “However, these remaining information system control deficiencies increase the risk of unauthorized access to, modification of, or disclosure of sensitive data and programs and disruption of critical operations.”
“Fiscal Service mitigated the potential effect of these deficiencies on financial reporting for fiscal year 2022 with compensating management and reconciliation controls designed to detect potential misstatements on the Schedule of Federal Debt,” it continues. “It will be important for Fiscal Service management to continue focusing efforts on timely addressing the remaining recommendations, some of which have been open for several years, related to these information system control deficiencies.”
GAO said that because it did not identify any new financial information system control deficiencies relevant to the schedules, it is not making any new recommendations.
In comments provided to GAO, the Fiscal Service pledged its commitment to having effective internal controls for its information technology systems. The agency said it plans to address the already identified weaknesses and cited planned corrective actions to address them.
During its audit of the FY2023 Schedule of Federal Debt, GAO said it plans to follow up on the status of actions taken to address these deficiencies.
