GAO Find Weaknesses in SEC Information Systems Security Program

By AccountingWEB Staff
 
In a letter dated April 12 to SEC Chairwoman Mary Schapiro, James Dalkin, GAO director of financial management and assurance, and Gregory Wilshusen, GAO director of information security issues, stated that "improvements were needed in the SEC's internal controls and accounting procedures." 
 
In its audit of the SEC's fiscal years 2011 and 2010 financial statements, GAO auditors "identified significant deficiencies in internal control," one of which was the SEC's information systems security program. Following is a brief summary.
 
The GAO report outlined five specific deficiencies:
  1. Controls were not consistently implemented for identifying and authenticating users.
  2. Weaknesses in authorization controls limited their effectiveness. 
  3. Certain sensitive data were transmitted unencrypted. 
  4. Certain systems were not configured to maintain audit trails of security-relevant events.
  5. Systems were not routinely and consistently patched.
GAO recommendations for executive action: 
  1. Establish configuration baselines and related guidance for securing systems and monitoring system configuration baseline implementation. 
  2. Enhance the EDGAR security plan to document security requirements for the EDGAR/Fee Momentum subsystem. 
  3. Develop and implement a comprehensive vulnerability management strategy that includes routine scanning of SEC's systems and evaluation of such scanning to provide for any needed corrective actions. 
To learn more, you can access the text file for GAO report number GAO-12-424R, "Management Report: Improvements Needed in SEC's Internal Controls and Accounting Procedures" that was released on April 13, 2012. 
 
Related articles:
 

You may like these other stories...

IRS audits less than 1 percent of big partnershipsAccording to an April 17 report from the Government Accountability Office (GAO), the IRS audits fewer than 1 percent of large business partnerships, Stephen Ohlemacher of the...
Is it time to consider a value added tax?Forbes contributor Joseph Thorndike wrote yesterday that he believes the tax reform proposal by House Ways and Means Committee Chairman Dave Camp (R-MI) was dead on arrival. But he...
Read more from Larry Perry here and in the Today's World of Audits archive.The planning phase of an audit engagement of an entity using US GAAP or a special purpose framework will, with minor differences, include similar...

Upcoming CPE Webinars

Apr 22
Is everyone at your organization meeting your client service expectations? Let client service expert, Kristen Rampe, CPA help you establish a reputation of top-tier service in every facet of your firm during this one hour webinar.
Apr 24
In this session Excel expert David Ringstrom, CPA introduces you to a powerful but underutilized macro feature in Excel.
Apr 25
This material focuses on the principles of accounting for non-profit organizations' revenues. It will include discussions of revenue recognition for cash and non-cash contributions as well as other revenues commonly received by non-profit organizations.
Apr 30
During the second session of a four-part series on Individual Leadership, the focus will be on time management- a critical success factor for effective leadership. Each person has 24 hours of time to spend each day; the key is making wise investments and knowing what investments yield the greatest return.