GAO Find Weaknesses in SEC Information Systems Security Program

By AccountingWEB Staff
 
In a letter dated April 12 to SEC Chairwoman Mary Schapiro, James Dalkin, GAO director of financial management and assurance, and Gregory Wilshusen, GAO director of information security issues, stated that "improvements were needed in the SEC's internal controls and accounting procedures." 
 
In its audit of the SEC's fiscal years 2011 and 2010 financial statements, GAO auditors "identified significant deficiencies in internal control," one of which was the SEC's information systems security program. Following is a brief summary.
 
The GAO report outlined five specific deficiencies:
  1. Controls were not consistently implemented for identifying and authenticating users.
  2. Weaknesses in authorization controls limited their effectiveness. 
  3. Certain sensitive data were transmitted unencrypted. 
  4. Certain systems were not configured to maintain audit trails of security-relevant events.
  5. Systems were not routinely and consistently patched.
GAO recommendations for executive action: 
  1. Establish configuration baselines and related guidance for securing systems and monitoring system configuration baseline implementation. 
  2. Enhance the EDGAR security plan to document security requirements for the EDGAR/Fee Momentum subsystem. 
  3. Develop and implement a comprehensive vulnerability management strategy that includes routine scanning of SEC's systems and evaluation of such scanning to provide for any needed corrective actions. 
To learn more, you can access the text file for GAO report number GAO-12-424R, "Management Report: Improvements Needed in SEC's Internal Controls and Accounting Procedures" that was released on April 13, 2012. 
 
Related articles:
 

You may like these other stories...

Regulators struggle with conflicts in credit ratings and auditsThe Public Company Accounting Oversight Board (PCAOB), which was created by the Sarbanes-Oxley Act in 2002, released its third annual report on audits of...
Regulatory compliance, risk management and cost-cutting are the big heartburn issues for finance execs in the C-suite. Yet financial planning and analysis—a key antacid—is insufficient.That's just one of the...
A review of Financial Accounting Standards Board (FASB) guidance on share-based payment transactions found that the 2004 standard achieves its purpose and provides useful information to investors and other users of financial...

Already a member? log in here.

Upcoming CPE Webinars

Aug 26
This webcast will include discussions of recently issued, commonly-applicable Accounting Standards Updates for non-public, non-governmental entities.
Aug 28
Excel spreadsheets are often akin to the American Wild West, where users can input anything they want into any worksheet cell. Excel's Data Validation feature allows you to restrict user inputs to selected choices, but there are many nuances to the feature that often trip users up.
Sep 9
In this session we'll discuss the types of technologies and their uses in a small accounting firm office.
Sep 11
This webcast will include discussions of commonly-applicable Clarified Auditing Standards for audits of non-public, non-governmental entities.