Exhibit I – Reportable Condition

U.S. Department of Commerce
Independent Auditors' Report
Exhibit I – Reportable Condition

Financial Management Systems Need Improvement (Repeat Condition Since 1998)

For many years, the U.S. Department of Commerce (Department) Office of Inspector General (OIG), U.S. Government Accountability Office (GAO), and departmental selfassessments have identified weaknesses in the Department’s information technology (IT) and financial systems controls. Our fiscal year 2006 assessment of the Department’s general IT and financial systems controls, performed in support of the fiscal year 2006 consolidated financial statement audit, found that although the Department needs to make further progress with its general IT control environment, progress has been made in addressing many prior weaknesses. For example, during FY 2006 Commerce took several positive steps with its IT control processes, not only to improve controls and processes, but also to help address previously reported IT control weaknesses, including an IT security material weakness reported under the Federal Managers’ Financial Integrity Act (FMFIA).

As in FY 2005, Commerce continued to focus on improving the Department’s information security certification and accreditation program, which is a key information security management and technical control process. Additionally, in June 2006, operating units were required to comply with the requirements of the Department’s revised DOC IT Security Policy and Minimum Implementation Standards. The guidance significantly updated DOC mandatory minimally acceptable implementation standards for the implementation of effective IT security programs at all bureaus and operating units. The policy incorporates, by reference, the most current Public Laws, Federal and Departmental regulations affecting security of Federal information systems. It also includes recommended management practices of the Federal government and private industry.

Despite these improvements, we continued to identify weaknesses in general IT controls that we consider to be a reportable condition as defined by the American Institute of Certified Public Accountants. As part of the Department’s fiscal year 2006 FMFIA evaluation, the Department also determined (and the OIG also confirmed) that a material weakness, related to IT information security, exists.

Effective general IT controls add assurance that data used to prepare and report financial information and statements is complete, reliable, and has integrity. Our fiscal year 2006 IT assessment was focused on the general IT controls over the Department’s major financial management systems and supporting network infrastructure, using GAO’s Federal Information System Controls Audit Manual (FISCAM) as a guide. The six FISCAM general IT control review elements, and our related findings, are as follows:

• Entity-wide security program. An entity-wide security program for security planning and management is the foundation of an organization’s information security control structure. The program should provide a framework and continuing cycle of activity for managing risk, developing security policies, assigning responsibilities, and monitoring the adequacy of computer-related security controls.
  
  Although the Department has made improvements in this area, our audit identified that entity-wide security can still be improved at three bureaus, primarily in the areas of: (1) updating risk assessments, (2) establishing security controls for interconnected systems, and (3) updating system security plans.
  
  Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, provides key guidance for establishing and maintaining an entity-wide information security program. Collectively, the identified entity-wide security planning and management issues, coupled with the access control issues described below, reduce the overall effectiveness of the entity-wide security programs for the individual bureaus and operating units, and the overall Department. The Department of Commerce IT Security Program Policy and Minimum Implementation Standards, reiterates OMB Circular A-130 guidance, and implements key elements of such guidance as Department-wide policy.
• Security access controls. In close concert with an organization’s entity-wide information security program, access controls for general support systems and financial systems should provide reasonable assurance that computer resources such as data files, application programs, and computer-related facilities and equipment are protected against unauthorized modification, disclosure, loss, or impairment. Access controls are facilitated by an organization’s entity-wide security program. Such controls include physical controls and logical controls.
  
  The objectives of limiting access are to ensure that users have only the access needed to perform their duties; that access to very sensitive resources, such as security software programs, is limited to very few individuals; and that employees are restricted from performing incompatible functions or functions beyond their responsibility. This is reiterated by Federal guidelines. For example, OMB Circular A-130 and supporting National Institute of Standards and Technology (NIST) security publications provide guidance related to the maintenance of technical access controls. In addition, the Department of Commerce IT Security Program Policy and Minimum Implementation Standards contain many requirements for operating Department IT devices in a secure manner.
  
  During fiscal year 2006, we noted that access controls should be improved at six of the Department’s bureaus, primarily in the areas of: (1) management of user accounts, (2) logical controls for network access, (3) requirements for obtaining signed user Rules of Behavior, (4) data center access, (4) monitoring of user actions through the use of audit trails, and (5) technical controls for system devices to protect against vulnerabilities associated with malicious threats and attacks. We recognize that the Department and its bureaus have some compensating controls in place to help reduce the risk of the identified vulnerabilities, and we have considered such compensating controls as part of our overall consolidated financial statement audit.
  
• Application software development and change control. The primary focus of application software development and change control is on controlling the changes that are made to software systems in operation. Establishing controls over the modification of application software programs ensures that only authorized programs and authorized modifications are implemented. This is accomplished by instituting policies, procedures, and techniques to determine that all programs and program modifications are properly authorized, tested, and approved, and that access to and distribution of programs is carefully controlled. Without proper controls, there is a risk that security features could be inadvertently or deliberately omitted or turned off, or that processing irregularities or malicious code could be introduced into the IT environment.
  
  During fiscal year 2006, we noted that application software development and change controls should be improved at two bureaus, primarily in the areas: (1) user access to test and production environments, and (2) segregation of system modification responsibilities and duties.
  
• System software. System software is a set of programs designed to operate and control the processing activities of computer equipment. System software helps control the input, processing, output, and data storage associated with all of the applications that run on a system. Controls over access to and modification of system software are essential in providing reasonable assurance that operating system-based security controls are not compromised and that the system will not be impaired.
  
  During fiscal year 2006, we noted that system software controls should be improved at two bureaus in the area of testing and approving system patches prior to implementation.
  
• Segregation of duties. Work responsibilities should be segregated so that an individual does not control more than one critical function within a process. Inadequately segregated duties increase the risk that erroneous or fraudulent transactions could be processed, improper program changes could be implemented, and computer resources could be damaged or destroyed. Key areas of concern for segregation of duties involves duties among major operating and programming activities, including duties performed by users, application programmers, and data center staff. Policies outlining individual responsibilities should be documented, communicated, and enforced. The prevention and/or detection of unauthorized or erroneous actions by personnel require effective supervision and review by management, as well as formal operating procedures.
  
  During fiscal year 2006, we noted a weakness related to segregation of duties that affected the implementation of system software modifications at one bureau. However, this weakness has been reported in the FISCAM review area of application software development and change control.
  
• Service continuity. Losing the capability to process, retrieve, and protect information maintained electronically can significantly affect an agency’s ability to accomplish its mission. For this reason, an agency should have: (1) procedures in place to protect information resources and minimize the risk of unplanned interruptions, and (2) a plan to recover critical operations should interruptions occur.
  
  During fiscal year 2006, we noted that service continuity controls should be improved at five bureaus, primarily in the areas of: (1) contingency plan updates to include appropriate controls and reflect current processing environments, (2) testing disaster recovery and continuity plans, and (3) procuring an alternate processing site.

Recommendations

Specific recommendations are included in a separate limited distribution IT general controls report, issued as part of the fiscal year 2006 consolidated financial statement audit. The Department should monitor bureau actions to ensure effective implementation of our recommendations.

Management’s Response

Management agreed with our findings, conclusions, and recommendations related to improving the Department’s financial management systems controls. The Department is in the process of developing corrective action plans to address the recommendations presented in the separate limited distribution IT general controls report.