Internal Controls


Despite making progress in safeguarding sensitive or confidential information, the SEC still lacks consistency in implementing key data controls, the GAO said in its annual audit released in April. Information security control weaknesses identified included 13 that remained unresolved from the previous year’s audit, plus 15 new ones, the GAO said. They included insufficient testing and evaluation of controls for a major data system as required by a certification and accreditation process, as well as inconsistent implementation of policies and procedures, including parts of the SEC’s information-security program.

The SEC had corrected 58 of the 71 weaknesses identified in 2005, the GAO noted, and by the completion of its 2006 audit had taken action on 11 of the newly identified faults. But the commission had not adequately guarded identification and authentication of users of data systems, leaving critical information in some instances vulnerable to hacking or unauthorized use or modification, the GAO said. For instance, requests for new or upgraded access to the EDGAR company financial reporting system weren’t always properly reviewed, and records of user privileges didn’t always reflect current information about users’ roles within the SEC.

FEATURE

Maximizing the higher education tax credits

A counterintuitive strategy can save taxes by including otherwise excludable scholarships in gross income.

SPONSORED REPORT

Solving the lease accounting challenge

The challenges of the new lease accounting standard have been pervasive to say the least. In this free, independently-written report, you'll learn effective adoption strategies as well as resources for easing the transition to the new standard.