The SEC said remediation of the material weaknesses is a top priority, adding that the agency has taken a number of steps to address the material weaknesses this fiscal year.
However, GAO said that putting the agency’s internal controls on a solid footing over the long term primarily requires significant investment in SEC’s financial systems.
The SEC also said that the centerpiece of SEC’s remediation strategy is to migrate its core financial system and transaction processing to a federal shared services provider.
GAO made 30 new recommendations – for example, establishing mechanisms to ensure audit logging procedures and system access roles are followed – to address these material weaknesses, and it identified other internal control issues that warrant management consideration concerning proper and timely approvals of disbursements, review of service providers’ auditor reports, and controls over travel transaction documentation.
The report noted that as of the end of fiscal 2010 the SEC had taken action to address 18 of 22 security weaknesses in information systems controls that were open as of last March.
