Federal Deposit Insurance Corporation
550 17th St. NW Washington, DC, 20429 Deputy to the Chairman & Chief Financial Officer
February 9, 2004
Mr. David M. Walker
Comptroller General of the United States
U. S. General Accounting Office
441 G Street, NW
Washington, DC 20548
Re: FDIC Management Response on the
GAO 2003 Financial Statements Audit Report
Dear Mr. Walker:
Thank you for the opportunity to comment on the U. S. General Accounting Officeís (GAO)
draft audit report titled, Financial Audit: Federal Deposit Insurance Corporation Fundsí
2003 and 2002 Financial Statements, GAO-04-429. The report presents GAOís opinions
on the calendar year 2003 financial statements of the Bank Insurance Fund (BIF), the
Savings Association Insurance Fund (SAIF), and the Federal Savings and Loan Insurance
Corporation Resolution Fund (FRF). The report also presents GAOís opinion on the
effectiveness of FDICís internal controls as of December 31, 2003 and GAOís evaluation
of FDICís compliance with applicable laws and regulations.
We are pleased to accept GAOís unqualified opinions on the BIF, SAIF, and FRF financial
statements and to note that there were no material weaknesses identified during the 2003
audits. The GAO reported that: the fundsí financial statements were presented fairly and in
conformity with U. S. generally accepted accounting principles; FDIC had effective internal
control over financial reporting (including safeguarding of assets) and compliance with laws
and regulations; and there were no instances of noncompliance with selected provisions of
laws and regulations.
GAO identified the need to improve internal control over FDICís information systems (IS)
and issued a reportable condition. Although GAO identified weaknesses in FDICís IS
controls, the audit team noted that significant improvements had been made during the past
year, and that the weaknesses did not materially affect the 2003 financial statements.
We acknowledge GAOís assessment of both the status and the substantial progress made
in addressing the IS control environment. During 2003, FDICís accomplishments included
implementation of a recurring IS controls self assessment program, implementation of
more stringent contractor personnel clearance and site security policies and procedures,
and establishment of an aggressive patch management program. The FDIC will continue
efforts to strengthen its ongoing, comprehensive information security program during 2004.
If you have any questions or concerns, please let me know.
Steven O. App
Deputy to the Chairman and Chief Financial Officer