This audit report contains the Annual Financial Statement of the Federal Bureau of Prisons (BOP) for the fiscal years (FY) ended September 30, 2007, and September 30, 2006. Under the direction of the Office of the Inspector General (OIG), KPMG LLP (KPMG) performed the audit, which resulted in an unqualified opinion on the FY 2007 financial statements. An unqualified opinion means that the financial statements present fairly, in all material respects, the financial position and results of the entity’s operations in conformity with generally accepted accounting principles in the United States. The FY 2006 audit also resulted in an unqualified opinion (OIG Report No. 07‑23).

KPMG also issued reports on internal control and on compliance and other matters. The auditors identified one significant deficiency in the Independent Auditors’ Report on Internal Control, which has been reported since the FY 2002 annual financial statement audit. The significant deficiency noted that improvements were needed in the BOP’s information system controls environment. Specifically, weaknesses were identified in the BOP’s logical access controls and system software. Also, weaknesses existed during the fiscal year in the area of system software for the Financial Management Information System accounting system maintained by the Department of Justice’s (DOJ) Justice Management Division. The report notes that improvements are needed in the consolidated DOJ information systems general controls environment, which provides general control support to the BOP. In their Independent Auditors’ Report on Compliance and Other Matters, the auditors reported no issues, including no instances of noncompliance with the requirements of the Federal Financial Management Improvement Act (FFMIA) of 1996.

The OIG reviewed KPMG’s report and related documentation and inquired of its representatives. Our review, as differentiated from an audit in accordance with U.S. generally accepted government auditing standards, was not intended to enable us to express, and we do not express, an opinion on the BOP’s financial statements, conclusions about the effectiveness of internal control, conclusions on whether the BOP’s financial management systems substantially complied with the FFMIA, or conclusions on compliance with laws and regulations. KPMG is responsible for the attached auditors’ reports dated November 5, 2007, and the conclusions expressed in the reports. However, our review disclosed no instances where KPMG did not comply, in all material respects, with generally accepted government auditing standards.