Lack of risk analysis and deficiencies in environmental controls in the information technology area of the Treasury
The Office of the Comptroller of Puerto Rico issued a qualified opinion on the fiscal operations of the Information Technology Area of the Department of the Treasury. A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.
The Report reveals that, as of April 12, 2022, the Information Technology Area of the Department of the Treasury lacked a risk-analysis process as provided by the cybersecurity policies in force. The risk analysis must include the assets of the existing information systems, their vulnerabilities, and threats. In addition, every 24 months it must establish the probability that the impact on the Department's operations will occur and the controls to address the risks.
The three-finding audit also notes that, as of October 5, 2022, the Department had not updated the Disaster Recovery Plan Guide. This disaster-recovery plan must incorporate the significant changes in the Department's operational and technological structure.
In addition, as of August 23, 2022, the Contingency Plan did not detail the strategy or the information necessary to address emergency situations.
These situations foster that, in emergencies, improvisation occurs and inappropriate measures are taken without any order. The Report recommends that, among other things, the operational and technical assistance of the Puerto Rico Innovation & Technology Service be requested to support the preparation of the plans.
The Report discloses deficiencies in the environmental and physical controls in the Computer Center, the Telecommunications Room, and the communications rooms. The main processing equipment and the communications network of the Department of the Treasury are located in these areas.
The auditors found uncovered areas in the raised floor, electrical and data cables that were not used, and stored equipment that did not work. In addition, the ceiling tiles showed moisture stains, leaks in some areas, and communications equipment not identified with a property number.
These situations make efficient and effective control of the facilities difficult, foster the misuse or loss of property, and affect the maximum performance of the equipment and the continuity of services.
The Report recommends that the Secretary of the Treasury instruct the principal technical advisor of the Center of Operational Excellence to ensure that the assistant secretary of the Information Technology Area addresses the findings and takes corrective measures.
The resources to finance the operational activities of the Department of the Treasury come from special allocations, state special funds, and the joint resolution of the general budget. The budget in 2022 was $208,103,000. It rose to $939,423,000 in 2023 and to $987,777,000 in 2024.
Audit Report OC-24-49 of the Information Technology Area of the Department of the Treasury covers the period from June 30, 2018 to May 31, 2023, and is available at www.ocpr.gov.pr.
CONTACT: Lisandra Rivera Rivera, R-168
Director
Office of Press and Communications
Office of the Comptroller of Puerto Rico
lriverar@ocpr.gov.pr
(787) 250-3322
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
