Comptroller detects deficiencies with access controls to the Treasury's information systems
The Office of the Comptroller of Puerto Rico (OCPR) issued a qualified opinion on the operations related to the computerized information systems of the Information Technology Area of the Department of the Treasury. A qualified opinion is issued when the noncompliances, individually or together, are significant but not pervasive.
The Report reveals deficiencies with the maintenance of the access accounts to the communications network. For example, the users of 24 active access accounts could not be identified from the lists of employees, consultants, or users of other agencies. In addition, nine groups had administrative privileges assigned to the security of the systems and the antivirus, which were not used by the Department, and which had not been removed from the 23 active access accounts to which they were assigned.
The auditors identified that, as of June 6, 2024, four access accounts of former employees who had ceased functions between 2015 and 2024 had not been deactivated. In addition, activity was recorded in four inactive access accounts and one active one, after the cessation of functions.
These situations can cause unauthorized persons to gain access to the communications network, irregularities to be committed, or the data of the information systems to be altered.
The two-finding audit notes that the Security Office of the Information Technology Area could not present documentation justifying the creation of 79 of the 99 accounts examined. One of the accounts had access to the communications network and remote access.
In fact, the evaluation of the remote access forms of a sample of 25 accounts evidenced the lack of complete information in 48% of the forms. In addition, 11 of the access accounts examined were assigned to employees not authorized to perform telework.
The budget of the Department of the Treasury rose from $939 million in 2023, to $988 million in 2024, and to $1,019 million in 2025. This fourth report with three recommendations to the Secretary of the Treasury covers the period from July 10, 2023, to July 31, 2024.
Audit Report OC-25-61 is available on our website: www.ocpr.gov.pr
.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
