Press Releases

The Comptroller reveals deficiencies with the Accounts Payable and Fixed Assets modules in the UPR Central Administration

The Office of the Comptroller of Puerto Rico (OCPR) issued a qualified opinion on the operations of the computerized information systems of the Office of Information Systems (OSI) of the Central Administration of the University of Puerto Rico (UPR). A qualified opinion is issued when the noncompliances, individually or together, are significant but not pervasive.

The Report reveals that the interim director of the Purchasing Division and an accountant of the Finance Office did not activate, in the Accounts Payable module, the option that calculates the income tax withholding. This had the effect that 10% was not withheld, in accordance with the 2011 Internal Revenue Code, from 10 of 14 suppliers, equivalent to $9,772.

The five-finding audit notes that the Fixed Assets module of the Administrative Information System (SIA) does not have updated information. From an examined sample, 14 of 16 computers registered in the module were not located, the documentation of the computers was not kept, and the property custodian did not issue the receipts for the property used by officials and employees.

In addition, the property custodian had requests of up to more than 12 years for disposals, transfers, thefts or seizures of computers without updating them in the SIA. This situation prevents reliable property records from being maintained and increases the risk of their loss or improper use.

In contravention of the Policy on Best Practices in Technological Infrastructure of Circular Letter 2023-004, the property custodian did not include the name of the employee custodian of the equipment in the Fixed Assets module. The examination of the records of 1,496 desktop or laptop computers revealed that, in 74%, the fields to identify the employee to whom the property was assigned were blank.

On the other hand, the auditors found that, as of August 22, 2024, after up to 18 months from the cessation or termination of service, 13 access accounts to the Administrative Information System of 12 former employees and a former consultant of the Finance Office had not been deactivated. This situation prevents effective and efficient control over the access accounts and makes it impossible to detect unauthorized access in time.

In the inspections carried out to validate the environmental controls, flammable liquids and cleaning equipment were found in the Office of Administrative Services, a wall with a deteriorated wood panel in the Telecommunications room and boxes stored inside the communication cabinet of the Office of Physical Development and Infrastructure. In addition, several cabinets were not locked and the cabling of the entire Computing Center was disorganized.

The lack of environmental and physical controls to protect the equipment is a situation contrary to the provisions established by the Federal Information System Controls Audit Manual.

The Central Administration has an infrastructure of 665 computers, 607 laptop computers, 80 physical servers and 171 virtual ones, 27 WiFi antennas, 14 switches, two routers and two firewalls.

The budget assigned to the Central Administration was $55.3 million in 2022, $18.4 million in 2023 and $17.8 million in 2024.

The Report contains four recommendations for the attention of the UPR Governing Board, the Secretary of the Treasury, and the President of the University.

This first report on the UPR Central Administration covers the period from January 1, 2023 to November 30, 2024.

Audit Report OC-25-86 is available on our website: www.ocpr.gov.pr.