Subject: The Comptroller of Puerto Rico issues a favorable opinion with exceptions on the internal controls established in the Puerto Rico Public Broadcasting Corporation in the administration of the security of its computerized information systems and the function of its Internal Audit Office.
The four-finding Report reveals that as of October 28, 2015, the Corporation had not prepared a risk analysis report or a business impact report of the computerized information systems. These situations, contrary to the Information Systems Security Policy (TIG-003) and the Government Continuity Policy (TIG-015), among others, prevent estimating the impact of risks on critical systems in order to protect them and reduce damages in the event of a disaster.
The audit points out the lack of a procedure for handling incidents and a trained response team, which are crucial for the control of security in the systems. In this regard, it recommends preparing a training plan for the supervisor and the personnel, and ensuring that contractors have the knowledge to develop the incident handling plan.
Our auditors detected that for 10 years, since July 1, 2006, the Internal Audit Office had not performed evaluations or audits of the computerized information systems.
The Corporation also lacks written procedures for the administration and security of the systems and needs to include important provisions in the Standards Manual that dates from 2003. These situations could promote the improper use of the information systems and expose the information to unnecessary risks.
The Report covers the period from September 30, 2015 to February 3, 2016.
See Audit Report TI-17-06.
To view other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
