The Office of the Comptroller of Puerto Rico issues a qualified opinion on the internal controls for the administration of the security program, the logical and physical access as well as the service continuity of the Computerized Information Systems of the Puerto Rico Labor Relations Board. A qualified opinion is issued when the noncompliances, individually or together, are significant but not pervasive.
The Report reveals that as of September 15, 2016, the Board did not have risk analysis reports, nor business impact analysis reports, and also did not have a plan for managing information systems incidents. These situations make it difficult to develop a business plan, estimate the impact that risks would have on critical areas and systems, and prevent effective control. In fact, the Board lacked a business continuity plan necessary to restore operations in the event of risks such as malicious network attacks, computer viruses, or voltage variations.
The five-finding audit notes deficiencies with the Contingency Plan, which was not updated nor had its effectiveness been certified through drills. The security parameters were also not defined and deficiencies were verified in the audit policies (Audit Policy), account control, and security options.
The Report recommends regulating the process of disposing of sensitive information and programs before transferring or decommissioning the computerized equipment. The Board's case system records personal information of the complainant as well as the facts and controversies, and not having a regulation in this regard may cause unauthorized persons to gain access to confidential information.
The Report covers the period from May 31 to December 23, 2016.
See Audit Report TI-18-04.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
