The Office of the Comptroller of Puerto Rico issues a qualified opinion on the internal controls for the administration of security, logical access and service continuity of the Information Systems Office of the Emergency Medical Corps (CEM). A qualified opinion is issued when the noncompliances, individually or together, are significant but not pervasive.
The Report reveals that the Emergency Medical Corps had not prepared a risk analysis report of the computerized information systems as of September 30, 2015. The lack of such a report does not allow estimating the impact of the risk elements nor planning how to protect them to reduce the risks of material damage and loss of information. The CEM had 177 computers, 10 servers and the applications NorthStar Computer Aided Dispatch for emergency medical services, e-Roc for administrative matters and Kronos to record staff attendance.
The four-finding audit notes deficiencies with the Business Continuity Plan, which was neither approved nor updated, and with the Emergency Response Plan, which was also not updated. In addition, the CEM did not have an alternate center to restore its operations and never formalized in writing the establishment of such an alternate center with the State Agency for Emergency Management.
Our auditors identified the lack of a written procedure to maintain control of access to accounts and the absence of a record on the follow-up, analysis and resolution of security incidents. This situation is contrary to the Information Systems Security Policy contained in Circular Letter 77-05. In this regard, the Report recommends that the Commissioner of the Bureau of the Emergency Medical Corps ensure that the rules and procedures to control access to applications and information systems are drafted and approved, and that he instruct the contracted company to maintain a record with the analysis of the incidents that occur in the information systems.
The Report covers the period from August 24, 2015 to June 24, 2016.
See Audit Report TI-18-05.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
