The Comptroller of Puerto Rico issues a qualified opinion on the internal controls and their effectiveness in the administration of security, logical and physical access, and the processing and output of data related to the Video Game System (SVJ) and the Electronic Betting System (SEA Hípico), among others. A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.
The Report reveals the lack of a risk analysis of the computerized information systems of the Horse Racing Industry and Sport Administration. This analysis is necessary to determine the security measures and controls that must be implemented to reduce or prevent risks from occurring and to protect the assets.
The three-finding audit notes that the Administration did not have a business continuity plan, so that, in case of emergency, there is the risk that inappropriate measures and without any order would be taken in the restoration of the information systems. In addition, the administrative policies for data backup did not include specific details about: the procedure and person responsible for the backup, the place where it would be stored, or the information to be backed up.
Contrary to Policy TIG-003 on the Security of Information Systems of Circular Letter 77-05, the Administration did not document in writing the creation, modification, and elimination of the access accounts and the privileges granted. Instead, the human resources director managed the creation or elimination of an access account in person or by telephone with the entity's chief information officer.
The Report covers the period from May 31 to December 15, 2016.
See Audit Report TI-18-08.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
