The Office of the Comptroller of Puerto Rico issues a qualified opinion on the operations of the Criminal Justice Information System of the Department of Justice related to, among others, the internal controls for the administration of security, logical and physical access and the continuity of service of the Integrated Criminal Registry (RCI) and the Registry of Persons Convicted of Sexual Crimes and Child Abuse (SORNA). A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.
The Report reveals that after almost four years of having been created through Act 143-2014, a Committee to direct and, among other duties, create a Protocol to Guarantee Effective Communication between the Security Components of the Commonwealth of Puerto Rico, this Protocol had not been approved or sent to the Legislature. Nor had the work plan to implement the measures provided in the Act been approved or submitted to the Legislature.
The six-finding audit notes the delay of almost three years in the validation of the registry information in the Integrated Criminal Registry created in 2013. As of September 21, 2016, only 89% of the 380,000 records had been validated.
In addition, the Information System did not have a contingency plan for the systems nor an alternate center for the recovery of computerized operations. These situations, which could lead to improvisation and to inappropriate and disorderly measures being taken in cases of emergency, had already been noted in Audit Report TI-05-07 in 2004.
The Report indicates that the Data Center was without air conditioning from October 4, 2015 to May 11, 2016 and without an alarm system for the air conditioner that warned about the need to turn off the equipment due to high temperatures. As a consequence, the server disks on which they maintained the data of the Auxiliary Secretariat of Juvenile Affairs and of the Prosecution Case Management System were damaged. In addition, the continuity of operations and the equipment of the Data Center, whose estimated cost amounts to $767,500, were put at risk.
Our auditors identified that access to SORNA had been granted to employees who did not use the system or record transactions. In addition, they found that a formal methodology for the acquisition and development of applications in the System is lacking.
The Report covers the period from January 25, 2016 to June 15, 2017.
To view other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
