The Comptroller of Puerto Rico issued a qualified opinion on the operations of the Information Systems Office and of the information systems of the State Insurance Fund Corporation. A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.
The Report reveals that, as of May 31, 2017, the Corporation lacked a business continuity plan with the specific, complete and updated plans for the computerized information systems. This plan is necessary to achieve the prompt functioning of the systems in the event of risks such as computer viruses, cyberattacks or natural disasters.
The Corporation had contracted the development of a business continuity plan and of a plan for the disaster recovery center on November 23, 2015 for $90,000. The contract was amended and extended until June 30, 2017. However, on March 2, 2017 it was rescinded, because, after 15 months, the company had not completed the business continuity plan.
The Report recommends that the Administrator of the State Insurance Fund Corporation effectively supervise the search for cost-effective alternatives to complete the business plan according to policies ATI-003 and ATI-015 of Circular Letter 140-16. The plan should detail, among others, the tasks, activities and procedures that the personnel would carry out to achieve the restoration of the critical systems.
The Report covers the period from August 5, 2016 to June 30, 2017.
See Audit Report TI-19-02.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
