We include the results of the information technology audit we conducted of the Office of Information Systems (OSI) of the Office for Persons with Disabilities of the Commonwealth of Puerto Rico (Defensoría). We performed it based on the authority conferred upon us in Article III, Section 22 of the Constitution of the Commonwealth of Puerto Rico, and in Act No. 9 of July 24, 1952, as amended; and in compliance with our Annual Audit Plan.
The Office of the Comptroller of Puerto Rico issued a qualified opinion on the operations of the Office of Information Systems of the Office for Persons with Disabilities of the Commonwealth of Puerto Rico. A qualified opinion is issued when noncompliances, individually or in the aggregate, are significant but not pervasive.
The audit reveals that, as of April 5, 2017, the Defensoría did not have a risk analysis report of the computerized information systems. This situation prevents taking security measures and implementing cost-effective controls that respond to possible threats.
In addition, the Defensoría had not updated its Contingency Plan for Emergency Situations since 2005. For example, this Plan mentions restoration processes on earlier operating systems such as Windows 2000, includes contact information of employees who do not work at the entity, or continues to refer to the agency by its old name of Office of the Ombudsman for Persons with Disabilities.
The five-finding audit notes deficiencies such as the creation of access accounts through telephone calls or emails, bypassing the required Form. Our auditors also identified active accounts in the Case System assigned to a former consultant who had not provided services since 2016.
The examination of the Case System revealed that the employees of a regional office did not use the System to record the information of persons with disabilities, nor the services provided. This caused information from the physical files to be lost as a result of the damage from Hurricane María in September 2017. The Defensoría has, in addition to the Central Office in San Juan, four regional offices in Arecibo, Humacao, Mayagüez, and Ponce. A similar situation had already been commented on in the Audit Report TI-05-09.
The Report shows that the server backups were not adequately protected since an additional copy was not produced and kept in a secure location distant from the Central Office of the Defensoría. The Report covers the period from March 1 to December 8, 2017.
See the Audit Report TI-19-05.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
