The Office of the Comptroller of Puerto Rico issued a qualified opinion on the operations of the Computerized Information Systems of the Corporation of the Musical Arts. A qualified opinion is issued when noncompliances, individually or in the aggregate, are significant but not pervasive.
The audit revealed that, as of July 13, 2017, the Corporation had not prepared a risk analysis report of the information systems. This situation prevents estimating the impact of the risks on the areas and establishing the control measures that minimize the risks.
As of that date, the Corporation also did not have a procedure or plan for handling security incidents, nor an inventory of the programs acquired and installed on its servers and computers.
The four-finding Report notes the lack of a business continuity plan that would allow restoring the Corporation's operations in the event of natural disasters, computer viruses, or cyberattacks. In addition, the Corporation did not have an alternate site for the recovery of computerized operations in case of emergency.
Contrary to what is established by the Federal Information System Controls Audit Manual, the Corporation did not maintain an additional copy of the backups in a secure and remote location. In addition, it did not conduct tests to ensure the successful recovery of the information.
Our auditors identified that user requests to access accounts were made verbally and not through a form. In addition, they detected that the Corporation did not have available the tool that allows generating reports of the firewall service that controls inbound and outbound Internet traffic. The Report covers the period from May 1, 2017 to January 26, 2018 .
See the Audit Report TI-19-06.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
