The Office of the Comptroller of Puerto Rico issued a qualified opinion on the operations of the Office of Information Systems of the Department of Economic Development and Commerce (DDEC). A qualified opinion is issued when noncompliance, individually or in the aggregate, is significant but not pervasive.
The Report reveals the absence of a risk analysis report on the computerized information systems. This situation makes it impossible to estimate the impact of the risk elements on the main information systems. On the other hand, the lack of a procedure for handling security incidents can cause duplication of effort and time in the face of unexpected situations.
The three-finding audit also notes the lack of a business continuity plan at the DDEC. This situation can lead to improvisation and to inappropriate measures being taken in emergencies. The Report recommends that the Secretary of the Department of Economic Development and Commerce prepare a business continuity plan that complies with the regulations in force.
The Comptroller's auditors identified that 50% of the active access accounts assigned to the personnel examined did not have the documentation of the access requests. This deficiency can lead to unauthorized persons having access to confidential information, or to altering its content by mistake or deliberately.
The Report covers the period from January 22 to October 15, 2018 .
See Audit Report TI-20-03.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
