The Office of the Comptroller of Puerto Rico issued a qualified opinion on the operations of the Computerized Information Systems of the Agricultural Extension Service of the Mayagüez Campus of the University of Puerto Rico. A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.
The Report reveals that the Agricultural Extension Service (SEA) did not have a risk-analysis report of the computerized information systems. This situation prevents estimating the impact of the risk elements on the critical systems.
In addition, the SEA's Technology Center did not have a contingency plan nor a security incident management procedure or plan. This deficiency fosters improvisation and could affect the prompt restoration of the systems in emergency situations.
The five-finding audit notes that although the SEA's Planning Office had a Contingency Plan, it was not approved by the assistant director of planning, did not include an inventory of the critical equipment used, and for its operation depended on its integration with the contingency plan of the Technology Center, which did not exist.
The Comptroller's auditors found that the schematic diagram –Network Topology Diagram– to identify the devices, telecommunication channels, and users, did not include details of the connections between the five regions, the 44 local offices, and one of the buildings of the Agricultural Extension Service. This situation makes it difficult to address connection problems and to effectively plan network improvements.
The audit evidences the lack of an inventory of the programs installed on each SEA computer and, contrary to what is established in the regulations on protection of private data and computer resources, the SEA had stopped performing backups of the ticketing system and of the voice over internet protocol (VoIP) telephone service server.
The report covers the period from September 17, 2018 to January 25, 2019.
See Audit Report TI-21-01.
To view other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
