The Office of the Comptroller of Puerto Rico issued a qualified opinion on the operations of the Office of Technology and Information Technology (OTI) of the House of Representatives of the Legislative Assembly of Puerto Rico. A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.
The Report reveals that the network administrator did not periodically review the security records (security event log) that the operating system of the main server provides. This review is necessary to detect possible security violations and so that the necessary preventive and corrective measures are taken.
For example, the Comptroller's auditors detected that the access account of a former employee was used 23 days after her separation date. However, the transaction of this account could not be examined since OTI could not provide the security event log.
The two-finding audit points out that former consultants and former employees of the House had their access accounts active despite up to two years and five months having elapsed since their contracts ended and their functions ceased. In addition, the Human Capital office took up to two years and seven months to notify OTI of the separation of the employees.
These situations, contrary to the regulations in effect, prevent maintaining control of the users authorized to access the information systems, and make it possible for unauthorized persons to gain access to confidential information.
The report covers the period from February 28 to September 18, 2019.
See Audit Report TI-21-05.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
