The Comptroller of Puerto Rico issued a qualified opinion on the operations of the Office of Information Systems (OSI) of the Department of the Family (Department). A qualified opinion is issued when the individual or combined noncompliances are significant, but not pervasive.
The audit reveals that the inventory of servers and applications in the Risk Assessment Report was not up to date, since it did not include 123 servers and eight applications in use at the Department. This situation, contrary to the established policies, prevents the Department from estimating the impact that risk elements would have on critical equipment and systems. In addition, a similar situation had been commented on in the Audit Report TI-13-18 of 2013.
The three-finding Report notes that the Department did not have a business continuity plan with the elements required in the Operational Manual on Backup. This document did not include the responsibilities of the OSI personnel to comply with the plan in case of emergency, the procedures for the use of equipment backups, or the evacuation procedure.
In addition, the Manual lacked up-to-date information on the tool used to perform backups, the retention period of the backups, and the process for verifying the integrity of the backed-up information, among others. The Comptroller's auditors also found that, as of August 31, 2020, no backup restoration tests had been performed. These situations can lead to improvisation, and that in case of emergency, measures may be taken without any order.
Contrary to the Department's Manual of Standards, the OSI's computer equipment registry did not have complete and up-to-date information on the equipment assigned to users in the Secretariat and the administrations. In one evaluation, the director of the OSI could not identify the user or the administration to which the 240 computers connected to the network belonged.
The Department of the Family is composed of a Secretariat and four programmatic and operational components, which are: the Administration of Socioeconomic Development of the Family (ADSEF), the Administration of Families and Children (ADFAN), the Administration for Child Support (ASUME), and the Administration for the Comprehensive Care and Development of Childhood (ACUDEN). The Report covers the period from October 30, 2019 to September 25, 2020.
See the Audit Report TI-21-13.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
