The Comptroller of Puerto Rico issued a qualified opinion on the operations of the Office of Information Technology of the Department of Justice (Department). A qualified opinion is issued when noncompliance, individually or in the aggregate, is significant but not pervasive.
The Report reveals that the Emergency Response and Recovery Plan lacks information necessary to address emergency situations. This Plan, approved on March 20, 2019, does not include the names and telephone numbers of the primary providers, the procedure for conducting tests at the alternate site, nor information on the operating systems and critical files of the Office of Information Technology.
This situation, contrary to the Guidelines of the National Institute of Standard and Technology (FISCAM), could lead to inappropriate measures being taken without any order in cases of emergency.
The two-finding audit notes that, after up to nine years had elapsed, the Department had not deactivated 42% of the access accounts of former employees, former contractors, nor of employees who had ended their assignment. The Comptroller's auditors identified that 49% of these accounts continued to be used up to six years after the user's separation from the Department.
These situations can allow unauthorized persons to gain access to confidential information and allow the data contained in the Department's systems to be altered by error or intentionally. The Report recommends immediately deactivating said accounts and establishing a procedure that notifies the Office of Information Technology of the cessation of a user in their duties. The Report covers the period from October 10, 2019 to September 25, 2020..
See Audit Report TI-21-14.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
