The Comptroller of Puerto Rico issued a qualified opinion on the operations of the Computerized Information Systems of the Traffic Safety Commission. A qualified opinion is issued when noncompliance, individually or in the aggregate, is significant but not pervasive.
The Report reveals that, as of September 8, 2020, the Commission did not have a risk analysis of the computerized information systems, but rather some guidelines for conducting the analysis. A similar situation had been noted in Audit Report TI-12-09 of 2012.
A risk analysis is a process that identifies the assets of the information systems, their vulnerabilities and threats. In addition, it establishes the controls to protect the assets and avoid the risks.
The two-finding audit notes that the Commission does not have an alternate site, away from its location at the Minillas Government Center, to recover computerized operations in the event of a disaster. For example, during the Hurricane María emergency, the Commission continued its operations at the facilities of the Department of Transportation and Public Works, which is located in the same building and is exposed to the same risks.
The executive director told the Comptroller's auditors that they had plans to have an alternate site at the Traffic Safety Educational Park (PESET) located in Arecibo. However, as of October 19, 2020, at PESET there was a computer that was obsolete, and they did not have servers to restore the applications operated by the Commission such as the Micro Information Products Fund Accounting (MIP) that processes the payroll, nor the Kronos system for recording employee attendance and leave. The report covers the period from January 27 to September 30, 2020.
See Audit Report TI-22-01.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
