The Office of the Comptroller of Puerto Rico issued a qualified opinion on the operations of the Office of Information Systems of the Teachers' Retirement System. A qualified opinion is issued when the noncompliances, individually or together, are significant but not pervasive.
The Report reveals that the current Risk Estimation and Analysis document, prepared in 2009, lacks an inventory of the information systems assets and is missing details of the equipment, programs, and data of the Retirement System. In addition, the risk analysis does not identify the possible threats against the information systems. This situation prevents estimating the impact that the risk elements would have on the main areas and systems.
The five-finding audit notes that the Technology Strategy document needs to be updated. As of November 9, 2021, this document did not include the applications implemented after 2009, mentions names of personnel who no longer work at the System, and defines an alternate center that no longer exists. This situation may foster improvisation and a high risk of incurring excessive and unnecessary expenses.
The Teachers' Retirement System does not keep copies of the backups of the employees' documents or of the applications developed internally in a secure place off the premises. As of May 11, 2021, the System also did not have an alternate center to restore its critical computerized operations in case of emergency.
The auditors found multiple deficiencies with the People Soft Finance application, and with the administration and documentation of active access accounts in the Integrated Contributions and Benefits System (SABI).
Some situations of lack of control examined by the auditors are: the lack of documentary evidence and information in the authorizations necessary for the creation of accounts and in the granting of privileges to the access accounts. In addition, permissions were found that did not correspond to the functions of their positions and active accounts that were not deactivated of a former employee and a former volunteer with more than a year out of service.
Contrary to the guidelines established by the Federal Information System Controls Audit Manual (FISCAM) issued by the General Accountant Office (GAO), the operating systems of the SABI and People Soft servers, and their database, had the Window Server 2008 and Window Server 2003 operating systems that do not have technical support from the provider. This fact increases the risks of malicious attacks on a vulnerable system.
This report covers the period from February 26 to November 30, 2021.
See Audit Report TI-22-12.
To see other published reports, visit our section of Audit Reports.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
