The Office of the Comptroller of Puerto Rico issued a qualified opinion of the operations of the Office of Technology and Informatics of the Department of Correction and Rehabilitation (OTI). A qualified opinion is issued when the noncompliance, individually or as a whole, is significant but not pervasive.
The Report reveals that, for more than 10 years, the Department has not had a computerized system that updates, in an integrated and organized manner, the records of inmates, as well as the calculations of their sentences. In 2009 the contract with the external company that developed the Population Control System was canceled, and in 2012, due to programming problems, the System became inoperative and obsolete.
The seven-finding audit notes that 38 computer units of the 400 acquired in 2020 and 2021 were not located, equivalent to $48,714. In addition, the Department did not provide for examination 133 receipts for the property in use. This situation of delivering equipment without the signature of the property custodian, among others, increases the risk of loss and improper use of the property.
The auditors identified that two laptops with their bags, and 51 desktops with their monitors, had not been distributed, despite up to 22 months having elapsed since their receipt. The executive officer indicated that he does not have sufficient personnel to prepare and configure the computer equipment.
Contrary to current regulation, the Risk Assessment of the computerized information systems did not include the inventory of the system's assets and was not updated. In this way, the impact that the risk elements would have on the Department's main areas and systems cannot be estimated. In addition, the OTI did not have a plan for incident management. This deficiency may cause the duplication of efforts and time in the face of unexpected situations.
The examination of the Contingency and Disaster Recovery Plan of the Office of Technology and Informatics of 2019 revealed that it was not approved by the secretary of Correction and Rehabilitation, that it did not include requirements necessary to address emergencies, and that it was not updated. In addition, the finding of active access accounts of 125 former employees who had ceased duties since 2018 may cause unauthorized personnel to gain access to confidential information.
The Report indicates that the copies of the backups were not stored in a safe place distant from the facilities, so that, in case of emergency or disaster, the greatest amount of information can be recovered. In addition, the Department also did not have an alternate center to restore the critical computerized operations in case of emergency.
As of April 27, 2022, the Department of Correction did not have a written agreement with the Department of Education formalizing the sharing of the computing center. The agreement by contract had expired in 2010, and Correction still maintained its critical equipment and used Education's electrical panel. This report covers the period from June 29, 2020, to September 16, 2022.
See Audit Report TI-23-08.
To see other published reports, visit our Audit Reports section.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
