AUDITOR General Pamela Monroe Ellis has given the eGov Jamaica Limited (eGovJa) portal “thumbs up” for the security controls being used for the transfer of money under the COVID-19 Allocation of Resources for Employees (CARE) programme.
“I am satisfied that the physical and environmental security controls implemented by eGovJa were adequate to prevent and detect unauthorised access and environmental hazards to the CARE system servers,” the auditor general said in the report tabled in the House Tuesday on her audit review of the information system infrastructure governing the CARE programme.
According to the auditor general, eGovJa has formal policies and procedures which were observed to be effective and consistent with international best practices and access to sensitive facilities were appropriately restricted and only accessible to authorised personnel.
The CARE programme was announced by the Government immediately after it became clear that the COVID-19 pandemic was a threat to the Jamaican economy.
Monroe Ellis, while giving a passing grade to the security systems in place, said in her review of the applications. She said 394 applicants were flagged as eligible despite not meeting the established criteria, and applications for 3,343 persons were submitted after the cut-off date, while five applicants had submissions accepted by the system for grants in two separate categories when only one is allowed.
However, the auditor general noted that this was out of a database of 402,393 applicants for the two aspects of the CARE programme on which the audit focused, which was more than 80 per cent of the total applications for benefits under the programme.
She said that the audit was, however, unable to complete verification to determine whether the system actually restricted applicants to Jamaican-based Internet Protocol (IP) addresses.
She said that the anomalies which were detected were brought immediately to the attention of eGovJa and are to be investigated before payments are made to the individuals. She added that eGov subsequently confirmed the findings and indicated that additional control measures had been or will be implemented to prevent further recurrence.
“The input controls were sufficient to appropriately identify a user validating the name, Tax Registration Number (TRN) and the birth date of each applicant against the RAis system maintained by Tax Administration Jamaica (TAJ),” Monroe Ellis reported.
“Further, the CARE portal system does not permit an application to be submitted by a minor, as a table look-up is used to restrict birth dates to on or before 2002,” she said.
However, she admitted that a risk has to be dealt with in terms of the TRN of deceased persons being submitted with applications, and an inherent risk of compassionate grant applicants benefiting where an employer fails to submit monthly and annual returns within stipulated periods.
The audit was commissioned by the Minister of Finance and the Public Service Dr Nigel Clarke, who made a specific request for a concurrent audit review of the CARE programme.
Now you can read the Jamaica Observer ePaper anytime, anywhere. The Jamaica Observer ePaper is available to you at home or at work, and is the same edition as the printed copy available at http://bit.ly/epaperlive