The Passport, Immigration and Citizenship Agency (PICA) is responsible for accepting and processing passport applications, managing the island’s immigration process and handling matters in relation to application for and renunciation of Jamaican citizenship. In fulfilling its mandate, the agency has adopted the use of Information Technology (IT) throughout its operations thereby creating risks that must be appropriately managed to ensure the continued availability of its services. Further, based on the nature of its operations, the agency handles personal information of its clients and national security data that should be safeguarded from inappropriate access and disclosure.

The Auditor General commissioned an IT audit to determine whether PICA’s information security controls were effective and will prevent or reduce the likelihood and impact of IT security risks on the organization. The audit revealed that though PICA had implemented good controls, there was room for improvement in the assessment of IT risks and access management. Additionally, PICA did not have an effective system in place for the oversight of the IT function to ensure the proper alignment of IT and corporate strategies and prioritization of its ICT projects.