You are Mariela Cárcamo, director of internal audit at Seguros del Caribe, a listed insurer headquartered in San Salvador. Your team has just found seven administrator accounts that nobody authorised in the core policy system. On Friday you must tell the board's audit committee which area of IT controls you will examine first.
The situation
It is Monday 8 June 2026, 7:40 in the morning. Seguros del Caribe sells property, liability and life cover in El Salvador, Honduras, Guatemala and Costa Rica. Its policy system holds about 450,000 policies, US$850 million of premium in force and roughly US$12 billion of claims exposure. The actuaries used the same data to set the loss reserves at the close of 2025: US$450 million, already published in March's financial statements.
The seven accounts, with names such as "admin2" or "admin5", can view and change policies, premiums, client data and claims, and nothing they do reaches the audit trail. At least one has existed for over a year. May's review found weaknesses in all four areas of IT general controls: access control, system administration, the audit trail, and backups, which run daily but have never been tested.
The committee has approved an envelope of US$500,000 for the whole process: audit hours at about US$500 each, the investigation of the data and the remediation. The chief technology officer, Óscar Lemus, has priced a six-month plan at almost exactly that figure and wants to start now. The chief financial officer, Rodrigo Menjívar, signed the 2025 statements and will not restate anything "on a suspicion". The committee chair, Ernesto Valle, thinks the regulator will find out either way. Your team is nine people, two of them systems specialists, and you report to the committee, not to management.