REPORT DIGEST ILLINOIS DEPARTMENT OF CORRECTIONS FINANCIAL AUDIT For the Year Ended: June 30, 2012, and COMPLIANCE EXAMINATION For the Two Years Ended: June 30, 2012 Release Date: August 6, 2013 Summary of Findings: Total this audit: 39 Total last audit: 34 Repeated from last audit: 25 State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • Weaknesses were noted in the preparation of generally accepted accounting principle (GAAP) reporting forms submitted to the Illinois Office of the Comptroller and preparation of year-end Department financial statements. • The Department did not maintain accurate and adequate property/fixed asset records and did not accurately record all capital asset information in its financial records. • The Department failed to maintain adequate controls over its inventory. Numerous exceptions were noted regarding the inventories at the Correctional Centers. • The Department’s Correctional Centers inadequately administered locally held funds (bank accounts) during the engagement period. Internal control weaknesses were noted at multiple Correctional Centers. • The Department’s Correctional Industries did not maintain adequate internal controls over its accounts receivable. • The Department had not implemented or documented the controls over its computing environment to ensure the controls provide sufficient protection. • The Department is not complying with the requirements of the Illinois Procurement Code with regard to purchases of items for resale in the Department’s commissaries at Correctional Centers. • The Department did not properly maintain records at the Adult Transition Centers. • The Department is not fully utilizing the meals purchased under a food services contract. • The Department failed to ensure proper controls were established in the administration of its contracts and grants during the audit period. • The Department was not able to locate 156 computers. INTRODUCTION This report presents our Department-wide financial statement audit for the year ended June 30, 2012 and compliance attestation examination of the Department for the two years ended June 30, 2012. The scope of the compliance examination excludes the Department’s Correctional Industries function which had a separate compliance examination for the two years ending June 30, 2012. At June 30, 2012 the Department operated 27 correctional centers, 7 adult transition centers and Correctional Industries. Subsequent to June 30, 2012 the Department closed the Tamms and Dwight Correctional Centers and the Decatur, Southern Illinois and Westside Adult Transition Centers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS WEAKNESSES IN PREPARATION OF GAAP REPORTING FORMS AND FINANCIAL STATEMENTS The Department’s year-end financial reporting in accordance with generally accepted accounting principles (GAAP) to the Illinois Office of the Comptroller contained inaccuracies. These problems, if not detected and corrected, could materially misstate the Department’s financial statements and negatively impact the financial statements prepared by the Illinois Office of the Comptroller. During the audit of the Department’s June 30, 2012 financial statements, the auditors noted errors in the GAAP reporting forms and financial statements. Some of the conditions noted follow: • The Department filed a Quit Claim Deed with the Carroll County, Illinois Clerk and Recorder to transfer the Thomson Correctional Center to the Department of Central Management Services (DCMS) effective August 1, 2010. As of the date of the transfer the Department should have stopped depreciating the building and improvements and all related equipment and not reported it in subsequent financial statements. However, the Department included the Thomson Correctional Center in the initial drafts of the June 30, 2012 financial statements provided to the auditors. After being brought to the Department’s and DCMS attention by the auditors, the Department removed the activity of the Thomson Correctional Center from its financial statements for the year ended June 30, 2012. The revisions to the financial statements and related GAAP reporting forms totaled a decrease in $120,313,000 to capital assets, and $24,209,000 of accumulated depreciation. Depreciation expense decreased $2,243,000. • The Department understated the cash and liability balances by $603,000 in the GAAP reporting packages submitted for the DOC Resident’s Trust Fund because it omitted the activity of the contractually administered Adult Transitional Centers (ATCs). The Department attempted to revise the GAAP reporting packages for this fund, but management stated it was instructed not to do so by the Illinois Office of the Comptroller due to the materiality of the adjustment on a statewide basis. The Department included the $603,000 cash and liability balances of these ATCs in its financial statements. • Auditors of the Department’s Correctional Industries noted the Department did not maintain adequate and accurate records related to the customer accounts receivable of the Working Capital Revolving Fund. The Department’s Correctional Industries reported $10,043,000 in customer accounts receivable for the Working Capital Revolving Fund at June 30, 2012. It was determined the Working Capital Revolving Fund customer accounts receivable system contained payment posting errors. According to the Department’s Correctional Industries’ management, between 2006 and 2012, payments had been posted at the customer level rather than the invoice level, resulting in open invoices. In addition, management indicated there were payments which had been posted twice. Management also stated they did not have all of the supporting detail to ensure the posting of payments to the proper invoice. Because of the significance of the exceptions noted, auditors considered this to be a material weakness in the Department’s internal control over financial and fiscal operations. Due to the noted differences in the Working Capital Revolving Fund customer account balances and the payment posting errors within the accounts receivable system, the information related to the accounts receivable and revenues for this fund included in the financial statements could not be verified. Auditors of the Department’s Correctional Industries issued a qualified opinion on those financial statements, which led to a qualification in the opinions on the Department’s financial statements. (Finding 1, pages 17-20) This finding was first reported in 2008. We recommended the Department outline and implement procedures to ensure GAAP reporting packages and financial statements are prepared in an accurate manner. Concerning the inaccurate records related to customer accounts receivable, we recommended the Department’s Correctional Industries work with its customers to determine the accurate receivable balance. Department officials accepted the recommendation and noted they will continue devoting the resources necessary to complete the GAAP reporting as required by implementing procedures and take all possible steps to ensure the GAAP reporting packages and financial statements are prepared in an accurate manner. Adequate resources have been added which may enhance making improvements to ensure the GAAP reporting packages and financial statements are accurately prepared. (For the previous Department response, see Digest Footnote #1.) NEED TO IMPROVE FINANCIAL ACCOUNTING AND RECORDKEEPING The Department did not maintain accurate and adequate property/fixed asset records and did not accurately record all capital asset information in its financial records. The auditors identified a number of inadequacies in the Department’s property / fixed asset recordkeeping process. Some of the inadequacies identified follow: • The Department’s Automated Property Control System (APCS) does not provide information for the auditors to test depreciation by asset. APCS reports provide a total cost of all buildings combined, along with total depreciation combined at the end of the quarter. A report by asset cannot be generated. As a result of this inherent limitation of APCS the auditors were unable to perform detailed testing by asset of the additions to accumulated depreciation and associated depreciation expense. • During testing at the Department’s General Office of equipment additions, deletions, transfers, location testing and voucher testing auditors noted a number of exceptions including purchases without supporting documentation and purchases not recorded in the APCS. • Auditors tested a sample of equipment items from all 7 Adult Transition Centers and 10 Correctional Centers for fiscal years 2011 and 2012. As a result of the testing, numerous exceptions were noted, some of the exceptions included: 1) Items which could not be located at the listed location or at all; 2) Employees separated from the Department which still had access to APCS, and; 3) Computer items identified as obsolete in 2008 were still being stored at a Correctional Center. Because of the significance of the exceptions noted, auditors considered this to be a material weakness in the Department’s internal control over financial and fiscal operations. Failure to maintain adequate fixed asset records is noncompliance with the State Property Control Act, and increases the risk of equipment theft or loss occurring without detection, and has resulted in inaccurate property / fixed asset reporting. (Finding 2, pages 21-25) This finding was first reported in 2008. We made a number of specific recommendations to the Department to strengthen its procedures over property and equipment to ensure accurate recordkeeping and accountability for all State assets. The Department officials accepted the recommendation and stated it will continue devoting the resources necessary, within the limitations of the current technology and budget constraints of the existing Automated Property Control System, to ensure that capital asset information is properly recorded and maintained. (For the previous Department response, see Digest Footnote #2.) INADEQUATE CONTROLS OVER INVENTORY Auditors identified numerous exceptions and weaknesses related to the controls over commodity and commissary inventory operations. Some of the exceptions noted follow: • Auditors noted the inventory counts completed by Correctional Center personnel did not agree to accounting records in The Inventory Management System (TIMS) or the Fund Accounting and Commissary Trading System (FACTS) at 5 Correctional Centers. • Auditors noted one Correctional Center understated its end of year commissary inventory balances to the General Office by $70,942. The Center did not record invoices in FACTS for inmate commissary goods totaling $70,942 until fiscal year 2013, although the items were received prior to June 30, 2012. • Auditors noted stockpiling of inventory totaling $120,650 at one Correctional Center. Stockpiling is defined as maintaining a supply greater than the level needed for a twelve month period. Failure to implement strong controls over inventory can lead to theft and loss of assets and noncompliance with Department and statutory guidelines as well as not accurately reporting the fiscal year-end inventory balances which would, in turn, reduce the reliability of Statewide financial reporting. (Finding 3, pages 26-28) This finding was first reported in 2008. We recommended the Department improve its centralized oversight function related to inventory to allow for improved controls. Department officials accepted the recommendation and noted they have made some revisions in maintaining and accounting for inventory with the implementation of TIMS and FACTS. In addition, the Department indicated adequate resources have been added, striving to continue making improvements in the Department’s centralized oversight function and to the inventory accounting and maintenance within the facilities. (For the previous Department response, see Digest Footnote #3.) INADEQUATE ADMINISTRATION OF LOCALLY HELD FUNDS AT THE CORRECTIONAL CENTERS During testing of the Department’s locally held funds auditors noted numerous exceptions. Some of the exceptions noted follow: • Seven Correctional Centers did not exercise adequate controls over the Resident Benefit Fund or the Employee Benefit Fund. • Four Correctional Centers did not properly report accounts payable at June 30, 2011 and 2012. Auditors noted the Correctional Centers were unable to provide supporting documentation to determine whether or not the Correctional Center properly excluded the item or included the item in its accounts payable listing at June 30 of each respective fiscal year. • Five Correctional Centers did not deposit locally held fund receipts timely. • Three Correctional Centers did not maintain adequate segregation of duties over functions within their locally held funds. It is important to properly administer locally held funds as they are not subject to appropriation and are held outside the State Treasury. In addition, failure to adequately administer locally held funds could lead to fraud, theft, or the use of unavailable monies in the funds causing overdraft charges. Inadequate administration also represents noncompliance with statute. (Finding 4, pages 29-32) This finding was first reported in 2008. We recommended the Department remind Correctional Center staff of the requirements set forth within the Administrative Directives and statutes related to the operation and maintenance of the locally held funds. In addition, we recommended the Department’s Internal Audit Division implement a plan to periodically perform internal audits of the locally held funds at the Correctional Centers. Department officials accepted the recommendation and noted they will remind facility staff of the requirements related to the operation and maintenance of locally held funds. The Assistant Deputy Director position responsible for Fiscal Accounting Compliance was filled effective February 1, 2012. Adequate resources have been added, striving to continue making improvements in the Department’s centralized oversight function and by the training of facility staff. (For the previous Department response, see Digest Footnote #4.) NEED TO ENHANCE CONTROLS OVER ACCOUNTS RECEIVABLE The Department’s Correctional Industries did not maintain adequate internal controls over its accounts receivable. Some of the exceptions noted by the auditors during testing of accounts receivable follow: • The Department’s Correctional Industries did not send out monthly statements to its customers. • The Department’s Correctional Industries did not take actions to bill and collect receivables within the fiscal year in which the debt was incurred. According to the records of the Department’s Correctional Industries, accounts receivable due over one year totaled $1,135,000 at June 30, 2012. • The Department did not issue catch up billings in the subsequent fiscal year for accounts with balances from the prior fiscal year. Because of the significance of the exceptions noted, this was considered a material weakness in the Department’s internal control over financial and fiscal operations. Failure to have adequate documentation for accounts receivable increases the chances of errors occurring in reporting the accounts receivable and the likelihood of accounts receivable not being accurately tracked for collection. (Finding 6, pages 36-37) We made a number of specific recommendations to the Department’s Correctional Industries to maintain adequate controls over accounts receivable. Department officials accepted the recommendations and indicated they will ensure that the Illinois Correctional Industries fiscal staff takes all possible steps to: 1) Work towards accurate and timely reconciliations; 2) Record all customers accounts receivable at the invoice level. In addition, the Department of Corrections will ensure the Illinois Correctional Industries fiscal staff sends out customer statements. LACK OF CONTROL OVER COMPUTER SYSTEMS The Department utilizes a myriad of computer systems to track offender’s location, information, and maintain accounting of offender’s finances. As part of the auditors standard audit procedures: 1) policies, 2) procedures, 3) recovery plans, and 4) various logs are requested from the Department in order to determine the controls over the computing environment. However, the Department was either unable to provide or did not maintain such information. In addition, as the auditors performed other testing procedures it was noted Department employees and former employees had inappropriate access to the various systems. The Department’s inability to provide detailed information prevented the auditors from performing required tests to determine the adequacy of the control environment. Without adequate controls over the computing environment, there is a great risk of unauthorized access, unauthorized or improper changes and the inability to recovery in the event of a disaster. The lack of control increases the risk that the confidentiality, integrity and availability of systems and data will be compromised. (Finding 8, pages 40-41) We recommended the Department implement and document the controls over its computing environment and ensure the controls provide sufficient protection. Department officials accepted the recommendation and noted they will ensure that IT internal controls are implemented and documented over its computing environment to provide for sufficient protection. NONCOMPLIANCE WITH THE ILLINOIS PROCUREMENT CODE The Department maintains numerous commissary operations at Correctional Centers for inmates and employees. Purchases are made from vendors for commodities to be resold in the commissaries. Total purchases made from vendors for resale in the commissaries were approximately $39 million in fiscal year 2011 and $41 million in fiscal year 2012. The commissaries commodity purchases are made through non-appropriated locally held funds. As a result of testing performed the auditors noted: • Purchases were not made by competitive sealed bidding or competitive sealed proposals as required by the Illinois Procurement Code (Code). The Correctional Centers use catalogs from various vendors or contact multiple vendors via telephone to request bids to select products for resale in the commissaries. • Terms and conditions for the purchases of goods from vendors for the commissaries were not documented in the form of a contract as required by the Code. Upon selection of a vendor an Order For Delivery (OFD) is prepared to document the purchase. • None of the required procurement notices were published in the Illinois Procurement Bulletin as required by the Code. • The Department’s Administrative Directive which provides guidance to employees on commissary purchase does not include all the requirements as set forth in the Code. By not following the requirements of the Code, the Department has limited the pool of available vendors to only a few selected vendors. In addition, the Department may be paying more for commodities at their commissaries than they should. (Finding 13, pages 53-54) This finding was first reported in 2004. We recommended the Department continue its efforts to work with the Department of Central Management Services for direction on the commissary purchasing to ensure it complies with the requirements of the Illinois Procurement Code. Department officials accepted the recommendation and noted they are working with the Department of Central Management Services to comply with the requirements of the Illinois Procurement Code in making commissary purchases. (For the previous Department response, see Digest Footnote #5.) ADULT TRANSITION CENTER RECORDS NOT PROPERLY MAINTAINED Testing at the 7 Adult Transition Centers (ATC) for the two years ended June 30, 2012, produced numerous exceptions where records were not properly maintained. Some of the exceptions noted were in the following areas: • Cash balances were misstated at 2 of the 7 ATC’s. • Auditors noted deficiencies at 3 ATCs related to disbursements from the Employee Benefit Fund portion of the DOC Resident’s and Employee’s Benefit Fund. • Deficiencies related to disbursements from the Inmate Benefit Fund portion of the DOC Resident’s and Employee’s Benefit Fund were noted at 4 of the ATC’s. • Deficiencies were noted in testing the personal property listings at 3 of the ATCs. Similar weaknesses were noted at the ATCs in the previous ten audits. Department management indicated on-going issues are the result of human errors, lack of resources, inadequate communication and central level oversight within the Department. (Finding 14, pages 55-57) This finding was first reported in 1994. We made a number of specific recommendations to the Department to improve accounting procedures and controls at the ATCs. Department officials accepted the recommendation and noted they will continue to make every effort to improve accounting procedures and controls to ensure accurate and appropriate records are maintained at the remaining ATCs. (For the previous Department response, see Digest Footnote #6.) WEAKNESSES IN ADULT TRANSITION CENTER FOOD SERVICES CONTRACT During testing auditors noted the food service contract at 5 of the ATCs allowed the vendor to bill the Department for 3 meals per day, per resident head count for the day, regardless of how many meals are actually prepared and served. This resulted in the ATCs being billed for 531,579 more meals than were actually prepared and served at a cost of $854,905. Good fiscal internal controls dictate the ATCs establish a system to determine in advance how many residents will be present for a meal and work with the vendor to ensure there is sufficient, but not excessive food. In addition, the Department should establish controls to ensure the State only pays for the meals consumed. Paying for meals that are never utilized is a poor use of State resources. (Finding 15, pages 58-59) We recommended the Department perform an analysis of its food service at all ATCs. Department officials accepted the recommendation and indicated they will make every effort to perform an analysis of the food service contract at the remaining Adult Transition Centers. WEAKNESSES IN CONTRACT, LEASE AND GRANT ADMINISTRATION During testing of contractual agreements, grants and emergency purchases auditors noted numerous weaknesses in their administration. Some of the weaknesses noted follow: • The Department could not demonstrate adequate contract monitoring for 8 contracts tested, totaling $1,697,359. Specifically, the auditors noted the Department failed to sufficiently explain what type of monitoring occurred for 7 contracts and insufficiently monitored another contract. • Twelve emergency purchase affidavits totaling $3,113,910 were not published at all in the Illinois Procurement Bulletin as required by the Illinois Procurement Code. In addition, 3 other emergency purchase affidavits totaling $148,255 were published 1 to 219 days late in the Illinois Procurement Bulletin. • During testing of 2 grants totaling $7,172,018, both grants to the same grantee, auditors identified the grantee did not return the unexpended funds to the Department at the end of the grant terms. The grantee owed the Department $159,454 of unexpended funds at the end of the fiscal year 2011 grant and $371,885 of unexpended funds at the conclusion of the fiscal year 2012 grant. Auditors noted the Department had not taken action to collect the $531,339 of unexpended funds as of the completion of their testing. Failure to properly administer contractual, lease, and grant agreements to ensure compliance with all applicable statutes and procedures could potentially compromise public accountability and oversight and results in noncompliance with statutes and Department administrative directives. (Finding 16, pages 60-63) This finding was first reported in 2006. We recommended the Department implement the necessary controls to adequately administer its contractual, lease, and grant agreements and ensure compliance with applicable statutes and Department Administrative Directives. In addition, we recommended the Department seek reimbursement for the unexpended grant funds not yet returned to the Department. Department officials accepted the recommendation and noted they will implement the necessary controls to ensure contracts, leases, and grant administration is properly administered and in compliance with applicable laws and regulations. The Department has initiated the process to recover unexpended grant funds. (For the previous Department response, see Digest Footnote #7.) INADEQUATE CONTROLS OVER COMPUTER INVENTORY The Department conducts an annual physical inventory of all equipment with an acquisition cost of $500 or more and annually reports its results to the Department of Central Management Services (DCMS). In its fiscal year 2011 Physical Inventory Report submitted to DCMS, the Department reported it was unable to locate $37,785 of computer inventory. In its fiscal year 2012 Physical Inventory Report, the Department reported $150,127 of missing computer inventory. Upon further inquiry with Department personnel auditors noted the missing computer equipment consisted of 51 desktop computers and 105 laptop computers. The Department considers these computers to be lost. Department personnel were not able to provide property transfer forms or any other documentation showing what happened to the computers and had not performed an assessment, and was unsure how much, if any, confidential information was on the missing computers. Failure to follow up on missing computer equipment resulted in a lack of control over State property and the risks associated with the potential exposure of confidential information. (Finding 25, pages 77-78) We made a number of specific recommendations to the Department to improve controls over computer inventory. In addition, recommendations were also made related to following up on the missing computer inventory and determining if the missing computers contained confidential information. Department officials accepted the recommendation and indicated they will work with Department of Central Management Services in an effort to reconcile any missing items and make an assessment of those reconciled to determine if computers contained confidential information. OTHER FINDINGS The remaining findings are reportedly being given attention by the Department. Auditors will review the Department’s progress towards the implementation of the recommendations in the next engagement. AUDITORS’ OPINION The auditors expressed a qualified opinion on the Department’s financial statements as of June 30, 2012 and for the year then ended. The qualified opinion was based on the auditors’ report on the financial statements of the Working Capital Revolving Fund (Correctional Industries). The Correctional Industries’ auditors qualified the opinion on the Working Capital Revolving Fund because they were unable to obtain sufficient appropriate audit evidence supporting the accounts receivable at June 30, 2012. In addition, the Correctional Industries’ auditors were unable to obtain sufficient appropriate audit evidence associated with revenues from the accounts receivable. A compliance examination of the Department was also conducted for the two years ended June 30, 2012 as required by the Illinois State Auditing Act. The Independent Accountants’ Report on State Compliance and on Internal Control Over Compliance was qualified for findings 1, 2, 6 and 7. Except for the noncompliance described in these findings, the auditors stated the Department complied, in all material respects, with the requirements described in the report. WILLIAM G. HOLLAND Auditor General WGH:RPU:rt SPECIAL ASSISTANT AUDITORS Sikich LLP were our Special Assistant Auditors for this engagement. DIGEST FOOTNOTES #1 WEAKNESSES IN PREPARATION OF GAAP REPORTING FORMS AND FINANCIAL STATEMENTS – Previous Department Response 2010: Recommendation accepted: IL Department of Corrections (IDOC) will continue devoting the resources necessary within the limitations of the current technology and budget constraints to complete the GAAP reporting as required. In addition, IDOC has established a follow-up control mechanism to ensure adequate and appropriate implementation occurs. #2 NEED TO IMPROVE FINANCIAL ACCOUNTING AND RECORDKEEPING– Previous Department Response 2010: Recommendation accepted: IL Department of Corrections (IDOC) will continue devoting resources necessary within the limitations of the existing Automated Property Control System (APCS) to ensure that property and equipment information is properly recorded and maintained. IDOC will also re-evaluate the capabilities of the existing APCS to determine whether it can produce the type of data necessary for IDOC to ensure accurate recordkeeping and accountability for all State assets. If necessary, IDOC will then research other property control systems and their availability. In addition, IDOC has established a follow-up control mechanism to ensure adequate and appropriate implantation occurs. #3 INADEQUATE CONTROLS OVER INVENTORY– Previous Department Response 2010: Recommendation accepted: IL Department of Corrections (IDOC) has made some revisions in maintaining and accounting for inventory with the implementation of The Inventory Management System (TIMS) and will strive to continue making improvements in the Department’s centralized oversight function and the inventory accounting and maintenance within the facilities. In addition, IDOC has established a follow-up control mechanism to ensure adequate and appropriate implementation occurs. #4 INADEQUATE ADMINISTRATION OF LOCALLY HELD FUNDS AT THE CORRECTIONAL CENTERS – Previous Department Response 2010: Recommendation accepted: IL Department of Corrections (IDOC) will remind facility staff of the requirements related to the operation and maintenance of locally held funds. In addition, the Department’s office of Internal Audit is mandated by the Fiscal Control and Internal Auditing Act to include an audit of the obligation, expenditure, receipt, and use of public funds of the State and of the funds held in trust to determine whether those activities are in accordance with applicable laws and regulations at least once every two years. #5 NONCOMPLIANCE WITH THE ILLINOIS PROCUREMENT CODE – Previous Department Response 2010: Recommendation accepted: IL Department of Corrections (IDOC) will, in cooperation with the Department of Central Management Services’ guidance and direction, comply with these requirements of the Illinois Procurement Code in making commissary purchases. #6 ADULT TRANSITION CENTERS RECORDS NOT PROPERLY MAINTAINED - Previous Department Response 2010: Recommendation accepted: IL Department of Corrections (IDOC) will continue to make every effort to improve accounting procedures and controls to ensure accurate and appropriate records are maintained at the Adult Transition Centers. #7 – WEAKNESSES IN CONTRACT, LEASE AND GRANT ADMINISTRATION - Previous Department Response 2010: Recommendation accepted: IL Department of Corrections (IDOC) will implement the necessary controls to ensure contracts are properly administered and in compliance with applicable laws and regulations.