REPORT DIGEST ILLINOIS DEPARTMENT OF FINANCIAL AND PROFESSIONAL REGULATION COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2018 Release Date: June 20, 2019 FINDINGS THIS AUDIT: 14 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 5 -- 1 -- 6 Category 2: 3 -- 5 -- 8 Category 3: 0 -- 0 -- 0 TOTAL: 8 -- 6 -- 14 FINDINGS LAST AUDIT: 9 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (18-02) The Department adopted an administrative rule which conflicts with the Boxing and Full-contact Martial Arts Act (Act), did not fully enforce various provisions of the Act, and lacked adequate control over tickets at contests. • (18-08) The Department failed to prepare and maintain adequate documentation supporting its administrative and fiscal operations. • (18-14) The Department failed to adhere to provisions of the Fiscal Control and Internal Auditing Act. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS NONCOMPLIANCE WITH BOXING AND FULL-CONTACT MARTIAL ARTS ACT The Illinois Department of Financial and Professional Regulation (Department) adopted an administrative rule which conflicts with the Boxing and Full-contact Martial Arts Act (Act), did not fully enforce various provisions of the Act, and lacked adequate control over tickets at contests. • The Department has adopted a rule codified within the Illinois Administrative Code (Code) (68 Ill. Admin. Code 1370) which conflicts with the Act (225 ILCS 105). • The Department accepted incomplete applications from promoters, and subsequently issued permits to conduct, for eight (100%) contests. We noted various applications did not include name of matchmaker, lacked purse amounts to be paid to the professionals, lacked a listing of the amateurs and/or professionals competing in the event, or lacked proof of contract. • The Department did not ensure that eight (100%) licensed promotors complied with the Act regarding tickets. Specifically, we noted the required ticket format was not used, certified inventories were not submitted or were submitted after the deadline and the Department could not provide the promoters’ required written reports. • The Department did not exercise adequate controls over monitoring physicians appointed by the Department oversee the contests. We noted one (13%) contest participant did not undergo an examination before the contest and the Department could not provide documentation to support that a physician had completed the examinations of a contests’ participants. (Finding 2, pages 15-19). We recommended the Department take action to ensure: • the Department’s adopted rules comport with statute; • permits are only approved after the submission of a complete application by the promoter which discloses all of the information required by State laws, rules, and regulations; • monitoring of tickets occurs and ticket printing, sales, and final accountings are conducted in strict accordance with State laws, rules, and regulations; and • all participants undergo a documented pre- and post-bout examination by a physician; and Further, we recommended the Department ensure contemporaneous documentation is produced and retained to support its oversight and monitoring of the Act. The Department agreed with the recommendation. GENERAL FAILURE TO PREPARE AND MAINTAIN DOCUMENTATION The Department failed to prepare and maintain adequate documentation supporting its administrative and fiscal operations during the examination period. A few of the exceptions we noted follow: • When testing the Boxing and Full-contact Martial Arts Act (225 ILCS 105/12(b)), we noted in one of eight (13%) contests the Department lacked documentation to support a physician had completed examinations of the contest participants. See also Finding 2. • When testing the Medical Practice Act of 1987 (225 ILCS 60/21(B)), we noted seven of 60 (12%) licenses tested did not have supporting documentation to show the applicants’ fitness for their reinstated licenses. We also noted two of 60 (3%) instances where the Department was unable to provide documentation, other than support for the fee paid, to demonstrate that the applicant had been certified as having active practice in another jurisdiction or had completed an evaluation program satisfactory to the Department. See also Finding 4. • During our testing of the Clinical Psychologist Licensing Act (225 ILCS 15/9.5), we noted one of 60 (2%) instances where the Department was unable to provide documentation to demonstrate the applicant had turned in the professional experience reference forms verifying the length, hours worked, and description of employment as required by the 68 Ill. Adm. Code 120(a). The Department provided all of the other requested documentation related to the applicant. See also Finding 5. • The Department was unable to provide us with support showing that 60 of 60 (100%) licensees tested were certified by a recognized accrediting body or that the licensees were subject to inspection when we tested the Home Medical Equipment and Services Provider License Act (225 ILCS 51/50) and the Illinois Administrative Code (68 Ill. Adm. Code 1253.80(b)). See also Finding 6. • During our testing of 60 nonresident pharmacies regulated by the Pharmacy Practice Act (225 ILCS 85/16a(b)(6)), the Department was unable to provide support the pharmacy was licensed in its state of residency for four (7%) nonresident pharmacies tested and was unable to provide support for the pharmacy’s location, names, and titles of all principal officers of the business and all pharmacists dispensing drugs to residents of the State of Illinois for four (7%) nonresident pharmacies tested. See also Finding 7. • During the examination period, 182 pharmacies closed within the State. During testing of closed 19 pharmacies subject to the guidelines outlined in the Pharmacy Practice Act (225 ILCS 85/17), the Department did not retain one (5%) tested pharmacy’s closing inventory of controlled substances. As such, the Department did not have documentation to support its approval or disapproval of the pharmacy’s intended disposition of all legend drugs and, if necessary, the Department’s decision to confiscate all remaining legend drugs 30 days after the pharmacy’s closure. See also Finding 7. • During our testing of the Pharmacy Practice Act (225 ILCS 85/9.5a), we noted one of 60 (2%) instances where the Department could not provide any documentation to show the certified pharmacy technician had graduated from a pharmacy technician training or verification from the pharmacy where the applicant is employed that the applicant completed the required training program as required by the statute. (Finding 8, pages 31-33). We recommended Department management and staff take immediate action to strengthen its control over records maintenance for each area in which a compliance requirement is present. The Department agreed with our recommendation. INADEQUATE INTERNAL AUDIT FUNCTION The Department failed to adhere to provisions in the Fiscal Control and Internal Auditing Act (Act). The Act requires the Department as a designated State agency to have a Chief Internal Auditor appointed by the Secretary and to maintain a full-time program of internal auditing. In addition, the Act also states “[a]gencies which do not have full-time internal audit programs may have internal audits performed by the Department of Central Management Services” (30 ILCS 10/2001 (b)). The Act was originally a Legislative Audit Commission initiative designed to address deficiencies noted in a May 1988 management audit of Illinois’ State Programs of Internal Auditing. The audit report’s conclusions and recommendations and the legislation that became the Act demonstrated an understanding that agencies which are not required to have their own full-time program of internal auditing could obtain internal auditing assistance from an agency such as the Department of Central Management Services (CMS). In other words, each designated State agency must have a full-time program of internal auditing and each State agency that is not so designated is not required to have a full-time program of internal auditing but may receive internal audit services from CMS. In 2003, by Executive Order (2003-10) the Governor transferred the internal auditors from the various State agencies and consolidated them into a bureau at CMS. In 2009, the General Assembly unanimously rejected this consolidation of internal audit authority in CMS and directed that the internal auditors and their functions be returned to their respective designated State agencies (P.A. 96-795, effective July 1, 2010). On February 2, 2018, the Department entered into an agreement with CMS’ Bureau of Internal Audit to provide the Department with internal auditing services effective April 1, 2018. As of the end of our fieldwork (February 12, 2019), CMS’ Chief Internal Auditor was acting as Chief Internal Auditor for eight State agencies (CMS, Agriculture, Corrections, Financial and Professional Regulation, Human Rights, Insurance, Labor, and Illinois Finance Authority). During testing, we noted the following: • The Department’s Secretary has not appointed an individual to fill the Department’s chief internal auditor position. This position was vacated on July 1, 2016, 729 days prior to the end of the examination period on June 30, 2018. The Act (30 ILCS 10/2002(a)) requires the Director to appoint a chief internal auditor. • The Department and CMS did not obtain the Governor’s approval for CMS to provide professional internal auditing services to the Department. The Code (20 ILCS 405/405-293(a)) states that CMS “is responsible for providing professional services for or on behalf of State agencies for all functions transferred to the Department by Executive Order No. 2003-10. . .” Since the part of Executive Order 2003-10 related to internal audit was reversed by P.A. 96-795 this portion of the Section is not applicable in the circumstances. The Section goes on to state that CMS may “with the approval of the Governor, provide additional services to or on behalf of State agencies.” “Additional services” is not defined and no approval for CMS to provide internal auditing services specifically to the Department, a designated State agency under the Act, was obtained from the Governor. • While testing the Expenses and Support Cost section of the intergovernmental agreement between the Department and CMS, we requested the Department provide us with sufficient and appropriate audit evidence related to costs of the Department’s internal audit function from April 1, 2018, through the end of the examination period on June 30, 2018. We requested the documentation to substantiate (1) the authorization of CMS to use the Department’s appropriation for processing payroll as allowed for under the intergovernmental agreement, and (2) that CMS only charged the Department for payroll services of CMS internal auditors who provided internal audit functions to the Department. The Department was unable to provide us with the documentation requested. Specifically, we noted the following : – It does not appear the Department is monitoring the current costs of its internal audit function. As a result, we were unable to audit the cost of the Department’s internal audit function to ensure the Department is accurately reimbursing CMS payroll costs as stipulated by the intergovernmental agreement. – The Department granted CMS authorization through its intergovernmental agreement to charge the Department’s appropriations for payroll costs associated with CMS’ rendering of professional internal audit services to the Department; however, as indicated by the Department in its response to our requests, it is not the Department’s nor CMS’ intent to process any vouchers against the Department’s appropriations. As a result, we believe there is a significant internal control risk with potentially delegating a State’s appropriation authority unnecessarily. (Finding 14, pages 44-48). We recommended the following: 1) the Department’s Secretary appoint a chief internal auditor and ensure a full-time program of internal auditing is in place and functioning at the Department; 2) if another agency is to be relied upon to supplement internal audit functions at the Department, the Department should obtain written approval of the Governor for these services and ensure such services are provided in accordance with the Act’s requirements; 3) the Department implement policies and procedures to track internal audit costs, maintain documentation which adequately documents the costs of the Department’s internal audit function, and ensure other agencies providing services to the Department are only reimbursed for allowable costs; and 4) finally, the Department should not grant another agency the authority to process payroll against the Department’s appropriations unnecessarily or without implementing and documenting proper controls. The Department partially agreed with the recommendation and noted it will work with CMS to develop a responsive, effective, and sustainable long-term solution for the Chief Internal Auditor appointment, obtain written approval from the Governor’s Office to supplement internal audit functions, track the costs associated with the audit services and develop a plan to review the costs for reimbursement of federal monies, and revise the intergovernmental agreement to remove the portion on processing payroll. The auditors commented that although the Department indicates it will work with CMS to revise the intergovernmental agreement under which CMS’ Chief Internal Auditor acts as the Chief Internal Auditor for the Department, as well as for numerous other agencies through other intergovernmental agreements, the auditors do not believe this arrangement meets the requirements of the Fiscal Control and Internal Auditing Act and, as a result, we are requesting a formal, written opinion from the Attorney General’s Office on the matter. OTHER FINDINGS The remaining findings pertain to the Department’s various boards and committees not being fully staffed, the lack of promulgated rules over consistency and due process in examination processes, inadequate controls over clinical psychologist evaluations, failure to adequately oversee pharmacies’ final controlled substance inventories, noncompliance with Payment Card Industry Data Security Standards, voucher processing weaknesses, deficiencies identified in its management of refunds and returned checks, employee performance evaluations not completed or timely completed, and weaknesses in internal control over travel. We will review the Department’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Department for the two years ended June 30, 2018, as required by the Illinois State Auditing Act. The accountants modified their opinion on compliance for Findings 2018-002, 2018-004, 2018-006, 2018-007, 2018-008, and 2018-014. Except for the noncompliance described in these findings, the accountants stated the Department complied, in all material respects, with the requirements described in the report. This compliance examination was conducted by Sikich, LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:JMR