REPORT DIGEST

DEPARTMENT OF INSURANCE

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2018

Release Date:  April 18, 2019

FINDINGS THIS AUDIT:  11

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  3 -- 1 -- 4
Category 2:  5 -- 2 -- 7
Category 3:  0 -- 0 -- 0
TOTAL:  8 -- 3 -- 11

FINDINGS LAST AUDIT: 5

Category 1: Findings that are material
weaknesses in internal control and/or a
qualification on compliance with State laws
and regulations (material noncompliance).
Category 2: Findings that are significant
deficiencies in internal control and
noncompliance with State laws and
regulations.
Category 3: Findings that have no internal
control issues but are in noncompliance
with State laws and regulations.

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, Iles Park
Plaza, 740 E. Ash Street, Springfield, IL
62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

SYNOPSIS

• (18-01) The Department’s Public Pension
Division did not perform required
examinations of police and firefighters
pension funds once every three years as
required by the Illinois Pension Code.
• (18-02) The Department did not maintain
adequate controls over the timeliness of
approving and denying insurance and Health
Maintenance Organization (HMO) company
policy forms.
• (18-04) The Department failed to adhere
to provisions in the Fiscal Control and
Internal Auditing Act.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

FAILURE TO PERFORM REQUIRED EXAMINATIONS OF
POLICE AND FIREFIGHTER PENSION FUNDS

The Department of Insurance’s (Department)
Public Pension Division did not perform
required examinations of the 656 police and
firefighters pension funds once every three
years as required by the Illinois Pension
Code (Code). Specifically, we noted the
following:
• Two (0.3%) pension funds have been
examined three times since 2004. As a
result, in the 14 years since 2004, the
Department did not complete one examination
for each of the two funds.
• 230 (35%) pension funds have been
examined on two occasions since 2004. As a
result, in the 14 years since 2004, the
Department did not complete two
examinations for each of the 230 funds.
• 383 (58%) pension funds have been
examined on one occasion since 2004. As a
result, in the 14 years since 2004, the
Department did not complete three
examinations for each of the 383 funds.
• 36 (5%) pension funds were currently
under examination as of the end of the
audit period. Seventeen of the 36 pension
fund examinations currently under
examination at the end of the audit period
were the funds’ initial examination. Formed
between 2008 and 2012, these 17 pension
funds did not have 1 or 2 examinations
conducted by the Department in the 6-10
years since the date of their formation.
The remaining 18 pension funds were in the
process of their second examination and one
pension fund on its third examination since
2004. As a result, in the 14 years since
2004, the Department did not complete three
examinations for each of the 19 funds.
• One (0.2%) pension fund has not been
examined. The pension fund was formed in
2011. As a result, in the 7 years since
2011, the Department did not complete two
examinations for the fund.

The Code (40 ILCS 5/1A-104(a)) requires the
Public Pension Division to make periodic
examinations and investigations of all
pension funds. Section 1A-104(b) of the
Code further requires the Public Pension
Division to examine or investigate each
pension fund established under Article 3
(Police) or Article 4 (Firefighters) of the
Code once every 3 years.  (Finding 1, pages
13-14)  This finding has been repeated
since 2012.

We recommended the Department perform the
pension fund examinations every three years
as required by the Code or continue to seek
a legislative change.

The Department accepted the recommendation
and noted it was pursuing legislation to
amend the Illinois Pension Code to shift to
a risk-based audit approach requiring an
audit of each pension fund every five
years. (For the previous Department
response, see Digest Footnote #1.)

INADEQUATE CONTROLS OVER THE TIMELINESS OF
APPROVING AND DENYING INSURANCE AND HMO
COMPANY POLICY FORMS

The Department did not maintain adequate
controls over the timeliness of approving
and denying insurance and Health
Maintenance Organization (HMO) company
policy forms.  Specifically, we noted the
following:
• 17 of 40 (43%) life, accident, and health
policy forms filed by insurer companies
were not approved or disapproved by the
Department within the required 60-day time
period after the form’s submission. The
Department approved the policy forms
between 8 to 432 days late.
• 10 of 18 (56%) HMO group contracts,
evidence of coverage, endorsement, rider,
bylaw or other policy forms were not
approved or disapproved by the Department
within the required 60-day time period
after the form’s submission. The Department
approved the policy forms between 1 to 113
days late.

By not approving or disapproving life,
accident, health insurance, or HMO policy
forms in a timely manner as required by the
Illinois Insurance Code or the Health
Maintenance Organization Act, insurance and
HMO companies’ distribution of their
products to the market may be delayed and
represents noncompliance with the State
law. (Finding 2, pages 15-16).

We recommended the Department comply with
the statutory requirements of the Illinois
Insurance Code and the Health Maintenance
Organization Act.

The Department accepted the recommendation
and noted it acknowledges the filings were
not approved within the 60-day statutory
timeline due to various circumstances that
may warrant the Department to request
additional documentation from the insurers
or may require actuarial review.

INADEQUATE INTERNAL AUDIT FUNCTION

The Department failed to adhere to
provisions in the Fiscal Control and
Internal Auditing Act (Act).

The Act requires the Department as a
designated State agency to have a Chief
Internal Auditor appointed by the agency
head and to maintain a full-time program of
internal auditing.  In addition, the Act
also states “[a]gencies which do not have
full-time internal audit programs may have
internal audits performed by the Department
of Central Management Services” (30 ILCS
10/2001 (b)).

The Act was originally a Legislative Audit
Commission initiative designed to address
deficiencies noted in a May 1988 management
audit of Illinois’ State Programs of
Internal Auditing. The audit report’s
conclusions and recommendations and the
legislation that became the Act
demonstrated an understanding that agencies
which are not required to have their own
full-time program of internal auditing
could obtain internal auditing assistance
from an agency such as the Department of
Central Management Services (CMS). In other
words, each designated State agency must
have a full-time program of internal
auditing and each State agency that is not
so designated is not required to have a
full-time program of internal auditing but
may receive internal audit services from
CMS.

In 2003, by Executive Order (2003-10) the
Governor transferred the internal auditors
from the various State agencies and
consolidated them into a bureau at CMS. In
2009, the General Assembly unanimously
rejected this consolidation of internal
audit authority in CMS and directed that
the internal auditors and their functions
be returned to their respective designated
State agencies (P.A. 96-795, effective July
1, 2010).

On January 15, 2018, the Department entered
into an agreement with CMS’ Bureau of
Internal Audit to provide the Department
with internal auditing services. As of the
end of our fieldwork (February 11, 2019),
CMS’ Chief Internal Auditor was acting as
Chief Internal Auditor for eight State
agencies (CMS, Agriculture, Corrections,
Financial and Professional Regulation,
Human Rights, Insurance, Labor, and
Illinois Finance Authority).

During testing, we noted the following:

• The Department’s Director has not
appointed an individual to fill the
Department’s chief internal auditor
position. This position was vacated on May
31, 2017, 395 days prior to the end of the
examination period on June 30, 2018. The
Act (30 ILCS 10/2002(a)) requires the
Director to appoint a chief internal
auditor.

• The Department and CMS did not obtain the
Governor’s approval for CMS to provide
professional internal auditing services to
the Department. The Code (20 ILCS
405/405-293(a)) states that CMS “is
responsible for providing professional
services for or on behalf of State agencies
for all functions transferred to the
Department by Executive Order No. 2003-10.
. .” Since the part of Executive Order
2003-10 related to internal audit was
reversed by P.A. 96-795 this portion of the
Section is not applicable in the
circumstances. The Section goes on to state
that CMS may “with the approval of the
Governor, provide additional services to or
on behalf of State agencies.” “Additional
services” is not defined and no approval
for CMS to provide internal auditing
services specifically to the Department, a
designated State agency under the Act, was
obtained from the Governor.

• While testing the Expenses and Support
Cost section of the intergovernmental
agreement between the Department and CMS,
we requested the Department provide us with
sufficient and appropriate audit evidence
related to costs of the Department's
internal audit function from January 15,
2018, through the end of the examination
period on June 30, 2018. We requested the
documentation to substantiate (1) the
authorization of CMS to use the
Department's appropriation for processing
payroll as allowed for under the
intergovernmental agreement, and (2) that
CMS only charged the Department for payroll
services of CMS internal auditors who
provided internal audit functions to the
Department. The Department was unable to
provide us with the documentation
requested. Specifically, we noted the
following internal control deficiencies:
– It does not appear the Department is
monitoring the current costs of its
internal audit function. As a result, we
were unable to audit the cost of the
Department’s internal audit function to
ensure the Department is accurately
reimbursing CMS payroll costs as stipulated
by the intergovernmental agreement.
– The Department granted CMS authorization
through its intergovernmental agreement to
charge the Department’s appropriations for
payroll costs associated with CMS’
rendering of professional internal audit
services to the Department; however, it is
not the Department’s nor CMS’ intent to
process any vouchers against the
Department’s appropriations. As a result,
we believe there is a significant internal
control risk with potentially delegating a
State’s appropriation authority
unnecessarily.


Failure to establish a full-time internal
audit program in accordance with the
requirements of the Act – where the chief
internal auditor develops a deep
understanding of the Department’s functions
and processes, oversees, and performs
audits of the Department’s major systems of
internal accounting and administrative
controls on a periodic basis, and oversees
and reviews major new and modifications to
information systems prior to implementation
– weakens the Department’s ability to
assess its overall internal control
environment and represents noncompliance
with State law. Further, the establishment
of the Department's internal audit function
by interagency agreement hinders the
operational autonomy intended by the
General Assembly for internal auditors.
Department management cannot terminate an
appointed chief internal auditor prior to
the conclusion of their term without cause
and a hearing before the Executive Ethics
Commission, but management can terminate
the interagency agreement with CMS at any
time for any reason. Failure to obtain the
approval of the Governor for expanding the
professional services provided to the
Department by CMS limits governmental
oversight and represents noncompliance with
the Code. Failure to adequately track
internal audit costs and be able to provide
the auditors with adequate cost support
related to the Department’s internal audit
function results in the auditors being
unable to determine the Department’s
compliance with the Act. Finally, granting
CMS authorization to expend the
Department’s payroll appropriations weakens
the Department’s overall internal control
environment and represents noncompliance
with State law. (Finding 4, pages 19-23).

We recommended the following: 1) the
Department’s Director appoint a chief
internal auditor and ensure a full-time
program of internal auditing is in place
and functioning at the Department; 2) if
another agency is to be relied upon to
supplement internal audit functions at the
Department, the Department should obtain
written approval of the Governor for these
services and ensure such services are
provided in accordance with the Act’s
requirements; 3) the Department implement
policies and procedures to track internal
audit costs, maintain documentation which
adequately documents the costs of the
Department’s internal audit function, and
ensure other agencies providing services to
the Department are only reimbursed for
allowable costs; and 4) the Department
should not grant another agency the
authority to process payroll against the
Department’s appropriations unnecessarily
or without implementing and documenting
proper controls.

The Department accepted the recommendation
and noted it will work with CMS to develop
a responsive, effective, and sustainable
long-term solution for the CIA appointment,
obtain written approval from the Governor’s
Office to supplement internal audit
functions, track the costs associated with
the audit services and develop a plan to
review the costs for reimbursement of
federal monies, and revise the
intergovernmental agreement to remove the
portion on processing payroll.

The auditors commented that although the
Department indicates it will work with CMS
to revise the intergovernmental agreement
under which CMS’ Chief Internal Auditor
acts as the Chief Internal Auditor for the
Department, as well as for numerous other
agencies through other intergovernmental
agreements, the auditors do not believe
this arrangement meets the requirements of
the Fiscal Control and Internal Auditing
Act and, as a result, we are requesting a
formal, written opinion from the Attorney
General’s Office on the matter.

OTHER FINDINGS

The remaining findings pertain to the
overstocking of postage inventory, failure
to assess penalties and interest to
insurance companies, failure to procure and
implement a fraud prevention and detection
information system, noncompliance with
federal grant agreements, and inadequate
controls over reporting, employee
performance evaluations, surplus equipment
items, and voucher processing. We will
review the Department’s progress towards
the implementation of our recommendations
in our next compliance examination.

ACCOUNTANT’S OPINION

The accountants conducted a compliance
examination of the Department for the two
years ended June 30, 2018, as required by
the Illinois State Auditing Act.  The
accountants qualified their report on State
compliance for Findings 2018-001 through
2018-004.  Except for the noncompliance
described in these findings, the
accountants stated the Department complied,
in all material respects, with the
requirements described in the report.

This compliance examination was conducted
by Adelfia LLC.

JANE CLARK
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:jv

DIGEST FOOTNOTES

#1-2016 Noncompliance with Requirements of
the Illinois Pension Code: The Department
accepts the finding.  Regarding the failure
to meet the three (3) year audit cycle
mandate, the Department has filed
legislation to amend Section 1A-104 of the
Illinois Pension Code to shift to a risk-
review audit process requiring an audit of
each pension fund every five years.  This
legislation, HB4660, is pending in
Committee, and the Department is continuing
to work toward passage.