REPORT DIGEST DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES - LOCAL GOVERNMENT HEALTH INSURANCE RESERVE FUND FINANCIAL AUDIT For the Year Ended: June 30, 2008 Summary of Findings: Total this audit 1 Total prior audit 0 Release Date: July 8, 2009 State of Illinois Office of the Auditor General WILLIAM G. HOLLAND AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General Iles Park Plaza 740 E. Ash Street Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are available on the worldwide web at www.auditor.illinois.gov

SYNOPSIS The Department did not obtain an independent internal control review of its third parties involved with the processing of health insurance claims for the Local Government Health Plan. {Financial Information and Activity Measures summarized on the reverse page.}

DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES

LOCAL GOVERNMENT HEALTH INSURANCE RESERVE FUND

FINANCIAL AUDIT

Year Ended June 30, 2008

FINANCIAL OPERATIONS (in thousands)

FY 2008

OPERATING REVENUES Charges for sales and services................................. Total operating revenues.............................. OPERATING EXPENSES Benefit payments and refunds.................................. Depreciation........................................................... General and administrative...................................... Total operating expenses.............................. Operating income (loss)........................................... NONOPERATING REVENUES (EXPENSES) Interest and investment income................................ Other revenues....................................................... Income (loss) before contributions and transfers...................................................... Transfers-out.......................................................... Change in net assets...................................... Net assets, July 1, 2007.......................................... NET ASSETS, JUNE 30, 2008................................

$ 60,189 60,189 60,313 3 898 61,214 (1,025) 735 145 (145) 0 (145) 7,374 $ 7,229

SUPPLEMENTARY INFORMATION	FY 2008
Number of local governmental entities participating… Approximate number of employees covered...……...... Approximate number of dependents covered……....... Approximate number of retirees covered......................	488 5,694 3,821 312

AGENCY DIRECTOR

During Audit Period: Mr. Barry S. Maram

Currently: Mr. Barry S. Maram

No assurance to prevent errors or irregularities No third party independent internal control review obtained for 2 of 5 third party service providers 28% of health insurance expenses processed by third party service providers have no internal control review Department disagrees with auditors Auditor’s comment Reports not obtained until after auditors requested them

INTRODUCTION This digest covers the financial audit of the Local Government Health Insurance Reserve Fund for the year ended June 30, 2008. The financial audit report includes one significant deficiency in internal control finding. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS THIRD PARTY INTERNAL CONTROL REVIEWS NOT OBTAINED The Department did not obtain an independent internal control review (SAS 70 Report) of its third parties involved with the processing of health insurance claims for the Local Government Health Plan. Without a review, the Department did not have assurance that information system controls to prevent errors or irregularities were established. When a user organization like the Department of Healthcare and Family Services uses service organizations, transactions that affect the Local Government Health Insurance Reserve Fund’s financial statements are subjected to controls that are, at least in part, separate from the Department’s. Consequently, it is good business practice to obtain a report from the service organization’s auditors concerning controls placed in operation and in some cases results of tests concerning operational effectiveness. These types of reports are commonly referred to as SAS 70 Reports. The Department contracts with five different third party health insurance service providers to process health insurance claims. Each of the health insurance service provider uses their own computer system to process these health insurance claims. During our review of third party health insurance service providers, we noted that the Department did not obtain an independent internal control review for two of the service providers during fiscal year 2008. Of the health insurance payments made to the five third party health insurance service providers totaling $28,573,571 in fiscal year 2008, $7,978,387 (28%) of the health insurance payments were processed under a third party health insurance service provider from which the Department did not obtain an independent internal control review. The Department stated that they negotiate long term contracts with the parties involved in processing insurance claims for the health care plans. Typical healthcare contracts have five year initial periods and up to five one-year renewal periods. The two contracts cited were initially negotiated with a five-year contract in 2001, for fiscal year 2002 implementation, without a “SAS 70” requirement. The two contracts are currently in one-year renewal periods without a “SAS 70” requirement. The Department previously submitted the relevant portions of the Sarbanes Oxley audit pertaining to internal controls as they relate to the audited financial statements for one of the two contracts. In addition, a 2008 Annual Report with SEC form 10-K and a Financial Statement audit were previously submitted for the remaining contract. The Annual Report with SEC form 10-K identified above includes the “Report of Independent Registered Public Accounting Firm.” The vendor of the original contract was acquired October 1, 2007. Prior to this the vendor was a privately held corporation. (Finding 1, pages 20-22) We recommended the Department require that each third-party health insurance service provider engage independent auditors to perform an annual independent internal control review on the controls placed in operation and the tests of their operating effectiveness. Department officials disagreed with our finding and recommendation and stated that the majority of these contracts were originally executed prior to industry acceptance of “SAS 70.” Department officials continued to state that the Fiscal Year 2010 contracts and renewals for the two vendors not submitting “SAS 70” audits have already been negotiated and have been signed by the vendors. In order to implement this requirement for those, the Department would have to renegotiate their contracts. Renegotiating those contracts at this date would jeopardize contracts beginning July 1, 2009. Negotiating an additional audit into these renewals would also increase the cost of the contract. The Department will include a “SAS 70” requirement to all future contracts bid with third parties involved with the processing of health insurance claims. In an auditor’s comment, we noted that we requested all third party internal control reviews from the Department and, for the two contracts noted above, the Department indicated that they relied on “equivalent” reviews for one of the contracts and they did not have a third party internal control review or equivalent review for the other contract. With regard to one of the contracts, the Department did provide the auditors with what they called a “Sox Report” (Sarbanes Oxley Report). The documentation that the Department provided was an excel spreadsheet that documented computer controls. This spreadsheet was not accompanied by any type of cover letter or auditor’s report. After the auditors questioned the “Sox Report,” the Department contacted the vendor and the Department was informed that the “Sox Report” is actually part of the vendor’s “SAS 70” Report. For the other contract, the Department indicated that they provided the auditors with a 2008 Annual Report with SEC Form 10-K. The Department did not have this Annual Report until the auditors asked for the “SAS 70” Reports. The Department could not provide any “equivalent” reviews prior to the 2008 Annual Report. The Department cannot state to the auditors that they are relying on these "equivalent" reports if they do not obtain them unless requested by the auditors. There are clearly no internal controls to obtain and review these reports. AUDITORS’ OPINION Our auditors state the financial statements of the Local Government Health Insurance Reserve Fund as of June 30, 2008, are fairly presented in all material respects. ___________________________________ WILLIAM G. HOLLAND, Auditor General WGH:TLD:pp AUDITORS ASSIGNED This audit was performed by the staff of the Office of the Auditor General.