REPORT DIGEST DEPARTMENT OF EMPLOYMENT SECURITY FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2020 Release Date: July 28, 2021 FINDINGS THIS AUDIT: 7 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 5 -- 1 -- 6 Category 2: 0 -- 1 -- 1 Category 3: 0 -- 0 -- 0 TOTAL: 5 -- 2 -- 7 FINDINGS LAST AUDIT: 5 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (20-1) The Department failed to implement general Information Technology controls over the Pandemic Unemployment Assistance System. • (20-2) The Department failed to ensure Pandemic Unemployment Assistance claimants met eligibility requirements. • (20-5) The Department did not have sufficient internal control over the determination of accruals for payments related to both the Unemployment Insurance program and the Pandemic Unemployment Assistance program. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS FAILURE TO IMPLEMENT GENERAL INFORMATION TECHNOLOGY CONTROLS OVER THE PANDEMIC UNEMPLOYMENT ASSISTANCE SYSTEM The Department failed to implement general Information Technology (IT) controls over the Pandemic Unemployment Assistance (PUA) System. During testing, some of the more significant issues we noted included the following: • The Department could not provide a System and Organization Controls (SOC) report for the PUA system. • The Department was unable to provide documentation demonstrating the completeness and accuracy of the population of changes made to the PUA system. • For 5 of 30 (17%) system changes tested, the Department could not provide documentation demonstrating changes were approved prior to being moved into the production environment. • The Department had not conducted a review of access rights to the PUA system during the audit period. • The Department could not provide documentation demonstrating users’ access was timely terminated. • The Department had not developed a disaster recovery plan in order to recover the PUA system in the event of a disaster. As a result of the Department’s failure to obtain a SOC report or ensure the general IT controls were suitably designed and operating effectively over the system, we were unable to rely on the system with respect to claimant eligibility and whether benefit payments made were in accordance with federal requirements. (Finding 1, pages 20-22) We recommended the Department ensure the contract with the service provider includes requirements for independent review of internal controls, such as a SOC report. Additionally, we recommended the Department develop internal controls to maintain documentation demonstrating populations of changes and system user access are complete and accurate. We also recommended the Department strengthen controls over policies and procedures, system changes, segregation of duties, user access approval and termination, and user access reviews. Finally, we recommended the Department work with its service provider to develop a detailed disaster recovery plan for recovery of the system and the claimants’ data. The Department accepted the auditor’s recommendation and indicated it was pursuing contractual arrangements to secure a SOC report. FAILURE TO ACCURATELY DETERMINE CLAIMANTS’ ELIGIBILITY FOR PANDEMIC UNEMPLOYMENT ASSISTANCE The Department failed to ensure Pandemic Unemployment Assistance (PUA) claimants met eligibility requirements. During testing, some of the more significant issues we noted included the following: • The Department did not validate the wages of all claimants receiving more than the minimum weekly payment amount of $198. The total amount paid for PUA above the minimum was $96,931,104. • 4,579 claimants’ identities were not validated. Additionally, the Department had not completed follow up actions to verify the identities of these claimants. The total PUA and Federal Pandemic Unemployment Compensation (FPUC) benefits paid to these claimants was $41,697,272. • 266 claimants received PUA and FPUC benefits totaling $2,668,266; however, the claimants’ birthdays were the same day or later than the date of the claim. The birthdate of the claimants ranged from the same day as the application for benefits to 2029. • 35 claimants were deceased at the time of receiving PUA and FPUC benefits. This was determined by matching the Social Security number on the application with records maintained by the Social Security Administration. The claimants were paid PUA and FPUC benefits totaling $343,670. Failure to accurately document PUA eligibility resulted in potentially ineligible claimants receiving benefits totaling $154,906,354. Noncompliance with federal laws and regulations could lead to sanctions and/or loss of future federal funding. Due to the absence of adequate information to support the eligibility of paid claimants as described above, the amounts recorded could not be audited. Accordingly, the auditor’s opinion on the financial statements of the Unemployment Compensation Trust Fund was qualified. This qualification will continue until the Department can provide auditable evidence in support of the PUA claimant eligibility as it relates to the issues noted above. (Finding 2, pages 23-26) We recommended the Department implement controls to ensure individuals are eligible to receive benefits prior to payment. Additionally, we recommended the Department ensure all staff are trained on the requirements to ensure eligibility is properly and timely determined. The Department accepted the auditor’s recommendation and stated it has been engaged in an ongoing effort to quickly implement the PUA program accurately as well as respond to additional information and provide changes issued by the U.S. Department of Labor in subsequent Unemployment Insurance Program Letters (UIPL). INADEQUATE CONTROLS OVER ACCRUALS The Department did not have sufficient internal control over the determination of accruals for payments related to both the Unemployment Insurance (UI) program and the Pandemic Unemployment Assistance (PUA) program. The Department initially recorded both the UI and PUA accruals based on the week covered, regardless of when the claimant became eligible to receive the benefit. An entry was recorded in the amount of $1.08 billion to reverse these accruals as the accrual criteria used was not appropriate. To correct the error, the Department recorded an adjustment for $264 million to record the UI payable based on claimants who certified their eligibility prior to year-end, but were paid after year- end. As certification is the final step of the eligibility determination for UI, this was determined to be the appropriate criteria Further, in evaluating the PUA accrual, the Department was unable to determine when claimants met all eligibility requirements, as limitations within the system did not track all necessary data for this analysis. Additionally, there was a large backlog of unprocessed paperwork filed by claimants which would need to be considered to determine when a claimant became eligible. The large increase in volume of claims led to this backlog not being processed timely, compounding the issue. Due to the lack of internal control in this area, the Department’s draft financial statements were materially misstated. Due to the absence of adequate information to support the eligibility of accrued claimants, the amount of the accrual could not be audited. Accordingly, the auditor’s opinion on the financial statements of the Unemployment Compensation Trust Fund was qualified. This qualification will continue until the Department can provide auditable evidence in support of the PUA claimant accrual. (Finding 5, pages 31-32) We recommended the Department develop a process to capture required data to determine which claimants met eligibility requirements prior to year-end. In addition, we recommended manual documents received from claimants be worked on a more timely basis so that claimants that are due funds are paid in the proper period. The Department accepted the auditor’s recommendation and stated it was formulating processes needed to capture required data to determine which claimants met the eligibility requirements as of year-end. OTHER FINDINGS The remaining findings pertain to inadequate controls over Pandemic Unemployment Assistance program processes, cash reconciliations, receivable allowances, and GenTax access. We will review the Department’s progress towards the implementation of our recommendations in our next financial audit. AUDITOR’S OPINIONS The auditors qualified their opinion on the Unemployment Compensation Trust Fund for Findings 2020-002 and 2020-005. Except for these matters, the auditors stated the financial statements of the Unemployment Compensation Trust Fund of the Department as of and for the year ended June 30, 2020, are fairly stated in all material respects. This financial audit was conducted by RSM US LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:DMG