REPORT DIGEST

ILLINOIS WORKERS’ COMPENSATION COMMISSION

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2023

Release Date:  May 30, 2024

FINDINGS THIS AUDIT: 21

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  0 -- 9 -- 9
Category 2:  2 -- 10 -- 12
Category 3:  0 -- 0 -- 0
TOTAL:  2 -- 19 -- 21

FINDINGS LAST AUDIT: 23

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

This digest covers the Illinois Workers’
Compensation Commission’s (Commission)
compliance examination for the two years
ended June 30, 2023.  A separate digest
covering the Commission’s Self-Insurers
Security Fund’s financial audit as of and
for the year ended June 30, 2023 was
released on February 15, 2024.  In total,
this report includes 21 findings, two of
which were reported in the financial audit.

SYNOPSIS

• (23-03) The Commission lacked adequate
internal controls over its cash receipts and
Agency Fee Imposition Reports.
• (23-04) The Commission did not
sufficiently monitor and pursue collection
on accounts receivable or properly report
its accounts receivable to the Comptroller’s
Office.
• (23-05) The Commission lacked adequate
internal control over its equipment.
• (23-07) The Commission failed to establish
internal control to conduct due diligence or
ensure project management controls over the
Self-Insurance Plus project.
• (23-13) The Commission did not exercise
adequate internal control over
telecommunication devices.
• (23-17) The Commission has not sought
judgement in circuit court against self-
insurers owing past due assessments.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

INADEQUATE CONTROLS OVER RECEIPTS

The Commission’s internal controls over its
receipt processing function were not
operating effectively during the examination
period.  In addition, the Commission did not
exercise adequate internal control over its
annual Agency Fee Imposition Reports
(Report).

Due to our ability to rely upon the
processing integrity of the Enterprise
Resource Planning System (ERP) operated by
the Department of Innovation and Technology
(DoIT), we were able to limit our receipt
and refund testing at the Commission to
determine whether certain key attributes
were properly entered by the Commission’s
staff into the ERP. In order to determine
the operating effectiveness of the
Commission’s internal controls related to
receipt processing, we selected a sample of
key attributes (attributes) to determine if
the attributes were properly entered into
the ERP based on supporting documentation.

During our testing of 28 receipts and 28
refund receipts, we noted 25 of 140 (18%)
attributes and 20 of 140 (14%) attributes,
respectively, were not properly entered into
the ERP. Therefore, the Commission’s
internal controls over receipt and refund
receipt processing were not operating
effectively.

Due to this condition, we qualified our
opinion because we determined the Commission
had not complied, in all material respects,
with applicable laws and regulations,
including the State uniform accounting
system, in its financial and fiscal
operations.

Results from testing of the Commission’s
Reports:

• During Fiscal Year 2022, we noted
unreconciled differences of $5,622, $19,338,
and $14,872 within the reported fees
collected for the Second Injury Fund, Rate
Adjustment Fund, and Illinois Workers’
Compensation Commission Operations Fund.

• During Fiscal Year 2023 we noted
unreconciled differences of $638, $3,937,
and $297 within the reported fees collected
for the Second Injury Fund, Rate Adjustment
Fund, and Illinois Workers’ Compensation
Commission Operations Fund.

Finally, this finding was first noted during
the Commission’s compliance examination for
the period ended June 30, 2017. As such,
Commission management has been unsuccessful
in implementing a corrective action plan.
(Finding 3, pages 18-20)

We recommended the Commission design and
maintain internal controls to provide
assurance its data entry of key attributes
into ERP and fees reported in the Report are
complete and accurate.

Commission officials agreed with the
finding.

INADEQUATE CONTROLS OVER ACCOUNTS RECEIVABLE

The Commission did not sufficiently monitor
and pursue collection on accounts receivable
or properly report its accounts receivable
to the Comptroller’s Office.

During testing of 40 accounts receivable, we
noted:
• For Five (13%) delinquent accounts
receivable, totaling $98,335, the Commission
had not referred these receivables to either
the Illinois Debt Recovery Offset Portal
(IDROP) at the Comptroller’s Office or the
Department of Revenue’s Debt Collection
Bureau (Bureau) and were not actively
monitored and pursued for collection, as
follows:

— Two (5%) accounts, totaling $83,329, were
deferred payment plans arising from
settlement agreement for the Injured
Workers’ Benefit Fund between the debtor
employer and the Commission where the
employers had not followed the payment plan.
We noted these employers had not made any
payments during the examination period.

— Three (8%) accounts, totaling $15,006,
were overpayments by the Commission of
benefits from the Injured Workers’ Benefit
Fund. Further, the Commission did not send
first and second notices to these debtors.

During testing of the Commission’s Quarterly
Summary of Accounts Receivable (Form C-97)
reports, we noted:

• The Injured Workers’ Benefit Fund’s
estimated uncollectible accounts balance was
erroneously reported as $1,929 thousand in
the Commission’s third quarter Form C-97
report for Fiscal Year 2023 as opposed to
$2,102 thousand from the Commission’s
records.

• The Rate Adjustment Fund has discrepancies
within the Commission’s Form C-97s, as
noted:
— The amount reported in the second quarter
for Fiscal Year 2022 as collections had
discrepancies of $2 thousand when compared
to the Commission’s records.

— The amount reported in the fourth quarter
for Fiscal Year 2022 as new accounts
receivable and adjustments had discrepancies
totaling $4 thousand when compared to the
Commission’s records.

— The amount reported in the third quarter
for Fiscal Year 2023 as new accounts
receivable had discrepancies of $4 thousand
when compared to the Commission’s records.
(Finding 4, pages 21-23)

We recommended the Commission review the
design and operation of its internal
controls over accounts receivable to ensure
it timely pursues and attempts to collect
amounts due to the Commission, including by
referring amounts due to IDROP and the
Bureau. In addition, we recommended the
Commission implement controls to ensure its
quarterly accounts receivable reports are
complete and accurate.

Commission officials agreed with our
recommendation.

INADEQUATE CONTROLS OVER PROPERTY

The Commission lacked adequate internal
control over its property.

During review of the Commission’s property
and equipment items including its records,
we noted:
• During testing of 80 equipment items we
either (1) found in use at the Commission
Office traced by us to the Commission’s
records or (2) recorded on the Commission’s
records traced by us to the Commission’s
Offices, we noted five (6%) items, including
a television, a printer, a trolley, a
shredder, and a conference table were found
at the Commission Offices but could not be
traced to the Commission’s property listing.
In addition, three (4%) items tested, a
podium and two speakers, did not have an
inventory tag or other marking of its
inventory tag number; as such, we could not
trace these items to the Commission’s
property listing.

• During testing of six equipment
acquisitions totaling $21,942, we noted:
— One (17%) item, a USB-C dock, was
incorrectly recorded resulting in an
understatement of $13.

— Five (83%) items, including a mailing
device, three laptops, and a desk, totaling
$21,752, were recorded in the Commission’s
property records more than 90 days after
acquisition, ranging from 22 to 773 days
late.

• During testing of 15 equipment deletions,
we noted the Commission did not maintain a
copy of internal investigation detailing
efforts made to locate the missing item and/
or a copy of a police report for one (7%)
item, a laptop, amounting to $1,239, coded
as Not Located. In addition, the Commission
could not prove this laptop did not have
confidential information on their hard
drives or that this computers had been
protected with encryption technologies.

• The Commission did not identify all of its
costs incurred during the application
development period of Self-Insurance Plus
and CompFile! and did not record the related
intangible asset on its property listing.
Moreover, invoices from the Self-Insurance
Plus development vendor did not provide
sufficient details to determine if the
vendor was paid in accordance with the
contract’s requirements.

Finally, this finding was first noted during
the Commission’s compliance examination for
the period ended June 30, 2003. Although the
Commission made significant improvements on
its control over equipment, the Commission
management has been unsuccessful in
implementing a corrective action plan to
remedy these problems.  (Finding 5, pages
24-26)

We recommended the Commission review its
remaining property items in use and ensure
these items are properly marked with an
inventory number and recorded on its
property listing. Additionally, we
recommended the Commission monitor its
property and the related listing to ensure
events and transactions, such as additions
and deletions, impacting its property are
accurately and timely recorded and are
properly supported with required
documentation.

Further, we recommended the Commission
ensure its equipment items with data storage
capabilities, which may process or store
confidential data, are protected from
exposure.

Commission officials agreed with the
finding.

FAILURE TO ESTABLISH PROJECT MANAGEMENT
INTERNAL CONTROLS

The Commission failed to establish internal
controls to conduct due diligence or ensure
project management controls over the Self-
Insurance Plus project.

In order to modernize the self-insurance
management system, the Commission executed
two contracts for the development and
oversight of Self-Insurance Plus, totaling
$7,319,870. As of June 30, 2023, the
Commission had implemented the release of
Self-Insurance Plus and CompFile! into the
production environment.

During testing, we noted:

• A project management framework had not
been implemented to ensure the development
met the Commission’s requirements.

• System development standards had not been
established to ensure system developments
were properly completed, documented, and
properly approved.

• The following project deliverables were
not signed-off by the Project Team:
— Solution Testing Plan; and
— Functional Design Document.

• The project management plan did not
document the change management process
followed. (Finding 7, pages 30-31)

We recommended the Commission develop and
implement internal controls over its project
management of information systems projects.
Specifically, we recommended the Commission:
• Develop a project management framework to
ensure the development meets the
Commission’s requirements;
• Establish system development standards to
ensure system developments are properly
completed, documented, and properly
approved;
• Ensure project deliverables are properly
approved or signed-off by the authorized
personnel; and
• Ensure the project management plan
documents the change management process
followed.

The Commission disagreed with the finding.
The Commission stated they contracted the
Vendor to develop and implement the Self
Insurance and CompFile! Applications, which
included utilizing the vendors’ project
management framework and system development
standards, per industry guidelines. The
Commission stated it does not have a project
management office to implement or develop
custom applications, nor does the Commission
plan to develop any other applications

In the accountant’s comment we reemphasized
the Commission is ultimately responsible for
ensuring information systems projects are
within industry standards and to maintain
documentation showing those standards were
followed.  Exceptions noted in the findings
highlighted the Commission was unable to
demonstrate that this occurred.

INADEQUATE CONTROL OVER TELECOMMUNICATION
DEVICES

The Commission did not exercise adequate
internal control over telecommunication
devices.

During testing of issued and canceled
wireless communication devices, we noted:

• Four of six (67%) issued wireless
communication devices tested did not have
the Telecommunication Service Request (TSR)
forms completed for the issuance of the
wireless communication devices.

• Six of six (100%) issued wireless
communication devices tested did not have
supporting documents of the request of the
respective employees’ Manager and the
approval of the Chairman.

• One of four (25%) canceled wireless
communication devices tested was not
returned when employee separated from the
Commission for a period of 3 months then
returned. The Commission continued to pay
for the wireless communication device during
the separation. This wireless communication
device was noted to be deactivated 244 days
after the employee originally separated from
the Commission.

• Four of four (100%) canceled wireless
communication devices tested did not have
supporting documentation (e-mail request/
approval) for the cancellation of service or
for the change of mobile device from the
Chairman.  (Finding 13, pages 41-42)

We recommended the Commission implement
controls to:
1) prepare documentation supporting the need
for a new wireless communication device and
issuance approval prior to getting a new
wireless communication device;
2) ensure the timely collection of wireless
communication devices and cancellation of
all telecommunication services upon an
employee’s separation; and,
3) prepare documentation for request/
approval for the cancellation or changes to
mobile device services or assignment.

Commission officials agreed with the
finding.

FAILURE TO DESIGN AND IMPLEMENT CONTROLS
OVER PENALTIES AND FINES

The Commission has not sought a judgment in
circuit court against self-insurers owing
past due assessments.

During testing, we noted:
• The Commission has not collected from a
self-insurer for an assessment dating back
to Fiscal Year 2009, totaling $228. In
response to the prior engagement finding,
the Commission requested the Attorney
General’s representation in circuit court or
for the Attorney General to certify the
amount as uncollectible.
• The Commission had two assessments during
the examination period on July 30, 2021 and
November 15, 2022, which required self-
insurers to calculate and remit their amount
due no later than August 31, 2021 and
December 16, 2022, respectively.
— We noted 180 self-insurers owing $754,438
of the $1,226,082 (62%) for Fiscal Year 2022
assessment wrote a check to pay their
balance due after the deadline. The last
check was dated June 19, 2022 which was 292
days after the deadline.
— We noted 158 self-insurers owing $499,714
of the $1,110,477 (45%) for Fiscal Year 2023
assessment wrote a check to pay their
balance due after the deadline. The last
check was dated June 13, 2023 which was 179
days after the deadline.  (Finding 17, pages
49-50)

We recommended the Commission continue
working with the Attorney General to seek a
judgment in circuit court against those
self-insurers with past due assessments, or
seek a legislative remedy.

The Commission agreed with the finding.

OTHER FINDINGS

The remaining findings are reportedly being
given attention by the Commission.  We will
review the Commission’s progress towards the
implementation of our recommendations in our
next State compliance examination.

AUDITOR’S OPINION

The financial audit was previously released.
The auditors stated the financial statements
of the Self-Insurers Security Fund as of and
for the year ended June 30, 2023, are fairly
stated in all material respects.

ACCOUNTANT’S OPINION

The accountants conducted a State compliance
examination of the Commission for the two
years ended June 30, 2023, as required by
the Illinois State Auditing Act.  The
accountants qualified their report on State
compliance for Finding 2023-001 and Findings
2023-003 through 2023-010.  Except for the
noncompliance described in these findings,
the accountants stated the Commission
complied, in all material respects, with the
requirements described in the report.

This State compliance examination was
conducted by Roth & Co., LLP.

JANE CLARK
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:jgr