REPORT DIGEST

ILLINOIS DEPARTMENT OF PUBLIC HEALTH

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2017

Release Date:  August 15, 2018

FINDINGS THIS AUDIT:  28

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  1 -- 4 -- 5
Category 2:  9 -- 14 -- 23
Category 3:  0 -- 0 -- 0
TOTAL:  10 -- 18 -- 28

FINDINGS LAST AUDIT: 24

Category 1: Findings that are material
weaknesses in internal control and/or a
qualification on compliance with State laws
and regulations (material noncompliance).
Category 2: Findings that are significant
deficiencies in internal control and
noncompliance with State laws and
regulations.
Category 3: Findings that have no internal
control issues but are in noncompliance
with State laws and regulations.

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, Iles Park
Plaza, 740 E. Ash Street, Springfield, IL
62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

SYNOPSIS

• (17-01) The Department did not exercise
adequate internal controls over its
commodities inventories.
• (17-02) The Department did not have
adequate controls over its purchased and
leased computer equipment.
• (17-03) The Department did not maintain
adequate controls over its property and
related records.
• (17-17) Controls were not maintained over
the administration of State vehicles.
• (17-24) The Department did not comply
with the MC/DD Act.
• (17-28) The Department failed to ensure
the Vaccines for Children program was
providing proper reimbursement to the
Centers for Disease Control.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

INADEQUATE INTERNAL CONTROLS OVER
COMMODITIES

The Department did not exercise adequate
internal controls over its commodities
inventories. The Department reported a
commodities inventory balance of $5,574,641
at June 30, 2017.

During testing, we noted nine of 22 (41%)
Department programs or divisions did not
report the dollar amount of their
commodities inventory in the June 30
balance.

Due to these conditions, the accountants
were unable to conclude the Department’s
population records were sufficiently
precise and detailed under the Attestation
Standards promulgated by the American
Institute of Certified Public Accountants
(AT-C § 205.35) to test the Department’s
commodities inventories.  (Finding 1, page
16) This finding has been repeated since
2013.

We recommended the Department implement
procedures to maintain records of its
complete commodities inventories to ensure
accurate accounting records and reports.

Department officials concurred with the
finding and stated the Department will
implement procedures to strengthen internal
controls over the reporting of commodities
inventories.  They further stated, in an
effort to accurately report commodities
inventories, all programs will be advised
of the importance of ensuring that June 30
balances are reported. (For the previous
Department response, see Digest Footnote
#1.)

INADEQUATE CONTROLS OVER COMPUTER INVENTORY

The Department did not have adequate
controls over its purchased and leased
computer equipment.

During our review of the Department’s
computer equipment inventory for the Fiscal
Years 2016 and 2017, we noted the
following:

• The Department was unable to locate 25
desktop computers and 10 laptop computers
during its annual inventories.  The
Department conducts an annual physical
inventory of all equipment with an
acquisition cost of $500 or more and
reported it was unable to locate missing
computer inventory totaling $16,019 in
Fiscal Year 2016 and $20,746 in Fiscal Year
2017.

• The Department did not perform a detailed
assessment at the time the computers could
not be located; and, therefore, had not
determined whether the missing computers
may have contained confidential
information.

• The Department did not have a policy for
clearing data and software from computer
equipment before transfer either outside or
within the Department.

• The Department did not maintain updated
purchased and leased computer inventory
listings. The computer inventory listing
included surplused computers.  Twelve of 12
(100%) purchased computers tested were
already in surplus, but the items were
still listed in the Department’s computer
inventory.   Three of 25 (12%) leased
computers tested could not be located
because the list was not updated with the
correct location.  Auditors noted five
stolen/lost laptops were not removed from
the leased computer inventory listing.
(Finding 2, pages 17-18)  This finding has
been repeated since 2011.

We recommended the Department perform a
detailed inventory of computer equipment to
ensure accuracy and determine whether
confidential information is stored on each
unit. We also recommended the Department
establish procedures to immediately assess
if a computer may have contained
confidential information whenever it is
reported lost, stolen or missing during the
annual physical inventory, and document the
results of the assessment.  Further, we
recommended the Department establish
policies and procedures to ensure
compliance with the Data Security on State
Computers Act.

Department officials concurred with the
finding and stated due to the rapid staff
turnover, the Department was without a
Property Coordinator for the majority of
the Fiscal Year 2016 inventory period.
Since hiring a new coordinator, the
individual has worked diligently to clean
up and maintain better control on the areas
listed in this finding.  Department
officials also stated the Department has
been working with DCMS to have them sign
and return surpluses in a timely manner and
are developing improved procedures and
documents, so the Location Coordinators can
have better instruction, guidance, and more
responsibility for the equipment assigned
to them.  (For the previous Department
response, see Digest Footnote #2.)

PROPERTY CONTROL WEAKNESSES

The Department did not maintain adequate
controls over its property and related
records.   Some of the conditions noted
included:

• For 12 of 60 (20%) property deletions
tested, totaling $64,608, the Department
did not maintain the required detailed
supporting documentation.  In addition,
four of 60 (7%) property deletions tested,
totaling $16,557, were assigned improper
transaction codes.

• Five of 60 (8%) deletions tested,
totaling $13,419, lacked documentation of
the approval by the DCMS’s Property Control
Division.

• Eight of 120 (7%) items tested did not
have a property tag.

• Thirteen of 60 (22%) items tested during
the physical inspection were not recorded
in the property records.

• No cost was recorded in the property
records for 48 equipment items purchased in
May 2017 as of June 30, 2017.

In addition, during testing, copies of the
Accounting for Leases-Lessee (SCO-560)
Forms submitted to the Office of the
Comptroller’s during Fiscal Years 2017 and
2016 were not provided to the accountants.

Due to these conditions, the accountants
were unable to conclude the Department’s
population records were sufficiently
precise and detailed under the Attestation
Standards promulgated by the American
Institute of Certified Public Accountants
(AT-C § 205.35) to test the Department’s
capital lease assets.  In addition, due to
these limitations, the accountants were
unable to conclude the Department’s
Schedule of Changes in State Property on
page 111 was complete and appropriately
reported. (Finding 3, pages 19-22)  This
finding has been repeated since 2013.

We recommended the Department designate
sufficient trained backup staff and
strengthen procedures over property and
equipment to ensure timely and accurate
recordkeeping for all State assets.  We
further recommended the Department include
a supervisory review process in its
procedures to ensure clerical, technical,
and other errors are promptly detected and
corrected. In addition, we recommended the
Department regularly survey inventories for
transferable equipment and report any such
equipment to the Property Control Division
of DCMS.  Assets that are obsolete, damaged
or unused should be identified and, if
necessary, removed from the Department’s
records.

Department officials concurred with the
finding and stated due to the rapid staff
turnover, the Department was without a
Property Coordinator for the majority of
the Fiscal Year 2016 inventory period.
Since hiring a new coordinator, the
individual has worked diligently to clean
up and maintain better control on the areas
listed in this finding.  Department
officials also stated the Department has
been working with DCMS to have them sign
and return surpluses in a timely manner and
is developing improved procedures and
documents so the Location Coordinators can
have better instruction, guidance, and more
responsibility for the equipment assigned
to them.  (For the previous Department
response, see Digest Footnote #3.)

INADEQUATE CONTROLS OVER THE ADMINISTRATION
OF STATE VEHICLES

The Department did not have adequate
controls over the reporting of vehicle
accidents, fringe benefits for personal use
of State vehicles, changes to vehicle
assignments, maintaining vehicle records,
or obtaining annual certifications of
license and vehicle liability coverage.

Some of the conditions noted include the
following:

• The Department was unable to provide
supporting documentation showing submission
of two of nine (22%) vehicle accident
reports reviewed to the Department of
Central Management Services (DCMS).

• Thirty-four of 37 (92%) vehicles tested
received oil changes 1,300 to 12,000 miles
or one to four months past the allowed oil
change interval;

• For seven of 37 (19%) employees tested
who were assigned State vehicles, the
Department was unable to provide
justification for the commuting miles of
more than 30% of the vehicle’s total
mileage.  Five of these employees had
commuting miles that ranged from 2,243 to
4,814 miles or 32% to 53% of the vehicles’
total mileage during Fiscal Year 2016.  Two
employees had commuting miles of 3,447 and
4,832 miles or 34% and 42% of the vehicles’
total mileage during Fiscal Year 2017.

• The Fiscal Year 2017 Annual Report on
Individually Assigned Vehicles was not
fully completed and timely submitted to
DCMS.  An incomplete report, lacking
required details and management
certifications, was submitted 35 days late.
(Finding 17, pages 52-56)  This finding has
been repeated since 2007.

We recommended the Department:

• Designate and train sufficient;
• Monitor the submission of accident
reports;
• Enforce vehicle maintenance schedules;
• Ensure proper reporting of fringe
benefits;

• Review and enforce procedures over the
timely filing of annual license and
liability insurance certifications; and
• Remind staff and monitor to ensure timely
reporting of employee vehicle changes and
the annual report on Individually Assigned
Vehicles.

Department officials concurred with the
finding and stated the new Agency Vehicle
Coordinator was assigned duties and
responsibilities for vehicles on December
16, 2016, a time frame for the last six
months of the audit cycle.  Since that
timeframe, the new Vehicle Coordinator has
been in communication with the program
offices to timely receive and monitor
information relative to vehicle maintenance
and inspection schedules.  (For the
previous Department response, see Digest
Footnote #4.)

NONCOMPLIANCE WITH THE MC/DD ACT

The Department did not comply with
provisions of the MC/DD Act (Act).    The
Act, effective July 29, 2015, required
long-term care facilities for individuals
under age 22 to be known and licensed as
medically complex for the developmentally
disabled under the Act instead of the
Intermediate Care Facility/Individual
Intellectually Disabled (ID/DD) Community
Care Act.

Some of the conditions noted included:

• The Administrative Code was not updated
to address the requirement that each policy
should include periodic review of the use
of restraints.

• The Department did not develop a de-
identified database of residents who have
injured facility staff, facility visitors,
and other residents.

• The Department did not file emergency
rules with the Office of the Secretary of
State’s (Office) regarding the provision of
services to identified offenders.
(Finding 24, pages 71-73)

We recommended the Department ensure it
complies with all provisions of the Act.

Department officials concurred with the
finding and stated the Department is
currently working on the rules to be
drafted to meet the provision of the Act
and working with industry providers who are
seeking legislative remedy by repealing
appropriate language to ensure the
Department’s compliance.

INSUFFICIENT REIMBURSEMENTS FOR THE
VACCINES FOR CHILDREN PROGRAM

The Department failed to ensure the
Vaccines for Children (VFC) program was
providing proper reimbursements to the
Centers for Disease Control (CDC).

The Department notified auditors on May 2,
2018 of its responsibility to replace
vaccine doses to the CDC which was
subsequent to the auditor’s original report
date, April 27, 2018.

The VFC program is a federally-funded
program that provides vaccines at no cost
to children ages 18 and younger who might
not otherwise be vaccinated because of the
inability to pay.  In order to utilize the
VFC’s vaccine distribution infrastructure
for the State-funded Children Health
Insurance Program (CHIP), the Department
and the Department of Healthcare and Family
Services (HFS) entered into an
Intergovernmental Agreement (Agreement)
beginning July 1, 2012, subject to an
annual amendment, that allowed HFS to
reimburse the Department for vaccines used
for the CHIP program based on the actual
costs of vaccines used and handling fees.
This Agreement was terminated October 1,
2016.

As of the end of fieldwork, the Department
continued to negotiate with the CDC over
the specific terms of replacement, and
estimates it will need to replace 502,190
vaccines doses totaling $24,161,267 over a
seven year period.  The Department
submitted a replacement plan for approval
to the CDC on June 5, 2018. (Finding 28,
pages 82-85)

We recommended the Department monitor its
programs to ensure all parties involved are
following the required provisions. We also
recommended the Department ensure it
complies with an approved vaccine
replacement plan as required.

Department officials concurred with our
recommendation.

OTHER FINDINGS

The remaining findings are reportedly being
given attention by the Department.  We will
review the Department’s progress toward the
implementation of our recommendations
during our next examination.

ACCOUNTANT’S REPORT

The accountants conducted a compliance
examination of the Department for the two
years ended June 30, 2017, as required by
the Illinois State Auditing Act.  The
auditors qualified their report on State
Compliance for findings 2017-001, 2017-002,
2017-003, 2017-017 and 2017-028.  Except
for the noncompliance described in these
findings, the auditors state the Department
complied, in all material respects, with
the requirements described in the report.

The compliance examination was conducted by
E.C. Ortiz & Co., LLP.

JANE CLARK
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:ph

DIGEST FOOTNOTES

#1 – Weakness in Controls Over Year-End
Inventory Balances - Previous Department
Response

2015:  The Department concurs with the
finding. Warehouse space is limited, which
causes an inability to store all inventory
items being overlooked when conducting the
warehouse inventory. One step OHP staff in
the Sexually Transmitted Diseases (STD)
Section has taken to avoid overstatement of
inventory items is to compare inventory
counts with prior years’ counts. Large
discrepancies will be investigated and the
count will be performed again to ensure
accuracy. In addition, the OHP Division of
Laboratories is currently working on a
solution to better track inventories.
Currently, the Springfield Laboratory is
evaluating a software solution designed to
monitor supplies. This software is a free
web-based service which is accessible from
an internet-connected device. The Division
of Laboratories is also developing a
standard operating procedure (SOP) to
direct laboratory supervisors to use a
consistent methodology for inventory
maintenance. Depending on the results of
the software pilot in Springfield, use of
that system may be incorporated into the
SOP.

#2 - Inadequate Controls over Computer
Inventory – Previous Department Response

2015:  The Department concurs with the
finding. The Department is currently
performing an inventory audit of existing
PC’s and is working with the IT
Coordinators. In order to address this
finding, IDPH will revise and update its IT
Directives and Guidance to reiterate and
reinforce the existing requirement that
storage of data that may contain sensitive
or personally identifiable information on a
device drive requires written permission
from the agency Chief Information Officer
(CIO). Additionally, IDPH will develop a
survey document to identify the agency
programs where sensitive and/or personally
identifiable information would be likely to
be accessed as a part of programmatic
activities. The Department will purchase
and provide to the IT coordinators for
those identified programs, software to wipe
the drive of any electronic data processing
equipment utilized in those identified
programs and will require as a part of the
process that the IT coordinators wipe those
computers prior to transfer or surplus. The
Department will continue to complete a CMS
Enterprise Service Request (ESR) to surplus
equipment which is collected by Central
Management Services.  Central Management
Services has implemented a policy to
mandate that all hard drives of surplus
electronic data processing equipment be
erased, wiped, sanitized, or destroyed in a
manner that prevents retrieval of sensitive
data and software before being sold,
donated, or transferred. The Department
will ensure they receive the certificates
back from CMS documenting the hard drive
has been wiped. While the Department’s
continued control will be to ensure an ESR
is completed by authorized Department staff
in order to surplus or transfer equipment
(etc. an IT Coordinator or IT Security
Staff), the added layer of identification
and erasure of all data from devices
utilized in program areas where sensitive
data may be utilized will further ensure
compliance with the requirements identified
in the finding. Current practices covered
under the “Guidance 07-01, 03/27/2012
Information Technology (IT) Policies” and
“Division of Information Technology Surplus
Inventory Procedures” will be reviewed and
revised, as necessary, to enhance and
reduce or prevent the theft or loss of
computers. Changes to existing guidelines
or practices for PC transfers, surplus, or
storing of sensitive data on PC’s will be
documented and communicated to the IT
Coordinators.

#3- Inaccurate Property and Fixed Asset
Record Keeping – Previous Department
Response

2015:  The Department concurs with the
finding. The finding regarding the
Department’s not maintaining accurate
property and fixed asset records is driven
by the limitations associated with only
having one individual dedicated to the
Property Control function for several
dispersed locations and the extended
vacancy in that position, as well as the
accountability for ensuring the adequacy of
the annual inventory submission not being
placed at a high enough level to reinforce
the importance of the exercise.

Because of the extended vacancy in the
Property Control Coordinator position,
efforts to complete property transfer forms
were not prioritized given the Unit
Manager’s primary responsibilities and the
associated changes were sometimes not
incorporated into the inventory system. Now
the Coordinator position has been filled
and new management has taken over at both
the Unit-level and Deputy Director-level,
during the learning process, gaps in the
process have been identified and improved.
Enhanced and standardized procedures are in
the process of being documented such that
the Property Control Liaisons for each
location can eventually be trained on the
new requirement. In doing so,
accountability can be enforced. In fact,
accountability enhancements began with the
annual inventory currently in process,
whereby the respective Deputy Director for
each location was required to sign off on
their inventory submissions for the first
time.

In an effort to minimize the number of
discrepancies discovered at the end of the
year when the annual inventory is
conducted, the new procedures developed
will require Property Control Liaisons at
the various locations to submit quarterly
assessments regarding the disposition of
individual assets valued at $10,000 or
more.

#4- Inadequate Controls over the
Administration of State Vehicles – Previous
Department Response

2015:  The Department concurs with the
finding.  In response to the finding that
controls over reporting of vehicle
accidents, fringe benefits for personal use
of State vehicles, changes to vehicle
assignments, maintaining vehicle records,
or obtaining annual certifications of
license and vehicle liability coverage, the
Department acknowledges these findings and
is putting in place the following changes
that resulted from previously noted
staffing constraints and inadequate
communications between all parties
involved.
• Reassignment of Vehicle Coordinator
responsibilities to the Department’s Travel
Coordinator given the logical synergies
between the two functions and the
observation by the new Deputy Director for
Finance and Administration that the
workload of the previous Vehicle
Coordinator when combined with this
individual’s extended leave may have
impacted the deficiencies noted in this
audit.
• Development of a revised Vehicle Policy
that indicates in detail the Department’s
implementation of the Statewide vehicle
requirements, with documented receipt of
the revised policy to all individuals with
individually assigned vehicles, and posting
of the revised  policy on the Department’s
intranet for all others. Included in the
revised policy will be the following:
• Standardization of the monthly vehicle
usage report forms and timely follow up on
missing submissions with notification to
the associated staff member’s Deputy
Director of delinquencies which should
facilitate more timely consolidation of
information for annual reports to be
submitted to CMS by stated deadline.
• Vehicle reassignment procedures and final
sign off by the Vehicle Coordinator.
• Accident reporting requirements with
stated documentation required and timelines
for various requirements and individuals
and external entities that must be advised.
• Log to track notification of required
maintenance and documentation to confirm
maintenance has been conducted for
inclusion in the vehicle’s file.
• Flow of commuting mileage, i.e. Vehicle
Coordinator to advise Payroll to ensure
consistency.
• Senior management is also considering
whether several of the vehicles where
commuting miles exceed the 30% usage level
should be converted to pool vehicles for a
more effective use of limited assets given
statewide demand for vehicles during this
economically challenging period.