STATE EMPLOYEES’ RETIREMENT SYSTEM OF ILLINOIS
For the Year Ended:
June 30, 2009
Summary of Findings:
Total this audit: 1
Total last audit: 2
Repeated from last audit: 0
April 20, 2010
State of Illinois
Office of the Auditor General
WILLIAM G. HOLLAND
To obtain a copy of the Report contact:
Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703
(217) 782-6046 or TTY (888) 261-2887
This Report Digest and Full Report are also available on the worldwide web at http://www.auditor.illinois.gov
This digest covers our compliance attestation examination of the State Employees’ Retirement System of Illinois’ (System) for the year ending June 30, 2009. A financial audit covering the year ending June 30, 2009 was previously released on February 16, 2010. It should be noted that, pursuant to the Illinois Pension Code, investments of the System are managed by the Illinois State Board of Investment. The auditors identified one report finding during their testing.
• The System had not updated its disaster recovery plan since May 2006 and testing of the plan had not been conducted during the examination period.
FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS
LACK OF DISASTER CONTINGENCY PLANNING OR TESTING
The System had not updated its disaster recovery plan since May 2006. For example, the employee roster included retired employees and did not include the current CIO or IT Manager. Additionally, testing of the System’s recovery plan had not been conducted during the examination period.
The System carries out its mission through the use of Information Technology.
System officials stated that although a disaster recovery plan has been in existence for a number of years, the plan had not yet been updated since May 2006, due to the extensive workload on several key management employees in the Administrative Services and Information Technology (IT) Divisions. Two of these key management employees from the IT Division retired as of May 31, 2008.
We recommended the System review and update its plan at least annually or when significant changes occur. The System should perform and document tests of its Plan at least once a year. In addition, the Plan should be continuously updated to reflect environmental changes and improvements identified from tests. (Finding 1, page 7)
System management agreed that an up-to-date Disaster Recovery plan is appropriate. The System will implement a plan to perform and document the tests of the Disaster Recovery plan on at least an annual basis.
We conducted a compliance attestation examination of the System for the year ended June 30, 2009 as required by the Illinois State Auditing Act. The accountants’ report does not contain any scope limitations, disclosures or other significant non-standard language.
WILLIAM G. HOLLAND, Auditor General
SPECIAL ASSISTANT AUDITORS
The public accounting firm of BKD LLP was our special assistant auditor for this engagement.