REPORT DIGEST

OFFICE OF THE STATE TREASURER –
THE ILLINOIS FUNDS

FINANCIAL AUDIT
FOR THE YEAR ENDED JUNE 30, 2019

Release Date:  February 11, 2020

FINDINGS THIS AUDIT:  1

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  0 -- 0 -- 0
Category 2:  0 -- 1 -- 1
Category 3:  0 -- 0 -- 0
TOTAL:  0 -- 1 -- 1

FINDINGS LAST AUDIT: 1

Category 1: Findings that are material
weaknesses in internal control and/or a
qualification on compliance with State laws
and regulations (material noncompliance).
Category 2: Findings that are significant
deficiencies in internal control and
noncompliance with State laws and regulations.
Category 3: Findings that have no internal
control issues but are in noncompliance with
State laws and regulations.

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, Iles Park
Plaza, 740 E. Ash Street, Springfield, IL
62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

SYNOPSIS

• (19-01) The Office did not maintain adequate
controls to ensure all external service
providers’ internal controls were reviewed.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF
EXTERNAL SERVICE PROVIDERS

The Office did not maintain adequate controls
to ensure all external service providers’
internal controls were reviewed.

The Office utilized external service providers
as the custodian of the Illinois Funds Program
and as a payment processors for the E-Pay
program.  All service providers utilized
subservice organizations.  As of June 30,
2019, the net position held in trust for pool
participants was $5.6 billion. The Office did
not establish an adequate process to monitor
its population of service and subservice
providers.  The following issues were
identified during testing:

• Two of six (33%) significant Service
Organization (SOC) reports were not reviewed
timely. The untimely reviews were performed
178 days and 217 days after the SOC report was
issued.

• The Office did not establish adequate
controls to review significant subservice
organizations.  The Office identified eight
subservice organizations as being significant.
Five of eight (63%) significant subservice
organization’s controls were not reviewed.
Two of eight (25%) significant subservice
organization’s controls were not reviewed
timely.  One untimely review did not document
the SOC report issuance date, but the review
was performed approximately 450 days after the
SOC report period end. The other untimely
review was performed approximately 300 days
after the SOC report was issued.  In addition,
for the two untimely reviews, the Office did
not obtain a bridge letter through the fiscal
year end.

• The determination of significant subservice
organizations utilized by one of six (17%)
significant service organizations was not
documented.  (Finding 1, pages 56-57)

We recommended the Office establish an
internal control process to identify all third
party service providers and determine and
document if a review of controls is required.
If required, the Office should:

• Obtain SOC reports or perform independent
reviews of internal controls associated with
outsourced systems at least annually.

• Monitor and document the operation of the
complementary user entity controls relevant to
the Office’s operations.

• Either obtain and review SOC reports for
subservice organizations or perform
alternative procedures to satisfy itself that
the existence of the subservice organization
would not impact its internal control
environment.

• Document its review of the SOC reports in a
timely manner, reviewing all significant
issues with subservice organizations to
ascertain if corrective action plans exist and
when they will be implemented, identifying any
impacts to the Office, and any compensating
controls.

• Review contracts with service providers to
ensure applicable requirements over the
independent review of internal controls are
included.

In addition, we recommended the Office obtain
training for its staff regarding service
organization due diligence procedures.

The Office accepted the recommendation.

AUDITOR’S OPINION

The auditors stated the Office of the
Treasurer, Illinois Funds financial statements
as of and for the year ended June 30, 2019,
are fairly stated in all material respects.

This financial audit was conducted by Crowe
LLP.

JANE CLARK
Division Director

This report is transmitted in accordance with
Section 3-14 of the Illinois State Auditing
Act.

FRANK J. MAUTINO
Auditor General

FJM:sjs