Illinois Criminal Justice Information Authority 2001 Audit

REPORT DIGEST
ILLINOIS CRIMINAL JUSTICE INFORMATION AUTHORITY
FINANCIAL AND COMPLIANCE AUDIT

For the Two Years Ended:
June 30, 2001

Summary of Findings:

Total this audit 3
Total last audit 2
Repeated from last audit 1

Release Date:
April 10, 2002

State of Illinois
Office of the Auditor General

WILLIAM G. HOLLAND

AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General
Attn: Records Manager
Iles Park Plaza
740 E. Ash Street
Springfield, IL 62703

(217) 782-6046 or TDD (217) 524-4646

This Report Digest is also available on
the worldwide web at
http://www.state.il.us/auditor

SYNOPSIS

The Authority has not developed a formal comprehensive disaster contingency plan for its computer systems.

The Authority did not review the maximum fees charged for processing requests for conviction information.

{Expenditures and Activity Measures are summarized on the reverse page.}

ILLINOIS CRIMINAL JUSTICE INFORMATION AUTHORITY
FINANCIAL AND COMPLIANCE AUDIT
For The Two Years Ended June 30, 2001

EXPENDITURE STATISTICS	FY 2001	FY 2000	FY 1999
Total Expenditures (All Funds)	$67,272,304	$59,168,555	$47,053,626
OPERATIONS TOTAL	$10,997,717	$6,637,951	$4,967,278
% of Total Expenditures	16.4%	11.2%	10.6%
Personal Services	$2,235,357	$1,892,744	$1,842,993
% of Operations Expenditures	20.3%	28.5%	37.1%
Average No. of Employees⁽¹⁾	78	68	49
Other Payroll Costs (FICA, Retirement)	$503,284	$424,045	$409,230
% of Operations Expenditures	4.6%	6.4%	8.2%
Contractual Services	$578,670	$562,685	$537,038
% of Operations Expenditures	5.3%	8.5%	10.8%
All Other Operations Items	$7,680,406	$3,758,477	$2,178,017
% of Operations Expenditures	69.8%	56.6%	43.9%
GRANTS TOTAL	$56,274,587	$52,530,604	$42,086,348
% of Total Expenditures	83.6%	88.8%	89.4%
Cost of Property and Equipment	$5,750,782	$6,169,248	$6,324,608

SELECTED ACTIVITY MEASURES	FY 2001	FY 2000	FY 1999
Police Information Management System, Area-Wide Law Enforcement Radio Terminal System, or Automated Law Enforcement Communications System:
Users	363	373	354
User fees expended	$1,471,100	$1,717,400	$1,561,900
Cash Receipts (All Funds)	$77,150,968	$50,975,861	$50,838,053

AGENCY DIRECTOR(S)

During Audit Period: Candice Kane
Currently: Candice Kane

(1) Excludes contractual employees: ’01 - 13; ’00 - 18; ’99 - 36.

Failure to develop a formal comprehensive disaster contingency plan for its computer systems

No annual review of fees

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

NEED TO DEVELOP A DISASTER CONTINGENCY PLAN

The Authority has approximately $5,550,000 of computer equipment, which maintains four critical applications, but the Authority has not developed a formal comprehensive disaster contingency plan to ensure availability of critical computer systems.

The Authority has not identified key components of a contingency plan, such as a recovery site and procurement of replacement equipment. Furthermore, the Authority does not have an alternative power source to safeguard against data loss in the event of a power failure. This finding has been repeated since 1987.

One of the Authority’s critical system applications is to provide local law enforcement officers the ability to retrieve information from their patrol cars relating to the current status of any driver’s license or vehicle in the State of Illinois. The loss of computer services would make these services unavailable (Finding 1, pages 14-16).

We recommended the Authority develop a comprehensive disaster contingency plan to address issues relevant to the continuance of services to users, and analyze alternatives to the necessary systems outside of the control of the Authority.

Authority officials agreed with our recommendation and stated they will pursue a move of their computer operations to an outside location that offers the needed services. (For previous agency responses, see Digest Footnote 1.)

NONCOMPLIANCE WITH UNIFORM CONVICTION INFORMATION ACT

The Authority did not review the maximum fees that other criminal justice agencies charge for processing requests for conviction information as required by the Uniform Conviction Information Act (Act).

This Act requires the Authority to establish the maximum fee and review the fee annually. The maximum fee was established at $16 in calendar year 1998 and has not been reviewed since that time. (Finding 2, pages 17-18)

We recommended that the Authority implement procedures to ensure compliance with the Act or seek legislative remedy regarding statutory requirement.

Authority officials responded they will seek an amendment to the statute in conjunction with amendments to other laws.

OTHER FINDING

The remaining finding is less significant and is reportedly being given attention by Authority management. We will review progress toward implementation of our recommendations in our next audit.

Authority responses to the recommendations were provided by Candice Kane, Executive Director.

AUDITORS’ OPINION

Our auditors state that the financial statements of the Illinois Criminal Justice Information Authority as of June 30, 2001 and June 30, 2000, and for the years then ended are presented fairly in all material respects.

____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:ROQ:ak

SPECIAL ASSISTANT AUDITORS

Our special assistant auditors for this audit were De Raimo, Hillger, & Ripp.

DIGEST FOOTNOTES

#1 FAILURE TO DEVELOP A COMPREHENSIVE DISASTER CONTINGENCY PLAN - Previous Agency Responses

1999: "Accepted. The Authority agrees with the finding and will again attempt to secure funding for a disaster recovery analysis to be performed by one of several organizations that specialize in disaster recovery.

The Authority also recognizes the importance of obtaining an alternative power source, and is exploring four possibilities:

Purchase and install an emergency generator at the Authority that will provide power to the computer room.
Contract with a supplier who will provide the Authority with the delivery and hookup of an emergency generator within a specified period of time after a power outage.
Install an uninterruptible power supply that will allow additional operating time before computer room equipment must be turned off during a power outage. While this option does not address the problem of long-term power outages, it will provide the Authority sufficient power to continue operations during the more common short-term power outages.
Move Authority computer operations to the Illinois State Police Bureau of Identification in Joliet. The computer room at the

Bureau of Identification has both halon fire protection and diesel-generated backup power.

These options, as well as other disaster recovery initiatives, require appropriation of sufficient funds for their implementation. In the current year, $23.6 thousand in General Revenue and $23.6 in Users Fees were approved and will be spent to address some of these issues."

1997: "Accepted. The Authority agrees with the finding and fully recognizes the importance of developing and implementing a complete disaster recovery system, as well as obtaining an alternative power source.

This finding has been included in every audit of the Authority since 1987, and funds have likewise been requested to address the issue in every fiscal year since then. However, such funding has not been approved.

The Authority continues to strengthen its disaster planning and recovery efforts in every area that does not require the expenditure of additional new funds. As such, basic contingency plans, personnel assignments and a recovery strategy to be used in the event of a disaster have already been developed. However, provisions for such items as a backup site and an alternative power source cannot be accommodated without the appropriation of sufficient funds.

An amount of $12.0 thousand was approved by the Administration in fiscal year 1997, specifically to cover the cost of a Disaster Recovery Analysis. In September 1996, the Authority hired a specialist company, "Environmental Systems Design Inc.," (ESD) to perform such an analysis. ESD's completed report detailed its investigation, examined the scope of the problem, documented specific implementation requirements and estimated that full implementation would cost over $700.0 thousand (in calendar 1996 dollars).

Because of the large cost to fully implement this system, a decision was made to seek funding on a multi-year basis. The Authority, therefore, requested $60.0 thousand in its fiscal year 1998 expansion budget, in order to implement some of the study's recommendations that were specifically associated with health and safety issues. Funding was not approved for fiscal year 1998, and $60.0 thousand has once again been requested, in our fiscal year 1999 budget submission, to address this critical issue."

1995: "Accepted. This finding has been included in every audit of the Authority since 1987, and funds have likewise been requested to address the issue in every fiscal year since then. However, such funding has not been approved.

The Authority agrees to strengthen its current disaster planning and recovery efforts in every area that does not require expenditure of additional new funds. Furthermore, the Authority will, to the best of its ability, develop contingency plans, personnel assignments and a recovery strategy to be used in the event of a disaster. However, provisions for such items as a backup site and alternative power source cannot be accommodated without the appropriation of sufficient funds to implement a comprehensive disaster plan.

Given the inability to obtain funds for such a large undertaking, and in order to provide an updated assessment of the scope and cost of such a system, the Authority has included a modest request in their fiscal year 1997 budget submission, to cover the cost of hiring an environmental systems design company, who would investigate and document requirements for implementation of a disaster recovery system. This updated knowledge will enable the Authority to once again request sufficient funding (in today’s dollars) to address this finding."

1993: "The Authority accepts the recommendation and has developed a written plan addressing this issue. However, without specific funding for installation of an uninterruptible power supply, the plan cannot be implemented or tested.

Funds for implementation of a disaster recovery plan were requested in the Authority's FY95 budget and have been denied by the Administration. This represents the Authority’s eighth budget request for funds to implement a disaster recovery plan, all of which have been denied.

During calendar year 1994, the Authority will fully investigate the viability of short-term rental of a generator. We will thus be able to

make an informed decision as to whether, in the event of an emergency, resources can be dedicated to this albeit stop-gap measure."

1991: "Accepted. The Authority is presently developing a written disaster recovery plan. This plan will specify the critical systems, responsible individuals and a schedule of events to perform in the event of a partial or total system failure. The timetable for completion of this plan is November 1992.

In addition, the Authority will investigate the costs for the recommendation of installing an uninterruptible power supply (UPS) and short-term rental of a generator, for use in the event of an emergency.

Funds will continue to be requested, as they have for the past 7 years, in the Authority's FY94 budget submission to implement the written plan."

1989: "The Authority accepts the recommendation and acknowledges the need for a complete disaster recovery plan and system. Funding for a backup power supply has been requested and denied for the past five fiscal years. Funding for such a system was again requested in the FY92 budget submission. The Authority has obtained a disaster recovery planning kit, and the Associate Director, ITU, has received information from vendors on their currently available consulting assistance in developing a disaster recovery plan. Developing and testing such a plan would require additional funding. If funding is made available, the Authority will develop and test a disaster recovery plan."

1987: "The Authority is fully cognizant of the need for a disaster recovery plan (as required by law), and has requested funding for such a system during each of the previous three fiscal years. On each occasion, such funding has been denied. During FY89, preliminary planning will be carried out to examine the areas required in the Authority’s Disaster Recovery efforts. Various policies and procedures will be put into place, which do not require additional funding.

Funding for an extensive survey will again be requested in FY90 for an experienced consultant who can understand the Authority's network and needs in this area. Such a consulting company could then design a Disaster Recovery plan for the Authority’s network of computer systems. If funded, items specified in the plan would be implemented and installed. Disaster Recovery items might include uninterruptible power supplies (UPS), setup of a remote "hot site" with additional equipment and telecommunications equipment to duplicate the Authority’s equipment. Copies of the Disaster Recovery plan, programs, and manuals will be stored off-site."