REPORT DIGEST

REPORT DIGEST

ILLINOIS CRIMINAL JUSTICE INFORMATION AUTHORITY

COMPLIANCE AUDIT

For the Two Years Ended:

June 30, 2003

Summary of Findings:

Total this audit 3

Total last audit 3

Repeated from last audit 2

Release Date:

February 26, 2004

State of Illinois

Office of the Auditor General

WILLIAM G. HOLLAND

AUDITOR GENERAL

To obtain a copy of the Report contact:

Office of the Auditor General

Iles Park Plaza

740 E. Ash Street

Springfield, IL 62703

(217) 782-6046 or TDD (217) 524-4646

This Report Digest is also available on

the worldwide web at

http://www.state.il.us/auditor

SYNOPSIS

The Authority has not developed a formal comprehensive disaster contingency plan for its computer systems.

The Authority did not timely file its GAAP Reporting Package with the Office of the Comptroller.

{Expenditures and Activity Measures are summarized on the reverse page.}

ILLINOIS CRIMINAL JUSTICE INFORMATION AUTHORITY

COMPLIANCE AUDIT

For The Two Years Ended June 30, 2003

EXPENDITURE STATISTICS	FY 2003	FY 2002	FY 2001
Total Expenditures (All Funds)	$85,194,319	$78,193,134	$67,272,304
OPERATIONS TOTAL	$6,092,933	$4,839,412	$4,828,406
% of Total Expenditures	7.2%	6.2%	7.2%

Personal Services	$2,496,342	$2,327,644	$2,245,808
% of Operations Expenditures	41.0%	48.1%	46.5%
Average No. of Employees⁽¹⁾	82	81	78

Other Payroll Costs (FICA, Retirement)	$598,899	$543,697	$503,284
% of Operations Expenditures	9.8%	11.2%	10.4%

Contractual Services	$705,074	$541,711	$578,670
% of Operations Expenditures	11.6%	11.2%	12.0%

All Other Operations Items	$2,292,618	$1,426,360	$1,500,644
% of Operations Expenditures	37.6%	29.5%	31.1%

GRANTS TOTAL	$79,101,386	$73,353,722	$62,443,898
% of Total Expenditures	92.8%	93.8%	92.8%
Cost of Property and Equipment	$5,565,055	$5,632,304	$5,750,782

SELECTED ACTIVITY MEASURES	FY 2003	FY 2002	FY 2001
Police Information Management System, Area-Wide Law Enforcement Radio Terminal System, or Automated Law Enforcement Communications System:
Users	319	340	363
User fees expended	$2,881,800	$1,933,200	$1,471,100
Cash Receipts (All Funds)	$69,409,295	$70,558,764	$77,150,968
⁽¹⁾Excludes contractual employees: ’03 - 14; ’02 - 14; ’01 - 13.

AGENCY DIRECTOR(S)

During Audit Period: Candice Kane

Currently: Lori Levin

Failure to develop a formal comprehensive disaster contingency plan for its computer systems

Reporting forms were filed between 17- 28 business days late

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

NEED TO DEVELOP A DISASTER CONTINGENCY PLAN

The Authority has approximately $5.1 million of computer equipment, which maintains four critical applications, however the Authority has not developed a formal comprehensive disaster contingency plan to ensure availability of critical computer systems.

The Authority has not identified key components of a contingency plan, such as a recovery site and procurement of replacement equipment. Furthermore, the Authority does not have an alternative power source to safeguard against data loss in the event of a power failure. This finding has been repeated since 1987.

One of the Authority’s critical system applications is to provide local law enforcement officers the ability to retrieve information from their patrol cars relating to the current status of any driver’s license or vehicle in the State of Illinois. The loss of computer services would make these services unavailable. (Finding 1, pages 9-11)

We recommended the Authority develop a comprehensive disaster contingency plan to address issues relevant to the continuance of services to users, and analyze alternatives to the necessary systems outside of the control of the Authority.

Authority officials agreed with our recommendation and stated that additional funding will be necessary to continue their current efforts. (For previous agency responses, see Digest Footnote 1.)

FAILURE TO TIMELY FILE GAAP REPORTING PACKAGE

The Authority failed to file the fiscal year 2003 State of Illinois GAAP Reporting Package on a timely basis with the Office of the Comptroller.

The Office of the Comptroller required the Authority to submit the GAAP Reporting Package for the General Revenue Fund and Proprietary Funds by August 29. All other funds were required to be submitted by August 22. The Authority filed the different fund forms 17 to 28 business days late. (Finding 3, pages 15-16)

We recommended that the Authority review procedures and staffing to ensure timely reporting to the Office of the Comptroller.

Authority officials stated that they accept this finding and that due to staff shortages it was necessary for the GAAP Coordinator to assume other duties. The Authority also noted delays occurred in reaching agreements with other agencies regarding sub-grantee disbursements of federal funds.

OTHER FINDING

The remaining finding is less significant and is reportedly being given attention by Authority management. We will review progress toward implementation of our recommendations in our next audit.

Authority responses to the recommendations were provided by Ted Miller, Associate Director, Fiscal Management.

AUDITORS’ OPINION

We conducted a compliance audit of the Illinois Criminal Justice Information Authority for the two years ended June 30, 2003 as required by the Illinois State Auditing Act. We have not audited any financial statements of the Authority for the purpose of expressing an opinion because the Authority does not, nor is it required to, prepare financial statements.

____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:TLK:pp

SPECIAL ASSISTANT AUDITORS

Our special assistant auditors for this audit were De Raimo, Hillger, & Ripp.

DIGEST FOOTNOTES

#1 FAILURE TO DEVELOP A COMPREHENSIVE DISASTER CONTINGENCY PLAN - Previous Agency Responses

2001: "Accepted. After analysis of our options, the Authority has decided to pursue a move of our computer operations to an outside location that offers needed services. Requests for proposals (RFPs) will be sent out in the near future to determine the best location for operations. Specifications of the RFP will require halon fire protection and an uninterruptible power source. The Authority requested appropriation authority in Fiscal Year 2003 budget from the Users Fund to cover the costs of the relocation of computer operations."

1999: "Accepted. The Authority agrees with the finding and will again attempt to secure funding for a disaster recovery analysis to be performed by one of several organizations that specialize in disaster recovery.

The Authority also recognizes the importance of obtaining an alternative power source, and is exploring four possibilities:

Purchase and install an emergency generator at the Authority that will provide power to the computer room.
Contract with a supplier who will provide the Authority with the delivery and hookup of an emergency generator within a specified period of time after a power outage.
Install an uninterruptible power supply that will allow additional operating time before computer room equipment must be turned off during a power outage. While this option does not address the problem of long-term power outages, it will provide the Authority sufficient power to continue operations during the more common short-term power outages.
Move Authority computer operations to the Illinois State Police Bureau of Identification in Joliet. The computer room at the

Bureau of Identification has both halon fire protection and diesel-generated backup power.

These options, as well as other disaster recovery initiatives, require appropriation of sufficient funds for their implementation. In the current year, $23.6 thousand in General Revenue and $23.6 in Users Fees were approved and will be spent to address some of these issues."

1997: "Accepted. The Authority agrees with the finding and fully recognizes the importance of developing and implementing a complete disaster recovery system, as well as obtaining an alternative power source.

This finding has been included in every audit of the Authority since 1987, and funds have likewise been requested to address the issue in every fiscal year since then. However, such funding has not been approved.

The Authority continues to strengthen its disaster planning and recovery efforts in every area that does not require the expenditure of additional new funds. As such, basic contingency plans, personnel assignments and a recovery strategy to be used in the event of a disaster have already been developed. However, provisions for such items as a backup site and an alternative power source cannot be accommodated without the appropriation of sufficient funds.

An amount of $12.0 thousand was approved by the Administration in fiscal year 1997, specifically to cover the cost of a Disaster Recovery Analysis. In September 1996, the Authority hired a specialist company, "Environmental Systems Design Inc.," (ESD) to perform such an analysis. ESD's completed report detailed its investigation, examined the scope of the problem, documented specific implementation requirements and estimated that full implementation would cost over $700.0 thousand (in calendar 1996 dollars).

Because of the large cost to fully implement this system, a decision was made to seek funding on a multi-year basis. The Authority, therefore, requested $60.0 thousand in its fiscal year 1998 expansion budget, in order to implement some of the study's recommendations that were specifically associated with health and safety issues. Funding was not approved for fiscal year 1998, and $60.0 thousand has once again been requested, in our fiscal year 1999 budget submission, to address this critical issue."

1995: "Accepted. This finding has been included in every audit of the Authority since 1987, and funds have likewise been requested to address the issue in every fiscal year since then. However, such funding has not been approved.

The Authority agrees to strengthen its current disaster planning and recovery efforts in every area that does not require expenditure of additional new funds. Furthermore, the Authority will, to the best of its ability, develop contingency plans, personnel assignments and a recovery strategy to be used in the event of a disaster. However, provisions for such items as a backup site and alternative power source cannot be accommodated without the appropriation of sufficient funds to implement a comprehensive disaster plan.

Given the inability to obtain funds for such a large undertaking, and in order to provide an updated assessment of the scope and cost of such a system, the Authority has included a modest request in their fiscal year 1997 budget submission, to cover the cost of hiring an environmental systems design company, who would investigate and document requirements for implementation of a disaster recovery system. This updated knowledge will enable the Authority to once again request sufficient funding (in today’s dollars) to address this finding."

1993: "The Authority accepts the recommendation and has developed a written plan addressing this issue. However, without specific funding for installation of an uninterruptible power supply, the plan cannot be implemented or tested.

Funds for implementation of a disaster recovery plan were requested in the Authority's FY95 budget and have been denied by the Administration. This represents the Authority’s eighth budget request for funds to implement a disaster recovery plan, all of which have been denied.

During calendar year 1994, the Authority will fully investigate the viability of short-term rental of a generator. We will thus be able to

make an informed decision as to whether, in the event of an emergency, resources can be dedicated to this albeit stop-gap measure."

1991: "Accepted. The Authority is presently developing a written disaster recovery plan. This plan will specify the critical systems, responsible individuals and a schedule of events to perform in the event of a partial or total system failure. The timetable for completion of this plan is November 1992.

In addition, the Authority will investigate the costs for the recommendation of installing an uninterruptible power supply (UPS) and short-term rental of a generator, for use in the event of an emergency.

Funds will continue to be requested, as they have for the past 7 years, in the Authority's FY94 budget submission to implement the written plan."

1989: "The Authority accepts the recommendation and acknowledges the need for a complete disaster recovery plan and system. Funding for a backup power supply has been requested and denied for the past five fiscal years. Funding for such a system was again requested in the FY92 budget submission. The Authority has obtained a disaster recovery planning kit, and the Associate Director, ITU, has received information from vendors on their currently available consulting assistance in developing a disaster recovery plan. Developing and testing such a plan would require additional funding. If funding is made available, the Authority will develop and test a disaster recovery plan."

1987: "The Authority is fully cognizant of the need for a disaster recovery plan (as required by law), and has requested funding for such a system during each of the previous three fiscal years. On each occasion, such funding has been denied. During FY89, preliminary planning will be carried out to examine the areas required in the Authority’s Disaster Recovery efforts. Various policies and procedures will be put into place, which do not require additional funding.

Funding for an extensive survey will again be requested in FY90 for an experienced consultant who can understand the Authority's network and needs in this area. Such a consulting company could then design a Disaster Recovery plan for the Authority’s network of computer systems. If funded, items specified in the plan would be implemented and installed. Disaster Recovery items might include uninterruptible power supplies (UPS), setup of a remote "hot site" with additional equipment and telecommunications equipment to duplicate the Authority’s equipment. Copies of the Disaster Recovery plan, programs, and manuals will be stored off-site."