REPORT DIGEST DEPARTMENT OF JUVENILE JUSTICE COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED: JUNE 30, 2016 Release Date: May 25, 2017 FINDINGS THIS AUDIT: 17 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 7 -- 10 -- 17 Category 3: 0 -- 0 -- 0 TOTAL: 7 -- 10 -- 17 FINDINGS LAST AUDIT: 16 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (16-01) The Department has not segregated certain aspects of its administrative processes from the Department of Corrections. • (16-02) The Department did not exercise adequate controls over maintaining, recording, and reporting its State property and equipment. • (16-04) The Department did not have project management controls and had not ensured the development process over Youth 360 was controlled and documented. • (16-06) The Youth Centers of the Department inadequately administered locally held funds (bank accounts) during the examination period. • (16-10) The Department failed to maintain adequate administration of confinement, grievances, and discipline policies at the Youth Centers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS ADMINISTRATIVE PROCESSES NOT FULLY SEGREGATED The Department has not segregated certain aspects of its administrative processes from the Department of Corrections (DOC) as intended by the Uniform Code of Corrections (Code). During testing, the auditors noted the following: • The Department places an overreliance on DOC’s property record system. • While the Department has made progress towards updating the Administrative Directives (AD) established by the DOC to be specific to the Department’s unique purpose and mission, 260 of 440 (59%) ADs have effective dates prior to the establishment of the Department. • The Department did not adequately monitor the administrative services provided by the DOC. • The Department was using real property where it was not a party to the written agreement. • The Department’s Joliet Youth Center had significant improvements being made for the benefit and use of DOC. (Finding 1, pages 11-13) This finding was first reported in 2008. We recommended the Department accelerate its efforts to segregate its books and records from those of the DOC to comply with the Code. Additionally, we recommended the Department improve its monitoring of the administrative services provided by the DOC to ensure the Department’s administrative responsibilities are being fulfilled. Department officials accepted the recommendation and stated the Department is working to update the Shared Services agreement with the DOC, secure adequate funding to hire personnel capable of providing adequate oversight, ensure separations of duties where and when appropriate, and properly document the transition of certain property if appropriate. (For the previous Department response, see Digest Footnote #1.) INACCURATE AND INADEQUATE EQUIPMENT AND CAPITAL ASSET RECORDKEEPING The Department did not exercise adequate controls over maintaining, recording, and reporting of its State property and equipment. Some of the more significant issues noted by the auditors included the following: • The Department did not update its inventory records within 30 days of acquiring, changing, or deleting equipment items. • The Department was unable to locate six items, totaling $10,651, selected from the Department’s records. • The Department did not have adequate controls over maintaining its inventory records. • The Department did not accurately report information on its quarterly Agency Report of State Property. • The Department had several unused, condemned, or worn down buildings in need of repairs, demolition, or significant improvements. • The Kewanee and St. Charles Youth Centers did not use equipment items purchased through grants. The noted items at Kewanee were for trades training and were still in their original boxes from when the items were received in October 2014. St. Charles had items from two separate grants, one for culinary arts and one for trades training. (Finding 2, pages 14-18) This finding was first reported in 2008. We recommended the Department take action to strengthen its controls over maintaining, recording, and reporting its State property and equipment by reviewing its inventory and recordkeeping practices to ensure compliance with State laws and regulations. We also recommended the Department ensure all equipment is accurately and timely recorded on the Department’s property records. Department officials accepted the recommendation. (For the previous Department response, see Digest Footnote #2.) LACK OF PROJECT MANAGEMENT OVER YOUTH 360 PROJECT The Department did not have project management controls and had not ensured the development process over Youth 360 was controlled and documented. During testing, the auditors requested documentation in order to determine if Youth 360 had been developed to meet State requirements and youth offender records were completely and accurately migrated from legacy applications. Specifically, the auditors noted: • A project management framework had not been developed to ensure the development met the Department’s requirements. • The Department had not entered into an agreement with the Department of Corrections outlining the roles and responsibilities of both parties. • The Department had not established controls to ensure the vendor’s cloud computing environment was sufficient to promote security, integrity, and availability of its applications and data. • The Department had embarked on the development of Youth 360 in order to maintain youth offender records, including the calculation of the youth’s release date. However, due to incorrect logic regarding the custody date, the length of the sentence, and the complexity of youth sentencing laws, Youth 360 did not correctly calculate the release date. • Approximately 90.1 million adult offender, youth offender, and visitor records were migrated from the legacy applications; however, the Departments did not provide documentation to ensure the accuracy and adequacy of the data migration from the legacy applications to the Offender and Youth 360 application. In fact, the Data Migration Staging Database indicated a significant number of records did not migrate accurately. • User access rights to Youth 360 were not periodically reviewed, timely deactivated, and always appropriate based on job duties. (Finding 4, pages 21-23) We recommended the Department: • Develop and implement project management controls to ensure projects are appropriately managed and adequately monitored and documented. • Enter into an agreement with the Department of Corrections which outlines both parties’ roles and responsibilities. • Establish controls to ensure the vendor’s cloud computing environment is sufficient to promote security, integrity and availability of its applications and data. Furthermore, the Department should ensure roles and responsibilities regarding the security of the environment and the Department’s data are outlined in the contract or Service License Agreement with the cloud computing service provider. • Ensure adequate testing is conducted and documentation is maintained to support the complete and accurate migration of data. • Ensure Youth 360 is meeting all requirements of the Department, including the calculation of each youth’s release date. • Periodically review access rights and ensure only individuals with applicable job responsibilities have access to Youth 360. Department officials accepted the recommendation and stated they will make every effort to ensure the security, integrity, and availability of its applications and data. Additionally, the Department will continue to work to ensure projects are managed, monitored, and documented adequately. INADEQUATE ADMINISTRATION OF LOCALLY HELD FUNDS AT YOUTH CENTERS The Youth Centers of the Department inadequately administered locally held funds (bank accounts) during the examination period. During testing of the Department’s Juvenile Justice Travel and Allowance Fund (Travel and Allowance Fund), Juvenile Justice Inmate Trust Fund (Trust Fund), and the Juvenile Justice Benefit Fund (Resident Benefit Funds and Employee Benefit Fund), the auditors noted a number of exceptions where the Youth Centers were not following the Department’s Administrative Directives and/or State law. Some of the more significant issues noted by the auditors included the following: • Two Youth Centers could not provide a Trust Fund Signature and Authorization Card for two youths. • Two Youth Centers could not provide the signature cards for their funds showing the individuals with signature authority for all of Fiscal Year 2015 and Fiscal Year 2016. • Three Youth Centers were not reviewing outstanding checks to determine whether a stop payment should be issued. • Four Youth Centers had cash receipts that were not deposited timely into the various funds. • Two Youth Centers could not provide adequate documentation for its receipts. • One Youth Center was not performing monthly reviews comparing receipts and expenditures sent to Springfield for the Resident Benefit Fund to the bank statements. • Two Youth Centers had disbursements, totaling $2,009, that were either not approved or were approved by individuals who were not on the committee. • One Youth Center had a disbursement, totaling $1,300, which did not meet the criteria of items approved to be purchased from the fund. (Finding 6, pages 26-29) This finding was first reported in 2008. We recommended the Department ensure the requirements related to the locally held fund administration, as set forth in the Administrative Directives, are followed by the Youth Center staff. We also recommended the Department retain all necessary documentation in regards to receipts, disbursements, and expenditures from the locally held funds. Department officials accepted the recommendation and stated they will make every effort to ensure the Administrative Directives are followed regarding the use of locally held funds and to preserve and maintain records necessary to document its financial activity. (For the previous Department response, see Digest Footnote #3.) INADEQUATE ADMINISTRATION OF CONFINEMENT, GRIEVANCE, AND DISCIPLINE POLICIES The Department failed to maintain adequate administration of confinement, grievances, and discipline policies at the Youth Centers. During testing of the Department’s administration of confinement, grievances, and discipline policies, the auditors noted the following at the Youth Centers: • Grievance forms for 11 of 60 (18%) grievances selected for testing from three of six (50%) Youth Centers were improperly completed or the grievance was not maintained by the Department for one year. • Three of six (50%) Youth Centers did not file a written report with the Chief Administrative Officer within 72 hours of an infraction when discipline was imposed for four of 60 (7%) youth infractions selected for testing. Two reports were filed three and 204 days late, while the other two reports could not be located. • Two of six (33%) Youth Centers could not locate the Confinement Record Admission Forms for four of 60 (7%) confinements selected for testing. • One of six (17%) Youth Centers could not provide documentation of established disciplinary procedures. (Finding 10, pages 37-38) We recommended the Department ensure the requirements related to confinements, grievances, and discipline, as set forth in the Unified Code of Corrections, are known and followed by all Youth Center staff. Further, we recommended the Department adopt controls to provide assurance proper documentation is maintained for all youth confinements, grievances, and youth discipline reports and procedures. Department officials accepted the recommendation and noted they have been revising its confinement, grievance, and discipline policies consistent with the requirements of the RJ v. Mueller consent decree. OTHER FINDINGS The remaining findings pertain to a lack of due diligence over its inventory conversion; inadequate controls over the Youth 360 system, performance evaluations, and interagency agreements; weaknesses over the security and control of confidential information; inadequate segregation of duties; policies and procedures for State vehicles not being followed; the lack of a fraud risk program and disaster recovery planning; failure to comply with the Custody Relinquishment Prevention Act and the Unified Code of Corrections; and, failure to maintain the required number of bilingual frontline staff. We will review the Department’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Department for the two years ended June 30, 2016, as required by the Illinois State Auditing Act. The accountants stated the Department complied, in all material respects, with the requirements described in the report. This compliance examination was conducted by the Office of the Auditor General’s staff. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:skm DIGEST FOOTNOTES #1 - ADMINISTRATIVE PROCESS NOT FULLY SEGREGATED – Previous Department Response 2014: Recommendation accepted. The Department will continue efforts to acquire necessary resources to segregate its books and records from DOC, update and review A.D.s as necessary, and more effectively monitor the administrative services provided by DOC. As of January 1, 2015, the Department hired a permanent Policy Staff Attorney position. In the 8 months after the end of this audit period, the Department has created new or revised 50 A.D.s to be specific to the Department’s unique purpose and mission. In the 8 months after the end of this audit period, the Department has also rescinded 20 A.D.s that were inapplicable to the Department. As of April 1, 2015, the Department has taken over the management and formal promulgation of all Administrative Directives from the DOC Policy and Directives Unit, with the exception of those pertaining to Fiscal and Business Management (Section 02 of the A.D.s). As of April 1, 2015, the Department has a total of 351 Administrative Directives in effect. Of these A.D.s, 168 are reliant upon DOC for operations (147 Fiscal and Business Management and 21 adult sentence calculations for juvenile felons). Ninety- five of the remaining 183 A.D.s (52%), that the Department has the authority to revise to be specific to Department’s unique purpose and mission, have been updated. The Department will continue to fully convert policies as shared services are transferred to Department control and the Department establishes substantively distinct policies and procedures. #2 – INACCURATE AND INADEQUATE EQUIPMENT AND CAPITAL ASSET RECORDKEEPING – Previous Department Response 2014: Recommendation accepted. The Department will continue efforts of devoting the resources necessary within the limitations of the existing Illinois Department of Corrections APCS to ensure that property and equipment information is timely and properly recorded and maintained. A review of the inventory and recordkeeping practices will be done to determine areas that can be improved on. #3 – INADEQUATE ADMINISTRATION OF LOCALLY HELD FUNDS AT YOUTH CENTERS – Previous Department Response 2014: Recommendation accepted. The Department will make every effort to ensure the Administrative Directives are updated and followed regarding the uses of locally held funds, and to preserve and maintain records necessary to document its financial activity. In addition, the Department resolved the access issues with the online banking site.