REPORT DIGEST DEPARTMENT OF JUVENILE JUSTICE COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2020 Release Date: June 30, 2021 FINDINGS THIS AUDIT: 25 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 5 -- 5 Category 2: 4 -- 16 -- 20 Category 3: 0 -- 0 -- 0 TOTAL: 4 -- 21 -- 25 FINDINGS LAST AUDIT: 21 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (20-01) The Department did not maintain adequate documentation and control over its State property during the examination period. •(20-02) The Department did not exercise adequate controls over voucher processing. • (20-05) The Department failed to maintain adequate controls over its personnel and payroll records and documentation. • (20-24) The Department did not obtain or conduct timely independent internal control reviews over its service providers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROLS OVER STATE PROPERTY The Department did not maintain adequate documentation and control over its State property during the examination period. The Department did not timely and accurately enter transactions into the property control system. We noted equipment purchases/additions were not being timely entered. We also noted addition and deletion reports could not be agreed to activity reported in the Agency Report of State Property (Form C-15) reported to the Office of Comptroller (Comptroller). As a result, we were unable to reconcile the Department-wide Form C-15s to the Comptroller’s object/Expenditures by Quarter Reports (SA02). The unreconciled differences totaled ($379,470) and $587,496 in Fiscal Year 2019 and Fiscal Year 2020, respectively. We also noted the Department does not have a policy clearly delineating the categories of equipment considered subject to theft. Due to these conditions, we were unable to conclude whether the Department’s population of inventory records was sufficiently precise and detailed under Attestation Standards promulgated by the America Institute of Certified Public Accountants (AT-C § 205.35) to test the Department’s State property. Even given the population limitations noted above which hindered our ability to conclude whether the selected sample was representative of the population as a whole, we selected a sample of items from the property listing provided by the Department and performed testing. This finding was first noted during the examination of the two years ended June 30, 2008. In subsequent years, the Department has been unsuccessful in implementing a corrective action plan. Following are a few items we noted during testing: • The Department’s property control listing did not accurately report equipment locations and location codes: – Items were still being reported on the property listing at closed Youth Centers (IYC) and Aftercare Centers (AC), including 13 equipment items, totaling $7,668, under AC Washington Cottage; 113 equipment items, totaling $29,680, under AC Chicago Healy; 477 equipment items, totaling $189,284, under IYC Kewanee; 130 equipment items, totaling $29,160, under IYC Murphysboro; and 1,038 equipment items, totaling $229,562, 55 buildings, totaling $29,825,386, and 160 acres of land, totaling $573,103, under IYC Joliet. These closed Youth Centers reopened as facilities under the Department of Corrections. – Although there were eight aftercare locations throughout the State, the property listing only contained two location codes: Springfield and Chicago. – Items at different locations utilized the same location code used by the Director’s Offices. • Eleven of 17 (65%) equipment items selected from the property listing, totaling $68,109, were not found because the location codes in the property records did not reflect the actual location. These exceptions were noted during the scheduled visit to the Director’s Office in Springfield. (Finding 1, pages 11-15) This finding has been repeated since 2008. We recommended the Department strengthen its controls over maintaining, recording, and reporting its State property and equipment by reviewing its inventory and recordkeeping practices to ensure compliance with State laws and regulations. Further, the Department should ensure all property transactions are accurately and timely recorded on the Department’s property records. Department officials accepted the recommendation. INADEQUATE CONTROLS OVER VOUCHER PROCESSING The Department of Juvenile Justice (Department) did not exercise adequate controls over voucher processing. Following are a few items we noted during testing: During our sample testing of 160 vouchers, we noted the following: • For 49 (31%) vouchers tested, totaling $1,814,138, the invoice was approved more than 30 days after receipt of the bill. The invoices were approved 1 to 232 days late. • For 41 (26%) vouchers tested, totaling $741,369, the required interest was not vouchered and submitted to the Office of Comptroller. During our sample testing of 65 payroll vouchers, we noted for 18 (28%) payroll vouchers tested, totaling $7,103,628, the voucher did not have documentation that it was properly approved by the agency head or authorized designee. During our sample testing of 35 travel vouchers, we noted travel vouchers were not approved within 30 days of receipt, related invoices were not date-stamped, reimbursement requests were not submitted timely and insufficient documentation was provided to determine whether the payments were proper. (Finding 2, pages 16-18) We recommended the Department retain all vouchers and adequate supporting documentation. We also recommended the Department timely approve vouchers and ensure the receipt date is properly documented. Department officials accepted the recommendation. FAILURE TO MAINTAIN REQUIRED PERSONNEL DOCUMENTATION The Department of Juvenile Justice (Department) failed to maintain adequate controls over its personnel and payroll records and documentation. During testing of personnel files for 65 employees, we noted the following: • For 16 (25%) employees tested, the Department was unable to provide the signed Federal/Illinois W-4 Employee’s Withholding Exemption Certificate (Form C-25). • Three (5%) employees tested had missing I-9 forms and checklists. In addition, three (5%) employees tested had inappropriately completed I-9 forms. All three new employees tested completed, and signed section 1 and the employer's representative completed, and signed section 2 of I-9 form later than three business days after the employee's first day of employment. • Three (5%) employees tested, were not found on the payroll vouchers provided. Therefore, we could not determine whether the payments were proper. Additionally, 1 of 65 (2%) employees tested had a different first name on the payroll voucher provided so we could not verify if it was the same employee. • For one (2%) employee tested, the gross salary per pay period should have been $4,045 but the employee was paid $3,985. The Department did not provide supporting documentation for the difference of $60. • For one (2%) employee tested, the Department was unable to provide timesheets for the months selected for testing. • One of 35 (3%) active employees tested had been transferred to another agency in 2018 but was included in the listing of active employees for both Fiscal Year 2019 and Fiscal Year 2020. In addition, one of 15 (7%) inactive employees tested was noted to have left the Department in 2017 but was included in the listing of terminated employees for Fiscal Year 2019. Due to these conditions, we were unable to conclude whether the Department’s population listing of employees was sufficiently precise and detailed under Attestation Standards promulgated by the American Institute of Certified Public Accountants (ATC § 205.35) to test the Department’s personnel files. Even given the population limitations noted above, which hindered our ability to conclude whether the selected sample was representative of the population as a whole, we selected a sample of items from the listings provided by the Department and performed testing We recommended the Department strengthen controls to ensure employees’ gross pay, payroll deductions, timesheets, Federal/ Illinois W-4 Employee’s Withholding Exemption Certificate (Form C-25), and Form I-9 are maintained as required. We also recommended the Department ensure employee transfers and terminations are updated in their records. Department officials accepted the recommendation. LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERAL CONTROLS OVER SERVICE PROVIDERS The Department of Juvenile Justice (Department) did not obtain or conduct timely independent internal control reviews over its service providers. We requested the Department provide the population of service providers utilized in order to determine if the Department had reviewed the internal controls over the service providers. In response to our request, the Department provided a listing of four service providers utilized during the audit period. The Department utilized these service providers to provide: • Hosting of its servers and application systems, maintenance of network and infrastructure, and security administration of user access. • Hosting of a cloud-based major application system. • Development of an electronic medical health system and its maintenance. • Provision of hardware that would run an educational system for the youth offenders. During testing of the four service providers, we noted the Department: • Did not obtain System and Organization Control (SOC) reports or conduct independent internal control reviews for all of its service providers • Did not conduct an analysis of the SOC reports to determine the impact of the modified opinions or the noted deviations. • Had not conducted an analysis of the complementary user entity controls documented in the SOC reports. (Finding 24, pages 65-66). We recommended the Department identify all service providers and determine and document if a review of controls is required. If required, the Department should: • Obtain SOC reports (or perform independent reviews) of internal controls associated with outsourced systems at least annually • Monitor and document the operation of the Complementary User Entity Controls (CUECs) relevant to the Department's operations. • Either obtain and review SOC reports for subservice organizations or perform alternative procedures to satisfy itself that the usage of the subservice organizations would not impact the Department's internal control environment. • Document its review of the SOC reports and review all significant issues with subservice organizations to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the Department, and any compensating controls. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. Department officials accepted the recommendation. OTHER FINDINGS The remaining findings pertain to 1) inadequate controls over Economic Interest Statements, leaves of absences, the Resident Trust Fund, the Employee and Resident Benefit Funds, the Travel and Allowance Fund, performance evaluations, contractual agreements, the administration of interagency agreements, and receipts and refunds; 2) inaccurate youth transfer listing; 3) reconciliations not performed timely; 4) inadequate documentation of employee training; 5) administrative process not fully segregated; 6) noncompliance with the Fiscal Control and Internal Auditing Act and the Unified Code of Corrections regarding inspections of Juvenile Detention; 7) State vehicle policies and procedures not followed; 8) inadequate administration of discipline and grievance policies; 9) required reports did not contain required elements; 10) noncompliance with Facilities; 11) weaknesses regarding security and control of confidential Information; 12) lack of disaster contingency planning; and 13) incorrect calculation of release dates. We will review the Department’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Department for the two years ended June 30, 2020, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Findings 2020-001 through 2020-005. Except for the noncompliance described in these finding, the accountants stated the Department complied, in all material respects, with the requirements described in the report. This compliance examination was conducted by Adelfia, LLC. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:SDW