REPORT DIGEST ILLINOIS DEPARTMENT OF CORRECTIONS COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2018 Release Date: September 18, 2019 FINDINGS THIS AUDIT: 46 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 3 -- 9 -- 12 Category 2: 7 -- 27 -- 34 Category 3: 0 -- 0 -- 0 TOTAL: 10 -- 36 -- 46 FINDINGS LAST AUDIT: 43 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers our State Compliance Examination of the Illinois Department of Corrections (Department) for the two years ended June 30, 2018. A separate Financial Audit as of and for the year ended June 30, 2018, was previously released on April 25, 2019. In total, this report contains 46 findings, seven of which were reported in the Financial Audit. SYNOPSIS • (18-09) The Department did not comply with the required transfers of profits from Commissary Funds to the Inmate and Employee Benefit Funds. • (18-10) The Department did not ensure fiscal requirements over the Offender 360 project were controlled and documented. • (18-11) The Department did not identify all State laws with specific requirements for the Department. • (18-16) The Department did not comply with the notification requirements of the Murderer and Violent Offender Against Youth Registration Act. • (18-24) The Department failed to properly conduct metal detector searches of inmates. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS NONCOMPLIANCE WITH THE REQUIRED TRANSFERS OF PROFITS FROM DOC COMMISSARY FUNDS The Department did not comply with the required transfers of profits from Commissary Funds to the Inmate Benefit Fund and Employee Benefit Fund. A Commissary Fund Cash Review Form (DOC 0075) is used to calculate and effectuate the transfers. The auditors noted some centers did not transfer funds, used an alternative methodology for transfers, or provided incomplete documentation for transfers. Documented transfers to the Inmate Benefit Fund and Employee Benefit Funds were $4,564,851 and $35,833, respectively, less than the mandated share of profits. The amounts due to other Departmental funds from the DOC Commissary Funds totaled $14.1 million as of June 30, 2018 ($9.2 million to the Inmate Benefit Fund, $.1 million to the Employee Benefit Fund and $4.8 million to the Salary Reimbursement Fund). (Finding 9, pages 61-63) We recommended the Department review its procedures for form DOC 0075 to ensure a consistent and accurate transfer calculation is utilized. We also recommended the Department determine if the current statutory language is sufficient to allow for operations of the commissary funds, or seek legislative changes if needed. We further recommended the Department develop a plan of action to begin decreasing the liability within the Commissary Funds. The Department accepted the finding and responded they will work on revising the Administrative Directive and DOC 0075 to help ensure compliance. CONTINUED LACK OF FISCAL CONTROLS OVER OFFENDER 360 PROJECT The Department did not ensure fiscal requirements were controlled and documented. In June 2010, the Department embarked on the development of Offender 360 in order to meet the statutory requirements of Public Act 097-0697 to manage the awarding of sentence credits to eligible offenders. Over the last eight years, the Department has added additional functionality to Offender 360 in the areas of offender tracking, offense information, security levels, offender personal and medical information. Since the Fiscal Year 2014 examination, the auditors reported the Department had not implemented controls over the fiscal requirements related to Offender 360. During the current examination, the auditors continued to identify weaknesses regarding overall costs as well as the appropriateness of vendor payments. During their testing, the auditors requested from the Department documentation supporting the cost of the Offender 360 project. The Department provided a spreadsheet that indicated $69,044,918 had been paid for vendor services since Fiscal Year 2011. The spreadsheet did not include the cost of Department staff and some additional hardware and software purchases. The auditors also reviewed contracts, statements of work, schedules, and amendments related to the vendor’s services and noted the Department may have overpaid or may have made advance payments to the vendor totaling $1,235,686 based on the terms of the agreements. In addition, the auditors reviewed 14 vendor invoices, totaling $42,970,792, and found sufficient detail was not provided to determine the accuracy of the payment. Further, the Department could not provide documentation to determine if all services were delivered prior to the expiration of the lapse period for the 14 invoices. In addition, the auditors noted the Department had not capitalized or maintained sufficient records to determine the costs for the development of Offender 360. Based on subsequently obtained documents and estimates, it was determined approximately $19.4 million had not been capitalized related to Offender 360. Moreover, in March 2018, the Department embarked on a development to replace their locally held funds system with A360, a module of Offender 360. In June 2018, the Department discontinued this development. During the application development period, the Department expended $1.5 million. Costs incurred during the preliminary project stage of A360 could not be determined. (Finding 10, pages 64-65) This finding was first reported in 2014. We recommended the Department implement controls to ensure expenditures are made in accordance with State statute, terms of the contract, and are properly documented. We also recommended the Department ensure that costs related to internally developed software be adequately tracked by development stage and analyzed for accurate calculation of costs to be capitalized. The Department accepted the finding and stated it will strengthen its internal controls over the development and support of its information technology environment. The Department also stated a central repository of information will be established, deliverables and performance will be tracked and monitored, and an exhaustive review of all information technology expenditures will be completed with appropriate action being taken for billing irregularities. INABILITY TO IDENTIFY ALL APPLICABLE AGENCY-SPECIFIC LAWS The Department was unable to provide a complete list of statutes with specific requirements for the Department during the examination period. The Department identified 11 of the major statutes establishing mandates specific to their agency. However, the Department did not identify an additional 39 applicable laws with specific mandates significant to the Department. (Finding 11, page 66) We recommended the Department strengthen its controls to identify, ensure compliance and monitor all applicable statutory mandates. The Department accepted the finding and responded it will work to create an online database of agency specific laws identified in the Illinois Compiled Statutes. NONCOMPLIANCE WITH THE MURDERER AND VIOLENT OFFENDER AGAINST YOUTH REGISTRATION ACT The Department did not comply with the notification requirements of the Act. The Act requires any violent offender against youth, prior to discharge, parole, or release from a Department facility, shall be informed of his or her duty to register in person within five days of release. Auditors noted the following weaknesses at six different Centers: • Notification forms for 5 of 9 (56%) applicable offenders were incomplete at two Centers. • One Center was unable to provide documentation of required notification forms for 1 of 5 (20%) applicable offenders tested. • Auditors noted the computer system that tracks Violence Against Youth (VAY) Offenders, Offender 360, did not properly track inmates who were violent offenders against youth. Auditors noted 23 of 53 (43%) of the Offender 360 population of VAY offenders released from one Center during the examination period were not violent offenders against youth. • Two inmates were incorrectly listed on the original Offender 360 report the auditor received at a Center and should not have been classified as violent offenders against youth. • An offender at a Center was not labeled as a VAY offender upon release and therefore did not sign a form confirming he was notified of his duty to register with the police upon being released. (Finding 16, pages 74-75) We recommended the Department comply with the requirements of the Act. We specifically recommended the Department ensure timely notification, proper completion, and maintenance of the Murderer and Violent Offender Against Youth Registration Notification Form and review records in Offender 360 to ensure accuracy. The Department accepted the finding and stated it will work to ensure compliance with the Act is achieved. Further, the Department stated to help achieve this outcome, it will work to have the proper documentation filed and its Information Technology platform provide reliable and accurate information. FAILURE TO PROPERLY CONDUCT METAL DETECTOR SEARCHES OF INMATES The Department failed to properly conduct metal detector searches of inmates. Auditors noted at six centers, inmates assigned to mechanical and kitchen areas where tools and metal were present were not subjected to searches with metal detectors upon exiting the area. (Finding 24, page 86) This finding was first reported in 2014. We recommended the Department properly conduct metal detector searches of inmates who are assigned to mechanical areas where tools and metals are present, in accordance with the Department’s Administrative Directive. The Department accepted the finding and responded it will work to allocate resources so that its facilities properly conduct metal detector searches of its offenders. The Department also stated staff will conduct a survey identifying the need for additional metal detectors, complete a system-wide security check to test for potential vulnerabilities and review the Departmental policy pertaining to tools and assignments that would be subject to metal detection. OTHER FINDINGS The remaining findings pertain to internal control and compliance matters. We will review the Department’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Department for the two years ended June 30, 2018, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Findings 2018-001 through 2018-012. Except for the noncompliance described in these findings, the accountants stated the Agency complied, in all material respects, with the requirements described in the report. This compliance examination was conducted by Adelfia LLC. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:LKW