REPORT DIGEST DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES - COMMUNITY COLLEGE HEALTH INSURANCE SECURITY FUND FINANCIAL AUDIT For the Year Ended: June 30, 2008 Summary of Findings: Total this audit 3 Total prior audit 1 Release Date: July 8, 2009 State of Illinois Office of the Auditor General WILLIAM G. HOLLAND AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General Iles Park Plaza 740 E. Ash Street Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are available on the worldwide web at www.auditor.illinois.gov

SYNOPSIS The State of Illinois did not have sufficient controls to ensure all contributions required by the State Employees Group Insurance Act of 1971 were paid into the Community College Health Insurance Security Fund. The Department did not obtain an independent internal control review of its third parties involved with the processing of health insurance claims for the College Insurance Program. The Department did not charge the correct health insurance premium rates for the College Insurance Program. {Financial Information and Activity Measures summarized on the reverse page.}

DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES

COMMUNITY COLLEGE HEALTH INSURANCE SECURITY FUND

FINANCIAL AUDIT

Year Ended June 30, 2008

FINANCIAL OPERATIONS (in thousands)

FY 2008

Additions Contributions Employer...……..................................................... State...……........................................................... Plan Member: Activities...……............................................... Retirees...……................................................. Federal government Medicare Part D...................... Consolidated Omnibus Budget Reconciliation Act Total contributions............................................ Interest income...……................................................. Total additions.................................................. Deductions Benefit payments......................................................... Administrative expense................................................ Total deductions............................................... Net increase/(decrease) .......................................... Net assets held in trust for other postemployment benefits Beginning of year.................................................. End of year..........................................................

$ 3,716 4,740 3,716 11,482 1,737 12 25,403 434 25,837 27,610 457 28,067 (2,230) 9,562 $ 7,332

SUPPLEMENTARY INFORMATION

FY 2008

Number of retirees and beneficiaries receiving benefits……...... Number of waived retirees who may elect healthcare coverage in the future...…….............................................................. Number of terminated plan members entitled to but not yet receiving benefits……........................................................ Number of active plan members............................................... Total…........................................................................ Number of participating employers...........................................

5,162 1,692 4,660 21,219 32,733 38

AGENCY DIRECTOR

During Audit Period: Mr. Barry S. Maram

Currently: Mr. Barry S. Maram

No controls to ensure required contributions were paid Department accepts responsibility for Fund’s financial statements Department disagrees with auditors Auditor’s comment No assurance to prevent errors or irregularities No third party independent internal control review obtained for 2 of 5 third party service providers 10% of health insurance expenses processed by third party service providers have no internal control review Department disagrees with auditors Auditor’s comment Reports not obtained until after auditors requested them Community College benefit recipients undercharged a total of $7,946 Department agrees with auditors

INTRODUCTION This digest covers the financial audit of the Community College Health Insurance Security Fund for the year ended June 30, 2008. The financial audit report includes three significant deficiency in internal control findings. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS NO CONTROLS OVER COMMUNITY COLLEGE HEALTH INSURANCE SECURITY FUND CONTRIBUTIONS The State of Illinois did not have sufficient controls to ensure all contributions required by the State Employees Group Insurance Act of 1971 were paid into the Community College Health Insurance Security Fund (Fund). Revenues deposited into the Fund are for the sole purpose of providing health benefits to Community College retirees and their dependents and associated administrative costs. The Fund is administered jointly by the Department of Central Management Services (DCMS) and the Department of Healthcare and Family Services (HFS). According to the State Employees Group Insurance Act of 1971, the State Universities Retirement Systems (SURS) is required to collect the contributions from community colleges as a service agent to DCMS and promptly deposit such collections into the Fund. HFS has accepted responsibility for preparing the Fund’s financial statements. During our testing, we determined no State agency is ensuring that the amounts collected from active community college employees and the matching contributions from community colleges are the amounts required to be contributed per the State Employees Group Insurance Act of 1971. (Finding 1, pages 17-19) We recommended the Department of Healthcare and Family Services ensure adequate controls are designed, implemented and operating effectively to ensure contributions required by the State Employees Group Insurance Act of 1971 are collected and properly accounted for in the Community College Health Insurance Security Fund. Department officials disagreed with the recommendation and stated that the Department reports on activity associated with the Community College Health Insurance Security Fund, to include deposits of receipts made by the Department of Central Management Services (CMS) and the State University Retirement System (SURS). As part of the Department’s reporting responsibility, Management Representation Letters were obtained from CMS and SURS so that assurances were provided for reporting purposes. The Comptroller’s Office delegated the reporting responsibility to the Department in lieu of reflecting this fund as shared. These letters were also provided to the Auditor General’s Office (OAG). The Department continued to state that the Department also performed due diligence once the OAG brought this concern to its attention by sampling eight community college payrolls and calculating the .5% required contribution amount. The results of this standard audit confirmation test found that all eight colleges were in compliance with 5 ILCS 375/6.10 and noted no further concerns with the amounts being reported in the Department’s financial statements. The responsibilities associated with the Group Insurance program that were transferred from CMS to the Department in accordance with Executive Order 2005-3 did not include the depositing of receipts and 5 ILCS 375/6.10 specifically requires SURS to act as a service agent for depositing all community college active employee contributions. The purpose of this split was to transfer “vendor facing” responsibilities to the Department while CMS would retain “member facing” responsibilities. Information on active contributors of SURS and community college boards would be defined as member facing information and would not fall under the purview of the Department’s administrative function. As such, the Department has neither the authority, nor the access to information needed to validate contributions and receipts. HFS has no oversight authority for contributions associated with the Group Insurance program to ensure compliance with State statute, as recommended by the OAG. If the requirement for verifying fund activity lies with the entity responsible for the financial reporting, then the Department will work with the Comptroller’s Office in establishing this fund as “shared,” whereas each agency will be responsible for reporting on their respective activity. In an auditor’s comment, we noted that no State Agency has implemented controls to ensure revenues are collected in accordance with State statute for this State administered insurance program. Consequently, the auditors were unable to test whether revenues were fairly stated for the Fund. Once the auditors brought this issue to the attention of the Department, the Department performed the minimum amount of work in order for the auditors to report on the financial statements for the Fund. The Department’s response to the audit concern did not eliminate the issue reported in the finding. The auditor’s recommendation is directed to the Department, since the Department has assumed the responsibility for preparing financial statements for the Fund. THIRD PARTY INTERNAL CONTROL REVIEWS NOT OBTAINED The Department did not obtain an independent internal control review (SAS 70 Report) of its third parties involved with the processing of health insurance claims for the College Insurance Program. Without a review, the Department did not have assurance that information system controls to prevent errors or irregularities were established. When a user organization like the Department of Healthcare and Family Services uses service organizations, transactions that affect the Local Government Health Insurance Reserve Fund’s financial statements are subjected to controls that are, at least in part, separate from the Department’s. Consequently, it is good business practice to obtain a report from the service organization’s auditors concerning controls placed in operation and in some cases results of tests concerning operational effectiveness. These types of reports are commonly referred to as SAS 70 Reports. The Department contracts with five different third party health insurance service providers to process health insurance claims. Each of the health insurance service provider uses their own computer system to process these health insurance claims. During our review of third party health insurance service providers, we noted that the Department did not obtain an independent internal control review for two of the service providers during fiscal year 2008. Of the health insurance payments made to the five third party health insurance service providers totaling $24,261,110 in fiscal year 2008, $2,470,366 (10%) of the health insurance payments were processed under a third party health insurance service provider from which the Department did not obtain an independent internal control review. The Department stated that they negotiate long term contracts with the parties involved in processing insurance claims for the health care plans. Typical healthcare contracts have five year initial periods and up to five one-year renewal periods. The two contracts cited were initially negotiated with a five-year contract in 2001, for fiscal year 2002 implementation, without a “SAS 70” requirement. The two contracts are currently in one-year renewal periods without a “SAS 70” requirement. The Department previously submitted the relevant portions of the Sarbanes Oxley audit pertaining to internal controls as they relate to the audited financial statements for one of the two contracts. In addition, a 2008 Annual Report with SEC form 10-K and a Financial Statement audit were previously submitted for the remaining contract. The Annual Report with SEC form 10-K identified above includes the “Report of Independent Registered Public Accounting Firm.” The vendor of the original contract was acquired October 1, 2007. Prior to this the vendor was a privately held corporation. (Finding 2, pages 20-22) We recommended the Department require that each third-party health insurance service provider engage independent auditors to perform an annual independent internal control review on the controls placed in operation and the tests of their operating effectiveness. Department officials disagreed with our finding and recommendation and stated that the majority of these contracts were originally executed prior to industry acceptance of “SAS 70.” Department officials continued to state that the Fiscal Year 2010 contracts and renewals for the two vendors not submitting “SAS 70” audits have already been negotiated and have been signed by the vendors. In order to implement this requirement for those, the Department would have to renegotiate their contracts. Renegotiating those contracts at this date would jeopardize contracts beginning July 1, 2009. Negotiating an additional audit into these renewals would also increase the cost of the contract. The Department will include a “SAS 70” requirement to all future contracts bid with third parties involved with the processing of health insurance claims. In an auditor’s comment, we noted that we requested all third party internal control reviews from the Department and, for the two contracts noted above, the Department indicated that they relied on “equivalent” reviews for one of the contracts and they did not have a third party internal control review or equivalent review for the other contract. With regard to one of the contracts, the Department did provide the auditors with what they called a “Sox Report” (Sarbanes Oxley Report). The documentation that the Department provided was an excel spreadsheet that documented computer controls. This spreadsheet was not accompanied by any type of cover letter or auditor’s report. After the auditors questioned the “Sox Report,” the Department contacted the vendor and the Department was informed that the “Sox Report” is actually part of the vendor’s “SAS 70” Report. For the other contract, the Department indicated that they provided the auditors with a 2008 Annual Report with SEC Form 10-K. The Department did not have this Annual Report until the auditors asked for the “SAS 70” Reports. The Department could not provide any “equivalent” reviews prior to the 2008 Annual Report. The Department cannot state to the auditors that they are relying on these "equivalent" reports if they do not obtain them unless requested by the auditors. There is clearly no internal controls to obtain and review these reports. INCORRECT HEALTH INSURANCE PREMIUM RATES CHARGED The Department did not charge the correct health insurance premium rates for the College Insurance Program. We noted a 2008 premium rate of the College Insurance Program health insurance were not in compliance with parameters established in State statute. The monthly health insurance premium rate charged for a Community College benefit recipient for ages twenty three and under selecting a managed care program was $73.01; however, the health insurance premium rate should have been at least $181.84. The benefit recipients were undercharged a total of $7,946 during fiscal year 2008. The insurance rate determined by the Department for this category was $727.34. (Finding 3, pages 23-24) We recommended the Department ensure health insurance premium rates are set for the College Insurance Program as required by the State Employees Group Insurance Act of 1971. Department officials agreed to the finding and recommendation and stated that the Department will review the calculation of the costs of this group and the premiums charged to this group to ensure that the Department is in compliance with the Statute. AUDITORS’ OPINION Our auditors state the financial statements of the Community College Health Insurance Security Fund as of June 30, 2008, are fairly presented in all material respects. ___________________________________ WILLIAM G. HOLLAND, Auditor General WGH:TLD:pp AUDITORS ASSIGNED This audit was performed by the staff of the Office of the Auditor General.