REPORT DIGEST ILLINOIS CONSERVATION FOUNDATION FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2022 Release Date: January 26, 2023 FINDINGS THIS AUDIT: 1 CATEGORY: NEW -- REPEAT – TOTAL Category 1: 0 -- 0 -- 0 Category 2: 0 -- 1 -- 1 Category 3: 0 -- 0 -- 0 TOTAL: 0 -- 1 -- 1 FINDINGS LAST AUDIT: 1 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers the financial audit of the Illinois Conservation Foundation (Foundation) as of and for the year ended June 30, 2022. SYNOPSIS • (22-01) The Foundation lacked adequate controls over review of internal controls over its service providers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER SERVICE PROVIDERS The Illinois Conservation Foundation (Foundation) lacked adequate controls over review of internal controls over its service providers. During testing of the Foundation’s service providers, we noted the Foundation had not: • Obtained and reviewed the service providers’ System and Organization Controls (SOC) reports. • Timely obtained and reviewed SOC reports for subservice providers or performed alternative procedures to determine the impact on its internal control environment. • Monitored and documented the operation of the Complementary User Entity Controls (CUECs) relevant to its operations. • Ensured a requirement for an independent review was included within the contract between the Foundation and service providers. • Developed or implemented procedures for monitoring the service providers. • Conducted an analysis to determine the impact of noted deviations within the SOC report. (Finding 1, pages 30-31) We recommended the Foundation: • Obtain and review SOC reports or perform independent reviews of internal controls associated with outsourced systems at least annually. • Either obtain and review SOC reports for subservice providers or perform alternative procedures to satisfy the use of the subservice providers would not impact the Foundation’s internal control environment. • Monitor and document the operation of the CUECs relevant to the Foundation's operations. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. • Develop and implement procedures for monitoring of service providers. • Conduct an analysis to determine the impact of noted deviations within the SOC reports. The Foundation agreed with the recommendation and stated it will do its best to follow the recommendation. AUDITOR’S OPINION The auditors stated the financial statements of the Foundation as of and for the year ended June 30, 2022, are fairly stated in all material respects. This financial audit was conducted by Roth & Company, LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:vrb