REPORT DIGEST

DEPARTMENT OF NATURAL RESOURCES

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2024

Release Date:  July 29, 2025

FINDINGS THIS AUDIT: 39

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  1 -- 10 -- 11
Category 2:  4 -- 23 -- 27
Category 3:  1 -- 0 -- 1
TOTAL:  6 -- 33 -- 39

FINDINGS LAST AUDIT: 37

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

Because of the significance and
pervasiveness of the findings described
within the report, we expressed an ADVERSE
OPINION on the Department of Natural
Resources’ (Department) compliance with the
specified requirements which comprise a
State compliance examination. The
Codification of Statements on Standards for
Attestation Engagements (AT-C § 205.74)
states a practitioner “should express an
adverse opinion when the practitioner,
having obtained sufficient appropriate
evidence, concludes the misstatements,
individually or in the aggregate, are both
material and pervasive to the subject
matter.”
Further, this digest covers our Compliance
Examination of the Department for the two
years ended June 30, 2024. A separate
Financial Audit of the Department’s Schedule
of Capital Assets for the year ended June
30, 2024 was previously released on February
20, 2025. In total, this report contains 39
findings, none of which were reported in the
Financial Audit.

SYNOPSIS

• (24-01) The Department did not exercise
adequate internal controls over its
reporting and maintenance of accounts
receivable.

• (24-02) The Department did not have
adequate controls over historical artifacts.

• (24-03) The Department did not have
adequate controls over preparation of
monthly reconciliations of its significant
accounts and transactions with the
Comptroller records.

• (24-05) The Department had weaknesses over
computer security.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

INADEQUATE CONTROLS OVER ACCOUNTS RECEIVABLE

The Department of Natural Resources
(Department) did not exercise adequate
internal controls over its reporting and
maintenance of accounts receivable.

We performed detailed testing of accounts
receivable including the Quarterly Summary
of Accounts Receivable – Accounts Receivable
Activity Report (Form C-97) and Quarterly
Summary of Accounts Receivable – Aging of
Total Gross Receivables (Form C-98). During
testing, we noted the following weaknesses:

Accounting System and Process Deficiencies

• The Department did not maintain a detailed
accounts receivable subsidiary ledger to
support the quarterly accounts receivable
additions reported on the Form C-97s.
Rather, the Department took the amount
collected during the quarter, subtracted the
beginning quarterly receivable balance, and
added the ending quarterly gross receivable
balance to calculate the accounts receivable
additions for the quarter.

• During the compilation of Forms C-97 and
C-98, the Department did not review and
verify the accuracy of accounts receivable
reported by the Department’s in-charge of
each fund.

Inadequate Processing of Old Accounts
Receivable

• The Department did not report accounts
receivable “due over one year” as
uncollectible on the Form C-97 for Funds
039, 040, 041, 905 and 962 for the fourth
quarter of Fiscal Years 2023 and 2024. The
Department’s accounts receivable balances
“due over one year” for Funds 039, 040, 041,
905 and 962 ranged from $1,817 to $199,648.

• The Department did not make sufficient
attempts to either collect its aged accounts
receivable or write off uncollectible
accounts receivable greater than one year
old. As of June 30, 2024, outstanding
receivables aged more than a year totaled
$2,305,314, $2,773,937, $123,374, and
$199,648 for Funds 137, 261, 884, and 962,
respectively.

Further, we noted these accounts receivable
were aged more than one year, in some cases,
were as old as Fiscal Year 1992.

• During testing of 40 accounts receivable,
we noted 14 (35%), totaling $225,108, were
over 90 days past due but not referred to
the Comptroller’s Illinois Debt Recovery
Offset Portal (IDROP) system.

Accounts Receivable Not Reported

• The Department was the lessor in several
real property rental agreements but did not
track the timing of the rental payment due
dates against related receipts to determine
if receivables should be recorded and
reported to the Comptroller on its Fund 538
Form C-97. The total real property rental
receipts reported by the Department for Fund
538 were $128,129 and $63,672 in Fiscal
Years 2023 and 2024, respectively. Potential
receivable amounts could not be determined.
(Finding 1, pages 14-17). This finding has
been reported since 2014.

We recommended the Department implement the
necessary internal controls to ensure
accounts receivable are adequately supported
and are consistently and accurately reported
to the Comptroller. Also, we recommended the
Department ensure accounts receivable are
timely pursued for collection and, if not
collectible, submitted for uncollectible
certification and subsequently written off.
Lastly, we recommended the Department review
rental transactions to determine the amount
receivable to be reported quarterly and at
the end of the year.

Department officials accepted the
recommendation. Department officials stated
the Department has updated its Finance
Handbook, which includes the accounts
receivable process, and has begun
implementing the necessary internal controls
to consistently and accurately report
accounts receivables. Department officials
further stated the Department has also
provided staff with training on the
Statewide Accounting Management System
(SAMS) manual to ensure all accounts
receivable reporting requirements are met.
Additionally, Department officials stated
the Department has hired additional staff to
increase collection efforts and continues
working to ensure that support for all
receivables, uncollectable accounts and
adjustments is obtained from each division.
Finally, Department officials stated the
Department will continue reviewing rental
transactions within Fund 538 to determine
the amount of receivable to be reported
quarterly and at the end of the year.

INADEQUATE CONTROLS OVER HISTORICAL
ARTIFACTS

The Department did not have adequate
controls over historical artifacts.

The Department is responsible for the
protection and interpretation of Illinois’
history and historic resources. The
Department collects and preserves
historically important materials and
maintains an artifact collection.

The Department did not maintain a central
inventory of its historical artifacts. Each
historical site maintained their own
inventory listing and there was not an
independent review of items added to or
removed from the listing maintained by each
site. Also, physical inventory counts were
performed by the custodians of the
artifacts, not by independent persons.

Due to the deficiencies noted above, we were
unable to conclude the Department’s
population records of historical artifacts
were sufficiently precise and complete under
the Attestation Standards promulgated by the
American Institute of Certified Public
Accountants (AT-C § 205.36) to test the
Department’s compliance relative to
historical artifacts.

Even given the population limitations noted
above, which hindered our ability to
conclude whether the records were complete
and accurate, we requested the Department
provide the population of historical
artifacts for three historical sites and
noted the following:

During our physical inspection of 33
historical artifacts, we noted the
following:

• Two (6%) artifacts could not be located.

• Three (9%) artifacts were not tagged with
an artifact ID number and could only be
identified through description and
confirmation from the Department.

During our tracing of 33 historical
artifacts to the Department records, we
noted the following:

• One (3%) artifact could not be traced to
the artifacts listing. (Finding 2, pages
18-19) This finding has been reported since
2018.

We recommended the Department maintain a
central inventory listing of historical
artifacts and implement internal controls
requiring additions and deletions to the
artifacts catalog to be independently
reviewed and approved. We also recommended
the Department ensure the inventory of all
historical artifacts is performed and/or
reviewed by independent personnel. Further,
we recommended the Department strengthen its
internal controls to ensure records are
accurately maintained and artifacts are
properly accounted for.

The Department accepted the recommendation.
Department officials stated the Department
is in the process of procuring a centralized
collections database to track all historical
artifacts, with procurement expected to be
completed by September 30, 2025.  Department
officials further stated the Department is
working to ensure inventories conducted at
the individual sites are independently
reviewed and approved until the database is
implemented. Finally, Department officials
stated they are in the process of hiring a
Historic Sites Registrar, who will be
responsible for managing all historic site
artifacts, and until this position is filled
an existing registrar at the Illinois State
Museum will assist historic sites in
ensuring best practices.

INADEQUATE CONTROLS OVER PREPARATION OF
MONTHLY RECONCILIATIONS

The Department did not have adequate
controls over preparation of monthly
reconciliations of its significant accounts
and transactions with the Comptroller
records.

During our testing, we noted the following:

• The Department did not reconcile its
internal records with the following
Comptroller’s reports during Fiscal Years
2023 and 2024:

– Appropriation Transfer Report (SB03); and,

– Cash Report (SB05).

• The Department did not reconcile its
internal records with the following
Comptroller’s reports during Fiscal Year
2023. In addition, the Fiscal Year 2024
monthly reconciliations did not have
documentation of who and when the
reconciliations were performed; therefore,
we were unable to determine if the monthly
reconciliations were performed timely and
authorized employees prepared the
reconciliations and performed supervisory
review:

– Revenue Status Report (SB04); and,

– Appropriations Status Report (SB01)
including lapse periods.

• Eight of eight (100%) monthly
reconciliation of its contractual
obligations to the Agency Contract Report
(SC14) or the Obligation Activity (SC15)
lacked documentation to support the dates
the reconciliations were completed;
therefore, we were unable to determine if
the monthly reconciliations were performed
timely and authorized employees prepared the
reconciliations and performed the
supervisory review. (Finding 3, pages
20-21). This finding has been reported since
2016.

We recommended the Department ensure monthly
reconciliation of its activity is timely
performed, documented, and reviewed.

The Department accepted the recommendation.
Department officials stated, as of April 30,
2025, the Department is current on all
reconciliations, except for the SB05
reconciliations, which are expected to be
current by December 31, 2025. Department
officials further stated the Department has
updated policies and procedures to ensure
all required reconciliations of its
activities are performed, documented and
reviewed on a timely basis.

WEAKNESSES OVER COMPUTER SECURITY

The Department of Natural Resources
(Department) had weaknesses over computer
security.

During testing, we noted the Department:

• did not have a formal access provisioning
policy.

• did not have a change control policy.

• could not provide supporting documentation
of access requests and approvals for 38 of
38 (100%) new users.

• did not timely remove separated employees’
user access rights. We noted three of 190
(2%) separated employees who continued to
have access to an application subsequent to
their separation from the Department.
Further, we noted the Department did not
evaluate whether the separated employees
accessed the application.

• did not perform user access review for the
Enterprise Resource Planning (ERP) system.

• did not maintain documentation verifying
the data sanitization for 37 of 37 (100%)
electronic devices prior to their disposal.

• did not have a formal policy on disposal
of data storage devices.

• had not maintained adequate control over
lost or missing computer equipment items. We
noted 116 electronic data processing
equipment items were reported as lost and
missing during the Department’s inventory
counts. However, the Department did not
determine if any confidential information
was stored on these electronic data
processing items. (Finding 5, pages 25-27).
This finding has been reported since 2020.

We recommended the Department establish and
implement formal access and change control
policies, maintain documentation of user
access requests and approvals, ensure timely
deactivation of separated users’ access,
ensure regular review of ERP users’ access,
establish and implement a policy on disposal
of data storage devices, ensure data storage
devices are properly sanitized before
disposal, and conduct an assessment to
determine if lost or stolen laptops
contained confidential or personal
information and ensure compliance with the
Personal Information Protection Act.

The Department accepted the recommendation.
Department officials stated the Department
has drafted a cybersecurity program that
establishes a formal access control policy.
Department officials further stated the
Department’s Human Resources Division is
working with the Department of Innovation
and Technology (DoIT) to improve off-
boarding procedures to ensure separated
users are deactivated timely. Additionally,
Department officials stated the Department
is currently working with DoIT to identify
all users for every application used by the
Department.

OTHER FINDINGS

The remaining findings are reportedly being
given attention by the Department. We will
review the Department’s progress towards the
implementation of our recommendations in our
next State compliance examination.

AUDITOR’S OPINION

The financial audit was previously released.
The auditors stated the Department’s
Schedule of Capital Assets as of June 30,
2024, was fairly stated in all material
respects.

ACCOUNTANT’S OPINION

The accountants conducted the State
compliance examination of the Department for
the two years ended June 30, 2024, as
required by the Illinois State Auditing Act.
Because of the effect of the noncompliance
described in Finding 2024-001 through
Finding 2024-039, the accountants stated the
Department did not materially comply with
the specified requirements described in the
report.

This State compliance examination was
conducted by Roth & Co., LLP.

COURTNEY DZIERWA
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:vrb