REPORT DIGEST ENVIRONMENTAL PROTECTION AGENCY FINANCIAL AND COMPLIANCE AUDIT For the Year Ended: Summary of Findings: Total this audit 3 Release Date:
State of Illinois WILLIAM G. HOLLAND AUDITOR GENERAL To obtain a copy of the Report contact: (217)782-6046 or TDD (217) 524-4646 This Report Digest is also available on |
SYNOPSIS
{Expenditures and Activity Measures are summarized on the reverse page.} |
ENVIRONMENTAL PROTECTION AGENCY
FINANCIAL AND COMPLIANCE AUDIT
For The Year Ended June 30, 2000
| EXPENDITURE STATISTICS | FY 2000 |
FY 1999 |
$377,113,232 |
$340,228,757 |
|
OPERATIONS TOTAL % of Total Expenditures |
$171,313,453 45.43% |
$179,224,894 52.68% |
Personal Services |
$53,290,627 |
$35,708,059 |
Other Payroll Costs (FICA, Retirement) |
$16,292,493 |
$9,762,997 |
Contractual Services |
$72,424,461 |
$44,095,900 |
All Other Operations Items |
$29,305,872 |
$89,657,938 |
GRANTS TOTAL % of Total Expenditures |
$205,799,779 54.57% |
$161,003,863 47.32% |
$62,339,108 |
$29,243,791 |
|
| SERVICE
EFFORTS AND ACCOMPLISHMENTS (Unaudited) |
FY 2000 |
FY 1999 |
AIR POLLUTION CONTROL |
|
|
LAND POLLUTION CONTROL |
|
1 1,935 |
WATER POLLUTION CONTROL |
39 |
35 |
| AGENCY DIRECTOR(S) |
| During Audit Period: Thomas V. Skinner Currently: Thomas V. Skinner |
|
The FY 00 audit plan did not provide for audits of all major systems, and not all planned audits were completed
A partial draft of the plan was prepared and submitted to the Agency's Security Officer in October 2000
|
FINDINGS, CONCLUSIONS, AND INCOMPLETE AUDITING OF INTERNAL CONTROL SYSTEMS Internal Audit has not completed reviews of all the significant internal control systems as required by the Fiscal Control and Internal Auditing Act. (FCIAA) The FCIAA (30 ILCS 10/2003(2)) requires the Agency to perform audits of major systems of internal accounting and administrative control on a periodic basis so that all major accounting systems are reviewed at least once every two years. FCIAA also provides for special audits of operations, procedures and other activities as directed by the chief executive officer. We noted that the audit plan for the two years ended June 30, 2000 did not provide for audits of all major systems and that not all planned audits were completed. Additionally, only 2 of 19 special purpose trust funds with significant expenditure/receipt activity were audited during the period. Incomplete auditing of all major internal control systems increases the risk that significant internal control weaknesses will exist and errors and irregularities may go undetected. (Finding 3, pages 18-19) This finding has been repeated since 1996. We recommended the Agency complete reviews of all major systems of internal accounting and administrative controls at least once every two years as required by the Fiscal Control and Internal Auditing Act. Agency officials agreed to make the necessary adjustments in audit coverage to ensure that all significant control systems are audited while continuing to provide management with meaningful reviews of program operations. (For the previous Agency responses, see Digest footnote #1.) INADEQUATE COMPUTER DISASTER RECOVERY PLAN The Agency did not have an adequate plan for reacting to information technology disasters. The Agency has approximately $7 million of computer equipment located at its facilities throughout the State. The computer equipment includes approximately 1,550 microcomputers connected to local area networks (LANs) and three minicomputers. A partial draft of the disaster plan was prepared and was submitted to the Agency's Security Officer in October 2000. As of our fieldwork end date, there were still five sections of the plan outstanding. Furthermore, the current draft of the plan still did not cover change procedures, test plans, distribution procedures or alternative space issues. A written and tested disaster recovery plan can greatly assist management in coping with service disruptions resulting from fires, floods, storms, power failures or vandalism that may last from minutes to weeks. (Finding 2, pages 15-17) This finding has been repeated since 1996. We recommended the Agency continue its efforts to complete its disaster contingency plan and obtain approval for the plan by the end of 2000. The Agency agreed with our recommendation and states they are in the final stages of developing the outstanding and missing plan sections. Their goal is to complete the plan by March 31, 2001 and complete testing of the plan by June 30, 2001. (For the previous Agency responses, see Digest footnote #2.) OTHER FINDING The remaining finding and recommendation is less significant and is being given attention by the Agency. We will review progress towards the implementation of our recommendations during the Agency’s next audit. Stuart Gresham, Chief Internal Auditor, provided the responses to our findings and recommendations. AUDITORS’ OPINION Our auditors state the June 30, 2000 combined financial statements of the Agency are fairly presented in all material respects. ____________________________________ WILLIAM G. HOLLAND, Auditor General WGH:KAL:pp SPECIAL ASSISTANT AUDITORS Our special assistant auditors were Sikich Gardner & Co, LLP. DIGEST FOOTNOTES #1 INCOMPLETE AUDITING OF INTERNAL CONTROL SYSTEMS – Previous Agency Responses 1999: Partially accepted. The Agency agrees with the auditors that an effective internal audit program will regularly and thoroughly review "major" systems of internal controls; however, we differ with the auditors on what is specifically required to accomplish this purpose. The Comptroller's guidance for implementing and administering the Fiscal Control and Internal Auditing Act (FCIAA) identifies eleven transaction/event cycles commonly found in Illinois State agencies. The auditors interpret FCIAA and the Comptroller's guidance to require, without exception, biennial audits of those of the eleven cycles determined to apply to the agency under review. We disagree with that interpretation. FCIAA requires the internal audit program to include: "Audits of major systems of internal accounting and administrative control conducted on a regular basis so that all major systems are reviewed at least once every 2 years" [30 ILCS 10/2003(2)] Since no specific systems of internal control are named, the wording, in our opinion, gives the Agency latitude to identify the internal control systems that are of the most significance to its operations and responsibilities. Further, the Comptroller's guidance on internal auditing states: "The purpose of this section is to help agency chief executive officers identify the major event/transaction cycles and associated control objectives that need to be considered when performing internal reviews. The list is neither all-inclusive nor mandatory. Agencies will probably operate transaction/event cycles not included on the list and certainly not operate all cycles included in the list. Also, all internal control objectives may not be appropriate for a particular situation." [CUSAS 02.50.20 page 1 of 11, emphasis added] We believe that our major systems of control are those necessary to carry out the programs assigned to the Agency by the General Assembly. For IEPA, we have broadly defined three major transaction/event cycles based on programmatic functions or activities: permit issuance, inspection and monitoring of compliance with environmental laws, and initiation of enforcement actions when non-compliance is found. Internal audit review of the administrative control systems inherent in these transaction/event functions assures effective management of activities related to overall program accomplishment. Due to their importance, our internal audit program places considerable emphasis in reviewing administrative controls established for these major programmatic transaction/event functions in the Water, Land and Air pollution control programs. Audits of these programmatic functions routinely involve testing of many of the elements of the traditional transaction/event cycles: organization and management, administrative support, purchasing, expenditures, contracts, revenues and receivables, data processing support and other common systems of control. We also rely on work of the external auditors who routinely test the eleven common systems during every audit. If external audit findings indicate a problem in one of the common systems of control, we initiate an internal audit. Conversely, if the external auditors do not identify any control weaknesses, we believe that redundant coverage is unnecessary and a waste of audit resources. This approach is supported by FCIAA which empowered the Internal Audit Advisory Board to adopt professional standards for Illinois State Government internal auditors. The Board adopted the standards of the Institute of Internal Auditors. Standard 550 states: "…[the] director of internal auditing should coordinate internal and external audit efforts." Standard 550.01.3 states: "In coordinating the work of internal auditors with the work of external auditors, the director of internal auditing should ensure that the work to be performed by internal auditors in fulfillment of Standard 300 [Scope of Work] does not duplicate the work of the external auditors which can be relied on for purposes of internal audit coverage. To the extent that professional and organizational reporting responsibilities allow, internal auditors should conduct examinations in a manner that allows for maximum audit coordination and efficiency." We believe that the effectiveness of our internal audit program speaks for itself both as evidenced by the decline in external audit findings over the past decade and in the successful programmatic improvements that have resulted from our approach to the review of systems of administrative control. AUDITORS' COMMENT We do not accept the Agency's position. The requirements of the law are clear. The State Comptroller's guidance for implementation of the Fiscal Control and Internal Auditing Act lists eleven major review categories. These eleven categories are all essential areas of internal accounting and administrative control. Unless EPA can demonstrate that one or more of these areas is missing in its operations, the Agency should comply with the law and review them all at least once every two years. 1998: Accepted. We will continue to make the necessary adjustments in audit coverage to ensure that all significant control systems are audited while continuing to provide management with meaningful reviews of program operations. 1996: Accepted. The audit report states that Internal Audits did not perform adequate reviews of the personnel/payroll and property control systems during the two-year audit period. This finding is based on the fact that five audits of control systems were begun but not completed during the audit period. It is not unusual that some internal audits would span external audit periods. The Agency believes that the audits of our personnel/payroll and property control systems, although not completed by the end of the audit period, nevertheless met the requirements of FCIAA. In fact, corrective action had begun in FY96 based on those audits in progress, as problem areas were identified. Such corrective action is reflected, for example, in our response to Finding #6, relative to property control. Although we disagree with this finding with regard to exactly what is required under FCIAA, we will make every effort to comply with the recommendation in the future. #2 INADEQUATE COMPUTER DISASTER RECOVERY PLAN – Previous Agency Responses 1999: Accepted. The Agency intends to build on our Y2K contingency planning efforts to develop an effective disaster recovery plan. Y2K required a complete review of our computer operations, including applications, hardware, and network infrastructure. We are looking at various software packages that will walk us through the disaster recovery planning process and will enable us to take full advantage of the information already gathered for Y2K. We plan to have a disaster recovery plan by September 1, 2000. 1998: Accepted. The Agency has been reviewing its use of information technology. As a result of that review, all network servers are being centralized into a single computer room to provide efficiency of operations, automated backup, and adequate physical and network security. With the completion of the centralization process, the disaster recovery process will be restarted and a disaster recovery plan should be completed and tested by December 31, 1999. 1996: Accepted. The Disaster Recovery Plan is being updated and expanded to include LAN-based applications. The updated plan will be tested upon completion and will be reviewed and updated annually.
|