The Agency obligated and paid inaccurate rent amounts under a multi-year lease
agreement which resulted in an underpayment of $35,791 in fiscal year 2001 and an
overpayment of $27,144 in fiscal year 2002. The amounts in the contract obligation
documents did not agree to the lease agreement.
We recommended the Agency ensure accurate lease payments are made in accordance
with the terms of the lease. We also recommended the Agency recoup the fiscal year 2002
overpaid rent amount from the vendor. (Finding 4, page 14)
The Agency accepted our recommendation and stated it has assigned a staff person in the
Finance Section to double check all lease terms to verify accuracy. The Agency also stated
it has recouped the FY02 overpayment amount.
The remaining findings are less significant and are reportedly being given
attention by the Agency. We will review progress towards the implementation of our
recommendations during the Agency’s next audit.
Gary Styzens, Chief Internal Auditor, provided the responses to our findings and
recommendations.
Our special assistant auditors stated that Agency’s individual nonshared
governmental financial statements, individual nonshared fiduciary financial statements and
individual nonshared proprietary financial statements, as of and for the year ended June
30, 2002, are fairly stated in all material respects.
WILLIAM G. HOLLAND, Auditor General
Our special assistant auditors for this audit were FPT&W, Ltd.
DIGEST FOOTNOTES
#1 INCOMPLETE AUDITING OF INTERNAL CONTROL SYSTEMS – Previous Agency Responses
2001: Accepted. We will make the necessary adjustments in audit coverage to
ensure that all significant control systems are audited while continuing to provide
management with meaningful reviews of program operations.
1999: Partially accepted. The Agency agrees with the auditors that an effective
internal audit program will regularly and thoroughly review "major" systems of
internal controls; however, we differ with the auditors on what is specifically required
to accomplish this purpose.
The Comptroller's guidance for implementing and administering the Fiscal Control and
Internal Auditing Act (FCIAA) identifies eleven transaction/event cycles commonly found in
Illinois State agencies. The auditors interpret FCIAA and the Comptroller's guidance to
require, without exception, biennial audits of those of the eleven cycles determined to
apply to the agency under review.
We disagree with that interpretation.
FCIAA requires the internal audit program to include:
"Audits of major systems of internal accounting and administrative control
conducted on a regular basis so that all major systems are reviewed at least once every 2
years" [30 ILCS 10/2003(2)]
Since no specific systems of internal control are named, the wording, in our opinion,
gives the Agency latitude to identify the internal control systems that are of the most
significance to its operations and responsibilities. Further, the Comptroller's guidance
on internal auditing states:
"The purpose of this section is to help agency chief executive officers identify
the major event/transaction cycles and associated control objectives that need to be
considered when performing internal reviews. The list is neither all-inclusive nor
mandatory. Agencies will probably operate transaction/event cycles not included on the
list and certainly not operate all cycles included in the list. Also, all internal
control objectives may not be appropriate for a particular situation." [CUSAS
02.50.20 page 1 of 11, emphasis added]
We believe that our major systems of control are those necessary to carry out the
programs assigned to the Agency by the General Assembly. For IEPA, we have broadly defined
three major transaction/event cycles based on programmatic functions or activities: permit
issuance, inspection and monitoring of compliance with environmental laws, and initiation
of enforcement actions when non-compliance is found. Internal audit review of the
administrative control systems inherent in these transaction/event functions assures
effective management of activities related to overall program accomplishment. Due to their
importance, our internal audit program places considerable emphasis in reviewing
administrative controls established for these major programmatic transaction/event
functions in the Water, Land and Air pollution control programs.
Audits of these programmatic functions routinely involve testing of many of the
elements of the traditional transaction/event cycles: organization and management,
administrative support, purchasing, expenditures, contracts, revenues and receivables,
data processing support and other common systems of control.
We also rely on work of the external auditors who routinely test the eleven common
systems during every audit. If external audit findings indicate a problem in one of the
common systems of control, we initiate an internal audit. Conversely, if the external
auditors do not identify any control weaknesses, we believe that redundant coverage is
unnecessary and a waste of audit resources.
This approach is supported by FCIAA which empowered the Internal Audit Advisory Board
to adopt professional standards for Illinois State Government internal auditors. The Board
adopted the standards of the Institute of Internal Auditors.
Standard 550 states:
"…[the] director of internal auditing should coordinate internal and external
audit efforts."
Standard 550.01.3 states:
"In coordinating the work of internal auditors with the work of external auditors,
the director of internal auditing should ensure that the work to be performed by internal
auditors in fulfillment of Standard 300 [Scope of Work] does not duplicate the work of the
external auditors which can be relied on for purposes of internal audit coverage. To the
extent that professional and organizational reporting responsibilities allow, internal
auditors should conduct examinations in a manner that allows for maximum audit
coordination and efficiency."
We believe that the effectiveness of our internal audit program speaks for itself both
as evidenced by the decline in external audit findings over the past decade and in the
successful programmatic improvements that have resulted from our approach to the review of
systems of administrative control.
AUDITORS' COMMENT
We do not accept the Agency's position. The requirements of the law are clear. The
State Comptroller's guidance for implementation of the Fiscal Control and Internal
Auditing Act lists eleven major review categories. These eleven categories are all
essential areas of internal accounting and administrative control. Unless EPA can
demonstrate that one or more of these areas is missing in its operations, the Agency
should comply with the law and review them all at least once every two years.
1998: Accepted. We will continue to make the necessary adjustments in audit coverage to
ensure that all significant control systems are audited while continuing to provide
management with meaningful reviews of program operations.
1996: Accepted. The audit report states that Internal Audits did not perform adequate
reviews of the personnel/payroll and property control systems during the two-year audit
period. This finding is based on the fact that five audits of control systems were begun
but not completed during the audit period. It is not unusual that some internal audits
would span external audit periods. The Agency believes that the audits of our
personnel/payroll and property control systems, although not completed by the end of the
audit period, nevertheless met the requirements of FCIAA. In fact, corrective action had
begun in FY96 based on those audits in progress, as problem areas were identified. Such
corrective action is reflected, for example, in our response to Finding #6, relative to
property control. Although we disagree with this finding with regard to exactly what is
required under FCIAA, we will make every effort to comply with the recommendation in the
future.
