REPORT DIGEST EXECUTIVE ETHICS COMMISSION COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2023 Release Date: Aug. 15, 2024 FINDINGS THIS AUDIT: 6 CATEGORY: NEW -- REPEAT – TOTAL Category 1: 0 -- 1 -- 1 Category 2: 2 -- 3 -- 5 Category 3: 0 -- 0 -- 0 TOTAL: 2 -- 4 -- 6 FINDINGS LAST AUDIT: 6 State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, 400 West Monroe, Suite 306, Springfield, IL 62704-9849 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (23-01) The Executive Ethics Commission’s (Commission) internal controls over its voucher processing function were not operating effectively during the examination period. • (23-02) The Commission did not maintain adequate controls over personal services. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS VOUCHER PROCESSING INTERNAL CONTROLS NOT OPERATING EFFECTIVELY The Executive Ethics Commission’s (Commission) internal controls over its voucher processing function were not operating effectively during the examination period. Due to our ability to rely upon the processing integrity of the Enterprise Resource Planning System (ERP) operated by the Department of Innovation and Technology (DoIT), we were able to limit our voucher testing at the Commission to determine whether certain key attributes were properly entered by the Commission’s staff into the ERP. In order to determine the operating effectiveness of the Commission’s internal controls related to voucher processing and subsequent payment of interest, we selected a sample of key attributes (attributes) to determine if the attributes were properly entered into the State’s ERP System based on supporting documentation. The attributes tested were 1) vendor information, 2) expenditure amount, 3) object(s) of expenditure, and 4) the later of the receipt date of the proper bill or the receipt date of the goods and/or services. Our testing noted 12 of 140 (9%) attributes were not properly entered into the ERP System, specifically for attribute 4 pertaining to proper receipt date. Therefore, the Commission’s internal controls over voucher processing were not operating effectively. Due to this condition, we qualified our opinion because we determined the Commission had not complied, in all material respects, with applicable laws and regulations, including the State uniform accounting system, in its financial and fiscal operations. Even given the limitations noted above, we conducted an analysis of the Commission’s expenditures data for Fiscal Years 2022 and 2023 to determine compliance with the State Prompt Payment Act (Act) (30 ILCS 540) and the Illinois Administrative Code (74 Ill. Admin. Code 900.70). We noted the following noncompliance: • The Commission did not timely approve 147 of 326 (45%) vouchers processed during Fiscal Year 2022, totaling $990,993. We noted these vouchers were approved between 1 and 164 days late. • The Commission did not timely approve 46 of 353 (13%) voucher processed during Fiscal Year 2023, totaling $1,069,478. We noted these vouchers were approved between 1 and 148 days late. During our testing of 36 travel vouchers, we noted the following: • One (3%) travel voucher tested, amounting to $2,239, did not have the proper object code. • Three (8%) travel vouchers tested, totaling $5,135, did not document the pre- approval for out-of-state travels. • Four (11%) travel vouchers tested, totaling $3,250, were not submitted within 60 days after the last day of travel. (Finding 1, pages 10-12) We recommended the Commission design and maintain internal controls to provide assurance its data entry of key attributes into ERP is complete and accurate and approve proper bills within 30 days of receipt. Further, we recommended the Commission use the proper object code, obtain pre-approval for out-of-state travels, and submit the travel voucher within 60 days after the last day of travel. The Commission accepted the recommendations and stated they have implemented additional procedural checks in its fiscal and travel approval processes to ensure full compliance in future cycles. INADEQUATE CONTROL OVER PERSONAL SERVICES The Commission did not maintain adequate controls over personal services. • During testing of the Commission’s Fiscal Year 2021 and Fiscal Year 2022 Agency Workforce Reports (Reports), we noted the following: — Fiscal Year 2021 Report, 9 out of 16 (56%) employee category groups, the data and statistical percentages presented did not agree to the supporting documentation. — Fiscal Year 2022 Report, 9 out of 16 (56%) employee category groups, the data and statistical percentages presented did not agree to the supporting documentation. — Fiscal Year 2019 and Fiscal Year 2020 Reports, cited as inaccurate during the prior examination, were not corrected and submitted with the Secretary of State and the Governor within 30 days after the release of the Commission’s compliance report by the Auditor General. • During our review of personal files, we noted evaluations were not performed for 3 of 19 (16%) employees selected for testing. • During our testing of leave of absence, we noted that for 1 of 8 (13%) employees tested, the Commission processed employee’s unpaid leave of absence as paid leave for $1,947 and there was no subsequent adjustment for the transaction. • During our testing of census data reconciliation, we noted that the Commission provided the certification of reconciliation, however, the Commission did not adequately maintain the data and document the process of reconciliation. Upon request of the auditor, the Commission reached out to the State Employees’ Retirement System of Illinois (System) representative for the data set. (Finding 2, pages 13-15) We recommended the Commission timely submit corrected Agency Workforce Reports with the Secretary of State and the Governor and complete performance evaluations timely. Further, we recommended the Commission adjust the payment processed for the employee’s unpaid leave of absence and document and maintain the reconciliation procedures over the census data. The Commission accepted the recommendations and stated they have implemented additional procedures to ensure full compliance in future audit cycles. OTHER FINDINGS The remaining findings pertain to noncompliance with Identity Protection Act; lack of adequate independent internal control review over service providers; and weaknesses in cybersecurity and disaster recovery planning and testing. We will review the Commission’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a State compliance examination of the Commission for the two years ended June 30, 2023, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Finding 2023-001. Except for the noncompliance described in this finding, the accountants stated the Commission complied, in all material respects, with the requirements described in the report. This State compliance examination was conducted by Adelfia LLC. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:[sjs]