REPORT DIGEST

GENERAL ASSEMBLY – SENATE

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2025

Release Date:  November 5, 2026

FINDINGS THIS AUDIT: 3

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  0 -- 0 -- 0
Category 2:  1 -- 2 -- 3
Category 3:  0 -- 0 -- 0
TOTAL:  1 -- 2 -- 3

FINDINGS LAST AUDIT: 2

State of Illinois, Office of the Auditor
General
CHRISTOPHER B. MEISTER, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov

SYNOPSIS

• (25-3) The Senate did not obtain or
conduct timely independent internal
control reviews over its  service
providers.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

INADEQUATE CONTROLS OVER SERVICE PROVIDERS

The Senate did not obtain or conduct
timely independent internal control
reviews over its service providers.

Although Senate management provided their
SOC report review for all 11 Service
Organization Control (SOC) reports, 1 (9%)
SOC report was not provided for testing.
As a result, we were unable to determine
whether the review of the service
provider’s internal controls performed by
Senate management was adequate.

We were able to test the Senate’s review
of the 10 SOC reports which were provided
for our review and we noted the following:

• For 7 (70%) SOC reports tested, the
Senate identified the control deviations
reported but did not document its analysis
and determination of the impact of the
reported control deviations to its
operations.
• For 8 (80%) SOC reports tested, the
Senate identified the Complementary User
Entity Controls (CUECs) but did not assess
and document the operation of the CUECs
relevant to the Senate’s operations.
• For 9 (90%) SOC reports tested, the
Senate identified the Complementary
Subservice Organization Controls but did
not assess and document its evaluation of
the impact on the Senate’s internal
control environment of the subservice
providers.
• For all SOC reports tested, the Senate
did not document the date when
management’s review was performed,
therefore, we were unable to determine the
timeliness of the review. (Finding 3,
pages 13-15).

We recommended the Senate implement
internal controls over service providers,
which include the following:

• Obtain SOC reports or perform
independent reviews of internal controls
associated with service providers at least
annually.
• Analyze the SOC reports obtained to
determine and document the impact of the
report’s opinion and noted deviations to
the Senate’s operations.
• Assess and document the operation of the
CUECs relevant to the Senate’s operations.
• Assess and document the evaluation of
the impact on the Senate’s internal
control environment of the subservice
providers.
• Monitor and document the request,
receipt, and completion date of the SOC
report reviews to ensure reviews are
performed in a timely manner and that any
issues identified are promptly assessed
and addressed by the Senate.

The Senate accepted the recommendation and
stated it has worked to develop an
assessment guide with appropriate
technical personnel, which should greatly
improve the evaluation of SOC reports and
assessments of the reports for reviews
identified in the audit recommendations.

OTHER FINDINGS

The remaining findings pertain to
cybersecurity and personal services.  We
will review the Senate’s progress towards
the implementation of our recommendations
in our next State compliance examination.

ACCOUNTANT’S OPINION

The accountants conducted a State
compliance examination of the Senate for
the two years ended June 30, 2025, as
required by the Illinois State Auditing
Act. The accountants stated the Senate
complied, in all material respects, with
the requirements described in the report.

This State compliance examination was
conducted by Adelfia LLC.

COURTNEY DZIERWA
Deputy Auditor General

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

CHRISTOPHER B. MEISTER
Auditor General

CBM:lkw