REPORT DIGEST ILLINOIS WORKERS’ COMPENSATION COMMISSION COMPLIANCE EXAMINATION FOR TH TWO YEARS ENDED JUNE 30, 2021 Release Date: Aug. 18, 2022 FINDINGS THIS AUDIT: 23 CATEGORY: NEW -- REPEAT – TOTAL Category 1: 6 -- 4 -- 10 Category 2: 5 -- 8 -- 13 Category 3: 0 -- 0 -- 0 TOTAL: 11 -- 12 -- 23 FINDINGS LAST AUDIT: 14 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers the Commission’s compliance examination for the two years ended June 30, 2021. A separate digest covers the Self-Insurers Security Fund’s financial audit as of and for the year ended June 30, 2021. In total, this report includes 23 findings, 2 of which were reported in the financial audit. SYNOPSIS • (21-03) The Commission lacked adequate internal control over its cash receipts and annual Agency Fee Imposition Report. • (21-04) The Commission did not sufficiently monitor and pursue collection on accounts receivable or properly report its accounts receivable to the Comptroller’s Office. • (21-06) The Commission failed to establish internal controls to conduct due diligence or ensure project management controls over the CompFile! project. • (21-10) The Commission lacked adequate internal control over its leases, resulting in leases which did not fully protect the State’s interests, unrecorded leasehold assets and depreciation, a procurement process which may not have been in the best interests of the State, an inability to determine the amount of cash due to a lessor, an indeterminate amount of rent expense recognized for a lease, and the improper confirmation of future lease commitments to the Comptroller’s Office. • (21-22) The Commission has neither designed nor implemented internal controls to enforce penalties imposed by Workers’ Compensation Act. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROL OVER RECEIPTS The Illinois Workers’ Compensation Commission (Commission) lacked adequate internal control over its cash receipts and annual Agency Fee Imposition Report (Report). During testing, some of the more significant problems we noted included the following: • Seven of 40 (18%) regular receipts tested, totaling $309,282, and 1 of 18 (6%) refund receipts tested, totaling $100, did not have the date when the receipt was received by the Commission. As such, we could not determine if the receipt was deposited timely by the Commission. • Two of 40 (5%) regular receipts tested, totaling $19,606, and 1 of 18 (6%) refund receipts tested, totaling $230, were deposited after the Commission’s 10-day extension to deposit its receipts, between one to three business days late. • Four of 40 (10%) regular receipts tested, totaling $241,894, were charged against a receipt code which did not reflect the purpose of the receipt. These receipts were erroneously reported as fines, penalties, or violations when the receipts were for the annual fee collected from self-insurers under the Workers’ Compensation Act. • The corresponding Receipts Deposit Transmittal Form for 2 of 40 (5%) receipts tested, totaling $29,053, were submitted to the Comptroller’s Office between 40 to 45 days after receiving the receipt’s associated Treasurer’s Draft from the Treasurer’s Office. • The Commission did not have sufficient receipt codes to differentiate the various types of cash collections within the Self- Insurers Security Fund to facilitate the preparation of its cash flows statement. Fiscal Year 2020 Report • The Commission excluded June 2020 receipts from its total fees collected during the year within the Second Injury Fund and the Illinois Workers’ Compensation Commission Operations Fund. • The Commission excluded receipts from July 2019 through May 2020 from its total fees collected during the year within the Rate Adjustment Fund. Fiscal Year 2021 Report • We noted unreconciled differences of $2,210, $25,796, and $48,036 within the reported fees collected for the Second Injury Fund, Rate Adjustment Fund, and Illinois Workers’ Compensation Commission Operations Fund. (Finding 3, pages 20-23) This finding has been repeated since 2017. We recommended the Commission review the design and operation of its internal controls over receipt processing and implement corrective action to ensure receipts are promptly remitted to correct account within the State Treasury, books and records are maintained in strict compliance with the Act, all revenue sources have a receipt code, and the annual Report is complete and accurate. Commission officials agreed with the finding. INADEQUATE CONTROLS OVER ACCOUNTS RECEIVABLE The Commission did not sufficiently monitor and pursue collection on accounts receivable or properly report its accounts receivable to the Comptroller’s Office. The following is some of the more significant problems we noted during our testing. During testing of 40 accounts receivable and 16 tested recipients of benefits paid from the Rate Adjustment Fund and/or the Second Injury Fund, we noted the following: • Sixteen of 40 (40%) delinquent accounts receivable tested, totaling $139,915, were not actively monitored and pursued for collection, as follows: — Two (5%) tested accounts, totaling $94,784, were deferred payment plans arising from settlement agreements for the Injured Workers’ Benefit Fund between the debtor employer and the Commission where the employers had not followed the payment plan. We noted these employers had not made any payments during the examination period and the Commission had not referred these receivables to either the IDROP system at the Comptroller’s Office and the Department of Revenue’s Debt Collection Bureau (Bureau). — Fourteen (35%) tested accounts, totaling $45,131, were overpayments by the Commission of benefits from the Rate Adjustment Fund and/or the Second Injury Fund. We noted the Commission had not referred these receivables to either the IDROP system at the Comptroller’s Office or the Bureau. Further, the Commission did not send timely second notices to 11 of these debtors, as the second notice was provided between 6 and 79 months after the first notice. — Five of 16 (31%) recipients of benefits from the Rate Adjustment Fund and/or the Second Injury Fund tested had net overpayments, totaling $10,260, outstanding when their eligibility was terminated. We noted three of the five (19% of the total tested accounts) had outstanding balances where the Commission had not sent out a second notice between 6 to 17 months after the date of the first notice. In response to these exceptions, Commission officials wrote they do not believe the collection of benefit overpayments paid from the Rate Adjustment Fund and/or Second Injury Fund is good public policy because these persons are typically low income. • Eight of eight (100%) quarterly reports for the Self-Insurers Security Fund did not include all accounts receivable, including accounts receivables for assessments, excess insurance, and miscellaneous sources, in the reports. Additionally, it does not appear the Commission makes use of all information available, such as reports filed by employers for assessments due to other Commission funds, to record and collect on assessments receivable. (Finding 4, pages 24-26) We recommended the Commission review the design and operation of its internal controls over accounts receivable to ensure it timely pursues and attempts to collect amounts due to the Commission, including by referring amounts due to IDROP and the Bureau. In addition, we recommended he Commission implement controls to ensure its quarterly accounts receivable reports are complete and accurate. Commission officials agreed with our recommendation. FAILURE TO ESTABLISH PROJECT MANAGEMENT INTERNAL CONTROLS The Commission failed to establish internal controls to conduct due diligence or ensure project management controls over the CompFile! project. In order to modernize the Case Management System, the Commission executed two contracts for the development and oversight of CompFile!, totaling $6,405,934. As of June 30, 2021, the Commission had implemented three releases which consisted of registration, settlements, and case maintenance. As part of our testing, we requested documentation to determine if CompFile! had been developed to meet the Commission’s requirements and contractual requirements. During testing, we noted the following: • A project management framework had not been implemented to ensure the development met the Commission’s requirements. Specifically, the Commission had not developed: — a project charter documenting the project’s scope, expenditures, feasibility study, risk analysis, and approval; — a governance plan documenting the roles, responsibilities, objectives, and strategies for implementing the project; — system security requirements; or, — a transition plan documenting the movement of CompFile!’s control from the development vendor to the Commission. •CompFile!’s master plan did not document the correct development vendor or the technology being utilized for the development. •Contract management had not been implemented to ensure the project conformed with the Statements of Work (SoWs) requirements. We noted: — the backlogs of requirements were not provided or were incomplete; — 4 of 23 (17%) deliverables were not reviewed and approved; — 5 of 23 (22%) deliverables were not provided or were incomplete; and, — 1 of 4 (25%) SoWs did not follow the documented change process. • CompFile’s system testing was inadequate and did not comply with development requirements, including: — all required functional, process, unit, and end-to-end testing scripts were not ran; — test scripts which failed did not have documentation of a resolution; — testing results were not reviewed and approved; and, — a process for reporting and rectifying defects had not been developed. • The Change Management Plan documented the incorrect vendor and did not document the actual change process followed. • Management’s go-live review and approval to move for release #2 into production was not provided. • Although data had been converted from the Commission’s legacy system during release #1 and release #2, documentation of reconciliations between the legacy system and CompFile! was not provided. Further, the reconciliation for release #3 was incomplete. Finally, the Commission did not provide documentation demonstrating the converted data had been tested to ensure its accuracy. • Incident management procedures had not been developed. • The Commission had not conducted a pre-implementation review prior to moving CompFile! into production. (Finding 6, pages 32-35) We recommended the Commission develop and implement internal controls over its due diligence and project management of information systems projects. Specifically, the Commission should: • develop a project management framework to ensure the development meets the Commission’s requirements; • implement internal controls to ensure the project complies with the requirements of the contract and SoWs; • ensure all system testing complies with the development requirements; • update its Change Management Plan to document the correct development vendor and the actual change process followed; • conduct a review and approve of each release go-live; • conduct detailed reconciliations each time data is converted from a legacy system and maintain documentation of these reconciliations; and, • develop incident management procedures. Commission officials partially agreed with the finding, noting they fully accepted the recommendation, but believed sufficient internal controls existed on the CompFile! project. They noted the Commission complied with the requirements of the SoWs for the CompFile! project and obtained, reviewed, and accepted all required deliverables to ensure the project met the Commission’s needs. As a multi- release project, certain deliverables were considered living documents that were updated throughout the project. Any changes to these deliverables after formal acceptance were done at the Commission’s request or to refine assumptions made during solution modeling. Finally, the Commission helped guarantee the success of the CompFile! project through rigorous testing and a comprehensive review of each release prior to its deployment into production. In an accountant’s comment, we stated are unsure how the Commission can state there were sufficient internal controls over the CompFile! project when a project management framework had not been implemented, deliverables had not been provided or were incomplete, and deliverables had not been reviewed. Further, if the Commission had completed rigorous testing and a comprehensive review of each release, then why was documentation not provided to us to demonstrate this rigorous testing and the comprehensive reviews? FAILURE TO EXERCISE APPROPRIATE CONTROLS OVER LEASES The Commission lacked adequate internal control over its leases, resulting in leases which did not fully protect the State’s interests, unrecorded leasehold assets and depreciation, a procurement process which may not have been in the best interests of the State, an inability to determine the amount of cash due to a lessor, an indeterminate amount of rent expense recognized for a lease, and the improper confirmation of future lease commitments to the Comptroller’s Office. During testing, some of the more significant problems we noted included the following: • The Commission entered into two lease agreements which did not fully protect the State’s interests. We noted: — The Commission entered into a 10- year real property lease for 1.008% of the useable square feet of the Richard J. Daley Center (Daley Center) with the Public Building Commission of Chicago (PBCC), effective October 1, 2020. Under the terms of this completely variable lease, the PBCC will adopt an (1) annual operating budget and (2) annual capital budget around October of each year and the annual rent due from the Commission for this space over the period from that October through the next September will be 1.008% of the total budgeted amounts, regardless of whether the PBCC actually spends its full budget amount, without any limitation on the amount of the amount of these budgets set completely by the PBCC. — The Commission entered into a 10- year real property lease for 3.27% of the useable space of the George W. Dunne Building (Dunne Building) from Cook County, effective December 1, 2020. The payment terms of this lease include an annual fixed component and a completely variable component. The variable amount has no limit and represents 3.27% of the Dunne Building’s capital, operating, and maintenance costs incurred or paid by Cook County to operate and maintain the Dunne Building and its adjacent plaza, which may then be increased at Cook County’s discretion in any year when the occupancy rate of the Dunne Building falls below 95%. • The Commission made tenant improvements and modifications to its space at the Daley Center between October 2020 and mid-April 2021 without (1) capitalizing any of these leasehold improvements and (2) starting to recognize depreciation expense for these assets over the remaining 113.5 months of the lease between the Commission and PBCC beginning in mid-April 2021. • The Commission did not receive the adopted operating and capital budgets of the PBCC for the Daley Center for Calendar Year 2020 and Calendar Year 2021 until after we requested this information to recalculate the amount due to the PBCC. • We were unable to determine or recalculate the amount of rent due to the PBCC for its lease at the Daley Center. During Fiscal Year 2021, the Commission paid $177,408 in rent to the PBCC. We recalculated the total amount due during Fiscal Year 2021 was $171,272, which consisted of rent from October 2020 through December 2020 of $57,492 and rent from January 2021 through June 2021 was $113,780. As such, the unreconciled difference was $6,136. • The Commission did not seek nor receive approval from the Chief Procurement Officer to forego the request for information (RFI) procurement process for its Daley Center and Dunne Building leases. • The Commission did not ensure its Contract-Obligation Document (Form C-23) for its Daley Center and Dunne Building leases filed with the Comptroller’s Office were complete and accurate. We noted included the following: — The Commission’s reported activity charged against its obligation at the Comptroller’s Office for its Daley Center lease does not make sense. We noted the Comptroller’s records show the Commission charged $466,876 in expenditures against its maximum contractual obligation during Fiscal Year 2021 of $540,000. However, this $466,876 balance did not agree with the rent payments of $177,408, leasehold improvements paid for by the Commission of $459,744, or the combination of the rent and leasehold improvements paid of $637,152 during Fiscal Year 2021. — The Commission’s initial Form C-23s filed for both its Daley Center and Dunne Building leases did not reflect a fair and reasonable estimate for the amount due as of the date the Commission prepared each Form C-23. — While the Commission entered into an agreement to not pay rent for its Dunne Building lease until the rent commencement date on July 1, 2021, the Commission did not file an amended Form C-23 reflecting the change associated with this agreement. • As part of preparing the State’s Annual Comprehensive Financial Report (ACFR), the Comptroller’s Office pulled the total future year lease commitments beyond June 2021 for real property leases from the Commission’s Form C-23s filed with the Comptroller’s Office, which are included within the State’s total balance of future year lease commitments reported in the State’s ACFR. Due to the valuation estimation problems noted above, Commission staff should have known the future year lease commitment valuations for its Daley Center and Dunne Building leases picked up by the Comptroller and reported to the Commission for confirmation did not accurately reflect the future cash flows associated these leases as of June 30, 2021. We noted Commission staff incorrectly confirmed the current balance of outstanding future year lease commitments with no changes to the Comptroller on July 14, 2021. (Finding 10, pages 41-46) We recommended the Commission implement controls to: 1) ensure future lease agreements include either meaningful State involvement in establishing rent rates or contractual limitations on the maximum due under the contract to help protect the State’s interests; 2) leasehold building improvements are properly capitalized and depreciated; 3) ensure information necessary to support the amount of rent due is obtained, used to recalculate and substantiate the amount of rent paid, and retained in adherence with the State Records Act; 4) real property leases are either procured through the RFI process or submitted to the Chief Procurement Officer for the Chief Procurement Officer’s determination the RFI process is not in the best interests of the State when the lessor is another governmental unit; 5) Form C-23s filed with the Comptroller’s Office are complete and accurate, with amendments to previously filed Form C-23s submitted when the Commission enters into an amendment to a preexisting contractual agreement or when the facts and circumstances of the amount due under the contract change; and, 6) confirmations submitted to other parties are complete, accurate, and reflect all currently known facts and circumstances. Commission officials disagreed with the finding, noting: 1) Per an official at the Department of Central Management Services, these lease agreements are actually intergovernmental agreements (IGAs) for space sharing and fall under the Intergovernmental Cooperation Act (5 ILCS 220). As such, these leases were exempt from the Illinois Procurement Code, so approval by the Chief Procurement Officer was not necessary. 2) The Commission does not pay rent – just the proration of the operating expense. Operating costs cannot be fixed in leases, as they are changeable costs and the tenant pays a portion of the actual cost as deemed appropriate. This is an industry standard and how leases and IGAs are procured and negotiated. For the Dunne Building, the Commission pays 35% below market rate and this IGA is definitely in the best interest of the State. 3) The inadvertent omission of capitalized leaseholder improvements was corrected in Fiscal Year 2022. 4) The PBCC’s staff was slow to respond to our request for its annual budget and we will communicate more appropriately with them going forward. 5) In regards to the issue of Commission staff incorrectly confirming the current balance of outstanding future year lease commitments with no changes made to the Comptroller, we note that this will no longer be an issue going forward as these leases will now be reported under the Governmental Accounting Standards Board’s new lease standards. In an accountant’s comment, with regards to #1 and #2 above, we noted the Illinois Procurement Code (30 ILCS 500/1-10(b)(1)) states: This Code shall not apply to contracts between the State and its political subdivisions or other governments, or between State governmental bodies, except as specifically provided in this Code.” (emphasis added) As paraphrased in the finding and in full below, the Illinois Procurement Code (30 ILCS 500/40-15(c)) states: Leases with other governmental units may be negotiated without using the request for information process when deemed by the chief procurement officer to be in the best interest of the State. (emphasis added) As such, in our opinion, the portion of the Code cited within this finding is applicable to the Commission’s leases at the Daley Center and Dunne Building with the PBCC and Cook County, respectively. In the event Commission officials continue to disagree, they should seek a formal written opinion from the Attorney General on the matter. Further, with regards to whether the lease is in the best interests of the State, it is the duty of the Chief Procurement Officer to make this determination, not the Commission. Also, as the Commission’s leases have significant variable components for both capital and operating expenditures that will only become known over the next nine years, it is not possible to say with certainty if the State will either realize cost savings or incur excessive costs over the life of the lease agreement. Finally, regarding the portion of the Commission’s response noted as #5 on the preceding page, at least for the Commission’s Daley Center lease, the Governmental Accounting Standards Board’s new lease guidance will not apply as the rent payment does not contain any fixed amounts, a variable payment which depends on an external index or rate, or a fixed in substance variable payment. In this case, the Commission’s future obligations will need to be considered by the Comptroller’s Office when preparing the commitments footnote disclosure within the State’s ACFR. FAILURE TO DESIGN AND IMPLEMENT CONTROLS OVER PENALTIES AND FINES The Commission has neither designed nor implemented internal controls to enforce penalties imposed by Workers’ Compensation Act (Act). The Act (820 ILCS 305/7) established the Rate Adjustment Fund to make cost- of-living adjustment payments to injured workers with a final decision awarding permanent total disability or death benefits. To pay these benefits, the Act requires the Commission assess all self-insured employers and insurers to pay up to 1.25% of its workers’ compensation payments, less hospital, surgical, and rehabilitation payments, for first six months and the second six months of the year. Similarly, the Act (820 ILCS 305/7 and 820 ILCS 305/8) established the Second Injury Fund to pay the differential between the complete loss of a second member (a hand, a foot, a leg, or an eye) and a permanent total disability for workers which had already suffered the loss of a member. To pay these benefits, the Act requires the Commission assess all self-insured employers and insurers to pay up to 0.125% of its workers’ compensation payments, less hospital, surgical, and rehabilitation payments, for first six months and the second six months of the year. The Commission mails all registered self-insured employers and insurers notice of the preceding period’s assessment in February and August, along with a form to calculate the amount due. Each self-insured employer and insurer must submit their full payment, along with the form, to the Commission no later than March 15 and September 15. In the event the Commission, after notice and a hearing, finds an employer willfully and knowingly either (1) failed to pay the proper amounts due to either the Rate Adjustment Fund or the Second Injury Fund or (2) did not make their payment within the time period prescribed by law, the employer must pay an additional 20% of the amount due or $2,500, whichever is greater, as a penalty under the Act (820 ILCS 305/7). Further, the Act (820 ILCS 305/7) authorizes the Commission, for good cause shown, to waive the penalty. During testing of the Commission’s receipt codes, we noted the Commission did not have a receipt source code within the State’s Chart of Accounts for these penalties collected by the Commission. In following up on this matter with Commission officials, they indicated the Commission did not need a code for this type of receipt as the Commission never imposes this penalty. In following up on this matter with the Commission’s legal staff, they indicated the Act’s penalty was designed as a deterrent and that the lack of penalties imposed was evidence of the success of the Commission’s efforts to collect amounts due by making responsible parties aware of their obligations to pay their assessments. In response, we inquired if the Commission had policies and procedures for its staff to identify and refer potential cases where a penalty may be appropriate, to which the Commission’s legal staff stated they did not believe any guidance outside of the statute was necessary. In following up on whether responsible parties were timely paying their obligations due to the Commission, we were unable to review complete and accurate accounts receivable information for the Rate Adjustment Fund and the Second Injury Fund, which would include the age and amount of past due accounts receivable to validate management’s assertion, due to the conditions noted in Finding 2021-004. However, our review of the Commission’s cash receipts records indicates the following cash collections on very old receivables occurred during the examination period: (Finding 22, pages 72-74) We recommended the Commission implement and maintain a control environment to enforce penalties for those parties who willfully and knowingly either delay or fail to pay their assessments to the Rate Adjustment Fund and the Second Injury Fund in accordance with the Act. The Commission disagreed with the finding, noting the wording of the statute (820 ILCS 305/7) is “willfully and knowingly” failing to pay assessments. In choosing this language, the General Assembly deliberately created a very high bar to meet before penalties should or even could be assessed. Additionally, the Commission must make “a finding . . . after reasonable notice and hearing.” The Commission would need compelling evidence (1) an employer was aware it needed to pay an assessment for the Rate Adjustment Fund and the Second Injury Fund, (2) the employer was aware of the “proper amounts” it needed to pay, and (3) the employer chose not to pay those amounts. Despite its aggressive management and supervision of the assessment process, the Commission has not encountered a situation where it had evidence an employer was aware of the assessment amount and that employer refused to pay. In an accountant’s comment, we noted the Commission’s poor internal controls over accounts receivable hinder its ability to (1) identify all self-insured employers and insurers, (2) determine if they owe assessments or have been responsive to the Commission’s communications, and (3) collect assessments due. As such, it is difficult to see how the Commission exercised “aggressive management and supervision of the assessment process” and conclude knowledgeable employers are always paying their assessments when due. In addition, while we do not disagree “willfully and knowingly” is a high bar, the Commission still does not even have a process to determine if the cash receipts they collected on assessments from up to 11 years ago warranted the imposition of a penalty under the Act under this high bar, let alone a process to identify and potentially assess penalties for as of yet unpaid assessments. As of now, the Commission will accept extremely tardy payments without questioning whether the party should receive a penalty, which does not encourage the timely collection of cash to fund benefits paid to injured employees from the Rate Adjustment Fund and the Second Injury Fund and may increase the rates paid by all employers to accommodate the Rate Adjustment Fund and the Second Injury Fund not receiving timely cash payments from tardy employers. Such a process neither protects the injured workers or responsible employers. OTHER FINDINGS The remaining findings pertain to (1) inadequate controls over property, service providers, telecommunication devices, performance evaluations, workforce reporting, monthly reconciliations, voucher processing, and employee training; (2) lack of fiscal controls over the CompFile! project; (3) inadequate information technology access controls; (4) weaknesses in cybersecurity programs and practices, change controls, and disaster contingency planning; (5) lack of a detailed agreement regarding security requirements; (6) noncompliance with report and publication requirements; and, (7) failure to seek a judgment in Circuit Court. We will review the Commission’s progress towards the implementation of our recommendations in our next State compliance examination. ACCOUNTANT’S OPINION The accountants conducted a State compliance examination of the Commission for the two years ended June 30, 2021, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Finding 2021-001 and Findings 2021-003 through 2021-011. Except for the noncompliance described in these findings, the accountants stated the Commission complied, in all material respects, with the requirements described in the report. This State compliance examination was conducted by Roth & Co., LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:djn