REPORT DIGEST DEPARTMENT OF MILITARY AFFAIRS COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED: JUNE 30, 2016 Release Date: August 22, 2017 FINDINGS THIS AUDIT: 11 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 1 -- 3 -- 4 Category 2: 2 -- 5 -- 7 Category 3: 0 -- 0 -- 0 TOTAL: 3 -- 8 -- 11 FINDINGS LAST AUDIT: 11 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (16-1) The Department did not maintain sufficient controls over its property and related fiscal records. • (16-2) The Department did not adhere to the internal auditing provisions of the Fiscal Control and Internal Auditing Act. • (16-3) The Department did not exercise adequate internal control over its commodities inventories. • (16-6) The Lincoln’s Challenge Academy within the Department did not maintain documentation to support compliance with the National Guard Challenge Program’s Cooperative Agreement. • (16-11) The Department did not have a formal, adequate fraud risk assessment program in place. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS PROPERTY CONTROL WEAKNESSES The Department did not maintain sufficient controls over its property and related fiscal records. During testing, the accountants noted the Department did not maintain detailed supporting documentation for its quarterly Agency Report of State Property (Form C-15) submitted to the Office of the State Comptroller (Comptroller). Due to the lack of detailed documentation, the following compliance examination procedures could not be performed: • Annual addition and deletion reports provided by the Department could not be agreed to activity reported in the quarterly Form C-15 reports submitted to the Comptroller. • Property additions during the examination period could not be reconciled to the Comptroller’s records reflected on the Object Expense/Expenditures by Quarter Report. Due to these conditions, the accountants were unable to conclude whether the Department’s population records were sufficiently precise and detailed under the Attestation Standards promulgated by the American Institute of Certified Public Accountants (AT-C § 205.35) to test the Department’s equipment. Even given the population limitations noted above which hindered the ability of the accountants to conclude whether selected samples were representative of the population as a whole, the accountants performed testing of what records were available. Some of the more significant issues noted by the accountants included the following: • Four of eight (50%) permanent improvements tested, totaling $119,785, were not added to the Department’s property records. In addition, one transfer from the Capital Development Board (CDB), totaling $19,572, was not added to the Department’s property records. • During voucher testing, the accountants identified 40 items, totaling $22,000, which were not added to the Department’s property listing. • Freight costs for 19 of 60 (32%) equipment additions tested, totaling $5,590, were not capitalized. • Seven of 60 (12%) equipment items selected from the Department’s property listing, totaling $54,910, were unable to be located at the Department. • The Department was unable to provide sufficient supporting documentation for its Fiscal Year 2016 Capital Asset Summary (Form SCO-538) submitted to the Comptroller during the annual financial reporting process. As a result, the accountants were unable to determine whether five of seven (71%) CDB transfers, totaling $296,895, were properly reported. • One of 10 (10%) historical artifacts tested was not listed on the Department’s historical artifacts listing. (Finding 1, pages 10-14). This finding has been repeated since 2004. We recommended the Department take action to strengthen its internal controls over recording and reporting its State property and equipment transactions. Further, the Department should implement a corrective action plan to complete a full inventory to identify and correct its accumulated property and equipment errors. Department officials agreed with the finding, but indicated the overall effects of the details of the finding are minimal. (For the previous Department response, see Digest Footnote #1.) In an accountant’s comment, we noted it is critical for accountants conducting an examination to reach a conclusion that a given population is sufficiently complete and detailed to ensure all items may be sampled. It is only after this conclusion has been reached that the accountants’ selection of an appropriate, representative sample of items for testing enables the accountants to reach conclusions about the population as a whole. In the Department’s case, its property records were in such poor condition that the accountants could not conclude that the property records were sufficiently precise and detailed to enable testing to reach conclusions about the population as a whole. While accountants would normally simply report this condition as a material weakness and not perform any further testing, the constitutional mission of the Auditor General to assist the General Assembly in achieving oversight of State government calls for testing of available records. Even the results of this testing (which cannot be used to reach conclusions about the population as a whole) revealed serious deficiencies in the Department’s property control functions. As this finding has been repeated since 2004, we continue to recommend the Department implement a corrective action plan to complete a full inventory to identify and correct its accumulated errors and address this population issue. NONCOMPLIANCE WITH THE FISCAL CONTROL AND INTERNAL AUDITING ACT The Department did not adhere to the internal auditing provision of the Fiscal Control and Internal Auditing Act (Act). During testing, the accountants noted the Department did not have a full-time program of internal audit and the Adjutant General did not appoint a Chief Internal Auditor at the Department during the examination period. (Finding 2, pages 15-16) This finding has been repeated since 2012. We recommended the Department establish a full-time internal audit program with a duly appointed Chief Internal Auditor in accordance with the provisions of the Act. Department officials agreed with the finding that there was no Chief Internal Auditor. Department officials disagreed with the assertion there was no full-time program of internal auditing and indicated there existed an interagency agreement that provided for an internal auditor and availability of a Chief Internal Auditor to review the work of the internal auditor position. (For the previous Department response, see Digest Footnote #2.) In an accountant’s comment, we noted the interagency agreement referenced by the Department is for the “dual-use” of a designated employee to serve as an internal auditor, who splits their working hours 50/50 between the Department and the Department of Veterans’ Affairs (DVA). Notably, the Agreement itself does not address the “availability of a Chief Internal Auditor to review the work of the internal auditor position” at the Department; rather, this “dual-use” internal auditor will report to the Adjutant General and the DVA Chief Internal Auditor. This is not a full-time program of internal auditing as contemplated by the provisions of the Act. INADEQUATE INTERNAL CONTROLS OVER COMMODITIES The Department did not exercise adequate internal controls over its commodities inventories. During testing, the accountants noted the following: • The Department did not segregate duties within its commodities transaction cycle. One individual has authority to perform all parts of the Department’s current transaction cycle, including custody by maintaining and tracking commodities items and authorization by reviewing and approving the purchase of items. • The Department did not establish two parts of the transaction cycle, including recordkeeping by maintaining a record of current items on hand or performing formal inventory counts and reconciliation by preparing reconciliations to the State Comptroller’s records verify each transaction’s validity, proper authorization, and entry into the Department’s accounting records. Due to these conditions, the accountants were unable to conclude whether the Department’s population records were sufficiently precise and detailed under the Attestation Standards promulgated by the American Institute of Certified Public Accountants (AT-C § 205.35) to test the Department’s commodities inventories. (Finding 3, pages 17-18). This finding has been repeated since 2012. We recommended the Department implement procedures to maintain records of its commodities inventory, perform periodic inventory counts, and reconcile its records to the State Comptroller’s records. Further, the Department should implement procedures to limit one person from having the authority to perform all of the functions associated with a transaction. Department officials agreed with this finding. (For the previous Department response, see Digest Footnote #3.) LACK OF DOCUMENTATION FOR LINCOLN’S CHALLENGE CADETS The Lincoln’s Challenge Academy (LCA) within the Department did not maintain documentation to support compliance with the National Guard Challenge Program’s Cooperative Agreement (Agreement). During testing at LCA, the accountants noted the following: • Forty-three of 48 (90%) Residential Phase cadet files did not include documentation the Pre-TABE Complete Battery scores were timely entered into the data management and reporting system. • Thirty-seven of 48 (77%) Residential Phase cadet files did not include documentation the Post-TABE Complete Battery scores were timely entered into the data management and reporting system. • Seventeen of 60 (28%) Pre-Challenge Phase cadet files tested did not include documentation to support the cadet was unemployed or underemployed. • Two of 60 (3%) Pre-Challenge Phase cadet files did not include documentation to support the cadet was physically and mentally capable for participating in the Residential Phase. • Nine of 60 (15%) Pre-Challenge Phase cadet files tested did not include evidence of a review of the cadet’s performance during the Acclimation Period. (Finding 6, pages 24-27). This finding has been repeated since 2012. We recommended the Department comply with the Agreement by ensuring cadets meet all required criteria for entry into LCA, timely entering each cadet’s pre-TABE and post-TABE scores, and maintaining documentation to substantiate cadet qualifications and compliance during each phase at the LCA. Department officials disagree with bullet points 1, 2, 4, and 5 by indicating they are in compliance with the Agreement, but that they agree with bullet point 3. (For the previous Department response, see Digest Footnote #4.) In an accountant’s comment, we noted in regards to bullet points one and two, the accountants were not provided documentation the scores were timely entered into the data management and reporting system. Although the Department stated in their response they disagree with these bullet points, the Department has agreed per their 2016 audit corrective action plan to maintain a printed, dated copy of the TABE entries into the data management and reporting system to verify that the scores were entered by the dates managed by the National Guard Bureau. In regards to bullet points four and five, the accountants are not disputing the Department’s assertion that the Department has a process to ensure the cadet was physically and mentally capable for participation in the Residential Phase and a process to review the cadet’s performance during the Acclimation Period. The accountant’s noted during our testing procedures that the Department could not provide evidentiary documentation to support the reviews were performed for certain cadets in our sample. As a result, the finding reflects the percentage of the sample found to be incorrect and not the percentage found to be correct. Further, the Department’s deficiencies in documenting compliance with requirements of the National Guard Challenge Program Cooperative Agreement are long standing. This finding has been repeated since 2012. Similar findings appear in our 2008, 2002, and 1994 reports. FAILURE TO DEVELOP A FORMAL FRAUD RISK ASSESSMENT PROGRAM The Department did not have a formal, adequate fraud risk assessment program in place. The Department relied on current internal controls and various other informal activities that had been implemented to prevent and detect fraud, but did not have a formal, comprehensive, written fraud risk assessment policy in place. (Finding 11, pages 35-36) We recommended Department management establish a continuous fraud prevention, deterrence, and detection program. We specifically recommended the Department implement a formal, written policy regarding the evaluation of fraud risk and a system of controls to help prevent and detect potential fraudulent activity within its organization. The Department should ensure the fraud program includes evaluating whether appropriate internal controls have been implemented in any areas identified as posing a higher risk of fraudulent activity, as well as controls over the financial reporting process. Department officials disagreed with the finding because they believe there are adequate fraud risk assessment activities ongoing at the Department to constitute an actual functioning program. In an accountant’s comment, we noted the Department was unable to provide evidence fraud risks were discussed and evaluated by management and controls were implemented for any risks identified. Without a formal, written fraud risk assessment program in place, employees and management may be unclear of the process to report noted fraud risks identified throughout the Department’s operations. In addition, the Department stated they relied on external auditing entities as part of their internal control process. External entities would constitute a post audit function which is not a substitute for appropriate internal controls facilitating prevention and timely detection of fraud by the Department. OTHER FINDINGS The remaining findings pertain to inadequate records substantiating interagency agreements, inadequate controls over refunds and reimbursements, the submission of incomplete and inaccurate financial information to the Comptroller, noncompliance with State laws regarding the operation of automotive equipment, inadequate controls over monthly reconciliations, and failure to file required reports. We will review the Department’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Department for the two years ended June 30, 2016, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Findings 2016-001 through 2016-004. Except for the noncompliance described in these findings, the accountants stated the Department complied, in all material respects, with the requirements described in the report. This compliance examination was conducted by the Office of the Auditor General’s staff. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:skm DIGEST FOOTNOTES #1 – PROPERTY CONTROL WEAKNESSES 2014 – Department concurs and will implement a corrective action plan based on the auditor’s recommendations. #2 - FAILURE TO COMPLY WITH THE FISCAL CONTROL AND INTERNAL AUDITING ACT (FCIAA) 2014 – Department concurs and will solicit additional funds through appropriate authorities to support a full-time internal audit program. The internal audit program implemented during the examination period had funding to support staffing only. #3 FAILURE TO MAINTAIN ADEQUATE COMMODITIES INVENTORY RECORDS AND CONTROLS 2014 – Department concurs and will implement a corrective action plan based on the auditor’s recommendations. We agree with the findings. The employee’s responsibilities are already segregated to control just commodities inventory. The Department is in the process of finding software to help us manage stock levels. #4 LACK OF DOCUMENTATION FOR LINCOLN’S CHALLENGE CADETS 2014 – Department concurs and will implement a corrective action plan based on the auditor’s recommendations.