REPORT DIGEST REGIONAL OFFICE OF EDUCATION #1: ADAMS, BROWN, CASS, MORGAN, PIKE AND SCOTT COUNTIES FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2021 Release Date: April 13, 2022 FINDINGS THIS AUDIT: 4 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 1 -- 2 -- 3 Category 3: 1 -- 0 -- 1 TOTAL: 2 -- 2 -- 4 FINDINGS LAST AUDIT: 2 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (21-1) The Regional Office of Education #1 had inadequate controls over the bank reconciliation process. • (21-2) The Regional Office of Education #1 had inadequate controls over receipts. • (21-3) The Regional Office of Education #1 lacked adequate controls over the review of internal controls over external service providers. • (21-4) The Regional Office of Education #1 was in noncompliance with grant requirements. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROLS OVER BANK RECONCILIATION PROCESS The Regional Office of Education #1 (ROE) did not have adequate controls over the bank reconciliation process. The ROE maintained 11 bank accounts. During the audit, auditors noted that in 4 bank accounts, 28 of 48 monthly bank reconciliations (58 percent) were reconciled more than a month late. Effective internal control policies require complete and accurate accounting records of all transactions of the entity. Sound internal controls require bank reconciliations to be performed accurately and promptly. Reconciling items should be investigated immediately, and adjustments made to the general ledger. Bank reconciliations should also be reviewed and approved by a person independent of the preparer in a timely manner. Regional Office officials indicated bank reconciliations were delayed due to system issues that were not resolved timely for them to prepare their bank reconciliations. (Finding 21-001, pages 11 – 12) The auditors recommended the ROE should prepare monthly bank reconciliations on a timely basis. This would ensure that the cash balance per ledger is correct and cash transactions are fully accounted for. The ROE should identify alternative procedures to manage future system issues. ROE Response: The data transfer of moving to a new accounting system created unexpected challenges that resulted in monthly bank reconciliations not being completed in a timely manner. Management accepts this finding and will identify alternative procedures to manage future system issues. INADEQUATE CONTROLS OVER RECEIPTS The Regional Office of Education #1 (ROE) did not document the date of cash receipts. During the audit, auditors used the dates of the checks received to determine the timeliness of deposit. Auditors noted 11 of 40 receipts tested (28%), totaling $192,081, were not timely deposited, ranging from 1 to 33 days late. Sound internal controls require a policy on timeliness of deposits, either based on dollar threshold or defined timeframe, from the date of receipt. Regional Office officials indicated the exceptions noted were because they have not formally documented their deposit policy, which includes timing of deposit and required supporting documentation such as receipt date. (Finding 21-002, page 13) The auditors recommended the ROE should implement controls and maintain adequate supporting documentation to ensure cash receipts are deposited in a timely manner. ROE Response: Management accepts this finding and will implement controls and maintain adequate supporting documentation to ensure cash receipts are deposited in a timely manner. LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER EXTERNAL SERVICE PROVIDERS The Regional Office of Education #1 (ROE) lacked adequate controls over the review of internal controls over external service providers. During testing, the auditors noted the ROE had not: • Developed a formal process for identifying service providers and for either obtaining the Service Organization Controls (SOC) reports from the service providers and related subservice organization or performing alternative procedures to determine the impact of such service on its internal control environment prior to signing an agreement with the service provider. • Documented its review of each of the SOC reports or performed alternative procedures to evaluate any issues relevant to the ROE’s internal controls. • Monitored and documented the operation of the Complementary User Entity Controls (CUECs) relevant to the ROE’s operations. The ROE is responsible for the design, implementation, and maintenance of internal controls, including the controls that are outsourced to service providers, related to information systems and operations to ensure resources and data are adequately protected from unauthorized or accidental disclosure, modifications, or destruction. Generally accepted information technology guidance endorses the review and assessment of internal controls related to information systems and operations to assure the accurate processing and security of information. Regional Office management indicated they understand the importance of a formal process to monitor service providers and did not realize the current process was not adequate to address all the issues noted. (Finding 21-003, pages 14 – 15) The auditors recommended ROE identify all third-party service providers and determine and document if a review of controls is required. If required, the ROE should: • Obtain SOC reports or perform independent review of internal controls associated with outsourced systems including services provided by subservice organizations prior to signing agreements with the providers and annually thereafter. • Monitor and document the operation of the CUECs relevant to the ROE’s operations. • Document its review of the SOC reports or perform alternative procedures, to evaluate all significant issues to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the ROE, and any compensating controls. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. ROE Response: Management accepts this finding. ROE No. 1 will identify all third-party service providers and determine and document if a review of controls is required. If required, ROE No. 1 will: • Obtain SOC reports prior to signing agreements and annually thereafter. • Monitor and document the operation of the CUECs relevant to ROE No. 1’s operations. • Document the review of the SOC reports, evaluate all significant issues to ascertain if a corrective action plan exists and when it will be implemented, any impacts to ROE No. 1, and any compensating controls. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. NONCOMPLIANCE WITH GRANT REQUIREMENTS The Regional Office of Education #1 (ROE) was in noncompliance with grant requirements. The ROE did not timely submit 8 of 25 (32%) quarterly expenditure reports, ranging from 2 to 21 days late. The Illinois Grant Funds Recovery Act (30 ILCS 705/4) requires State grant recipients with awards in excess of $25,000 to submit quarterly expenditure reports to reflect the process of the grant program. The Illinois State Board of Education (ISBE) requires all grant recipients regardless of amount awarded, to submit quarterly expenditure reports. The State and Federal Grant Administration Policy, Fiscal Requirements, and Procedures of the ISBE Division of Funding and Disbursement Services require expenditure reports to be filed within 20 calendar days of the end of each reporting quarter. Regional Office management indicated in four of the exceptions noted, there were no expenditures during the quarter and they were not aware that reports were still required to be submitted. For the remaining four exceptions, it was an oversight on their end as two of the grants were new grants. (Finding 21-004, page 16) The auditors recommended the ROE should develop internal controls to ensure expenditure reports are submitted within the grantors’ due date. ROE Response: Management accepts this finding and will develop internal controls to ensure expenditure reports are submitted within the grantors’ due date. AUDITORS’ OPINION Our auditors state the Regional Office of Education #1’s financial statements as of June 30, 2021 are fairly presented in all material respects. This financial audit was conducted by the firm of Adelfia LLC. JOE BUTCHER Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:JRB