REPORT DIGEST

REGIONAL OFFICE OF EDUCATION #8: CARROLL, JO
DAVIESS, AND STEPHENSON COUNTIES

FINANCIAL AUDIT
FOR THE YEAR ENDED JUNE 30, 2023

Release Date:  March 27, 2024

FINDINGS THIS AUDIT: 2

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  0 -- 0 -- 0
Category 2:  2 -- 0 -- 2
Category 3:  0 -- 0 -- 0
TOTAL:  2 – 0 -- 2

FINDINGS LAST AUDIT:  0

Category 1: Findings that are material
weaknesses in internal control and/or a
qualification on compliance with State laws
and regulations (material noncompliance).
Category 2: Findings that are significant
deficiencies in internal control and
noncompliance with State laws and
regulations.
Category 3: Findings that have no internal
control issues but are in noncompliance with
State laws and regulations.

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, Iles Park
Plaza, 740 E. Ash Street, Springfield, IL
62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

SYNOPSIS

• (23-1) The Regional Office of Education #8
lacked adequate controls over the review of
internal controls over external service
providers.

• (23-2) The Regional Office of Education #8
did not have adequate internal controls over
disposal of capital assets.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

LACK OF ADEQUATE CONTROLS OVER REVIEW OF
INTERNAL CONTROLS OVER EXTERNAL SERVICE
PROVIDERS

The Regional Office of Education #8 (ROE)
lacked adequate controls over the review of
internal controls over external service
providers. During testing, the auditors
noted the ROE had not:

• Developed a formal process for identifying
service providers and for either obtaining
the Service Organization Controls (SOC)
reports from the service providers and
related subservice organization or
performing alternative procedures to
determine the impact of such services on its
internal control environment on an annual
basis.
• Documented its review of each of the SOC
reports, or performed alternative
procedures, to evaluate any issues relevant
to the ROE’s internal controls.
• Monitored and documented the operation of
the Complementary User Entity Controls
(CUECs) relevant to the ROE’s operations.

The ROE is responsible for the design,
implementation, and maintenance of internal
controls, including the controls that are
outsourced to service providers, related to
information systems and operations to ensure
resources and data are adequately protected
from unauthorized or accidental disclosure,
modifications, or destruction. This
responsibility is not limited due to the
process being outsourced.

Generally accepted information technology
guidance endorses the review and assessment
of internal controls related to information
systems and operations to assure accurate
processing and security of information.

Regional Office management indicated they
understand the importance of a formal
process to monitor service providers and due
to competing priorities, they were still not
able to address the issues noted. (Finding
2023-001, pages 11 – 12)

The auditors recommended the ROE identify
all third-party service providers and
determine and document if a review of
controls is required. If required, the ROE
should:

• Obtain SOC reports or perform independent
reviews of internal controls associated with
outsourced systems including services
provided by subservice organizations, at
least annually.
• Monitor and document the operation of the
CUECs relevant to the ROE’s operations.
• Document its review of the SOC reports or
perform alternative procedures to evaluate
all significant issues to ascertain if a
corrective action plan exists and when it
will be implemented, any impacts to the ROE,
and any compensating controls.
• Review contracts with service providers to
ensure applicable requirements over the
independent review of internal controls are
included.

ROE Response: ROE No. 8 understands the
importance of this finding and has consulted
with other ROEs on a best practice procedure
to comply with this requirement. The
corrective action indicates a new procedural
plan as follows:

• Obtain SOC reports from providers on an
annual basis in December of each year.
• Regional Superintendent or Asst. Regional
Superintendent reviews and initials SOC
reports.
• Regional Superintendent or Asst. Regional
Superintendent reviews any significant
issues with providers and ascertains if a
corrective action plan exists.
• Regional Superintendent or Asst. Regional
Superintendent reviews contracts with
service providers to ensure applicable
requirements over independent review of
internal controls are included.
• Regional Superintendent or Asst. Regional
Superintendent monitors CUECs relevant to
ROE #8.
• ROE No. 8 will refer any concerns to its
technology support contractor.

INADEQUATE INTERNAL CONTROLS OVER DISPOSAL
OF CAPITAL ASSETS

The Regional Office of Education #8 (ROE)
did not have adequate internal controls over
disposal of capital assets. Auditors noted 5
of 5 disposed equipment tested (100%), had
no documentation of approval for the
disposal.

The Regional Office of Education Accounting
Manual requires each ROE to maintain
detailed fixed assets for accounting
purposes, as well as insurance purposes, for
fixed assets costing $500 or more. In
addition, sound internal controls require
that policies and procedures on fixed assets
should cover acquisition and tagging,
recording and reporting, depreciation (if
applicable), transfers and dispositions, an
annual physical inventory, and they should
be formally documented and consistently
applied.

Regional Office management indicated
competing priorities resulted in not having
adequate controls over the maintenance of
the disposal of capital assets. (Finding
2023-002, page 13)

The auditors recommended the ROE should
establish and document internal control
procedures to ensure disposal of capital
assets is properly maintained.

ROE Response: ROE No. 8 understands the
nature of this finding, and has begun to
implement a corrective action plan, which
should be fully implemented by June 30,
2024. ROE No. 8 will add an equipment
disposal section to our current inventory
log and advise Program Coordinators to
document approval to dispose of equipment
(items over $500). The Grant Coordinator
manages the current inventory log and will
be responsible for implementing this
procedure.

AUDITORS’ OPINION

Our auditors state the Regional Office of
Education #8’s financial statements as of
June 30, 2023 are fairly presented in all
material respects.

This financial audit was conducted by the
firm of Adelfia LLC.

JOE BUTCHER
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:BAO