REPORT DIGEST REGIONAL OFFICE OF EDUCATION #32 : IROQUOIS AND KANKAKEE COUNTIES FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2020 Release Date: AUGUST 24, 2021 FINDINGS THIS AUDIT: 3 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 1 -- 1 Category 2: 1 -- 0 -- 1 Category 3: 1 -- 0 -- 1 TOTAL: 2 -- 1 -- 3 FINDINGS LAST AUDIT: 2 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (20-1) The Regional Office of Education #32 did not have sufficient internal controls over the financial reporting process. • (20-2) The Regional Office of Education #32 lacked adequate controls over the review of internal controls over external service providers. • (20-3) The Regional Office of Education #32 did not provide completed financial statements in an auditable form by the August 31 deadline. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS CONTROLS OVER FINANCIAL STATEMENT PREPARATION The Regional Office of Education #32 (ROE) did not have sufficient internal controls over the financial reporting process. The ROE maintained its accounting records on the cash basis of accounting during the fiscal year and posted year-end accrual and other applicable entries for financial statement purposes. While the ROE maintained controls over the processing of most accounting transactions, there were not sufficient controls over the preparation of the generally accepted accounting principles (GAAP) based financial statements for management or employees in the normal course of performing their assigned functions to prevent or detect financial statement misstatements and disclosure errors and omissions in a timely manner. The ROE is required to maintain a system of controls over the preparation of financial statements in accordance with GAAP. The ROE’s internal controls over GAAP financial reporting should include adequately trained personnel with the knowledge, skills, and experience to prepare the GAAP based financial statements and include all disclosures as required by the Governmental Accounting Standards Board (GASB). During review of the ROE’s financial information prepared by the ROE, auditors noted the ROE’s financial information required a material adjusting entry in order to present its financial statements in accordance with GAAP. Regional Office management indicated the complex requirements of GASB statements will require additional time and training before the ROE can fully implement the requirements on its own. (Finding 20-001, pages 10a – 10b) The auditors recommended that the ROE should implement comprehensive preparation and/or review procedures as a part of its internal control over the preparation of financial statements to ensure the financial statements, including disclosures, are complete and accurate. These procedures should be performed by a properly trained individual(s) possessing a thorough understanding of the applicable GAAP, GASB pronouncements, and knowledge of the ROE’s activities and operations. ROE Response: The ROE will train I-KAN Staff to improve skills in implementing comprehensive preparation and/or review procedures as part of internal control over the preparation of financial statements. LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER EXTERNAL SERVICE PROVIDERS As part of the audit process, auditors held discussions with Regional Office of Education #32 (ROE) personnel regarding the ROE’s change in accounting software. The ROE switched to an accounting software which utilizes a service provider to provide hosting and backup services for the ROE. The ROE is responsible for the design, implementation, and maintenance of internal controls, including the controls that are outsourced to service providers, related to information systems and operations to ensure resources and data are adequately protected from unauthorized or accidental disclosure, modifications, or destruction. Generally accepted information technology guidance endorses the review and assessment of internal controls related to information systems and operations to assure the accurate processing and security of information. During testing, the auditors noted the ROE had not: • Developed a formal process for identifying service providers and for either obtaining the Service Organization Controls (SOC) report from the service provider and related subservice organization or performing alternative procedures to determine the impact of such services on its internal control environment prior to signing an agreement with the service provider. • Documented its review of the SOC report, or performed alternative procedures, to evaluate any issues relevant to the ROE’s internal controls. • Monitored and documented the operation of the Complementary User Entity Controls (CUECs) relevant to the ROE’s operations. Regional Office management indicated the ROE transitioned software and did not have the current SOC report prior to the site visit of the auditing firm. (Finding 20-002, pages 10c – 10d) The auditors recommended the ROE identify all third-party service providers and determine and document if a review of controls is required. If required, the ROE should: • Obtain SOC reports or perform independent reviews of internal controls associated with outsourced systems, including services provided by subservice organizations, prior to signing agreements with the providers and annually thereafter. • Document its review of the SOC report, or perform alternative procedures, to evaluate all significant issues to ascertain if a corrective action plan exists, when it will be implemented, any impacts to the ROE, and any compensating controls. • Monitor and document the operation of the CUECs relevant to the ROE’s operations. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. ROE Response: The ROE will: • Obtain SOC reports or perform independent reviews of internal controls associated with outsourced systems, including services provided by subservice organizations, prior to signing agreements with the providers and annually thereafter. • Document its review of the SOC report, or perform alternative procedures, to evaluate all significant issues to ascertain if a corrective action plan exists, when it will be implemented, any impacts to the ROE, and any compensating controls. • Monitor and document the operation of the CUECs relevant to the ROE’s operations. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. DELAY OF AUDIT The Regional Office of Education #32 (ROE) did not provide completed financial statements in an auditable form by the August 31 deadline. Financial statements were provided on November 24, 2020. The ROE is subject to 105 ILCS 5/2-3.17a which requires the Auditor General’s office to cause an audit to be made, as of June 30th of each year, of the financial statements of all accounts, funds, and other moneys in the care, custody, or control of the regional superintendent of schools of each educational service region in the State and of each educational service center established in the School Code. The audit is to be conducted in accordance with Generally Accepted Government Auditing Standards (GAGAS). In accordance with 105 ILCS 5/2-3.17a, the Auditor General has promulgated administrative rules and regulations to govern this process. Those rules, 74 Ill. Adm. Code 420.320 (c) (2), state that for audit purposes, each regional office of education and educational service center shall make available to the Auditor General or his designee all books and records deemed necessary to make and complete the required audits. The records shall be in auditable form by August 15 of the succeeding fiscal year. Financial reports are to be available no later than August 31 in order for the annual audit to be completed by an independent auditor selected by the Auditor General. Annual financial statements are to be prepared on an accrual basis of accounting in accordance with generally accepted accounting principles (GAAP). In addition, prudent business practices and transparency require timely preparation and completion of financial statements. Regional Office management indicated the delay of audit was due to implementing a new accounting system. Specialized Data Systems (SDS) was not set up properly when the conversion took place in October 2019. (Finding 20-003, pages 10e – 10f) The auditors recommended the ROE should implement procedures to ensure compliance with 105 ILCS 5/2-3.17a and 74 Ill. Adm. Code 420.320 (c) (2). Annual financial statements should be compiled on an accrual basis of accounting in accordance with GAAP. These financial statements need to be presented to the Auditor General’s independent auditors for audit by the August 31 deadline. ROE Response: The Delay of Audit was due to implementing a new accounting system. Specialized Data Systems (SDS) was not set up properly when the conversion took place in October 2019. The Finance Officer had to go back and manually recalculate each payroll from October 2019 to June 2020 to post each payroll to the correct cash account. AUDITORS’ OPINION Our auditors state the Regional Office of Education #32’s financial statements as of June 30, 2020 are fairly presented in all material respects. This financial audit was conducted by the firm of West & Company, LLC. JOE BUTCHER Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:JRB