REPORT DIGEST REGIONAL OFFICE OF EDUCATION #33: HENDERSON, KNOX, MERCER AND WARREN COUNTIES FINANCIAL AUDIT (IN ACCORDANCE WITH THE UNIFORM GUIDANCE) FOR THE YEAR ENDED JUNE 30, 2021 Release Date: Aug. 17, 2022 FINDINGS THIS AUDIT: 4 CATEGORY: NEW -- REPEAT – TOTAL Category 1: 1 -- 1 -- 2 Category 2: 0 -- 1 -- 1 Category 3: 0 -- 1 -- 1 TOTAL: 1 -- 3 -- 4 FINDINGS LAST AUDIT: 5 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION • (21-1) The Regional Office of Education #33 did not have adequate internal control procedures. • (21-2) The Regional Office of Education #33 did not have sufficient internal controls over the financial reporting process. • (21-3) The Regional Office of Education #33 did not have adequate controls over the review of internal controls over external service providers. • (21-4) The Regional Office of Education #33 did not provide completed financial statements in an auditable form by the August 31 deadline. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE INTERNAL CONTROL PROCEDURES The Regional Office of Education #33 (ROE) did not have adequate internal control procedures. Auditors noted the following weaknesses in the ROE’s internal control system for which there were no mitigating controls: • No documented evidence of independent review of completed bank reconciliations. In addition, we noted that for 2 bank accounts, monthly reconciliations were not performed timely for 12 out of 12 months (100%). Twenty-four of 24 (100%) monthly bank reconciliations were reconciled more than 30 days after month-end (19 to 292 days late). • Untimely deposit of receipts. Auditors noted 10 of 40 receipts tested (25%), totaling $121,792, were not timely deposited, ranging from 9 to 29 days late. The Regional Superintendent of Schools is responsible for establishing and maintaining an internal control system over accounting transactions to prevent errors and fraud. Regional Office officials indicated employee resignation, staff transition, and competing priorities resulted in the conditions noted above. (Finding 21-001, pages 14 – 15) This finding was first reported in 2016. The auditors recommended the ROE should have an individual, independent of the general ledger processes, review the bank reconciliation to ensure timely completion and agreement to the general ledger. This review should be documented. The ROE should implement controls and maintain adequate documentation to ensure cash receipts are deposited in a timely manner. ROE Response: The Regional Office of Education No. 33 will have an individual, independent of the general ledger processes, review the bank reconciliation to ensure timely completion and agreement to the general ledger. He/she will document the review. The Regional Office of Education No. 33 will also implement controls and maintain adequate documentation to ensure cash receipts are deposited in a timely manner. CONTROLS OVER FINANCIAL STATEMENT PREPARATION The Regional Office of Education #33 (ROE) did not have sufficient internal controls over the financial reporting process. The ROE maintained its accounting records on the cash basis of accounting during the fiscal year and posted year-end accrual entries for financial statement purposes. While the ROE maintained controls over the processing of most accounting transactions, there were not sufficient controls over the preparation of the generally accepted accounting principles (GAAP) based financial statements for management or employees in the normal course of performing their assigned functions to prevent or detect financial statement misstatements and disclosure omissions in a timely manner. The School Code (105 ILCS 5/2-3.17a) allows a Regional Office of Education or Educational Service Center to utilize a cash basis, modified cash basis, or GAAP basis of accounting to prepare the financial statements for audit. The ROE has chosen to utilize the GAAP basis of accounting for financial statement reporting. The ROE is required to maintain a system of controls over the preparation of financial statements. ROE internal controls over GAAP financial reporting should include adequately trained personnel with the knowledge and expertise to prepare and/or thoroughly review GAAP based financial statements to ensure that they are free of material misstatements as required by the Governmental Accounting Standards Board (GASB). During the auditors’ review of subsequent collections, auditors noted a receipt totaling $45,100 for professional development courses rendered in fiscal year 2021 received in July 2021 was not reported in the proprietary fund and government-wide financial statements prepared by the ROE. This required a material adjustment to the financial statements. The ROE management indicated this was an oversight. (Finding 21-002, pages 16 – 17) The auditors recommended the ROE should establish procedures to ensure that financial statements be carefully reviewed for proper accounting and reporting in accordance with GAAP. Year-end cut-off entries for accruals should be reviewed to ensure they are complete and are charged to the proper account and correct fiscal year. Additionally, ROE management should determine if changing from the GAAP basis to the cash or modified cash basis of accounting would be allowable or beneficial to the ROE and users of the ROE statements. ROE Response: The Regional Office of Education No. 33 will establish procedures to ensure that financial statements be carefully reviewed for proper accounting and reporting in accordance with GAAP. Year-end cut-off entries for accrual will be reevaluated to ensure they are complete and are charged to the proper account and correct fiscal year. The Regional Office of Education No. 33 intends to change from the GAAP basis to the cash basis of accounting beginning July 1, 2021. The ROE has retained the accounting firm who prepared the Fiscal Year 2021 financial statements for Fiscal Year 2022 for the transition. LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER EXTERNAL SERVICE PROVIDERS As part of the audit process, auditors requested the Regional Office of Education #33 (ROE) to provide a population of the service providers utilized. The ROE was able to identify service providers that provided various hosting and backup services for the ROE. The ROE is responsible for the design, implementation, and maintenance of internal controls, including controls that are outsourced to service providers, related to information systems and operations to ensure resources and data are adequately protected from unauthorized or accidental disclosure, modifications, or destruction. This responsibility is not limited due to the process of being outsourced. Generally accepted information technology guidance endorses the review and assessment of internal controls related to information systems and operations to assure the accurate processing and security of information. During testing, the auditors noted the ROE had not: • Developed a formal process for obtaining the Service Organization Controls (SOC) reports from the service providers and related subservice organization or performing alternative procedures to determine the impact of such services on its internal control environment prior to signing an agreement with the service provider. • Documented its review of each of the SOC reports, or performed alternative procedures, to evaluate any issues relevant to the ROE’s internal controls. • Monitored and documented the operation of the Complementary User Entity Controls (CUECs) relevant to the ROE’s operations. Regional Office officials indicated they understand the importance of a formal process to monitor service providers and did not realize the current process did not address all the issues noted. (Finding 21-003, pages 18 – 19) The auditors recommended the ROE identify all third-party service providers and determine and document if a review of controls is required. If required, the ROE should: • Obtain SOC reports or perform independent reviews of internal controls associated with outsourced systems including services provided by subservice organizations, prior to signing agreements with the providers and annually thereafter. • Document its review of the SOC reports or perform alternative procedures to evaluate all significant issues to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the ROE, and any compensating controls. • Monitor and document the operation of the CUECs relevant to the ROE’s operations. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. ROE Response: The ROE will continue to identify all third-party service providers and determine and document if a review of controls is required. If required, the ROE will: • Obtain SOC reports or perform independent reviews of internal controls associated with outsourced systems including services provided by subservice organizations, prior to signing agreements with the providers and annually thereafter. • Document its review of the SOC reports or perform alternative procedures to evaluate all significant issues to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the ROE, and any compensating controls. • Monitor and document the operations of the CUECs relevant to the ROE’s operations. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. DELAY OF AUDIT The Regional Office of Education #33 (ROE) did not provide completed financial statements in an auditable form by the August 31 deadline. The financial statements were provided on November 12, 2021. The ROE is subject to 105 ILCS 5/2-3.17a which requires the Auditor General’s office to cause an audit to be made, as of June 30th of each year, of the financial statements of all accounts, funds, and other moneys in the care, custody, or control of the regional superintendent of schools of each educational service region in the State and of each educational service center established in the School Code. The audit is to be conducted in accordance with Generally Accepted Government Auditing Standards (GAGAS). The ROE may utilize a cash basis, modified cash basis, or generally accepted accounting principles (GAAP) basis of accounting to prepare the financial statements for audit. The ROE chose the GAAP basis of accounting for financial reporting. In accordance with 105 ILCS 5/2-3.17a, the Auditor General has promulgated administrative rules and regulations to govern this process. Those rules, 74 Ill. Adm. Code 420.320 (c) (2), state that for audit purposes, each regional office of education and educational service center shall make available to the Auditor General or his designee all books and records deemed necessary to make and complete the required audits. The records shall be in auditable form by August 15 of the succeeding fiscal year. Financial reports are to be available no later than August 31 in order for the annual audit to be completed by an independent auditor selected by the Auditor General. In addition, prudent business practices and transparency require timely preparation and completion of financial statements. Regional Office officials indicated competing priorities resulted in the delay in the preparation of Fiscal Year 2021 financial statements. (Finding 21-004, pages 20 – 21) This finding was first reported in 2018. The auditors recommended the ROE should implement procedures to ensure compliance with 105 ILCS 5/2-3.17a and 74 Ill. Adm. Code 420.320 (c) (2). Additionally, ROE should determine if changing to the cash basis would be allowable and beneficial to the ROE and users of its financial statements. These financial statements need to be presented to the Auditor General’s independent auditors for audit by the August 31 deadline. ROE Response: The Regional Office of Education No. 33 will implement procedures to ensure compliance with 105 ILCS 5/2-3.17a and 74 Ill. Adm. Code 420.320 (c) (2). Additionally, the ROE has been given the authority to switch over to the cash basis of accounting and is planning to do so beginning July 1, 2021. Fiscal Year 2022 financial statements will be presented to the Auditor General’s independent auditors for audit by the August 31 deadline. AUDITORS’ OPINION Our auditors state the Regional Office of Education #33’s financial statements as of June 30, 2021 are fairly presented in all material respects. This financial audit was conducted by the firm of Adelfia LLC. JOE BUTCHER Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:BAO