REPORT DIGEST UNIVERSITY OF ILLINOIS FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2021 Release Date: May 25, 2022 FINDINGS THIS AUDIT: 2 CATEGORY: NEW -- REPEAT – TOTAL Category 1: 1 -- 0 -- 1 Category 2: 1 -- 0 -- 1 Category 3: 0 -- 0 -- 0 TOTAL: 2 -- 0 -- 2 FINDINGS LAST AUDIT: 0 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (21-1) The Regional Office of Education #41 did not have sufficient internal controls over the financial reporting process. • (21-2) The Regional Office of Education #41 lacked adequate controls over the review of internal controls over external service providers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS CONTROLS OVER FINANCIAL STATEMENT PREPARATION The Regional Office of Education #41 (ROE) did not have sufficient internal controls over the financial reporting process. The ROE maintained its accounting records on the cash basis of accounting during the fiscal year and posted year-end accrual entries for financial statement purposes. While the ROE maintained controls over the processing of most accounting transactions, there were not sufficient controls over the preparation of generally accepted accounting principles (GAAP) based financial statements for management or employees in the normal course of performing their assigned functions to prevent or detect and correct, financial statement misstatements and disclosure errors and omissions in a timely manner. Effective June 25, 2021, Public Act 102-0025 allowed a Regional Office of Education or Educational Service Center to utilize a cash basis, modified cash basis, or GAAP basis of accounting to prepare the financial statements for audit. The ROE has chosen to utilize the GAAP basis of accounting for financial statement reporting. The ROE is required to maintain a system of controls over the preparation of financial statements. The ROE’s internal controls over GAAP financial reporting should include adequately trained personnel with the knowledge, skills, and experience to prepare GAAP based financial statements and include all disclosures as required by the Governmental Accounting Standards Board (GASB). During review of the financial information prepared by the ROE, the following was noted: • Several adjustments were necessary to properly record interfund receivables, payables, and transfers. • Several adjustments were necessary to properly adjust capital outlay to actual. • Several adjustments were necessary to adjust individual fund cash balances and fund balances to actual. • An adjustment was necessary to properly record the Teacher Health Insurance Security (THIS) Postemployment Benefits Other Than Pensions (OPEB) on behalf revenue and expense. Regional Office management indicated it did not effectively detect all of the adjustments needed in order to present financial statements in accordance with GAAP. This was an oversight and due in part to a change in its accounting department during the current fiscal year. (Finding 21-001, pages 10a – 10b) The auditors recommended the ROE should implement comprehensive preparation and/or review procedures as part of its internal control over the preparation of financial statements to ensure the financial statements, including disclosures, are complete and accurate. These procedures should be performed by a properly trained individual(s) possessing a thorough understanding of the applicable GAAP, GASB pronouncements, and knowledge of the ROE’s activities and operations. Additionally, ROE management should consider Public Act 102-0025 to determine if changing to the cash or modified cash basis would be allowable or beneficial to the ROE and users of the ROE’s financial statements. ROE Response: The Regional Office agrees with the finding and corrective actions are being implemented. LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER EXTERNAL SERVICE PROVIDERS The Regional Office of Education #41 (ROE) utilizes a service provider, via Madison County, for its payroll processing. The ROE is responsible for the design, implementation, and maintenance of internal controls, including the controls that are outsourced to service providers, related to information systems and operations to ensure resources and data are adequately protected from unauthorized or accidental disclosure, modifications, or destruction. Generally accepted information technology guidance endorses the review and assessment of internal controls related to information systems and operations to assure the accurate processing and security of information. During testing, the auditors noted the ROE had not: • Developed a formal process for identifying service providers and for either obtaining the Service Organization Controls (SOC) report from the service provider and related subservice organization or performed alternative procedures to determine the impact of such services on its internal control environment. • Documented its review of the SOC report, or performed alternative procedures, to evaluate any issues relevant to the ROE’s internal controls. • Monitored and documented the operation of the Complementary User Entity Controls (CUECs) relevant to the ROE’s operations. Regional Office management indicated due to personnel changes in the accounting department of the ROE and Madison County, a review of a current SOC report or another form of independent internal controls reviews did not occur. (Finding 21-002, pages 10c – 10d) The auditors recommended the ROE identify all third-party service providers and determine and document if a review of controls is required. If required, the ROE should: • Obtain SOC reports or perform independent reviews of internal controls associated with outsourced systems, including services provided by subservice organizations, prior to signing agreements with the providers and annually thereafter. • Document its review of the SOC report, or perform alternative procedures, to evaluate all significant issues to ascertain if a corrective action plan exists, when it will be implemented, any impacts to the ROE, and any compensating controls. • Monitor and documented the operation of the CUECs relevant to the ROE’s operations. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. ROE Response: The Regional Office agrees with the finding and corrective actions are being implemented. AUDITORS’ OPINION Our auditors state the Regional Office of Education #41’s financial statements as of June 30, 2021 are fairly presented in all material respects. This financial audit was conducted by the firm of Kemper CPA Group LLP. JOE BUTCHER Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:JRB