REPORT DIGEST REGIONAL OFFICE OF EDUCATION # 54: VERMILION COUNTY FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2020 Release Date: January 13, 2021 FINDINGS THIS AUDIT: 0 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 0 -- 0 -- 0 Category 3: 0 -- 0 -- 0 TOTAL: 0 -- 0 -- 0 FINDINGS LAST AUDIT: 0 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (20-1) The Regional Office of Education #54 did not have sufficient internal controls over the financial reporting process. • (20-2) The Regional Office of Education #54 had inadequate review of bank accounts. • (20-3) The Regional Office of Education #54 had a lack of adequate controls over the review of internal controls over external service providers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS CONTROLS OVER FINANCIAL STATEMENT PREPARATION The Regional Office of Education No. 54 (ROE) did not have sufficient internal controls over the financial reporting process. The ROE maintained its accounting records on the cash basis of accounting during the fiscal year and posted year-end accrual entries for financial statement purposes. While the ROE maintained controls over the processing of most accounting transactions, there were not sufficient controls over the preparation of the generally accepted accounting principles (GAAP) based financial statements for management or employees in the normal course of performing their assigned functions to prevent or detect financial statement misstatements and disclosure omissions in a timely manner. The Regional Office is required to maintain a system of controls over the preparation of financial statements in accordance with GAAP. The ROE’s internal controls over GAAP financial reporting should include adequately trained personnel with the knowledge, skills, and experience to prepare GAAP based financial statements and include all disclosures as required by the Governmental Accounting Standards Board (GASB). During review of the ROE’s financial information prepared by the ROE, auditors noted the ROE’s financial information required a material adjusting entry in order to present its financial statements in accordance with GAAP. Regional Office management indicated that a miscoded item in a non-routine transaction caused the material error. (Finding 20-001, pages 10 – 11) This finding was first reported in 2010. The auditors recommended that as part of internal control over the preparation of financial statements, the ROE should implement comprehensive preparation procedures to ensure that the financial statements are complete and accurate. These procedures should be performed by a properly trained individual(s) possessing a thorough understanding of applicable GAAP, GASB pronouncements, and knowledge of the ROE’s activities and operations. ROE Response: The Regional Office of Education No. 54 acknowledges the one error in coding a non-routine transaction which caused the material finding. A bookkeeping error was made and the ROE has been informed of the incorrect coding and recognizes how to prevent it from happening again. INADEQUATE REVIEW OF BANK ACCOUNTS The Regional Office of Education #54’s (ROE) bank reconciliations were not being reviewed or did not show documentation of review to ensure the reconciliation is taking place and that the reconciliation is complete. The Regional Office is responsible for establishing and maintaining a system of internal controls over cash to prevent errors and fraud. This includes timely preparation and review of bank reconciliations. Each month’s bank statements should be reconciled to the related general ledger account balance and reviewed by the appropriate level of management. Regional Office management indicated they had insufficient internal controls over the bank reconciliation process. (Finding 20-002, page 12) The auditors recommended that as part of its internal controls over bank reconciliations, the ROE’s management should review bank reconciliations and document their review each month after the reconciliation has been completed. ROE Response: The ROE acknowledges that bank reconciliations were not being reviewed to ensure reconciliation was taking place and complete. Although the statements were reviewed by multiple staff members, they were not reviewed after reconciliation had been completed. LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER EXTERNAL SERVICE PROVIDERS As part of the audit process, auditors requested the Regional Office of Education #54 (ROE) provide a population of the service providers utilized. The ROE was able to identify service providers that provided various hosting and backup services for the ROE. The ROE is responsible for the design, implementation, and maintenance of internal controls, including the controls that are outsourced to service providers, related to information systems and operations to ensure resources and data are adequately protected from unauthorized or accidental disclosure, modifications, or destruction. Generally accepted information technology guidance endorses the review and assessment of internal controls related to information systems and operations to assure the accurate processing and security of information. During testing, the auditors noted the ROE had not: • Developed a formal process for identifying service providers and obtaining the Service Organization Controls (SOC) reports from the service providers on an annual basis. • Documented its review of each of the SOC reports. • Monitored and documented the operation of the Complementary User Entity Controls (CUECs) relevant to the ROE’s operations. • Obtained and reviewed SOC reports for subservice organizations or performed alternative procedures to determine the impact on its internal control environment. Regional Office officials indicated they understand the importance of a formal process to monitor service providers; however, they have not completed a policy to address the issues due to other priorities. (Finding 20-003, pages 13 – 14) The auditors recommended the ROE identify all third-party service providers and determine and document if a review of controls is required. If required, the ROE should: • Obtain SOC reports or perform independent reviews of internal controls associated with outsourced systems at least annually. • Monitor and document the operation of the CUECs relevant to the ROE’s operations. • Either obtain and review SOC reports for subservice organizations or perform alternative procedures to satisfy itself that the existence of the subservice organization would not impact the ROE’s internal control environment. • Document its review of the SOC reports and review all significant issues with subservice organizations to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the ROE, and any compensating controls. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. ROE Response: The ROE acknowledges the need to have System and Organizational Controls processes and policy in place to monitor service providers. Third party service providers with access to the confidential data of the ROE must have their internal controls reviewed prior to entering into a purchasing contract. An SOC audit is the preferred documentation of appropriate internal controls. In the event an SOC audit is not available from a third-party service provider, optional documentation covering the depth and breadth of an SOC audit may be considered. Contracts with third party service providers will be at the discretion of the Regional Superintendent. AUDITORS’ OPINION Our auditors state the Regional Office of Education #54’s financial statements as of June 30, 2020 are fairly presented in all material respects. This financial audit was conducted by the firm of West & Company, LLC. JOE BUTCHER Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:BAO