REPORT DIGEST REGIONAL OFFICE OF EDUCATION #54: VERMILION COUNTY FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2021 Release Date: April 27, 2022 FINDINGS THIS AUDIT: 3 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 1 -- 1 -- 2 Category 3: 1 -- 0 -- 1 TOTAL: 2 -- 1 -- 3 FINDINGS LAST AUDIT: 3 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (21-1) The Regional Office of Education #54 lacked adequate controls over the review of internal controls over external service providers. • (21-2) The Regional Office of Education #54 had an improper application of accounting principle. • (21-3) The Regional Office of Education #54 did not provide completed financial statements in an auditable form by the August 31st due date. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER EXTERNAL SERVICE PROVIDERS The Regional Office of Education #54 (ROE) lacked adequate controls over the review of internal controls over external service providers. During testing, the auditors noted the ROE had not: • Developed a formal process for identifying service providers and for either obtaining the Service Organization Controls (SOC) reports from the service providers and related subservice organization or performing alternative procedures to determine the impact of such services on its internal control environment on an annual basis. • Documented its review of each of the SOC reports, or performed alternative procedures, to evaluate any issues relevant to the ROE’s internal controls. • Monitored and documented the operation of the Complementary User Entity Controls (CUECs) relevant to the ROE’s operations. The ROE is responsible for the design, implementation, and maintenance of internal controls related to information systems and operations to ensure resources and data are adequately protected from unauthorized or accidental disclosure, modifications, or destruction. This responsibility is not limited due to the process being outsourced. Generally accepted information technology guidance endorses the review and assessment of internal controls related to information systems and operations to assure the accurate processing and security of information. Regional Office officials indicated they understand the importance of a formal process to monitor service providers and due to competing priorities, they were still not able to address the issues noted. (Finding 21-001, pages 11 – 12) The auditors recommended the ROE identify all third-party service providers and determine and document if a review of controls is required. If required, the ROE should: • Obtain SOC reports or perform independent reviews of internal controls associated with outsourced systems including services provided by subservice organizations, at least annually. • Monitor and document the operation of the CUECs relevant to the ROE’s operations. • Document its review of the SOC reports or perform alternative procedures to evaluate all significant issues to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the ROE, and any compensating controls. • Review contracts with service providers to ensure applicable requirements over the independent review of internal controls are included. ROE Response: The ROE acknowledges the need to have System and Organizational Controls processes and policy in place to monitor service providers. Third party service providers with access to the confidential data of ROE #54 must have their internal controls reviewed prior to entering into a purchasing contract. An SOC audit is the preferred documentation of appropriate internal controls. In the event an SOC audit is not available from a third- party service provider, optional documentation covering the depth and breadth of an SOC audit may be considered. Contracts with third party service providers will be at the discretion of the Regional Superintendent. IMPROPER APPLICATION OF ACCOUNTING PRINCIPLE The Regional Office of Education #54 (ROE) reported and disclosed revenue receipts totaling $38,370 as an extraordinary item in its originally submitted financial statements for audit. Auditors determined the amount was actually ordinary local revenues and should not be reported and disclosed as extraordinary. The ROE submitted revised financial statements to report these amounts as local revenues and removed the note disclosure about the extraordinary item. Governmental Accounting Standards Board (GASB) Statement No. 62, Codification of Accounting and Financial Reporting Guidance Contained in Pre-November 30, 1989 FASB and AICPA Pronouncements defines extraordinary items as transactions or other events that are both unusual in nature and infrequent in occurrence. GASB Statement No. 62 states an event or transaction should be presumed to be ordinary and usual activity of the government, unless the evidence clearly supports its classification as a special or extraordinary item. Regional Office management indicated this was an oversight. The revenue receipts were charged to an account used in the prior year for receipts related to an actual extraordinary item reported in the prior audit and was assumed to be related to the same transaction. (Finding 21-002, pages 13 – 14) The auditors recommended the ROE should establish procedures to ensure that transactions which include special items and reporting be carefully reviewed for proper accounting and recognition in accordance with generally accepted accounting principles. ROE Response: The ROE acknowledges that revenue receipts totaling $38,370 was originally disclosed as an extraordinary item when they were submitted for the audit. However, the revenue should have been reported as ordinary. DELAY OF AUDIT The Regional Office of Education #54 (ROE) did not provide completed financial statements in an auditable form by the August 31st due date. The financial statements were provided on September 24, 2021. The ROE is subject to 105 ILCS 5/2-3.17a which requires the Auditor General’s office to cause an audit to be made, as of June 30th of each year, of the financial statements of all accounts, funds and other moneys in the care, custody or control of the regional superintendent of schools of each educational service region in the State and of each educational service center established in the School Code. The audit is to be conducted in accordance with Generally Accepted Government Auditing Standards. In accordance with 105 ILCS 5/2-3.17a, the Auditor General has promulgated administrative rules and regulations to govern this process. Those rules, 74 Ill. Adm. Code 420.320 (c) (2), state that for audit purposes, each regional office of education and educational service center shall make available to the Auditor General or his designee all books and records deemed necessary to make and complete the required audits. The records shall be in auditable form by August 15 of the succeeding fiscal year. Financial reports are to be available no later than August 31 in order for the annual audit to be completed by an independent auditor selected by the Auditor General. Additionally, effective June 25, 2021, Public Act 102-0025 allowed a Regional Office of Education or Educational Service Center to utilize a cash basis, modified cash basis, or GAAP basis of accounting to prepare financial statements for audit. The ROE has chosen to change to the modified cash basis of accounting for financial statement reporting. In addition, prudent business practices and transparency require timely preparation and completion of financial statements. The ROE indicated additional time was needed both by the contracted accountant and the ROE bookkeeper to convert the financial statements to modified cash basis. (Finding 21-003, pages 15 – 16) The auditors recommended the ROE should implement procedures to ensure compliance with 105 ILCS 5/2-3.17a and 74 Ill. Adm. Code 420.320 (c) (2). These financial statements need to be presented to the Auditor General’s independent auditors for audit by the August 31 deadline. ROE Response: The ROE acknowledges that the completed financial statements were not in an auditable form by the August 31st due date. Unfortunately, there were some unforeseeable challenges that created the delay, but the office acknowledges that it is our responsibility to ensure that the financial statements are prepared and ready prior to the August 31st due date. AUDITORS’ OPINION Our auditors state the Regional Office of Education #54’s financial statements as of June 30, 2021 are fairly presented in all material respects. This financial audit was conducted by the firm of Adelfia LLC. JOE BUTCHER Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:BAO