REPORT DIGEST ILLINOIS RACING BOARD Compliance Examination For the Two Years Ended June 30, 2014 Release Date: September 10, 2015 FINDINGS THIS AUDIT: 15 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 3 -- 6 -- 9 Category 2: 2 -- 4 -- 6 Category 3: 0 -- 0 -- 0 TOTAL: 5 -- 10 -- 15 FINDINGS LAST AUDIT: 16 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (14-2) The Board had inadequate internal controls over collecting and reporting receipts and lacked adequate cash management for ensuring the timely and efficient deposit of cash. • (14-3) The Board lacked control over its personal services expenditures. • (14-4) The Board was unable to provide adequate records substantiating the population of individuals who received occupation licenses. • (14-8) The Board was unable to distribute all inter-track wagering location admission fees to the City of Chicago and Cook County. • (14-9) The Board did not comply with, or enforce compliance with, provisions of the Illinois Horse Racing Act of 1975 and the Illinois Administrative Code at the racetracks. • (14-12) The Board failed to enforce specific statutory racing requirements for thoroughbred and standardbred racetracks. • (14-15) The Board inadequately secured and controlled confidential and personal information. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROLS OVER RECEIPTS The Illinois Racing Board (Board) did not have adequate internal controls over collecting and reporting receipts and lacked adequate cash management for ensuring both the timely and efficient deposit of cash into the State Treasury. During testing, some of the more significant issues noted by the auditors included the following: • Thirteen of 60 (22%) receipts tested, totaling $1,455,784, were deposited into the State Treasury between one and 46 business days late after exhausting any applicable receipt deposit extensions. • Two of 60 (3%) receipts selected for testing, totaling $21,282, were not provided to the auditors for testing, as the Board did not have documentation to support the receipt transaction. • Three of 60 (5%) receipt deposit transmittals (RDTs) tested, totaling $8,613, were not timely remitted to the State Comptroller within a reasonable period of time. The RDTs were remitted to the State Comptroller between 32 and 37 days after the Board received a State Treasurer’s Draft. • Four of 60 (7%) receipts tested, totaling $114,815, did not trace to the Board’s Cash Receipt Journals. In following up on this matter with an official with the Administrative and Regulatory Shared Services Center at the Department of Revenue (Shared Services), the official indicated Shared Services was correcting prior errors by incorrectly posting subsequent receipts to the wrong receipt account. • The Board does not have a centralized listing of each individual cash receipt received by the Board with a detailed itemized account of all moneys showing the date of receipt, the payor, purpose, and amount, and the date and manner of disbursement. • The Board does not prepare a proper reconciliation of its receipts to the State Comptroller’s Monthly Revenue Status Report. (Finding 2, pages 20-28) This finding has been repeated since 2010. We recommended the Board take action to establish and implement controls over the Board’s receipt process. Board officials agreed, noting they are implementing new procedures to reduce the processing time for receipts. (For the previous Board response, see Digest Footnote #1.) NEED TO IMPLEMENT PAYROLL CONTROLS The Board lacked control over its personal services expenditures, totaling $9,711,238, during the examination period. The auditors tested the Board’s payroll expenditures for nine per diem and three full time employees during six selected months during the examination period. Due to the seasonal nature of the Board’s operations and separations, not all of the employees worked during each month. During testing, some of the more significant internal control deficiencies noted by the auditors included the following: • Four of nine (44%) per diem employees tested did not have signed punch clock records from the racetracks to support the employee had worked four per diem days recorded by the Board within the State’s Central Time and Attendance System (CTAS). The Board paid these employees for these noted days. • For 15 of 40 (38%) leave days, the Board did not either receive or retain leave requests from five of nine (56%) per diem employees and two of three (67%) full time employees tested. As such, the Board did not have documentation to support entries recorded within CTAS. • Four of nine (44%) per diem employees tested did not have the employee’s use of benefit time recorded within CTAS, which reported the employees had been working at a racetrack. As a result, each employee’s accrual of benefit time is overstated by one day each. • One of nine (11%) per diem employees tested had one per diem shift not entered into CTAS, resulting in the employee not being paid for a shift he had worked. • Two of nine (22%) per diem employees tested had one extra per diem shift entered into CTAS, resulting in the employees being overpaid for two shifts they had not worked. • Shared Services did not extract per diem information from CTAS and accurately enter the total number of per diems worked by Board employees into the 260-day count tracking sheet. The 260-day count tracking sheet is used to determine the proper rate of pay for per diem employees pursuant to the union agreement. • The Board’s timekeeper inserts one hour placeholders into CTAS to indicate instances where an employee had been scheduled to work, but either the Board had not received the timesheet as of the payroll close date or the scheduled event has not happened. As such, Shared Services pays the employee for these dates entered into CTAS, even though the employee may not have been entitled to payment for time worked or some other employee actually worked the shift. This procedure created cascading errors throughout the Board’s payroll system, necessitating manual adjusting entries and increased the risk an employee would not have been paid for time they worked or the Board’s benefit accruals would have been inaccurate. • For seven of the nine (78%) per diem employees tested, the auditors noted the Board was not submitting payroll adjustment information to Shared Services in a timely manner and Shared Services was not submitting this information to the State Comptroller for payment timely. The auditors identified 39 per diems worked by employees during the six months tested where the employee was not paid for their day worked on the payroll voucher purporting to pay employees for work performed during the payroll period. In 25 of these 39 instances (64%), the employee was not paid for the day worked by the Board even in the subsequent semi-monthly payroll. In those 25 instances, the Board reported the adjustment to Shared Services an average of 27 days (between two and 75 days) after the close of the subsequent period’s payroll. Upon notification of the error, Shared Services paid the amount due to the employee on the Board’s next regular payroll voucher submitted to the State Comptroller for payment. • Due to the impact of the preceding errors and the auditors noting CTAS is not corrected in a timely manner prior to the Board generating each employee’s Monthly Timekeeping Report from CTAS (typically printed about two weeks after month end), the Monthly Timekeeping Reports were inaccurate. These reports represent a key internal control mechanism because each employee, the employee’s supervisor, and the timekeeper certifies the accuracy of the information recorded within CTAS. In addition to providing a verification that the information within CTAS is accurate, this report represents the sole document where the employee certifies their time spent on official State business, as required by the State Officials and Employees Ethics Act. • For seven of the 64 (11%) tested months where employees worked, the employee’s supervisor reviewed and approved the employee’s Monthly Timekeeping Report between 179 and 194 days after month end, which was not a reasonable lapse in time to identify and correct payroll errors. • For four of the 64 (6%) tested months where employees worked, the employee performed the supervisor review of their own Monthly Timekeeping Report. • For 12 of 12 (100%) employees tested did not have an annual performance evaluation performed during either Fiscal Year 2013 or Fiscal Year 2014. (Finding 3, pages 29-36) This finding has been repeated since 2010. We recommended the Board take action to establish and implement controls over the Board’s payroll process. Board officials agreed, noting they have stopped using the placeholders and are seeking out a suitable timekeeping software product. (For the previous Board response, see Digest Footnote #2.) NEED TO ENSURE OCCUPATIONAL LICENSEE RECORDS ARE ACCESSIBLE AND USABLE The Board was unable to provide adequate records substantiating the population of individuals who received occupation licenses during the examination period. During testing, the auditors requested the Board provide the population of individuals who had received occupation licenses during the examination period to test compliance with the licensing and fee provisions of the Illinois Horse Racing Act of 1975 (230 ILCS 5/15). In response to our request, the Board made three distinct attempts to provide the auditors with the population of licenses issued by extracting the information from its computer system, the Pari-Mutuel Information and Tracking System (PITS). For each of the populations provided by the Board, the auditors attempted to ascertain the completeness of the population by comparing and reconciling the information to other records maintained by the Board and the Office of the State Comptroller; however, the auditors were unable to get any of the Board’s lists to agree with other records. After the three attempts, the auditors met with Board officials and an employee of the Department of Revenue who maintains PITS pursuant to an intergovernmental agreement. Per the Department of Revenue’s employee, he noted PITS was cutting off some records when he extracted the information from PITS and he was unsure if he had maintained consistency in programming PITS on what information to extract. The auditors offered the Board one additional opportunity to provide a complete population that would reconcile with other records maintained by the Board and the Office of the State Comptroller, but the Board declined this offer. (Finding 4, pages 37-38) We recommended the Board conduct an analysis to ascertain why the occupational licensee records retained in PITS did not reconcile with its external records and take corrective action to ensure data extractions from PITS are complete and accurate. Board officials agreed, noting they will continue to seek out a remedy for the issues present in the current licensing system. UNABLE TO PAY OBLIGATIONS DUE TO THE CITY OF CHICAGO AND COOK COUNTY The Board was unable to distribute all inter-track wagering location admission fees to the City of Chicago and Cook County. During the prior examination, the auditors noted the Board had ceased activity within the Illinois Racing Board Grant Fund at the close of Fiscal Year 2012 and began depositing inter-track wagering location admission fees into the Horse Racing Fund. However, as a result of prior period fund transfers, the Board lacked sufficient cash after ceasing activity within the Illinois Racing Board Grant Fund to pay its remaining obligations due to Cook County, totaling $43,809, and the City of Chicago, totaling $1,118. During the current examination, the auditors noted the Board had not paid these obligations due to Cook County and the City of Chicago. Further, the auditors noted the Board had not reported these outstanding liabilities to the Office of the State Comptroller for consideration in preparing the State’s Comprehensive Annual Financial Report. Board officials stated they have neither requested nor received an appropriation to pay these outstanding obligations and the Board did not report the liability due to oversight and human error. (Finding 8, pages 50-51) We recommended the Board work with the Governor and General Assembly to seek a legislative remedy to pay the outstanding obligations due to Cook County and the City of Chicago. We further recommended the Board ensure all liabilities are reported to the Office of the State Comptroller to facilitate accurate financial reporting. Board officials concurred with our recommendation. NEED TO ENFORCE AND COMPLY WITH RACING LAWS AND REGULATIONS The Board did not comply with, or enforce compliance with, provisions of the Illinois Horse Racing Act of 1975 and the Illinois Administrative Code at the racetracks. During the current examination, the auditors conducted walkthroughs at one standardbred and two thoroughbred racetracks. During testing, some of the more significant issues noted by the auditors included the following: • During auditor observation of a Board- licensed veterinarian administering furosemide to horses entered in the fourth race at a thoroughbred racetrack with one document for recording the required signatures and injection information for all of the horses running in a race that day, the auditors noted the veterinarian had pre- signed off on his administration of furosemide to horses in the fifth through eighth races. As the time period for administering furosemide to these horses had not come up and the veterinarian had not actually administered furosemide to the horses, it was not possible for him to verify the timely administration of furosemide. • At the standardbred racetrack tested, the auditors noted one instance where the horse’s owner, trainer, or representative was not present during the Board’s collection of a urine sample from the horse. • At three of three (100%) racetracks tested, the Board did not require the horse’s owner, trainer, or representative to remain to witness the sealing of the horse’s urine and blood samples. • At two of two (100%) thoroughbred racetracks tested, the stewards - two State employees and one racetrack employee who oversee the race and enforce the rules and regulations of the Board - did not arrive at their office on the grounds of the racetrack three hours prior to the first race. The auditors noted two State stewards arrived 23 and 61 minutes late and one association steward (the racetrack’s steward and employee) arrived 43 minutes late. • Three of three (100%) racetracks tested did not have signs posted at each entrance and exit with contact information for obtaining assistance with gambling problems. • At three of three (100%) racetracks tested, the Board did not have adequate control over the Board’s controlled substances, including euthanasia drugs. The auditors noted the following: – At the thoroughbred racetracks, the auditors noted both racetracks used removable tackle boxes for the Board’s drugs. Further, the tackle box at one of the racetracks was not locked. – At the standardbred racetrack, the auditors noted the Board did not store its emergency medication within a locked box in the Board’s veterinarian’s office within the Detention Barn. The auditors observed the Board’s drugs in the veterinarian’s unlocked lunch box (an Igloo cooler) by the horse warm-up viewing area, which happens to be in a cafeteria. • At the standardbred racetrack tested, the auditors noted the racetrack was not limiting admission to the paddock area to authorized persons under the Board’s regulations and was admitting individuals with guest passes to the paddock area. (Finding 9, pages 52-58) We recommended the Board take action to ensure compliance by its employees and licensees with State laws, rules, and regulations governing horse racing, including developing an appropriate process to monitor racetrack operations for instances of noncompliance. Board officials concurred with our recommendation. NEED TO ENHANCE MONITORING OF STATUTORY RACING REQUIREMENTS The Board did not enforce specific statutory racing requirements for thoroughbred and standardbred racetracks. During testing of 15 weeks (54 unique days) of thoroughbred racing, the auditors noted the following: • For one of 54 (2%) race days tested, the Board did not record within the steward’s minutes the number of races offered and ran limited to Illinois-bred horses. • For 29 of 54 (54%) race days tested, the Board did not document its consent to eliminate and/or substitute races for Illinois-bred horses on the given day due to insufficient competition among the horse population. • For two of 15 (13%) race weeks tested, one racetrack did not offer six races limited to Illinois-bred horses. During testing of nine weeks (22 unique days) of standardbred racing, the auditors noted the following: • For two of 22 (9%) race days tested, the Board did not record within the steward’s minutes the number of races offered and ran limited to Illinois-bred horses. • For 15 of 22 (68%) race days tested, the Board did not document its consent to eliminate and/or substitute races for Illinois-bred horses on the given day due to insufficient competition among the horse population. (Finding 12, pages 66-67) We recommended the Board implement a formal monitoring process to ensure the racetracks comply with State law and maintain records documenting the Stewards’ conclusion that a required race may be waived due to insufficient competition. Board officials stated they will continue to develop internal controls to ensure all changes/cancellations are properly documented. NEED TO ENHANCE SECURITY AND CONTROL OVER CONFIDENTIAL AND PERSONAL INFORMATION The Board did not adequately secure and control confidential and personal information. During testing, the auditors noted the following: • The Board failed to utilize redaction when displaying confidential information within computer-based applications. Furthermore, social security numbers were printed on license application receipts and some internal reports. • The Board does not encrypt laptops or other portable media. • The Board had not performed a risk assessment of its physical space or computing resources to identify confidential or personal information to ensure such information is protected from unauthorized disclosure. (Finding 15, pages 77-78) This finding has been repeated since 2010. We recommended the Board complete a formal risk assessment of its physical and computing environment to ensure adequate security controls are applied. We further recommended the Board ensure all confidential information is properly secured (encrypted during transmission and at rest) and ensure compliance with the requirements of the Identity Protection Act. Board officials stated they will continue to work with the Department of Central Management Services to assess risk and needs for the purpose of ensuring personal information protection of vendors and employees. (For the previous Board response, see Digest Footnote #3.) OTHER FINDINGS The remaining findings pertain to: (1) a lack of adequate detailed procedures with the Administrative and Regulatory Shared Services Center at the Department of Revenue; (2) tax collection, allocation, and distribution deficiencies; (3) and, inadequate controls over accounts receivable, laboratory testing, fee reporting, State-owned vehicles, and voucher processing. We will review the Board’s progress towards implementation of our recommendations in the next engagement. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Board for the two years ended June 30, 2014, as required by the Illinois State Auditing Act. The auditors qualified their report on State compliance for Findings 2014-001 through 2014-009. Except for the noncompliance described in these findings, the accountants stated the Board complied, in all material respects, with the requirements described in the report. WILLIAM G. HOLLAND Auditor General WGH:djn AUDITORS ASSIGNED This examination was performed by the Office of the Auditor General’s staff. DIGEST FOOTNOTES #1 - Inadequate Control over Receipts 2012: The Board has taken steps to expedite deposits into the State Treasury. Beginning in May of 2012, all receipts are processed in the Central Office at the James R. Thompson Center and are scanned electronically by the Department of Revenue into a Racing Board clearing account. Additionally, all documentation and support for those receipts are stored at the Board’s Central Office. Since the Shared Services Center began the responsibility of certain deposit functions for the Board, additional review procedures have been added to help prevent discrepancies when the RDT forms are submitted. Following the Auditor’s recommendation, the Board will formalize a procedure for receipts and ensure all employees that handle receipts adhere to that policy. This procedure will address sending all receipts and applications to the Central Office via FedEx in a timely fashion as well as depositing gross receipt amounts to the State Treasury in instances of an overpayment and issuing refunds as needed. #2 - Inadequate Controls over Personal Services 2012: Due to understaffing and the lack of an IRB Human Resources Manager, performance evaluation due dates were not identified and evaluations were not completed or not completed timely. All past due evaluations have currently been identified and will be completed by the next audit cycle. The Board will pursue hiring a full-time HR manager to assure that all performance evaluations, time-keeping reports, and other personnel responsibilities are met. #3 - Need to Enhance Controls over Confidential Information 2012: The Board accepts this finding and will address the encryption issue with recommended risk assessment of the physical computing environment. The Board intends to be compliant with the Personal Information Protection Act (815 ILCS 530). The Board has since addressed the redaction issue and the Photo ID system weakness has been addressed by procuring and installing the Assure ID photo system. This allows multiple workstations to share a common database over the LAN, which is maintained by CMS. Each user has a unique username and password access. Each workstation is username and password protected.