REPORT DIGEST DEPARTMENT OF REVENUE FINANCIAL AUDIT For the Year Ended: June 30, 2012 COMPLIANCE EXAMINATION For the Two Years Ended: June 30, 2012 Release Date: July 24, 2013 Summary of Findings: Total this audit: 21 Total last audit: 37 Repeated from last audit: 10 State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest summarizes the report of the Department of Revenue’s (Department) Financial Audit for the year ended June 30, 2012 and State Compliance Examination for the two years ended June 30, 2012. The Financial Audit and State Compliance Examination report contained 21 findings. SYNOPSIS • The Department’s year-end financial reporting in accordance with generally accepted accounting principles (GAAP) to the Illinois Office of the Comptroller contained inaccuracies. • During testing, auditors noted the Department has sustained a significant level of inventory of Business Income Tax and Withholding Income Tax taxpayer information to be processed and finalized. • The Department has not completely implemented controls and safeguards over processing taxpayer information. • The Department could not resolve conflicts with provisions of the State Revenue Sharing Act and the Illinois Income Tax Act. • The Department misstated cash during the year-end reporting process. • The Department did not have a detailed process to follow up on lost files and failed to timely disclose information related to the lost files to the auditors. • The Department continued to have inadequate security controls over the GenTax (enterprise wide tax system) system and data. • The Department exceeded statutory limitations for transfers into the Tourism Promotion Fund. • The Department failed to comply with the requirements of the Environmental Protection Act regarding the tire user fee. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS WEAKNESSES IN THE DEPARTMENT’S FINANCIAL REPORTING PROCESS The Department’s year-end financial reporting in accordance with generally accepted accounting principles (GAAP) to the Illinois Office of the Comptroller contained inaccuracies. The issues associated with the inaccuracies, if not detected and corrected, could materially misstate the Department’s financial statements and impact the Statewide financial statements prepared by the Illinois Office of the Comptroller. Some of the exceptions identified follow: • A formula error was discovered by the auditors in the spreadsheet utilized by the Department to calculate the estimated future refunds payable for the individual and business income taxes relating to the current fiscal year. As a result, the refunds payable balance in the Income Tax Refund Fund was overstated by $70.4 million in the Department’s GAAP reporting packages. The Department notified the Illinois Office of the Comptroller and requested a journal entry be made to correct the Department’s closed GAAP reporting packages. The Department’s financial statements as of June 30, 2012 were submitted correctly to the Illinois Office of the Comptroller. • During audit testing of deferred revenue, the Department determined its original calculation for deferred revenue related to taxpayer refunds carried forward for credit on future returns contained errors. The program to generate the data the Department utilized to calculate the deferred revenue for its financial statements contained errors. Upon reanalyzing the data, the Department determined deferred revenue was understated by $19.4 million. The misstatement was not considered material by the Department and was not corrected as of June 30, 2012. • During audit testing of accounts receivable exceptions were noted with certain Business Income Tax and Individual Income Tax accounts. From the exceptions noted the accounts receivable was potentially overstated by $6.2 million. As a result of the exceptions noted in the finding, the initial GAAP reporting packages submitted to the Office of the Comptroller were misstated. In addition, the exceptions have the potential to materially misstate the Department’s financial statements. Accurate preparation of the Department’s financial information for GAAP and financial reporting purposes is important due to the impact adjustments have on the Statewide financial statements. (Finding 1, pages 17-22) We made a number of recommendations including the Department take steps to improve the review process of the underlying data used to compile the financial statements. Department officials agree with the recommendations and indicated given appropriate resources, they can improve the processes regarding financial reporting. The Department noted financial reporting is very complicated with: 1) 94 funds, 2) outdated and manual accounting systems, and 3) lack of appropriate resources for the time constraints allowed for GAAP/fiscal year end reporting. The Department would welcome a modern statewide accounting system to assist in the compilation of monthly, quarterly, and annual accrual based financial information and statements. SUSTAINED HIGH LEVELS OF UNPROCESSED TAXPAYER INFORMATION During testing, auditors noted the Department has sustained a significant level of inventory of Business Income Tax (BIT) and Withholding Income Tax taxpayer information to be processed and finalized. One segment of the Department’s inventory consists of original tax returns to be processed and finalized. When taxpayer information is entered into the Department’s tax processing system (GenTax), certain returns are automatically flagged by GenTax that require additional manual processing to finalize, which creates this category of inventory. These flags are attached for various reasons including mathematical errors, missing tax forms, etc. This segment has increased significantly over the past few years and is predominantly business income tax returns. It is the Department’s policy to exclude the indicated balances due on these returns from the financial statements, because the true balances are unknown until the returns are manually worked by the Department’s tax specialists. At June 30, 2012, the Department identified $5.5 billion of items related to taxpayer information to be processed and finalized (representing 217,822 returns). Although it is generally agreed the vast majority of the $5.5 billion is invalid and will be reduced upon the tax information being finalized, there is no reasonable methodology or process for estimating the valid receivable amount of these partially processed returns. The number and amount of these returns has been increasing steadily. Failure to process and finalize the taxpayer information and determine the final disposition to taxpayers in a timely fashion increases the risk the Department will be unable to recover the full amount owed and delays the recognition of receivables, deferred revenue, and tax revenue in the financial statements. (Finding 2, pages 23-26) We recommended the Department seek sufficient resources to process taxpayer information in a timely manner to ensure taxpayer records and financial statement information reflect appropriate information and expedite the ability of the Department to collect all taxes due to the State. Department officials agree with the recommendation and noted inventories represent the accounts on which they are performing additional due diligence in order to ensure the taxpayer is in compliance with tax laws and to validate refunds due or amounts owed are accurate. Furthermore, the June 30 inventory levels will always be the highest of the year, due to the tax filing deadline of April 15. Department officials also indicated they have reduced the inventory level in the past year. The BIT inventory levels at December 31, 2012 were at the lowest level in the past 20 months. Also, the Department has filled 36 positions in BIT processing during the past year and, subject to sufficient resources, will continue to acquire staff to process tax returns in an expeditious manner. WEAKNESSES IN PROCESSING TAXPAYER INFORMATION The Department has not completely implemented controls and safeguards over processing taxpayer information. During fiscal year 2012, the Department processed 11.8 million tax receipt documents throughout its facilities, totaling $34.6 billion. The Department receives and uses federal tax information (FTI) to verify information contained on various State tax returns; therefore, under the Internal Revenue Service’s definition of comingling, the information on the Department’s tax processing system (GenTax) related to Business Income Tax and Individual Income Tax is considered FTI and should be handled as such. During testing auditors noted the Department’s internal controls and physical safeguards to protect taxpayer information contained weaknesses. Weaknesses were specifically noted in the following areas: • The Department has not implemented sufficient physical safeguards to control access to the tax processing areas throughout the Department from contractors, vendors and other State employees utilized by the Department. • Auditors noted taxpayer files were stored on open shelving units throughout the Department. This information is not secure from potential unauthorized access. The Department is responsible for ensuring the confidentiality of tax information within its possession. The Department maintains data that is covered by both State and Federal requirements. (Finding 5, pages 33-34) We recommended the Department ensure taxpayer information is adequately protected during both business and non-business hours from potential unauthorized access as mandated by State statute and IRS Publication 1075. Department officials agree with the recommendation and indicated they: 1) consider the safeguarding of confidential taxpayer information to be a critical function, and 2) continually act to assure this information remains secure. Further, the IRS certified its most recent Safeguard Procedures Report on November 29, 2012 stating “We are accepting this report as certification that the confidentiality of Federal tax information (FTI) is adequately protected.” The Department was also allocated $1 million in FY2013 by the Capital Development Board for security initiatives and has requested an additional $5 million in FY2014. CONFLICT IN PROVISIONS OF THE ILLINOIS INCOME TAX ACT AND STATE REVENUE SHARING ACT The Department could not resolve conflicts with provisions of the State Revenue Sharing Act (30ILCS 115) and the Illinois Income Tax Act (35ILCS 5/901), as both of these Acts were impacted by the passage of Public Act 096-1496, the Taxpayer Accountability and Budget Stabilization Act. During fiscal year 2011, the General Assembly passed and the Governor signed Public Act 096-1496, which increased the State income rates on individuals, trusts, estates, and corporations and contained amendatory provisions to update existing State law. During testing, auditors noted the following: • The Illinois Income Tax Act was not amended by Public Act 096-1496 to authorize deposits of a portion of income tax receipts by the Department into the Income Tax Refund Fund. • Prior to Public Act 096-1496, the Illinois Income Tax Act and the State Revenue Sharing Act were harmonious statutes directing the Department to transfer 10% of the prior month’s income tax receipts deposited into both the General Revenue Fund and the Education Assistance Fund from the General Revenue Fund to the Local Government Distributive Fund. Public Act 096-1496 amended the Illinois Income Tax Act to change the transfer percentage to 6.86% for receipts from corporate tax collections and 6% for receipts from individual, estate, and trust collections; however the State Revenue Sharing Act was not amended. From a review of the statutes, it does not appear a supremacy clause or other language directs which statute controls in this situation. Further, the auditors noted the Department’s receipt deposit codes and receipt processing system do not provide sufficient information for the Department to allocate receipts among the various State funds or calculate statutory transfers pursuant to State law. Specifically, auditors identified the following: • It was determined the deposits for estates, trusts, and certain individual income taxes are coded as corporate income tax receipts and transferred at 6.86%; however, the Illinois Income Tax Act transfer calculation includes estates, trusts, and individual income taxes under the 6% transfer calculation for individual income tax receipts. The Department determined the transfers from the General Revenue Fund to the Local Government Distributive Fund may have been overstated by as much as $257,639. • The Illinois Income Tax Act specifies deposits into the Income Tax Refund Fund between corporate receipts and individual income tax receipts, including receipts from estates and trusts. As noted above, estates, trusts, and certain individual income taxes are coded as corporate income tax receipts. The Department determined the deposits into the Income Tax Refund Fund during fiscal year 2012 may be overstated by as much as $12.2 million, the General Revenue Fund may be understated by as much as $11.3 million, and the Education Assistance Fund may be understated by as much as $.9 million. Functioning with inconsistent State laws results in the Department performing functions not specifically directed by the General Assembly and could subject the Department to legal risks. Further, failure to have a receipt processing system with sufficient receipt deposit codes resulted in inaccurate fund deposits, incorrect statutory transfers, and reduces the reliability of Statewide financial reporting. (Finding 6, pages 35-38) We recommended the Department continue to seek a legislative remedy to the conflicting provisions of the State Revenue Sharing Act and the Illinois Income Tax Act; implement systems and controls to capture sufficient information to properly allocate tax receipts among State funds and calculate statutory transfers; and, work with the Office of the State Comptroller to review and update the Department’s receipt codes. Department officials indicated they are seeking changes to the Illinois Income Tax Act to authorize deposits of a portion of income tax receipts into the Income Tax Refund Fund and to the State Revenue Sharing Act to reflect the new percentages established by Public Act 096-1496. The corrective language has been written and the Department is working to get the legislation enacted. In addition, the Department has developed strategies to correct the receipt allocation and statutory transfer discrepancies caused by tax returns that cover multiple entity types that are neither individuals nor corporations (trusts, estates, partnerships). YEAR-END CASH BALANCES NOT PROPERLY RECORDED During testing of cash balances recorded in the Office of the State Comptroller’s GAAP reporting packages, the auditors noted the following: • The Department maintains 19 tax units, of which 13 (68%) contained discrepancies in the amount allocated to the funds per the GAAP reporting packages versus the amounts allocated in the bank reconciliations. In aggregate, the errors led to a misclassification of $6.5 million between cash and accounts receivable on the GAAP reporting packages. Due to the accrual process developed by the Department, it records 7 days of July hotel operators’ occupation tax receipts in cash instead of accounts receivable. The amount was deemed immaterial and did not require the Department to make any adjustments to its financial statements. • The Department did not properly record $2.8 million of cash from remittance clearing accounts leading to cash being understated as of June 30, 2012. The Department did not record $2.8 million (13%) in the GAAP reporting packages. This amount was deemed immaterial and did not require the Department to make any adjustment to their financial statements. By failing to properly and accurately record all cash amounts, the Department has misstated its cash balance in the Office of the State Comptroller’s GAAP reporting packages, Department financial statements and the Statewide Comprehensive Annual Financial Report (CAFR). (Finding 8, pages 43-44) We recommended the Department implement procedures to ensure the amount allocated from each tax unit to the GAAP reporting packages are included and properly classified in the Department’s financial statements. Department officials agree with the recommendation and indicated they will change the current procedures to recognize the receipts noted in the finding as revenues and accounts receivable at year end. The Department will continue to research the feasibility and cost/benefit of further enhancements to GenTax, a rewrite of the current Consolidated Accounting System, and development of a general ledger system to allow faster, more complete GAAP reporting packages for the 94 funds administered by the Department. LOST TAXPAYER AUDIT FILES As part of performing testing associated with the financial statement audit, the auditors requested certain account information for one taxpayer to support amounts being reported by the Department. The Department failed to timely inform the auditors the original audit files, to support amounts being tested, were lost. The auditors had delayed testing of the particular files pending the Department’s Legal Services Office in Chicago finalizing a settlement with the taxpayer. Auditors were not made aware the original audit files were lost until three months after the information was first requested. Had the lost audit files been disclosed to the auditors upon the initial request they would have been able to take that into consideration in their testing plan as opposed to being informed the original files were lost when they went to test them. The Department disclosed the audit files, which had been in two banker boxes, had been lost in transit between the Department’s Chicago and Springfield offices in May 2011, fourteen months prior to the Department receiving the auditors’ request for these audit files. Auditors had been provided documents to test that were recreations from the Department’s Continuing Audit File system. The documents provided lacked the supporting information the auditors would test to agree to the amounts in the Department’s audit reports. Prior to this instance of audit files being lost the Department lacked detailed policies and procedures to address the protocol in searching for undelivered/lost/mislaid files which contain taxpayer information as well as the timely notification of the Department’s Director, Internal Audit Division, and Internal Affairs Division. Further, the Department did not have procedures to timely determine the contents of lost or mislaid files in the event they contained Federal Tax Information (FTI). Auditors could not determine if any of the lost files contained FTI. The lost taxpayer audit files exposes the Department to unauthorized disclosure of taxpayer information and noncompliance with the Illinois Income Tax Act, potentially subjecting the State to legal risks and sanctions and penalties imposed by the IRS if the files contained FTI. Failure to timely provide pertinent information related to the original files being lost resulted in delays in completing the Department’s financial audit and compliance examination. The Department’s failure to timely disclose the lost taxpayer audit files to the auditors heightened their professional skepticism related to all other procedures being performed during the engagement thus requiring the auditors to reevaluate their testing. (Finding 9, pages 45-49) We recommended the Department expand their existing policies and procedures to address instances when taxpayer information is identified as being undelivered/lost/mislaid, including notify the proper State and Federal authorities, as applicable, regarding any potential disclosure of taxpayer information, as well as formally communicating the policies and procedures to employees. In addition, we recommended the Director communicate to employees that all auditor requests be timely complied with and any instances related to unlocatable/undelivered/lost/mislaid taxpayer information be identified to the auditors in a timely fashion. Department officials indicated they will continue to improve existing policies and procedures to protect all taxpayer records and data. There were policies and procedures in place at the time of the lost files and the new Audit Manual update will further define the policies and procedures, including notifying the Director of Revenue and Internal Affairs of any lost or missing tax records. The Department went on to note the use of the Department of Central Management Services (CMS) messenger is an efficient means of transferring all types of Department files and other materials. However, the Department is reassessing the use of the CMS Messenger services for transporting confidential taxpayer records since CMS has refused to institute a package tracking mechanism. Regardless of the shipper, while in the shipper’s hands the Department has no ability to control the movement or handling of the package. The Department follows the IRS rules on shipping of documents. NEED TO IMPROVE SECURITY OVER GENTAX The Department carries out its daily operations through the use of Information Technology. The Department is significantly reliant on GenTax in order to support the Department’s mission as “chief tax collector for the State of Illinois.” GenTax maintains confidential and sensitive information on all individuals who pay taxes to the State of Illinois. During the auditors review, some of the issues noted were as follows: • The Department did not have a documented process for the administration of access rights to GenTax. • The deactivation of 3 of 36 separated employees’ accounts ranged from 15 to 33 days after separation. • 7 of 15 (47%) Department of Central Management Services (CMS) employees with administrative access right to servers with Department data did not have documentation to support that required background checks had been performed. • The Department had a process in place for the review of access rights to GenTax; however, a review had not been completed during the audit period. The Department has the responsibility to ensure only authorized individuals have access to taxpayer information. Failure to establish adequate security controls could result in taxpayer identity theft or unintended use. (Finding 11, pages 53-54) We recommended the Department establish a documented process over the administration of GenTax access rights. Additionally, the Department should adhere to its process and periodically review the access rights of GenTax users, document such reviews, and timely deactivate separated employee accounts. Also, the Department should ensure required background checks are properly and timely completed, and documentation maintained, including those for applicable CMS employees. Furthermore, Department should consider developing a formal process to ensure all current and future CMS employees with administrative access rights to servers with Department data have required background checks. Department officials agree with the recommendations and indicated they have taken steps to improve information security. The Department established and hired a Chief Information Security Officer (CISO) in March 2012 and established the Information Security Office. This Office is in the process of implementing a comprehensive Information Security Policy, which will include supporting standards and procedures for the Agency’s computing environment and will specifically address Access Control. In addition, the CISO has been working with the IRS Safeguards Program to address open issues as required by IRS Publication 1075. The IRS certified the Department’s most recent Safeguard Procedures Report on November 29, 2012 stating “We are accepting this report as certification that the confidentiality of Federal tax information (FTI) is adequately protected.” NONCOMPLIANCE WITH STATUTORY TRANSFER LIMITATIONS The Illinois Promotion Act states, upon certification of the Department, the amount to be transferred from the General Revenue Fund to the Tourism Promotion Fund was not to exceed $26,300,000 for fiscal year 2012. Auditors noted the Department transferred $30,394,645 in fiscal year 2012, thus exceeding the statutory limitation for fiscal year 2012 by $4,094,645. Failure to comply with statutory transfer limits represents statutory noncompliance, and prevents funds from being utilized for other purposes. (Finding 19, page 73) We recommended the Department implement internal controls to ensure the Department complies with statutory transfer limitations. Department officials agree with this recommendation and noted they have implemented a procedure to review the fund transfer report on a monthly basis. NEED TO IMPROVE CONTROLS OVER THE TIRE USER FEE The Department failed to comply with the requirements of the Environmental Protection Act regarding the tire user fee, resulting in errors on taxpayer accounts and inaccurate fund deposits and statutory transfers, and related financial reporting. Some of the issues noted follow: • In 17 out of 25 (68%) returns tested, the Department’s GenTax system did not correctly calculate the discount allowed on tires that were timely paid by the taxpayer which also timely filed their return. • The Department did not exercise adequate controls over allocating tire user fee receipts. The Department’s daily deposit process assumed all taxpayers filed returns and paid moneys due to the State in a timely manner. Then, after the end of the fiscal year, the Department calculated a transfer to account for untimely returns that had been received during the fiscal year. These transfers were not performed timely, as the transfer for fiscal year 2011 was performed in April 2012, and the transfer for fiscal year 2012 was performed in December 2012. • The Department’s statutory transfers of $0.10 per tire sold from the Used Tire Management Fund to the General Revenue Fund did not appear reasonable and resulted in an excess transfer of $1,020,313 for fiscal year 2012 and $880,864 for fiscal year 2011. Weaknesses in controls over the tire user fee affects the integrity of processing taxpayer information, financial data, and financial reporting and results in noncompliance with State law. (Finding 20, pages 74-76) We recommended the Department implement a number of improvements to their internal controls related to system processing, taxpayer filing and receipt allocation. Department officials agree with the recommendations and indicated they have implemented all of the system changes relating to the Tire User Fee. OTHER FINDINGS The remaining findings are reportedly being given attention by the Department. Auditors will review the Department’s progress towards the implementation of all the recommendations in the next engagement. AUDITORS’ OPINIONS Auditors stated the financial statements of the Department of Revenue as of June 30, 2012, and for the year then ended are fairly presented in all material respects. The Independent Accountants’ Report on State Compliance and on Internal Control Over Compliance was qualified for findings 12-01 and 12-02. Except for the noncompliance described in these findings, the auditors stated the Department complied, in all material respects, with the requirements described in the report. WILLIAM G. HOLLAND Auditor General WGH:RPU:rt SPECIAL ASSISTANT AUDITORS Sikich LLP were our special assistant auditors for this engagement.