REPORT DIGEST ILLINOIS DEPARTMENT OF REVENUE FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2017 Release Date: March 13, 2018 FINDINGS THIS AUDIT: 2 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 1 -- 0 -- 1 Category 2: 1 -- 0 -- 1 Category 3: 0 -- 0 -- 0 TOTAL: 2 -- 0 -- 2 FINDINGS LAST AUDIT: 0 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • 17-1 Inadequate controls over changes to GenTax • 17-2 Inadequate controls over the administration of income tax abatements resulting from tax credits FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROLS OVER CHANGES TO GENTAX The Department did not maintain adequate controls over changes to the enterprise-wide tax system (GenTax). During fiscal year 2017, GenTax processed over 13.3 million tax returns and $38.3 billion in payments from taxpayers. We selected a sample of GenTax changes to determine if the Department complied with its change control policy. Our testing noted the changes did not comply, as follows: • Prior to commencement, change requests were to be reviewed and assigned by the Department’s Production Support Management. However, 25 of 54 (46%) change requests were not reviewed by Production Support Management. • The Department’s Standards Guide, Creation, required a change request to contain an example of the requested correspondence or data request. However, we noted 4 of 8 (50%) changes did not contain the requested correspondence or data request. • The Department’s Standards Guide required changes to be tested at various stages of the change process. However, we were unable to determine the adequacy of the testing conducted; as the Department’s Standards Guide did not document the detailed testing that was required to be conducted or the testing documentation requirements. We did however, note: - 32 of 41 (78%) change requests did not contain documentation of testing by the developer. - 32 of 41 (78%) change requests did not contain documentation of testing by the contact person in the test environment. - 33 of 41 (80%) change requests did not contain documentation of testing by the contact person prior to moving the change request into the production environment. • The Department’s Standards Guide required approval and “sign-off” at various stages of the change requests. However, we noted: - 32 of 45 (71%) change requests were not approved by the contact person at the pre- production stage. - 19 of 45 (42%) change requests were not approved by the contact person prior to being moved to the production environment. Additionally, 2 of 45 (4%) change requests were not approved by the developer prior to moving the change into the production environment. • The Department’s Standards Guide, Implementation, required Production Support Team Leads to approve the change and to migrate the change into the production environment. However, we noted 6 of 37 (16%) changes were not approved by Production Support. In addition, 6 of 37 (16%) changes did not contain documentation of approval. • The Department’s Standards Guide, Closure, required the contact person to verify the change was working correctly and to close the change request. However, we noted 6 of 45 (13%) change requests were not verified and closed by the contact person. It should be noted that audit fieldwork was completed and a draft finding was presented to the Department on January 31, 2018. The Department presented, the auditors accepted, and tested additional information related to the change control policy on February 7, 2018. The results of testing the additional information are noted above. In addition, as part of our testing, we requested from the Department a listing of programmers and Production Support Team Leaders. The listing was utilized to ensure only authorized developers were completing changes and authorized individuals approved the changes. However, during our testing, we noted developers and Production Support Team Leaders which were not included in the listing. (Finding 1, pages 67-69) We recommended the Department maintain adequate controls over changes to GenTax. Specifically, the Department should update the Standards Guide to ensure all requirements are addressed and that all changes comply. The Department accepted the auditor’s recommendation and stated they would modify their Standards Guide to more fully address all applicable changes. In addition, the Department stated that while their documentation may be lacking, they believed adequate procedures were followed. INADEQUATE CONTROLS OVER THE ADMINISTRATION OF INCOME TAX ABATEMENTS RESULTING FROM TAX CREDITS The Department did not maintain adequate controls over income tax abatements resulting from tax credits issued under the Economic Development for a Growing Economy (EDGE) and the Angel Investment Credit (AIC) programs administered by the Department of Commerce and Economic Opportunity. During testing of a sample of tax credits, we noted: • The administration of the EDGE and AIC programs are implemented through a shared function between the Department and the Department of Commerce and Economic Opportunity. The Department of Commerce and Economic Opportunity was unable to provide the auditors with signed agreements for 2 of 40 (5%) EDGE and AIC tax credits tested. Without the agreements, we were unable to compare them to the Certificates of Verification provided by the Department. As a result, we could not determine if the tax credits, totaling $791,763 were valid and proper. • The Department did not obtain a Certificate of Verification from a taxpayer for 1 of 40 (3%) tax credits tested. While the tax credit was not used to reduce taxes paid in the current year because there was no tax due reported on the return, we did note the Department’s procedures allow for the possibility that the credit could be used in future tax years without first obtaining a copy of the certification from the taxpayer. Accordingly, taxes totaling $3,246,166 could be abated in the future without the Department determining that the related credit is valid and proper. • The Department misreported 1 of 40 (3%) AIC tested within its tax abatement footnote within its draft financial statements. This error caused the Department to overstate income taxes abated under the AIC program by $2.888 million (representing 56% of the amount originally reported) and overstated the amount of income taxes abated which are shared with local governments by $205 thousand. Department management corrected this financial reporting error within the Department’s final financial statements. (Finding 2, pages 70-72) We recommended the Department obtain each taxpayer’s Certificate of Verification prior to allowing the taxpayer’s credit and retain this documentation within its financial reporting return. Further, we recommended the Department review its financial reporting process and make any changes needed to ensure tax abatements are properly reported within its financial statements. Finally, the Department should work with the Department of Commerce and Economic Opportunity to ensure all necessary source documentation, including the original agreements, is retained for the EDGE and AIC programs. The Department accepted the auditor’s recommendation and stated they would evaluate their procedures and make any necessary changes including working more closely with the Department of Commerce and Economic Opportunity to ensure source documentation is maintained and appropriate information is shared between the two agencies. AUDITOR’S OPINION The auditors stated the financial statements of the Illinois Department of Revenue as of and for the year ended June 30, 2017 are fairly stated in all material respects. This financial audit was conducted by Sikich, LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:jv