REPORT DIGEST OFFICE OF THE SECRETARY OF STATE FINANCIAL AUDIT For the Year Ended: June 30, 2011 COMPLIANCE EXAMINATION For the Two Years Ended: June 30, 2011 Release Date: June 19, 2012 Summary of Findings: Total this audit: 9 Total last audit: 8 Repeated from last audit: 3 State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • The Secretary of State permitted multiple employees to have access to the same cash drawers at the Drivers License Facilities. • The Secretary of State submitted inaccurate quarterly reports of State property to the Comptroller during fiscal years 2010 and 2011. • The Secretary of State had not assured adequate Office-wide procedures exited for disposal of confidential information. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROL OF CASH AT DRIVERS LICENSE FACILITIES The Office of the Secretary of State (Office) permitted multiple employees to have access to the same cash drawers at the Drivers License Facilities (facilities). During our fieldwork, we visited 6 of the Office’s 138 facilities. At 4 of the facilities visited, we noted that multiple employees could access the same cash drawer. (Finding 1, pages 11-12) This finding was first reported in 2005. We recommended the Secretary of State ensure that each employee utilizes an individual cash drawer and not be permitted to access the drawer of other employees until such time as alternative controls are achieved through the new technology equipment that the Office has obtained. Secretary of State officials accepted our recommendation and stated they are in the process of using available technology to gain appropriate control over their receipt processing at these facilities. (For the previous Office response, see Digest Footnote #1) INADEQUATE REVIEW OF QUARTERLY PROPERTY REPORTS The Office submitted inaccurate quarterly reports of State property to the Comptroller during fiscal years 2010 and 2011. The Office timely filed its Agency Report of State Property (form C-15) with the Comptroller. However, we noted various errors on the C-15 reports that were not identified until our review. The report of the quarter ended December 31, 2010 understated Office assets by $19,969. The following quarterly C-15’s included errors as well, and the report for the quarter ended March 31, 2011 overstated Office property by approximately $622,000. After we discussed these errors with Office personnel, C-15 corrections and revisions were prepared by the Office prior to completion of year end GAAP reporting to the Comptroller. (Finding 2, page 13) We recommended the Office implement procedures to ensure the accuracy of its quarterly property reporting to the Comptroller. Secretary of State officials accepted our recommendation and stated they have already implemented the auditor’s recommendation of performing a supervisory review of the quarterly property reports submitted to the Comptroller to ensure the accuracy of the reports. INADEQUATE PROCEDURES FOR DISPOSAL OF CONFIDENTIAL INFORMATION The Office had not assured adequate Office-wide procedures existed for disposal of confidential information. Although the Office had established policies relating to the security of confidential information, the Office failed to establish and implement Office-wide procedures for adequately disposing of confidential information. Since the prior review, the Office had made improvements such as restricting access to additional areas within the Vehicle Service Department. However, we found informal procedures existed for shredding confidential documentation and confidential information was not always secured prior to disposal. While performing walkthroughs at the Office we noted the following: • At least 12 boxes of vehicle applications, vehicle titles, and processed International Registration Plan (IRP) forms containing personal and confidential were found in hallways accessible to the public. • Rooms containing an incinerator and an industrial shredder used for disposing confidential information were not secured. Within the rooms we found several pallets of boxes containing personal and confidential information such as death certificates, tax return information, and driver’s license information. • Lockable bins were not always used to store personal and confidential information prior to disposal. (Finding 8, pages 19-20) We recommended the Office assure all confidential information is adequately safeguarded and promptly disposed when no longer needed. Office-wide procedures for properly disposing confidential information should be established. Once established, the Office should effectively communicate the procedures to all Office personnel, and enforce compliance with its procedures ensuring all confidential information is kept secured until no longer needed, and then properly disposed. In addition, we recommend the Office perform a comprehensive risk assessment to identify all confidential information in electronic and hardcopy form and ensure it is adequately safeguarded. Secretary of State officials accepted our recommendation and stated the Office will perform a risk assessment as recommended. The Office will continue to review and improve its policies and procedures for the disposition of confidential information. In areas where it is difficult to change operations to physically secure confidential information, the Office will consider other security measures such as video surveillance or other reasonable methods. Communication of their policies and procedures will remain a priority of the Office. OTHER FINDINGS The remaining findings are reportedly being given attention by the Office of the Secretary of State. We will review progress toward implementing all recommendations in our next compliance examination. AUDITORS’ OPINION Our auditors stated the financial statements of the Office of the Secretary of State as of June 30, 2011, and for the year then ended are fairly presented in all material respects. WILLIAM G. HOLLAND Auditor General WGH:GSR:rt SPECIAL ASSISTANT AUDITORS Our special assistant auditors for this audit were Sikich LLP. DIGEST FOOTNOTES #1 INADEQUATE CONTROL OF CASH AT DRIVERS LICENSE FACILITIES – Previous Office Response The Office accepts this finding. The Office continues to move forward with a project started during the prior audit that will utilize biometric keyboards whereby an employee can access the computer/terminal by scanning their fingerprint. This will restrict computer access and any discrepancies detected between the validation total and drawer amount at the close of business by facility personnel can be traced to a specific employee, thus increasing accountability. The plan is for this to be in place by March 2011. The Office is also accepting proposals for an Office wide Point of Sale system. Among the requirements in the request for proposals are solutions to excessive access to cash drawers, user accountability weakness and reconciliation and reporting requirements to assist management with resolution of discrepancies between facility sales and related receipts.