The Illinois Supreme Court (Court) did not complete required internal audits in compliance with the Fiscal Control and Internal Auditing Act (FCIAA).

During our audit, we noted that no audits of major systems of accounting and administrative control were completed during the two years under review. Although a number of audits had been initiated during the audit period, only one internal audit was completed, reviewed, and submitted to the Court. Also, the two-year audit plan, for both fiscal years, was not carried out.

The FCIAA states that the Court "…will establish by its rulemaking authority or by administrative order a full-time program of internal auditing of State-funded activities of the judicial branch, which is consistent with the intent of this Article." At the January 1993 Term, the Court by directive, established the program of internal auditing consistent with FCIAA. (Finding 1, pages 10-11)

We recommended the Court comply with the requirements of the Fiscal Control and Internal Auditing Act and complete required internal audits in compliance with the Court’s directive.

Agency officials responded that they accepted our recommendation and stated the Chief Internal Auditor for the Supreme Court of Illinois is charged by the Court with the continuing responsibility to timely complete, review and issue reports for all audits.

The Illinois Supreme Court (Court) did not have an adequate security administration program to ensure security over, and use of, information systems (IS) resources.

During our testing, we noted that many of the Court’s security practices at its central location appeared to be appropriate. However, we noted the Court had not established a formal security administration program to ensure its computer security and usage guidelines were followed at all locations.

In our review of the Computer Security and Usage Guidelines distributed by the Court’s Judicial Management Information Services (JMIS) division, we noted the following control weaknesses:

JMIS management maintains that they can only provide suggested guidelines for IS security and are not granted the authority to monitor and enforce compliance with the guidelines. Each judicial branch office is left to determine if they wish to comply with the guidance provided by JMIS.

A lack of guidance concerning users’ responsibilities related to computer security and protection of IS assets could result in unauthorized access and/or misuse of the Court’s information systems, especially with the Court’s decentralized computer environment located in numerous locations. (Finding 3, pages 17-18)

We recommended the Court develop a security administration program that encompasses the entire organization. The program should include the development of computer security and usage policies and procedures and outline the Court’s security management structure.

Agency officials responded that they accepted our recommendation and stated that the JMIS will expand its security monitoring by disseminating the Computer Security and Usage Guidelines to all personnel who utilize information system resources within the judicial branch.

Mr. John Bracco, Chief Internal Auditor provided the responses to our recommendations on December 30, 2003.

The other finding pertained to locally held funds. We will review progress toward implementation of all recommendations in our next compliance audit.

We conducted a compliance audit of the Illinois Supreme Court as required by the Illinois State Auditing Act. We have not audited any financial statements of the Court for the purpose of expressing an opinion because the agency does not, nor is it required to, prepare financial statements.

_____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:GSR

Our Special Assistant Auditors were Sikich Gardner & Co, LLP