REPORT DIGEST ILLINOIS SUPREME COURT COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2023 Release Date: July 18, 2024 FINDINGS THIS AUDIT: 3 CATEGORY: NEW -- REPEAT – TOTAL Category 1: 0 -- 0 -- 0 Category 2: 2 -- 1 -- 3 Category 3: 0 -- 0 -- 0 TOTAL: 2 -- 1 -- 3 FINDINGS LAST AUDIT: 2 State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, 400 West Monroe, Suite 306, Springfield, IL 62704-9849 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION Our compliance examination of the Supreme Court included Appellate Court Districts 1-5. SYNOPSIS • (23-1) The Court did not maintain adequate controls over its service providers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS OVER SERVICE PROVIDERS The Court had not implemented adequate internal controls over its service providers. We selected a sample of service providers and requested the Court to provide documentation of their review. We noted, for 2 of 3 (67%) and 3 of 3 (100%) third party service providers for Fiscal Year 2022 and Fiscal Year 2023, respectively, the Court had not: • Obtained a System and Organization Control (SOC) report. • Conducted an analysis of the Complementary User Entity Controls (CUECs). • Obtained and reviewed SOC reports for subservice organizations or performed alternative procedures to determine the impact of complementary subservice organization controls (CSOCs) on its internal control environment. (Finding 1, pages 10-11) We recommended the Court implement controls to: • Obtain a SOC report for all identified third party service providers and document the assessment of internal controls associated with outsourced systems annually. • Monitor and document the operation of the CUECs related to the Court’s operations. • Obtain and review SOC reports for subservice organizations or perform alternative procedures to determine the impact of CSOCs on its internal control environment and to determine whether adequate controls are in place. The Court agreed and stated procedures were implemented to identify service organizations and to then evaluate those service organizations’ third-party SOC reports. Management also noted that since 2023, a SOC review and assessment has been completed for 9 service organizations. Management further stated they will continue SOC procedures together with other relevant evaluations they develop to ensure specific services contracted are supported through the appropriate controls provided relative to the services. OTHER FINDINGS The remaining findings pertain to voucher approval and employee training. We will review the Agency’s progress towards the implementation of our recommendations in our next State compliance examination. ACCOUNTANT’S OPINION The accountants conducted a State compliance examination of the Court for the two years ended June 30, 2023, as required by the Illinois State Auditing Act. The accountants stated the Court complied, in all material respects, with the requirements describe in the report. This State compliance examination was conducted by Adelfia LLC. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:lkw