REPORT DIGEST OFFICE OF THE TREASURER – ILLINOIS ACHIEVING A BETTER LIFE EXPERIENCE PROGRAM FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2019 Release Date: February 25, 2020 FINDINGS THIS AUDIT: 1 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 1 -- 1 Category 2: 0 -- 0 -- 0 Category 3: 0 -- 0 -- 0 TOTAL: 0 -- 1 -- 1 FINDINGS LAST AUDIT: 1 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (19-01) The Office did not maintain adequate internal controls to properly assess the procedures required to sufficiently review the checking (banking) option debit card withdrawal process serviced by an external subservice organization and document its review of controls. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF EXTERNAL SERVICE PROVIDER The Office of the Treasurer (Office) did not maintain adequate internal controls to properly assess the procedures required to sufficiently review the checking (banking) option debit card withdrawal process serviced by an external subservice organization and document its review of controls. The Office utilized a third party service provider to manage the Achieving a Better Life Experience Program (ABLE), which utilized an external subservice organization to manage the Checking Account (banking) option. During testing, the auditors noted the Office performed procedures designed to understand the external subservice organization’s process and controls, but did not properly assess the sufficiency of the procedures related to financial reporting controls for debit card transaction withdrawals. In addition, the procedures performed were not sufficiently documented. While not identified by the service organization as being material to its operations, the subservice organization was material to the Office. As of June 30, 2019, total assets of the checking (banking) option were $1,596,534, totaling 27% of Illinois ABLE assets, and the net position held in trust for participants was $5,833,289. (Finding 1, pages 63-64) We recommended the Office establish an internal control process to perform and fully document due diligence procedures to ensure transactional activity between service and subservice organizations is fully documented. We also recommended the review of controls be documented timely and include any complementary user entity controls relevant to the Office’s operations. In addition, we recommended the Office obtain training for its staff regarding service organization due diligence procedures and an understanding of the types of controls that would impact financial reporting and the Office’s fiduciary responsibilities. The Office disagreed with the finding, noting internal controls and procedures the Office performed included reporting, due diligence, review of the SOC1 Report of the third-party service provider, and daily, weekly, and monthly review of transaction data provided by the third-party service provider. Further, the Office noted the checking (banking) account is provided by an external contractor which is a federally insured bank, subject to rigorous federal and state oversight and regulatory examination. In an auditor’s comment, we stated the Office may have procedures in place to obtain an understanding of the subservice provider’s internal controls over the debit card transaction withdrawals; however, without documentation of such, the auditors are unable to assess the adequacy and sufficiency of the internal controls. AUDITOR’S OPINION The auditors stated the Office of the Treasurer, Achieving a Better Life Experience program financial statements as of and for the year ended June 30, 2019 are fairly stated in all material respects. This financial audit was conducted by Crowe LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:sjs