REPORT DIGEST
UNIVERSITY OF ILLINOIS

FINANCIAL AUDIT
FOR THE YEAR ENDED JUNE 30, 2025

Release Date:  January 15, 2026

FINDINGS THIS AUDIT: 0

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  0 -- 1 -- 1
Category 2:  1 -- 0 -- 1
Category 3:  0 -- 0 -- 0
TOTAL:  1 -- 1 -- 2

FINDINGS LAST AUDIT: 0

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

The University’s financial audit report
consists of three sets of financial
statements as follows – the financial
statements of the University, the revenue
bond financial statements of the Auxiliary
Facilities System, and the revenue bond
financial statements of the Health Services
Facilities System.

This digest covers the University of
Illinois’s Financial Audit as of and for
the year ended June 30, 2025.  The
University’s Compliance Examination and
Single Audit will be issued in separate
reports at a later date.

SYNOPSIS

• (25-1) The University did not ensure
adequate controls for system access reviews
and terminations over their Electronic
Health Record System and Enterprise
Resource Planning System.

• (25-2) The University did not properly
transfer construction in progress into
depreciable assets when projects were
substantially complete.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

WEAKNESSES IN CONTROLS OVER ACCESS
TERMINATION AND REVIEWS

The University of Illinois (University) did
not ensure adequate controls for system
access reviews and terminations over their
Electronic Health Record System (EHR) and
Enterprise Resource Planning System (ERP).

The University maintains an EHR that
contains patient medical records and data.
The EHR supports billing and transaction
workflows which feed into the financial
statements. Additionally, the University
maintains an ERP that contains student,
faculty, financial, and personal data. The
University relies on the ERP for financial
reporting.

During our testing of separated users’
access to the ERP and EHR, we noted the
University’s departments were not timely
notifying Human Resources (HR), which in
turn did not timely notify the Information
Technology security team (IT) in order to
remove access. Specifically, we noted:

• For the ERP system, HR did not notify IT
timely for 1 of 60 terminations (2%), and
this user’s access was removed 28 days
late.

• For the EHR system, HR did not notify IT
timely for 12 of 60 terminations (20%), and
for 8 of those terminations (13%) access
was removed between 2 and 106 days late.

In addition, for the EHR system, we noted
the user access review was not performed at
an appropriate level of precision.  The
review only validated whether employees who
did not access the system within the past
year were still employed by the
university.  The review did not include a
review of all users with access to
determine if their access was needed for
their assigned job role. (Finding 1, Pages
5-6)

We recommended the University implement
additional controls to ensure HR is
notifying IT timely for all terminations.
We also recommended that the EHR user
access review includes a comprehensive
review of all users with access.

University officials accepted the
recommendation.

INADEQUATE CONTROLS OVER CONSTRUCTION IN
PROGRESS

The University of Illinois (University) did
not properly transfer construction in
progress to depreciable assets when
projects were substantially complete.
During our audit, we identified two
projects classified as construction in
progress that were substantially completed
prior to the University’s fiscal year-end.
The University identified an additional
fourteen construction in progress projects
that were also substantially complete prior
to the University’s fiscal year-end.  As a
result, the University improperly
classified fixed assets of $23,606,000 as
non-depreciable capital assets that should
have been classified as depreciable capital
assets.  The University recorded an
adjustment to correct this error, which was
properly reflected in the financial
statements.

In addition, certain amounts disclosed in
the capital assets footnote were misstated
as these projects were substantially
completed in prior fiscal years.  For the
fiscal year ending June 30, 2025, the
beginning balances for construction in
progress and buildings were overstated and
understated by $18,186,000, respectively,
and transfers between construction in
progress and buildings were overstated by
$18,186,000.  Lastly, the accumulated
depreciation for buildings was understated
by $1,305,000, and depreciation expense for
fiscal year 2025 was understated by
$826,000.  The University elected to pass
on these adjustments. (Finding 2, Pages
7-8)

We recommended the University implement
controls to ensure that project managers
communicate status updates of projects
timely so that assets can be classified and
depreciated appropriately.

University officials accepted the
recommendation.

AUDITOR’S OPINIONS

Our auditors stated the financial
statements of the University, the Auxiliary
Facilities System and the Health Services
Facilities System as of June 30, 2025, and
for the year then ended, are fairly stated
in all material respects.

This financial audit was conducted by RSM
US LLP.

COURTNEY DZIERWA
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:TLK