REPORT DIGEST ILLINOIS DEPARTMENT OF INNOVATION AND TECHNOLOGY COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2018 Release Date:  July 9, 2019 FINDINGS THIS AUDIT:  30 CATEGORY:  NEW -- REPEAT -- TOTAL Category 1:  16 -- 0 -- 16 Category 2:  14 -- 0 -- 14 Category 3:  0 -- 0 -- 0 TOTAL:  30 -- 0 -- 30 FINDINGS LAST AUDIT: N/A* *This is the first examination of the Department. Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION Because of the significance and pervasiveness of the findings described within the report, we expressed an adverse opinion on the Department’s compliance with the assertions which comprise a State compliance examination. The Codification of Statements on Standards for Attestation Engagements (AT-C § 205.72) states a practitioner “should express an adverse opinion when the practitioner, having obtained sufficient appropriate evidence, concludes that misstatements, individually or in the aggregate, are both material and pervasive to the subject matter.”  This is the first Compliance Examination of the Department. SYNOPSIS • (18-001) The Department failed to comply with the provisions of Executive Order 2016-01: Executive Order Consolidating Multiple Information Technology Functions Into a Single Department of Innovation and Technology. • (18-002) The Department failed to maintain controls over its property and related records. • (18-003) The Department failed to comply with request for documentation from the Office of the Comptroller. • (18-004) The Department did not timely submit vouchers for payment. • (18-012) The Department did not establish adequate controls to ensure project management over the State’s Enterprise Resource Planning System. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS FAILURE TO COMPLY WITH EXECUTIVE ORDER 2016-01 The Department of Innovation and Technology (Department) failed to comply with the provisions of Executive Order 2016-01: Executive Order Consolidating Multiple Information Technology Functions Into A Single Department of Innovation and Technology. The Executive Order, effective March 27, 2016, required the Department and 38 agencies (agencies) to transfer (1) identified employees, (2) personnel records, books, correspondence, and other property; both real and personal, and (3) unexpended balances of Fiscal Year 2016 and Fiscal Year 2017 appropriations, to the Department as of July 1, 2016. Our testing noted, as of July 1, 2016, the Department and the agencies had not transferred: • the identified personnel. The first transfer of personnel occurred on October 1, 2016, with 23 additional agencies transferring personnel during Fiscal Year 2018. As of June 30, 2018, the remaining 14 agencies had not transferred personnel or had transferred the personnel to another agency. • the real and personal property. The first transfer of property from two agencies occurred during the last quarter of Fiscal Year 2017, with six agencies transferring property during Fiscal Year 2018.  The remaining 30 agencies had not transferred property as of June 30, 2018. The Department had entered into Intergovernmental Agreements (IGAs) with the agencies documenting the rights and duties of each party as they relate to the personnel, assets, contracts, and funding during the transition period.  However, we noted the Department had not entered into IGAs with 11 and 13 agencies for Fiscal Years 2017 and 2018, respectively.  In addition, we noted the Department had entered into IGAs with five agencies that were not documented in the Executive Order as a transferring agency.  (Finding 1, pages 12-13) We recommended the Department work with the agencies to complete the transfer of personnel and property as required by the Executive Order. Department management agreed with the finding and stated given the complexity of issues and number of stakeholders involved, it was not possible to complete the transfers within the time period required by the Executive Order. FAILURE TO MAINTAIN CONTROLS OVER PROPERTY The Department failed to maintain controls over its property and related records. Agency Report of State Property During our testing of the Agency Report of State Property (Form C-15) filed with the Office of the State Comptroller, we noted: For the Fiscal Year 2017 C-15 Reports: • The Department of Central Management Services (DCMS) compiled the C-15 Reports for the Statistical Service Revolving Fund (Fund 304) and the Communication Revolving Fund (Fund 312) for the Department. Department management indicated this was due to the DCMS, Bureau of Communication and Computer Services’ property not being transferred to the Department until June 29, 2017.  See Finding 2018-001 for additional information. • Fund 312 C-15 Reports were understated by $54,790,222 due to not recording the cost of the Fiber Optic Network. • Building and building improvements, totaling $1,089,591, were incorrectly classified as Capital Lease Assets on the C-15 Report for Fund 312.  The Department corrected the asset classification on the second quarter of Fiscal Year 2018’s C-15 Report. • The Department did not maintain supporting documentation for deletions reported on the C-15 Reports for Fund 304 and Fund 312, totaling $946,569 and $82,091, respectively. For the Fiscal Year 2018 C-15 Reports: • Fund 312 C-15 Report for the fourth quarter was understated by $44,825,981 due to not recording the cost of the Fiber Optic Network. • The Department did not maintain support for deletions, additions, and transfers reported on the C-15 Reports for Fund 312, totaling $741,267 (net). • On Fund 304’s third quarter C-15 Report, totaling $148,601,618, the Department stated “the above totals do not include a large quantity of tagged assets that have been recently identified with incomplete records in CIS (inventory system).  These appear to primarily stem from FY17 and are in the process of being completed.  The total value of these suspense items is estimated at $10 million.” • Fund 312 C-15 Reports did not include deletions, totaling $129,938 and transfers, totaling ($240,430). •For Fund 304 and Fund 312 C-15 Reports, net transfers totaling $14,872,663 were incorrectly reported as deletions and additions. Property Records Our testing of the Department’s Property Records noted: • Building and building improvements, totaling $1,089,591 and intangible assets, totaling $3,880,858 were not recorded in the Department’s inventory system. • 2,305 equipment items did not contain the purchase price and the purchase dates in the property records. Additionally, the Department was unable to determine the purchase price or the purchase dates. • 6,928 equipment items purchased in months/years preceding June 30, 2018, totaling $5,703,583 did not contain the purchase prices and the purchase dates. • 4,965 equipment items transferred to the Department by six transferring agencies, totaling $19,016,554 had not been recorded in the Department’s property records. • The Department recorded incorrect transaction codes in their property records for 150 and 1,652 equipment items in Fiscal Years 2017 and 2018, respectively. Annual Inventory During our testing of the Department’s Fiscal Years 2017 and 2018 annual physical inventory reports submitted to DCMS, we noted the following: • DCMS completed the Annual Property Certification for Fiscal Year 2017 due to not transferring property to the Department.  See finding 2018-001 for additional information. • For 14 of 17 (82%) missing computers, totaling $57,424, the Department was unable to provide information whether the computers contained confidential information. • The Department did not report the certification of inventory and discrepancy report for four of 203 (2%) location codes for Fiscal Year 2018. Population Completeness We requested the Department to provide the population of its property in order to determine if property had been properly recorded. In response to the request, the Department provided a population; however, given the noted exceptions above we were unable to conclude the Department’s population records were sufficiently precise and detailed under the Professional Standards promulgated by the American Institute of  Certified Public Accountants (AT-C § 205.35). Even given the population limitations noted above, we performed testing on a sample of the property population. Detailed Testing Property Additions: • Six of seven (86%) property additions, totaling $4,131, were recorded 17 to 293 days late. Property Deletions: • For 34 of 60 (57%) property deletions, totaling $955,552, the Department did not maintain the supporting documentation for the deletion. • 12 of 60 (20%) property deletions, totaling $103,651, were assigned improper transaction codes. • 20 of 60 (33%) property deletions, totaling $52,146, were recorded 15 to 1,337 days late. • 35 of 60 (58%) property deletions, totaling $325,978, lacked documentation of the approval by the DCMS’ Property Control Division. • 35 of 60 (58%) property deletions, totaling $319,040, lacked documentation of the signature by the receiving officer. Physical observation During testing, we noted: • For 17 of 120 (14%) items, totaling $84,503, property records were not updated to reflect the current location or transfer to DCMS as surplus. • Seven of 60 (12%) items were not recorded in the property records. • Three of 60 (5%) items, totaling $2,510, were not included on the listing reported to DCMS. Schedule of Changes in State Property Due to the noted exceptions above and limitations on the property population, the accountants were unable to conclude the Department’s Schedule of Changes in State Property was complete and appropriately reported. (Finding 2, pages 14-19) We recommended the Department implement controls to ensure all property is accounted for in accordance with the Illinois Administrative Code and the Statewide Accounting Management System Manual.  In addition, we recommended the Department ensure the reporting to DCMS and the Office of the State Comptroller is accurate and reconciled to the Department’s records. Department management agreed with the finding and noted they now operate under a new set of procedures and a computer application for the intake and reporting. In addition, Department management stated inaccurate data have been and continues to be corrected. FAILURE TO COMPLY WITH OFFICE OF THE COMPTROLLER REQUEST The Department failed to comply with request for documentation from the Office of the Comptroller. On March 10, 2017, the Office of the Comptroller requested from the Department documentation supporting vouchers presented for payment related to the development of the State’s Enterprise Resource Planning (ERP) system. The correspondence stated until such time the Office of the Comptroller received the documentation, the vouchers presented for payment would not be approved for payment. During our examination, we requested from the Department documentation of their response to the Office of the Comptroller’s correspondence. However, as of November 21, 2018, the Department had not provided the requested documentation to the Office of the Comptroller. As of June 30, 2018, the Office of the Comptroller was holding vouchers dating back to November 2015, totaling $124,938,490. In addition, due to the delay in payment of these vouchers, prompt payment interest has been accruing.  As of December 31, 2018, accrued interest was $20,658,807.  (Finding 3, pages 20-21) We recommended the Department work with and submit the requested documentation to the Office of the Comptroller. Department management agreed with the finding and noted they had provided answers and a detailed explanation of all work and deliverables performed by the vendor to the Office of the Comptroller in early April 2019. HELD VOUCHERS The Department did not timely submit vouchers for payment. During our examination, we noted the Department did not submit a majority of their vouchers for payment until after June 30: Fiscal Year -- Prior to June 30 -- After June 30 -- Total* 2017 -- $175,938,087 (49%) -- $182,217,868 (51%) -- $358,155,955 2018 -- $125,348,536 (39%) -- $193,993,717 (61%) -- $319,342,253 *The chart does not reflect the vouchers being held by the Office of the Comptroller as noted in Finding 2018-003. As a result of holding vouchers, the Department has accrued interest totaling approximately $28,872,879 and $11,863,416 at June 30, 2017 and 2018, respectively. (Finding 4, pages 22-23) We recommended the Department review and approve or deny a bill within 30 days. Additionally, upon approval, the Department should immediately submit the voucher to the Office of the Comptroller for payment. Department management agreed with the finding. INADEQUATE CONTROLS OVER PROJECT MANAGEMENT OF THE ENTERPRISE RESOURCE PLANNING SYSTEM The Department did not establish adequate controls to ensure project management over the State’s Enterprise Resource Planning System (ERP). Costs As part of the examination, we requested the initial approved budgeted cost for the ERP project; however, the Department was unable to provide this documentation.  The Department did, however, provide the Fiscal Year 2017 Capital Budget Overview, which stated the ERP was estimated to cost $250 million over five to six years.  For Fiscal Years 2015 through 2021, the Department’s actual and projected expenditures totaled $399,069,500.  Specifically: • FY2015 through FY 2018 actual expenditures were $149,328,900, and • FY2019 through FY2021 projected expenditures were $249,740,600. Change Management Our review of the ERP Change Management Policy and Procedures (Policy) noted it did not depict the current change environment. Specifically, we noted the Policy did not document: • the type of changes and the process they were to follow, • the information the Project Management Office and/or the Change Request Lead were to review and approve, • who was to review and approve the change request requirements and resource estimates, and • who was to approve the movement of the change request to the various environments. In addition, we noted the approvals were not always maintained in the change tracking system as required by the Policy, but rather in a secondary repository. We selected a sample of 15 change requests to determine if they complied with the requirements that were documented in the Policy, noting change requests were not always properly completed, tested, approved, or documented. Processes We selected a sample of 13 transaction processes to ensure they were functioning properly, and noted the ERP allowed for duplicate asset tag numbers. During testing, auditors were able to enter the same property tag number into the Asset management module.  (Finding 12, pages 40-42) We recommended the Department establish controls to ensure project management over the State’s ERP and ensure the ERP does not allow duplicate asset tag numbers. We also recommended the Department review the ERP Change Management Policy and Procedures and ensure it depicts the current change environment and actual practices.  Specifically, the Department should ensure the Policy addresses: • the type of changes and the process they are to follow, • the information the Project Management Office and/or the Change Request Lead are to review, • who is to review the change request requirements and resource estimates, and • who is to approve the movement of the change request to the quality environments. Lastly, we recommended the Department ensure all change requests document the requirements of the ERP Change Management Policy and Procedures. Department management agreed with the finding and noted a new module had been launched which will alleviate the problem of duplicate asset tag numbers.  Department management also stated they will review the Change Management policies and procedures and ensure they are comprehensive and reflect current practices. OTHER FINDINGS The remaining findings pertain to 1) inadequate controls over accounts receivable credit memorandums, collection efforts, voucher processing, external service providers, monthly reconciliations, State vehicles, employee exit procedures, and records for refunds 2) review of billing rates, 3) failure to adopt Departmental rules, 4) failure to comply with the Fiscal Control and Internal Auditing Act, 5) failure to approve or submit overtime requests and time reports not completed, 6) failure to submit and accurately file required reports, 7) emergency purchases weaknesses, 8) inadequate IT security, security over the midrange environment, disaster recovery planning, 9) employee evaluations not conducted timely, 10) inaccurate contract obligation documents, 11) failure to disable wireless communication devices, 12) lack of comprehensive and accurate description of IT controls, and 13) lack of agreements to ensure compliance with IT security requirements.  We will review the Department’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Department for the two years ended June 30, 2018, as required by the Illinois State Auditing Act.  Because of the effect of noncompliance described in Finding 2018-001 through Finding 2018-016, the accountants stated the Department did not comply with the requirements described in the report. This compliance examination was conducted by E.C. Ortiz & Co., LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:mkl