REPORT DIGEST

DEPARTMENT OF INNOVATION AND TECHNOLOGY,
STATE OF ILLINOIS, ENTERPRISE RESOURCE
PLANNING SYSTEM


SYSTEM AND ORGANIZATION CONTROL REPORT
AND REPORT REQUIRED UNDER GOVERNMENT
AUDITING STANDARDS
FOR THE YEAR ENDED JUNE 30, 2020

Release Date:  August 12, 2020

FINDINGS THIS AUDIT:  1

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  1 -- 0 -- 1
Category 2:  0 -- 0 -- 0
Category 3:  0 -- 0 -- 0
TOTAL:  1 -- 0 -- 1

FINDINGS LAST AUDIT: 0

Category 1: Findings that are material
weaknesses in internal control and/or a
qualification on compliance with State
laws and regulations (material
noncompliance).
Category 2: Findings that are significant
deficiencies in internal control and
noncompliance with State laws and
regulations.
Category 3: Findings that have no
internal control issues but are in
noncompliance with State laws and
regulations.

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, Iles Park
Plaza, 740 E. Ash Street, Springfield, IL
62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

This digest covers our System and
Organization Control Report and Report
Required Under Government Auditing
Standards of the Department of Innovation
and Technology (Department), State of
Illinois, Enterprise Resource Planning
System for the period from July 1, 2019
through June 30, 2020.

The Enterprise Resource Planning System
is utilized by approximately 54 user
agencies.

The System and Organization Control
Report contained a modified opinion due
to the weakness associated with the
Department’s operating effectiveness of
controls. In addition, the Report
Required Under Government Auditing
Standards (GAS) contains one finding.

SYNOPSIS

• (20-1) The Department did not ensure
its controls over the State of Illinois,
Enterprise Resource Planning System
operated effectively.

FINDINGS, CONCLUSIONS, AND
RECOMMENDATIONS

CONTROLS DID NOT OPERATE EFFECTIVELY

The Department of Innovation and
Technology (Department) did not ensure
its controls over the State’s Enterprise
Resource Planning (ERP) System operated
effectively.  The controls related to the
control objectives are stated in the
“Description of the State of Illinois,
Enterprise Resource Planning System for
the IT General Controls and Application
Controls” (description of system),
provided by the Department.

As part of our testing to determine if
the controls were operating effectively,
we requested the Department to provide a
population of modifications to employees’
and contractors’ access to the
Department’s resources.  The Department
was unable to provide a population. As a
result of the Department’s inability to
provide the population, we were unable to
conduct testing to determine if the
controls related to logical access to
applications, data, and the environment
were restricted to authorized and
appropriate users.

Additionally, during our testing of the
controls related to the control
objectives stated in the description of
system, we noted specific controls which
did not operate effectively.
Specifically, we noted:

• Multiple instances where employees or
contractors:
– did not have evaluations completed
within the defined timeline.
– did not complete the Safeguard
Disclosure training and Security
Awareness training.
– did not have a completed Remedy service
request for terminated employees.

• One of 60 edits (tcodes) selected was
to allow display access only; however,
the tcode allowed update access.

• The Department was unable to provide
documentation demonstrating the timely
termination of individuals’ access to the
Department’s resources.

• New employee and contractor access
requests were not submitted by an
authorized Agency Technology Service
Requester or Department IT Coordinator.

• A new employee did not have an access
request submitted to obtain access to the
Department’s resources.

As a result of the above noted
exceptions, the controls were not
operating effectively to provide
reasonable assurance that the control
objectives related to logical access to
applications, data and the environment
was restricted to authorized and
appropriate users. (Finding 1, pages 7-8
of GAS Report)

We recommended the Department ensure its
controls operate effectively over the
services provided to user agencies.

Department officials accepted the
recommendation.

DEPARTMENT SECRETARY

During Examination Period:
Ron Guerrier (2/18/20 – Current)
Ron Guerrier, Acting (7/1/19 – 2/17/20)

SERVICE AUDITOR’S OPINION

The System and Organization Control
Report contained a modified opinion.
Specifically, the Service Auditors
determined, except for the matters
described in the System and Organization
Control Report, in all material respects,
based on the criteria described in the
State of Illinois, Department of
Innovation and Technology’s assertion:

• the description fairly presents the
State of Illinois, Enterprise Resource
Planning System that was designed and
implemented throughout the period from
July 1, 2019 to June 30, 2020.
• the controls related to the control
objectives stated in the description were
suitably designed to provide reasonable
assurance that the control objectives
would be achieved if the controls
operated effectively throughout the
period from July 1, 2019, to June 30,
2020; and subservice organizations and
user entities applied complementary
controls assumed in the design of the
State of Illinois, Department of
Innovation and Technology’s control
throughout the period July 1, 2019 to
June 30, 2020.
• the controls operated effectively to
provide reasonable assurance that the
control objectives stated in the
description were achieved throughout the
period from July 1, 2019 to June 30, 2020
if complementary subservice organization
and user entity controls assumed in the
design of the State of Illinois,
Department of Innovation and Technology’s
controls operated effectively throughout
the period July 1, 2019 to June 30, 2020.

This System and Organization Examination
was conducted by the Office of the
Auditor General’s staff.

JANE CLARK
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM: MKL