REPORT DIGEST

DEPARTMENT OF INNOVATION AND TECHNOLOGY
INFORMATION TECHNOLOGY SHARED SERVICES
SYSTEM

SYSTEM AND ORGANIZATION CONTROLS REPORT AND
REPORT REQUIRED UNDER GOVERNMENT AUDITING
STANDARDS
FOR THE TWO YEARS ENDED JUNE 30, 2023

Release Date:  November 7, 2024

FINDINGS THIS AUDIT: 1

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  1 -- 0 -- 1
Category 2:  0 -- 0 -- 0
Category 3:  0 -- 0 -- 0
TOTAL:  1 -- 0 -- 1

FINDINGS LAST AUDIT: 2

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

This digest covers our System and
Organization Controls Report and Report
Required under Government Auditing Standards
of the Department of Innovation and
Technology, Information Technology Shared
Services System (Department) for the period
from July 1, 2023 through June 30, 2024.

The System and Organization Controls Report
contains a qualified opinion due to
weaknesses associated with the Department’s
suitability of the control design and
operating effectiveness of controls. In
addition, the Report Required under
Government Auditing Standards (GAS) contains
one finding.

SYNOPSIS

• (24-1) The controls related to the control
objectives stated in the Description of the
Information Technology Shared Services
System were not suitably designed or did not
operate effectively to provide reasonable
assurance the control objectives would be
achieved.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

CONTROLS WERE NOT SUITABLY DESIGNED OR DID
NOT OPERATE EFFECTIVELY

The controls related to the control
objectives stated in the “Description of the
State of Illinois, Department of Innovation
and Technology’s Information Technology
Shared Services System” (description of
system), provided by the Department of
Innovation and Technology (Department), were
not suitably designed or did not operate
effectively to provide reasonable assurance
the control objectives would be achieved.

As part of our testing to determine if the
controls were suitably designed, we
requested the Department provide populations
related to unsuccessful backups and
processing deviations, problems and errors.
However, the Department was unable to
provide the populations. Due to these
conditions, we were unable to conclude the
Department’s population records were
sufficiently precise and detailed under the
Attestation Standards promulgated by the
American Institute of Certified Public
Accountants (AT-C § 320.30) to test the
suitable design of the controls. As such, we
could not perform testing.

As a result, we were unable to determine if
the controls were suitably designed or
operated effectively.  (Finding 1, page 8 of
GAS Report)

We recommended the Department ensure the
controls are suitably designed and operate
effectively over the services provided to
user agencies.

Department officials agreed and stated they
were assessing options to capture and retain
reports of alerts from the mainframe log
files.

SERVICE AUDITOR’S OPINION

The System and Organization Controls Report
contained a qualified opinion. Specifically,
the Service Auditors determined, except for
the matters described in the System and
Organization Controls Report, in all
material respects, based on the criteria
described in the State of Illinois,
Department of Innovation and Technology’s
assertion:

a. the description fairly presents the State
of Illinois, Department of Innovation and
Technology’s Information Technology Shared
Services System that was designed and
implemented throughout the period July 1,
2023 to June 30, 2024.

b. the controls related to the control
objectives stated in the description were
suitably designed to provide reasonable
assurance that the control objectives would
be achieved if the control operated
effectively throughout the period July 1,
2023 to June 30, 2024, and if the subservice
organizations and users entities applied the
complementary controls assumed in the design
of the State of Illinois, Department of
Innovation and Technology’s controls
throughout the period July 1, 2023 to June
30, 2024.

c. the controls operated effectively to
provide reasonable assurance that the
controls stated in the description were
achieved throughout the period from July 1,
2023 to June 30, 2024, and if the subservice
organizations and users entities applied the
complementary controls assumed in the design
of the State of Illinois, Department of
Innovation and Technology’s controls
operated effectively throughout the period
July 1, 2023 to June 30, 2024.


The System and Organization Controls
Examination was conducted by
CliftonLarsonAllen LLP.

JANE CLARK
Division Director


This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:vrb