REPORT DIGEST

DEPARTMENT OF INNOVATION AND TECHNOLOGY
INFORMATION TECHNOLOGY SHARED SERVICES
SYSTEM

SYSTEM AND ORGANIZATION CONTROLS REPORT
AND REPORT REQUIRED UNDER GOVERNMENT
AUDITING STANDARDS
FOR THE YEAR ENDED JUNE 30, 2026

Release Date:  November 5, 2026

FINDINGS THIS AUDIT: 1

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  0 -- 1 -- 1
Category 2:  0 -- 0 -- 0
Category 3:  0 -- 0 -- 0
TOTAL:  0 -- 1 -- 1

FINDINGS LAST AUDIT: 2

State of Illinois, Office of the Auditor
General
CHRISTOPHER B. MEISTER, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

This digest covers our System and
Organization Controls Report and Report
Required under Government Auditing
Standards of the Department of Innovation
and Technology, Information Technology
Shared Services System (Department) for
the period from July 1, 2025, through June
30, 2026.

The System and Organization Controls
Report contains a qualified opinion due to
weaknesses associated with the
Department’s suitability of the control
design and operating effectiveness of
controls. In addition, the Report Required
under Government Auditing Standards (GAS)
contains one finding.

SYNOPSIS

• (26-1) The controls related to the
control objectives stated in the
description of the Information Technology
Shared Services System were not suitably
designed or did not operate effectively to
provide reasonable assurance the control
objectives would be achieved.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

CONTROLS WERE NOT SUITABLY DESIGNED OR DID
NOT OPERATE EFFECTIVELY

The controls related to the control
objectives addressing system processing
and error handling, change management,
physical access, and logical access stated
in the “Management of the State of
Illinois, Department of Innovation and
Technology’s Description of its
Information Technology Shared Services
System” (description), provided by the
Department of Innovation and Technology
(Department), were not suitably designed
or did not operate effectively to provide
reasonable assurance the control
objectives would be achieved.

System processing and error handling

During testing, we noted the Department
has not designed and implemented a
formalized process to document and monitor
abends (unexpected or abnormal
terminations of applications or operating
systems that result from problems with the
software) to resolution.

Change management

During testing, we noted change management
controls were not operating effectively to
ensure system changes were implemented in
accordance with established Department
procedures. Specifically, systems were not
patched during one of three (33%) months
tested.

Physical Access

During testing, we noted the physical
access controls were not operating
effectively to ensure physical access to
Department facilities was restricted to
authorized personnel. Specifically:

• Background check – For two of 24 (8%)
individuals tested, the Department could
not provide evidence of the required
attestation of a clear background check
completed within the five years preceding
badge issuance.
• Recertification of Access –
-- User access for individuals with access
to the Central Computing Facility (CCF),
Communications Building, and Warehouse was
not verified during the first quarter of
Fiscal Year 2026 access review in
accordance with the Department’s policy.
-- User access for individuals with access
to the CCF secured area was not verified
for one of three (33%) monthly reviews
tested.

Logical Access

During testing, we noted the logical
access controls were not operating
effectively to ensure access to Department
resources was authorized and approved.
Specifically:

• Revocation of Access – Access was not
revoked by the end of the next business
day following the employee’s or
contractor’s last day of work in
accordance with Department procedures for
three of 37 (8%) separated users tested.
Access was revoked three to 46 days late.

• Provisioning of Access – Access was
inadvertently provisioned to the wrong
user for one of 33 (3%) access requests
tested.

• Weekly Access Violation Report Reviews –
The Department was unable to provide
evidence that weekly access violation
reports were produced and reviewed in
accordance with established procedures for
two of seven (29%) weeks tested. (Finding
1, pages 8-10)

We recommended the Department ensure the
controls are suitably designed and
operating effectively over the services
provided to user agencies, specifically
involving system processing and error
handling, change management, and physical
and logical access.

Department officials agreed and stated
they will evaluate and strengthen controls
to ensure that procedures are established
and followed to (1) document and monitor
abends to resolution, (2) provision,
monitor, and revoke physical and logical
access, and (3) implement change
management controls.

SERVICE AUDITOR’S OPINION

The System and Organization Controls
Report contained a qualified opinion.
Specifically, the Service Auditors
determined, except for the matters
described in the System and Organization
Controls Report, in all material respects,
based on the criteria described in the
State of Illinois, Department of
Innovation and Technology’s assertion:

a. the description fairly presents the
Information Technology Shared Services
System that was designed and implemented
throughout the period July 1, 2025, to
June 30, 2026.

b. the controls related to the control
objectives stated in the description were
suitably designed to provide reasonable
assurance that the control objectives
would be achieved if the controls operated
effectively throughout the period July 1,
2025, to June 30, 2026, and subservice
organizations and user entities applied
the complementary controls assumed in the
design of the State of Illinois,
Department of Innovation and Technology’s
controls throughout the period July 1,
2025, to June 30, 2026.

c. the controls operated effectively to
provide reasonable assurance that the
controls stated in the description were
achieved throughout the period July 1,
2025, to June 30, 2026, and if
complementary subservice organization and
user entity controls assumed in the design
of the State of Illinois, Department of
Innovation and Technology’s controls
operated effectively throughout the period
July 1, 2025, to June 30, 2026.

The System and Organization Controls
Examination was conducted by Sikich CPA
LLC.

DENNIS M. GIBBONS
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

CHRISTOPHER B. MEISTER
Auditor General

CBM:vrb