State of Illinois

Office of the Auditor General

2018 Annual Report

March 1, 2019

The Honorable Members of the General Assembly

The Legislative Audit Commission

The Honorable JB Pritzker, Governor

Citizens of Illinois

Ladies and Gentlemen:

Enclosed is the Annual Report of the Auditor General’s Office, submitted in compliance with Section 3-15 of the Illinois State Auditing Act.

The mission of the Auditor General’s Office has been, and will continue to be, to present objective, balanced and independent audits. I believe this Annual Report reflects the Office’s success in fulfilling that goal during calendar year 2018.

I would like to thank the members of the General Assembly, members and staff of the Legislative Audit Commission, and the staff of the Auditor General’s Office, through whose efforts the reported accomplishments were made possible.

Yours truly,

FRANK J. MAUTINO

Auditor General

Overview

Frank J. Mautino became Auditor General of the State of Illinois on January 1, 2016. Prior to his appointment as Auditor General, Mr. Mautino was a member of the Illinois House of Representatives, and served as a co-chairman of the Legislative Audit Commission.

As a constitutional officer, the Auditor General audits public funds of the State and reports findings and recommendations to the General Assembly and to the Governor. The establishment of the Auditor General under the Legislature is important. It ensures that the Legislature, which grants funds and sets program goals, will ultimately review program expenditures and results. Thus, agencies are accountable to the people through their elected representatives.

The Auditor General’s Office performs several types of audits to review State agencies. Financial audits and Compliance examinations are mandated by law. They disclose the obligation, expenditure, receipt, and use of public funds. They also provide agencies with specific recommendations to help ensure compliance with State and Federal statutes, rules and regulations.

Performance audits are conducted at the request of legislators to assist them in overseeing State government. Programs, functions, and activities are reviewed according to the direction of the audit resolution or law directing the audit. The General Assembly may then use the audit recommendations to develop legislation for the improvement of government.

Information Systems audits are performed on the State’s computer networks. They determine whether appropriate controls and recovery procedures exist to manage and protect the State’s financial and confidential information.

Copies of all audits are made available to members of the Legislature, the Governor, the media, and the public. Findings include areas such as accounts receivable, computer security, contracts, expenditure control, leases, misappropriation of funds, personnel and payroll, property control, purchasing, reimbursements, telecommunications, and travel.

Audit reports are reviewed by the Legislative Audit Commission in a public hearing attended by agency officials. Testimony is taken from the agency regarding the audit findings and the plans the agency has for corrective action. In some cases, the Commission may decide to sponsor legislation to correct troublesome fiscal problems brought to light by an audit. All outstanding recommendations are reviewed during the next regularly scheduled audit of an agency or, if the Commission requests, a special interim audit may be conducted.

Public Information

An audit and its supporting workpapers, unless confidential by, or pursuant to, law or regulation, are public documents once the report has been officially released to the Legislature, the public, and the press. These documents are available for review in our Springfield and Chicago offices.

The following information is also available by request:

• Late Filing Affidavits

• Emergency Purchase Affidavits

• Contractual Services Certifications

Information about the Auditor General is available on the Internet. This information includes report summaries and full report texts.

Our internet web site address is: www.auditor.Illinois.gov

Our e-mail address is: oag.auditor@Illinois.gov

Public information is available by writing:

FOIA Officer

Office of the Auditor General

Iles Park Plaza

740 E. Ash St.

Springfield, IL 62703-3154

Springfield:

Telephone: (217) 782-6046

Fax: (217) 785-8222

Chicago:

Telephone: (312) 814-4000

Fax: (312) 814-4006 TTY: (888) 261-2887

Our Fraud Hotline is: Toll-Free: (855) 217-1895

Visit our web site at www.auditor.Illinois.gov for full details or for an on-line reporting form.

Organizational Chart

As of December 31, 2018, there were 87 employees. Eighty-two were located in the Springfield Office and five in the Chicago Office.

The Compliance Examination Program

The Auditor General is required by the Illinois State Auditing Act to conduct, as is appropriate to the agency’s operations, a financial audit and/or compliance examination of every State agency at least once every two years. These audits and examinations inform the public, the Legislature, and State officers about the obligation, expenditure, receipt, and use of public funds, and provide State agencies with specific recommendations to help ensure compliance with State and Federal statutes, rules, and regulations.

The Compliance Audit Division conducted engagements at 83 different agencies during the FY 2017 audit cycle. These engagements encompassed compliance examinations, financial audits, and/or federal audits. Staff auditors conducted 30 of these audits. The remainder were performed by public accounting firms under the general direction and management of the Auditor General’s audit managers.

The Illinois Constitution of 1970 revised and expanded the traditional financial audits conducted of State agencies to focus on compliance with legislative intent and proper performance of governmental operations, as well as financial accountability.

The compliance program has a positive impact on the operations of State government because agencies implement many of the recommendations made in these reports. Compliance reports are also reviewed by the Legislative Audit Commission, where legislators question agency directors about audit findings and the corrective action they plan to take. Legislators and their staffs also use compliance reports during appropriation hearings in the spring legislative session. To maximize the usefulness of audit information, the Office attempts to deliver audits as early as possible in the legislative session.

Accountability

A number of reports issued for FY2016 had findings that were critically important from an accountability standpoint. A brief summary of some of these findings follows:

PROBLEMS WITH THE DECOMMISSIONING OF THE ILLINOIS HEALTH INFORMATION EXCHANGE

The Illinois Health Information Exchange Authority’s (Authority) purpose was to promote and facilitate the widespread adoption of electronic medical records and participation in the Illinois Health Information Exchange (ILHIE) among healthcare providers. According to Authority officials, the ILHIE was decommissioned by June 30, 2016.

The Authority, the Office of the Governor, and the Department of Healthcare and Family Services (Department) entered into an interagency agreement on September 23, 2016. This interagency agreement included the following terms:

• Section 2.03 noted all of the Authority’s remaining staff “shall ultimately report to, and be under the management control of the Department’s Chief Operating Officer/Chief of Staff.”

• Section 3.02 required the Authority to designate the Department as its fiscal agent for the purposes of distributing moneys from the Health Information Exchange Fund and may, at the Department’s discretion, deposit future moneys received into the Health Information Exchange Fund.

• Section 3.03 required the Authority to designate the signature authority of its Executive Director “in its entirety” to the Department’s Director.

In practicality, this interagency agreement ended the Authority’s existence as an independent, standalone entity and reorganized the functions of the Authority into the Department. We noted this change would contravene the provisions of the Illinois Health Information Exchange and Technology Act (20 ILCS 3860/10), which created the Authority as “an instrumentality and an administrative agency of the State.”

The Constitution (Article V, Section 11) allows the Governor to reassign functions among or reorganize executive agencies directly responsible to the Governor. If the reassignment or reorganization contravenes a statute, the Executive Order must be delivered to the General Assembly. After the Governor complies with the delivery provisions of the Constitution, the General Assembly has 60 calendar days after the delivery of the Executive Order to have one house, by a record vote, disapprove of the reassignment or reorganization to prohibit the reassignment or reorganization from occurring.

Some of the other significant problems we noted were as follows:

• It does not appear that the Authority has an adequate plan for its future operations.

• The Authority failed to adopt a comprehensive decommissioning plan for ILHIE which completely addressed the destruction of personally identifiable information and health data of individuals within the ILHIE.

• The Authority did not ensure data on the ILHIE was properly destroyed.

• The Authority failed to comply with the State Records Act, resulting in an improper destruction of the State’s records.

We recommended the Department, on behalf of the Authority, develop and operate ILHIE, or seek legislative remedy; take action to ensure all of the ILHIE’s data is adequately protected from disclosure and secured until it can be verified as destroyed; and take action to ensure all of the Authority’s remaining records are retained and only destroyed in accordance with the provisions of the State Records Act.

Department officials accepted the recommendations.

LATE PAYMENT OF STATUTORILY MANDATED TRANSFERS

The Office of the Comptroller did not make all statutorily mandated transfers between State funds within established timeframes, as required.

The Office of the Comptroller processed transfers from 31 to 479 days after the mandated transfer date. The late transfers outstanding as of and paid after June 30, 2017, totaled $2.14 billion. Failure to make inter-fund transfers within applicable timeframes represents noncompliance with State law and might result in delayed use of appropriated funds.

Comptroller officials stated the late payment of transfers occurred because of cash management decisions and prioritization due to the lack of available cash in the State Treasury. Further, some statutory provisions relating to transfers contain language such as “as soon as possible.”

We recommended the Comptroller make transfers within timeframes established by applicable statute. While we realize that lack of available funds in the State Treasury requires prioritization and cash management decisions, we also recommended the Comptroller continue in its efforts to make transfers in as timely a manner as possible.

Comptroller officials accepted the recommendation and stated that taking into account the financial condition of State funds facing at times a $16 billion backlog, they will continue efforts to make the required transfers to the extent possible given all the competing payments from limited resources in the State Treasury.

FAILURE TO IDENTIFY FINANCIAL STATEMENT REPORTING ERRORS

The Office of the Secretary of State (Office) did not identify the required adjustments necessary to ensure the Office’s audited financial statements were accurately presented in accordance with generally accepted accounting principles (GAAP).

The Office’s financial statements were originally submitted to the Illinois Office of the Comptroller with errors. The government-wide adjustments on the Reconciliation of Statement of Revenues, Expenditures and Changes in Fund Balance of Governmental Funds to Statement of Activities were materially misstated by approximately $340,000,000, primarily due to incorrect pension adjustments. In addition, the governmental funds balance sheet did not balance because total assets and deferred outflows of resources did not equal total liabilities, deferred inflows of resources and fund balances by $6,000 on the Statement of Net Position and Governmental Funds Balance Sheet. The Office submitted revised financial statements with the previous issues corrected, however, additional misstatements were noted.

We recommended the Office implement internal control procedures to assess the risk of material misstatements of the Office’s financial statements and devote adequate resources to identify such misstatements during the financial statement preparation and review process.

Office officials agreed with the recommendation and stated corrective measures will be taken in order to ensure that documentation of Office financial reporting procedures is current and complete, and that appropriate resources are utilized to ensure a more accurate and timely review of reports prior to submission.

INADEQUATE PROCESS TO DETERMINE CLAIMS LIABILITIES

The Illinois Workers’ Compensation Commission (Commission) Self-Insurers Security Fund (Fund) had an inadequate process to determine the claims liabilities of the Fund.

Background

The Self-Insurers Advisory Board (Board) within the Commission was established by the Workers’ Compensation Act (Act) to provide oversight of self-insurers, ensure the employees of insolvent self-insurers continue to receive their benefits due under the Act and the Workers’ Occupational Diseases Act (together, the “Acts”) by administering the Fund, and determining the assessments to levy against all private self-insurers to ensure resources are available to continue paying benefits due to employees of insolvent self-insurers.

If a self-insurer becomes insolvent and can no longer pay its workers’ compensation obligations, the Board assumes the outstanding obligations under the Acts of the insolvent self-insurer and takes action to collect, recover, and enforce all of the various forms of security provided by the insolvent self-insurer. The Board then directs the Commission to deposit resources derived from the security into the Fund.

The Fund will continue to pay, in full, the insolvent self-insurer’s obligations due under the Acts as long as the insolvent self-insurer’s employees remain disabled. Due to the nature of workers compensation claims, these costs can extend out over several decades and remain subject to a wide variety of factors impacting the actual cost of the obligation due to the employees, including necessary medical procedures, cost inflation, and each employee’s life expectancy.

Review of Accounting Principles Generally Accepted in the United States

Governmental Accounting Standards Board Statement (GASBS) No. 34 requires the presentation of proprietary funds, such as the Fund, under the accrual basis of accounting and the economic resources measurement focus. Further, GASBS No. 34 notes transactions occur when something of value passes between two or more parties. Additionally, National Council on Governmental Accounting Statement No. 1 states that under the accrual basis of accounting, transactions are generally recorded when the transaction occurs, regardless of when cash is received or disbursed.

Additionally, GASBS No. 62 requires estimated losses be accrued if both (1) information available prior to the issuance of the financial statements indicates it is probable a liability has been incurred as of the date of the financial statement, and (2) the amount of the loss can be reasonably estimated. If either or both of these conditions cannot be satisfied, GASBS No. 62 requires the exposure be disclosed in the notes to the financial statements.

Application of the Accounting Literature to the Fund’s Environment

As such, the Fund must develop an accounting methodology to properly account for incurred but not reported (IBNR) claims liabilities and the associated administrative costs necessary to continue processing the amounts due to the employees’ over time as of the date when it is both (1) probable a liability has been incurred, and (2) the amount can be reasonably estimated, or disclose the situation in the Fund’s notes if one or both conditions are not met. This is necessarily an accounting estimate and impacts the Board’s determination of assessments needed to ensure the Fund has sufficient resources to carry out its activities under the Act.

We noted the Commission’s current methodology for its claims liability generally reflects cash basis or modified accrual basis accounting for the Fund’s unpaid medical claims and unpaid administrative and legal expenses. These liabilities must be reported on the full accrual basis of accounting.

During the audit process, we recommended the Commission adopt a claims reserve analysis to properly estimate the Fund’s net unpaid claims liability. This process would calculate both known claims (such as established rates for indemnity payments) and IBNR claims where actuarial techniques are used to calculate the total liability of each individual claim from an insolvent self-insurer’s employees, and recognize that expense in the period when it becomes probable a liability has been incurred. When these claims are ultimately paid from the Fund, the Fund would reduce its already recorded liability for unpaid claims.

A formula for determining the Fund’s net claims liability from each claim is:

Add:

• Gross Unpaid Indemnity Claims

• Gross Unpaid Medical Claims

• Gross Unpaid Administrative and Legal Expenses
Less:

• Excess Insurance Recoveries

• Security Collected from Insolvent Self-Insurers

Equals:

Recognized Net Unpaid Claims Liability

Material and Pervasive Misstatement

After extensive discussions between the auditors and the Commission, the Board and Commission ultimately did not adopt a claims reserve analysis approach to calculate claims liabilities in accordance with the accrual basis of accounting.

The Board and Commission kept its prior claims methodology which did not reflect the accrual basis of accounting.

As a result of the Commission not adopting a more robust process to determine the estimated claims liabilities of the Fund, the auditors expressed an adverse opinion of the Fund financial statements as of and for the year ended June 30, 2016.

We recommended the Commission, in conjunction with the Board, take action to ensure its claims liabilities, including the Fund’s unpaid medical claims and unpaid administrative and legal expenses, are properly presented in accordance with the accrual basis of accounting.

The Commission agreed with this recommendation.

NONCOMPLIANCE WITH STATUTORILY MANDATED TIME LIMITS

The Department of Human Rights (Department) did not meet the procedural time limits set forth when a charge of a civil rights violation has been filed.

In our review of 40 employment cases filed with the Department, we noted the following:

• In 28 (70%) of the cases tested, a copy of the charge to the respondent was served 1 to 115 days later than the required 10 day period.

• In 25 (63%) of the cases tested, notices to the complainant of the complainant’s rights to file a complaint with the Human Rights Commission or commence a civil action in the appropriate circuit court were served 1 to 115 days later than the required 10 day period.

• In 34 (85%) of the cases tested, notice to the respondent of the complainant’s right to file with the Human Rights Commission or commence a civil action in the appropriate circuit court was not served. The required time period to send the notice is 10 days.

We recommended the Department timely notify the appropriate parties as mandated by the Illinois Human Rights Act.

Department officials accepted the recommendation.

NONCOMPLIANCE WITH THE ILLINOIS LOTTERY LAW

The Department of the Lottery (Department) did not transfer the required amount to the Capital Projects Fund (Fund 694), as required by the Illinois Lottery Law (Law), and did not properly disclose the noncurrent portion of the liabilities associated with not making the transfer in its financial statements.

During testing, the auditors noted the amount owed to Fund 694 from the State Lottery Fund (Fund 711) has grown to $98.382 million. This amount has been steadily increasing since June 30, 2015, because the actual annual amount of cash transferred to Fund 694 from Fund 711 has been less than required by the Law. The following is an analysis of the actual transfers and cash deposits into Fund 694 and amounts due to Fund 694 (in thousands) over the past three fiscal years: (Please see PDF version of this report for table.)

In analyzing Fund 711’s current assets for the last three years, there were sufficient funds available from current assets to pay current liabilities (less amounts due to Fund 694) with current assets left over. The following summary analysis shows Fund 711’s current assets, current liabilities (excluding the amount due to Fund 694), and cash balances (in thousands) over the past three fiscal years: (Please see PDF version of this report for table.)

Finally, the cash ratio, a comparison of total cash to current liabilities, is one metric to analyze liquidity, or ability to satisfy an entity’s short-term obligations with cash. The higher the cash ratio, the more capable an entity is to pay its current liabilities. The cash ratio is generally a more conservative look at an entity’s ability to cover its liabilities than many other liquidity ratios because other current assets, including accounts receivable, are left out of the equation and some current liabilities have not yet been invoiced by vendors. A cash ratio of 1.0 or greater is an indicator an entity is better positioned to cover its current liabilities. The following is a summary analysis and chart of Fund 711’s increasing cash ratio (in thousands) over the past three fiscal years: (Please see PDF version of this report for table and graph.)

The Illinois Lottery Law (Law) (20 ILCS 1605/9.1(o)) requires the Department distribute the proceeds of lottery tickets and shares sold in the following priority order and manner:

1) to pay prizes and retailer bonuses;

2) to pay costs related to administering the Lottery (including all amounts due under the Management Agreement to the Private Manager);

3) to distribute the net revenue from specialty tickets into specific State funds, as provided by §21.5, § 21.6, § 21.7, § 21.8, and § 21.9 of the Law;

4) to transfer into the Common School Fund (Fund 412) an amount equal to the proceeds transferred into Fund 412 from Fund 711 in Fiscal Year 2009, as adjusted for inflation; and,

5) to deposit, on or before the last day of each fiscal year, any remaining proceeds into Fund 694.

In addition, the auditors noted the Department had not properly disclosed its current and noncurrent liabilities associated with the interfund balances due to Fund 694 from Fund 711. Department management corrected this error in the Department’s final financial statements.

Department officials stated the insufficient transfers were due to:

1) excess transfers from Fund 711 to the Fund 412 which occurred up to June 30, 2009; and,

2) the Law’s annual deadline for transferring cash from Fund 711 to Fund 694 occurring on the last day of the State’s fiscal year, which does not allow the Department to perform a close of its accounting records to determine the actual amount of net proceeds to transfer into Fund 694.

Further, Department officials indicated the development of a reasonable estimate is complicated by an unknown liability for prizes won (particularly, if a jackpot was to be won) on June 30 but after the transfer would have to be completed and the fact the Lottery has to maintain sufficient cash reserves to continue normal operations until non-cash assets at June 30 are converted to cash, such as accounts receivable.

In regards to the excess transfers referenced by the Department’s management, until June 30, 2009, the Department’s predecessor agencies had historically made cash transfers into Fund 412 in excess of Fund 711’s accrual basis net income. These excess transfers were recorded as a due from Fund 412 on Fund 711’s financial statements (effectively, an account receivable). As of June 30, 2009, this amount of excess transfers was $69.9 million. At June 30, 2012, the Department determined – due to the statutory changes within Public Act 096-0034 (effective on July 13, 2009) – the excess contributions would not be collected. As such, the Department recorded an adjustment of $69.842 million to reclassify the due from Fund 412 as a transfer. Through the end of fieldwork, the Department has not been able to recoup the $69.9 million in excess transfers, which has caused a shortage of cash available to perform current period transfers.

We recommended the Department study its estimation process for the amount due to Fund 694 so the annual transfer can better approximate the amount required to transfer in accordance with the Law, absent a statutory change in the transfer date. Further, the Department should continue to seek a legislative remedy to allow the Department to “true-up” its annual required transfer after finalizing its accounting records. In addition, the Department should properly report the current and noncurrent portions of the amount due to Fund 694 from Fund 711 during its financial reporting process.

Department officials accepted the recommendation.

INADEQUATE CONTROLS OVER FISCALLY MONITORING MANAGED CARE ORGANIZATIONS

The Department of Healthcare and Family Services (Department) failed to implement adequate fiscal-related monitoring controls over Managed Care Organization (MCO) contracts. In addition, the Department failed to exercise or enforce fiscal-related monitoring controls as provided for in the various MCO contracts. Since 2013, the Department has paid the 12 MCOs approximately $22.5 billion.

While testing the contracts the Department entered into with the 12 MCOs, we noted the Department did not:

• have a review process in place to ensure MCO capitation payments were accurate. As a result, we noted instances totaling $619,455 for which the Department had a net underpayment to the MCOs for services paid during fiscal year 2017.

• have a review process in place to ensure the correct percentage of the MCO incentive payments, manually calculated, were withheld in accordance with the MCO contracts. As a result, we noted instances totaling $10,991,086 for which the Department overpaid the MCOs during fiscal year 2017 by failing to withhold at the rate established by the contract.

• review or audit self-reported encounter data (valid claims of services rendered by medical providers) submitted to the Department by the MCOs as required by the MCO contracts and the federally-approved State Plan.

• receive all healthcare program encounter data.

• review or audit the MCOs denial of claims data.

• review MCO actual administrative costs or other non-benefit costs.

• calculate and finalize the MCOs’ annual Medical Loss Ratio calculations for mandatory enrollment for Coverage Years 2013, 2014, and 2015. This provision of the MCO contracts is included to determine whether the MCOs met established benefit levels for the coverage year and provides a mechanism for the State to recoup payments that fail to meet the target.

• conduct internal audits over the Managed Care Program for mandatory enrollment since 2013.

We recommended the Department take immediate action to exercise and enforce monitoring and accountability provisions established in the contracts with the MCOs. We also recommended the Department establish and implement additional internal controls, internal audits, and on-site reviews to fiscally monitor the MCOs to ensure the State’s Medicaid program is carried out in an effective, efficient, and economical manner.

The Department accepted the recommendation.

INADEQUATE CONTROLS OVER STATE PROPERTY

The Department of Agriculture (Department) did not exercise adequate controls over State property.

The following are some of the items we noted during our testing of State property within the Department:

• We were unable to locate 3 of 60 items totaling $23,254 from the property listing.

• Twenty-four of 60 items could not be traced to the property listing.

• We noted 16 of 120 items were not tagged.

• The Department was not able to provide adequate supporting documentation for additions or deletions during Fiscal Year 2016 and 2017. As a result, we were not able to perform additions and deletions testing of State property items.

During our testing of the quarterly Agency Report of State Property (Form C-15), we noted the following:

• Adequate supporting documents for the additions and deletions for Fiscal Years 2016 and 2017 were missing. As a result, we were not able to verify the accuracy of the amounts reported or reconcile Department records with Comptroller’s record for equipment expenditures. In addition, we were unable to determine whether C-15 errors noted in the prior examination were corrected by the Department.

• Three of 8 Form C-15s were not submitted timely.

• Five of 8 Form C-15s contained mathematical errors in totals and the beginning balances did not agree with ending balances of previous quarter.

We recommended the Department strengthen its procedures over property and equipment to ensure accurate and timely recordkeeping and accountability for all State assets. We also recommended the Department incorporate internal review procedures within its fixed assets reporting function to ensure the capital asset information is complete and properly recorded and accounted for to permit the preparation of reliable financial information and reports to the Illinois Office of the Comptroller.

Department officials agreed with the recommendation and stated new procedures resulting from the Department’s conversion into the new Enterprise Resource Program, with SAP replacing much of the current software and programs that are used by the Department today that are very out of date, should clear up much of the confusion surrounding property and assets held by the Department.

WEAKNESSES IN INTERNAL CONTROL OVER FINANCIAL REPORTING

The Department of Central Management Services (Department) year-end financial reporting in accordance with generally accepted accounting principles (GAAP) to the Illinois Office of the State Comptroller contained errors in the determination of certain year-end account balances.

During the audit of the June 30, 2017 financial statements we noted the following errors for which the Department revised their financial statements:

• The Department understated accrued liabilities in the Health Insurance Reserve Fund by $11.849 million due to the exclusion of certain prescription drug benefit liabilities. This misstatement also resulted in an understatement of the amounts due to this fund from the General Revenue Fund and Road Fund.

• The Department understated accrued liabilities in the Local Government Health Insurance Reserve Fund, the Teacher Health Insurance Security Fund, and the Community College Health Insurance Security Fund by $247 thousand,

$2.032 million, and $199 thousand, respectively, due to the exclusion of certain prescription drug benefit liabilities.

• In the prior fiscal year, the Department understated their accrued liabilities and benefit payments in the Community College Health Insurance Security Fund due to a mathematical error when calculating the accrued liability. The Department restated its financial statements as of July 1, 2016, to correct for these errors.

• The Department overstated accounts receivable in the Health Insurance Reserve Fund by $12.423 million due to including a deposit in transit in accounts receivable and cash. It should not have been included in accounts receivable. This misstatement also resulted in an understatement of the amounts due to this fund from the General Revenue Fund and Road Fund.

• The Department overstated accounts receivable in the Local Government Health Insurance Reserve Fund, the Teacher Health Insurance Security Fund, and the Community College Health Insurance Security Fund by $296 thousand, $1.898 million, and $215 thousand, respectively, due to including a deposit in transit in accounts receivable and cash. It should not have been included in accounts receivable.

We recommended the Department implement procedures and cross-training measures throughout the Department to ensure required financial information is submitted to those responsible for financial reporting in a timely, accurate and complete manner. This should include allocating sufficient staff resources and the implementation of formal procedures to ensure adequate and reliable financial information is prepared and submitted to the Office of the State Comptroller. We also recommended these procedures address all elements of the Department’s financial reporting process including, but not limited to, accruals for liabilities and receivables, supervisory review of supporting spreadsheets for data accumulation, and the preparation of management estimates.

The Department agreed with the finding and stated they will strive to implement cross-training measures and financial reporting procedures to ensure the timeliness, accuracy, reliability and reasonableness of data utilized to perform financial reporting. Additionally, the Department stated they will continue to work diligently to fill key positions to ensure an independent, internal analytical review of calculations is documented and completed timely.

INADEQUATE INTERNAL CONTROLS OVER COMMODITIES

The Department of Public Health (Department) did not exercise adequate internal controls over its commodities inventories. The Department reported a commodities inventory balance of $5,574,641 at June 30, 2017.

During testing, we noted nine of 22 (41%) Department programs or divisions did not report the dollar amount of their commodities inventory in the June 30 balance.

Due to these conditions, the accountants were unable to conclude the Department’s population records were sufficiently precise and detailed under the Attestation Standards promulgated by the American Institute of Certified Public Accountants (AT-C § 205.35) to test the Department’s commodities inventories.

We recommended the Department implement procedures to maintain records of its complete commodities inventories to ensure accurate accounting records and reports.

Department officials concurred with the finding and stated the Department will implement procedures to strengthen internal controls over the reporting of commodities inventories. They further stated, in an effort to accurately report commodities inventories, all programs will be advised of the importance of ensuring that June 30 balances are reported.

FEDERAL AUDITING

STATEWIDE SINGLE AUDIT UPDATE

The purpose of the Statewide Single Audit is to fulfill the State mandate in accepting federal funding. It includes all State agencies that are part of the primary government and expend federal awards. In total, 44 Illinois State agencies expended federal financial assistance in FY 2017.

The Schedule of Expenditures of Federal Awards (SEFA) reflects total expenditures of approximately $27.5 billion for the year ended June 30, 2017. Overall, the State participated in 363 different federal programs; however, 10 of these programs or program clusters accounted for approximately 86.9% of the total federal award expenditures.

Overall, 11 State agencies accounted for approximately 98.8% of all federal dollars spent during FY17.

Our audit testing focused primarily on the 30 major programs expending about $25.850 billion in federal awards.

Our report contained 72 findings related to programs at 13 State agencies.

Federal Agencies Providing Federal Funding

For the year ended June 30, 2017

(Amounts in millions)

Health & Human Services: $12,325.8

Education: $5,984.0

Agriculture: $4,156.6

Labor: $2,197.1

Transportation: $2,181.7

All others: $660.4

Total Federal Award Expenditures: $27,505.6

Source: FY 2017 State of Illinois Single Audit Report

Summary of Federal Spending by State Agency

For the year ended June 30, 2017

(Amounts in millions)

Healthcare and Family services: $10,192.7

Human Services: $4,773.7

Student Assistance Commission: $4,318.4

Board of Education: $2,337.1

Transportation: $2,177.7

Employment Security: $2,050.4

Commerce & Economic Opportunity: $412.7

Children & Family Services: $391.5

Public Health: $256.3

Environmental Protection Agency: $166.8

Emergency Management Agency: $105.8

All Others: $322.9

Total Federal Spending: $27,505.6

Source: FY 2017 State of Illinois Supplemental Report of Federal Expenditures by Agency/Program Fund.

The Performance Audit Program

Performance audits are conducted at the request of legislators to assist them in their oversight function. Based on the scope specified in the resolution or the law requesting the audit, State agencies’ programs, functions, and activities are reviewed. The audits determine if the services are provided as intended by the General Assembly and directly impact and improve agency operations.

The General Assembly uses performance audit information to develop legislation, to deal with budgetary issues, and to direct agencies to improve programs. Some audits produce immediate changes. For example, our 2016 audit of the State Moneys Provided to the Criminal Justice Information Authority for Community Based Violence Prevention Programs identified several issues related to monitoring grants and recovering unspent grant funds. Legislation was passed in the Spring of 2018 which addressed some issues raised in our audit. Among several issues addressed, a provision was added requiring grantees to maintain grant funds in a separate account, which specifically addressed Recommendation Number 15 in our audit.

In other instances, significant changes may not be seen for several years. The length of time it takes to see changes is due to the process of transforming the audit findings and recommendations into legislative bills and converting bills into law; additionally, once a law is implemented, the effects may not be apparent for some time.

The National State Auditors Association (NSAA) established the Excellence in Accountability Awards Program in 2003 to recognize outstanding performance audits and special projects. Performance audits performed by the Office of the Auditor General (OAG) have received five NSAA awards in past years:

• 2014 Neighborhood Recovery Initiative audit (Honorable Mention);

• 2012 Management Audit of the Department of State Police’s Administration of the Firearm Owner’s Identification Act;

• 2007 Performance Audit of the Mass Transit Agencies of Northeastern Illinois: RTA, CTA, Metra, and Pace;

• 2004 Management and Program Audit of the Rend Lake Conservancy District; and

• 2003 Management Audit of the Illinois State Toll Highway Authority.

Another national organization, the National Legislative Program Evaluation Society (NLPES), also has an Impact Award which is given annually to audits that demonstrate significant dollar savings, program improvements, or impact from a legislative and public perspective. The OAG has received the NLPES award for many audits as well:

• 2016 Program Audit of the College of DuPage;

• 2014 Neighborhood Recovery Initiative audit;

• 2012 Management Audit of the College Illinois! Prepaid Tuition Program’s Administrative Operations;

• 2012 Management Audit of the Department of State Police’s Administration of the Firearm Owner’s Identification Act;

• 2011 Management Audit of the State’s Financial Reporting System;

• 2010 Program Audit of the Covering ALL KIDS Health Insurance Program;

• 2009 Management and Program Audit of the Illinois State Police’s Division of Forensic Services;

• 2008 Performance Audit of the Department of Healthcare and Family Services’ Prompt Payment Act Compliance and Medicaid Payment Process;

• 2007 Performance Audit of the Mass Transit Agencies of Northeastern Illinois;

• 2006 Management Audit of the Flu Vaccine Procurement and the I-SaveRx Program;

• 2004 Management and Program Audit of the Rend Lake Conservancy District;

• 2003 Management Audit of the Illinois State Toll Highway Authority;

• 2002 Management Audit of Agency Use of Internet User Tracking Technology;

• 2001 State Board of Education and Other State Agencies Providing Funding to Illinois’ Regional Offices of Education;

• 2000 Management Audit of Child Support State Disbursement Unit;

• 1999 Management Audit of the Pilsen Little Village Community Mental Health Center; and

• 1998 Management Audit of Tuition and Fee Waivers.

PERFORMANCE AUDITS COMPLETED IN 2018

The Auditor General released three performance audits and three reviews in 2018. The performance audits released are listed below. Performance audits released in 2018 included 42 recommendations for improvement.

In addition, the Performance Audit Division had the responsibility for 35 audits of Regional Offices of Education (ROEs) and 3 Intermediate Service Centers (ISCs) which covered Fiscal Year 2017. The FY17 ROE audits released in 2018 contained a total of 42 recommendations for improvement.

PERFORMANCE AUDIT OF MEDICAID MANAGED CARE ORGANIZATIONS

On May 31, 2017, House Resolution Number 100 was adopted which directed the Office of the Auditor General to conduct an audit of Medicaid Managed Care Organizations (MCOs). The Resolution included a comparison of State expenditures between MCOs and the Medicaid fee-for-service program for fiscal year 2016. The audit found the following:

• Auditors determined that the Department of Healthcare and Family Services (HFS) did not maintain the complete and accurate information needed to adequately monitor $7.11 billion in payments made to and by the 12 MCOs during FY16.

• Specifically, HFS could not provide auditors with the following information:

- all paid claims to Medicaid providers by the MCOs in FY16;

- Medicaid provider claims denied by MCOs in FY16;

- the administrative costs incurred by MCOs in FY16;

- the coordinated care costs incurred by MCOs in FY16; and

- Medical Loss Ratio calculations since calendar year 2012.

• In FY16, HFS made multiple monthly capitation payments to MCOs for the same months for the same individuals totaling $590,237.

The audit recommended HFS should:

• Monitor the actual administrative costs incurred by its MCOs to ensure that the administrative costs do not exceed what is allowed by contract;

• Calculate the Medical Loss Ratios for the previous four calendar years (2013 through 2016), and determine whether the State should be reimbursed by MCOs due to overpayment;

• Require all MCOs to submit all Medicaid provider payment data for all services, and perform on-site reviews of the MCOs’ financial data systems and test the completeness and accuracy of the data reported to HFS that is used to monitor the payments made to Medicaid providers;

• Provide clear guidance to the MCOs for reporting denied claims, and ensure that MCOs provide the denied claims to HFS as required by contract;

• Ensure multiple monthly capitation payments are not being made for the same Medicaid recipients, immediately identify and remove all duplicative recipients from its eligibility data, and recoup any overpayment of duplicate capitation payments; and

• Ensure that it effectively monitors the newly awarded MCO contracts to ensure compliance with all contractual provisions.

This audit report contained six recommendations to the Department of Healthcare and Family Services.

PERFORMANCE AUDIT OF THE STATE’S LEASING DECISION

On June 28, 2017, the Illinois General Assembly adopted House Joint Resolution Number 63 which directed the Auditor General to conduct a performance audit of the State’s decision to enter into a five-year $2.4 million lease for property at

2410 South Grand Ave. East, Springfield.

The decision to enter into the lease actually involved two different leases – one for a file storage warehouse and one for an IT (Information Technology) and Telecommunications Support Center. After the winning vendors were selected but prior to the final award, the Department of Central Management Services (CMS) switched the purposes of the leases and the using agencies.

CMS violated a provision of the Illinois Procurement Code by awarding leases to vendors who were not qualified respondents for the leases awarded. For example, the vendor awarded the warehouse lease was not a qualified respondent under the Procurement Code as it had submitted a response for the IT and Telecommunications Support Center and not the warehouse lease. This was no fault of the vendors as the decision to switch leases was made by CMS. In addition:

• Offers were evaluated and awards selected based on the requirements set forth in the solicitation document. These requirements were then changed.

• CMS and the Chief Procurement Office for General Services have characterized the switch of the leases as substituting using agencies. However, the switch was not a simple substituting of using agencies. Not only were the agencies changed, the purposes of the leases were changed, the structural layouts were changed, the tenant’s space requirements were changed, and the prices offered were changed.

• Other responders did not get the opportunity to change their bids to meet the new lease requirements violating the principle of fair and equal treatment.

• By not rebidding, CMS may have excluded potential bidders who were not afforded the opportunity to bid on the new space requirements.

• The State Purchasing Officer responsible for reviewing the leases could not provide adequate documentation of review.

Other key findings of the audit included the following:

• The information provided by CMS to the Procurement Policy Board for the Department of Human Services (DHS) warehouse lease was misleading and incomplete which hampered the Board’s ability to review the lease. A draft version of the information sent to the Board contained additional language explaining the switching of leases but it was removed in the final version sent to the Board.

• The amount of space requested in the DHS space request was insufficient to meet its file storage needs. DHS also could not provide documentation demonstrating any cost savings resulting from consolidating files.

• CMS did not conduct an analysis of the cost-benefit of purchasing instead of leasing the property at 2410 South Grand Ave. East.

• DHS has not conducted a comprehensive cost-benefit analysis of digitizing records.

This audit report contained ten recommendations: five recommendations directed to CMS; two recommendations directed to the Chief Procurement Office for General Services; one recommendation directed to both CMS and the Chief Procurement Office for General Services; one recommendation directed to DHS; and one recommendation directed to the Procurement Policy Board.

PERFORMANCE AUDIT OF THE DHS OVERSIGHT OF THE CILA PROGRAM

On March 15, 2017, the Illinois House of Representatives adopted House Resolution Number 34 which directed the Auditor General to conduct a performance audit of the oversight of the Community Integrated Living Arrangements

(CILA) program at the Department of Human Services (DHS).

As of May 2017, DHS licensed more than 3,000 CILA locations around the State with over one-third of all CILAs being located in Cook County. These CILAs served approximately 10,000 individuals.

• For the period FY12-FY16, DHS:

- expended over $2 billion on CILA services with the majority for clients with developmental disabilities;

- additionally expended nearly $6.1 million for a contractor to provide transition planning and support;

- expended more than $28 million on 17 Independent Service Coordinators whose primary role is to assist with finding individuals appropriate living arrangements; and

- transitioned 408 individuals to CILA from State-Operated Developmental Centers.

• We found weaknesses in DHS’ licensing process including failures to:

- publish accurate survey data;

- complete timely annual reviews;

- accurately account for notices of violation in its database;

- complete all surveys, require plans of correction, and approve all plans of correction; and

- exercise ability to revoke a CILA license.

• We found weaknesses in DHS oversight and monitoring of the CILA Program including failures to:

- conduct all CILA reviews by the Bureau of Quality Management;

- monitor CILA residents’ personal funds by DHS;

- maintain supporting documentation for community placement interest by individuals at State-Operated Developmental Centers;

- share findings from DHS bureaus/offices with licensing staff; and

- recover funds from CILA providers not providing services for which they were paid.

• There was a lack of documentation to support that all required transition visits were conducted for individuals that transitioned to CILA from State-Operated Developmental Centers.

• DHS utilized a vendor, on a decision from the Governor’s Office from the previous administration, to assist in closing State-Operated Developmental Centers. We found weaknesses in the oversight by DHS of the vendor including questionable procurement strategies and failure to maintain documentation to support required contractual deliverables. Additionally, DHS paid the vendor an additional $233,000 for services already required by the contract.

This audit report contained 26 recommendations directed to the Department of Human Services.

REGIONAL OFFICES OF EDUCATION AUDITS

In addition to other duties, the Auditor General has the responsibility for annual audits of the financial statements of the regional superintendent of schools of each educational service region in the State.

There were a total of 38 Fiscal Year 2017 audits conducted: 35 of Regional Offices of Education (ROEs) and 3 of Intermediate Service Centers (ISCs). Our Office arranged for auditing firms to perform these audits under the general direction and management of the Auditor General’s audit managers.

The FY17 ROE audits released in 2018 contained a total of 42 recommendations for improvement. Most of the recommendations dealt with the ROEs not having sufficient internal controls, including controls over their financial reporting processes.

Performance Audits in Progress

DEPARTMENT OF CHILDREN AND FAMILY SERVICES ABUSE AND NEGLECT INVESTIGATIONS

House Resolution Number 418 directs the Auditor General to conduct a performance audit on the Department of Children and Family Services to review and assess the Department’s protocols for investigating reports of child abuse and neglect. The audit is to include a review of abuse and neglect investigations conducted by the Department of Children and Family Services in Fiscal Year 2015, Fiscal Year 2016, and Fiscal Year 2017. The audit resolution contains the following determinations:

• The status of abuse and neglect investigations;

• The final determination or findings made by the Department for abuse and neglect investigations;

• The time frame within which the Department completed or closed abuse and neglect investigations;

• For sampled cases, recommendations made by the Department to families who were the subject of an abuse or neglect investigation, including any services provided by the Department to the child or family; and

• Demographic information on abuse and neglect investigations, including the age, race, and gender of children who were subjects of the abuse or neglect investigations, and, if available, the zip code and county where the abuse or neglect was alleged to have occurred.

The audit resolution also requires the Auditor General to compile a detailed report that includes a full summary of the number of lawsuits or other legal actions filed against the Department, and the number of lawsuits the Department settled, within the past three fiscal years that concern an abuse or neglect investigation.

MEDICAID LONG-TERM CARE ELIGIBILITY DETERMINATION AUDIT

On August 25, 2017, the Governor signed into law Public Act 100-380 which amended the Public Aid Code. This amendment to the Public Aid Code requires the Auditor General to report every three years to the General Assembly on the performance and compliance of the Department of Healthcare and Family Services, the Department of Human Services, and the Department on Aging in meeting the requirements placed upon them by Section 11-5.4 of the Public Aid Code and federal requirements concerning eligibility determinations for Medicaid long-term care services and supports.

The audit is to, at a minimum, review, consider, and evaluate the following:

• Compliance with federal regulations on furnishing services as related to Medicaid long-term care services and supports as provided under 42 CFR 435.930 (i.e., furnish Medicaid promptly to beneficiaries without any delay caused by the agency’s administrative procedures);

• Compliance with federal regulations on the timely determination of eligibility as provided under 42 CFR 435.912 (i.e., the determination of eligibility for any applicant may not exceed: (i) Ninety days for applicants who apply for Medicaid on the basis of disability; and (ii) Forty-five days for all other applicants);

• The accuracy and completeness of the report required under paragraph (9) of subsection (e) (i.e., monthly reports posted to the Department of Human Services and the Department of Healthcare and Family Services websites on the applications and redeterminations pending long-term care eligibility determination and admission and the number of appeals of denials in given categories);

• The efficacy and efficiency of the task-based process used for making eligibility determinations in the centralized offices of the Department of Human Services for long-term care services, including the role of the State’s integrated eligibility system, as opposed to the traditional caseworker-specific process from which these central offices have converted; and

• Any issues affecting eligibility determinations related to the Department of Human Services’ staff completing Medicaid eligibility determinations instead of the designated single-state Medicaid agency in Illinois, the Department of Healthcare and Family Services.

AUDIT OF THE MORNEAU SHEPELL CONTRACT

House Resolution Number 522 directs the Auditor General to conduct a performance audit of the procurement and administration of the contract with Morneau Shepell. The audit is to include the following determinations:

• Whether the scope of the Request for Proposals (RFP) that was issued in November 2015 was adequate to meet the State’s needs and written in a manner to allow adequate competition on this multi-million dollar initiative;

• Whether the time frame for response to the RFP was adequate to allow for participation by potential vendors;

• The rationale for not including a business enterprise goal in the solicitation;

• The rationale for awarding the contract to Morneau Shepell rather than re-issuing the RFP in an attempt to obtain adequate competition;

• The cost of the procurement, including amounts paid to the State’s procurement consultant;

• Whether the Department of Central Management Services has reviewed the vendor’s compliance with the Performance Standard Guarantees and, in particular, the standards applicable to the accuracy of participant transactions; and

• Whether there have been any reductions in the vendor’s administrative fee as a result of any failure to meet performance guarantees.

QUINCY VETERANS’ HOME

Senate Resolution Number 1186 directs the Auditor General to conduct a performance audit of the Illinois Department of Veterans’ Affairs’ management of Legionnaires’ disease outbreaks at the Quincy Veterans’ Home. The audit is to include the following determinations:

• The responses of the Department of Veterans’ Affairs to the outbreaks of Legionnaires’ disease in 2015, 2016, and 2017, including the recommendations made in the 2015 study by the Centers for Disease Control and the Department’s actions to address those recommendations;

• The type, cost, and timing of any infrastructure or other building improvements intended to contain the further spread of Legionnaires’ disease or prevent its reoccurrence;

• The nature of changes made by the Department in operating protocols and staff training thereon, intended to contain the further spread of Legionnaires’ disease or prevent its reoccurrence;

• The nature and extent of monitoring conducted by the Department to determine whether the improvements and protocols put in place are effective to ensure the safety of residents and staff at the Quincy Veterans’ Home;

• The amount of State moneys received and the amount of State moneys expended by the Department or any other State agency during State fiscal years 2015, 2016, 2017, and 2018 for infrastructure improvement, monitoring, and other measures taken to address the Legionnaires’ disease outbreaks; and

• To the extent information is available, whether the Quincy Veterans’ Home has been the subject of any reviews since 2015 to determine its compliance with applicable laws and regulations with regard to the care of its residents and, if so, the results of those reviews.

CMS MULTIPLE CHOICE EXAMS

House Resolution Number 816 directs the Auditor General to conduct a performance audit of the Department of Central Management Services to review and assess the Department’s automated multiple choice exams.

The audit is to include a review of whether those automated multiple choice exams are biased against minority exam takers, either in their content or in their results.

FORD HEIGHTS PUBLIC LIBRARY DISTRICT

House Resolution Number 843 directs the Auditor General to conduct a performance audit of the Ford Heights Library District. The audit is to include the following determinations:

• Whether the administrative expenses at the Ford Heights Public Library District are justified based on the services provided to the residents of Ford Heights;

• Whether the Ford Heights Public Library District maintains documentation supporting its administrative expenses;

• Whether there has been any use of public library district funds that is not supported by adequate and reasonable documentation; and

• What services are provided by the Ford Heights Public Library District and whether service can be improved.

COVERING ALL KIDS HEALTH INSURANCE PROGRAM (Fiscal Year 2017)

Public Act 95-985 amended the Covering ALL KIDS Health Insurance Act [215 ILCS 170/63] and directed the Auditor General to annually audit the ALL KIDS program. This will be the ninth annual audit and will cover FY17. The focus of this audit will be on “EXPANDED ALL KIDS,” which is the portion of the ALL KIDS program that serves uninsured children not previously covered by KidCare (children whose family income was greater than 200% of the federal poverty level or who were undocumented immigrants).

This FY17 audit will follow up on the Department of Healthcare and Family Services’ and the Department of Human Services’ actions to address prior audit findings. There were five audit recommendations made in the FY16 audit report. The FY17 audit report will follow-up on all five recommendations – including the recommendation on the policies covering orthodontic treatment, which could not be followed-up on in FY15 or FY16.

REGIONAL OFFICES OF EDUCATION

Since 2002, the School Code (105 ILCS 5/2-3.17a) has required the Auditor General’s Office to conduct annual audits of the financial statements of all accounts, funds, and other moneys in the care, custody, or control of the regional superintendent of schools of each educational service region in the State. For Fiscal Year 2018, a total of 38 audits are to be performed.

The Information Systems Audit Program

Computers are an integral part of State government, processing billions of dollars in financial transactions each year and helping control the operations of State agencies. Since financial transactions and confidential information are processed using computers, audits of information system activities are necessary to ensure that computer processing is secure and accurate.

TESTING CONTROLS AND SYSTEMS

The Auditor General’s Office plans to continue to emphasize the review of information system controls at State agencies. In 2018, we reviewed the following agencies:

Chicago State University, Department of Agriculture, Department of Central Management Services, Department of Employment Security, Department of Healthcare and Family Services, Department of Human Services, Department of Innovation & Technology, Department of Revenue, Illinois Commerce Commission, Illinois Emergency Management Agency, Illinois Power Agency, Illinois State Toll Highway Authority, Illinois Supreme Court, Northeastern Illinois University, Northern Illinois University, Office of the Comptroller, Southern Illinois University, Teachers’ Retirement System, and University of Illinois.

To enhance the control environment, the Auditor General has emphasized the review of networks and the security and control of confidential information. These reviews have focused on the necessity of establishing consistent and effective security policies and programs, performing comprehensive risk assessments, and implementing comprehensive security techniques on all computer systems.

ISA FINDINGS

Six agencies – Department of Agriculture, Department of Employment Security, Department of Human Services, Illinois Emergency Management Agency, Northeastern Illinois University, and Northern Illinois University – had not adequately developed or tested recovery plans to provide for continuation of critical computer operations in the event of a disaster. We recommended that these agencies develop and test disaster contingency plans.

Four agencies – Department of Agriculture, Department of Public Health, Northeastern Illinois University, and Office of the Secretary of State – had not completed all requirements to demonstrate full compliance with the Payment Card Industry Data Security Standards. We recommended that these agencies at least annually, assess each program accepting credit card payments, review and validate its environment, and ensure agreements with service providers are current and maintained.

Five agencies – Chicago State University, Governors State University, Human Rights Commission, Illinois Emergency Management Agency, and Northeastern Illinois University – had not established adequate controls for securing their computer resources. We recommended that these agencies evaluate their computer environments and ensure adequate security controls and policies exist to safeguard computer resources.

The Department of Human Services had not ensured the adequate security and/or disposal of confidential information and transmitted unsecured confidential information over the Internet. Confidential and personally identifiable information collected and maintained by agencies should be adequately secured at all times. As such, it is an agency’s responsibility to ensure adequate procedures for safeguarding all confidential information have been established, effectively communicated to all personnel, and continually enforced. We recommended the Department assess their procedures for safeguarding, retaining, transmitting, and disposing confidential information and ensure such information is adequately protected.

Two agencies – Department of Healthcare and Family Services and Department of Human Services – failed to implement adequate controls over the State of Illinois’ Integrated Eligibility System (IES). We recommended that these agencies implement suitable security controls over the computing environment supporting IES.

Three agencies – Department of Healthcare and Family Services, Department of Human Services, and Office of the State Treasurer – did not perform and document internal control reviews of all external data processing related service providers. We recommended that these agencies obtain or perform independent reviews of internal controls associated with service providers at least annually.

Nine agencies – Department of Agriculture, Department of Healthcare and Family Services, Department of Human Services, Department of Public Health, Department of Revenue, General Assembly Retirement System, Illinois Emergency Management Agency, Judges Retirement System, and State Employees’ Retirement System – had not implemented an effective change management process to ensure changes to computer applications were properly approved, tested, and documented. We recommended that these agencies develop and implement change management standards to ensure adequate oversight of all changes to computer applications.

The Illinois Historic Preservation Agency failed to implement the provisions of the Identity Protection Act. We recommended the Agency finalize and implement an identity protection policy as required by the Act.

The information systems audit staff also reviewed and tested the systems and procedures at the State’s central computer facility operated by the Department of Innovation & Technology. The Department provides IT services, general controls, and application controls for approximately 103 user agencies.

We released a Service Organization Control (SOC) Report regarding the Department’s control environment.

The SOC Report contained an adverse opinion as a result of:

• The Department’s Description of System contained inaccuracies and omissions.

• The controls stated in its Description of System were not suitably designed to provide reasonable assurance that the control objectives would be achieved.

• The controls stated in its Description of System were not operating effectively.

As a result of this adverse opinion, auditors of these agencies will likely modify the agency-level risk assessments to accommodate the additional risk to agencies and perform additional procedures to properly address these risks.

Agency officials generally concurred with our recommendations concerning these issues.

The Information Systems Audit Division also maintains the computer system environment for the office.

OAG FRAUD HOTLINE

The Auditor General’s Office is required by law [30 ILCS 5/2-15, added by P.A. 97-261, effective August 5, 2011] to operate a toll-free fraud hotline for the public to report allegations of fraud in the executive branch of State government. The hotline went into operation at the beginning of January 2012.

The toll free number is 1-855-217-1895. The hotline is available 24 hours a day, 7 days a week. Live operators are generally available Monday-Friday from 8:00 a.m. to 4:00 p.m. (CST).

In addition to calling the toll-free number, other options have been established for the public to report allegations of fraud. The public may also:

• Complete the Fraud Reporting Form on-line located on the OAG web-site

(www.auditor.Illinois.gov);

• E-mail a description of the allegation to: OAG.Hotline@Illinois.gov;

• Contact the Auditor General via telecommunications device for the disabled (TTY) at 1-888-261-2887; or

• Send a written report via the U.S. Postal Service to the following address:

Fraud Hotline, Auditor General’s Office,

740 E. Ash St., Springfield, IL 62703.

Individuals reporting alleged fraud to the hotline may remain anonymous. However, if the individual chooses not to be identified, the Office’s ability to follow up on the allegation may be limited.

More information regarding the reporting of fraud allegations can be found at the Fraud Hotline section of the OAG website. Jurisdiction of the Fraud Hotline does not include the legislative or judicial branches of government, nor units of local government. Other resources the public may use to report fraud if it is outside of the jurisdiction of the OAG can also be found on the website. Even if the Auditor General’s Office does not have jurisdiction over the allegation, our hotline manager will try to direct the caller to another State, federal, or local agency that may be able to help.

Other Office Responsibilities

ANNUAL AUDIT ADVISORY

Every year, the Auditor General’s Office distributes an Illinois Audit Advisory to all State agencies for the purpose of sharing information that may make their operations more efficient and effective, and increase compliance with State law. Copies of this audit advisory are available on our website at: www.auditor.illinois.gov.

Comptroller’s Accounting System Review

The Auditor General is required by law to annually review the Comptroller’s Statewide accounting system. This review is accomplished through the Office’s audit of the State Comptroller, and by ensuring that all agency audits are performed in accordance with the Auditor General’s Audit Guide.

In addition, the Auditor General annually reviews the State Comptroller’s pre-audit function. Pre-audit is the primary control over expenditure voucher processing. The State Comptroller pre-audits financial transactions to determine if they are proper and legal.

Peer Review

Peer review is an external quality control review conducted every three years by audit professionals from across the United States who are selected by the National State Auditors Association. The peer review helps to ensure that our procedures meet all required professional standards, comply with Government Auditing Standards, and produce reliable products for the agencies we audit.

The September 2017 peer review of the Auditor General’s audit processes resulted in an unmodified (clean) opinion. Additionally, the peer review team did not note any deviations from professional standards that would have required a written letter of comments. Our prior peer reviews, conducted from 1996 through 2014, likewise resulted in unmodified opinions. Our next peer review is slated for 2020.

State Actuary

Public Act 97-694, effective June 18, 2012, directed the Auditor General to “contract with or hire an actuary to serve as the State Actuary.” Among its duties, the State Actuary is required to “review assumptions and valuations prepared by actuaries retained by the boards of trustees of the State-funded retirement systems” and “issue preliminary reports... concerning proposed certifications of required State contributions submitted to the State Actuary by those boards.” [30 ILCS 5/2-8.1 (a) and (b)] In addition, Public Act 100-465, effective August 31, 2017, added a similar requirement for the State Actuary to review the Public School Teachers’ Pension and Retirement Fund of Chicago. [40 ILCS 5/17-127(e)]

Through a competitive proposal process, the Auditor General awarded a contract in August 2012 to Cheiron, a full-service actuarial and consulting firm. Cheiron issued its preliminary reports to the public retirement systems in December 2018. As required by statute, the Auditor General submitted a written report to the General Assembly and Governor on December 27, 2018, documenting the initial assumptions and valuations prepared by the actuaries retained by the boards of trustees of the State-funded retirement systems, the State Actuary’s preliminary reports, and the responses of each board to the State Actuary’s recommendations. The report is available in its entirety on our website at www.auditor.illinois.gov.

Continuing Professional Education and Training Requirements

The U.S. Government Accountability Office established Government Auditing Standards (the Yellow Book) for performing high-quality audit work with competence, integrity, objectivity, and independence to provide accountability and to help improve government operations and services.

The Yellow Book standard relating to competence specifies that management must assign auditors to conduct the engagement who collectively possess the competence needed to address the engagement objectives and perform their work in accordance with Generally Accepted Government Auditing Standards (GAGAS).

Auditors who plan, direct, perform engagement procedures for, or report on an engagement

conducted in accordance with GAGAS should develop and maintain their professional competence by completing at least 80 hours of continuing professional education (CPE) every 2 years. A minimum 24 hours of that CPE should be directly related to the government environment, government auditing, or the specific or unique environment in which the audited entity operates. The remaining 56 CPE hours should be in subject matter that directly enhances auditors’ professional expertise to conduct engagements. Auditors should complete at least 20 hours of CPE in each year of the 2-year period.

Auditors hired or assigned to a GAGAS engagement after the beginning of the 2-year CPE period may complete a prorated number of CPE hours. Also, auditors who charge less than 20 percent of their time annually to engagements conducted in accordance with GAGAS but are not involved in planning, directing, or reporting on the engagement need only comply with the 24-hour requirement.

The most recently completed 2-year period for CPE requirements as measured by the Office of the Auditor General was January 1, 2017, through December 31, 2018. All auditors, audit directors, and information specialists required to meet the CPE standards were in compliance for this 2-year period.

Additionally, the Office of the Auditor General is a registered sponsor with the Illinois Department of Financial and Professional Regulation, and complies with the rules of the Illinois Public Accounting Act.

CLAIMS DUE THE STATE AND METHODS OF COLLECTION

As required by law [30 ILCS 205/2 (k)], the Office of the Auditor General is reporting that there were no outstanding claims administered by the Office that were due and payable to the State as of December 31, 2017. The accounts receivables generated by our Office primarily represent billings to other State agencies for reimbursement of audit costs. Reimbursements for federal single audits are deposited into the General Revenue Fund. Reimbursements for audits not associated with federal single audits are deposited or transferred to the Audit Expense Fund. If normal collection methods fail, we request assistance from the Office of the Attorney General. To date we have never used the services of a private collection agency.

SUMMARY OF APPROPRIATIONS AND EXPENDITURES

The Office of the Auditor General was funded by appropriations from the General Revenue Fund and Audit Expense Fund for Fiscal Year 2018 (July 1, 2017 to August 31, 2018, including lapse period).

FY 2018 - FINAL

(Appropriation; Expended; Balance)

GRF Operations:

Personal Services: $5,677,350; $5,677,048; $302

Social Security: $416,000; $413,357; $2,643

Contractual Services; $605,000; $601,793; $3,207

Commodities: $1,250; $1,170; $80

Paper and Printing: $4,400; $4,355; $45

Equipment: $6,250; $5,949; $301

EDP: $41,000; $40,559; $441

Telecommunications: $53,250 ; $52,855; $395

Oper. of Auto. Eqpt: $2,500; $1,850; $650

GRF Operations Total: $6,807,000; $6,798,936; $8,064

Audit Expense Fund:

Audits/Studies/Invest.: $25,398,600; $22,943,281; $2,455,319

Financial Audits and Compliance Examinations

FOR THE PERIOD(S) ENDING JUNE 30, 2017, SEPTEMBER 30, 2017, and December 31, 2017.

(Released on or before December 31, 2018)

F = Financial Audits, C= Compliance Attestation Examinations, S = Single Audits

AGENCY........................................................................................................ F............. C......... S................ Date Released

Architect of the Capitol........................................................................................ X.......................... 05-30-18

Arts Council......................................................................................................... X.......................... 06-28-18

Arts Council Foundation........................................................................ X........... X.......................... 05-03-18

Attorney Registration and Disciplinary Commission (12/31/17)............ X........... X.......................... 05-30-18

Board of Admissions to the Bar (9/30/17)............................................. X........... X.......................... 05-03-18

Board of Examiners.............................................................................................. X.......................... 11-01-18

Board of Higher Education................................................................................... X.......................... 07-10-18

Capital Development Board................................................................... X......................................... 12-21-17

Chicago State University........................................................................ X........... X........ X.............. 03-15-18

Civil Service Commission..................................................................................... X.......................... 07-25-18

Commission on Government Forecasting and Accountability............................... X.......................... 04-19-18

Comptroller - Fiscal Officer Responsibilities......................................... X........... X.......................... 12-21-17

Court of Claims.................................................................................................... X.......................... 12-12-18

Criminal Justice Information Authority.............................................................................................. *

DCMS - Deferred Compensation Plan (12/31/17)................................. X......................................... 06-28-18

Deaf and Hard of Hearing Commission................................................................ X.......................... 08-15-18

Department of Agriculture.................................................................................... X.......................... 03-27-18

Department of Central Management Services........................................ X......................................... 02-22-18

Department of Central Management Services....................................................... X.......................... 03-27-18