Volume 21, 2015 Annual

AUDIT ADVISORY

Emerging and Potential Audit Issues

William G. Holland, Auditor General

Auditor General’s Message

On December 31, 2015, I will retire as Auditor General.

My twenty-three year tenure in this position spans the terms of five different governors, six comptrollers, and five treasurers. During this timeframe, audits issued by our Office have received sixteen awards from the National Legislative Program Evaluation Society and five awards from the National State Auditors Association. We have undergone eight triennial peer reviews – each of which resulted in a clean (unmodified) opinion. We have implemented four revisions to Government Auditing Standards promulgated by the U.S. Government Accountability Office, and there have been 60 new GASB pronouncements and numerous expanded, amended and clarified Statements on Auditing Standards and Statements on Standards for Attestation Engagements. We adopted a Statewide Single Audit approach and followed applicable changes made in OMB Circulars and the Federal Compliance Supplement. We have also carried out several new and significant duties, including creation of the State Actuary, the issuance of Taxpayer Accountability Reports, and the start up of a Fraud Hotline. Together we survived Y2K, the 2002 early retirement incentive that resulted in the loss of many seasoned fiscal professionals, and the centralization (and subsequent decentralization) of agency internal auditors. And I personally spent several hours testifying about our audit findings at the impeachment and subsequent trial of a sitting Illinois Governor.

Much has changed in twenty-three years.

But what has not changed is my admiration for the many people in State government who have the heart of a public servant and who work hard every day to provide necessary services like public education, child protection, highway construction, nursing home inspections, economic development, housing, food and medical care to Illinois citizens from every economic level and geographic area.

I want to thank all State government workers, but especially current and former employees of the Auditor General’s Office without whom none of the Office’s accomplishments would have been possible.

Yours truly,

WILLIAM G. HOLLAND

September 2015

TIMELINESS OF THE STATE’S FINANCIAL REPORTING IMPROVES

As the use of electronic media to transmit and store Personally Identifiable Information (PII) continues to increase, so does the need to effectively safeguard this information. Almost on a daily basis there are news reports of breaches of private or public databases. Release of confidential personal information not only creates hardship on the individuals whose private information has been compromised, it also creates significant obligations on the private or public entity which was responsible for safeguarding the information.

Requirements to protect personal information are outlined in laws, such as the Personal Information Protection Act (815 ILCS 530), Identity Protection Act (5 ILCS 179), and the federal Health Insurance Portability and Accountability Act (HIPAA).

The Auditor General’s Office has identified weaknesses in the implementation of controls to protect confidential information at State agencies. Examples of poor practices include:

• Sending confidential PII, such as Social Security Numbers or Protected Health Information, over the Internet in clear, unencrypted text. Agencies need to be aware that even the use of secure web delivery is limited as it generally only encrypts the transmission and not the email or attachments. Additionally, the email and attachments would not be protected (encrypted) in the sender’s out-box, recipient’s in-box, or archived copies. The Department of Central Management Services offers agencies a strong encryption resource to protect emails or attachments. (Information on encryption can be found at http://www.illinois.gov/bccs/services/catalog/security/PKI/Pages/default.aspx)
  
  
• Transporting confidential information on laptops or storage devices without utilizing encryption. Simply having a password on the laptop or file does not adequately protect this information.
  
  
• Improperly storing or disposing of documents containing confidential information. Documents containing PII need to be properly safeguarded and access to those documents controlled. When no longer needed, these documents need to be properly disposed (e.g., shredded in a secure manner).

PROTECTING PERSONAL INFORMATION

On December 26, 2013, “OMB Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards” was published in the Federal Register.  The federal Office of Management and Budget notes that this guidance, referred to as the “Super Circular”, streamlines the language from eight existing OMB circulars into one consolidated set of guidance in the Code of Federal Regulations.

By combining eight previously separate sets of OMB guidance into one, the OMB has attempted to eliminate numerous overlapping duplicative and conflicting provisions of guidance that were written separately over the years.  The Federal Register noted that the reform of OMB guidance will improve the integrity of the financial management and operation of federal programs and strengthen accountability for federal dollars by improving policies that protect against waste, fraud, and abuse.  At the same time, the Register notes the reforms will increase the impact and accessibility of programs by minimizing time spent complying with unnecessarily burdensome administrative requirements, and so re-orients recipients toward achieving program objectives. 

The Circular also makes significant changes to Single Audit requirements.  For example, the Single Audit threshold will be raised from $500,000 to $750,000.  The questioned cost threshold will be raised from $10,000 to $25,000 and the questioned cost section requires a description of how the questioned costs were calculated.  The audit provisions are effective for fiscal years beginning on or after December 26, 2014.

Please see the PDF version of this Audit Advisory for an auditing terms crossword puzzle.

###

Contact Information:

Office of the Auditor General

Iles Park Plaza, 740 East Ash Street

Springfield, Illinois 62703-3154

Michael A. Bilandic Building,

160 N. LaSalle Street, Suite S-900

Chicago, Illinois 60601-3109

Phone: 217-782-6046

Fax: 217-785-8222

TTY: 1-888-261-2887

Fraud Hotline: 1-855-217-1895

E-mail:  oag.auditor@illinois.gov

Website:  www.auditor.illinois.gov