REPORT DIGEST DEPARTMENT OF CENTRAL MANAGEMENT SERVICES, COMMUNITY COLLEGE HEALTH INSURANCE SECURITY FUND FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2022 Release Date: April 6, 2023 FINDINGS THIS AUDIT: 2 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 1 -- 1 -- 2 Category 3: 0 -- 0 -- 0 TOTAL: 1 -- 1 -- 2 FINDINGS LAST AUDIT: 1 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov This digest covers the Department of Central Management Services (Department), Community College Health Insurance Security Fund financial audit as of and for the year ended June 30, 2022. SYNOPSIS • (22-1) The Department failed to determine premiums that will allow for the establishment of an actuarially sound reserve for the Community College Health Insurance Program. • (22-2) The Department did not have sufficient controls over their change management procedures. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS FAILURE TO DETERMINE PREMIUMS THAT ALLOW FOR ESTABLISHMENT OF ACTUARIAL SOUND RESERVE The Department of Central Management Services (Department) failed to determine premiums that will allow for the establishment of an actuarially sound reserve for the Community College Health Insurance Program (Program). In the Fiscal Year 2018 and 2019 compliance examination, we first reported the Department had failed to determine premiums that would allow for the establishment of an actuarially sound reserve. During Fiscal Year 2022 testing, we continued to identify exceptions, as noted below: • The State Employees Group Insurance Act of 1971 (Act) (5 ILCS 375/6.9(e) (2)) states the balance of the rate of insurance, including the entire premium for any coverage for community college dependent beneficiaries that has been elected, shall be paid by deductions authorized by the community college benefit recipient. During testing, we noted the Fund covered 1.932% of the total insurance rate for benefit recipients. The projected total additional cost to the Fund was $42,066. • The Act (5 ILCS 375/6.9(e)) requires the Department to determine premiums that will allow for the establishment of an actuarially sound reserve for the Program. As of June 30, 2022, the Program had a fund deficit of $123.594 million. Additionally, the Program experienced a loss of $19.458 million during Fiscal Year 2022. The Program does not have an actuarially sound reserve. (Finding 1, pages 24-25) We recommended the Department ensure premium rates meet the requirements established by the Act. Additionally, we recommended the Department either comply with the law by working with the Governor’s Office of Management and Budget to obtain the necessary appropriation to supplement the Program or seek legislative relief from the statutory requirement. The Department agreed with the finding and stated it will seek legislative relief as an expected bill is in the process of being introduced. INADEQUATE CONTROLS OVER CHANGE MANAGEMENT The Department did not have sufficient controls over their change management procedures. Change control is the systematic approach to managing changes to an IT environment, applications, or data. The purpose is to prevent unnecessary and/or unauthorized changes, ensure all changes are documented, and minimize any disruptions due to system changes. The Department was unable to provide a complete and accurate population of changes for applications maintained by the Department; therefore, we were unable to perform any testing of the internal controls over changes to the applications and data. (Finding 2, pages 26-27) We recommended the Department implement controls in order to track the changes made to their applications and data. The Department agreed with the finding and stated it will work with the Department of Innovation and Technology (DoIT) to obtain the information needed to implement the controls necessary for tracking changes made to its applications. AUDITOR’S OPINION The auditors stated the financial statements of the Department of Central Management Services, Community College Health Insurance Security Fund as of and for the year ended June 30, 2022, are fairly stated in all material respects. This financial audit was conducted by Sikich LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:meg