REPORT DIGEST DEPARTMENT OF CENTRAL MANAGEMENT SERVICES COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2017 Release Date: March 27, 2018 FINDINGS THIS AUDIT: 9 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 1 -- 1 Category 2: 4 -- 4 -- 8 Category 3: 0 -- 0 -- 0 TOTAL: 4 -- 5 -- 9 FINDINGS LAST AUDIT: 9 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (17-1) The Department’s year-end financial reporting to the Office of the State Comptroller contained errors in the determination of certain year-end account balances. • (17-2) The Department did not demonstrate adequate control over property and equipment during the engagement period. • (17-3) The Department continued to have inadequate controls over the surplus electronic equipment inventory. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS WEAKNESSES IN INTERNAL CONTROL OVER FINANCIAL REPORTING The Department’s year-end financial reporting in accordance with generally accepted accounting principles (GAAP) to the Illinois Office of the State Comptroller contained errors in the determination of certain year- end account balances. During the audit of the June 30, 2017 financial statements we noted the following errors for which the Department revised their financial statements: • The Department understated accrued liabilities in the Health Insurance Reserve Fund by $11.849 million due to the exclusion of certain prescription drug benefit liabilities. This misstatement also resulted in an understatement of the amounts due to this fund from the General Revenue Fund and Road Fund. • The Department understated accrued liabilities in the Local Government Health Insurance Reserve Fund, the Teacher Health Insurance Security Fund, and the Community College Health Insurance Security Fund by $247 thousand, $2.032 million, and $199 thousand, respectively, due to the exclusion of certain prescription drug benefit liabilities. • In the prior fiscal year, the Department understated their accrued liabilities and benefit payments in the Community College Health Insurance Security Fund due to a mathematical error when calculating the accrued liability. The Department restated its financial statements as of July 1, 2016 to correct for these errors. • The Department overstated accounts receivable in the Health Insurance Reserve Fund by $12.423 million due to including a deposit in transit in accounts receivable and cash. It should not have been included in accounts receivable. This misstatement also resulted in an understatement of the amounts due to this fund from the General Revenue Fund and Road Fund. • The Department overstated accounts receivable in the Local Government Health Insurance Reserve Fund, the Teacher Health Insurance Security Fund, and the Community College Health Insurance Security Fund by $296 thousand, $1.898 million, and $215 thousand, respectively, due to including a deposit in transit in accounts receivable and cash. It should not have been included in accounts receivable. (Finding 1, pages 13-15) This finding has been repeated since 2015. We recommended the Department implement procedures and cross-training measures throughout the Department to ensure required financial information is submitted to those responsible for financial reporting in a timely, accurate and complete manner. This should include allocating sufficient staff resources and the implementation of formal procedures to ensure adequate and reliable financial information is prepared and submitted to the Office of the State Comptroller. We also recommended these procedures address all elements of the Department’s financial reporting process including, but not limited to, accruals for liabilities and receivables, supervisory review of supporting spreadsheets for data accumulation, and the preparation of management estimates. The Department agreed with the finding and stated they will strive to implement cross- training measures and financial reporting procedures to ensure the timeliness, accuracy, reliability and reasonableness of data utilized to perform financial reporting. Additionally, the Department stated they will continue to work diligently to fill key positions to ensure an independent, internal analytical review of calculations is documented and completed timely. (For the previous Department response, see Digest Footnote #1) INADEQUATE CONTROLS OVER PROPERTY AND EQUIPMENT The Department did not demonstrate adequate control over property and equipment during the engagement period. A few of the items we noted follows: • Thirty-five of 40 additions totaling $184,470 were entered into the Department’s property records between 20 and 504 days late. • Seventeen of 40 additions totaling $41,205 did not include the shipping costs in the cost of the asset. • For 35 of 60 deletions or transfers tested, totaling $150,748, the CMS Surplus Property Delivery Form was not properly completed. • Three unencrypted laptops were reported on the Department’s Lost or Stolen property listing; however, the Department could not determine whether they contained confidential information. (Finding 2, pages 16-20) This finding has been repeated since 2002. We recommended the Department implement controls and procedures to ensure its additions are entered timely and accurately, documentation exists to support location changes, transfers and deletions are properly recorded, the Certification of Inventory is timely and accurately prepared, and the other activities related to the Department’s property comply with State statute and the Illinois Administrative Code. The Department agreed with the recommendation. (For the previous Department response, see Digest Footnote #2) INADEQUATE CONTROLS OVER ELECTRONIC SURPLUS PROPERTY The Department continued to have inadequate controls over the surplus of electronic equipment inventory. During our review of surplus electronic inventory, we noted: • The Department did not wipe hard drives of electronic equipment; rather the Department relied upon the recycling vendor to complete this task. However, the required wiping certification provided by the recycling vendor did not comply with the provisions of the Data Security on Computers Act. • The Department did not offer to State agencies or to municipalities and units of local government surplus equipment, rather the equipment was shipped to a recycling vendor. • The Department did not provide certification of receipt of equipment within the 30 day timeline. As a result, the Department and other agencies were not able to adjust property records within the timeline. (Finding 3, pages 21-22) This finding has been repeated since 2013. We recommended the Department ensure all electronic equipment is wiped as required by the Data Security on State Computers Act. We also recommended the Department ensure they comply with their Property Control Rules. The Department agreed with the finding and stated they are working with the recycling vendor to ensure the wiping certification they provide complies with the provisions of the Data Security on Computers Act. The Department further stated they will continue to work toward presentation to JCAR of revised Property Control rules with regard to ensuring property transferred to State agencies, municipalities, and local governments has a positive cost benefit to the State of Illinois; and extending the 30 day timeline currently required by the rule. (For the previous Department response, see Digest Footnote #3) OTHER FINDINGS The remaining findings pertain to interagency agreements monitoring; performance appraisals; noncompliance with the State Employment Records Act; untimely processing of refunds; noncompliance related to public liability claims; and noncompliance with the Business Enterprise for Minorities, Women, and Persons with Disabilities Act. We will review progress toward implementing all recommendations in the next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Department of Central Management Services for the two years ended June 30, 2017, as required by the Illinois State Auditing Act. The auditors qualified their report on State Compliance for finding 2017-001. Except for the noncompliance described in this finding, the auditors state the Department complied, in all material respects, with the requirements described in the report. This financial audit was conducted by Sikich, LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:skm DIGEST FOOTNOTES #1 – Weaknesses in internal control over financial reporting 2016: The Department agrees with the finding and recommendation. The Department experienced major transitions during the financial reporting time period including changes in personnel, the shared services de- consolidation, and the creation of the Illinois Department of Innovation and Technology as its own agency. Additionally, the Department continues to work through issues created by the budget impasse. The Department will continue to work toward more comprehensive cross-training among staff and will continue to work to improve communications from Bureau staff to Financial Reporting staff. Lastly, the Department will continue to update its financial reporting procedures to help ensure accurate and reliable financial information is prepared and submitted to the Office of the Comptroller. #2 – Inadequate controls over property and equipment 2015: The Department concurs. We will continue to implement and improve on controls and procedures to ensure property and equipment additions, deletions, and transfers are properly and timely recorded. This will include: training, as needed, on required documentation for property transactions; returning incomplete or incorrect documents to their originator for correction; and more accurately reviewing information entered into CIS to minimize errors. Additionally, we are now dually date stamping transaction documents, upon receipt and when processed, to help identify and correct delays. We will continue to work with each bureau, travel to each location, and meet with all assigned property control liaisons to ensure correct understanding of procedures, duties, and responsibilities, and that documents are submitted correctly and timely. Department bureaus are working together to alter the parameters in CIS for report generation so that the proper information regarding assets is exported for the Agency Report of State Property. Additionally, the Department will complete the update of property control procedures and share the procedures with all bureaus and liaisons. The procedures will also be made available on the CMS Intranet to communicate to all employees their responsibilities with regards to inventory control. #3 - Inadequate controls over electronic surplus property 2015: The Department concurs. However, CMS is responsible for electronic equipment for consolidated agencies. • We will review and update the CMS State Surplus Electronic Receiving and Processing Procedure as needed. Hard drives are destroyed by the vendor, and, in late FY15 began requiring the certification be provided to the Department. • For consolidated agencies, electronic equipment is determined by the BCCS End User group to be redeployed or recycled. Most recycled equipment goes directly to the recycling vendor under a State use contract. For surplus equipment, it is maintained in the warehouse for 30 days prior to being put onto iBid, the CMS website to sell State surplus property. During the 30 days at the warehouse, the equipment is available to municipalities and other units of local government. We will continue to work on improving this process. • Surplus equipment received at the warehouse to be processed by recycling vendors typically waits in queue several months before the electronics can be sent and certified as destroyed. As a result, certification of receipt by recyclers may not be received by the Department within the 30 day timeframe. Surplus property has adjusted procedures to account for this discrepancy. Additionally, the Department will request a change to 5010.400 of the JCAR rules to exempt EDP equipment from the 30 day time period currently required for all property.