FINDINGS,
CONCLUSIONS, AND RECOMMENDATIONS
FAILURE TO RETAIN HISTORICAL FINANCIAL
INFORMATION
The Authority failed to retain certain
investment reports on microfiche or on hard
copies. This finding has been repeated since
1996.
During audit testing of the investment area,
22 of 25 investment transactions could not be
agreed to the investment transactions' general
ledger as the microfiche for the dates of the
transactions were missing. Additionally, the hard
copies of the ledger could not be found. However,
the auditors did agree these transactions to the
applicable bank statements to verify the
existence of the transactions.
The Authority's internal policy states that
all financial reports will be retained throughout
the year in order to ensure adequate
documentation of all transactions.
We recommended the Authority adhere to its
policy to retain all financial reports to support
investment activity. (Finding 1, page 14)
The Authority concurred with the
recommendation and stated the problem with the
microfiche supplier has been resolved and the
conversion of past transactions is now being
performed. Authority officials also stated that
once the past investment transactions are
converted to microfiche, investment material will
be retained on microfiche on a current basis.
(For previous Authority responses, see Digest
footnote #1.)
INADEQUATE SYSTEM STANDARDS AND SECURITY
PROGRAMS
The Authority has inadequate formal, written
standards and procedures for its information
systems. This finding has been repeated since
1994.
During audit testing, the auditors noted that
a formal, comprehensive System Development
Methodology did not exist, and there were no
formal installation standards for organization
and administration of the Authority's information
systems. Also, there were no formal procedures to
monitor, review, and follow-up on security
violations, nor was a formal security awareness
program in place.
The lack of standards has adversely affected
existing applications. One application has
operational inefficiencies and is unable to
adjust to the growth of demand on the system. In
the past few years, it has been continuously
modified and enhanced to meet the increasing
service needs. However, there is no complete
up-to-date documentation to describe procedures
for input, processing, and output of
transactions.
We recommended Authority management continue
to take an active role in systems development
project oversight for those projects which will
be developed in-house. We also recommended the
Authority formalize and implement a Systems
Development Methodology, installation standards
for organization and administration of the
facility, standards for regular monitoring and
review of security violations and a step-by-step
process for developing and approving standards.
In addition, we recommended the Authority
formalize a documented systems development life
cycle. (Finding 3, pages 17-18)
The Authority concurred with the
recommendations and stated that in the future,
little, if any, software will be developed
internally, but will be purchased from outside
sources. Authority officials also stated
activities to establish procedures for regular
monitoring and review of security violations will
continue. (For previous Authority responses, see
Digest footnote #2.)
NONCOMPLIANCE WITH ILLINOIS AFFORDABLE
HOUSING TRUST FUND
The Illinois Affordable Housing Trust Fund
loan application supporting documentation is
incomplete, and loans are not processed in a
timely manner. This is in violation of the
Authority's internal policies and procedures
regarding timely processing of development
applications.
The testing of loan application files
indicated delays regarding the initial
notification to an applicant within the 10 days
of application receipt, if processing can
proceed, as required by Authority policy. Also, a
project summary sheet was not prepared within
three weeks of receipt of the application for two
of the five files tested, as required by
Authority policy. Finally, site visits were not
properly documented for two of the five files
tested. Authority policy requires a site visit to
be performed as part of the loan application
process. However, the Authority could not provide
documentation to indicate if site visits were
conducted.
We recommended the Authority adhere to its
policy requiring applicants be notified within
ten days whether or not their applications are
suitable for processing. We also recommended the
Authority ensure a date is placed on all project
summary sheets and that application completeness
be monitored so that project summary sheets can
be prepared immediately upon receipt of all
necessary information. Finally, we recommended
the Authority adhere to its policy and maintain
documentation to support site visits. (Finding 7,
pages 23-24)
The Authority concurred with our
recommendations regarding applicant notification
within 10 days and the maintenance of
documentation to support site visits. Authority
personnel stated they would update the current
policy to more accurately reflect the current
practices related to the use of project
summaries.
INACCURATE AND INCOMPLETE FEDERAL FILES
Federal eligibility files for Section 8 and
Section 236 tenants lacked proper supporting
documentation, and the eligibility forms, which
are used to determine Housing Assistance
Payments, contained numerous errors. This
finding has been repeated since 1989.
During audit testing, 128 errors were found in
the 512 files reviewed. The files contained
numerous errors resulting in several
underpayments and overpayments to HUD. There were
also many files containing inaccurate
information, incomplete or missing forms and
inadequate documentation.
The Authority is responsible for adequate
monitoring procedures to ensure subrecipients are
complying with requirements of applicable federal
programs. This includes ensuring federal funds
are being used for the assistance of eligible
tenants only and adequate supporting documents
are retained to verify tenants' eligibility. The
numerous errors could result in incorrect
payments from HUD and the subsidy of ineligible
tenants. Ultimately, they could jeopardize future
federal financial assistance.
We recommended the Authority re-evaluate its
current subrecipient monitoring procedures.
(Finding 9, pages 26-27)
Authority officials stated they are in the
process of developing a requirement for relevant
management staff to attend a two-day training
session biennially. In addition, the Eligibility
and Processing Officers' (EPO) procedures are to
be revised to reflect an increased emphasis
regarding on-site audits, and EPO staff workload
will also be reviewed according to Authority
officials. (For previous Authority responses, see
Digest footnote #3.)
OTHER FINDINGS
The remaining findings are less significant
and are being given appropriate attention by the
Authority. We will review progress toward
implementing these recommendations in our next
audit. Responses to the recommendations were
provided by Executive Director John Varones.
AUDITORS' OPINION
Our auditors state the Authority's financial
statements for the year ended June 30, 1997 are
fairly presented.
___________________________________
WILLIAM G. HOLLAND, Auditor General
- WGH:BAR:pp
SPECIAL ASSISTANT
AUDITORS
KPMG Peat Marwick LLP were our special
assistant auditors for this audit.
DIGEST
FOOTNOTES
#1 FAILURE TO RETAIN
HISTORICAL FINANCIAL INFORMATION - Previous
Authority Responses.
1996: "The Authority
concurs with the recommendation and is in the
process of selecting a new vendor to record and
retain the investment reports.
#2 INADEQUATE SYSTEM
STANDARDS AND SECURITY PROGRAM - Previous
Authority Responses.
1996: "The Authority
concurs with the recommendations. The Authority
plans to use a design methodology on systems
developed under the conversion from the existing
VAX systems to the unified database and
client/server, if these systems are developed
internally. Should software be purchased, such a
design methodology would not be necessary.
The Authority will continue its
activities to establish procedures for regular
monitoring and review of security violations.
The Authority has a process for
developing standards and maintaining them as a
part of its Disaster Recovery Plan. The Authority
will make this process a part of its Installation
Standards as applicable.
Due to the small size of the
Authority's Information Systems staff together
with the heavy demands being placed upon it by
the systems conversion project, full
implementation of the recommendations can not be
accomplished by the end of fiscal year 1997
without the hiring of additional personnel or
consulting help. The Authority will evaluate
these alternatives, both of which will be
affected by budget constraints."
1995: "The Authority
concurs with the recommendations. The Authority
plans to use a methodology on systems developed
under the conversion from the existing VAX
systems to the unified database and
client/server, if these systems are developed
internally. Should software be purchased, such a
design methodology would not be necessary.
The Authority will continue its
activities to establish procedures for regular
monitoring and review of security violations.
The Authority has a process for
developing standards and maintaining them as a
part of its Disaster Recovery Plan. The Authority
will make this process a part of its Installation
Standards as applicable.
Due to the small size of the
Authority's Information Systems staff together
with the heavy demands being placed upon it by
the systems conversion project, full
implementation of the recommendations can not be
accomplished by the end of fiscal year 1996
without the hiring of additional personnel or
consulting help. The Authority will evaluate
these alternatives, both of which will be
affected by budget constraints."
1994: "The Authority
concurs with the recommendations. The Authority
plans to use a design methodology on systems
developed under the conversion from the existing
VAX systems to the unified database and
client/server. The selection and purchase of a
methodology are subject to the availability of
funding.
The Authority will continue its
activities to establish appropriate standards for
organization and administration, as well as those
to create standards for regular monitoring and
review of security violations.
The Authority has a process for
developing standards and maintaining them as a
part of its Disaster Recovery Plan. The Authority
will make this process a part of its Installation
Standards as applicable.
Due to the small size of the
Authority's Information Systems staff, the full
implementation of the recommendations can not be
accomplished within the next fiscal year and will
be affected by demands on existing staff and
approval and acquisition of additional
staff."
#3 INCORRECT HOUSING
ASSISTANCE PAYMENTS - Previous Authority
Responses.
1996: "The Authority will
review the files in question and will make
necessary adjustments upon the completion of the
review. The Authority will continue to emphasize
to management agents the importance of accuracy
as it relates to tenant eligibility and tenant
rent. In addition, the Authority continues to
offer training and retraining for site managers
and strongly recommends that new managers attend
and that managers be retrained every two years.
The Authority will continue to advise site
managers that continuing inaccuracies may result
in abatement of Housing Assistance Payments.
1995: "The Authority is in
the process of reviewing the files in question
and will make necessary adjustments upon
completion of the reviews. During site visits by
Authority staff, the 50059 forms are reviewed and
calculated for completeness and accuracy. The
Authority will continue to emphasize to
management agents the importance of accuracy as
it relates to tenant eligibility and tenant rent.
In addition, the Authority will continue to offer
training and retraining for site managers and
strongly recommends that new managers attend
immediately and that all managers be retrained
biannually. The Authority will also advise site
managers that continuing inaccuracies may result
in abatement of Housing Assistance
Payments."
1994: "HUD regulations
require that the tenant file systems be
established and maintained for three years. The
Authority supports this requirement by supplying
checklists to management personnel during monthly
training sessions and strongly encouraging their
use. These checklists recap all information which
should be included in each on-site tenant file.
In addition, when the Eligibility and Processing
(E&P) Officers do an on-site tenant audit,
they check to see that the tenant files are in
order and that all verification forms are
properly filed.
1993: "During site visits
by the E&P Officers, the Form 50059's are
reviewed and calculated for completeness and
accuracy. The Authority will continue to
emphasize to management agents the importance of
accuracy as it relates to tenant eligibility and
tenant rent.
In addition, the Authority
continues to offer training and retraining for
site managers and strongly recommends that new
managers attend immediately and for all managers
to reattend biennially.
The Authority is in the process
of reviewing the files in question as noted in
the above findings and will make necessary
adjustments upon completion of the reviews."
1992: Same response as 1993.
1991: Same response as 1993.
1990: Same response as 1993.
1989: "During all training
sessions, on-site audits and telephone
conversations with management personnel, the
E&P Officers stress the importance of
accurate and complete 50059 forms. These forms
are now reviewed by computer which is supposed to
eliminate human error. Should the computer reject
a file due to erroneous information, the E&P
Officer checks the form and contacts the on-site
manager. For major errors, a new 50059 is
requested. Should the error be of the type found
during the audit, the on-site manager is told to
correct the error on their 50059 form. The
E&P Officer then corrects the IHDA 50059 and
the file is reentered into the computer. The
on-site manager, however, may not always follow
through and correct the on-site 50059 form."
