REPORT DIGEST DEPARTMENT OF THE LOTTERY Financial Audit For The Year Ended June 30, 2013 Compliance Examination For The Two Years Ended June 30, 2013 Release Date:  July 24, 2014 Summary of Findings: Total this audit: 7 Total last audit: 2* Repeated from last audit: 2 * Prior engagement was a financial statement audit only State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest summarizes the State of Illinois, Department of the Lottery’s Financial Audit report for the year ended June 30, 2013 and State Compliance Examination report for the two years ended June 30, 2013.  The Financial Audit and State Compliance Examination reports contained 7 findings. Effective October 15, 2011, the Department of Revenue transferred all functions performed for the Illinois Lottery and all associated powers duties, rights and responsibilities to the Department of the Lottery in accordance with Public Act 97-0464.  As a means of easing and transitioning, management elected to use an effective date of July 1, 2011 for the financial accounting and reporting. SYNOPSIS • The Illinois Department of the Lottery’s (Department) year-end financial reporting in accordance with generally accepted accounting principles to the Illinois Office of the Comptroller contained numerous errors, inaccuracies and incomplete data. • The Department had not implemented controls over its computing environment to ensure the controls provided sufficient protection. • Weaknesses were noted in regard to the Department’s security and control of confidential information. • The Department failed to submit, or timely submit, certain required reports, documents and policies to the required oversight entities. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS NEED TO IMPROVE FINANCIAL REPORTING The State of Illinois Department of the Lottery’s (Department or Lottery) year-end financial reporting in accordance with generally accepted accounting principles (GAAP) to the Illinois Office of the Comptroller contained numerous errors/inaccuracies and incomplete data. During the audit of the June 30, 2013 Department financial statements, auditors noted errors in the Department’s GAAP Reporting forms submitted to the Office of the Comptroller and Department financial statements and deficiencies in internal controls over financial reporting. Some of the issues noted by the auditors are as follows: • During testing of the estimate of the Prizes payable, liability for instant games, auditors noted the prize structure utilized in the calculation of the Instant prize liability, for numerous instant games, was inaccurate. The inaccuracies resulted in Prize expense and the associated liability being understated by $18,538,189.  These inaccuracies were discussed with Department management at which time they made a correcting entry. • During testing of the Department’s accounts payable, an error in recording “vouchers in transit” as of June 30, 2013 was identified. The error resulted in Accounts Payable – General and Operating expenses at June 30, 2013 each being understated by $12,105,750. These inaccuracies were discussed with Department management at which time they made a correcting entry. • Auditors found an error in recording payments as of year-end.  The Department made a journal entry to correct a previously identified error which inappropriately adjusted the wrong account resulting in Operating expense and Prizes payable each being overstated by $13,111,389.  These inaccuracies were discussed with Department management at which time they made a correcting entry. The aggregate impact of all auditor recommended adjustments made by the Department since the initial June 30, 2013 GAAP Reporting forms were submitted to the Illinois Office of the Comptroller was approximately a $17.5 million increase in liabilities and expenses. The errors and inaccuracies noted, if not detected and corrected, can materially misstate the Lottery’s financial statements and negatively impact the Statewide financial statements.  Accurate and timely preparation of the Lottery’s financial information for GAAP reporting purposes is important due to the impact Lottery adjustments have on the Statewide financial statements.  (Finding Code No. 2013-001, pages 12-14 We recommended the Lottery implement procedures to ensure GAAP Reporting Packages and financial statements are prepared in an accurate and complete manner. Lottery Management agreed and indicated they will continue to review current procedures to ensure they are up-to-date and implement any additional procedures, as necessary, to ensure GAAP financial reporting and the financial statements are prepared completely, accurately and timely with appropriate supporting documentation.  The Lottery will also ensure sufficient staff resources are allocated to this process. NEED TO IMPROVE GENERAL INFORMATION TECHNOLOGY CONTROL ENVIRONMENT OVER KEY SYSTEMS During testing, auditors noted a number of control deficiencies related to the various computer systems utilized by the Department. Several of the Department’s computer systems generate reports that are used to process, accumulate and analyze financial information. Specific areas where weaknesses were identified are as follows: • Access Reviews • Access Provisioning and Termination • Change Management • Segregation of Duties • Access to Drawing Room • Monitoring of Service Providers The areas noted with control deficiencies have specific controls that are considered to be key controls which should be in place and functioning in the Department’s computing control environment to prevent or detect unauthorized access or changes to the Department’s systems.  (Finding Code No. 2013-002, pages 15-17) We recommended the Department implement and document adequate controls over its computing environment and ensure the controls provide sufficient protection. Lottery management agreed with the recommendation and provided additional information regarding improvements in the Lottery’s technology control environment. WEAKNESSES REGARDING THE SECURITY AND CONTROL OF CONFIDENTIAL INFORMATION The Department has several computer systems that contained confidential or personal information.  During testing auditors identified weaknesses related to the Department’s security and control of confidential information.  Specifically auditors noted the following weaknesses: • The Department failed to perform a risk assessment of their computer resources. • The Department lacked formalized breach of Security procedures. • The Department lacked a formal Identity Protection Policy. The Department has the responsibility to ensure confidential information is protected from accidental or unauthorized disclosure. (Finding Code No. 2013-003, pages 18-19) We recommended the Department: a) Develop policies and procedures to ensure timely compliance with the requirements outlined in the Personal Information Protection Act; b) Develop and approve an identity protection policy as required in the Identity Protection Act, and; c) Perform a comprehensive risk assessment to identify all forms of confidential or personal information and ensure adequate security controls have been established. The Lottery management agreed with the recommendation and noted they will continue efforts to complete its risk assessment, finalize its identity protection policy and develop policies and procedures to ensure prompt notification of security breaches.  The Confidential Personal Information Policy required under the Illinois Identity Protection Act has been drafted and is under final review. FAILURE TO SUBMIT, OR TIMELY SUBMIT, REQUIRED REPORTS, DOCUMENTS AND POLICIES During testing of the statutes applicable to the Department, auditors identified instances where the Department failed to submit, or timely submit required reports, documents and policies.  Some of the exceptions noted are as follows: • There were no quarterly reports on activities and actions of the private manager submitted to the Governor or the General Assembly during the period under audit. Illinois Lottery Law (Lottery Law) states “… the Department shall submit written quarterly reports to the Governor and the General Assembly on the activities and actions of the private manager selected under this Section...” • The Department did not timely submit the findings and recommendations of the Internet Lottery Study to the members of the Internet Lottery Study Committee.  The auditors noted the findings and recommendations should have been submitted by February 27, 2013, but were not submitted until November 21, 2013, approximately nine months late.  Lottery Law states “No later than 6 months after the effective date of this amendatory Act of the 97th General Assembly, the Department shall provide to the members of the Study Committee the proposed findings and recommendations of the study in order to solicit input from the Study Committee.”  Public Act 97-1121 was effective August 27, 2012. • The Department failed to submit their required Travel Headquarter Reports (TA-2) to the Legislative Audit Commission during the period under audit.  The State Finance Act requires State agencies to file reports with the Legislative Audit Commission no later than each July 15 for the period from January 1 through June 30 of that year and no later than each January 15 for the period from July 1 through December 31 of the preceding year. Failure to submit the required reports, documents and policies results in noncompliance with the applicable statutory requirements, and diminishes oversight and communication to those charged with governance.  (Finding Code No. 2013-006, pages 24-25) We recommended the Department comply with the applicable statutory requirements and submit the required reports, documents and policies as required. The Lottery management agreed with the recommendation and indicated they have subsequently filed all required reports, documents and policies, and implemented processes to ensure future filings are timely. OTHER FINDINGS The remaining findings are reportedly being given attention by the Department.  Auditors will review the Department’s progress towards the implementation of all the recommendations in the next engagement. AUDITORS’ OPINION The auditors stated the Department of the Lottery financial statements as of June 30, 2013 and for the year then ended were presented fairly in all material respects. The Independent Accountants’ Report on State Compliance and on Internal Control Over Compliance was qualified for finding 2013-001. Except for the noncompliance described in this finding, the auditors stated the Department complied, in all material respects, with the requirements described in the report. WILLIAM G. HOLLAND Auditor General WGH:RPU SPECIAL ASSISTANT AUDITORS KPMG LLP were the Special Assistant Auditors for this engagement.