REPORT DIGEST DEPARTMENT OF THE LOTTERY Financial Audit For the Year Ended June 30, 2014 Release Date: March 18, 2015 FINDINGS THIS AUDIT: 2 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 1 -- 1 Category 2: 0 -- 1 -- 1 Category 3: 0 -- 0 -- 0 TOTAL: 0 -- 2 -- 2 FINDINGS LAST AUDIT: 2 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS OF FINDINGS • (14-1) The Illinois Department of the Lottery’s (Department) year-end financial reporting in accordance with generally accepted accounting principles to the Illinois Office of the Comptroller contained errors in certain accounts. • (14-2) The Department has not implemented a sufficient level of controls over its computing environment to ensure the controls provided adequate protection. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS NEED TO IMPROVE FINANCIAL REPORTING The State of Illinois Department of the Lottery’s (Department or Lottery) year-end financial reporting in accordance with generally accepted accounting principles (GAAP) to the Illinois Office of the Comptroller contained errors in certain accounts. During the audit of the June 30, 2014 Department financial statements, auditors noted errors in the Department’s GAAP Reporting forms submitted to the Office of the Comptroller and Department financial statements and deficiencies in internal controls over financial reporting. Some of the specific issues noted by the auditors are as follows: • Manual errors and inaccuracies in the calculation of the estimate of the Prizes payable liability for Instant games were identified. The inaccuracies resulted in Prize expense and the associated liability being overstated by $7.314 million. These inaccuracies were discussed with Department management at which time they made an adjusting entry to their accounting records. • An unreconciled difference was identified in the Department’s Accounts receivable. Upon further research, Department management determined that this difference was the result of an error. The error resulted in Accounts receivable being overstated by $4.901 million. This inaccuracy was discussed with Department management at which time they made an adjusting entry to Ticket expense for $1.220 million and Other income for $3.681 million. • Auditors identified that the Department recorded an annuity in error. The error resulted in Current annuity prizes payable and Long-term annuity prizes payable being overstated by $244 thousand and $4.494 million, respectively, and Investment income and Interest expense being overstated and understated by $4.798 million and $60 thousand, respectively. This error was discussed with Department management at which time they made an adjusting entry to their accounting records. The errors and inaccuracies noted, if not detected and corrected, could materially misstate the Lottery’s financial statements and negatively impact the Statewide financial statements. Accurate preparation of the Lottery’s financial information for GAAP reporting purposes is important due to the impact Lottery adjustments have on the Statewide financial statements. (Finding 1, pages 28-30) This finding has been repeated since 2012. We recommended the Lottery implement procedures to ensure GAAP Reporting Packages and financial statements are prepared in an accurate and complete manner. Lottery Management agreed and indicated they will continue to review current procedures to ensure they are up-to-date and implement any additional procedures, as necessary, to ensure GAAP financial reporting and the financial statements are prepared completely, accurately and timely with appropriate supporting documentation. The Lottery will also ensure sufficient staff resources are allocated to this process. (For the previous Department response, see Digest Footnote #1) WEAKNESSES IN THE GENERAL INFORMATION TECHNOLOGY CONTROL ENVIRONMENT OVER KEY SYSTEMS During testing, auditors noted a number of control deficiencies related to the various computer systems utilized by the Department. Several of the Department’s computer systems generate reports that are used to process, accumulate and analyze financial information. Although the Department made certain changes since the prior audit, weaknesses were identified in the following areas: • Access Reviews • Access Termination • Monitoring of Service Providers • Information Technology Policy The areas noted with control deficiencies have specific controls that are considered to be key controls which should be in place and functioning in the Department’s computing control environment to prevent or detect unauthorized access or changes to the Department’s systems. (Finding 2, pages 31-32) This finding has been repeated since 2012. We recommended the Department implement controls over its computing environment and ensure the controls provide sufficient protection. The Lottery Management agreed with the recommendations and indicated they will continue to make improvements in controls to ensure sufficient protection in its IT environment and further reduce the number of or totally eliminate weaknesses. (For the previous Department response, see Digest Footnote #2) PRIVATE MANAGEMENT AGREEMENT The State (acting through the Department) entered into a 10-year private management agreement (PMA) with Northstar Lottery Group, LLC (Northstar) effective January 18, 2011, for the purpose of providing all equipment, services, and functions necessary to operate the Lottery for the State, except for those specifically retained by the State as defined within the PMA. Under the terms of the agreement, effective July 1, 2011, the compensation to be paid under the PMA is comprised of the reimbursement of operating expenses and incentive compensation payments. Incentive compensation is subject to annual adjustments in accordance with the agreement. The Office of the Governor directed the Department to end its relationship with Northstar, on August 15, 2014. The Office of the Governor, the Department, Northstar and its member entities executed a Termination Agreement on December 9, 2014 and delivered a Termination Notice to Northstar on December 10, 2014, exercising the State’s right to terminate the PMA for convenience. Subsequently, the Termination Agreement was disapproved by the State of Illinois Attorney General. (pages 19-21) AUDITOR’S OPINION Auditors stated the financial statements of the Department of the Lottery as of June 30, 2014, and for the year then ended, are fairly stated in all material respects. WILLIAM G. HOLLAND Auditor General WGH:RPU SPECIAL ASSISTANT AUDITORS Our Special Assistant Auditors for this audit were KPMG LLP. DIGEST FOOTNOTES #1 NEED TO IMPROVE FINANCIAL REPORTING - Previous Department Response 2013: Lottery agrees and will continue to review current procedures to ensure they are up-to-date and implement any additional procedures, as necessary, to ensure GAAP financial reporting and the financial statements are prepared completely, accurately and timely with appropriate supporting documentation. The Lottery will also ensure sufficient staff resources are allocated to this process. #2 WEAKNESSES IN THE GENERAL INFORMATION TECHNOLOGY CONTROL ENVIRONMENT OVER KEY SYSTEMS- Previous Department Response 2013: Lottery agrees with the recommendations the auditors have put forth. • Access Reviews – The Department continues to perform periodic access reviews of key systems. We have also begun to ensure proper related documentation is kept to track the reviews. • Access Provisioning and Termination – The Department had one instance of lack of documentation for access provisioning and strives to have zero instances in the future. Access rights termination time frames have improved due to a tighter control over our user de-provisioning practice. • System Change Control – The system in question as designed does not have a formal change logging capability nor can it produce a system generated list of changes. The Department instituted a manual process of tracking, managing and approving system changes for this system in late FY13 and has begun to fully implement the process that includes maintaining all test data produced to support approved changes. The process also serves as a compensating control to mitigate the risk associated with the Department’s inability to segregate development activities and production migration activities by leveraging the Department’s ability to control access to the production environment of the system. The system manager cannot make any system changes without getting access from the Department. • Draw Room Security – The Department has relocated and instituted procedures to fully secure its draw room in early fiscal year 14. • Monitoring of Service Providers – The Department will improve its process of review of the Service Organization Control reports of its service providers to determine the impact to its environment.