REPORT DIGEST ILLINOIS RACING BOARD COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2016 Release Date: MAY 3, 2018 FINDINGS THIS AUDIT: 22 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 4 -- 6 -- 10 Category 2: 8 -- 3 -- 11 Category 3: 0 -- 0 -- 0 TOTAL: 12 -- 9 -- 21 FINDINGS LAST AUDIT: 15 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION Because of the significance and pervasiveness of the findings described within the report, we expressed an adverse opinion on the Board’s compliance with the assertions which comprise a State compliance examination. The Codification of Statements on Standards for Attestation Engagements (AT-C § 205.72) states a practitioner “should express an adverse opinion when the practitioner, having obtained sufficient appropriate evidence, concludes that misstatements, individually or in the aggregate, are both material and pervasive to the subject matter.” SYNOPSIS • (16-02) The Board lacked control over its personal services functions. • (16-03) The Board did not exercise adequate control over service organization controls (SOC) reports received from the totalizator companies during the examination period. • (16-04) The Board lacked control over physical access to the Board’s offices at the racetracks. • (16-05) The Board did not adequately monitor a racetrack’s allocation of moneys derived by the racetrack from simulcast wagering and inter-track wagering. • (16-07) The Board was unable to distribute all inter-track wagering location admission fees to the City of Chicago and Cook County. • (16-08) The Board did not comply with, or enforce compliance with, provisions of the Illinois Horse Racing Act of 1975 (Act) and the Illinois Administrative Code (Code) at the racetracks. • The Board disclosed noncompliance regarding purse allocations at a racetrack after June 30, 2016. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROLS OVER PERSONAL SERVICES The Illinois Racing Board (Board) lacked control over its personal services functions. We tested the Board’s payroll expenditures for nine per diem and six full time employees during six selected months during the examination period. Due to the seasonal nature of the Board’s operations and separations, not all of the employees worked during each month. The following are some of the more significant issues we noted during testing: Documentation Problems • For 9 of 59 (15%) leave days, the Board either did not receive or did not retain leave requests from 5 of 9 (56%) per diem employees tested. As such, the Board did not have documentation to support entries recorded within the Central Time and Attendance System (CTAS). • For 2 of 59 (3%) leave days, the employee’s supervisor did not approve the employee’s use of vacation time until 5 and 23 days after the day off. • For 15 of 59 (25%) leave days, the employee’s supervisor never approved the employee’s use of benefit time. Errors within Attendance Records • We noted one employee who was sick on a day where CTAS records indicated the individual worked at a race, which resulted in the employee’s sick leave balances being overstated by one day. • We noted one employee who did not have any information records within CTAS where the employee had taken a vacation day. It appears the employee was underpaid by $162 and the employee’s vacation leave balance is overstated by one day. • One employee was not paid for a double shift, which resulted in an underpayment of $162. • One employee was not paid the correct differential for holiday pay on Labor Day, which resulted in an overpayment of $195. • One employee was paid for a shift where the employee did not work, which resulted in an overpayment of $440. Payroll Adjustments • We noted the Board did not post payroll adjustments in a timely manner. During testing of six months of payroll, we noted the Board posted 76 prior period adjustments for five of the nine (56%) per diem employees tested. As we considered adjustments made for the immediately preceding payroll period as timely, we noted 10 of the 76 (13%) adjustments were performed between two to five pay periods after the pay period covering the date with an adjustment. Given this condition, each employee’s Monthly Timekeeping Report for the period with the adjusted day was inaccurate and they did not certify all of their time spent on official State business, as required by the State Officials and Employees Ethics Act. Monthly Timekeeping Reports • For 22 of 60 (37%) Monthly Timekeeping Reports tested, the Board either did not receive or did not retain the employee’s report. • For 34 of the 60 (57%) Monthly Timekeeping Reports tested, we noted the following problems: – Twenty-one of the 60 (35%) Monthly Timekeeping Reports were not approved by the employee within a reasonable period of time, with reports approved between 1 and 326 days late. – Eight of the 60 (15%) Monthly Timekeeping Reports were not reviewed by the employee’s supervisor or certified by the timekeeper within a reasonable period of time, with reports signed off on between 1 and 25 days late. – One of the 60 (2%) Monthly Timekeeping Reports tested was never approved by the employee. – Sixteen of the 60 (27%) Monthly Timekeeping Reports tested were either not reviewed by the employee’s supervisor, certified by the timekeeper, or both. – One of the 60 (2%) Monthly Timekeeping Reports tested was certified by the timekeeper prior to the employee approving the report, indicating any adjustments noted by the employee would not have been noticed by the timekeeper. – One employee reported errors on their Monthly Timekeeping Report from CTAS on two of the 60 (3%) monthly reports, which were not investigated or resolved by the Board. Due to all of the foregoing problems, we concluded the Board did not ensure its employees certified their time spent on official State business. Evaluations • During testing of the 24 annual evaluations required for the 15 employees tested, we noted 20 of 24 (83%) evaluations were not performed and 3 of 24 (13%) evaluations were completed between 82 to 161 days late. (Finding 2, pages 18-26) This finding has been repeated since 2010. We recommended the Board review its payroll process and make changes to ensure: 1) source documentation is obtained in a timely manner; 2) leave requests are properly submitted and approved in a timely manner; 3) records are retained for the duration of the approved retention period; 4) payroll adjustments are minimized, with any necessary adjustments entered into CTAS promptly to facilitate the production of complete and accurate Monthly Timekeeping Reports; 5) employees promptly review Monthly Timekeeping Reports to either certify an accurate report or make notations of incorrect information on the report so corrections can be made before certifying a revised report; 6) supervisors promptly review Monthly Timekeeping Reports to certify they agree with the employee’s time report; and, 7) the timekeeper certifies the close of the monthly payroll cycle by certifying only complete and accurate Monthly Timekeeping Reports approved by the employee and the employee’s supervisor. Further, we recommended the Board implement internal controls where the timekeeper has a process to notate a source document has been entered into CTAS and reviews of information recorded in CTAS are performed by an individual independent of the timekeeper. Finally, the Board should ensure each employee’s performance is timely reviewed in accordance with the provisions of the Code. Board officials agreed and noted they have been taking steps to correct these errors and manage the dissolution of the Administrative and Regulatory Shared Services Center. (For the previous Board response, see Digest Footnote #1.) INADEQUATE CONTROL OVER TOTALIZATOR SOC REPORTS The Board did not exercise adequate control over service organization controls (SOC) reports received from the totalizator companies during the examination period. During the examination period, the Board had three totalizator companies who provided the computerized systems to run pari-mutuel wagering systems, commonly known as totalizators. The totalizator systems process wagering transactions made by patrons either at the racetracks or online through advance deposit wagering (ADW) licensees, ensure the correct pricing for each wagering transaction, and handle distributions of proceeds from the pools such as validating a winning ticket. In addition, these totalizator systems serve as the Board’s primary source of information for verifying the completeness and accuracy of pari-mutuel tax receipts. According to the Board’s annual reports, the total value of wagering transactions processed by the totalizator companies (referred to as “handle”) within the State was $623.98 million, $593.42 million, and $570.51 million during Calendar Year 2014, Calendar Year 2015, and Calendar Year 2016, respectively. During testing, we noted the following: • The Board did not monitor the racetracks to ensure the Complementary User Entity Controls (CUECs) identified in the various SOC reports covering the totalizator systems were implemented and functioning during the examination period. Further, the Board did not monitor or document the operation of the CUECs relevant to the Board's operations. • The Board did not obtain or review SOC reports for subservice organizations or perform alternative procedures to satisfy itself that the existence of the subservice organization would not impact its internal control environment. • The Board needs to improve its monitoring of SOC reports to ensure all significant issues are reviewed with the totalizator company to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the data processed, and any compensating controls. Further, the Board needs to document this review and conclude as to whether and why noted deviations were not significant to the Board's operations or regulatory responsibilities. (Finding 3, pages 27-30) We recommended the Board (1) monitor the racetracks to ensure the CUECS are in place and functioning, (2) monitor and document the operation of the CUECs relevant to the Board's operations, (3) either obtain and review SOC reports for subservice organizations or perform alternative procedures to satisfy itself that the existence of the subservice organization would not impact its internal control environment, and (4) document its review of the SOC reports and review all significant issues with the totalizator company to ascertain if a corrective action plan exists and when it will be implemented, any impacts to the data processed, and any compensating controls. Board officials disagreed with the finding. They stated, “The Board does analyze the SOC reports as it had been instructed by a previous IT auditor. Further analysis to supplemental levels was never anticipated but the Board will include that in future audits. The tote companies are already paying major CPA firms (Deloitte, Grant Thornton, etc.) to conduct the audit, but then it is subject to audit two-fold thereafter.” In an accountant’s comment, we stated it is the Board’s responsibility to assess the impact of the sub-service organizations’ services on the processing of transactions and financial information generated by the totalizators and whether the sub-service organization requires its own SOC report or if the Board can apply alternative procedures to understand and conclude the controls of the sub-service organization were put into place and operating effectively to ensure the pari-mutuel betting system can be relied upon to provide accurate financial data. We also stated it is imperative for the Board to review all significant issues reported by the Independent Service Auditor. These types of problems need to be considered by the Board (1) in assessing the potential impact a noted problem could have on the reliability of financial information from the totalizators and (2) as a component of its regulation of pari-mutuel wagering. This type of analysis is the responsibility of the Board as a user of the Independent Service Auditor’s report and is not a responsibility of the Independent Service Auditor. INADEQUATE PHYSICAL SECURITY CONTROLS The Board lacked control over physical access to the Board’s offices at the racetracks. During testing, we noted the Board’s offices at a racetrack were burglarized. Items reported missing included a breathalyzer stored in a box and an empty cash box bolted into a desk used to store checks prior to their delivery to the State Treasury. During the police investigation, detectives noted (1) there was no damage to the points of entry into the Board’s offices and (2) the lock on the door into the Board’s office was a “master key” which approximately 30-50 racetrack employees have access to use. (Finding 4, page 31) We recommended the Board work with each of the racetracks to limit the number of keys outstanding to the minimum necessary to ensure the Board’s operations can be conducted and all individuals with access to the Board’s offices are known to, and approved in advance by, the Board. Board officials agreed with the recommendation. FAILURE TO MONITOR A RACETRACK’S CASH ALLOCATIONS The Board did not adequately monitor a racetrack’s allocation of moneys derived by the racetrack from simulcast wagering and intertrack wagering. During testing, some of the problems noted included: • The Board did not monitor a racetrack’s allocation of moneys derived by the racetrack from simulcast wagering and inter-track wagering. • The Board did not monitor the racetrack’s deposits of receipts into the Illinois Colt Stakes Purse Distribution Fund (Fund), a locally held fund of the Department of Agriculture. (Finding 5, pages 32-34) While discussing these conditions with Board officials on August 25, 2017, they stated the Board had been unable to obtain these records from the racetrack subsequent to the end of the examination period to substantiate (1) the allocations to the thoroughbred purse account and the Fund and (2) whether payments to the Fund were made timely. We recommended the Board take action to obtain required documentation from the licensee and implement controls to monitor the racetrack’s allocation of moneys derived from simulcast wagering and inter-track wagering. Further, we recommended the Board work with the Governor and the General Assembly to ensure the Act provides for an allocation of funds in all foreseeable situations. Board officials agreed with the recommendation, noting the Board has not had the resources or staff to arrive at the purses earned calculation as the calculation is extremely complicated and a time-consuming task. UNABLE TO DISTRIBUTE COLLECTED LOCAL TAXES The Board was unable to distribute all inter- track wagering location admission fees to the City of Chicago and Cook County. During the Board’s examination for the two years ended June 30, 2012, we noted the Board had ceased activity within the Illinois Racing Board Grant Fund at the close of Fiscal Year 2012 and began depositing inter- track wagering location admission fees into the Horse Racing Fund. However, as a result of prior period fund transfers into the General Revenue Fund, the Board lacked sufficient cash after ceasing activity within the Illinois Racing Board Grant Fund to pay its remaining obligations due to Cook County, totaling $43,809, and the City of Chicago, totaling $1,118. During the current examination, we noted the Board still had not paid these obligations due to Cook County and the City of Chicago. Further, we noted the Board still had not reported these liabilities to the Office of the State Comptroller for consideration in preparing the State’s Comprehensive Annual Financial Report. (Finding 7, pages 38-39) This finding has been repeated since 2012. We recommended the Board work with the Governor and General Assembly to seek a legislative remedy to pay the outstanding obligations due to Cook County and the City of Chicago. Further, the Board should ensure all liabilities are reported to the Office of the State Comptroller. Board officials agreed with the recommendation. (For the previous Board response, see Digest Footnote #2.) NONCOMPLIANCE WITH RACING LAWS AND REGULATIONS The Board did not comply with, or enforce compliance with, provisions of the Illinois Horse Racing Act of 1975 (Act) and the Illinois Administrative Code (Code) at the racetracks. The following are some of the more significant issues we noted during testing: • The Board did not ensure race officials at the racetrack had active licenses prior to the first race day at the racetrack. These individuals oversee certain race-related functions at the racetracks, with some of the functions with exceptions noted during testing including individuals serving as the racetrack’s general manager, racing secretary, Association Steward, security managers, placing judges, and outriders not having a license at the start of their racetrack’s meet. Specifically, we noted: – Fourteen of 25 (56%) race officials at one thoroughbred racetrack obtained their annual occupation license from the Board between 3 to 82 days late. – Sixteen of 27 (59%) race officials at a racetrack which runs both thoroughbred and standardbred races obtained their annual occupation license from the Board between 3 to 251 days late. – Five of 14 (36%) race officials at one thoroughbred racetrack obtained their annual occupation license from the Board between 3 and 27 days late. • One of three (33%) racetracks did not accurately report its racing officials to the Board. We noted one individual, an outrider, did not obtain a license for its 2016 meet. In following up on this exception with the Board, it appears the racetrack actually had three individuals acting in an official racing capacity as outriders without being approved by the Board. • One of three (33%) racetracks tested had two individuals acting in an official racing capacity without being approved by the Board. The Board eventually obtained all of the necessary documentation to approve these persons 13 days after the start of the racetrack’s meet, which was 73 days after the deadline established within the Code. • At one of three (33%) racetracks tested, the Board did not maintain adequate control over the collection and processing of urine and blood samples taken from each race’s winning horse and any other selected horse(s) by the stewards for laboratory testing. At the standardbred racetrack, we noted the Board did not require the horse’s owner, trainer, or representative to remain to witness the collection or sealing of the horse’s urine and blood samples. • At three of three (100%) racetracks tested, the racetracks were not requiring individuals in the stable area to have their Board-issued photo identification. • We noted the Board has not adequately defined what an entrance, exit, or credit location is under the Act through its regulations. Under the Act, each racetrack must post signage at each entrance, exit, and credit location with (1) a statement provided by the Department of Human Services regarding obtaining assistance with gambling problems and (2) a statement provided by the Department of Healthcare and Family Services about involuntary withholding of delinquent child support, respectively. During testing, we noted disputes about whether the entrances or exits meant the initial ticket/admission gate to the grounds of the racetrack, the points of ingress and egress of only the building where wagers are placed, or any entrances or exits to external areas where wagers can be made on automated machines. Additionally, the terminology of a credit location is ambiguous and may include certain types of automated teller machines (ATMs). • At three of three (100%) racetracks tested, we noted the Board did not adequately monitor the Association Steward as follows: – At two of two (100%) thoroughbred racetracks tested, the Board is not monitoring the arrival time of the Association Steward to determine they arrive at least three hours prior to the first race. – The Board does not appear to have any rules or regulations governing the time when the Association Steward is required to be performing their duties at the standardbred racetrack. (Finding 8, pages 40-46) We recommended the Board take action to ensure compliance by its employees and licensees with State laws, rules, and regulations governing horse racing, including developing an appropriate process to monitor racetrack operations for instances of noncompliance and appropriately address any identified noncompliance. Board officials agreed with the recommendation. BOARD DISCLOSED NONCOMPLIANCE OCCURRING AFTER JUNE 30, 2016 Board officials included the following statement within their Management Assertion Letter (pages 4-5): On and after January 1, 2017, no live thoroughbred racing has occurred within the State during the period from January 1 through the third Friday in February. As such, allocations of purse moneys collected from interstate simulcast wagers should have been allocated pursuant to § 26(g)(7)(B) of the Illinois Horse Racing Act of 1975 at one racetrack. This subparagraph states the allocation must be made pursuant to § 26(g) (10) of the Illinois Horse Racing Act of 1975, which reads “(Blank).” We are aware the racetrack in question continued to allocate its purse moneys collected from interstate simulcast wagers assuming live thoroughbred racing had occurred during the period from January 1 through the third Friday in February. OTHER FINDINGS The remaining findings pertain to (1) inadequate control over cash receipts, accounts receivable, voucher processing, and the laboratory; (2) failure to enforce withholding of child support due; (3) failure to monitor handle allocations; (4) noncompliance with certain non-live racing requirements and inadequate monitoring of certain racing requirements; (5) excess commuting mileage and noncompliance with the Illinois Vehicle Code; (6) an outdated records retention schedule; (7) reconciliation problems; (8) inaccurate Agency Fee Imposition Reports; and, (9) failure to report grant information and noncompliance with the Illinois Grant Funds Recovery Act. We will review the Board’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the Board for the two years ended June 30, 2016, as required by the Illinois State Auditing Act. Because of the effect of the noncompliance described in Finding 2016-001 through Finding 2016-011, the accountants stated the Board did not comply with the requirements described in the report. This compliance examination was conducted by the Office of the Auditor General’s staff. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:djn DIGEST FOOTNOTES #1 – Inadequate Control over Payroll Expenditures – Previous Board Response The Board will continue to streamline processes for gathering documents from field employees to address these issues. Additionally, the timekeeping software utilized by Shared Services is incompatible with the timekeeping needs for per diem employees, which requires all timekeeping to be entered manually. The Board will continue to seek more suitable timekeeping software within its affordability range that will allow for the timely recording and review of all timekeeping data with less need for manual input, thus reducing human error. This will address the remaining issues around adjustments, timeliness of entries and the ability of staff to review and return timekeeping reports. The Board no longer utilizes the one-hour placeholder. It should be noted that the practice was put in place to adhere to the payroll cutoff dates. The Board is working to change the cutoff dates. #2 – Unable to Distribute Local Government Tax Collections – Previous Board Response The Board will continue to work with the General Assembly and the Governor’s Office of Management and Budget to recover the transferred funds and direct them to the proper local governments.