REPORT DIGEST

SUPREME COURT OF ILLINOIS

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2019

Release Date:  February 25, 2020

FINDINGS THIS AUDIT:  1

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  0 -- 0 -- 0
Category 2:  1 -- 0 -- 1
Category 3:  0 -- 0 -- 0
TOTAL:  1 -- 0 -- 1

FINDINGS LAST AUDIT: 0

Category 1: Findings that are material
weaknesses in internal control and/or a
qualification on compliance with State laws
and regulations (material noncompliance).
Category 2: Findings that are significant
deficiencies in internal control and
noncompliance with State laws and regulations.
Category 3: Findings that have no internal
control issues but are in noncompliance with
State laws and regulations.

State of Illinois, Office of the Auditor
General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, Iles Park
Plaza, 740 E. Ash Street, Springfield, IL
62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are also
available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

Our compliance examination of the Supreme
Court included Appellate Court Districts 1-5
and the Illinois Courts Commission.


SYNOPSIS

• (19-01) The Court did not obtain or conduct
timely independent internal control reviews
over its service providers.

FINDING, CONCLUSION, AND RECOMMENDATION

LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF
INTERNAL CONTROL OVER SERVICE PROVIDERS

The Court did not obtain or conduct timely
independent internal control reviews over its
external service provider. The auditors noted
the Court had not:

• Developed a process for identifying all
service providers and assessing the effect on
internal controls of these services on an
annual basis;
• Performed independent reviews of internal
controls associated with outsourced systems at
least annually or obtained from its third-
party service provider its annual Service
Organization Control (SOC) report;
• Reviewed the SOC report to determine the
impact and whether assurance could be obtained
that internal controls being relied upon at
the service provider were effectively
operating;
• Determined if complementary user entity
controls (CUECs) that should be at the Court
are in place; and
• Determined if the third-party service
provider used subservice organizations.
Accordingly, the Court did not obtain and
review SOC reports for subservice
organizations or perform alternative
procedures to determine the impact on its
internal control environment.

Additionally, the contract between the Court
and the service provider did not contain a
requirement for an independent review to be
completed. (Finding 1, pages 11-12).

We recommended the Court identify all third
party service providers and determine and
document if a review of controls is required.
If required, the Court should:

• Obtain SOC reports or perform independent
reviews of internal controls associated with
third party service providers at least
annually;
• Document its review of the SOC reports and
review all significant issues with service
organizations to ascertain if a corrective
action plan exists and when it will be
implemented, any impacts to the Court, and any
compensating controls;
• Monitor and document the operation of the
CUECs relevant to the Court’s operations.
• Either obtain and review SOC reports for
subservice organizations or perform
alternative procedures to satisfy itself that
the existence of the subservice organization
would not impact its internal control
environment; and
• Review contracts with service providers to
ensure applicable requirements over the
independent review of internal controls are
included.

The Court responded the SOC report for the
vendor identified during the audit period was
recently obtained and reviewed, and no
weaknesses were identified with the third-
party service provider affecting the Court’s
operations.  The Court further stated it is
implementing procedures for future contracts
where SOC reports will be needed.

We will review the Court’s progress towards
the implementation of our recommendation in
our next compliance examination.

ACCOUNTANT’S OPINION

The accountants conducted a compliance
examination of the Court for the two years
ended June 30, 2019, as required by the
Illinois State Auditing Act.  The accountants
stated the Court complied, in all material
respects, with the requirements described in
the report.

This compliance examination was conducted by
Adelfia LLC.

JANE CLARK
Division Director

This report is transmitted in accordance with
Section 3-14 of the Illinois State Auditing
Act.

FRANK J. MAUTINO
Auditor General

FJM:lkw