REPORT DIGEST ILLINOIS INDEPENDENT TAX TRIBUNAL COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2021 Release Date: May 10, 2023 FINDINGS THIS AUDIT: 6 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 2 -- 1 -- 3 Category 2: 1 -- 2 -- 3 Category 3: 0 -- 0 -- 0 TOTAL: 3 -- 3 -- 6 FINDINGS LAST AUDIT: 4 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (21-01) The Tribunal did not handle filing fees received with incorrectly filed petitions in accordance with State laws and regulations. • (21-02) The Tribunal had not implemented adequate internal controls related to applications access and control. • (21-03) The Tribunal had not implemented adequate internal controls over its service providers. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROL OVER FILING FEES The Illinois Independent Tax Tribunal (Tribunal) did not handle filing fees received with incorrectly filed petitions in accordance with State laws and regulations. In addition, the Tribunal did not timely remit Treasurer’s Drafts to complete the receipt process associated with properly filed petitions. During testing, we noted the Tribunal occasionally receives petitions that are incorrectly filed. The incorrectly filed petitions are either immediately dismissed or dismissed with the ability to amend and refile. In either scenario, the Tribunal returns the petitioner’s original $500 check or money order to the taxpayer through the mail. The Tribunal’s records indicated this occurred 9 times during Fiscal Year 2020 and 7 times during Fiscal Year 2021. We noted the following noncompliance related to this process: • The Tribunal did not process refunds, defined as repayments of fees paid in excess or in error to the State, through the standard voucher- warrant process. • The Tribunal did not have appropriation authority within the Illinois Independent Tax Tribunal Fund to pay refunds due to taxpayers in either Fiscal Year 2020 or Fiscal Year 2021. We also noted the following: • The Tribunal did not timely send the consolidated Receipt Deposit Transmittal (RDT) Form to the Office of Comptroller (Comptroller) after depositing the receipts into the Treasurer’s Clearing account. The RDTs were sent between 1 and 16 days late. • The support provided by the Tribunal for 7 of 60 (12%) receipts tested, totaling $3,500, lacked sufficient detail. Auditors were unable to determine if the individual receipts tested were included in the batch deposits listed on the support. • For 28 of 60 (47%) receipts tested, totaling $14,000, the time between the date the Tribunal deposited receipts and the date the Tribunal drafted the RDT appeared significant and abnormal. Auditors determined 30 days to be a reasonable time to process the RDT after making the deposit. The Tribunal drafted the RDTs between 8 and 256 days after the 30 days. • For one of two Agency Fee Imposition Reports (Report) tested, the Tribunal incorrectly reported the amount of fees collected. The Fiscal Year 2020 Report stated 164 Petition Filing Fees were charged at a cost of $500 each, totaling $82,000. Further along in the report, the Tribunal reported the amount deposited for Petition Filing Fees as $63,500. This is a difference of $18,500. In addition, the deposits on the Report did not agree to the Tribunal’s deposit records. The Tribunal’s records reported deposits of $63,000, resulting in a $500 difference. (Finding 1, pages 10-13) This finding has been reported since 2015. We recommended the Tribunal pay necessary refunds through the State’s voucher-warrant process and request an appropriation to pay refunds due. We also recommended the Tribunal prepare and remit all RDTs to the Comptroller on a timely basis, maintain sufficient detail of batch deposits, and ensure the accuracy of reports prior to submission. Tribunal officials stated: We do not agree with the Auditor General’s recommendation. The Tax Tribunal cannot deposit checks for petitions that are deficient and cannot legally be accepted under the Tribunal statute. The Tax Tribunal has a written policy for when a petition is initially rejected for being deficient. If a petition cannot be accepted, any accompanying check will not be accepted as well and will be immediately returned to the petitioner. The fact a check is returned in a case that is not accepted is noted in the case order dismissing the case as well as in our internal docket system and our monthly fee/deposits reconciliations spreadsheets. We do agree with the Auditor General’s recommendation to timely submit RDT’s to the Comptroller, maintain sufficient detail of batch deposits, and to verify the accuracy of reports prior to submission. In an accountant’s comment, we stated the issue within the finding is when a receipt is considered received under the State Officers and Employees Money Disposition Act as opposed to when the Tribunal can accept a petition given its limited jurisdiction under the Illinois Independent Tax Tribunal Act of 2012. To be received is commonly defined as “to be given, presented with, or paid,” and our position is the Tribunal has received a receipt when the mail is opened and a check or money order is located with the incomplete petition. Currently, the State Officers and Employees Money Disposition Act requires the Tribunal to deposit the entire remittance into the State Treasury. If the Tribunal continues to disagree with our position, the Tribunal should seek a formal written opinion from the Attorney General. INFORMATION TECHNOLOGY ACCESS WEAKNESSES The Tribunal had not implemented adequate internal controls related to applications access and control. To carry out its mission, the Tribunal utilizes several IT applications, including the Docket System, Central Payroll System (CPS), and Enterprise Resource Planning System (ERP). In order to determine if access was appropriate, we requested the Tribunal to provide the listing of users with access to its applications. However, the Tribunal was unable to provide a population of users during the examination period or documentation demonstrating the population was complete and accurate. Due to these conditions, we were unable to conclude the Tribunal’s population records were sufficiently precise and detailed under the Professional Standards promulgated by the American Institute of Certified Public Accountants (AT-C § 205.36). As a result, we were unable to determine if users of those applications had access rights aligned with job duties. Further, the Tribunal had not developed access provisioning policies and procedures and had not conducted access reviews of the network or CPS during the examination period. (Finding 2, pages 14-15) We recommended the Tribunal develop a mechanism to produce user access populations and develop access provisioning policies and procedures. Additionally, we recommended the Tribunal conduct access reviews at least annually. Tribunal officials agreed with the recommendations stating they will create a more detailed user access list and will conduct user access reviews annually. Tribunal officials also stated they have already implemented a new access policy for employees and contractors. LACK OF ADEQUATE CONTROLS OVER THE REVIEW OF INTERNAL CONTROLS FOR SERVICE PROVIDERS The Tribunal had not implemented adequate internal controls over its service providers. In order to carry out its mission, the Tribunal utilized a service provider for hosting services and software as a service. We requested the Tribunal provide the population of service providers utilized to determine if they had reviewed the internal controls over their service providers. In response to our request, the Tribunal did not provide a population. Due to these conditions, we were unable to conclude the Tribunal’s population records were sufficiently precise and detailed under the Professional Standards promulgated by the American Institute of Certified Public Accountants (AT-C § 205.36). Even given the population limitations noted above, we performed testing over the service provider we identified. During our testing, we noted the Tribunal had not obtained System and Organization Control (SOC) reports or conducted independent internal control reviews of the service provider. (Finding 3, pages 16-17) We recommended the Tribunal strengthen its controls in identifying and documenting all service providers utilized. Further, we recommended the Tribunal obtain SOC reports or conduct independent internal control reviews at least annually. In addition, we recommended the Tribunal: • Monitor and document the operation of the Complementary User Entity Controls (CUECs) related to the Tribunal’s operations. • Either obtain and review SOC reports for subservice organizations or perform alternative procedures to satisfy itself that the existence of the subservice organization would not impact its internal control environment. • Document its review of the SOC reports and review all significant issues with subservice organizations to ascertain if a corrective action plan exists and when it will be implemented, any impact to the Tribunal, and any compensating controls. Tribunal officials agreed with our recommendation stating they will create a written list identifying the Department of Innovation and Technology (DoIT) as their sole service provider. OTHER FINDINGS The remaining findings pertain to failure to fully implement the Illinois Independent Tax Tribunal Act of 2012, weaknesses in cybersecurity programs, and disaster recovery planning weaknesses. We will review the Tribunal’s progress towards the implementation of our recommendations in our next compliance examination. ACCOUNTANT’S OPINION The accountants conducted a State compliance examination of the Tribunal for the two years ended June 30, 2021, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Findings 2021-001 through 2021-003. Except for the noncompliance described in those findings, the accountants stated the Tribunal complied, in all material respects, with the requirements described in the report. This State compliance examination was conducted by the Office of the Auditor General’s staff. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:sdw