REPORT DIGEST STATE OF ILLINOIS FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2021 Release Date: June 28, 2022 FINDINGS THIS AUDIT: 6 CATEGORY: NEW -- REPEAT – TOTAL Category 1: 0 -- 4 -- 4 Category 2: 0 -- 1 -- 1 Category 3: 0 -- 1 -- 1 TOTAL: 0 -- 6 -- 6 FINDINGS LAST AUDIT: 7 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION The Illinois Office of Comptroller prepares the State of Illinois’ Annual Comprehensive Financial Report. The Annual Comprehensive Financial Report is the State’s official annual report, which provides the readers with the financial position of the State as of June 30, 2021, and its results of operations during the fiscal year. The financial section of the Annual Comprehensive Financial Report includes the Independent Auditor’s Report on the basic financial statements, management’s discussion and analysis, the basic financial statements, required supplementary information, and individual fund statements and schedules. AUDITOR’S OPINION The auditors issued a disclaimer of opinion on the Unemployment Compensation Trust Fund and qualified their opinion on the Business-Type Activities opinion units of the financial statements of the State of Illinois. All other opinion units of the financial statements of the State of Illinois are fairly presented in all material respects. The financial statements at June 30, 2021, reflect the following: • The net position of governmental activities continued to deteriorate and the deficit increased by $1.7 billion from June 30, 2020, to June 30, 2021. Overall, the net position of governmental activities is reported as a deficit of $199.2 billion. (Exhibit 1) • The General Fund deficit decreased by $3.3 billion from June 30, 2020, to June 30, 2021. The General Fund deficit is $3.1 billion. (Exhibit 2) REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING AND ON COMPLIANCE In accordance with Government Auditing Standards, a report on our consideration of the State of Illinois’ internal control over financial reporting and our tests of its compliance is also issued as part of our financial statement audit. This report is a separate document and is summarized in this document. Our report noted the State’s decentralized internal control system is not adequate. We also reported significant financial reporting deficiencies at several State agencies. STATE OFFICIALS As of June 30, 2021 Governor: JB Pritzker Comptroller: Susana A. Mendoza Speaker of the House: Emanuel Chris Welch President of the Senate: Don Harmon House Republican Leader: Jim Durkin Senate Republican Leader: Dan McConchie FINANCIAL ANALYSIS OF THE STATE The net position of the State’s governmental activities declined $1.7 billion. The following condensed financial information was derived from the government-wide Statement of Net Position and reflects the State’s governmental activities financial position as of June 30 for Fiscal Years 2014 through 2021. (Please see PDF version of this digest for a graphical depiction of data.) The deficits reflected in Exhibit 1 are presented on an accrual basis and represent the excess of total liabilities and deferred inflows of resources over total assets and deferred outflows of resources at a given point in time. These deficits represent the deferral of current and prior year costs to future periods. GENERAL FUND Many programs are accounted for in the General Fund. The GAAP basis financial position of the General Fund deficit decreased at June 30, 2021, from June 30, 2020. The fund balance deficit in the State’s General Fund decreased by $3.3 billion on a GAAP basis. The June 30, 2021, deficit was $3.1 billion. Exhibit 2 reflects the General Fund deficit for Fiscal Years 2014 through 2021. (Please see PDF version of this digest for a graphical depiction of data.) STATE COMPARISON Exhibit 3 provides an analysis of the State’s governmental activities net position at June 30, 2021, compared to other States. (Please see PDF version of this digest for a graphical depiction of data.) FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE FINANCIAL REPORTING PROCESS The State of Illinois’ current financial reporting process does not allow the State to prepare a complete and accurate Annual Comprehensive Financial Report (ACFR) in a timely manner. Reporting issues at various individual agencies caused delays in finalizing the financial statements. The lack of timely financial reporting limits effective oversight of State finances. In addition, the Comptroller had weaknesses in the internal control over its change control and information technology environment. Accurate and timely financial reporting problems continue to exist even though the auditors have (1) continuously reported numerous findings on the internal controls (material weaknesses and significant deficiencies), (2) commented on the inadequacy of the financial reporting process of the State, and (3) regularly proposed adjustments to the financial statements year after year. These findings have been directed primarily towards major State agencies under the organizational structure of the Governor and towards the Comptroller. The Comptroller has made significant changes to the system used to compile financial information; however, the State has not solved all the problems to effectively remediate these financial reporting weaknesses. The State has a highly decentralized financial reporting process due to the use of numerous financial reporting systems, many of which are not interrelated and require manual intervention to convert data. The process is also overly dependent on the post audit program, even though the Office of the Auditor General has repeatedly informed State agency officials that the post audit function is not a substitute for appropriate internal controls at State agencies. Annual financial reporting to the Comptroller requires the State’s agencies to prepare a series of financial reporting forms (SCO forms) designed by the Comptroller, which are utilized to prepare the ACFR. Although these SCO forms are subject to review by the Comptroller’s financial reporting staff during the ACFR preparation process and there are recommended minimum qualifications for all new generally accepted accounting principles (GAAP) coordinators who oversee the preparation of the SCO forms, the current process still lacks sufficient internal controls at individual agencies. In addition, we noted the Comptroller had information security weaknesses and inadequate processes and procedures for network changes and system development, including authorizations, approvals, segregation of duties, and backout and mitigation plans (Finding 1, pages 7-10). This finding has been reported since 2007. We recommended the Governor and the Comptroller continue to work together to resolve the State’s inability to produce timely and accurate GAAP-basis financial information. In addition, we recommended the Comptroller improve controls over information security, maintain adequate documentation of network changes, ensure policies and procedures are adequate and reflect the current operating environment, and ensure proper segregation of duties between the programmers. The Office of the Governor agreed with the recommendation, and stated they will continue to work with the Comptroller, and individual State agencies that have the most pressing challenges, to address the core issues of the State’s inability to produce timely and accurate GAAP-basis financial information. The Office of the Governor also stated the State agencies under the Governor are in the midst of a multi-year implementation of an Enterprise Resource Planning (ERP) system—an integrated enterprise- wide system that includes a financial accounting component. Currently, 65 State agencies, representing approximately 99.7% of the budget under the Governor’s purview, have “gone live” and begun using the financial accounting component of ERP. On July 1, 2022, 8 additional agencies will be added to ERP, such that all agencies that were originally included in the implementation plan for the new system will have the opportunity to utilize ERP’s accounting functions. Agencies will continue to assess how ERP can support them in the production of timely and accurate GAAP reporting. Further, the Governor anticipates that all agencies subject to the Grant Accountability and Transparency Act will join the Statewide grants management system, currently under development, in Fiscal Year 2024. The system will pull data from ERP, promoting consistency across state systems. Upon full implementation, the two systems are expected to improve internal controls and will better support the agencies’ production of accurate and timely financial statements. The Governor notes that it does not possess the authority to direct or control the financial reporting processes within the other constitutional offices. The Comptroller accepted the recommendation. The State still faces several roadblocks in the timely completion of the Annual Comprehensive Financial Report. The General Assembly enacted P.A. 97-0691, which extended lapse period from August 31 to December 31 for Fiscal Year 2013 and future fiscal years for medical assistance payments of the Department of Healthcare and Family Services. Public Act 96-1501 extended the lapse period to October 31 for Fiscal Year 2021 for medical payments of the Department of Veterans’ Affairs and medical, childcare, and substance abuse treatment payments of the Department of Human Services. As a result of these extensions, the preparation and completion of critical financial schedules will continue to be delayed. In addition, the General Assembly enacted P.A. 102-0016, which extended lapse period from August 31 to September 30 for Fiscal Year 2021 for all State agencies, further delaying the financial reporting process. More importantly, the Annual Comprehensive Financial Report completion continues to be delayed because of financial reporting issues identified during individual State agency financial and compliance audits. The report cannot be finalized until these issues are resolved at the individual State agency reporting level. The Comptroller will continue to work with the Governor’s Office, the Auditor General’s Office, and agency GAAP coordinators to improve the timeliness, quality, and processing of financial reporting for the State. In addition, the Comptroller will work to improve written documentation of processes and procedures as they relate to information systems. FINANCIAL REPORTING WEAKNESSES The State of Illinois did not have adequate controls to assess the risk that information reported by individual agencies of the primary government would not be fairly stated and compliant with generally accepted accounting principles (GAAP). The Office of the Auditor General performed 24 audits at agencies of the primary government, including the five pension systems and the Illinois State Board of Investment. During these audits, we noted a total of 20 material weaknesses and 10 significant deficiencies related to the internal controls over the financial reporting process at 13 of the agencies. Specifically, some of the more significant issues noted included the following: • The Department of Healthcare and Family Services and the Department of Human Services failed to execute adequate internal controls over the Integrated Eligibility System. • The Department of Healthcare and Family Services and the Department of Human Services failed to execute adequate internal controls over the operation of the Illinois Medical Program Advanced Cloud Technology system. • The State Board of Education did not exercise adequate internal control over the State’s Evidence-Based Funding Formula. Material weaknesses and significant deficiencies further extend financial reporting timelines since additional measurements and reporting are required. Completion or substantial completion of these audits is necessary for the Auditor General to issue an opinion on the State’s basic financial statements. In addition to the deficiencies noted above, material misstatements were identified by the auditors at one agency. The adjustments totaled $332.5 million for the Business-Type Activities and Water Revolving Fund and $15.7 million for Fiduciary Funds (Finding 2, pages 11-16). This finding has been reported since 2002. We recommended the State continue its efforts to improve internal control procedures in order to assess the risk of material misstatements to the financial statements and to identify such misstatements during the financial statement preparation process. We further recommended the internal control procedures include a formal evaluation of prior problems and implementation of procedures to reduce the risk of these problems reoccurring. The Office of the Governor agreed with our recommendation and stated they will continue to work together with the Office of Comptroller and the State agencies under its jurisdiction to improve Statewide internal control procedures and reduce the likelihood of material misstatements to the financial statements. The State agencies under the Governor are in the midst of a multi-year implementation of an Enterprise Resource Planning (ERP) system—an integrated enterprise- wide system that includes a financial accounting component. Currently, 65 State agencies, representing approximately 99.7% of the budget under the Governor’s purview, have “gone live” and begun using the financial accounting component of ERP. On July 1, 2022, 8 additional agencies will be added to ERP, such that all agencies that were originally included in the implementation of the new system will have the opportunity to utilize ERP’s accounting functions. Agencies will continue to assess how ERP can support them and help them to assess the risk of material misstatements and identify such misstatements during the reporting process. Further, the Governor anticipates that all agencies subject to the Grant Accountability and Transparency Act will join the Statewide grants management system, currently under development, in Fiscal Year 2024. The system will pull data from ERP, promoting consistency across state systems. Upon full implementation, the two systems are expected to improve internal controls and will better support the agencies’ ability to avoid misstatements in the financial reporting process. The Office of Comptroller accepted our recommendation and stated they will continue to assist the Governor’s Office in their efforts to increase the quality of GAAP packages by providing enhanced training and technical assistance to State agencies. INADEQUATE CONTROLS OVER PANDEMIC UNEMPLOYMENT ASSISTANCE The Illinois Department of Employment Security (IDES) failed to maintain adequate controls over Pandemic Unemployment Assistance systems and failed to maintain accurate and complete claimant data. We noted the following problems related to the COVID-19 Pandemic: • The IDES contracted with a service provider for a system for issuing Pandemic Unemployment Assistance (PUA). The IDES did not obtain a System and Organization Controls (SOC) review of the system from the service provider; therefore, we conducted testing over the general Information Technology (IT) controls of the system. During testing, we noted the system had weaknesses regarding change control and user access. Further, the IDES had not developed a disaster recovery plan in order to recover the system in the event of a disaster. • From June 2021 through January 2022, the IDES attempted to provide complete and accurate PUA claimant data in order to determine if the claimants were properly determined eligible. After several attempts and considerable manipulation of the data to make the data more auditable and organized, it was determined complete and accurate PUA claimant data could not be provided. Therefore, auditors were unable to conduct detailed testing to determine whether the PUA claimants were entitled to benefits (Finding 5, pages 21-22). We recommended IDES work to improve its controls over Pandemic Unemployment Assistance systems, eligibility, and financial reporting. As a result of the COVID-19 Pandemic, the State’s unemployment rate jumped to a historically high rate of 17.4 percent in April 2020. While unemployment rates began to fall through Fiscal Year 2021, implementing federal programs created in response to the unprecedented COVID-19 public health emergency strained the resources of IDES, as well as those of unemployment agencies across the country. The United States Department of Labor (DOL) Office of Inspector General noted that both DOL and states struggled to implement federal pandemic unemployment programs and specifically noted that the DOL guidance and oversight failed to ensure states implemented the federal programs promptly and accurately. Despite these challenges, throughout 2021, IDES took significant steps to improve internal controls over the stand-alone PUA system and PUA financial reporting and implemented updated federal guidance regarding PUA eligibility. While PUA program eligibility ended in September 2021, the Department continues to work with eligible individuals through the State’s unemployment insurance program, while at the same time integrating additional identity verification and identity management tools to safeguard the program’s resources. The Governor has supported the Department’s efforts and will continue to work with the IDES, the General Assembly, US DOL, and the Congressional Delegation to support the integrity of all federal and State unemployment insurance programs administered by IDES. OTHER FINDINGS The remaining findings pertain to late payment of statutorily mandated transfers, insufficient controls over finances, and lack of controls over census data. We will review the State’s progress towards the implementation of our recommendations in our next financial audit. This financial audit was conducted by the Office of the Auditor General’s staff. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:skm