REPORT DIGEST

COMMISSION ON EQUITY AND INCLUSION

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2025

Release Date:  September 1, 2026

FINDINGS THIS AUDIT: 8

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  0 -- 1 -- 1
Category 2:  3 -- 4 -- 7
Category 3:  0 -- 0 -- 0
TOTAL:  3 -- 5 -- 8

FINDINGS LAST AUDIT: 6

State of Illinois, Office of the Auditor
General
CHRISTOPHER B. MEISTER, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov

SYNOPSIS

• (25-1)  The Commission had weaknesses
related to information technology (IT)
functions.

• (25-2)  The Commission demonstrated
weaknesses related to personal services.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

WEAKNESSES IN THE INFORMATION TECHNOLOGY
FUNCTION

The Commission on Equity and Inclusion
(Commission) had weaknesses related to
information technology (IT) functions.

User Access Reviews

During fieldwork, we examined the
Commission’s system access controls over
five significant applications with a
material impact on the Commission’s
financial information and/or operations.

During our user access review testing, we
noted there were no documented annual
access reviews performed for these
applications. Furthermore, the Commission
did not oversee the review of its Active
Directory accounts, nor did it complete
any reviews or provide supporting
documentation.

During our user access testing, the
Commission was unable to provide a user
access listing for one application.
Specifically, the Commission indicated it
could not generate or obtain a complete
population of users or supporting
information necessary to perform user
access testing.

As a result, we were unable to determine
whether user access to this system was
appropriately authorized, consistent with
job responsibilities, or timely removed
for separated employees.

Service Organization Control Reports

During the examination period, we noted
the Commission had not conducted
independent internal control reviews of
System and Organization Control (SOC)
reports issued by the Department of
Innovation and Technology (DoIT), an
information technology service provider,
and by a third-party external service
provider. Additionally, the Commission had
not assessed the impact of SOC report
opinions on its operations or considered
the applicability of Complementary User
Entity Controls (CUECs). Furthermore, the
Commission did not identify subservice
organizations or perform procedures to
evaluate their impact on its internal
control environment.

Identity Protection Policy

The Commission did not establish or
formally adopt a written Identity
Protection Policy during the examination
period. While the Commission indicated it
follows DoIT guidance, it did not have a
policy specific to its operations
governing the protection and handling of
personal information.

Backups

The Commission did not maintain
documentation demonstrating backups were
successfully completed for one system.
Additionally, the Commission did not
perform or document backup testing or
verification procedures.

Cybersecurity

The Commission had not established an
adequate cybersecurity program during the
examination period. Specifically, the
Commission had not:

* established or documented cybersecurity
roles and responsibilities;
* developed and implemented a formal
cybersecurity plan;
* formally adopted a risk management
methodology;
* performed a cybersecurity risk
assessment or engaged a third party to
perform one; or,
* classified its data or developed a data
classification methodology.

Confidential Information Tracking

The Commission did not establish guidance
for properly handling confidential,
sensitive, and Personally Identifiable
Information (PII), including:

* classification of applications and data
based on criticality and sensitivity in
accordance with DoIT standards;
* avoidance of unnecessary collection of
PII; and,
* minimization of PII use in testing,
training, and research. (Finding 1, pages
8-11)

We recommended the Commission strengthen
its IT controls and governance to ensure
systems and data are adequately protected
and managed in compliance with State laws
and standards. Specifically, the
Commission should:

* implement formal user access review
procedures;
* ensure complete and accurate system
access listings;
* establish procedures to obtain, review,
and assess SOC reports, including
complementary user controls and subservice
organizations;
* develop and adopt an Identity Protection
Policy;
* ensure backups are performed,
documented, and tested;
* establish and document a cybersecurity
program, including
  -- establish and document roles and
  responsibilities,
  -- develop and implement a formal
  cybersecurity plan,
  -- formally adopt a risk management
  methodology,
  -- perform a cybersecurity risk
  assessment, and
  -- classify data with a developed data
  classification methodology; and
* establish guidance for properly handling
confidential, sensitive, and PII.

The Commission accepted the finding and
recommendation. The Commission stated it
has a project manager with IT expertise
contracted for FY2027 that will enable it
to work with DoIT to fulfill the
recommendation in a timely manner.

WEAKNESSES RELATED TO PERSONAL SERVICES

The Commission demonstrated weaknesses
related to personal services.

Timesheets

During our testing of timesheets, we noted
one of six (17%) employees tested did not
submit their timesheet within one week of
the last day covered by the timesheet. The
timesheet was submitted four business days
late based on the Commission’s expected
weekly submission cycle. Additionally, we
noted one of six (17%) employee timesheets
tested was submitted without a signature
or signature date; therefore, we were
unable to determine whether the timesheet
was submitted timely.

Employee Performance Evaluations

During our testing of employee performance
evaluations, we noted the following
exceptions:

* Two of six (33%) employees tested did
not have evaluations completed in a timely
manner. The evaluations were completed 31
and 114 days late.
* One of six (17%) employees tested did
not sign and date the evaluation;
therefore, we were unable to determine
whether the evaluation was completed
timely.
* One of six (17%) employees did not have
an evaluation completed during the
examination period. (Finding 2, pages
12-13)

We recommended the Commission strengthen
controls over personal services to ensure
compliance with applicable laws,
regulations, and internal policies.
Specifically, the Commission should
implement procedures to ensure timesheets
are submitted completely including date
and signature, appropriately approved, and
in a timely manner; and ensure employee
performance evaluations are timely
completed, signed and dated, and retained
in accordance with required timeframes.

The Commission accepted the finding and
recommendation and stated the Commission’s
HR staff regularly sends reminders to
supervisors concerning timely eTime
submissions. The Commission further stated
it also sends email reminders to
supervisors advising them of employee
evaluation due dates. The Commission
stated it will continue this cadence to
ensure compliance with the applicable
statutes.

OTHER FINDINGS

The remaining findings are purportedly
being given attention by Commission
personnel.  We will review the
Commission’s progress towards the
implementation of our recommendations in
our next State compliance examination.

ACCOUNTANT’S OPINION

The accountants conducted a State
compliance examination of the Commission
for the two years ended June 30, 2025, as
required by the Illinois State Auditing
Act.  The accountants qualified their
report on State compliance for Finding
2025-001.  Except for the noncompliance
described in this finding, the accountants
stated the Commission complied, in all
material respects, with the requirements
described in the report.

This State compliance examination was
conducted by Sikich CPA LLC.

COURTNEY DZIERWA
Deputy Auditor General

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

CHRISTOPHER B. MEISTER
Auditor General

CBM:meg