REPORT DIGEST ILLINOIS DEPARTMENT OF VETERANS’ AFFAIRS STATE COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2022 Release Date: April 13, 2023 FINDINGS THIS AUDIT: 32 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 1 -- 1 -- 2 Category 2: 11 -- 19 -- 30 Category 3: 0 -- 0 -- 0 TOTAL: 12 -- 20 -- 32 FINDINGS LAST AUDIT: 25 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (22-2) The Department did not exercise adequate controls over its voucher processing during the examination period. • (22-8) The Department failed to complete annual performance evaluations timely. • (22-15) The Department did not exercise adequate control over the recording, reporting, and inventorying of State Property. • (22-22) The Department did not provide adequate planning for the recovery of its applications and data. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS VOUCHER PROCESSING WEAKNESSES The Illinois Department of Veterans’ Affairs (Department) did not exercise adequate controls over its voucher processing during the examination period. We conducted an analysis of the Department’s expenditure data for Fiscal Year 2021 and Fiscal Year 2022 and noted the following: • The Department did not timely approve 3,004 of 15,454 (19%) vouchers processed during Fiscal Year 2021. The vouchers were submitted to the Office of Comptroller (Comptroller) between 31 and 422 days late. • The Department did not timely approve 1,773 of 13,143 (13%) vouchers processed during Fiscal Year 2022. The vouchers were submitted to the Comptroller between 31 and 366 days late. (Finding 2, pages 17-18) We recommended the Department process proper bills within 30 days of receipt. The Department accepted our recommendation and stated it would take the necessary steps to comply with statutory requirements. EMPLOYEE PERFORMANCE EVALUATIONS NOT PERFORMED TIMELY The Department failed to complete annual performance evaluations timely. During our testing of 40 employee personnel files containing 70 evaluations, we noted the following: • Evaluations were not performed on a timely basis for 17 of 70 (24%) evaluations tested. The evaluations were performed from 10 to 141 days late. • The evaluation was not signed by the employee for five of 70 (7%) evaluations tested. • The Department could not provide evidence that it had completed evaluations for four of 40 (10%) employees tested. • The Department did not complete an evaluation for two of 40 (5%) employees during the examination period. • The evaluation was improperly dated for one of 70 (1%) evaluations tested. The evaluation period ended June 30, 2022; however, the evaluation was dated by the supervisor June 14, 2023. (Finding 8, pages 28-29) This finding has been reported since 2008. We recommended the Department take appropriate measures to ensure performance evaluations are conducted timely. The Department accepted our recommendation and stated it put measures in place to strengthen controls and tracking related to the timely completion of employee performance evaluations to ensure compliance. INADEQUATE CONTROLS OVER THE PURCHASE, RECORDING, AND REPORTING OF STATE PROPERTY The Department did not exercise adequate control over the recording, reporting, and inventorying of State property. A few issues we noted during our testing of State property follow: • During testing of additions to the Department’s property records, we noted that five of 40 (13%) assets tested totaling $5,686 were not added timely to property records, ranging from 145 to 1,097 days late. • In its Calendar Year 2021 (Fiscal Year 2020) Annual Inventory Report submitted to the Department of Central Management Services (CMS), the Department reported it was unable to locate 159 items totaling $91,368, which represents 2.1% of the Department’s total property. One of these items was information technology (IT) related equipment that could potentially store confidential information. • In its Calendar Year 2022 (Fiscal Year 2021) Annual Inventory Report submitted to CMS, the Department reported it was unable to locate 222 items totaling $192,695. This represents 2.54% of the Department’s total property. Ten of these items were IT related equipment that could potentially store confidential information. (Finding 15, pages 47-52) This finding has been reported since 2008. We recommended the Department strengthen internal control over the recording and reporting of State property by strengthening its inventory and recordkeeping practices to ensure compliance with statutory and regulatory requirements. The Department accepted our recommendation and stated it was working to fill key positions and get the new employees properly trained on inventory and recordkeeping practices to ensure compliance with statutory and regulatory requirements. The Department also stated it had created an internal focus group to implement procedures that are in compliance with statutory and regulatory requirements. LACK OF DEPARTMENT-WIDE DISASTER RECOVERY PLAN OR TESTING TO ENSURE RECOVERY OF APPLICATIONS AND DATA The Department did not provide adequate planning for the recovery of its applications and data. During our testing, we noted the following: • The Department had not developed a Department-wide disaster recovery plan or performed disaster recovery testing during the examination period. • The Department had application specific recovery plans for four applications; however, these plans lacked some elements such as training requirements and testing schedules. • The Department provided an updated Business Impact Analysis (BIA) dated August 30, 2021. The BIA documented seven business areas and 40 business functions and applications that support them. However, the Department had not fully incorporated the results of its BIA into its contingency plans. (Finding 22, pages 64-65) This finding has been reported since 2018. We recommended the Department develop a Department-wide Recovery Plan and incorporate the results of its BIA to ensure recovery plans reflect the needs of the Department. In addition, we recommended disaster recovery testing of critical systems and components be conducted and documented at least annually. The Department accepted our recommendations and stated it had initiated contact with the Department of Innovation and Technology for assistance in both strengthening existing disaster recovery plans and developing plans for the remaining systems. Additionally, the Department stated it would update the 2021 BIA as needed and continue to incorporate the results into its contingency plans. OTHER FINDINGS The remaining findings are reportedly being given attention by Department personnel. We will review the Department’s progress towards the implementation of our recommendations in our next State compliance examination. ACCOUNTANT’S OPINION The accountants conducted a State compliance examination of the Department for the two years ended June 30, 2022, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Findings 2022-002 and 2022-015. Except for the noncompliance described in these findings, the accountants stated the Department complied, in all material respects, with the requirements described in the report. This State compliance examination was conducted by Sikich LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:dmg