REPORT DIGEST

GENERAL ASSEMBLY – HOUSE OF
REPRESENTATIVES

COMPLIANCE EXAMINATION
FOR THE TWO YEARS ENDED JUNE 30, 2025

Release Date:  November 5, 2026

FINDINGS THIS AUDIT: 5

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  0 -- 0 -- 0
Category 2:  2 – 3* -- 5
Category 3:  0 -- 0 -- 0
TOTAL:  2 -- 3 -- 5

FINDINGS LAST AUDIT: 4

* Note: Findings 2023-001 and 2023-002
were repeated and combined into Finding
2025-001.

State of Illinois, Office of the Auditor
General
CHRISTOPHER B. MEISTER, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov

SYNOPSIS

• (25-2) The House of Representatives did
not implement adequate internal controls
over its service providers.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

INADEQUATE CONTROLS OVER SERVICE PROVIDERS

The House of Representatives had not
implemented adequate internal controls
over its service providers.

We requested the System and Organization
Control (SOC) reports and documentation of
the review and assessment of all service
providers and noted the following:

House Democratic Leadership identified 14
service providers. It obtained SOC reports
from the 14 service providers but did not
perform a review and assessment thereof.

House Republican Leadership identified 10
service providers.

• For 2 of 10 (20%) Service Providers, it
did not obtain SOC reports from its
service providers or conduct independent
internal control reviews of the service
providers.
• Although the Republican Leadership
provided its SOC report review for 8 SOC
reports, 7 (88%) SOC reports were not
provided for testing. As a result, we were
unable to determine whether the reviews
performed by the Republican Leadership
were adequate.
• For the 1 SOC report which was provided
for our review, we noted that the
Republican Leadership had not performed an
adequate review of control exceptions
identified in the SOC report to determine
their impact on data security and
integrity and any necessary mitigating
controls by the Republican Leadership’s
office. (Finding 2, pages 16-18).

We recommended the House implement
internal controls over service providers
to include the following:

• Review contracts with service providers
to ensure applicable requirements over the
independent review of internal controls
are included.
• Obtain SOC reports or perform
independent reviews of internal controls
associated with service providers at least
annually.
• Assess and document the operation of the
complementary user entity controls
relevant to the House’s operations.
• Assess and document the evaluation of
the impact on the House’s internal control
environment of the subservice providers.
• Analyze the SOC reports obtained to
determine and document the impact of the
report’s opinion and noted deviations to
the House’s operations.
• Provide to the accountants all necessary
support to document whether appropriate
measures have been taken by the House to
ensure integrity and safeguarding of data.

The Office of the House Republican Leader
accepted the finding and stated it will
continue to work with vendors and its
legal staff on procedures regarding the
sharing and review of SOC reports.

The House Democratic Leadership agreed and
stated it performed a review and
assessment of each of the 14 service
providers but failed to formally document
that the review and assessment took place.
It further stated that House Democratic
Leadership will ensure that formal
documentation of the reviews is completed.
An accountant’s comment stated that given
the lack of documentation, the accountants
were unable to obtain assurance that a
review and assessment of the 14 service
providers was performed during the
examination period or to evaluate the
sufficiency thereof.

OTHER FINDINGS

The remaining findings pertain to personal
services, reconciliations, and
cybersecurity.  We will review the House’s
progress towards the implementation of our
recommendations in our next State
compliance examination.

ACCOUNTANT’S OPINION

The accountants conducted a State
compliance examination of the House for
the two years ended June 30, 2025, as
required by the Illinois State Auditing
Act. The accountants stated the House
complied, in all material respects, with
the requirements described in the report.

This State compliance examination was
conducted by Adelfia LLC.

DENNIS GIBBONS
Director of Financial and Compliance
Audits

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

CHRISTOPHER B. MEISTER
Auditor General

CBM:lkw