Background In May 2012, OMB embarke

Background
In May 2012, OMB embarked on performing an independent risk assessment and internal Controls and Performance Audit of DOR. This initiative related to concerns that arose over the Organization’s information technology (IT) systems and financial operations after two significant financial errors were discovered.
DOR is the state entity that collects and accounts for the majority of general fund tax revenues for the State of Indiana (the “State”). DOR is responsible for assessing and collecting the taxes and transferring them into proper funds so that they may be utilized by the State and, when required, local governments as prescribed by statute. It is also responsible for managing taxpayer accounts and for generating reports that are utilized to distribute certain local revenues, such as local option income taxes (LOITs), food and beverage, auto rental, professional sports development areas, etc., back to local governments.
DOR has strategically focused its efforts on increasing customer satisfaction and serving its customer, the Indiana taxpayer. In recent years they streamlined operational areas, which resulted in more efficient returns processing and an enhanced taxpayer experience. Since 2008, DOR has significantly reduced the time frame for processing returns while also cutting the processing cost per return. With their focus primarily on processing taxes, support areas such as information systems management and financial accounting and reporting appear to have been a lower priority for the Organization. Without this same degree of focus, the control environment and importance of financial and IT controls were not as rigorous in preventing or detecting errors within the financial accounting systems.
Within the past year, DOR discovered two significant errors regarding corporate tax and LOIT distributions. Specifically, DOR discovered that $320 million of corporate tax e-file payments were not transferred from a holding account, thereby overstating the account balance of one account while understating the balance of another. Additionally, DOR identified that $206 million in LOITs were not distributed to local governments because programming changes related to new legislative rules were not thoroughly tested within the system and the allocation of the funds was not correctly computed. DOR has acknowledged these errors and is taking proactive measures to reclaim the trust of the taxpayers and the legislature.
As a result of DOR’s challenges, a new Revenue Commissioner and Chief Financial Officer were hired in May 2012, soon followed by a new Chief Information Officer, two Deputy Controllers and a Strategic Transformation Initiatives Leader. Additionally, some supervisory and management staff have also turned over, with new individuals being placed into those positions. This new management team is focused on evaluating and correcting the identified errors while identifying other risks requiring remediation.
OMB initiated an independent and objective Risk Assessment along with a Controls and Performance Audit of DOR to analyze the circumstances and corrective actions necessary for the identified errors along with the identification of additional risks and concerns that may exist in DOR. OMB’s expectation is that the final Controls and Performance Audit report will provide recommendations for improving IT and financial controls and other recommendations deemed
Background
appropriate to include replacement of IT system(s), Organizational/structural changes, legislative changes, etc. As such, Deloitte & Touche was contracted to perform the requested services, starting with a risk assessment and continuing into the Controls and Performance Audit.
The risk assessment process identified and risk ranked eighteen key business processes for the Organization’s performance audit universe. Nine key business processes were identified as high risk, eight were identified as medium risk, and one was identified as low risk. Furthermore, several general risk themes became apparent and relate to one of the following fundamental questions:
• Does the Organization have the right strategy and governance mechanisms in place to achieve its mission?
• Does the Organization have the right processes and technologies in place to support its strategies?
• Does the Organization have the right people in place to execute the processes and technologies in accordance with the Organization’s expectations?
The Controls and Performance Audit further examined these risk themes along with the specific risks identified within the risk assessment and the ensuing report presents the results of this work.