Can multiple Illinois state agencies share a single chief internal auditor through an intergovernmental agreement instead of each appointing their own?

Subject

Authority of Multiple Designated State Agencies to Appoint the Same Individual as their Chief Internal Auditor

Category

STATE MATTERS

Plain-English summary

Illinois Auditor General Frank Mautino had flagged a 2018 audit finding: the Department of Insurance had no chief internal auditor and was instead receiving internal audit services from the Department of Central Management Services (CMS) under an intergovernmental agreement. The CMS chief internal auditor was simultaneously serving as the chief internal auditor for eight other agencies, including Agriculture, Corrections, Financial and Professional Regulation, Human Rights, Labor, and the Illinois Finance Authority. Mautino asked the Attorney General whether that arrangement satisfied the Fiscal Control and Internal Auditing Act.

The AG said no. The statute requires each "designated State agency" to maintain a "full-time" internal audit program and the chief executive of each such agency must "appoint a chief internal auditor." One person doing the job for nine agencies could not be running a full-time program for any one of them. The Intergovernmental Cooperation Act allows agencies to combine resources, but only when doing so does not violate other statutory limits. Sharing one chief internal auditor among multiple designated agencies violated the limits in this Act. If the state wanted to consolidate, the AG said, the General Assembly would have to authorize it, or the Governor could use the Executive Reorganization Implementation Act process.

Currency note

This opinion was issued in 2019. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Background and statutory framework

The Fiscal Control and Internal Auditing Act (30 ILCS 10/1001 et seq.) sits at the center of the opinion. Subsection 1003(a) lists which agencies count as "designated State agencies": the offices of the Secretary of State, Comptroller, Treasurer, and Attorney General; the State Board of Education; state colleges and universities; the Toll Highway Authority; public retirement systems; the Illinois Finance Authority; the Capital Development Board; the Illinois Housing Development Authority; the Department of Military Affairs; the State Fire Marshal; the Illinois Student Assistance Commission; the EPA; and "each Department of State government created in Article 5, Section 5-15 of the Civil Administrative Code of Illinois." The Department of Insurance is one of those Article 5 departments.

Section 2001(a) requires each designated agency to "maintain a full-time program of internal auditing." Section 2002(a) requires the chief executive officer of each such agency to "appoint a chief internal auditor." That auditor reports directly to the chief executive, serves a five-year term, and can only be removed for cause after a hearing before the Executive Ethics Commission. Section 2001(b) lets non-designated agencies use CMS for internal audits.

The history of these rules matters. In 2003, Governor Blagojevich's Executive Order 2003-10 had moved internal auditors from agencies under his control into CMS, creating a centralized "Illinois Office of Internal Audits." But the General Assembly reversed that in 2010 (Public Act 96-795), adding subsection 2001(a-5), which sent the auditors back to their home agencies. The legislative debate explicitly described it as undoing Blagojevich's consolidation.

Two CMS-side statutes were also relevant:

• 20 ILCS 405/405-293 defines internal audits as professional services, but the AG held that this section did not authorize CMS to perform them for designated agencies. The earlier transfer of audit functions under Executive Order 2003-10 had been reversed. Governor-approved "additional services" could not include internal audits because the statute separately classified them as professional services. The opinion also noted that CMS had not shown Governor approval for the arrangement examined.

• 20 ILCS 405/405-15 lets CMS perform internal audits "when so requested by the Governor or the chief executive officer of a State agency." The AG read this authority alongside the Act's appointment requirement.

Why the AG reached this conclusion

The AG ran the question through several layers of statutory construction.

First, plain meaning. "Full-time" is not defined in the Act. Using Webster's, the AG noted that "full-time" commonly means "engaged in work for specified periods regarded as taking all of one's regular working hours." A chief internal auditor running internal audits across nine agencies cannot dedicate full-time effort to any single one. So the CMS arrangement was at best a part-time program for each of the agencies sharing him, contrary to the explicit "full-time" requirement.

Second, the mandatory verb "shall." Section 2002(a) says the chief executive officer of each designated state agency "shall appoint a chief internal auditor." The Illinois Supreme Court treats "shall" as mandatory absent a contrary signal. Nothing in the Act authorizes skipping the appointment or contracting around it.

Third, reading the Act as a whole. Subsection 2001(b) lets "agencies which do not have full-time internal audit programs" use CMS. Read in context with subsection 2001(a) (which requires designated agencies to have full-time programs), the AG concluded subsection 2001(b) was talking about non-designated agencies (examples given: the Illinois Law Enforcement Training Standards Board, the Illinois Racing Board), not designated agencies opting out. Reading it the other way would render the section 2001(a) requirement meaningless.

Fourth, the 2010 reversal of Executive Order 2003-10. Subsection 2001(a-5) returned the auditors to their home agencies and added that "if an auditor does not have a designated State agency or has more than one designated State agency, then the chief executive officer of a State agency shall appoint such person as the chief internal auditor of a State agency." That language anticipated a one-auditor-one-agency model. Allowing one CMS auditor to be chief for nine agencies would resurrect the very system the General Assembly had explicitly dismantled.

Fifth, the Intergovernmental Cooperation Act. While that statute lets agencies pool authority, an intergovernmental agreement cannot authorize what the underlying substantive statutes prohibit. Earlier AG opinions (1991 and 1976) had reached the same general conclusion: cooperation cannot dissolve other statutory limits.

Sixth, the CMS Law itself. Section 405-293(a) concerns professional services for functions transferred to CMS by Executive Order No. 2003-10. Public Act 96-795 had returned the internal audit functions, so that clause no longer applied to them. The AG also concluded that internal audits, expressly defined as professional services, could not count as Governor-approved "additional services" under the same section. CMS had not shown Governor approval in any event. Section 405-15 allows requested internal audits in limited circumstances, but does not let CMS replace a designated agency's appointed chief internal auditor.

The AG closed with a roadmap. If designated agencies want to share or consolidate internal audit functions, they can either get authorizing legislation from the General Assembly or use the constitutional reorganization process under article V, section 11, of the Illinois Constitution, in combination with the Executive Reorganization Implementation Act. They cannot simply contract around the Act through an intergovernmental agreement.

Common questions

Which agencies were affected by the audit finding that prompted this opinion?

The 2018 audit report identified the CMS chief internal auditor as also serving as the chief internal auditor for the Departments of Agriculture, Corrections, Financial and Professional Regulation, Human Rights, Insurance, and Labor, plus the Illinois Finance Authority, in addition to CMS itself. Each of those is a designated state agency under the Act.

Did the opinion say CMS could never perform internal audits for another agency?

No. Section 405-15 of the CMS Law lets CMS perform internal audits when requested by the Governor or an agency CEO. The opinion says that does not permit CMS to replace a designated agency's appointed chief internal auditor. It also concluded that section 405-293 did not authorize CMS to perform internal audit services for designated agencies under the arrangement examined.

What if the General Assembly later wanted to allow shared chief internal auditors?

The opinion expressly said that path was open: authorizing legislation. Or the Governor could use article V, section 11, of the constitution, which lets executive orders reassign functions among directly responsible agencies, subject to General Assembly disapproval. That was how the consolidation worked in 2003 before Public Act 96-795 reversed it.

Could the auditor general have flagged this through other means?

Yes, and the audit findings already had. Finding 2018-004 of the Department of Insurance compliance examination identified the Act violation. The AG's opinion gave Mautino's office a formal legal interpretation backing the audit conclusion.

Did the opinion say CMS could not approve the absence of a chief internal auditor at the Department of Insurance?

The Department of Insurance, as a designated state agency, had a statutory duty to maintain a full-time program and appoint a chief internal auditor. The opinion concluded the Act did not allow it to substitute the CMS chief internal auditor through an intergovernmental agreement. Whether the Department was in violation was the audit's conclusion. The opinion was the legal basis for that conclusion.

Citations

• Fiscal Control and Internal Auditing Act, 30 ILCS 10/1001 et seq., specifically §§1002, 1003, 2001, 2002, 2003, 2005, 3001
• Illinois State Auditing Act, 30 ILCS 5/1-1 et seq., §1-7
• Civil Administrative Code, 20 ILCS 5/5-15, 5-655
• Intergovernmental Cooperation Act, 5 ILCS 220/1 et seq., §§2, 3
• Department of Central Management Services Law, 20 ILCS 405/405-15, 405-293
• Executive Reorganization Implementation Act, 15 ILCS 15/1 et seq., §5.5
• Ill. Const. 1970, art. V, §11
• Public Act 86-936 (effective January 1, 1990)
• Public Act 96-795 (effective July 1, 2010)
• Public Act 93-586 (effective August 22, 2003)
• Executive Order No. 2003-10 (March 31, 2003)
• 1991 Ill. Att'y Gen. Op. 216
• 1991 Ill. Att'y Gen. Op. 158
• 1976 Ill. Att'y Gen. Op. 51
• Ill. Att'y Gen. Op. No. 05-010 (December 16, 2005)

Source

• Landing page: https://illinoisattorneygeneral.gov/opinions/
• Original PDF: https://illinoisattorneygeneral.gov/dA/978577df13/2019%2019-001%20STATE%20MATTERS%20Multiple%20State%20Agencies%20to%20Appoint%20the%20Same%20Individual%20as%20Chief%20Internal%20Auditor.pdf

Original opinion text

OFFICE OF THE ATTORNEY GENERAL
STATE OF ILLINOIS

KWAME RAOUL
ATTORNEY GENERAL

August 9, 2019

FILE NO. 19-001

STATE MATTERS:
Authority of Multiple Designated
State Agencies to Appoint the Same
Individual as their Chief Internal Auditor

The Honorable Frank J. Mautino
Auditor General
Iles Park Plaza
740 East Ash Street
Springfield, Illinois 62703-3154

Dear Mr. Mautino:

I have your letter inquiring whether, pursuant to the Fiscal Control and Internal Auditing Act (the Act) (30 ILCS 10/1001 et seq. (West 2018)), multiple "designated State agencies"¹ may appoint the same individual as their chief internal auditor through the execution

¹ Subsection 1003(a) of the Act (30 ILCS 10/1003(a) (West 2018)) defines the phrase "designated State agencies" to include "the offices of the Secretary of State, the State Comptroller, the State Treasurer, and the Attorney General, the State Board of Education, the State colleges and universities, the Illinois Toll Highway Authority, the Illinois Housing Development Authority, the public retirement systems, the Illinois Student Assistance Commission, the Illinois Finance Authority, the Environmental Protection Agency, the Capital Development Board, the Department of Military Affairs, the State Fire Marshal, and each Department of State government created in Article 5, Section 5-15 of the Civil Administrative Code of Illinois [(see 20 ILCS 5/5-15 (West 2018))]." The Department of Insurance is among the Departments of State government created in section 5- 15 of the Civil Administrative Code.

500 South Second Street, Springfield, Illinois 62701 • (217) 782-1090 • TTY: (877) 844-5461 • Fax: (217) 782-7046 100 West Randolph Street, Chicago, Illinois 60601 • (312) 814-3000 • TTY: (800) 964-3013 • Fax: (312) 814-3806 601 South University Ave., Carbondale, IL 62901 • (618) 529-6400 • TTY: (877) 675-9339 • Fax: (618) 529-6416

The Honorable Frank J. Mautino - 2

of an intergovernmental agreement. If the answer to your first question is in the affirmative, you have also inquired: what constitutes a "full-time program of internal auditing" under the Act; and whether a designated State agency may terminate the services of a chief internal auditor who is providing services to the agency through an intergovernmental agreement. For the reasons stated below, it is my opinion that multiple designated State agencies may not appoint the same individual as their chief internal auditor through the execution of an intergovernmental agreement. Because my answer to your first question is in the negative, it is not necessary to address the other questions you have raised.

BACKGROUND

History of State Agency Internal Audit Provisions

To assist in the development of an internal auditing program in State agencies, the General Assembly enacted the Internal Auditing Act (1967 Ill. Laws 2938; Ill. Rev. Stat. 1967, ch. 127, par. 136.1 et seq.), which required certain State agencies to establish internal audit programs and specified certain internal audit staffing, reporting, planning, and performance requirements.² In 1987, in response to perceived shortcomings in the internal audit function as reflected by 96 internal audit compliance findings for 36 different State agencies over a four-year

audit period, the Legislative Audit Commission adopted a resolution (Legislative Audit

² Specifically, the Internal Auditing Act required that "[a]ll [d]epartments of State government designated by the Governor subject to the provisions of 'The Civil Administrative Code of Illinois', the Secretary of State, the Auditor of Public Accounts, the State Treasurer, the Attorney General, the Superintendent of Public Instruction and any other State agency designated by the Governor, shall establish a program of internal auditing." 1967 Ill. Laws 2938-39; Ill. Rev. Stat. 1967, ch. 127, par. 136.1. Public Act 83-301, effective September 14, 1983, amended the Internal Auditing Act to require additional State agencies, including State colleges and universities, to establish a full-time program of auditing and to require that the chief executive officer of those State agencies appoint a chief internal auditor.

The Honorable Frank J. Mautino - 3

Commission Resolution No. 78, adopted April 9, 1987) directing the Auditor General's office to "conduct a management audit of the policies, procedures, and practices of the State's programs of internal auditing[.]" Auditor General, Management Audit, Illinois' State Programs of Internal Auditing, May 1988 (1988 Audit Report), at 45. In the resulting Audit Report, former Auditor General Robert G. Cronson concluded that "[m]ost internal audit programs [did] not comply with the requirements of the Internal Auditing Act and internal audit coverage [was] inadequate to achieve effective and efficient management of State agencies." 1988 Audit Report at iv. The Audit Report also recommended specific changes to the Internal Auditing Act for the General Assembly's consideration. See 1988 Audit Report at 41-42. Among the recommendations was the "[e]stablish[ment] [of] an office under the Governor to provide internal audit services to those agencies which are accountable to the Governor and which are not required to have a full- time internal audit program[.]" 1988 Audit Report at 41.

In response to the 1988 Audit Report, the General Assembly repealed the Internal Auditing Act and replaced it with the Act. See Public Act 86-936, effective January 1, 1990; Ill. Rev. Stat. 1989, ch. 15, pars. 1001 et seq.; now codified at 30 ILCS 10/1001 et seq. (West

2018).³ Since its initial enactment, the Act has provided that "[i]t is the policy of this State that

³ During the legislative debates on House Bill 2031, which as enacted became Public Act 86-936, the House sponsor stated that the bill "modernizes the State Internal Audit Statute" and "is a collaborative effort between the [Legislative] Audit Commission, the Governor's Office, the Department of Central Management Service [sic] and the States Internal Audit Managers Association." Remarks of Rep. Keane, May 19, 1989, House Debate on House Bill No. 2031, at 24.

The Honorable Frank J. Mautino - 4

the chief executive officer of every State agency"⁴ is responsible for effectively and efficiently managing the agency and establishing and maintaining an effective system of internal control." 30 ILCS 10/1002 (West 2002); 30 ILCS 10/1002 (West 2018). In addition, the Act requires "[e]ach designated State agency * * * [to] maintain a full-time program of internal auditing" (30 ILCS 10/2001 (West 2018); see generally 30 ILCS 10/2001 (West 2002)), and for "[t]he chief executive officer of each designated State agency [to] appoint a chief internal auditor[,]" who meets the qualifications established by the Act (30 ILCS 10/2002 (West 2002); 30 ILCS 10/2002 (West 2018)). The Act also provides that agencies which are "not designated and required to have a full-time program of internal auditing under [the] Act" are not relieved of the responsibility of maintaining an effective internal control system. 30 ILCS 10/2001(b) (West 2002); 30 ILCS 10/2001(b) (West 2018). The Act authorizes those agencies which do not have full-time internal audit programs to have internal audits performed by the Department of Central Management Services (CMS) (30 ILCS 10/2001(b) (West 2002); 30 ILCS 10/2001(b) (West

2018)). The Act also sets out the requirements for each designated State agency's internal

⁴ Subsection 1003(b) of the Act (30 ILCS 10/1003(b) (West 2018)) defines "State agency" to mean the term "as defined in the Illinois State Auditing Act [30 ILCS 5/1-1 et seq. (West 2018)]," which includes:

all officers, boards, commissions and agencies created by the Constitution, whether in the executive, legislative or judicial branch, but other than the circuit court; all officers, departments, boards, commissions, agencies, institutions, authorities, universities, bodies politic and corporate of the State; and administrative units or corporate outgrowths of the State government which are created by or pursuant to statute, other than units of local government and their officers, school districts and boards of election commissioners; all administrative units and corporate outgrowths of the above and as may be created by executive order of the Governor. 30 ILCS 5/1-7 (West 2018).

The Honorable Frank J. Mautino - 5

auditing program (30 ILCS 10/2003 (West 2002); 30 ILCS 10/2003 (West 2018)), and describes the internal fiscal and administrative controls required of all State agencies (30 ILCS 10/3001 (West 2002); 30 ILCS 10/3001 (West 2018)).

Thereafter, former Governor Rod Blagojevich issued Executive Order No. 2003- 10, on March 31, 2003, which, among other things, ordered the transfer of the internal auditing functions and the personnel related thereto from each agency, office, division, department, bureau, board, and commission directly responsible to the Governor to the jurisdiction of CMS. Executive Order No. 2003-10 was issued pursuant to the authority granted by article V, section 11, of the Illinois Constitution of 1970, which provides that "[t]he Governor, by Executive Order, may reassign functions among or reorganize executive agencies which are directly responsible to him[,]" and the Executive Reorganization Implementation Act (the Reorganization Act) (15 ILCS 15/1 et seq. (West 2018)), which in part authorizes the Governor to transfer functions from one executive agency to another.

As a check on the Governor's authority to reorganize agencies and functions under his control, the Illinois Constitution authorizes the General Assembly to consider executive orders wherein the Governor's reassignment or reorganization would contravene State statute. If either house of the General Assembly disapproves the executive order, then the order shall not become effective. Ill. Const. 1970, art. V, §11. Neither house of the General Assembly

voted to disapprove Executive Order No. 2003-10.⁵ As a result, on October 1, 2003,

⁵ VI Final Legislative Synopsis and Digest of the 93 Ill. Gen. Assem. (No. 15), at 4928.

The Honorable Frank J. Mautino - 6

approximately 90 internal auditors and 10 administrative staff operating out of 26 State agencies were formally transferred and placed under the jurisdiction of CMS. The transferred personnel were placed in an administrative unit which was known as the Illinois Office of Internal Audits.⁶

Seven years after Executive Order No. 2003-10 was issued, the General Assembly superseded the consolidation of the internal audit functions under CMS. Specifically, Public Act 96-795, effective July 1, 2010, among other things,⁷ returned the chief internal auditors who were moved into CMS to their respective agencies by adding subsection 2001(a-5) to the Act (30 ILCS 10/2001(a-5) (West 2018)). Subsequent to the enactment of Public Act 96-975, there has been no transfer of internal audit functions from designated State agencies to CMS pursuant to article V, section 11, of the Illinois Constitution of 1970, and/or the Reorganization Act.

Department of Insurance Audit Finding

Your inquiry arises out of an audit finding that the Department of Insurance (the Department) received during a compliance examination conducted on your behalf for the two years ended June 30, 2018, which was publicly released on April 18, 2019. Finding 2018-004 of

the indicated compliance examination concludes that the Department failed to adhere to the

⁶ See Illinois Department of Central Management Services, Consolidation Reports, Executive Reorganization of Internal Audit (May 11, 2005), available at https://www2.illinois.gov/cms/About/Reports/ Documents/ER_InternalAudit_05112005.pdf.

⁷ Public Act 96-795 also expanded the agencies within the Act's definition of "designated State agencies," required that each designated State agency "maintain" rather than "establish" a full-time program of internal auditing, and provided that chief internal auditors may only be removed for cause after a hearing before the Executive Ethics Commission. During the legislative debates on Senate Bill 51, which was enacted as Public Act 96-795, the House sponsor of the bill explained that "[t]he old internal auditors who at one time worked in all of the agencies and were moved into [CMS] by Governor Blagojevich will be returned to their old jobs." Remarks of Rep. Madigan, May 21, 2009, House Debate on Senate Bill No. 51, at 6.

The Honorable Frank J. Mautino - 7

provisions of the Act. See Auditor General, Illinois Department of Insurance Compliance Examination For the Two Years Ended June 30, 2018 (2018 Audit Report), Finding 2018-004, pages 19-23. Specifically, the finding notes that the Act requires each designated State agency to maintain a full-time program of internal auditing (2018 Audit Report at 19) and that the Department, as a designated State agency, "has not appointed an individual to fill the Department's chief internal auditor position[,] * * * [and] did not obtain the Governor's approval for CMS to provide professional internal auditing services to the Department." 2018 Audit Report at 20. Notably, the audit report states that on January 15, 2018, the Department entered into an intergovernmental agreement with CMS' Bureau of Internal Audit for CMS to provide internal auditing services to the Department. 2018 Audit Report at 19. The audit report further indicates that the CMS chief internal auditor is also acting as the chief internal auditor for eight designated State agencies, including the Departments of Agriculture, Corrections, Financial and Professional Regulation, Human Rights, Insurance, Labor, and the Illinois Finance Authority, in addition to CMS. 2018 Audit Report at 19. Finding 2018-004 concludes that the consolidation of internal audit functions by designated State agencies entering into an "intergovernmental agreement under which CMS' Chief Internal Auditor acts as the Chief Internal Auditor for the Department * * * [does not] meet[ ] the requirements of the * * * Act[.]" 2018 Audit Report at 23.

ANALYSIS
It is well established that administrative agencies such as the Department and

CMS possess only those powers that are expressly granted to them by statute, together with those

The Honorable Frank J. Mautino - 8

powers which may be necessarily implied therefrom to effectuate the powers which have been expressly granted. Vuagniaux v. Department of Professional Regulation, 208 Ill. 2d 173, 186- 88, 802 N.E.2d 1156, 1164-65 (2003). The intergovernmental agreement between the Department and CMS states that it was entered into pursuant to the Intergovernmental Cooperation Act (5 ILCS 220/1 et seq. (West 2016)) and in accordance with section 5-655 of the Civil Administrative Code of Illinois (20 ILCS 5/5-655 (West 2016)).⁸ Intergovernmental Agreement Regarding Provision of Internal Auditing Functions, Illinois Department of Central Management Services-Illinois Department of Insurance, December 11, 2017 (amended December 7, 2018), at 1. While section 3 of the Intergovernmental Cooperation Act (5 ILCS 220/3 (West 2018)) grants State agencies the authority to, among other things, contract and associate together to undertake governmental activities and to combine resources so that they may more efficiently perform their governmental functions (1991 Ill. Att'y Gen. Op. 216, 219),⁹ the authority to cooperate intergovernmentally cannot authorize an agreement which would contravene statutory prohibitions or limitations that apply to the contracting parties. Ill. Att'y Gen. Op. No. 05-010, issued December 16, 2005, at 31, citing 1991 Ill. Att'y Gen. Op. 158, 161;

1976 Ill. Att'y Gen. Op. 51, 53. Thus, it is necessary to review the Act and other pertinent

⁸ Section 5-655 of the Civil Administrative Code of Illinois provides that "directors of departments shall devise a practical and working basis for co-operation and co-ordination of work, eliminating duplication and overlapping of functions."

⁹ Section 3 of the Intergovernmental Cooperation Act provides that “[a]ny power or powers, privileges, functions, or authority exercised or which may be exercised by a public agency of this State may be exercised, combined, transferred, and enjoyed jointly with any other public agency of this State[.]" The Intergovernmental Cooperation Act includes "any agency of the State government" within its definition of "public agency." 5 ILCS 220/2 (West 2018).

The Honorable Frank J. Mautino - 9

statutory provisions to determine the extent of the Department's and CMS' authority to share internal audit functions.

The Act
Section 2001 of the Act (30 ILCS 10/2001 (West 2018)) directs State agencies with respect to the maintenance of an internal auditing program and provides, in pertinent part:

(a) Each designated State agency as defined in Section
1003(a) shall maintain a full-time program of internal auditing. In the event that a designated State agency is merged, abolished, reorganized, or renamed, the successor State agency shall also be a designated State agency.

(a-5) Within 30 days after the effective date of this
amendatory Act of the 96th General Assembly, each chief internal
auditor transferred under Executive Order 2003-10 to the
Department of Central Management Services shall be transferred
to the auditor's designated State agency, and if an auditor does not have a designated State agency or has more than one designated State agency, then the chief executive officer of a State agency shall appoint such person as the chief internal auditor of a State

agency. * * *

(b) The chief executive officer of a State agency is not
relieved from the responsibility for maintaining an effective
internal control system merely because that State agency is not
designated and required to have a full-time program of internal
auditing under this Act. Agencies which do not have full-time
internal audit programs may have internal audits performed by the
Department of Central Management Services. (Emphasis added.)

Subsection 2002(a) of the Act (30 ILCS 10/2002(a) (West 2018)) addresses the appointment of a chief internal auditor and provides:

(a) The chief executive officer of each designated State
agency shall appoint a chief internal auditor[.] (Emphasis added.)

The Honorable Frank J. Mautino - 10

Upon appointment, a chief internal auditor reports directly to the chief executive officer of the agency (30 ILCS 10/2002(b) (West 2018)), serves a 5-year term beginning on the date of appointment, and may only be removed for cause after a hearing before the Executive Ethics Commission. 30 ILCS 10/2002(c) (West 2018).

Where statutory language is clear and unambiguous it must be given effect as written. Klaine v. Southern Illinois Hospital Services, 2016 IL 118217, ¶14, 47 N.E.3d 966, 970 (2016). Further, a statute should be evaluated as a whole; each provision should be construed in connection with every other section (Jackson v. Board of Election Commissioners, 2012 IL 111928, ¶48, 975 N.E.2d 583, 596 (2012)) and no word or paragraph should be interpreted so as to be rendered meaningless or superfluous (People v. Chenewith, 2015 IL 116898, ¶21, 25 N.E.3d 612, 617 (2015)). When the meaning of a statute is not clear from the statutory language itself, however, it is proper to consider the purpose of the enactment, the evils to be remedied, and the legislative history of the statute. Home Star Bank & Financial Services v. Emergency Care & Health Organization, Ltd., 2014 IL 115526, ¶24, 6 N.E.3d 128, 135 (2014).

Under the plain and unambiguous language of subsection 2001(a) of the Act (30 ILCS 10/2001(a) (West 2018)), "[e]ach designated State agency[,]" which includes the

Department,¹⁰ "shall maintain a full-time program of internal auditing." (Emphasis added.) The phrase "full-time" is not defined in the Act. Undefined statutory terms are to be given their

ordinary and popularly-understood meaning. Skaperdas v. Country Casualty Insurance Co.,

2015 IL 117021, ¶15, 28 N.E.3d 747, 751 (2015). The term "full-time" commonly refers to

¹⁰ See note 1.

The Honorable Frank J. Mautino - 11

"designating, of, or engaged in work, study, etc. for specified periods regarded as taking all of one's regular working hours[.]" Webster's New World Dictionary 564 (2d coll. ed. 1976). Applying the commonly understood meaning of the term "full-time," a full-time program of internal auditing would refer to the internal auditing program undertaken by each designated State agency that utilizes all of the regular working hours of the person providing the internal auditing services.

While CMS' chief internal auditor may be providing internal auditing services during the entirety of his regular working hours, CMS' chief internal auditor is not engaged in a full-time program of internal auditing on behalf of each designated State agency. CMS' chief internal auditor is only engaged in a part-time program of internal auditing for each one of the designated State agencies that is a party to one of the intergovernmental cooperation agreements. This approach is inconsistent with the plain language of subsection 2001(a) of the Act.

Similarly, subsection 2002(a) of the Act (30 ILCS 10/2002(a) (West 2018)) also

clearly provides that "[t]he chief executive officer of each designated State agency shall appoint a chief internal auditor" (emphasis added) with the qualifications set out therein. The use of the word "shall" in a statute generally indicates a mandatory obligation, unless the statute indicates otherwise. Schultz v. Performance Lighting, Inc., 2013 IL 115738, ¶16, 999 N.E.2d 331, 335 (2013). Subsection 2002(a) unambiguously requires that each chief executive officer of a designated State agency appoint a chief internal auditor. Nothing in the Act expressly authorizes the chief executive officer to forego appointing a chief internal auditor or to contract around the

Act's requirements. In addition, nothing in the Act specifically authorizes multiple designated

The Honorable Frank J. Mautino - 12

State agencies to appoint the same individual as their chief internal auditor to perform internal audit functions, nor does the Act impliedly contemplate such an arrangement.

Subsection 2001(b) of the Act (30 ILCS 10/2001(b) (West 2018)) does provide that "[a]gencies which do not have full-time internal audit programs may have internal audits performed by [CMS]." If read in isolation, it could be argued that this sentence authorizes CMS to perform internal audits of any State agency that simply chooses not to establish its own full- time internal audit program. However, this sentence is located within the same subsection and immediately follows language which states that "[t]he chief executive officer of a State agency is not relieved from the responsibility for maintaining an effective internal control system merely because that State agency is not designated and required to have a full-time program of internal auditing[.]"¹¹ When the language of subsection 2001(b) is read and construed together, the phrase "[a]gencies which do not have full-time internal audit programs" clearly refers to agencies other than the designated State agencies which are required to have a full-time program of internal auditing.

Additionally, the language permitting agencies which do not have a full-time internal audit program to have internal audits performed by CMS appears in the same section of the Act which expressly requires that each designated State agency maintain a full-time program of internal auditing. 30 ILCS 10/2001(a) (West 2018). To construe the language of subsection

2001(b) to permit designated State agencies the option of having another State agency, in this

¹¹ The Illinois Law Enforcement Training Standards Board (see 50 ILCS 705/3 (West 2018)) and the Illinois Racing Board (see 230 ILCS 5/2 (West 2018)) are examples of State agencies that are not designated agencies under the Act.

The Honorable Frank J. Mautino - 13

instance CMS, perform their internal audit functions, would render the language of subsection 2001(a) requiring a full-time program of internal auditing meaningless.

Finally, the language permitting agencies which do not have a full-time internal auditing program to have CMS perform internal audits also appears within the same section as the language of subsection 2001(a-5) of the Act (30 ILCS 10/2001(a-5) (West 2018)), which required that chief internal auditors transferred to CMS under Executive Order 2003-10 return to their respective designated State agencies within 30 days after July 1, 2010. Subsection 2001 (a- 5) also provides that "if an auditor does not have a designated State agency or has more than one designated State agency," then the chief executive officer of a State agency shall appoint such person as the chief internal auditor of a State agency. When these provisions are construed together, again, it is clear that the Act contemplates that each chief internal auditor will serve only one designated State agency and will do so on a full-time basis.¹² Accordingly, because a designated State agency may not share a chief internal auditor with CMS or any other designated

State agency without contravening the Act, a designated State agency likewise may not enter into

¹² In discussing possible approaches for providing internal audit functions for smaller agencies, the 1988 Audit Report noted that Illinois had previously used but rejected a pool approach to internal auditing. 1988 Audit Report at 12. However, the 1988 Audit Report recommended that the General Assembly consider amending the Act to establish an office under the Governor "to provide internal audit services for those agencies and departments under the Governor which are not required to have their own internal audit programs[.]" (Emphasis added.) 1988 Audit Report at 12. In response, the Governor's office and CMS noted that the proposal duplicated an existing statute which allowed CMS to examine the accounts of any organization and to develop guidelines and provide continuing instructions in auditing (see Ill. Rev. Stat. 1987, ch. 127, pars. 35.4(d), (e), now codified at 20 ILCS 405/405-15 (West 2018)), and that CMS had conducted audits of several agencies without full-time internal audit functions. 1988 Audit Report at 13. When considered in the context of the recommendations made in the 1988 Audit Report, the language of subsection 2001(b) must be construed as authorizing CMS to perform internal audits for agencies which do not have full-time internal audit programs because they are not designated State agencies under the Act.

The Honorable Frank J. Mautino - 14

an intergovernmental agreement permitting the sharing of internal audit services without violating the Act.

Department of Central Management Services Law

Two other statutory provisions were referenced in the audit report related to the Department's recent compliance examination, subsection 405-293(a) of the Department of Central Management Services Law (the CMS Law) (20 ILCS 405/405-293(a) (West 2018)) and section 405-15 of the CMS Law (20 ILCS 405/405-15 (West 2018)). See 2018 Audit Report at

20. Subsection 405-293(a) of the CMS Law addresses CMS' provision of professional services
    and provides:

(a) The Department of Central Management Services * * *
is responsible for providing professional services for or on behalf of State agencies[¹³] for all functions transferred to the Department by Executive Order No. 2003-10 (as modified by Section 5.5 of the Executive Reorganization Implementation Act)[¹⁴] and may, with the approval of the Governor, provide additional services to or on behalf of State agencies. To the extent not compensated by direct fund transfers, the Department shall be reimbursed from each State agency receiving the benefit of these services. The reimbursement shall be determined by the Director of Central Management Services as the amount required to reimburse the Professional Services Fund for the Department's costs of rendering the professional services on behalf of that State agency. (Emphasis added.)

¹³ For purposes of this subsection "State agency" means each State agency, department, board, and commission directly responsible to the Governor." 20 ILCS 405/405-293(b) (West 2018).

¹⁴ Section 5.5 of the Reorganization Act (15 ILCS 15/5.5 (West 2018)) was added by Public Act 93-586, effective August 22, 2003, to supersede portions of Executive Order No. 2003-10, which incorrectly referenced the Illinois State Auditing Act (see 30 ILCS 5/1-1 et seq. (West 2018)), which addresses external audits, rather than internal audits. See Remarks of Sen. Demuzio, May 31, 2003, Senate Debate on Senate Bill No. 1901, at 165; Remarks of Rep. Currie, May 31, 2003, House Debate on Senate Bill No. 1901, at 104.

The Honorable Frank J. Mautino - 15

As used in subsection 405-293(a), "professional services" includes "internal audit services." 20 ILCS 405/405-293(b) (West 2018).

As previously discussed, seven years after the issuance of Executive Order No. 2003-10, the General Assembly expressly returned the chief internal auditors to their respective designated State agencies with the enactment of Public Act 96-795. Accordingly, the portion of subsection 405-293(a) referencing the provision of professional services transferred under Executive Order No. 2003-10 is inapplicable to internal audit services. Subsection 405-293(a) also provides that CMS may, "with the approval of the Governor, provide additional services to or on behalf of State agencies." However, internal audit services specifically fall within the CMS Law's definition of "professional services," and, therefore, cannot constitute "additional services." Assuming, arguendo, that internal audit services qualify as "additional services," nothing in the information we have been provided indicates that CMS obtained approval from the Governor prior to providing internal auditing services to the Department or any other designated State agency during the pertinent time period.¹⁵ Accordingly, subsection 405-293(a) of the CMS Law does not authorize CMS to perform internal audit services for designated State agencies.

The audit report of the compliance examination also references section 405-15 of the CMS Law (20 ILCS 405/405-15 (West 2018)), which authorizes CMS to provide internal

audits for other State agencies in certain, limited circumstances:

¹⁵ The audit report indicates that "no approval for CMS to provide internal auditing services

specifically to the Department, a designated State agency under the Act, was obtained from the Governor." 2018 Audit Report at 20.

The Honorable Frank J. Mautino - 16

The Department, when so requested by the Governor or the

chief executive officer of a State agency, may perform internal

audits, and procedural audits and in performing these

responsibilities, the Department may examine the accounts of any

organization, body, or agency receiving appropriations from the

General Assembly, including all grantees and sub-grantees of

grantor State agencies included within the scope of the audit.

Section 405-15 thus provides that CMS may perform internal audits when requested by the Governor or the chief executive officer of a State agency. It does not, however, provide that CMS may act as the full-time chief internal auditor in lieu of the appointment of a chief internal auditor by the chief executive officer of a designated State agency in accordance with subsection 2002(a) of the Act.

In determining the extent of authority granted to CMS by section 405-15, it is helpful to review the section's legislative history, which parallels the history of the Act. When the Internal Auditing Act was enacted, section 35.4 of the Civil Administrative Code of Illinois (Ill. Rev. Stat. 1967, ch. 127, par. 35.4, now codified at 20 ILCS 405/405-15 (West 2018)) provided that the Department of Finance, a predecessor to CMS,¹⁶ was "responsible for procedural audits of and financial reporting by state agencies[,]" including the "power and duty to * * * perform periodical procedural audits of state agencies to determine that adequate internal fiscal controls exist within the agencies" and to "examine the accounts of any * * * agency[.]"

Public Act 82-789, effective July 13, 1982, however, amended section 35.4 of the Civil

Administrative Code of Illinois to provide that CMS "may" rather than "shall have the power and

¹⁶ See Public Acts 80-57, effective July 1, 1977 (changing the name of the Department of Finance to the Department of Administrative Services); 82-789, effective July 13, 1982 (changing the name of the Department of Administrative Services to CMS).

The Honorable Frank J. Mautino - 17

duty to" perform periodical procedural audits of State agencies and examine the accounts of any agency, and added language authorizing CMS to establish guidelines for internal audit functions and provide continuing instruction in auditing. See Ill. Rev. Stat. 1982 Supp., ch. 127, par. 35.4.

Not long after the Act was enacted, the General Assembly rewrote section 35.4 to provide that CMS, "when so requested by the Governor or the chief executive officer of a State agency, may perform internal audits and procedural audits" and, in performing those responsibilities, "may examine the accounts of any * * * agency[.]" Public Act 87-817, effective December 16, 1991; see Ill. Rev. Stat. 1991, ch. 127, par. 35.4; 20 ILCS 405/405-35.4 (West 1992). The legislative debates on House Bill 2181, enacted as Public Act 87-817, indicate that the bill included "a CMS audit cleanup" (Remarks of Rep. Hoffman, June 30, 1991, House Debate on House Bill No. 2181, at 5) that, like the Act, was "request[ed] [by] the Legislative Audit Commission" (Remarks of Senator Davidson, June 20, 1991, Senate Debate on House Bill No. 2181, at 93). The Senate sponsor described the bill as "tak[ing] care of internal/external audits that's already performed by an agency." Remarks of Sen. Davidson, June 20, 1991, Senate Debate on House Bill No. 2181, at 93. Consistent with the Act's establishment of the Internal Audit Advisory Board (see 30 ILCS 10/2005 (West 2018)), the language permitting CMS to establish guidelines and providing continuing instruction in auditing was deleted. Section 35.4 was subsequently recodified as section 405-15 of the CMS Law (Public Act 91-239, effective January 1, 2000), but there have been no substantive changes to its language. Given the

legislative history of section 405-15 of the CMS Law, the language authorizing CMS to perform

The Honorable Frank J. Mautino - 18

internal audits must be construed as complementary to the Act, rather than a separate grant of authority to perform chief internal audit functions for or on behalf of a designated State agency. CONCLUSION

For the reasons stated above, it is my opinion that, pursuant to the Fiscal Control and Internal Auditing Act, multiple designated State agencies may not appoint the same individual as their chief internal auditor through an intergovernmental agreement. Should designated State agencies desire to consolidate or combine their internal audit functions, they must either seek authorizing legislation from the General Assembly or follow the process for reassigning functions among or reorganizing executive agencies which are directly responsible to the Governor as established by article V, section 11, of the Illinois Constitution of 1970, and the

Executive Reorganization Implementation Act.

Very truly yours,

KWAME RAOUL
ATTORNEY GENERAL