IL 19-001 August 9, 2019

Can multiple Illinois state agencies share a single chief internal auditor through an intergovernmental agreement instead of each appointing their own?

Short answer: No. The AG concluded that the Fiscal Control and Internal Auditing Act required each designated state agency (the Department of Insurance, the Departments of Agriculture, Corrections, Labor, and others) to maintain a full-time internal audit program and to appoint its own chief internal auditor. An intergovernmental agreement that let the CMS chief internal auditor serve as chief auditor for eight other agencies did not satisfy the statute.

Disclaimer: This is an official Illinois Attorney General opinion. AG opinions are persuasive authority but not binding precedent. This summary is for informational purposes only and is not legal advice. Consult a licensed Illinois attorney for advice on your specific situation.

Subject

Authority of Multiple Designated State Agencies to Appoint the Same Individual as their Chief Internal Auditor

Plain-English summary

Illinois Auditor General Frank Mautino had flagged a 2018 audit finding: the Department of Insurance had no chief internal auditor and was instead receiving internal audit services from the Department of Central Management Services (CMS) under an intergovernmental agreement. The CMS chief internal auditor was simultaneously serving as the chief internal auditor for eight other agencies, including Agriculture, Corrections, Financial and Professional Regulation, Human Rights, Labor, and the Illinois Finance Authority. Mautino asked the Attorney General whether that arrangement satisfied the Fiscal Control and Internal Auditing Act.

The AG said no. The statute requires each "designated State agency" to maintain a "full-time" internal audit program and the chief executive of each such agency must "appoint a chief internal auditor." One person doing the job for nine agencies could not be running a full-time program for any one of them. The Intergovernmental Cooperation Act allows agencies to combine resources, but only when doing so does not violate other statutory limits. Sharing one chief internal auditor among multiple designated agencies violated the limits in this Act. If the state wanted to consolidate, the AG said, the General Assembly would have to authorize it, or the Governor could use the Executive Reorganization Implementation Act process.

Currency note

This opinion was issued in 2019. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Background and statutory framework

The Fiscal Control and Internal Auditing Act (30 ILCS 10/1001 et seq.) sits at the center of the opinion. Subsection 1003(a) lists which agencies count as "designated State agencies": the offices of the Secretary of State, Comptroller, Treasurer, and Attorney General; the State Board of Education; state colleges and universities; the Toll Highway Authority; public retirement systems; the Illinois Finance Authority; the Capital Development Board; the Illinois Housing Development Authority; the Department of Military Affairs; the State Fire Marshal; the Illinois Student Assistance Commission; the EPA; and "each Department of State government created in Article 5, Section 5-15 of the Civil Administrative Code of Illinois." The Department of Insurance is one of those Article 5 departments.

Section 2001(a) requires each designated agency to "maintain a full-time program of internal auditing." Section 2002(a) requires the chief executive officer of each such agency to "appoint a chief internal auditor." That auditor reports directly to the chief executive, serves a five-year term, and can only be removed for cause after a hearing before the Executive Ethics Commission. Section 2001(b) lets non-designated agencies use CMS for internal audits.

The history of these rules matters. In 2003, Governor Blagojevich's Executive Order 2003-10 had moved internal auditors from agencies under his control into CMS, creating a centralized "Illinois Office of Internal Audits." But the General Assembly reversed that in 2010 (Public Act 96-795), adding subsection 2001(a-5), which sent the auditors back to their home agencies. The legislative debate explicitly described it as undoing Blagojevich's consolidation.

Two CMS-side statutes were also relevant:

20 ILCS 405/405-293 lets CMS provide "professional services" (which include internal audit services) for functions transferred under Executive Order 2003-10, or, "with the approval of the Governor," additional services. The 2018 audit found CMS had no Governor's approval to provide internal audit services to the Department of Insurance.
20 ILCS 405/405-15 lets CMS perform internal audits "when so requested by the Governor or the chief executive officer of a State agency." The AG read this as a complementary fallback authority, not a replacement for the appointment-of-chief-auditor requirement.

Why the AG reached this conclusion

The AG ran the question through several layers of statutory construction.

First, plain meaning. "Full-time" is not defined in the Act. Using Webster's, the AG noted that "full-time" commonly means "engaged in work for specified periods regarded as taking all of one's regular working hours." A chief internal auditor running internal audits across nine agencies cannot dedicate full-time effort to any single one. So the CMS arrangement was at best a part-time program for each of the agencies sharing him, contrary to the explicit "full-time" requirement.

Second, the mandatory verb "shall." Section 2002(a) says the chief executive officer of each designated state agency "shall appoint a chief internal auditor." The Illinois Supreme Court treats "shall" as mandatory absent a contrary signal. Nothing in the Act authorizes skipping the appointment or contracting around it.

Third, reading the Act as a whole. Subsection 2001(b) lets "agencies which do not have full-time internal audit programs" use CMS. Read in context with subsection 2001(a) (which requires designated agencies to have full-time programs), the AG concluded subsection 2001(b) was talking about non-designated agencies (examples given: the Illinois Law Enforcement Training Standards Board, the Illinois Racing Board), not designated agencies opting out. Reading it the other way would render the section 2001(a) requirement meaningless.

Fourth, the 2010 reversal of Executive Order 2003-10. Subsection 2001(a-5) returned the auditors to their home agencies and added that "if an auditor does not have a designated State agency or has more than one designated State agency, then the chief executive officer of a State agency shall appoint such person as the chief internal auditor of a State agency." That language anticipated a one-auditor-one-agency model. Allowing one CMS auditor to be chief for nine agencies would resurrect the very system the General Assembly had explicitly dismantled.

Fifth, the Intergovernmental Cooperation Act. While that statute lets agencies pool authority, an intergovernmental agreement cannot authorize what the underlying substantive statutes prohibit. Earlier AG opinions (1991 and 1976) had reached the same general conclusion: cooperation cannot dissolve other statutory limits.

Sixth, the CMS Law itself. Section 405-293(a) authorizes CMS to provide internal audit services for "functions transferred to the Department by Executive Order No. 2003-10." But Public Act 96-795 had already returned those functions, so the transfer-clause portion did not apply. The "additional services with Governor's approval" portion required actual Governor approval, which the audit report said never happened. And subsection 405-15 only authorizes CMS to perform internal audits "when so requested." That is a request-driven backup, not a substitute for the chief-internal-auditor appointment that the Act independently requires.

The AG closed with a roadmap. If designated agencies want to share or consolidate internal audit functions, they can either get authorizing legislation from the General Assembly or use the constitutional reorganization process under article V, section 11, of the Illinois Constitution, in combination with the Executive Reorganization Implementation Act. They cannot simply contract around the Act through an intergovernmental agreement.

Common questions

Which agencies were affected by the audit finding that prompted this opinion?

The 2018 audit report identified the CMS chief internal auditor as also serving as the chief internal auditor for the Departments of Agriculture, Corrections, Financial and Professional Regulation, Human Rights, Insurance, and Labor, plus the Illinois Finance Authority, in addition to CMS itself. Each of those is a designated state agency under the Act.

Did the opinion say CMS could never perform internal audits for another agency?

No. CMS retained two narrow paths: section 405-15 of the CMS Law, which lets CMS perform internal audits when requested by the Governor or an agency CEO, and section 405-293, which allows CMS to provide professional services with Governor's approval. The opinion treated those as complements to the Act, not workarounds for designated agencies that have their own statutory duty to appoint a chief internal auditor and run a full-time program.

What if the General Assembly later wanted to allow shared chief internal auditors?

The opinion expressly said that path was open: authorizing legislation. Or the Governor could use article V, section 11, of the constitution, which lets executive orders reassign functions among directly responsible agencies, subject to General Assembly disapproval. That was how the consolidation worked in 2003 before Public Act 96-795 reversed it.

Could the auditor general have flagged this through other means?

Yes, and the audit findings already had. Finding 2018-004 of the Department of Insurance compliance examination identified the Act violation. The AG's opinion gave Mautino's office a formal legal interpretation backing the audit conclusion.

Did the opinion say CMS could not approve the absence of a chief internal auditor at the Department of Insurance?

The Department of Insurance, as a designated state agency, had a statutory duty to maintain a full-time program and appoint a chief internal auditor. The opinion concluded the Act did not allow it to substitute the CMS chief internal auditor through an intergovernmental agreement. Whether the Department was in violation was the audit's conclusion. The opinion was the legal basis for that conclusion.

Citations

Fiscal Control and Internal Auditing Act, 30 ILCS 10/1001 et seq., specifically §§1002, 1003, 2001, 2002, 2003, 2005, 3001
Illinois State Auditing Act, 30 ILCS 5/1-1 et seq., §1-7
Civil Administrative Code, 20 ILCS 5/5-15, 5-655
Intergovernmental Cooperation Act, 5 ILCS 220/1 et seq., §§2, 3
Department of Central Management Services Law, 20 ILCS 405/405-15, 405-293
Executive Reorganization Implementation Act, 15 ILCS 15/1 et seq., §5.5
Ill. Const. 1970, art. V, §11
Public Act 86-936 (effective January 1, 1990)
Public Act 96-795 (effective July 1, 2010)
Public Act 93-586 (effective August 22, 2003)
Executive Order No. 2003-10 (March 31, 2003)
1991 Ill. Att'y Gen. Op. 216
1991 Ill. Att'y Gen. Op. 158
1976 Ill. Att'y Gen. Op. 51
Ill. Att'y Gen. Op. No. 05-010 (December 16, 2005)

Source

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain — the linked PDF is authoritative.

OFFICE OF THE ATTORNEY GENERAL
STATE OF ILLINOIS

KWAME RAOUL
ATTORNEY GENERAL

August 9, 2019

FILE NO. 19-001

STATE MATTERS:
Authority of Multiple Designated State Agencies to Appoint the Same Individual as their Chief Internal Auditor

The Honorable Frank J. Mautino
Auditor General
Iles Park Plaza
Springfield, Illinois

Dear Mr. Mautino:

I have your letter inquiring whether, pursuant to the Fiscal Control and Internal Auditing Act (the Act) (30 ILCS 10/1001 et seq. (West 2018)), multiple "designated State agencies" may appoint the same individual as their chief internal auditor through the execution of an intergovernmental agreement. If the answer to your first question is in the affirmative, you have also inquired: what constitutes a "full-time program of internal auditing" under the Act; and whether a designated State agency may terminate the services of a chief internal auditor who is providing services to the agency through an intergovernmental agreement. For the reasons stated below, it is my opinion that multiple designated State agencies may not appoint the same individual as their chief internal auditor through the execution of an intergovernmental agreement. Because my answer to your first question is in the negative, it is not necessary to address the other questions you have raised.

BACKGROUND

History of State Agency Internal Audit Provisions

To assist in the development of an internal auditing program in State agencies, the General Assembly enacted the Internal Auditing Act (1967 Ill. Laws 2938; Ill. Rev. Stat. 1967, ch. 127, par. 136.1 et seq.), which required certain State agencies to establish internal audit programs and specified certain internal audit staffing, reporting, planning, and performance requirements. In 1987, in response to perceived shortcomings in the internal audit function as reflected by 96 internal audit compliance findings for 36 different State agencies over a four-year audit period, the Legislative Audit Commission adopted a resolution (Legislative Audit Commission Resolution No. 78, adopted April 9, 1987) directing the Auditor General's office to "conduct a management audit of the policies, procedures, and practices of the State's programs of internal auditing." Auditor General, Management Audit, Illinois' State Programs of Internal Auditing, May 1988 (1988 Audit Report), at 45. In the resulting Audit Report, former Auditor General Robert G. Cronson concluded that "[m]ost internal audit programs [did] not comply with the requirements of the Internal Auditing Act and internal audit coverage [was] inadequate to achieve effective and efficient management of State agencies." 1988 Audit Report at iv. The Audit Report also recommended specific changes to the Internal Auditing Act for the General Assembly's consideration. See 1988 Audit Report at 41-42. Among the recommendations was the "[e]stablish[ment] [of] an office under the Governor to provide internal audit services to those agencies which are accountable to the Governor and which are not required to have a full-time internal audit program[.]" 1988 Audit Report at 41.

In response to the 1988 Audit Report, the General Assembly repealed the Internal Auditing Act and replaced it with the Act. See Public Act 86-936, effective January 1, 1990; Ill. Rev. Stat. 1989, ch. 15, pars. 1001 et seq.; now codified at 30 ILCS 10/1001 et seq. (West 2018). Since its initial enactment, the Act has provided that "[i]t is the policy of this State that the chief executive officer of every State agency is responsible for effectively and efficiently managing the agency and establishing and maintaining an effective system of internal control." 30 ILCS 10/1002 (West 2002); 30 ILCS 10/1002 (West 2018). In addition, the Act requires "[e]ach designated State agency * * * [to] maintain a full-time program of internal auditing" (30 ILCS 10/2001 (West 2018); see generally 30 ILCS 10/2001 (West 2002)), and for "[t]he chief executive officer of each designated State agency [to] appoint a chief internal auditor[,]" who meets the qualifications established by the Act (30 ILCS 10/2002 (West 2002); 30 ILCS 10/2002 (West 2018)). The Act also provides that agencies which are "not designated and required to have a full-time program of internal auditing under [the] Act" are not relieved of the responsibility of maintaining an effective internal control system. 30 ILCS 10/2001(b) (West 2002); 30 ILCS 10/2001(b) (West 2018). The Act authorizes those agencies which do not have full-time internal audit programs to have internal audits performed by the Department of Central Management Services (CMS) (30 ILCS 10/2001(b) (West 2002); 30 ILCS 10/2001(b) (West 2018)). The Act also sets out the requirements for each designated State agency's internal auditing program (30 ILCS 10/2003 (West 2002); 30 ILCS 10/2003 (West 2018)), and describes the internal fiscal and administrative controls required of all State agencies (30 ILCS 10/3001 (West 2002); 30 ILCS 10/3001 (West 2018)).

Thereafter, former Governor Rod Blagojevich issued Executive Order No. 2003-10, on March 31, 2003, which, among other things, ordered the transfer of the internal auditing functions and the personnel related thereto from each agency, office, division, department, bureau, board, and commission directly responsible to the Governor to the jurisdiction of CMS. Executive Order No. 2003-10 was issued pursuant to the authority granted by article V, section 11, of the Illinois Constitution of 1970, which provides that "[t]he Governor, by Executive Order, may reassign functions among or reorganize executive agencies which are directly responsible to him[,]" and the Executive Reorganization Implementation Act (the Reorganization Act) (15 ILCS 15/1 et seq. (West 2018)), which in part authorizes the Governor to transfer functions from one executive agency to another.

As a check on the Governor's authority to reorganize agencies and functions under his control, the Illinois Constitution authorizes the General Assembly to consider executive orders wherein the Governor's reassignment or reorganization would contravene State statute. If either house of the General Assembly disapproves the executive order, then the order shall not become effective. Ill. Const. 1970, art. V, §11. Neither house of the General Assembly voted to disapprove Executive Order No. 2003-10. As a result, on October 1, 2003, approximately 90 internal auditors and 10 administrative staff operating out of 26 State agencies were formally transferred and placed under the jurisdiction of CMS. The transferred personnel were placed in an administrative unit which was known as the Illinois Office of Internal Audits.

Seven years after Executive Order No. 2003-10 was issued, the General Assembly superseded the consolidation of the internal audit functions under CMS. Specifically, Public Act 96-795, effective July 1, 2010, among other things, returned the chief internal auditors who were moved into CMS to their respective agencies by adding subsection 2001(a-5) to the Act (30 ILCS 10/2001(a-5) (West 2018)). Subsequent to the enactment of Public Act 96-975, there has been no transfer of internal audit functions from designated State agencies to CMS pursuant to article V, section 11, of the Illinois Constitution of 1970, and/or the Reorganization Act.

Department of Insurance Audit Finding

Your inquiry arises out of an audit finding that the Department of Insurance (the Department) received during a compliance examination conducted on your behalf for the two years ended June 30, 2018, which was publicly released on April 18, 2019. Finding 2018-004 of the indicated compliance examination concludes that the Department failed to adhere to the provisions of the Act. See Auditor General, Illinois Department of Insurance Compliance Examination For the Two Years Ended June 30, 2018 (2018 Audit Report), Finding 2018-004, pages 19-23. Specifically, the finding notes that the Act requires each designated State agency to maintain a full-time program of internal auditing (2018 Audit Report at 19) and that the Department, as a designated State agency, "has not appointed an individual to fill the Department's chief internal auditor position[,] * * * [and] did not obtain the Governor's approval for CMS to provide professional internal auditing services to the Department." 2018 Audit Report at 20. Notably, the audit report states that on January 15, 2018, the Department entered into an intergovernmental agreement with CMS' Bureau of Internal Audit for CMS to provide internal auditing services to the Department. 2018 Audit Report at 19. The audit report further indicates that the CMS chief internal auditor is also acting as the chief internal auditor for eight designated State agencies, including the Departments of Agriculture, Corrections, Financial and Professional Regulation, Human Rights, Insurance, Labor, and the Illinois Finance Authority, in addition to CMS. 2018 Audit Report at 19. Finding 2018-004 concludes that the consolidation of internal audit functions by designated State agencies entering into an "intergovernmental agreement under which CMS' Chief Internal Auditor acts as the Chief Internal Auditor for the Department * * * [does not] meet the requirements of the * * * Act[.]" 2018 Audit Report at 23.

ANALYSIS

It is well established that administrative agencies such as the Department and CMS possess only those powers that are expressly granted to them by statute, together with those powers which can be necessarily implied therefrom to effectuate the powers which have been expressly granted. Vuagniaux v. Department of Professional Regulation, 208 Ill. 2d 173, 186-88, 802 N.E.2d 1156, 1164-65 (2003). The intergovernmental agreement between the Department and CMS states that it was entered into pursuant to the Intergovernmental Cooperation Act (5 ILCS 220/1 et seq. (West 2016)) and in accordance with section 5-655 of the Civil Administrative Code of Illinois (20 ILCS 5/5-655 (West 2016)). Intergovernmental Agreement Regarding Provision of Internal Auditing Functions, Illinois Department of Central Management Services-Illinois Department of Insurance, December 11, 2017 (amended December 7, 2018), at 1. While section 3 of the Intergovernmental Cooperation Act (5 ILCS 220/3 (West 2018)) grants State agencies the authority to, among other things, contract and associate together to undertake governmental activities and to combine resources so that they may more efficiently perform their governmental functions (1991 Ill. Att'y Gen. Op. 216, 219), the authority to cooperate intergovernmentally cannot authorize an agreement which would contravene statutory prohibitions or limitations that apply to the contracting parties. Ill. Att'y Gen. Op. No. 05-010, issued December 16, 2005, at 31, citing 1991 Ill. Att'y Gen. Op. 158, 161; 1976 Ill. Att'y Gen. Op. 51, 53. Thus, it is necessary to review the Act and other pertinent statutory provisions to determine the extent of the Department's and CMS' authority to share internal audit functions.

The Act

Section 2001 of the Act (30 ILCS 10/2001 (West 2018)) directs State agencies with respect to the maintenance of an internal auditing program and provides, in pertinent part:

(a) Each designated State agency as defined in Section 1003(a) shall maintain a full-time program of internal auditing. In the event that a designated State agency is merged, abolished, reorganized, or renamed, the successor State agency shall also be a designated State agency.

(a-5) Within 30 days after the effective date of this amendatory Act of the 96th General Assembly, each chief internal auditor transferred under Executive Order 2003-10 to the Department of Central Management Services shall be transferred to the auditor's designated State agency, and if an auditor does not have a designated State agency or has more than one designated State agency, then the chief executive officer of a State agency shall appoint such person as the chief internal auditor of a State agency. * * *

(b) The chief executive officer of a State agency is not relieved from the responsibility for maintaining an effective internal control system merely because that State agency is not designated and required to have a full-time program of internal auditing under this Act. Agencies which do not have full-time internal audit programs may have internal audits performed by the Department of Central Management Services. (Emphasis added.)

Subsection 2002(a) of the Act (30 ILCS 10/2002(a) (West 2018)) addresses the appointment of a chief internal auditor and provides:

(a) The chief executive officer of each designated State agency shall appoint a chief internal auditor[.] (Emphasis added.)

Upon appointment, a chief internal auditor reports directly to the chief executive officer of the agency (30 ILCS 10/2002(b) (West 2018)), serves a 5-year term beginning on the date of appointment, and may only be removed for cause after a hearing before the Executive Ethics Commission. 30 ILCS 10/2002(c) (West 2018).

Where statutory language is clear and unambiguous it must be given effect as written. Klaine v. Southern Illinois Hospital Services, 2016 IL 118217, ¶14, 47 N.E.3d 966, 970 (2016). Further, a statute should be evaluated as a whole; each provision should be construed in connection with every other section (Jackson v. Board of Election Commissioners, 2012 IL 111928, ¶48, 975 N.E.2d 583, 596 (2012)) and no word or paragraph should be interpreted so as to be rendered meaningless or superfluous (People v. Chenewith, 2015 IL 116898, ¶21, 25 N.E.3d 612, 617 (2015)). When the meaning of a statute is not clear from the statutory language itself, however, it is proper to consider the purpose of the enactment, the evils to be remedied, and the legislative history of the statute. Home Star Bank & Financial Services v. Emergency Care & Health Organization, Ltd., 2014 IL 115526, ¶24, 6 N.E.3d 128, 135 (2014).

Under the plain and unambiguous language of subsection 2001(a) of the Act (30 ILCS 10/2001(a) (West 2018)), "[e]ach designated State agency[,]" which includes the Department, "shall maintain a full-time program of internal auditing." (Emphasis added.) The phrase "full-time" is not defined in the Act. Undefined statutory terms are to be given their ordinary and popularly-understood meaning. Skaperdas v. Country Casualty Insurance Co., 2015 IL 117021, ¶15, 28 N.E.3d 747, 751 (2015). The term "full-time" commonly refers to "designating, of, or engaged in work, study, etc. for specified periods regarded as taking all of one's regular working hours[.]" Webster's New World Dictionary 564 (2d coll. ed. 1976). Applying the commonly understood meaning of the term "full-time," a full-time program of internal auditing would refer to the internal auditing program undertaken by each designated State agency that utilizes all of the regular working hours of the person providing the internal auditing services.

While CMS' chief internal auditor may be providing internal auditing services during the entirety of his regular working hours, CMS' chief internal auditor is not engaged in a full-time program of internal auditing on behalf of each designated State agency. CMS' chief internal auditor is only engaged in a part-time program of internal auditing for each one of the designated State agencies that is a party to one of the intergovernmental cooperation agreements. This approach is inconsistent with the plain language of subsection 2001(a) of the Act.

Similarly, subsection 2002(a) of the Act (30 ILCS 10/2002(a) (West 2018)) also clearly provides that "[t]he chief executive officer of each designated State agency shall appoint a chief internal auditor" (emphasis added) with the qualifications set out therein. The use of the word "shall" in a statute generally indicates a mandatory obligation, unless the statute indicates otherwise. Schultz v. Performance Lighting, Inc., 2013 IL 115738, ¶16, 999 N.E.2d 331, 335 (2013). Subsection 2002(a) unambiguously requires that each chief executive officer of a designated State agency appoint a chief internal auditor. Nothing in the Act expressly authorizes the chief executive officer to forego appointing a chief internal auditor or to contract around the Act's requirements. In addition, nothing in the Act specifically authorizes multiple designated State agencies to appoint the same individual as their chief internal auditor to perform internal audit functions, nor does the Act impliedly contemplate such an arrangement.

Subsection 2001(b) of the Act (30 ILCS 10/2001(b) (West 2018)) does provide that "[a]gencies which do not have full-time internal audit programs may have internal audits performed by [CMS]." If read in isolation, it could be argued that this sentence authorizes CMS to perform internal audits of any State agency that simply chooses not to establish its own full-time internal audit program. However, this sentence is located within the same subsection and immediately follows language which states that "[t]he chief executive officer of a State agency is not relieved from the responsibility for maintaining an effective internal control system merely because that State agency is not designated and required to have a full-time program of internal auditing[.]" When the language of subsection 2001(b) is read and construed together, the phrase "[a]gencies which do not have full-time internal audit programs" clearly refers to agencies other than the designated State agencies which are required to have a full-time program of internal auditing.

Additionally, the language permitting agencies which do not have a full-time internal audit program to have internal audits performed by CMS appears in the same section of the Act which expressly requires that each designated State agency maintain a full-time program of internal auditing. 30 ILCS 10/2001(a) (West 2018). To construe the language of subsection 2001(b) to permit designated State agencies the option of having another State agency, in this instance CMS, perform their internal audit functions, would render the language of subsection 2001(a) requiring a full-time program of internal auditing meaningless.

Finally, the language permitting agencies which do not have a full-time internal auditing program to have CMS perform internal audits also appears within the same section as the language of subsection 2001(a-5) of the Act (30 ILCS 10/2001(a-5) (West 2018)), which required that chief internal auditors transferred to CMS under Executive Order 2003-10 return to their respective designated State agencies within 30 days after July 1, 2010. Subsection 2001(a-5) also provides that "if an auditor does not have a designated State agency or has more than one designated State agency," then the chief executive officer of a State agency shall appoint such person as the chief internal auditor of a State agency. When these provisions are construed together, again, it is clear that the Act contemplates that each chief internal auditor will serve only one designated State agency and will do so on a full-time basis. Accordingly, because a designated State agency may not share a chief internal auditor with CMS or any other designated State agency without contravening the Act, a designated State agency likewise may not enter into an intergovernmental agreement permitting the sharing of internal audit services without violating the Act.

Department of Central Management Services Law

Two other statutory provisions were referenced in the audit report related to the Department's recent compliance examination, subsection 405-293(a) of the Department of Central Management Services Law (the CMS Law) (20 ILCS 405/405-293(a) (West 2018)) and section 405-15 of the CMS Law (20 ILCS 405/405-15 (West 2018)). See 2018 Audit Report at 20. Subsection 405-293(a) of the CMS Law addresses CMS' provision of professional services and provides:

(a) The Department of Central Management Services * * * is responsible for providing professional services for or on behalf of State agencies for all functions transferred to the Department by Executive Order No. 2003-10 (as modified by Section 5.5 of the Executive Reorganization Implementation Act) and may, with the approval of the Governor, provide additional services to or on behalf of State agencies. To the extent not compensated by direct fund transfers, the Department shall be reimbursed from each State agency receiving the benefit of these services. The reimbursement shall be determined by the Director of Central Management Services as the amount required to reimburse the Professional Services Fund for the Department's costs of rendering the professional services on behalf of that State agency. (Emphasis added.)

As used in subsection 405-293(a), "professional services" includes "internal audit services." 20 ILCS 405/405-293(b) (West 2018).

As previously discussed, seven years after the issuance of Executive Order No. 2003-10, the General Assembly expressly returned the chief internal auditors to their respective designated State agencies with the enactment of Public Act 96-795. Accordingly, the portion of subsection 405-293(a) referencing the provision of professional services transferred under Executive Order No. 2003-10 is inapplicable to internal audit services. Subsection 405-293(a) also provides that CMS may, "with the approval of the Governor, provide additional services to or on behalf of State agencies." However, internal audit services specifically fall within the CMS Law's definition of "professional services," and, therefore, cannot constitute "additional services." Assuming, arguendo, that internal audit services qualify as "additional services," nothing in the information we have been provided indicates that CMS obtained approval from the Governor prior to providing internal auditing services to the Department or any other designated State agency during the pertinent time period. Accordingly, subsection 405-293(a) of the CMS Law does not authorize CMS to perform internal audit services for designated State agencies.

The audit report of the compliance examination also references section 405-15 of the CMS Law (20 ILCS 405/405-15 (West 2018)), which authorizes CMS to provide internal audits for other State agencies in certain, limited circumstances:

The Department, when so requested by the Governor or the chief executive officer of a State agency, may perform internal audits, and procedural audits and in performing these responsibilities, the Department may examine the accounts of any organization, body, or agency receiving appropriations from the General Assembly, including all grantees and sub-grantees of grantor State agencies included within the scope of the audit.

Section 405-15 thus provides that CMS may perform internal audits when requested by the Governor or the chief executive officer of a State agency. It does not, however, provide that CMS may act as the full-time chief internal auditor in lieu of the appointment of a chief internal auditor by the chief executive officer of a designated State agency in accordance with subsection 2002(a) of the Act.

In determining the extent of authority granted to CMS by section 405-15, it is helpful to review the section's legislative history, which parallels the history of the Act. When the Internal Auditing Act was enacted, section 35.4 of the Civil Administrative Code of Illinois (Ill. Rev. Stat. 1967, ch. 127, par. 35.4, now codified at 20 ILCS 405/405-15 (West 2018)) provided that the Department of Finance, a predecessor to CMS, was "responsible for procedural audits of and financial reporting by state agencies[,]" including the "power and duty to * * * perform periodical procedural audits of state agencies to determine that adequate internal fiscal controls exist within the agencies" and to "examine the accounts of any * * * agency[.]" Public Act 82-789, effective July 13, 1982, however, amended section 35.4 of the Civil Administrative Code of Illinois to provide that CMS "may" rather than "shall have the power and duty to" perform periodical procedural audits of State agencies and examine the accounts of any agency, and added language authorizing CMS to establish guidelines for internal audit functions and provide continuing instruction in auditing. See Ill. Rev. Stat. 1982 Supp., ch. 127, par. 35.4.

Not long after the Act was enacted, the General Assembly rewrote section 35.4 to provide that CMS, "when so requested by the Governor or the chief executive officer of a State agency, may perform internal audits and procedural audits" and, in performing those responsibilities, "may examine the accounts of any * * * agency[.]" Public Act 87-817, effective December 16, 1991; see Ill. Rev. Stat. 1991, ch. 127, par. 35.4; 20 ILCS 405/405-35.4 (West 1992). The legislative debates on House Bill 2181, enacted as Public Act 87-817, indicate that the bill included "a CMS audit cleanup" (Remarks of Rep. Hoffman, June 30, 1991, House Debate on House Bill No. 2181, at 5) that, like the Act, was "request[ed] [by] the Legislative Audit Commission" (Remarks of Senator Davidson, June 20, 1991, Senate Debate on House Bill No. 2181, at 93). The Senate sponsor described the bill as "tak[ing] care of internal/external audits that's already performed by an agency." Remarks of Sen. Davidson, June 20, 1991, Senate Debate on House Bill No. 2181, at 93. Consistent with the Act's establishment of the Internal Audit Advisory Board (see 30 ILCS 10/2005 (West 2018)), the language permitting CMS to establish guidelines and providing continuing instruction in auditing was deleted. Section 35.4 was subsequently recodified as section 405-15 of the CMS Law (Public Act 91-239, effective January 1, 2000), but there have been no substantive changes to its language. Given the legislative history of section 405-15 of the CMS Law, the language authorizing CMS to perform internal audits must be construed as complementary to the Act, rather than a separate grant of authority to perform chief internal audit functions for or on behalf of a designated State agency.

CONCLUSION

For the reasons stated above, it is my opinion that, pursuant to the Fiscal Control and Internal Auditing Act, multiple designated State agencies may not appoint the same individual as their chief internal auditor through an intergovernmental agreement. Should designated State agencies desire to consolidate or combine their internal audit functions, they must either seek authorizing legislation from the General Assembly or follow the process for reassigning functions among or reorganizing executive agencies which are directly responsible to the Governor as established by article V, section 11, of the Illinois Constitution of 1970, and the Executive Reorganization Implementation Act.

Very truly yours,