Solving Complex Single Audit Issues for Government and Nonprofit Organizations

Gain comprehensive, practical, hands-on guidance on implementing the requirements of the Single Audit Act Amendments of 1996 as revised by OMB Circular A-133. The 2008 version of the course also reviews the federal study on A-133 audit quality.

Objectives:

• Conduct an audit that complies with the latest requirements of OMB Circular A-133
• Perform risk-based assessments of programs

Prerequisite: Completion of the AICPA course Applying A-133 to Nonprofit and Governmental Organizations or equivalent knowledge and experience

Chapter 0

The Report on National Single Audit Sampling Project

In June 2007, the President's Council on Integrity and Efficiency and the Executive Council on Integrity and Efficiency issued a report entitled Report on National Single Audit Sampling Project (http://ignet.gov/). The report presented the results of a 2+ year effort to (1) assess the quality of single audits and establish a statistically based measure of audit quality; and (2) recommend changes in single audit requirements, standards and procedures to improve the quality of single audits.

The study looked at 208 audits of the 38,523 single audits submitted and accepted for the period 4/03 to 3/04. The 208 audit sample was split into two strata (or groups). Stratum I included audits of entities that expended $50 million or more of federal awards. Stratum II included audits of entities that expended at least $500,000 of federal awards, but less than $50 million. A summary of the results is presented below:

Stratum I	# of Audits	% of Audits
Audits were acceptable and thus could be relied upon	61	63.5%
Audits had significant deficiencies and thus were of limited reliability	12	12.5%
Audits were unacceptable and could not be relied upon	23	24%
Total	96	100%

Stratum II	# of Audits	% of Audits
Audits were acceptable and thus could be relied upon	54	48.5%
Audits had significant deficiencies and thus were of limited reliability	18	16.5%
Audits were unacceptable and could not be relied upon	40	36%
Total	112	100%

To provide a feel for the number of audits performed in the above two groupings, in the 4/03 to 3/04 year used, 2% (852) of the audits performed were in the Stratum I category and 98% (37,671) were in the Stratum II category.

The results of the study indicate that single audits reporting large dollars of federal awards are more likely to be of acceptable quality than other single audits. With respect to dollars of federal awards reported in the audits reviewed, the study showed that 93% of the federal awards reported in all 96 Stratum I audits reviewed were reported in acceptable single audits. 56% of the federal awards reported in all 112 Stratum II audits were reported in acceptable single audits. 93% of the federal awards reported in all 208 audits in both strata combined were reported in acceptable single audits.

Misreporting of Audit Coverage of Major Federal Programs

In 8% of the audits reviewed in the sample, one or more major programs were incorrectly identified in the Summary of Auditor's Results section of the Schedule of Findings and Questioned Costs (SFQC) as having been audited as a major program.

OMB Circular A-133 states that the Summary of Auditor's Results section of the SFQC shall include an identification of major programs. The AICPA Audit Guide's1 illustrative Report on Compliance with Requirements Applicable to Each Major Program and on Internal Control Over Compliance in Accordance with OMB Circular A-133 states in the second sentence "Example Entity's major federal programs are identified in the summary of auditor's results section of the accompanying schedule of findings and questioned costs." This type of error is particularly significant to the federal agencies that rely on the listing in the summary of auditor's results section of the SFQC to be accurate. If it is not accurate, the agencies may erroneously rely on opinions that major programs have been audited as major when they have not.

By incorrectly identifying a program as major in the Summary of Auditor's Results section of the SFQC, the auditor erroneously expresses a compliance opinion on a program that was not audited.

Unreported Audit Findings

In 11% of the audits reviewed in the sample, the report found audit documentation or management letter content that included matters that the reviewers concluded either should have been reported as audit findings or the audit documentation should have explained why they were not reported as findings.

OMB Circular A-133 Section .510 describes the kinds of audit findings that the auditor shall report for federal awards. If the audit work indicates these kinds of audit findings exist, they should be reported. If the auditor concludes that a matter that could appear to be a reportable finding is not, the auditor should document that conclusion.

Findings relating to the financial statements which are required to be reported in accordance with the Yellow Book shall also be reported. The report found deficiencies in this reporting as well.

1 The AICPA Audit Guide Government Auditing Standards and Circular A-133 Audits is available at www.cpa2biz.com.

Compliance Testing Not Documented as Performed or Not Applicable

To varying degrees, in 54% of the audits reviewed in the sample, the reviewers found that the audit documentation did not include evidence that the auditor tested major program compliance requirements or explain why certain generally applicable requirements identified in the OMB Compliance Supplement were not applicable to the audit.

The report found that in some cases the lack of documentary evidence for compliance testing was substantial with audit documentation lacking for all or most applicable compliance requirements pertaining to one or more major programs. In other cases the problem existed to a lesser degree. In these cases, some compliance requirements were not documented as having been tested or documentation to support why the requirements were not applicable was lacking, but for a fewer number of compliance requirements.

The report found that in some cases the auditor documented that types of compliance requirements identified as generally applicable to the major program per the Part 2 matrix of the OMB Compliance Supplement were not applicable (e.g., by only marking "N/A" next to the item in an audit program) but did not explain why. Both SAS No. 103 and the Yellow Book require audit documentation of conclusions reached on significant matters. The reviewers believe determining that a requirement identified in the OMB Compliance Supplement as generally applicable for a major program is "not applicable" is a significant conclusion of judgment that warrants documentation.

When a program is not included in the OMB Compliance Supplement, the auditor must apply the procedures in Part 7 of the supplement to identify applicable compliance requirements. For these programs, the reviewers determined whether the audit documentation included evidence that the Part 7 procedures were properly applied to identify compliance requirements that should be tested. The report found deficiencies related to this.

Deficiencies in Understanding\Testing Compliance Internal Controls

The report segregated the deficiencies noted in this area as reflected below: In addition to the requirements of the Yellow Book, OMB Circular A-133 requires the auditor to perform procedures to obtain an understanding of internal control over federal programs sufficient to plan the audit to support a low assessed level of control risk for major programs.

Deficiencies in understanding and testing of internal control over compliance
Understanding	Testing
In 43% of the audits reviewed in the sample, reviewers determined that auditors did not document their understanding of internal controls over compliance required in OMB Circular A-133 in a manner that addresses the five elements of internal control	In 49% of the audits reviewed in the sample, reviewers found that the auditors did not document that they tested internal controls over compliance as required by A-133

In addition to the requirements of the Yellow Book, OMB Circular A-133 requires the auditor to perform procedures to obtain an understanding of internal control over federal programs sufficient to plan the audit to support a low assessed level of control risk for major programs.

OMB Circular A-133 also requires² the auditor to

• Plan the testing of internal control over major programs to support a low assessed level of control risk for the assertions relevant to the compliance requirements for each major program; and
• Perform testing of internal control as planned.

Deficiencies in Risk Assessments as Part of Major Program Determination

In 20% of the audits reviewed in the sample, the report found deficiencies in risk assessments as part of major program determination. The risk analyses must be conducted per procedures set forth in OMB Circular A-133 sections .520, .525, and .530.

The report found the following kinds of deficiencies in risk assessments of programs:

• Required risk analyses were not documented at all;
• The basis for the assessments of risk was not documented;
• The documentation indicated that the risk assessment was not performed or not properly performed for reasons including: not considering all programs, improperly clustering programs, not clustering programs, or mistakenly categorizing a program as Type A or as Type B; and
• The risk assessment decision was not consistent with information in the audit documentation.

² When internal control over some or all of the compliance requirements for a major program are likely to be ineffective in preventing or detecting noncompliance, the planning and performing of testing are not required for those compliance requirements. However, the auditor shall report a significant deficiency (including whether any such deficiency is a material weakness) in accordance with Section .510 of OMB Circular A-133, assess the related control risk at the maximum, and consider whether additional compliance tests are required because of ineffective internal control. For more information see Section .500(c) of OMB Circular A-133.

734412