AICPA Governmental Audit Quality Center Conference Call January 28, 2009 Preparing for Your Single Audit: An Auditee

1. AICPA Governmental Audit Quality Center Conference CallJanuary 28, 2009Preparing for Your Single Audit: An Auditee Perspective Presented by: Joseph E. Seibert Partner KPMG jseibert@kpmg.com (717) 260-4608 Sean M. Walker, Assistant Director of Assurance Services Clifton Gunderson LLP Sean Walker@cliftoncpa.com (414) 721-7521

2. What Will Be Covered After participants complete this call, they will understand: Why this call is being held The basics of OMB Circular A-133, when it is applicable, and what it requires of the auditor What compliance requirements are, how auditees can identify them, and what auditors are required to test Auditee responsibilities for internal control over compliance, the various elements of COSO, and auditor responsibilities for understanding and testing auditee internal control Various rules and regulations that must be complied with to achieve compliance The various reporting requirements for both auditors and auditees Tips for auditees to get ready for their audits and steps that can be taken to help ensure a quality audit is obtained

3. Why the Need for this Call?

4. Single Audit Quality Concerns • Study of single audits performed in 2007 indicated that improvements are needed in many areas • These quality problems have been a focus of attention for the AICPA and certain federal agencies since the federal study was issued • There has been a Senate hearing on the study and the Government Accountability Office is also studying the issue

5. AICPA Activities in Response to the Study • Establishment of the AICPA Governmental Audit Quality Center (GAQC) in 2004 (the sponsor of this call) • Voluntary membership organization within the AICPA with over 1100 member firms whose mission it is to improve the quality of single audits • Center provides member firms resources to assist in enhancing their audit quality, particularly their single audit quality • Member firms must adhere to membership requirements designed to enhance quality • To learn more about the GAQC or to view a member listing, go to www.aicpa.org/GAQC • The GAQC Web site (www.aicpa.org/GAQC) can also be used as a resource for auditees • Specific task forces working on various technical areas

6. Improving Single Audit Quality is a Group Effort • For significant improvements in single audit quality to occur, the audit profession, federal agencies, and auditees need to be involved in the solution • Auditees can: • Ensure rigorous procurement processes • Develop robust governance structures that support the benefit of audits, consider the qualifications of a firm during the hiring process, and evaluate the reasonableness of the firm’s anticipated hours in relation to the proposed fee based on the work to be performed • Be well-educated about the single audit process and what it requires of both auditees and auditors (the reason for today’s call!!)

7. Quality Concerns Not Just an Auditor Issue • Factors to consider when hiring an auditor: • Demonstration of qualifications • Availability of staff with appropriate technical abilities • Extent of auditor’s experience with organizations like yours • Results of the external peer review • Participation in quality improvement programs like the GAQC

8. Why a Quality Single Audit Benefits Auditees • Helps assure you about the integrity of funded programs • Allows you to uncover noncompliance early • Helps you fulfill your fiduciary responsibility • It is the right thing to do

9. A-133 Basics Circular A-133 Basics

10. What Auditors are Required to Do Under A-133, What We Need from Management, and How it Affects You • Definition of Federal Award • Obtain SEFA from Client • Complete Risk Assessment / Determine Major Programs • Type A/B Programs • High Risk Program Indicators • Percentage of Coverage Rules • Obtain Understanding of Major Program

11. What Auditors are Required to Do Under A-133, What We Need from Management, and How it Affects You(continued) • Test Major Program • Design of Internal Controls / Walk-through • Elements of COSO • Compliance with Grant Regulations and Effectiveness of Internal Control • Federal Compliance Supplement • 14 Compliance Requirements • Common Areas for Findings (with reference to regulation) • Develop Reports on Compliance and Control • Evaluate Findings

12. Audit Scope and Objectives of an A-133 Single Audit • Conducted in accordance with Generally Accepted Government Auditing Standards (GAGAS) • Covers entire operations of the entity • Financial statements are presented fairly • Adequate internal control structure • Compliance with laws and regulations • Follow-up on prior audit findings

13. When is A-133 Applicable? • When an entity expends federal awards (either direct or indirect awards) in excess of $500,000 they are subject to the provisions of OMB Circular A-133. • What qualifies as a Federal Award?

14. Definition of Federal Award • Federal financial assistance and Federal cost-reimbursement contracts that non-Federal entities receive directly from Federal awarding agencies or indirectly from pass-through entities. • It does not include procurement contracts, under grants or contracts, used to buy goods or services. • Analysis completed by the client to determine if a vendor relationship exists.

15. Examples of Federal Assistance • Grants • Contracts • Cooperative Agreements • Loans • Loan Guarantees • Property • Interest Subsidies • Insurance • Direct Appropriations • Endowments • Other Non-Cash Assistance • Indirect State or Local Government Transfers of Federal Funds

16. Schedule of Expenditures of Federal Awards (SEFA) • Prepared by management • Includes all activities from previous slide • Reconciles to the general ledger • Specify pass-through awards • Include CFDA or identifying number for each grant • Auditor uses this document to perform risk assessments and selection of major programs • Completeness critical to avoid over testing or missed programs

17. Cluster Consideration • Similar requirements but different CFDA numbers can be clustered based on the compliance supplement • Treated as one program for major program determination and testing • Awards with the same CFDA number will also be clustered together • Most common: • Research and Development • Student Financial Aid • Homeland Security • Special Education • Part 5 of the Compliance Supplement for information on clusters

18. Risk Assessment and Major Program Determination • Determine if entity is a low risk auditee • Considerations for the two preceding years include: • A-133 audit performed • Unqualified opinion on Financial Statements and SEFA • No Material Weaknesses noted • No compliance findings that have a material impact on a Type A program. • Known/likely question costs > 5% of total awards expended on Type A program • Low risk auditee determination dictates coverage of SEFA required to be obtained by the auditor. • Low Risk Auditee = 25% • High Risk Auditee = 50% After this is determined, auditor can begin the process of selection of major programs.

19. Risk Assessment and Major Program Determination (continued) • Risk–Based Approach: Step 1 Step 2 Step 3 Step 4 Identify "Type A" programs Identify low-risk "Type A" programs Identify high-risk "Type B" programs Determine major programs to audit

20. Risk Assessment and Major Program DeterminationStep 1 – Identify Type A Programs • Federal programs where total expenditures under the program exceed the larger of: • $300,000 or 3% of total Federal expenditures where total Federal expenditures are > $300,000 AND < $100 million Programs not deemed Type A are Type B

21. Risk Assessment and Major Program DeterminationStep 2 – Identify Low Risk Type A • Considerations Necessary for Low Risk: • Audited as a major program in at least 1 of preceding 2 years • No audit findings noted in last audit • Oversight agency does not deem high-risk • Auditor judgment • Current and prior audit experience • Major changes in program regulation, personnel or systems All Type A's that are not Low Risk are deemed High Risk

22. Risk Assessment and Major Program DeterminationStep 3 – Identify High Risk Type B • Type B programs are those that exceed the larger of $100,000 or .3% of Federal Awards that are not Type A programs • Perform risk assessments on the items noted above • Considerations for Assessing Risk: • Weakness in internal control over compliance • Skill level of those responsible for program compliance • Administration under multiple internal control structures • System for monitoring sub-recipients • Information systems utilized • Prior audit findings • Audited as a major program in the past • Reviews by oversight agency or pass-thru entity completed recently • Auditor judgment

23. Risk Assessment and Major Program DeterminationStep 4 – Identify Major Programs • Major programs will be: • All Type A programs except those identified as low-risk in Step 2 (i.e., high-risk Type A) • Type B programs identified as high-risk in Step 3 using 1 of 2 options (discussed below) • Such additional programs necessary to comply with 50% rule or 25% if low-risk auditee • Option 1: • At least ½ of Type B programs identified as high-risk under Step 3 • Option 2: • One high-risk Type B program for each low-risk Type A program identified under Step 2

24. Obtaining an Understanding of Major Programs • Compliance Supplement – Parts 2, 3, 4, 5 and 7 • Review grant documents • Determine key elements • Amount • Timing • Applicable compliance requirements • Indirect cost considerations • Regulations • Expenditure Patterns • Wages, benefits, equipment, etc. • View Handout: Grant Coversheet

25. Other Planning Considerations • Discussion with oversight agency • Review reports issued during the year • Follow up on status of prior audit findings

26. Compliance Requirements

27. All Compliance Requirements? • Do auditors look at all applicable compliance requirements? • No • Direct and material compliance requirements • Should an auditee comply with all applicable compliance requirements? • Yes • Do not try to predict an auditor’s scope

28. Compliance Requirements • Activities Allowed or Unallowed (A) • Specifies the activities that can or cannot be funded under a specific program • Allowable Costs / Cost Principles (B) • Specifies the costs that can and cannot be funded under a specific program and how they are calculated and supported • Cash Management (C) • Reimbursements are properly supported • Advance payments are properly managed • Interest earned on advance payments is inconsequential or remitted to grantor • Davis-Bacon Act (D) • Contractors are paid the prevailing wages of the local department of labor • Eligibility (E) • Participants meet the program criteria to receive grant funding

29. Compliance Requirements (continued) • Equipment and Real Property Management (F) • Management, use and disposal of equipment or real property • Matching, Level of Effort, Earmarking (G) • Matching, required cost share • Level of effort, required participation from period to period • Earmarking, setting aside funding for a purpose • Period of Availability of Federal Funds (H) • Expenditures are within the granting period • Claims have been made within a reasonable period of time after the granting period • Procurement and Suspension and Debarment (I) • Federal, state or local procurement laws are followed • Vendors and sub-recipients are not suspended or debarred

30. Compliance Requirements (continued) • Program Income (J) • Income generated by Federal funds are used for program expenditures • Income generated by Federal program offset Federal claims • Real Property Acquisition and Relocation Assistance (K) • Equal treatment by persons displaced by the Federal government • Reporting (L) • Reporting results • Performance • Financial • Special reporting • Sub-recipient Monitoring (M) • Monitoring pass-through funding • Special Tests (N) • Other

31. What is a Direct and Material Compliance Requirement? • First thing is first, what compliance requirements are applicable? • Part 2 – Matrix of Compliance Requirements • Part 7 – Guidance for Auditing Programs Not Included • Very subjective, meaning • Personal views / auditor judgment • Experience • Accepted risk • Industry expectation • Qualitative and quantitative factors

32. Qualitative Factors • Federal, state, local oversight • Internal or other external audits • Findings • Obvious need for compliance • Allowability • Cash management • Eligibility • Reporting

33. Quantitative Factors • Materiality assessments • For example: 5% of expenditures, +/- 1 day, etc. • Auditor’s tolerance, not an auditee concept

34. Tips for the Grant Manager • Gather and summarize grant information • Clean and organized records give auditors comfort • Document your policies and procedures • Documentation drives quality and compliance • Know where to find the OMB A-133 Compliance Supplement

35. Approaching a Compliance Requirement • Who is responsible for the compliance requirement? • Analyze internal control using COSO • Design test of internal control over compliance • Sample size • Key controls • Design test of compliance

36. Internal Control Over Compliance

37. Analyzing Internal Control • OMB A-133 requires us to plan our audit to obtain a “low” control risk • That is controls that “operate effectively” • Reliable controls • How do we get to “low” control risk? • Document our understanding • Test control design and implementation • Test control effectiveness

38. Understanding • We are required to document our understanding of your internal controls over grant programs using the COSO framework

39. Control Activities You should be able to answer the following questions when asked: • How are you certain your organization is in compliance with (insert specific compliance requirement)? This question flushes out the control activities.

40. Risk Assessment • How did you learn that (control activity) was necessary to ensure compliance? This question flushes out the risk assessment component.

41. Information and Communications • How and when do you notify people the (control activity) is required? This question flushes out the information and communication component.

42. Monitoring • What is the process used to ensure the (control activity) is performed correctly and consistently? This question flushes out the monitoring component. Auditors cannot be part of the auditee’s internal controls!

43. Control Environment • A summary of the other control components is the control environment • What is management attitude about controls? • By looking at the answer to the other questions, we can get real insight on management’s attitudes

44. The Good, The Bad and The Ugly • Testing internal controls and compliance require sampling • The Good – auditors do not test every transaction • The Bad – the transactions tested have significant meaning • The Ugly – errors equal findings or more testing which translates in more time and more money

45. Internal Control Testing • Test of design and implementation • Walkthrough of our understanding • Conclusion: Control has been properly designed and implemented • Test of effectiveness • Select a sample and test control attributes • Conclusion: Control is effective • Control must be effective or you should have a finding

46. Compliance Testing • If controls are effective, sample sizes are similar if not the same for compliance testing • If controls are not effective, sample sizes need to be significantly increased to determine compliance

47. Tips for Grant Managers • Document your controls using COSO • Make sure everyone in your organization knows your control system • Periodically, review the internal control system and see if it is working • Closely monitor new employees for strict compliance with policies

48. Achieving Compliance

49. First Step to Compliance Which Circular Do I Follow? Although there are six grant circulars, you are only covered by three of them, depending on type of entity: States, local governments, and Indian Tribes follow: • A-87 for cost principles, Relocated to 2CFR, Part 225 • A-102 for administrative requirements (common rule), and • A-133 for audit requirements Educational Institutions (even if part of a State or local government) follow: • A-21 for cost principles, Relocated to 2CFR, Part 200 • A-110 for administrative requirements, Relocated to 2 CFR, Part 215, and • A-133 for audit requirements Non-Profit Organizations follow: • A-122 for cost principles, Relocated to 2 CFR, Part 230 • A-110 for administrative requirements, Relocated to 2 CFR, Part 215 and • A-133 for audit requirements

50. Effort Reporting • Cost principles for not-for-profits are found in A-122 Attachment B 8(m) • Amount must be from documented payrolls approved by responsible officer supported by after-the-fact personal activity reports • Cost principles for Governments are found in A-87 Attachment B 8(h) • One cost center – approval by responsible official • Complete semi-annual personal activity report • Multiple cost centers – personal activity report • Cost principles for hospitals can be found at 45CFR Appendix E to Part 74 “Principles for Determining Costs Applicable to Research and Development Under Grants and Contracts with Hospitals”