Follow Up on the National Single Audit Sampling Project 2009 NSAA/NASC Middle Management Conference April 20-21, 2009 By: Ike Boone Tennessee Department of Finance and Administration

Background In 2002, the Office of Management and Budget (OMB) reported to Congress a concern that Single Audits were not being implemented correctly. This concern was based on specific cases of poor audit quality identified by Federal agencies and the Government Accountability Office (GAO). The OMB initiated a statistically based study to assess the overall effectiveness of single audits. This study was carried out by the Presidents Council on Integrity and Efficiency (PCIE) and the Executive Council on Integrity and Efficiency (ECIE) now collectively known as the Council of Inspector Generals on Integrity and Efficiency (CIGIE). Goal #1- Determine and establish a statistically based measure of the quality of single audits. Goal #2- Recommend changes in single audit requirements, standards and procedures to improve the quality of single audits

Background (continued) In June 2007 The PCIE and the ECIE released their report on the National Single Audit Sampling Project They conducted Quality Control Reviews of a statistical sample of 208 audits randomly selected from a universe of 38,523 audits that were submitted and accepted for the period April 1, 2003 through March 31, Sample was split into two strata, entities that expended $50 million or more of Federal awards (stratum 1) vs. entities that expended at least $500,000 but less than $50 million of Federal awards (stratum 2).

Project Results Results showed significant percentages of unacceptable audits and audits of limited reliability. Audits in stratum 2 showed higher percentages of deficiencies than audits in stratum 1. In total, 93 out of 208 audits were deemed unacceptable or of limited reliability, estimated 51.5% of entire universe. Stratum 1 showed 35 out of 96 audits in negative categories, estimated 36.5% of stratum 1 universe (852 total audits). Stratum 2 showed 58 out of 112 audits in negative categories, estimated 51.8% in stratum 2 universe (37,671 total audits). On a dollar basis, only 7.1% of the total Federal dollars awarded, in the audits tested, were deemed unacceptable or of limited reliability (4.1 billion out of 57.2 billion). The 115 acceptable audits led to the conclusion that lack of due professional care was, to some degree, a factor for most deficiencies (lack of documentation, misreporting coverage of major programs, unreported findings, understanding controls, SEFA presentation deficiencies).

Recommendations Report recommended a three pronged approach to improving quality of single audits and suggested that the OMB work with the American Institute of Certified Public Accountants (AICPA), CIGIE, and other appropriate parties to implement the following: Revising and improving single audit standards, criteria and guidance. Revisions should include specific documentation requirements and should require compliance testing be done using sampling as prescribed by SAS 39, Audit Sampling. Establishing minimum requirements for training on performing single audits. Should initially be hours of hands on training and should be a prerequisite for auditors to perform single audits. Periodic update training needed to continue performing audits. Reviewing and enhancing processes to address unacceptable single audits. There is a need to explore making process of suspension and debarment more effective and efficient. Also need to investigate alternative methods of sanctioning auditors who perform unacceptable audits including possible fines.

OMB Response and Follow Up The OMB concurred with the recommendations for improvements and by October of 2007 had initiated corrective action for all recommendations that required OMB action. Eight work groups were established to address recommendations. Audit Findings- creating examples to what should be included in reports. Compliance Testing- clarifying the need to test applicable compliance requirements. Audit Testing and Sampling- creating guidance and examples for testing. Training- Developing a CPE curriculum. Suspension and Debarment- drafting proposals for use of process against auditors who perform unacceptable audits. Sanctions and Punitive Actions- dialoging with AICPA and NASBA concerning ethics and peer review. PCIE QCR Checklist Revision- considering approaches for Federal Quality Control Reviews. New and Improved Single Audit Process- generating ideas for redesign of the single audit. OMB would also be evaluating other measures to improve quality and overall effectiveness of single audits. They are Looking at longer term reforms.

OMB Response and Follow Up (continued) Status of OMB Work Group Actions Work groupAnticipated product(s)Proposed timeline(s) 1. Audit Findings Revisions to OMB Circular No. A-133 Fall Compliance TestingRevisions to OMB Circular No. A-133 Compliance supplementSpring Audit Testing and SamplingComment on AICPA Audit Guide, Government Auditing Standards and Circular No. A-133 Audits Fall Training Revisions to OMB Circular No. A-133 Fall Suspension and DebarmentRevisions to OMB Circular No. A-133 which will identify criteria for single audit procurement Fall Sanctions and Punitive Actions Monitoring of the activities of NASBA and AICPAContinuous 7. PCIE QCR Checklist RevisionRevised PCIE QCR Checklist with guidance emphasizing the significance of performing QCRs Spring New and Improved Single Audit Process Revisions to OMB Circular No. A-133 with proposals for immediate improvements to the single audit process Identification of strategic improvements to the single audit process Fall 2009 Continuous Source: OMB

AICPA Response and Follow Up The AICPA concurred with the recommendations and findings. They also felt that many steps had been taken, since the period of audits being reviewed, that would address some of the issues noted, such as the establishment of the Governmental Audit Quality Center (GAQC). As a result of the study, 7 task forces were set up to examine and study the detailed findings and recommendations. Sampling/Materiality Issues in a Single Audit Environment Internal Control and Compliance Responsibilities in a Single Audit Environment Schedule of Expenditures of Federal Awards Reporting Issues Reporting Audit Findings in a Single Audit Single Audit Training Needs and Continuing Professional Education Evaluation Practice Monitoring in a Single Audit Environment Compliance Audit Considerations in Audits of Governmental Entities and Recipients of Governmental Financial Assistance

AICPA Response and Follow Up (continued) Status of AICPA Task Force Actions Work groupCompleted/Anticipated product(s) Completed/proposed timeline(s) 1. Sampling/Materiality Issues in a Single Audit Environment New chapter in AICPA Audit Guide, Government Auditing Standards and Circular A-133 Audits (Audit Guide) Fall Internal Control & Compliance Responsibilities in a Single Audit Environment Clarification to Chapter 9 Consideration of Internal Control Over Compliance for Major Programs of the 2008 AICPA Audit Guide Practice Aid templates (both in a narrative and checklist format) to assist auditors in documenting their understanding and testing of internal control over compliance Examples of internal control and compliance documentation for certain A-133 compliance requirements using the Practice Aids described above Issued November 2008 Summer 2009 Fall Reporting Audit Findings in a Single Audit Illustrative Findings Template Practice Aid Examples of actual findings write-ups using the Illustrative Findings Template Practice Aid Summer 2009 Fall Single Audit Training Needs and Continuing Professional Education (CPE) Evaluation Single Audit Training Curriculum white paper issued to OMB for its consideration Issued July 2008Issued July Schedule of Expenditures of Federal Awards (SEFA) Reporting Issues Clarification to Chapter 7 Schedule of Expenditures of Federal Awards of the 2008 AICPA Audit Guide Illustrative Audit Program for the SEFA Illustrative Auditor Disclosure Checklist for the SEFA Issued November 2008 Summer Practice Monitoring in a Single Audit Environment Recommendations to the AICPA Peer Review Board Conduct periodic meetings with Inspector General community after recommendations from all the task forces are completed to facilitate, enhance, and improve the effectiveness of the Peer Review Program Spring 2009 Continuous 7. Compliance Auditing Considerations in Audits of Governmental Entities and Recipients of Governmental Financial Assistance Exposure Draft of a new auditing standard titled Compliance Auditing issued and out for public comment. This proposed standard would supersede Statement on Auditing Standards (SAS) No. 74, Compliance Auditing Considerations of Governmental Entities and Recipients of Governmental Financial Assistance, which is the current auditing standard in this area. New compliance auditing standard Issued December 2008 Summer 2009 Source: AICPA

GAO Response and Follow Up In testimony before congress, the GAO supported the recommendations that were in the report. They were concerned that the audits were not being conducted in accordance with professional standards and requirements and that those audits could provide a false sense of assurance and could mislead users of the single audit reports. GAO pointed out factors to consider when implementing recommendations: Audit quality problems by size of audit Distribution of audits by size GAO also suggested a separate effort to evaluate the entire framework for single audits. The following questions were posed: What type of simplified alternatives exist for meeting accountability in smaller audits? Is current Federal oversight structure adequate and consistent? What alternative oversight structures could improve accountability and oversight? Are sufficient resources dedicated to oversight? What role can auditing profession play in increasing single audit quality? Do the specific requirements in OMB Circular No. A-133 and the single audit act need updating? GAO would also monitor the activities of the other mentioned agencies as it related to implementing the recommendations.

GAO Response and Follow Up (continued) The GAO conducted a performance audit from February 2008 through January 2009, in accordance with generally accepted government auditing standards and found the following: The current design of the Federal oversight structure for the single audit process does not include a designated function or entity for monitoring implementation of single audit requirements by Federal awarding agencies The current design of single audit process has resulted in variations in performing key functions such as quality control reviews and the use of Federal Audit Clearinghouse Entities with smaller awards are subject to same requirements of larger entities raising concerns about complexity and relative cost-benefit of those requirements on smaller audits and can the requirements for larger entities be reviewed to identify best practices and provide guidance for achieving higher quality audits.

GAO Response and Follow Up (continued) GAO made recommendations for OMB to follow in order to monitor the risk, cost-benefit, and efficiency and effectiveness of the single audit process: designate an entity or group to (1) evaluate and comprehensively monitor the single audit process governmentwide, (2) assess the efficiency and effectiveness of how agencies carry out their single audit responsibilities, and (3) identify additional guidance and resources needed to carry out single audit requirements designate a federal workgroup such as its New and Improved Single Audit Process workgroup to evaluate the current single audit process to identify simplified alternatives for meeting the accountability objectives of the Single Audit Act for the audits of small entities, while achieving the proper balance between risk and cost-effective accountability for the smallest to the largest entities; and monitor the status of OMB workgroups, AICPA task forces, and NASBA referral project activities, and evaluate completed actions and their impact on addressing the PCIE report recommendations to improve single audit quality. OMB concurred with the observations and recommendations.

Other Agency Efforts The National Association of State Boards of Accountancy developed a process in May 2008 for tracking status of federal agency referrals on poor performing auditors to state boards to ensure appropriate action and timely follow up. NASBA plans to contact each Federal grant awarding agency on a quarterly basis to inquire about outstanding referrals They will follow up with agency 2 weeks after each quarterly referral to determine whether issue has been resolved. The Association of Government Accountants created the Partnership for Intergovernmental Management and Accountability to determine how all levels of government can develop ways the Single Audit Act Amendments of 1996 and Improper Payments Information Act of 2002 can be coordinated to meet accountability requirements of both laws with less duplication of work. Final report due in 2010