1. May 20, 2016 SINGLE AUDIT Tracy Hensley, Partner, KPMG LLP Brett Burns, Senior Manager, KPMG LLP

2. Agenda What is a Single Audit? Uniform Guidance – Audit Specific Changes Programs Audited Audit Approach KPMG Audit Team Student Financial Aid Other Federal Programs Single Audit Timeline Determination of Findings Overview MAY 2016YEAR-END GAAP TRAINING 2

3. What is a Single Audit? The Single Audit Act of 1996 established requirements for audits of entities that administer federal financial assistance programs. The Office of Management and Budget (OMB) issued Circular A-133 in 1997 to implement the requirements of the Single Audit Act and provide specific criteria to be followed as required by Federal regulations. This circular and its requirements are effective for Federal awards received prior to December 26, 2014. The Uniform Guidance (2 CFR part 200, subpart F) was issued in 2013 to replace Circular A-133, and is effective for Federal awards received after December 26, 2014. A Compliance Supplement will be prepared to describe the compliance requirements under the Uniform Guidance and is expected to be issued in late May or early June. MAY 2016YEAR-END GAAP TRAINING 3

4. What is a Single Audit? (continued) The Uniform Guidance requires the auditor to: Obtain an understanding of the entity’s internal control over Federal programs and perform testing of internal control over compliance requirements relevant to each major program Test compliance with requirements relevant to each major program The Reports issued at the end of a Single Audit includes: A report on internal controls over compliance. An opinion on compliance with applicable federal regulations for the programs audited. One consolidated “in relation to” opinion on the Schedule of Expenditures of Federal Awards, representing all CSU campuses and federally-funded programs subject to the Single Audit. MAY 2016 YEAR-END GAAP TRAINING 4

5. Knowledge Check #1 The Uniform Guidance requires the auditor to: A. Test controls or compliance with Federal regulations B. Provide an opinion on internal control C. Obtain an understanding of the entity’s internal control over Federal programs and perform testing of internal control over compliance requirements relevant to each major program D. Only test for compliance with Federal program compliance requirements MAY 2016 YEAR-END GAAP TRAINING 5

6. Knowledge Check #1 Answer The Uniform Guidance requires the auditor to: C. Obtain an understanding of the entity’s internal control over Federal programs and perform testing of internal control over compliance requirements relevant to each major program A is incorrect since the auditor is required to test both controls and compliance B is incorrect because the auditor provides a report on internal control, but does not provide an opinion on the effectiveness of internal control D is incorrect as the auditor is required to test both controls and compliance MAY 2016 YEAR-END GAAP TRAINING 6

7. Uniform Guidance “New” Low Risk – 25% High Risk – 50% 7 OMB Circular A-133 “Old” Audit Coverage Low Risk – 20% High Risk – 40% No impact Likely Impact.003 times Federal Awards Type A Threshold.003 times Federal Awards No impact Significant deficiency, material weakness High Risk triggers Material weakness Moderate impact on program selection 14 Compliance Requirements 12 Moderate Impact Required but not well defined Internal Controls Must have internal controls over compliance Moderate to High impact $10,000 known or likely Questioned Cost threshold $25,000 known or likely Moderate impact Focus on Type A programs Program Selection Focus on high risk programs Moderate to High impact on program selection Topic MAY 2016 YEAR-END GAAP TRAINING 7

8. Uniform Guidance – Audit Specific Changes Combination of cost circulars (A-87, A-21, A-122) Governments, non profits and universities will all follow the same cost principles as included in 2 CFR part 200 Strengthens Subrecipient Monitoring requirements Requires establishment of documented time and effort policies Must have written policies for: Financial Management Compensation Payment Relocation Costs Procurement Travel Costs Prescribes five procurement methods – deferred adoption Different purchase thresholds will have different compliance requirements Requires the entity to maintain effective internal control over compliance. 8 MAY 2016 YEAR-END GAAP TRAINING

9. What will be Different about this year’s Audit? Subrecipient Monitoring Audit teams will request written risk assessment and monitoring policies and processes for awards to subrecipients Compliance procedures will include testing whether: Subaward agreements include standard data elements Monitoring activities include the review of financial and programmatic reports; that campus verify each subrecipient is audited; and, that follow up on corrective actions is occurring That management evaluated and documented each subrecipients risk of noncompliance to determine monitoring approach Could consider subrecipients prior experience with similar subawards, results of previous audits, whether subrecipients has new personnel or systems and extent and results of Federal awarding agency monitoring That monitoring activities are documented and consistent with results of risk assessment 9 9 MAY 2016 YEAR-END GAAP TRAINING

10. What will be Different about this year’s Audit? Time and Effort Reporting Audit teams will request written policies and processes for allocation of compensation, fringe benefits, relocation and travel costs (time and effort reporting) to Federal expenditures, and evaluate compliance with federal regulations Compliance procedures will include testing whether: Allocation to Federal awards is in compliance with policy Procedures could vary depending on the policies and processes put in place. If policies and processes are unchanged from prior year, there will be little change in audit procedures from prior year Such policies are documented, regardless of whether policies and processes changed 10 MAY 2016 YEAR-END GAAP TRAINING

11. What will be Different about this year’s Audit? The “Musts” For Other Written Policies included in the Uniform Guidance Audit teams will request the following required written policies that should conform to applicable Federal law and the Uniform Guidance: Financial Management: Policies and procedures for determining the allowability of costs in accordance with the Uniform Guidance Payment: Policies and procedures to ensure that funds received on an advance basis are promptly disbursed Procurement: Documented procurement procedures which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable Federal law and the Uniform Guidance, including written standards of conduct covering conflicts of interest and governing the actions of its employees 11 MAY 2016 YEAR-END GAAP TRAINING

12. What will be Different about this year’s Audit? Internal Controls over Compliance “The entity must establish and maintain effective internal controls over Federal awards that provide reasonable assurance that awards are being managed in compliance with Federal statutes, regulation and the terms and conditions of the Federal award. “ The Compliance Supplement requires that auditors test those controls over compliance and report on internal control over compliance. Audit teams will be requesting written documentation describing internal controls in place over compliance requirements If automated controls are identified, with no manual mitigating controls identified, audit teams will need to test system controls If no control is identified, or the control is not documented or is ineffective, that could result in a significant deficiency or material weakness in controls over compliance, even if a compliance finding is not noted. 12 MAY 2016 YEAR-END GAAP TRAINING

13. Internal Controls Internal Controls are policies and procedures organizations employ to make sure that the information being processed is complete and accurate. An internal control answers the question, “How do you know it’s right?” Controls need to be documented to demonstrate they are operating Two general categories of internal controls: Preventive Controls Examples: Segregation of Duties Supervisory Review Reviewing and addressing exception reports Automated controls Detective Controls Examples: Account reconciliations Sampling transactions after the fact Reviewing and addressing exception reports Automated controls 13 MAY 2016 YEAR-END GAAP TRAINING

14. So Then, What is a Process? A process includes the steps taken to compute an amount or record a transaction. Processes include internal control components. An example of a student financial aid process (refunds) and a control in the process: Process: Financial aid counselor computes a student’s refund by obtaining the student’s last day of attendance, referencing the campus refund policy, and applying that information to the student’s payment. Control: The financial aid counselor’s knowledgeable supervisor reviews the refund computation, compares the information used in the computation to the information used by the financial aid counselor, and signs the refund computation, indicating that the review was performed. MAY 2016 YEAR-END GAAP TRAINING 14

15. And Compliance? Compliance is actually getting the right answer. Was the refund properly made in the right amount in the right timeframe? There is a higher likelihood of compliance when effective internal controls are in place. Controls could be in place, but if they are not effective, errors could occur. Causes of ineffective controls (using prior example): Supervisory review performed by someone who is not knowledgeable. Supervisory review performed, but underlying documents are not reviewed. Not occurring (assumed if not documented). MAY 2016 YEAR-END GAAP TRAINING 15

16. An Example – Allowable Costs – Non Payroll Compliance RequirementsControl Procedure over Compliance Type of Control Costs were necessary and reasonable for the performance of the Federal Award and allocable under the principles of 2 CFR part 200, subpart E and the applicable program grant agreement. Costs were adequately documented (supported with an invoice). Costs were approved by the Federal awarding agency, if required. All expenditures are reviewed and approved by a knowledgeable individual prior to payment to ensure the costs are allowable under the program, have proper invoice support, have received approval by the Federal awarding agency if required, and are charged to the correct expense code and fund. This review is evidenced by their signature and date on the invoice. Manual Review Control YEAR-END GAAP TRAINING MAY 2016 16

17. Another Example – Allowable Costs - Payroll Compliance RequirementsControl Procedure over ComplianceType of Control Charges for salaries and wages must be based on records that accurately reflect the work performed after the fact. These records must be supported by a system of internal control which provides` reasonable assurance that the charges are accurate, allowable and properly allocated. The entity's system of internal control includes processes to review the after the fact interim charges made to the federal awards based on budget estimates. All necessary adjustments must be made be made such that the final amount charged to the Federal award is accurate, allowable and properly allocated. Salary allocations entered into the Effort Reporting System at the time the grant is awarded are reviewed and approved by prior to the salaries being charged in the GL. After initial approval, effort is reviewed and confirmed every six months by a person knowledgeable about the individuals activities. Review and Approval is indicated in the system by their log in credentials on the effort report. Any adjustments in percentages are updated in the general ledger prior to year end. All changes for each reporting period are summarized on an edit report which is reviewed. Their review of this report includes making sure these adjustments were posted to the general ledger. Evidence of their review of this edit report is noted by their signature and date. Management Review control and System control YEAR-END GAAP TRAINING MAY 2016 17

18. Knowledge Check #2 An internal control can be described as follows: A. The process used to compute a refund by a financial aid counselor. B. A procedure in place that is effective in determining that refunds are computed properly. C. A control is not necessary if refunds are usually computed correctly. D. The only effective control is a detective control. MAY 2016 YEAR-END GAAP TRAINING 18

19. Knowledge Check #2 Answer An internal control can be described as follows: B. A procedure in place that is effective in determining that refunds are computed properly. A is not correct, as a control is in place to make sure the process was performed properly C is not correct, as entities are required to have internal controls over compliance requirements under the Uniform Guidance D is not correct as there are a variety of controls that could be effective MAY 2016 YEAR-END GAAP TRAINING 19

20. Knowledge Check #3 Which of the following situations could result in an internal control finding: A. The supervisor may perform a review of a refund computation; however, that review is not documented. B. Internal controls are in place and documented; however, numerous errors in refund computations were noted. C. The supervisor reviewed and approved the refund computation, which was accurately determined, as evidenced by his/her signature on the computation D. Both A and B. MAY 2016 YEAR-END GAAP TRAINING 20

21. Knowledge Check #3 Answer Which of the following situations could result in an internal control finding: D. Both A and B. The supervisor may perform a review of a refund computation; however, that review is not documented. Internal controls are in place and documented; however, numerous errors in refund computations were noted. C is not correct, as that control appears to be in place and functioning MAY 2016 YEAR-END GAAP TRAINING 21

22. Major Programs Selection Process for 2016 Audit The selection process will be performed by KPMG once a final consolidated Schedule of Federal Awards has been provided by the CSU System in early August. We will perform the following procedures to determine the programs subject to audit: Compute a threshold to distinguish between Type A and Type B programs. Evaluate programs over the threshold based on inherent risk in the program, last time the program was audited, and any findings noted in program in prior year. Those programs over the threshold that are considered low risk are subject to audit every three years. Programs with the same CFDA number are considered the same program, even if on different campuses or from different agencies. Certain programs, such as Student Financial Aid programs and Research and Development programs, are audited as one program or cluster. MAY 2016 YEAR-END GAAP TRAINING 22

23. Preliminary Major Program Selection Programs Subject to Audit in 2016 Student Financial Aid Cluster Programs that may be subject to audit in 2016 Research and Development Head Start TRIO Higher Education Institutional Aid Foster Care Program – Title IV Other smaller programs – to be determined MAY 2016 YEAR-END GAAP TRAINING 23

24. Audit Approach Chapter 15 in the GAAP Manual discusses the procedures and planned approach for the Single Audit, including: Designated space for providing guidance and memorializing questions and answers that arise regarding preparation for the audit; and Comprehensive Single Audit PBC lists. There are two PBC lists included at Exhibit 24 to the GAAP Manual: Limited Scope: applicable to all campuses Higher Scope: applicable to the eight campuses selected for Higher Scope procedures for the Student Financial Aid Cluster Due dates are stated on the respective PBC lists PBC lists and other guidance applicable for audit testwork of major programs (other than the Student Financial Aid Cluster) will be provided directly to selected campuses once planned procedures are identified. MAY 2016 YEAR-END GAAP TRAINING 24

25. Audit Approach (continued) All campuses are responsible for the preparation of the Schedule of Expenditures of Federal Awards (SEFA). Campuses are to submit a preliminary SEFA in YES by July 25, 2016. The CO will submit a preliminary consolidating SEFA to KPMG by August 7, 2016. See GAAP Manual for other relevant deadlines. Subsequent changes to each campus SEFA may affect the selection process of major programs. Please keep the CO informed with regard to subsequent changes in the SEFA that are either reported or planned to be reported. All campuses will also need to prepare a reconciliation of the SEFA to other reporting sources, such as FISAP (template provided at Exhibit 23 of the GAAP Manual). Support for reconciling items should be prepared by the campus and made available to the audit team. MAY 2016 YEAR-END GAAP TRAINING 25

26. Audit Approach (continued) Single audit fieldwork will be conducted by specialized audit teams, separate from those conducting the financial statement audit. The timing of the student financial aid audit begins in late-July and will continue through the end of August (with the exception of the testing of the FISAP, which is not due until October). The timing of the audits for non-student financial aid programs will be in August or September, and will be coordinated with the individual campuses once program selections have been finalized. Each campus subject to higher scope procedures will have a preliminary entrance discussion, regular status meeting updates, and a closing discussion. We ask that the GAAP Coordinator at each campus take an active role with ensuring that PBCs are prepared in a timely manner and that any open items at the conclusion of fieldwork are addressed. MAY 2016 YEAR-END GAAP TRAINING 26

27. KPMG Team MAY 2016 YEAR-END GAAP TRAINING 27 Partner Tracy Hensley Senior Manager/Manager Brett Burns Erin Alton SoCal SFA Team Senior AssociateStaff Associate NoCal SFA Team Senior AssociateStaff Associate Other Programs Team Senior AssociateStaff Associate

28. Knowledge Check #4 Which of the following is true with regard to preparation and reporting for the Single Audit procedures? A. All campuses are expected to prepare a reconciliation of the SEFA to other reporting sources, such as the FISAP. B. Changes to the SEFA subsequent to initial reporting will have no impact to the selection of major programs or scoping of the year-end single audit. C. Documents requested on the PBC lists are suggested rather than required deliverables. D. All campuses are required to prepare the documents requested on the Higher Scope PBC list. MAY 2016 YEAR-END GAAP TRAINING 28

29. Knowledge Check #4 Answer Which of the following is true with regard to preparation and reporting for the Single Audit procedures? A. All campuses are expected to prepare a reconciliation of the SEFA to other reporting sources, such as the FISAP. B is not correct, as changes to the SEFA after program selections are made could change the program selection process C is not correct, as all requested documents are required D is not correct, as only campuses subject to higher scope procedures are required to prepare those documents MAY 2016 YEAR-END GAAP TRAINING 29

30. Student Financial Aid Cluster of Programs Included in Scope of Federal Single Audit MAY 2016 YEAR-END GAAP TRAINING 30 Grant Programs Pell Grants Federal Supplemental Educational Opportunity Grants TEACH Grants Scholarships for Disadvantaged Students Federal Work Study Postsecondary Education Scholarships for Veteran’s Dependents Loan Programs Federal Direct Student Loans Federal Perkins Loans Nursing Student Loans 30

31. Student Financial Aid – Full Scope Campuses MAY 2016 YEAR-END GAAP TRAINING 31 Channel Islands Chico Long Beach Maritime Academy Sonoma San Francisco San Bernardino Northridge

32. Student Financial Aid – Compliance Areas Subject to Audit & Sample Procedures Cash Management Select a sample of cash receipts and compare with campus accounting records to test for compliance with applicable payment method (i.e. advance, reimbursement, etc.). Eligibility and Disbursements Select a sample of students and review campus records to ascertain appropriate determination of: Student eligibility for various grant and loan programs Calculation of benefits Disbursements only occurring after certain criteria have been met Proper disclosure to students with respect to repayment and cancellation of any loans or loan increments disbursed MAY 2016 YEAR-END GAAP TRAINING 32

33. Student Financial Aid – Compliance Areas Subject to Audit & Sample Procedures (continued) Reporting Obtain FISAP and test for accuracy and completeness by selecting a sample of line items reported and comparing to campus records. Select a sample of students that received Pell Grants and compare the data reported on Pell origination and disbursement records to the COD to campus records for accuracy. Verification Select a sample of students that were selected for verification and obtain campus records to ascertain that verifications were performed in accordance with campus policies and federal requirements, generally prior to disbursement of aid. Student Status Changes (Enrollment Reporting) Select a sample of students to test for timing and accuracy of the status change data submitted to the NSLDS. MAY 2016 YEAR-END GAAP TRAINING 33

34. Student Financial Aid – Compliance Areas Subject to Audit and Sample Procedures (continued) Return of Title IV Funds Select a sample of students or students that did not begin attendance, and obtain campus calculation of amounts earned and due back. Obtain campus records, and test for accuracy and timeliness of returns (i.e. 45 days). Borrower Data Transmission and Reconciliation (Direct Loans) Select a sample of school account statements and ascertain that reconciliations are being performed. Select a sample of borrowers and verify the accuracy of data in the Direct Loan Servicing System by comparing to campus records. MAY 2016 YEAR-END GAAP TRAINING 34

35. Knowledge Check #5 Which of the following areas of compliance are expected to be part of the Single Audit for the Student Financial Aid Cluster? A.Cash Management B.Eligibility C.Refunds D.All of the Above MAY 2016 YEAR-END GAAP TRAINING 35

36. Knowledge Check #5 Answer Which of the following areas of compliance are expected to be part of the Single Audit for the Student Financial Aid Cluster? D. All of the Above Cash Management, Eligibility, and Refunds are all areas of compliance that will likely be tested as part of the Single Audit. MAY 2016 YEAR-END GAAP TRAINING 36

37. Other Federal Programs – Compliance Areas Subject to Audit and Sample Procedures Allowable Activities/Allowable Costs Select a sample of non-payroll-related expenditures charged to the program and test allowability in accordance with OMB Circular A-21 and the applicable program regulations. Select a sample of payroll-related costs charged to the program and test if time and effort documentation is in accordance with OMB Circular A-21 and supports the expense charged to the program. Obtain a copy of the approved indirect cost rate for the audit year and review the campus’ calculation to determine if an appropriate base was used and the rate was applied correctly. Cash Management Select a sample of cash receipts from the federal government along with campus records that support the related cost incurred. Test for compliance with applicable timing requirements for advance payments or reimbursements. MAY 2016 YEAR-END GAAP TRAINING 37

38. Other Federal Programs – Compliance Areas Subject to Audit and Sample Procedures (continued) Eligibility Select a sample of program participants and obtain the campus records that support their eligibility. Re-perform the eligibility determination in accordance with program guidelines. Earmarking Obtain the campus documentation for its calculations regarding any required program earmark amounts or participants. Perform procedures to verify that the records support that at least the minimum or no more than the maximum was achieved. Reporting Obtain the reports submitted and supporting documentation from the campus. Test the reports for accuracy and completeness with the campus records. MAY 2016 YEAR-END GAAP TRAINING 38

39. Other Federal Programs – Compliance Areas Subject to Audit and Sample Procedures (continued) Subrecipient Monitoring Select a sample of program subrecipients and determine if the campus: Provided appropriate federal award notification. Monitored the activities and expenditures of the subrecipient in accordance with program regulations. Obtained and reviewed the subrecipient’s single audit report. Special Tests and Provisions As applicable, test any additional program specific requirements contained in the Uniform Guidance Compliance Supplement. MAY 2016 YEAR-END GAAP TRAINING 39

40. Single Audit Timeline MAY 2016 YEAR-END GAAP TRAINING 40 JulyAugustSeptemberOctober Student Financial Aid – Higher Scope Campuses FieldworkReviewFISAP Testing Review and Reporting Other Major Programs FieldworkReview and Reporting System wide (all campuses and CO) SEFA Preparation Update of SEFA (if needed) and other deliverables Review and Reporting

41. Determination of Findings Overview At the conclusion of the single audit procedures, KPMG will assess matters noted during fieldwork and determine whether or not they rise to the level of a finding subject to presentation in the year-end report. The evaluation will consider issues identified at individual campuses individually as well as in aggregate across campuses for the CSU System as whole. Section 717(a) of the Uniform Guidance, as amended, provides that the auditor should report the following instances as audit findings in the schedule of findings and questioned costs: 1. Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. 2. Material noncompliance with the provisions of laws, regulations, contracts, or grant agreements related to a major program. 3. Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. [In evaluating the effect of questioned costs on the opinion on compliance, the auditor should consider the best estimate of the total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs).] 4. Known questioned costs that are greater than $25,000 for programs that are not audited as major. MAY 2016 YEAR-END GAAP TRAINING 41

42. Which Findings Get Reported? For findings not associated with a question cost, the determination as to whether it will be reported as a finding will generally be based on the following criteria: Noncompliance at any one particular campus that constitutes an error rate greater than 10% - 20% of the sample size depending on the particular compliance requirement Combined noncompliance at more than one campus that constitutes an error rate greater than 5% of the sample size for any particular compliance requirement (for the system as a whole). Sometimes a campus, on a stand alone basis, may have some noted exceptions that alone would not warrant inclusion as a finding. However, if there are exceptions in a particular compliance requirement that cross several or more campuses, it may be considered a systemic issue and may therefore be reported as a finding. The auditor generally cannot conclude on which findings will be included until all potential findings at all campuses are resolved. MAY 2016 YEAR-END GAAP TRAINING 42

43. Knowledge Check #6 Which of the following is false regarding the determination of findings to be reported for the Single Audit? A. Material noncompliance with the provisions of laws, regulations, contracts, or grant agreements related to a major program should be reported by the auditor. B. Findings are only assessed at the individual campus level and there is no consideration for issues identified when aggregated with matters noted at other campuses C. Known or likely fraud affecting a federal award should be reported by the auditor. D. In evaluating the effect of questioned costs on the opinion on compliance, the auditor should consider the best estimate of the total costs questioned (likely questioned costs), not just the questioned costs specifically identified. MAY 2016 YEAR-END GAAP TRAINING 43

44. Knowledge Check #6 Answer Which of the following is false regarding the determination of findings to be reported for the Single Audit? B. Findings are only assessed at the individual campus level and there is no consideration for issues identified when aggregated with matters noted at other campuses. As the year-end report presents consolidated activity for the CSU System as a whole, the analysis of findings for presentation in our report will consider issues identified at individual campuses as well as in aggregate across campuses for the CSU System as whole. A, C and D are all true. MAY 2016 YEAR-END GAAP TRAINING 44

45. Sponsored Program Administration Updates MAY 2016 YEAR-END GAAP TRAINING 45

46. Thank you Tracy Hensley Partner 213-955-8850 thensley@kpmg.com thensley@kpmg.com MAY 2016 YEAR-END GAAP TRAINING 46 Sue DeRosa Director, Sponsored Programs 562-951-4213 sderosa@calstate.edu sderosa@calstate.edu Brett Burns Senior Manager (213) 533-3039 bburns@kpmg.com bburns@kpmg.com

47. Questions? MAY 2016 YEAR-END GAAP TRAINING 47