1. Tracy Hensley, Partner Brett Burns, Manager KPMG LLP May 19, 2015
The California State University
Single Audit
Tracy Hensley, Partner
Brett Burns, Manager
KPMG LLP May 19, 2015

2. Year-End GAAP Training
Agenda
What is a Single Audit?
Programs Audited
Audit Approach
KPMG Audit Team
Student Financial Aid
Other Federal Programs
Single Audit Timeline
Determination of Findings Overview
New Uniform Guidance Overview
Our agenda will serve to discuss the single audit for the year ended June 30, 2013.
The summary content is as follows:
[Read Agenda]
The overall objective of this training is to allow participants to understand the audit process and what is included in the GAAP manual. Additionally, participants will gain an understanding of the scope of the A-133 Single Audit procedures to be performed.
May 2015
Year-End GAAP Training

3. Year-End GAAP Training
What is a Single Audit?
The Single Audit Act of 1996, OMB Circular A-133, established requirements for audits of entities that administer Federal financial assistance programs.
The Compliance Supplement is revised on an annual basis in order to identify existing important compliance requirements that the Federal Government expects to be considered as part of a single audit. The 2015 Compliance Supplement is expected to be released soon.
The requirements for Single Audits will change in 2016 with the release of the new Uniform Guidance, which may also have an impact on the 2015 audit. The Uniform Guidance Compliance Supplement is expected to be released soon.
The 2015 transitional Compliance Supplement will be the basis of the Single Audit conducted by KPMG for the year-ended June 30, 2015.
Currently, all non-Federal entities that expend $500,000 or more of Federal awards in a year are required to obtain an annual audit in accordance with OMB Circular A-133.
[Read slide]
May 2015
Year-End GAAP Training

4. What is a Single Audit? (continued)
OMB Circular A-133 indicates the auditee shall:
Maintain internal control over Federal programs that provides reasonable assurance that the auditee is managing Federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs.
Comply with laws, regulations, and the provisions of contracts or grant agreements related to each of its Federal programs.
The A-133 Single Audit opinion includes:
One consolidated “in relation to” opinion on the Schedule of Expenditures of Federal Awards, representing all CSU campuses and federally-funded programs subject to A-133.
A report on internal controls over compliance.
An opinion on compliance with applicable Federal regulations for the programs audited.
All non-Federal entities that expend $750,000 or more of Federal awards in a year are required to obtain an annual audit in accordance with OMB Circular A-133.
OMB Circular A-133 indicates the auditee shall:
Maintain internal control over Federal programs that provides reasonable assurance that the auditee is managing Federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs.
Additionally, the audit shall comply with laws, regulations, and the provisions of contracts or grant agreements related to each of its Federal programs.
The auditee’s major programs subject to higher scope procedures are based on a quantitative assessment of the amount of federal awards expended by each program as well as a qualitative assessment of each program’s risks.
May 2015
Year-End GAAP Training

5. What is a Single Audit? (continued)
The auditee’s major programs subject to higher scope procedures are based on a quantitative assessment of the amount of federal awards expended by each program as well as a qualitative assessment of each program’s risks.
For each compliance area of each major program audited, KPMG audit procedures include both:
Tests of campus-specific controls, including understanding, assessment, and tests of operating effectiveness;
Tests of compliance with applicable rules and regulations.
The A-133 Single Audit opinion includes one consolidated opinion for all CSU campuses and federally-funded programs subject to A-133. The opinion pertains to internal controls over compliance as well compliance with applicable Federal regulations for the programs audited.
Therefore, for each compliance area of each major program audited, KPMG’s audit procedures include both tests of campus-specific controls, which include developing an understanding, assessment and tests of operating effectiveness; as well as tests of compliance with applicable rules and regulations.
May 2015
Year-End GAAP Training

6. Year-End GAAP Training
Knowledge Check #1
OMB Circular A-133 indicates the auditee shall:
Manage Federal awards in compliance with laws, regulations and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs, without regard to internal controls.
Comply with laws, regulations, and the provisions of contracts or grant agreements related to each of its Federal programs, but only if convenient.
Maintain internal control over Federal programs and manage Federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs.
Comply with laws, regulations, and the provisions of contracts or grant agreements related only to its major Federal programs.
Read question
May 2015
Year-End GAAP Training

7. Knowledge Check #1 Answer
OMB Circular A-133 indicates the auditee shall:
Maintain internal control over Federal programs and manage Federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs.
Read answer
May 2015
Year-End GAAP Training

8. What is an Internal Control?
Internal Controls are policies and procedures organizations employ to make sure that the information being processed is complete and accurate.
Controls need to be documented to demonstrate they are operating
Two general categories of internal controls:
Preventive Controls:
Segregation of Duties – Separate individuals authorize (approve) and process transactions
Supervisory Review - A supervisor reviews and approves all work performed by staff
Reviewing and addressing exception reports
Detective Controls:
Account reconciliations
Sampling transactions after the fact to ensure the desired result was achieved (consider minimum sample size of 25)
May 2015
Year-End GAAP Training

9. So Then, What is a Process?
A process includes the steps taken to compute an amount or record a transaction
Processes include internal control components
An example of a student financial aid process (refunds) and the control in the process:
Process:
Financial Aid counselor computes a student’s refund by obtaining the student’s last day of attendance, referencing the campus refund policy and applying that information to the student’s payment
Control:
The financial aid counselor’s knowledgeable supervisor reviews the refund computation, compares the information used in the computation to the information used by the financial aid counselor and signs the refund computation indicating that the review was performed.
May 2015
Year-End GAAP Training

10. Year-End GAAP Training
And Compliance?
Compliance is actually getting the right answer
Was the refund properly made in the right amount in the right timeframe?
There is a higher likelihood of compliance when effective internal controls are in place
Controls could be in place, but if they are not effective, errors could occur
Causes of ineffective controls (using prior example):
Supervisory review performed by someone who isn’t knowledgeable
Supervisory review performed, but underlying documents aren’t reviewed
Not occurring (assumed if not documented)
May 2015
Year-End GAAP Training

11. Year-End GAAP Training
Questions You Should Ask to Determine if Controls are In Place and Effective
How do you know it’s right?
If there is no answer, other than the steps the financial aid counselor performs (process), there may be no control in place
Every compliance requirement should have a documented control in place to minimize errors, even if reliance is placed on computer systems
If there are no documented controls in place over a compliance requirement, it is possible to have a control finding (significant deficiency or material weakness) without having a compliance finding.
Compliance findings are usually a result of ineffective controls and generally result in a control finding (significant deficiency or material weakness)
May 2015
Year-End GAAP Training

12. Year-End GAAP Training
Knowledge Check #2
An internal control can be described as follows:
The process used to compute a refund by a financial aid counselor
A procedure in place that is effective in determining that refunds are computed properly
A control isn’t necessary if refunds are usually computed correctly
The only effective control is a detective control
May 2015
Year-End GAAP Training

13. Knowledge Check #2 Answer
An internal control can be described as follows:
A procedure in place that is effective in determining that refunds are computed properly
May 2015
Year-End GAAP Training

14. Year-End GAAP Training
Knowledge Check #3
Which of the following situations could result in an internal control finding:
The supervisor may perform a review of a refund computation, however that review is not documented
Internal controls are in place and documented, however, numerous errors in refund computations were noted
The supervisor reviewed and approved the refund computation, as evidenced by his/her signature on the computation
Both A. and B.
May 2015
Year-End GAAP Training

15. Knowledge Check #3 Answer
Which of the following situations could result in an internal control finding:
Both A. and B.
The supervisor may perform a review of a refund computation, however that review is not documented
Internal controls are in place and documented, however, numerous errors in refund computations were noted
May 2015
Year-End GAAP Training

16. Major Programs Selection Process for 2015 Audit
The selection process will be performed by KPMG once a final consolidated Schedule of Federal Awards has been provided by the CSU System in early August. We will perform the following procedures to determine the programs subject to audit:
Compute a threshold to distinguish between Type A and Type B programs
Evaluate programs over the threshold based on inherent risk in the program, last time the program was audited, and any findings noted in program in prior year
Those programs over the threshold that are considered low risk, are subject to audit every three years
Programs with the same CFDA number are considered the same program, even if on different campuses or from different agencies
Certain programs, such as Student Financial Aid programs and Research and Development programs, are audited as one program or cluster
Moving to our next slide, the chart shown here indicates the initial programs that have been selected for testing as a major program for fiscal We plan to perform procedures over the Student Financial Aid Cluster, the Head Start Cluster, and the Research and Development Cluster.
The listing is preliminary in nature and has been prepared based on known programs that have incurred expenditures of federal funds greater than relevant thresholds.
The final selection process will be completed by KPMG once a final consolidated Schedule of Federal Awards has been provided by the CSU System later this year. The final determination of Major Programs selected for audit will vary based on consideration for the total amount of expenditures incurred by the CSU System as a whole as well as expenditures incurred for each relevant program or cluster of programs on a consolidated basis amongst all campuses that administer funds. Campuses that administer funds associated with the additional programs subject to testwork will be notified on a timely basis once identified.
May 2015
Year-End GAAP Training

17. Preliminary Major Program Selection
Programs Subject to Audit in 2015
Student Financial Aid Cluster
Programs that may be subject to audit in 2015
Research and Development
Head Start
Trio
Higher Education Institutional Aid
Foster Care Program – Title IV
Other smaller programs, to be determined
May 2015
Year-End GAAP Training

18. Year-End GAAP Training
Audit Approach
Chapter 15 in the GAAP Manual discusses the procedures and planned approach for the A-133 Single Audit, including:
Designated space for providing guidance and memorializing questions and answers that arise regarding preparation for the audit,
Comprehensive A-133 PBC lists.
There are two PBC lists included at Exhibit 24 to the GAAP Manual:
Limited Scope: applicable to all campuses
Higher Scope: applicable to the eight campuses selected for Higher Scope procedures for the Student Financial Aid Cluster
Due dates are stated on the respective PBC lists
PBC lists and other guidance applicable for audit testwork of major programs (other than the Student Financial Aid Cluster) will be provided directly to selected campuses once planned procedures are identified.
Chapter 15 in the GAAP Manual discusses the procedures and planned approach for the A-133 Single Audit. Chapter 15 is a designated space for providing guidance and memorializing questions and answers that arise regarding preparation for the audit. Comprehensive A-133 PBC lists are also included. The PBC list is based on documents that have historically been obtained as well as documents that we expect to be relevant for the year-end single audit.
There are two PBC lists included at Exhibit 26 to the GAAP Manual. The first is labeled Limited Scope and pertains to the preparation of the Schedule of Federal Awards as well as various documents relevant to our understanding of the programs that exist at each campus. The documentation in the Limited Scope PBC list is applicable to all campuses. The second listing is labeled Higher Scope, and it is applicable to the eight campuses selected for Higher Scope procedures for the Student Financial Aid Cluster. This listing includes the documents that will be the basis for the conduct of our fieldwork for those specified campuses. The campuses subject to higher scope procedures are listed in the GAAP Manual and will be discussed at a later slide in this presentation.
In addition to the PBC lists currently posted in the GAAP Manual, please note that PBC lists and other guidance applicable for audit testwork of major programs (other than the Student Financial Aid Cluster) will be provided directly to the relevant campuses at a later date once planned procedures have been identified.
May 2015
Year-End GAAP Training

19. Audit Approach (continued)
All campuses are responsible for the preparation of the Schedule of Expenditures of Federal Awards (SEFA).
Campuses are to submit a preliminary SEFA in YES by July 28, 2015.
The CO will submit a preliminary consolidating SEFA to KPMG by August 7, 2015.
See GAAP Manual for other relevant deadlines.
Subsequent changes to each campus SEFA may affect the selection process of major programs. Please keep the CO informed with regard to subsequent changes in the SEFA that are either reported or planned to be reported.
All campuses will also need to prepare a reconciliation of the SEFA to other reporting sources, such as FISAP (template provided at Exhibit 23 of the GAAP Manual). Support for reconciling items should be prepared by the campus and made available to the audit team.
KPMG plans our audit procedures based on amounts reported in the California State University System’s Schedule of Expenditures of Federal Awards, or SEFA. All campuses are responsible for the preparation of the SEFA.
Campuses are to submit a preliminary SEFA in YES by July 22, 2013.
The CO will submit a preliminary consolidating SEFA to KPMG by July 29, KPMG will begin assessing major programs based on information contained in this preliminary consolidating SEFA.
The SEFA is finalized for each campus during the course of the year-end reporting process, and such deadlines are outlined in the GAAP Manual.
Although campuses may determine that it is necessary to update the SEFA subsequent to the initial submission on July 22, 2013, we request that campuses be as diligent as possible during the initial preparation of the SEFA, as changes to the SEFA are likely to affect the selection process of major programs at both the campus level as well as for the CSU System as a whole, as the amount of dollars expended for each program is one of the most important criteria in our risk assessment. Additionally, we request that campuses keep the CO informed with regard to subsequent changes in the SEFA that are either reported or planned to be reported. This will enable KPMG and the CO to adjust the scoping of year-end audit procedures in a timely manner. This will ensure completion of both planned fieldwork procedures as financial reporting consistent with the overall reporting timeline.
In addition to reporting the current year information in the SEFA, another required deliverable is for all campuses to prepare a reconciliation of the SEFA included in the reporting package to other financial reports. The purpose of this documentation is to assist the audit team with the procedure of determining whether the amounts reported on the SEFA are reconcilable with other financial reports submitted for those same grant programs to federal funding agencies. The most common example of this type of reconciliation would be to compare the student financial aid amounts reported as expended on the reporting package to the amounts reported as expended on the FISAP. The amounts included in SEFA per the reporting package are to be based on amounts disbursed during the campus fiscal year (July 1, 2012 and June 30, 2013). Conversely, the amounts reported in the FISAP are based on amounts disbursed for a specified award year (all disbursements made for awards granted). Thus, a reconciliation schedule is needed to bridge the gap. See Exhibit 23 of the GAAP Manual for an example of the reconciliation.
The campus should be prepared to provide supporting documentation for the various reconciling items. Reconciling items will be subjected to testwork based on sampling techniques determined by KPMG based on the volume of reconciling items at the campus-level as well as in comparison to system-wide materiality.
May 2015
Year-End GAAP Training

20. Audit Approach (continued)
Single audit fieldwork will be conducted by specialized audit teams, separate from those conducting the financial statement audit.
The timing of the student financial aid audit begins in late-July and will continue through the end of August (with the exception of the testing of the FISAP, which is not due until October).
The timing of the audits for non-student financial aid programs will be in August or September, and will be coordinated with the individual campuses once program selections have been finalized.
Each campus subject to higher scope procedures will have a preliminary entrance discussion, regular status meeting updates, and a closing discussion.
We ask that the GAAP Coordinator at each campus take an active role with ensuring that PBCs are prepared in a timely manner and that any open items at the conclusion of fieldwork are addressed.
Consistent with plans implemented during prior year-end audits, we’ve scheduled a separate team of auditors that will specialize in performing the A-133 audit that will be going to multiple campuses in an effort to increase efficiency and consistency. These teams will be receiving additional training to increase efficiency and knowledge of specific program requirements.
The timing of the student financial aid audit begins in late-July and will continue through the end of August (with the exception of the testing of the FISAP, since that is not due until October).
The timing of the audits for non-student financial aid programs will be in August or September, and will be coordinated with the individual campuses once program selections have been finalized.
We continue to promote communication among KPMG, campus management, GAAP Coordinators and Financial Aid Directors. Each campus will have a preliminary entrance discussion, regular status meeting updates, and a closing discussion. Findings noted (if any) will be provided to the campuses in the closing discussion.
We ask that the GAAP Coordinator at each campus take an active role with ensuring that PBCs are prepared in a timely manner and that any open items at the conclusion of fieldwork are understood. This increased coordination and communication will help to expedite the completion of testwork and ensure that a proper understanding exists for each campus and the Chancellor’s Office.
May 2015
Year-End GAAP Training

21. Partner
Tracy Hensley
Senior Manager/Manager
Brett Burns
Stephanie Sakai
SoCal
SFA Team
Senior Associate
Staff Associate
NoCal
Other Programs
Team
KPMG Team
This slide depicts our KPMG Single Audit team. Tracy Hensley is the lead partner this year. I will be the lead manager. We have two teams that will specialize in student financial aid -- one team for the southern California campuses and one team for the northern California campuses. Additionally, we have a separate team that will perform testing on the other major programs.
Please note that this team listing has been prepared as of June One senior associate and one staff associate performing fieldwork at your respective campuses and programs will be assigned. The campuses will be informed of contact information for their respective senior associates and associates well in advance of fieldwork.
May 2015
Year-End GAAP Training

22. Year-End GAAP Training
Knowledge Check #4
Which of the following is true with regard to preparation and reporting for the A-133 Single Audit procedures?
All campuses are expected to prepare a reconciliation of the SEFA to other reporting sources, such as the FISAP.
Changes to the SEFA subsequent to initial reporting will have no impact to the selection of major programs or scoping of the year-end single audit.
Documents requested on the PBC lists are suggested rather than required deliverables.
All campuses are required to prepare the documents requested on the Higher Scope PBC list.
Read question
May 2015
Year-End GAAP Training

23. Knowledge Check #4 Answer
Which of the following is true with regard to preparation and reporting for the A-133 Single Audit procedures?
All campuses are expected to prepare a reconciliation of the SEFA to other reporting sources, such as the FISAP.
Read answer
May 2015
Year-End GAAP Training

24. Year-End GAAP Training
Student Financial Aid Cluster of Programs included in Scope of Federal A-133 Audit
Pell Grants
Federal Supplemental Educational Opportunity Grants
TEACH Grants
Scholarships for Disadvantaged Students
Federal Work Study
Postsecondary Education Scholarships for Veteran’s Dependents
Federal Direct Student Loans
Federal Perkins Loans
Nursing Student Loans
Loan Programs
Grant Programs
This next module contains an overview of the Student Financial Aid cluster audit that includes both Grant and Loan programs. This slide lists various programs that were included in CSU’s SEFA for the year-ended June 30, 2012 in relation to the Financial Aid Cluster.
Grant Programs
May 2015
Year-End GAAP Training

25. Student Financial Aid – Full Scope Campuses
Dominguez Hills
Monterey Bay
This slide depicts the 8 campuses, in alphabetical order, that have been selected as higher scope campuses for testwork over student financial aid during the 2013 year-end audit. A separately-selected date of fieldwork will be determined for each campus based upon communication between the KPMG A-133 audit team and relevant campus personnel.
The next few slides are to provide you with an overview of some of the compliance areas that may be tested as part of the single audit for financial aid. This is not a complete listing nor will all procedures be performed at all campuses. This is meant to provide you with some insight to help you better understand the types of procedures that may be performed to help you better prepare for the audit. Additionally, please note that the nature of procedures may change compared to prior years, as the Draft 2013 Compliance Supplement identified the Financial Aid Cluster on a list of programs identified by OMB as having more than minor change in the 2013 Compliance Supplement. Our procedures will be updated accordingly based on the latest guidance available at the time of fieldwork.
East Bay
San Jose
Los Angeles
San Luis Obispo
Maritime Academy
San Marcos
May 2015
Year-End GAAP Training

26. Year-End GAAP Training
Student Financial Aid – Compliance Areas Subject to Audit & Sample Procedures
Cash Management
Select a sample of cash receipts and compare with campus accounting records to test for compliance with applicable payment method (i.e., Advance, Reimbursement, etc.).
Eligibility and Disbursements
Select a sample of students and review Campus records to ascertain appropriate determination of:
Student Eligibility for Various Grant and Loan Programs
Calculation of Benefits
Disbursements only occurring after certain criteria have been met
Proper disclosure to students with respect to repayment and cancellation of any loans or loan increments disbursed
The first compliance area is cash management, which has some specific rules regarding the timing of when funds are disbursed to the students and drawn down from the Federal government. If this procedure is performed, we will select a sample of cash receipts and test the campus’ compliance with the requirements for requesting such payments.
Another compliance area to be tested at all higher scope campuses is eligibility. In order to test this requirement, we would select a sample of students and obtain campus records to test if eligibility was determined in accordance with relevant guidelines. In addition, we would test the award packaging and calculation of the award amounts.
May 2015
Year-End GAAP Training

27. Year-End GAAP Training
Student Financial Aid – Compliance Areas Subject to Audit & Sample Procedures (continued)
Reporting
Obtain FISAP and test for accuracy and completeness by selecting a sample of line items reported and comparing to Campus records.
Select a sample of students that received Pell Grants and compare the data reported on Pell origination and disbursement records to the COD to Campus records for accuracy.
Verification
Select a sample of students that were selected for Verification and obtain Campus records to ascertain that verifications were performed in accordance with campus policies and Federal requirements, generally prior to disbursement of aid.
Student Status Changes
Select a sample of students to test for timing and accuracy of the status change data submitted to the NSLDS.
Once the FISAP has been prepared and provided to KPMG, we will consider testwork over Reporting compliance. Based on guidance from the Compliance Supplement, we will select a sample of line items within the reports and ensure their accuracy as compared to the campus’ records. Further, we will perform procedures to ensure the completeness of information reported.
In our procedures over verification, we would select a sample of students that had been flagged for verification and review campus records to test if they had obtained appropriate documentation.
For student status changes, we would select a sample of students that underwent a status change (i.e., graduated, withdrew, dropped out) and test if the updates were made to the National Student Loan Data System timely and accurately.
May 2015
Year-End GAAP Training

28. Year-End GAAP Training
Student Financial Aid – Compliance Areas Subject to Audit & Sample Procedures (continued)
Return of Title IV Funds
Select a sample of students, or students that did not begin attendance, and obtain Campus calculation of amounts earned and due back. Obtain campus records, and test for accuracy and timeliness of returns (i.e., 45 days).
Borrower Data Transmission and Reconciliation (Direct Loans)
Select a sample of School Account Statements and ascertain that reconciliations are being performed.
Select a sample of borrowers and verify the accuracy of data in the Direct Loan Servicing System by comparing to campus records.
For Return of Title IV Funds, there are procedures for students that began attendance and then dropped their coursework and for students that registered but that never attended with funds received. We would select a sample of students and test any return calculations and timing of when the funds were returned to the federal government or to the lender (as applicable).
For Borrower Data Transmissions, we test a sample of Student Account Statement reconciliations. We will select a sample of borrowers and verify the accuracy of the information in the Direct Loan Servicing System by comparing to campus records.
May 2015
Year-End GAAP Training

29. Year-End GAAP Training
Knowledge Check #5
Which of the following areas of compliance are expected to be part of the A-133 Single Audit for the Student Financial Aid Cluster?
Cash Management
Eligibility
Refunds
All of the Above
Read question
May 2015
Year-End GAAP Training

30. Knowledge Check #5 Answer
Which of the following areas of compliance are expected to be part of the A-133 Single Audit for the Student Financial Aid Cluster?
D. All of the Above
Cash Management, Eligibility, and Refunds are all areas of compliance that will likely be tested as part of the A-133 Single Audit.
Review answer
May 2015
Year-End GAAP Training

31. Year-End GAAP Training
Other Federal Programs – Compliance Areas Subject to Audit & Sample Procedures
Allowable Activities/Allowable Costs
Select a sample of non-payroll-related expenditures charged to the program and test allowability in accordance with OMB Circular A-21 and the applicable program regulations.
Select a sample of payroll-related costs charged to the program and test if time and effort documentation is in accordance with OMB Circular A-21 and supports the expense charged to the program.
Obtain a copy of the approved indirect cost rate for the audit year and review the Campus’ calculation to determine if an appropriate base was used and the rate was applied correctly.
Cash Management
Select a sample of cash receipts from the Federal government along with campus records that support the related cost incurred. Test for compliance with applicable timing requirements for advance payments or reimbursements.
The next few slides detail procedures that may be performed for other Major Programs. The extent of procedures performed will be dependant upon whether or not specific criteria are direct and material to the program and the CSU System as a whole. Potential procedures are outlined in the Compliance Supplement. These slides present a portion of the overall procedures outlined in the Compliance Supplement, and other compliance requirements may be identified.
For allowable activities and costs, we select a sample of expenditures – both for payroll-related costs and other non-payroll-related costs – and test for compliance with program rules and regulations. Further, we ensure that reported expenditures are adequately supported and either allowable or unallowable for Institutions of Higher Education.
For cash management, we would test a sample of cash receipts for compliance with various timing requirements.
May 2015
Year-End GAAP Training

32. Year-End GAAP Training
Other Federal Programs – Compliance Areas Subject to Audit & Sample Procedures (continued)
Eligibility
Select a sample of program participants and obtain the Campus records that support their eligibility. Re-perform the eligibility determination in accordance with program guidelines.
Earmarking
Obtain the Campus documentation for its calculations regarding any required program earmark amounts or participants. Perform procedures to verify that the records support that at least the minimum or no more than the maximum was achieved.
Reporting
Obtain the reports submitted and supporting documentation from the Campus.
Test the reports for accuracy and completeness with the Campus records.
For eligibility, we would select a sample of students and test the campus records that support the participants eligibility.
For earmarking, we would review program regulations for any minimum or maximum requirements and test the campus documentation that supports meeting those requirements.
For reporting, we would select a sample of line items reported and test the campus documentation that supports those items reported.
May 2015
Year-End GAAP Training

33. Year-End GAAP Training
Other Federal Programs – Compliance Areas Subject to Audit & Sample Procedures (continued)
Subrecipient Monitoring
Select a sample of program subrecipients and determine if the Campus:
Provided appropriate Federal award notification.
Monitored the activities and expenditures of the subrecipient in accordance with program regulations.
Obtained and reviewed the subrecipient’s single audit report.
Special Tests and Provisions
As applicable, test any additional program specific requirements contained in the OMB Circular A-133 Compliance Supplement.
For subrecipient monitoring, we would select a number of program subrecipients and test for: appropriate notification of program requirements, the campus’ monitoring of the subrecipent’s compliance with program regulations, and the campus’ obtaining and reviewing their subrecipients’ A-133 audits.
Special tests may consist of any other specific requirements that may be included on the grant awards or in the OMB compliance supplement.
May 2015
Year-End GAAP Training

34. Single Audit Timeline July August September October
Student Financial Aid – Higher Scope Campuses
Fieldwork
Review
FISAP Testing
Review and Reporting
Other Major Programs
System wide
(all campuses and CO)
SEFA Preparation
Update of SEFA (if needed)
and other deliverables
This slide is designed to provide you with a general overview of the timelines for the conduct of the Single Audit. Our deadline for issuance this year is October 31, 2013.
Note that the financial aid fieldwork will primarily be performed in July and August with the FISAP work in October. The fieldwork for other programs will be performed in August and September. During fieldwork and subsequent weeks, we will communicate potential findings to the campus teams and also consider compensating procedures that may limit the impact to the system as a whole. By October, our work papers will be through our internal review process, and we will present the formal draft findings to the CO and various campuses for responses, as necessary. Our goal is to be in contact with the individual campuses as well as the Chancellor’s Office regarding our status and potential reporting matters throughout the process outlined above.
May 2015
Year-End GAAP Training

35. Determination of Findings Overview
At the conclusion of the single audit procedures, KPMG will assess matters noted during fieldwork and determine whether or not they rise to the level of a finding subject to presentation in the year-end report. The analysis will consider issues identified at individual campuses individually as well as in aggregate across campuses for the CSU System as whole.
Section 717(a) of Circular A-133, as amended, provides that the auditor should report the following instances as audit findings in the schedule of findings and questioned costs:
significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs.
material noncompliance with the provisions of laws, regulations, contracts, or grant agreements related to a major program.
known questioned costs that are greater than $10,000 for a type of compliance requirement for a major program. [In evaluating the effect of questioned costs on the opinion on compliance, the auditor should consider the best estimate of the total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs).]
known questioned costs that are greater than $10,000 for programs that are not audited as major.
the circumstances concerning why the auditor's report on compliance for major programs is other than an unmodified opinion,
known or likely fraud affecting a federal award,
instances in which the results of audit follow-up procedures disclosed that the summary schedule of prior audit findings prepared by the auditee materially misrepresents the status of any prior audit finding.
This last slide provides an overview of considerations made by KPMG in determining findings for the year-end single audit.
At the conclusion of the single audit procedures, one of the key matters to be determined for reporting is whether or not findings exists. KPMG will assess matters noted during fieldwork and determine whether or not they rise to the level of a that is finding subject to presentation in the year-end report. The analysis will consider issues identified at individual campuses as well as in aggregate across campuses for the CSU System as whole.
The conclusion as to whether or not a matter is subject to reporting in the consolidated single audit report is based on a number of criteria that are to be considered by the audit team. We have outlined the seven criteria per the guidance in this slide. To highlight, a few of the criteria that were used to identify findings in the past are: the identification of significant deficiencies or material weaknesses in internal control, material noncompliance, or likely questioned costs greater than $25,000. Additionally, repeated findings from prior year will be reported if not sufficiently remediated. Please note that the threshold of $25,000 has changed from prior years, when existing guidance identified that the threshold was $10,000 for questioned costs.
It is important for individual campuses to keep in mind that a minor deficiency or small questioned cost at one campus may reach the level of a significant deficiency or material questioned cost when aggregated with matters noted at the other campuses in the System. Additionally, determining matters is an on-going process throughout the year-end audit timeline.
May 2015
Year-End GAAP Training

36. Which Findings Get Reported?
For findings not associated with a question cost, the determination as to whether it will be reported as a finding will generally be based on the following criteria:
Noncompliance at any one particular campus that constitutes an error rate greater than 10-20% of the sample size depending on the particular compliance requirement
Combined noncompliance at more than one campus that constitutes an error rate greater than 5% of the sample size for any particular compliance requirement (for the system as a whole).
Sometimes a campus, on a stand alone basis, may have some noted exceptions that alone would not warrant inclusion as a finding. However, if there are exceptions in a particular compliance requirement that cross several or more campuses, it may be considered a systemic issue and may therefore be reported as a finding. The auditor generally can’t conclude on which findings will be included until all potential findings at all campuses are resolved.
May 2015
Year-End GAAP Training

37. Year-End GAAP Training
Knowledge Check #6
Which of the following is false regarding the determination of findings to be reported for the Single Audit?
Material noncompliance with the provisions of laws, regulations, contracts, or grant agreements related to a major program should be reported by the auditor.
Findings are only assessed at the individual campus level and there is no consideration for issues identified when aggregated with matters noted at other campuses
Known or likely fraud affecting a federal award should be reported by the auditor.
In evaluating the effect of questioned costs on the opinion on compliance, the auditor should consider the best estimate of the total costs questioned (likely questioned costs), not just the questioned costs specifically identified.
Read question
May 2015
Year-End GAAP Training

38. Knowledge Check #6 Answer
Which of the following is false regarding the determination of findings to be reported for the Single Audit?
Findings are only assessed at the individual campus level and there is no consideration for issues identified when aggregated with matters noted at other campuses.
As the year-end report presents consolidated activity for the CSU System as a whole, the analysis of findings for presentation in our report will consider issues identified at individual campuses as well as in aggregate across campuses for the CSU System as whole.
Read answer
May 2015
Year-End GAAP Training

39. New A-133 – Uniform Guidance
Effective for the year ended June 30, 2016
New entity threshold is $750,000 in Federal Expenditures
Entity coverage now 20% or 40% (currently 25% and 50%)
New findings threshold (known or likely) is $25,000
Selection of programs to audit is more risk based, i.e., smaller programs likely to be selected
Combination of cost circulars (A-87, A-21, A-122)
Prescribes five procurement methods
Clarifies Subrecipient Monitoring requirements
Changes in time and effort documentation
Clarifies Federal expectations about establishing and maintaining effective internal control over compliance. Specifies compliance with COSO like framework, to include.
Control environment, risk assessment, control activities, information and communication and monitoring
Document and the related crosswalks can be obtained at:
May 2015
Year-End GAAP Training

40. Thank you Tracy Hensley Partner 213-955-8850 thensley@kpmg.com
Brett Burns Manager (213)
Thank you
This concludes the presentation on the Single Audit for fiscal My contact information as well as the contact information for Tracy Hensley is listed on this slide in the event you have questions in the future. I appreciate your attention and look forward to working with you during the year-end procedures.
The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after a thorough examination of the particular situation.
© 2015 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS
The KPMG name, logo and “cutting through complexity” are registered trademarks or trademarks of KPMG International.

41. Sue DeRosa, Director, Financial Services / Sponsored Programs
Thank you, Tracy.
I’m Sue DeRosa, Director of Sponsored Programs for the Chancellor’s Office. I will review some highlights from the new Uniform Guidance (UG for short) with a focus on the Audit Requirements and Internal Controls.
Uniform Guidance New Federal Regulations (2 CFR 200) Audit Requirements
Sue DeRosa, Director, Financial Services / Sponsored Programs
Chancellor’s Office
May 19, 2015

42. Uniform Guidance (UG): Effective Dates for compliance with 2 CFR 200
All federal grants/contracts (direct and subawards) awarded on or after December 26, 2014
Awards issued prior to December 26, 2014 with new funding added on or after December 26, 2014, in accordance with federal agency award modification
Awards issued prior to December 26, 2014 where the federal agency notifies recipients that the award is subject to the new guidance (otherwise compliance remains with OMB A-21, A-110 and A-133)
The Uniform Guidance (UG) combined eight OMB circulars (including the three circulars that we followed as institutions of higher education – A-21, A-110 and A-133) into one part in the Code of Federal Regulations, 2 CFR 200. This new Uniform Guidance went into effect December 26, 2014 (Happy Holidays to us). Although the Audit Requirements (Subpart F) do not technically go into effect until fiscal year beginning July 1, 2015 – if you receive a new award after 12/26/2014, then you are subject to the new guidelines and may be audited on expenditures incurred on those awards between 12/26/2014 and 6/30/2015 against 2 CFR 200.
In addition to new awards received after 12/26/2014, new funding added may trigger compliance with 2 CFR 200, the federal agency should notify you with an award modification and additional funding.
For other awards issued PRIOR to 12/26/2014, continue to follow OMB circulars A-21, A-110 and A-133 unless you receive an award modification from the federal funding agency indicating that the award is now subject to 2 CFR 200 for the balance of the project term.
May 2015
Year-End GAAP Training

43. UG: Effective Date - Exceptions
UG Procurement Standards – 2 CFR 200, Subpart D – ( ) effective July 1, 2016 – CSU issued policy announcement on ICSUAM, indicating CSU campuses would continue to follow A-110 Procurement Standards through June 30, 2016, unless a campus/ auxiliary decides to implement 2 CFR 200, Procurement Standards (and then update their policy accordingly)
UG Audit Section – 2 CFR 200, Subpart F – ( ) will not go into effect until the fiscal year beginning July 1, EXCEPT for federal expenditures during the FY2014/15 under awards issued AFTER December 26, 2014– which will be audited under Subpart F for FY2014/15; while other expenditures will remain subject to OMB A-133
The CSU issued a policy announcement prior to 12/26/2014 indicating that CSU campuses (and auxiliaries) will continue to follow the procurement standards from OMB Circular A-110 until the extended effective date of the UG Procurement Standards, July 1, In our policy announcement we’ve allowed campuses and auxiliaries the option of implementing Subpart D, Procurement Standards of 2 CFR 200 earlier, if desired.
As mentioned earlier, Subpart F, Audit Requirements of 2 CFR 200 will not go into effect until July 1, 2015, EXCEPT for expenditures incurred on new awards -or any award- subject to 2 CFR 200 between 12/26/2014 and 6/30/2015.
May 2015
Year-End GAAP Training

44. UG: Audit Requirements (2 CFR 200.501-520, Subpart F)
Basic Structure of the Single Audit Process Unchanged
Audit threshold ($750K)
Subrecipient vs Contractor (formerly referred to as Vendor)
Biennial & Program-specific audits
Non-federal entity selects auditor
Auditee prepares financial statements and SEFA
Audit follow-up & corrective action
9-month due date (set in law) – March 31st for the CSU
Reporting to Federal Audit Clearinghouse
By March 31st or within 1 month of publishing Single Audit Report, whichever comes first
Major programs determined based on risk
Compliance Supplement –overall format (Appendix XI)
&
&
&
App XI
The basic structure of the Single Audit process has not changed – the major changes are focused on risk and internal controls.
The audit threshold was increased from $500K to $750K – this means any entity with more than $750K of federal expenditures in a fiscal year is subject to Subpart F of the UG. No major impact on the CSU, as the university and the sponsored programs auxiliaries (and maybe other auxiliaries) far exceed $750K in annual federal expenditures. At one point the threshold was to be increased to $1M – higher education community pushed back, as we often use the Single Audit to demonstrate compliance with subrecipient monitoring requirements – OMB listened and reduced the threshold from $1M to $750K
Another minor change is the word “Contractor” rather than “Vendor”. Under A-133 we used the definition of Subrecipient and Vendor to determine whether we flow down the federal guidelines to the receiving entity. If it was a Subrecipient, we flowed down the provisions of the prime federal award and charged allowable indirect cost on only the first $25,000 of the subaward. If it was a Vendor (now a Contractor), we did not flow down the federal award provisions and we recovered allowable indirect cost on the full cost of the vendor/contractor. The definition for CONTRACTOR in the UG (Section ) is the same as the definition for VENDOR in A-133.
On down to the compliance supplement, there are no material changes to mention.
May 2015
Year-End GAAP Training

45. UG: I N T E R N A L C O N T R O L S
Major focus on Internal Controls throughout the UG
While the UG states that the non-federal entity MUST establish & maintain effective internal control over the Federal award –and– “These internal controls SHOULD be in compliance with guidance in…” (MUST is required, SHOULD is a good business practice) –COSO standards may be a good practice to consider
CSU Internal Audit on Internal Controls:
There is an increased focus on internal controls through the UG. This is not really anything new to our auditors, they have been auditing internal controls for years. It will be incumbent on all staff to pay more attention to internal controls and to be able to demonstrate that your internal controls are effective.
The UG suggests two standards to follow – “Standards for Internal Control in the Federal Government” or the “Internal Control Integrated Framework” issued by COSO (Committee of Sponsoring Organizations). The UG says we MUST establish and maintain effective internal controls, and that we SHOULD comply with one of these two standards. In the FAQ on the UG, it was made clear that MUST is a requirement and SHOULD is a suggested business practice. That said, the COSO standards may be a good business practice to emulate.
The CSU Audit & Advisory Services website has lots of good information on internal controls. I suggest you give that a good read. They also site COSO standards for internal control.

46. UG: Internal Controls (cont.) (from CSU Audit Website)
The COSO Report defines the five interrelated components of internal control that must be present and functioning and operating together in order to conclude that internal control relating to an operation’s objective is effective:
Control Environment - This sets the tone of the organization and is the foundation for carrying out internal controls across the organization.
Risk Assessment - Management establishes activity-level objectives and mechanisms for identifying and analyzing risks related to their achievement.
Control Activities - Policies and procedures that help ensure that management's directives to mitigate risks to the achievement of objectives are carried out.
Information and Communication - Information identified, captured, and communicated in a form and timeframe to enable people to carry out their responsibilities.
Monitoring - Ongoing monitoring activities, separate evaluations or a combination of the two used to ascertain whether each of the five components of internal control is present and functioning.
Who is responsible for internal controls? The auditors, right? Wrong! Everyone plays a part in the CSU's internal control system. Ultimately, it is CSU management's responsibility to ensure that controls are in place. That responsibility is delegated to each area of operation, which must ensure that internal controls are established, properly documented, and maintained. Every employee has some responsibility for making this internal control system function.
Here are a few excerpts from the CSU Audit website.
For responsibility, clearly it takes a village to establish an effective internal control system. In sponsored programs, our focus will be on establishing effective internal controls where they are required.
I leave you with some information (possibly TMI) on COSO internal control components. For more information on this you can visit the CSU Audit & Advisory Services website or the COSO website where you will find their Executive Summary on Internal Controls.

47. Year-End GAAP Training
References
2 CFR 200 –
CSU Policy Announcement on Uniform Guidance
CSU PI Quick Reference Guide – fin/Financial-Services/spa/Documents/PI_UG_QuickRefGuide%20Dec2014_v1.2%20Mar2015.pdf
COSO – Executive Summary on Internal Controls –
CSU Audit & Advisory Services (Internal Controls):
That’s all from me on the UG!! I’m providing links to several documents that may help you prepare for your Single Audit (especially next year). Wishing you all a finding-free single audit for the 2014/15 fiscal year!
May 2015
Year-End GAAP Training

48. Year-End GAAP Training
Questions?
May 2015
Year-End GAAP Training

49. The California State University