Actions in Response to the National Single Audit Sampling Project ...

Actions in Response to the
National Single Audit
Sampling Project
June 2, 2010
Presentation to the
Mid-Atlantic Intergovernmental Audit Forum
by Terry Ramsey
Issues
• Reporting major program coverage
• Reporting audit findings & SEFA
• Compliance and Internal Control testing
– Undocumented
– Not performed
• Audit Materiality
• Management representations
•Sampling
AICPA Responses
• Ethics enforcement
• Government Audit Quality Center (GAQC)
• SAS 117
• Revised A-133 Audit Guide
• Peer review enhancements
• Emphasis in training sessions and risk
alerts
Ethics Enforcement
Primary Sources of Referrals
• Government
• Outside party (e.g., client)
• Media (e.g., newspaper, professional
publications.
Government Referrals
• Missed major program – 2 year look back
• Percentage of coverage
• Incorrect Type A threshold
• Missing programs in a cluster
• Not including all grants within a CFDA #
• SEFA presentation
• Regulatory basis of accounting
Investigation Process
• Full investigation
• Enhanced enforcement process
1

Full Investigation
• Financial statements
• Work papers
• Not restricted to referral complaint
• Time consuming and done less frequently
Enhanced Enforcement
• Correspondence
• Financial statements
• Wording papers on a limited basis
• Not restricted to referral compliant
• A-133/Yellow Book
• SEFA Issues
• Reporting Issues
• Disclosure Issues
• Accounting Issues
Findings
Sanctions Available
• No further action or NFA with comments
• Required Corrective Action
–CPE
– GAQC membership
– Restrictions - Peer review & teaching
– Work product follow-up (immediate or
subsequent
– Pre-issuance reviews
• Membership rights/publications
RCA –Remediate 55%
Trial Board or Settlement Agreement – Remediate & 12%
discipline
No further action taken (violations not material or self 17%
remediated)
Audit submitted for review to comply with
12%
remediation imposed – complied with standards
Other 4%
Total 100%
2

GAQC
• Firms
– Designated partner
– Peer review by another GAQC firm
• Continuous learning
–Alerts
– Newsletter
– Conference calls
– Web based events
GAQC Resources
• GAQC Web site (www.aicpa.org/GAQC)
• Recovery Act Resource Center
– GAQC Web site for auditors dedicated to Recovery Act matters
– Archived GAQC member events
• Recovery Act events
• Auditee call on preparing for a single audit
– Links to Recovery Act GAQC Alerts
– Links to GAQC Recovery Act tools
– The Resource Center is open to general public
– Encourage clients to visit
• HUD information page
GAQC Membership
• Over 1,350 member firms representing 50
states, Puerto Rico, and US Virgin Islands
• AICPA Board approved State Audit
Organizations (SAO) as members – 15
have joined to date
• RI, VA, ND, SD, NH, VT, UT, MI, OH, GA, LA, DE,
FL, MN, TX
SAS 117 – Compliance Audits
• Issued December 2009
• Effective fiscal periods ending on or after
June 15, 2010.
• Supersedes SAS 74
• Uses new clarity format
• Focused on addressing NSAS project
recommendations
• Elevates material from guide to standard
Applicability of Other SAS
• Clarifies that all AU sections applicable
unless specifically excluded (4-6)
• Adapt and apply SAS in a compliance
audit, e.g., by replacing the word
misstatement with the word
noncompliance
Terms
• Applicable compliance requirements
• Governmental audit requirement (GAR)
3

Audit Objectives (10)
• Obtain sufficient appropriate evidence
• Form opinion at level required by GAR
• Identify audit reporting requirements
specified in GAR that are supplementary
to GAGAS.
Audit Procedures
• Risk assessment procedures, tests of controls,
and analytical procedures alone are not
sufficient to address a risk of material noncompliance
(19)
• The use of analytical procedures to gather
substantive evidence is generally less effective
in a compliance audit than a financial statement
audit (A23)
• References A-133 requirement to test I/C even if
such testing would be inefficient (A25)
Documentation
• Risk assessment procedures (39 & A38)
• Procedures performed to test I/C &
compliance (40)
• Materiality levels and how determined (41)
• How complied with GAR (42)
Management Representations (23)
• Required by standard
• Elements specifically enumerated
Material Noncompliance
• Failure to follow or violation of compliance
requirements that results in noncompliance
that is:
– Quantitatively or qualitatively material
– Either individually or when aggregated with
other non-compliance
Audit Findings
• Materiality evaluation (29)
– Known questioned costs
– Likely questioned costs
– Other material noncompliance that by its
nature may not result in questioned costs
• Likely QC defined (11)
– Developed by extrapolating from audit
evidence, e.g., projecting known QC to
population.
4

Reporting of Major Programs
• In 2008 FAC revised on-line submission
screens to alert auditors of importance of
identifying major programs both in the
SEFA and the SF-SAC
• Reference to separate schedule including
major programs is a required reporting
element (30.a)
Reissuance of Compliance Report (43)
• Explanatory paragraph
– Replacing previously issued report
– Reasons why reissued
– Changes
•Dating
• Reissuance auditor pepared document is
considered reissuance of report, e.g.:
– Schedule of Findings and Question Costs.
National Sampling Project Found
• The number of items tested varied widely
for audits of comparable entities (size,
programs, risks, internal control
assessments) involving the same
sampling parameters.
• Audit testing not documented.
A-133 Audit Guide
Chapter 11 - Sampling
• Statistical and judgmental sample sizes should
be comparable. (AU 350.23 – SAS 111 12/06))
• Sample must include transactions from all major
programs (11.42)
– Preferable to select separate samples for each major
program (11.43)
• Evaluate dual purpose tests (I/C & Compliance)
separately for findings (11.54)
• Suggested minimum sample sizes (11.59)
Minimum samples for populations >250 –
COMPLIANCE
Desired Level of
Assurance (Remaining
Risk of Material
Noncompliance)
Sample Sizes
Minimum Sample Size
High 60
Moderate 40
Low 25
29
Documenting sampling (11.134)
• Control or compliance tested
• Definition of population
• Definition of deviation
• Desired confidence level, tolerable
deviation rate, and expected deviation rate
• Sample size
• Sample selection method
5

Documenting sampling (11.134)
• Selected items
• Evaluation of sample
– Number deviations
– Qualitative factors of the deviations
– Projected deviation rate
– Effects on other audit procedures
– Determination of known and likely QC
– Whether deviations result in opinion modification or
finding & if not how auditor considered sampling risk.
• Overall conclusion
SEFA
• Clarifying guidance added to 2008
GAS/A133 Guide
• SEFA Practice Aids (both for the auditor
and auditee) issued and available on the
GAQC Web site, under the Resources tab
(under “Research Tools and Aids”) and also
incorporated in the GAS/A133 Guide
– Audit Program and Disclosure Checklist for Auditors
– Document for auditees to accumulate important information on
federal awards and a Disclosure Checklist for Auditees
Peer Review
• In response to the PCIE Report the AICPA created the
Practice Monitoring Task Force.
– Areas of Focus:
• Establish consistent measures of A-133 deficiencies
• Develop guidance and training materials for peer reviewers
• Interpretation 63-1a ensures A-133 engagement selection
− Effective for peer reviews commencing on or after September 1, 2009
• Peer review checklists modified to focus peer reviews of
single audits on areas known to be problematic
6