CONTENTS Page I. INTRODUCTION 1 II. ROLES AND RESPONSIBILITIES OF THE RECIPIENT 3 A. Management of Program 3 1. Ultimate Responsibility for Federal Programs 3 2. Receiving and Distributing Federal Financial Assistance 4 3. Understanding and Communicating Terms and Requirements of Grants 4 4. Maintaining Open Communication with Subrecipients 6 5. Coordinating with Other Grantors 7 B. Management of Subrecipient Audits 8 1. Identifying Federal Funds Subgranted 8 2. Determining Applicable Audit Requirements for Subrecipients 9 3. Evaluating Audit Quality 10 4. Identifying Audit Findings 11 5. Resolving Audit Findings 11 6. Other Monitoring as Appropriate 12 III. ROLES AND RESPONSIBILITIES OF THE SUBRECIPIENT 12 A. Management of Program 13 1. Establishing and Maintaining Accountability 13 2. Complying with Applicable Requirements 14 B. Management of Audit 15 1. Determining Applicable Audit Requirements 15 2. Arranging for Audit Coverage 17 3. Distributing the Audit Report 18 4. Completing a Corrective Action Plan 18 C. Subgrants by Subrecipient Organizations 19 IV. ROLES AND RESPONSIBILITIES OF THE AUDITOR 19 A. Knowledge of Audit Requirements 19 B. Communicating with Auditee 20 C. Additional Audit Responsibilities 21 D. Design of Audit Plan 23 E. Audit Disclosure 24 CONTENTS(Cont'd) Page V. FINAL COMMENTS 24 VI. GLOSSARY OF TERMS 26 VII. REFERENCE DOCUMENTS 30 I. INTRODUCTION To properly manage federal funds, recipient organizations should have a clear understanding of their responsibilities as primary grantors or subgrantors of federal funds. Furthermore, auditors of these entities should obtain knowledge of the requirements as related to program operations and audits. Federal, state, and local auditors and CPA representatives, who are members of the Technical Issues Committee, Mid-America Intergovernmental Audit Forum, are concerned that the requirements for the subrecipient audits may not be adequately fulfilled because the roles of the primary recipient, subrecipient, and auditor are not always fully understood. Due to the high degree of confusion, the lack of implementation of program responsibilities, and the many questions received in this area, the Technical Issues Committee decided to address these concerns. A task force was appointed to design a guide to identify and discuss roles and responsibilities in subrecipient audits. For governmental entities, the subrecipient audit issue was originally addressed in Office of Management and Budget (OMB) Circular A-128, paragraphs 9 and 13.f, and the Questions and Answers on the Single Audit Provisions of OMB Circular A-128 "Audits of State and Local Governments," November 1987, questions 21 through 30. Though the guidance provided was helpful, some questions have developed that were not previously discussed. Furthermore, some of the answers to questions that had been previously addressed resulted in additional questions. This guide is intended to provide practical information on how to obtain and implement the guidance available for subrecipient audits. The objectives of the guide are to describe: - federal requirements for audits of subrecipients of federal financial assistance and - the roles of the primary recipient, the subrecipient, and the independent auditor in complying with federal audit requirements. The guide includes: - the duties of the recipient pertaining to management of programs and management of subrecipient audits, - the duties of the subrecipient pertaining to management of programs and of audits and subgrants by subrecipient organi- zations, and - the role of the independent auditor relative to subrecipients. This guide also incorporates the requirements of the Single Audit Act of 1984 and the implementing regulations in OMB Circular A-128. In addition the guide references OMB Circular A-133, issued March 16, 1990. Circular A-133 supersedes the previous OMB Circular A-110 audit requirements and provides guidance to federal agencies for establishing uniform requirements for audits of awards to institutions of higher education and other not-for-profit organizations. The audit approach called for by this circular is similar to the Single Audit approach. This guide is not intended to be a complete manual of procedures to meet subrecipient audit requirements. Responsible individuals need to be familiar with the specific statutes and regulations pertaining to subrecipient audits. Section VII of this guide lists major reference sources pertaining to federal audit re- quirements. II. ROLES AND RESPONSIBILITIES OF THE RECIPIENT A. MANAGEMENT OF PROGRAMS Program management roles and responsibilities of a recipient are set forth in the following areas--(1) ultimate responsibility for federal programs, (2) receiving and distributing federal finan- cial assistance, (3) understanding and communicating terms and requirements of grants, (4) maintaining open communication with subrecipients, and (5) coordinating with other grantors. 1. Ultimate Responsibility for Federal Programs The federal government places the management responsibility for federal financial assistance programs on the recipient. The federal funding agency retains authority to evaluate, review, or monitor the recipient and to review the recipient's audit to assure compliance with federal requirements. Requirements applicable to federal financial assistance programs can include: - federal statutes enacted by the Congress, - executive orders of the President, - regulations issued by federal agencies, - OMB circulars, - Treasury circulars, - other program guidance issued by federal agencies, and - terms of the grant or agreement set by the federal agency . In accepting federal financial assistance, the recipient assumes responsibility for complying with federal requirements. That responsibility covers operating the program, arranging for the audit, assuring audit resolution, and maintaining property and records. If the recipient provides federal financial assistance to a subrecipient, the recipient's responsibility carries over to each stage of the program at that level. Federal agencies hold the recipient, not the subrecipient, responsible for compliance at the subrecipient level. This responsibility includes the required repayment of any federal financial assistance because of the subrecipient's failure to comply with federal laws and regulations. 2. Receiving and Distributing Federal Financial Assistance Various tiers of state and local governments, institutions of higher education, and private not-for-profit entities may be involved in the receipt and pass-through of federal financial assistance. The Older Americans Act of 1965 offers an example of these tiers. Under that act, the U.S. Department of Health and Human Services annually distributes over $700 million to states and territories. State agencies provide assistance to regional planning and service area agencies which in turn distribute federal financial assistance to local governments or not-for-profit organizations. The local entities may use the federal financial assistance to provide services or to procure goods and services. In this example, the state is the primary recipient, the area agency is the subrecipient, and the local organization is a second-tier subrecipient. 3. Understanding and Communicating Terms and Requirements of Grants When a recipient provides federal funds to a subrecipient, many of the federal requirements also pass through to the subrecipient. The recipient is responsible for setting forth in writing the federal requirements that apply to the subrecipient. In many cases, additional requirements may be imposed by the recipient as a result of state or local funds added to the federal funding provided to subrecipients. These requirements can include: - state statutes, - local ordinances, - administrative regulations, and - administrative procedural requirements. The recipient must clearly identify the source of funding as well as any additional administrative requirements imposed on the subrecipients. This will facilitate the conduct of the audit, including the preparation of the independent auditor's report. The OMB Compliance Supplement provides key compliance require- ments applicable to the primary recipient of selected federal financial assistance programs. These requirements may not apply to a subrecipient of federal financial assistance or they may apply at the recipient's discretion. Therefore, the primary recipient should clearly state which of the requirements apply at the subrecipient level. As an example, a federally mandated 25 percent matching require- ment for a statewide federal financial assistance program may apply to a state agency receiving a grant. The state agency may meet the 25 percent matching requirement statewide, but the state may allow subrecipients in poverty areas to provide only a 10 percent match. Audit requirements present challenges because the requirements differ depending on the subrecipient organization type, the funding levels, and the audit language contained in federal statutes creating the federal financial assistance programs in which the entity participates. The recipient must first under- stand the audit requirements before those requirements are imposed on the subrecipient. To understand the body of audit regulations and guidance issued or adopted by the federal govern- ment, the recipient should enlist the support of its federal cognizant agency and the appropriate authorities within its state. The role of the federal cognizant agency is outlined in "Federal Cognizant Agency Audit Organization Guidelines" issued by the President's Council on Integrity and Efficiency. 4. Maintaining Open Communication with Subrecipients Over the past few years, it has become apparent that proper communication of audit requirements to subrecipients is often lacking. What are the keys to successful subrecipient communica- tions? - Make the communication specific from the start. - Provide subrecipients the rationale for any rules or rule changes. - Educate subrecipients to be better grant applicants, admin- istrators, and procurers of audit services. - Communicate with subrecipients on an ongoing basis because changes to the environment are inevitable. An effective approach the recipient can take to establish and improve a subrecipient's audit management skill is to provide education or training on such topics as audit requirements, procurement of audit services, audit review standards, and other elements of audit management. A number of resources are avail- able for such training. (See Section VII.) In addition, the recipient should be accessible to each subrecipient and its independent auditor by directly responding to requests for information or by referring requests to the appropriate source. Recipients are also encouraged to partici- pate in training programs sponsored by state societies of CPAs to provide guidance to independent auditors about program require- ments. This guidance should greatly enhance the independent auditor's ability to properly test compliance with program requirements at the subrecipient level. In addition, the recipi- ent may wish to consider providing subrecipients a manual con- taining audit guidance or a listing of sources of audit guidance. This material should be updated as new or revised audit require- ments are issued by the federal government. The communication of timely and accurate information to the subrecipient and its independent auditor is essential for the recipient's successful management of federal financial assistance programs. The degree to which the recipient can implement these or other steps depends on the expertise of the recipient entity, the mandates of local laws and regulations, and the availability of resources. 5. Coordinating with Other Grantors Coordination and pooling of resources can result in better training and technical assistance for subrecipients to assure their compliance with federal audit requirements. If both a federal agency and a state agency provide federal assistance to a common recipient/subrecipient, the state and federal agencies may be able to coordinate the communication of audit requirements, the review of audit quality, and the action related to the audit (for example, the resolution of cross-cutting audit findings). Unless grantors of federal assistance work together, duplication of effort and inconsistent messages to a common recipi- ent/subrecipient may occur. When two grantors provide assistance to the same recipient/subrecipient year after year, it is advis- able to establish a cooperative agreement concerning oversight. Identification of and communication with other grantors are keys to successful coordination. Identification of other grantors providing federal financial assistance to the subrecipient may be accomplished by contacting federal cognizant agencies or by reviewing cognizant agency assignments or the Schedule of Federal Financial Assistance in the subrecipient's most recent audit report. The audit report should be reviewed prior to subgranting awards. The recipient should also require the subrecipient to file audit reports received during the period of the recipient's award even though the periods audited precede that award. If no prior audit report has been written, the subrecipient can be surveyed to identify other grantors. B. MANAGEMENT OF SUBRECIPIENT AUDITS Recipients should maintain a list of all the subrecipients and amounts distributed to them from each federal financial assis- tance program. This list is essential for effective program management and for proper audit oversight. It will also facili- tate responses to confirmation requests received from the subrecipients' independent auditors. Furthermore, the list can be an integral part of a system used to track subrecipient audits. Such a system should be established to assure completion of audit reports within allowable timeframes, to track the review of audit quality, and to monitor the resolution of audit findings and questioned costs on a timely basis. Recipient management of subrecipient audits can be further defined in the following areas -- (1) identifying federal funds subgranted, (2) determining applicable audit requirements for subrecipients, (3) evaluating audit quality, (4) identifying audit findings, (5) resolving audit findings, and (6) other monitoring as appropriate. 1. Identifying Federal Funds Subgranted Identification of funds subgranted requires identification of funds received from the federal government. The recipient is required to maintain: - information necessary to permit preparation of a schedule of federal financial assistance identifying each federal grant- or agency - the Catalog of Federal Domestic Assistance number and - the period of federal funding. As recipients pass federal financial assistance to subrecipients, each step of the process (including subgranting award, financing, financial reporting, and auditing) should clearly provide for identification of the source of federal financial assistance. If state or local funds are subgranted with federal assistance, recipients should provide for separate identification of each source so that the subrecipient has the information necessary to complete the required schedule of federal financial assistance. 2. Determining Applicable Audit Requirements for Subrecipients The recipient should evaluate the level of funding provided to subrecipients to determine applicable audit requirements. Depending on the type of subrecipient organization, audits may or may not be required by federal statutes and regulations. In addition, depending on funding levels provided to subrecipients, audits may be required organization-wide or on a grant-by-grant basis. The recipient may also decide to have all of its subrecipients similarly audited to simplify the quality review process. If the recipient chooses to issue audit requirements above those issued by the federal government or other recognized authorities, audit expertise within the recipient organization is essential. At the outset the recipient must determine the nature of the entity-- subrecipient of federal financial assistance or vendor of generally required goods and services that are related to the administrative support of a federal assistance program. In the case of the vendor, federal audit requirements pertaining to subrecipients would not pass through to the entity. The vendor would be responsible to meet only the requirements of the pro- curement. This is an area of interpretation in which federal cognizant agencies can assist. 3. Evaluating Audit Quality Federal regulations require that the recipient determine whether subrecipients have met the audit requirements of the federal government. The Office of Management and Budget's Questions and Answers, states that a recipient's system to assure the quality of subrecipient audits should include a desk review of each subrecipient audit report for conformity with federal audit requirements. Likewise, Circular A-133 "Audits of Institutions of Higher Education and Other Nonprofit Organizations" requires the recipient to ensure that subrecipients have met audit re- quirements. The applicable desk review guide may be obtained from the President's Council on Integrity and Efficiency. To make the results of the desk review binding, the recipient should explain the use of this guide in the terms and conditions of the agree- ment with the subrecipient or through other means. Subrecipients also should be advised to communicate to their auditors that federal cognizant agencies use desk review guides to evaluate audit quality. In addition to the desk review of the audit reports, the recipient may assess the quality of an audit firm's work with a working paper review or on-site assessment. A subrecipient, subject to the Single Audit requirement, that fails to have an acceptable audit performed cannot charge the cost of the audit to federal financial assistance programs. Moreover, sanctions can be placed on both the recipient and the subrecipient for failing to obtain the proper audit. The recipi- ent should advise the subrecipient when an audit is found to have not met applicable audit requirements. In this instance, the subrecipient will be expected to work with its independent auditor to take corrective action. The recipient also ensures that any major inadequacy or repetitive substandard performance of an independent auditor is referred to appropriate professional bodies for possible disciplinary action. If corrective action is not taken, the cognizant agency will notify the recipient and granting agency of the facts and make recommendations for follow- up action. 4. Identifying Audit Findings Findings, including reported questioned costs identified by the independent auditor, should be addressed by the subrecipient and reviewed by the recipient. The desk review guides currently being used by most federal agencies suggest a thorough review of the audit report to determine if other findings not disclosed by the independent auditor might exist. The review may include notes to the financial statements as well as various schedules in the report for possible exceptional items. A review of fund balances and transfers between funds should also be made to assess possible violations of laws and regulations. Findings such as excess cash balances on hand and improper transfer of funds are sometimes identified through this process. The recipient must oversee resolution of instances of noncompli- ance by a subrecipient or material weaknesses in internal con- trols necessitating corrective action. Moreover, the recipient must obtain the subrecipient's corrective action plan. The recipient should also consider the effects of subrecipient findings on its own financial statements. Material findings may result in adjustments to records and/or disclosure of such findings in the recipient's audit report. 5. Resolving Audit Findings According to Federal Cognizant Agency Audit Organization Guide- lines for A-128 audits, a corrective action plan should identify the following for each finding: (1) actions planned in response to the finding including questioned costs, (2) the official responsible for ensuring corrective action of the deficiency, (3) the planned completion date for the corrective action, (4) an explanation of any disagreement with the auditor's findings, and (5) a plan to monitor completion of corrective actions. The corrective action plan should also include comments on the status of corrective action taken on prior findings. The recipient should review corrective action plans to determine the allowability of questioned costs and the follow-up actions necessary for proper resolution. For cross-cutting findings, coordination with other grantors is essential to efficiently achieve a mutually acceptable resolution. An example of a cross-cutting finding might include an identified accounting system weakness in which funding from several different agencies was involved. 6. Other Monitoring as Appropriate The recipient should be aware that receiving a subrecipient audit does not eliminate the need for performing program reviews or other monitoring procedures of its subrecipients. The recipient should have a clear understanding that its monitoring procedures, including the receipt and review of subrecipient audits, will most likely be evaluated during the audit of its own organiza- tion. The recipient should maintain a proper balance between reliance on subrecipient audits and other monitoring activities. III. ROLES AND RESPONSIBILITIES OF THE SUBRECIPIENT When an organization indirectly receives federal financial assistance (from a federal granting agency through another entity), it becomes a subrecipient organization. A given organi- zation may be a recipient organization directly receiving federal financial assistance from one or more federal granting agencies and a subrecipient organization indirectly receiving federal financial assistance through nonfederal organizations at the same time. This section pertains primarily to the roles and responsibilities of the organization as a subrecipient. These roles and responsi- bilities fall into two major areas--program management and audit management. The subrecipient organization should note that these guidelines do not address all program management responsibili- ties. They address those responsibilities related to the organization's position as a subrecipient within the context of audit. A. MANAGEMENT OF PROGRAMS A subrecipient's program management roles and responsibilities relate to two main audit areas -- (1) establishing and maintain- ing accountability for federal financial assistance and (2) complying with the requirements applicable to the federal finan- cial assistance received. 1. Establishing and Maintaining Accountability As discussed in the previous section, the primary recipient through which a subrecipient receives its federal financial assistance is responsible for ensuring that the subrecipient's use of the monies is in accordance with the requirements of the applicable program. To fulfill that responsibility, the primary recipient may engage in monitoring activities. It may also require the subrecipient to be audited. In either case, the subrecipient must establish and maintain accountability for its federal financial assistance. Maintaining accountability involves establishing a system of accounting and reporting that: segregates and identifies federal financial assistance received by program or grant, demonstrates how that assistance was used (with appropriate supporting docu- mentation), and provides regular reports to the primary recipient that allows it to monitor the use of the assistance. While generally acceptable accounting principles may be used as a starting point, guidance and technical assistance in this area may be sought from the primary recipient or from the applicable federal granting agency. 2. Complying with Applicable Requirements The primary recipient is also responsible for determining whether subrecipients comply with the requirements of the applicable program. By the same token, the subrecipient is responsible for complying with program requirements. To fulfill this responsi- bility, the subrecipient should establish effective internal control structure policies and procedures to ensure compliance. Although the particulars of the control procedures actually established will depend on the nature of the subrecipient organi- zation and the requirements of the program, the following general procedures should prove helpful: - Identify and become familiar with the applicable compliance requirements of each federal financial assistance program. - Assign responsibility for compliance with the requirements to specific employees. - Communicate the compliance requirements to employees. - To the extent possible, assure that the requirements become an integral part of the subrecipient's way of doing busi- ness. - Monitor operations on a regular basis for adherence to the applicable compliance requirements. - Establish and maintain open communication with the primary recipient and cooperate in the primary recipient's oversight efforts. To gain an understanding of the concepts and nature of establish- ing effective internal control structure policies and procedures, individuals should refer to the appendix in the AICPA audit guide, Audits of State and Local Governmental Units, the State- ment on Auditing Standards (SAS) 55, and the many other documents available. B. MANAGEMENT OF AUDITS A subrecipient's audit management roles and responsibilities can be classified in the following areas: (1) determining the audit requirements which apply to the subrecipient, (2) arranging for audit coverage that meets those requirements, (3) distributing the audit report, and (4) completing a corrective action plan. 1. Determining Applicable Audit Requirements Audit requirements applicable to a subrecipient organization depend on the amount of financial assistance received, the sources of that financial assistance, and the type of organiza- tion receiving the funds. Although this document focuses on federal audit requirements, a subrecipient organization should be aware that the primary recipient through which it receives federal financial assistance may provide additional funding under the program and may impose additional audit requirements. The following steps should be helpful in determining the applicable audit requirements. -- Determine whether federal funds are included in the finan- cial assistance received by the subrecipient organization by contacting the primary recipient if necessary. -- If federal funds are included, determine the total amount of federal funds received by the subrecipient organization, both directly from federal granting agencies and indirectly through primary recipients. -- On the basis of the amount of federal funds received and the nature of the subrecipient organization, determine the type of audit coverage required. Audit requirements for univer- sities and not-for-profit organizations are set forth in OMB Circular A-133. Audit requirements for state and local government units are set forth in OMB Circular A-128. In general, OMB Circular A-128 states that if the subrecipient organization receives: - $100,000 or more in federal financial assistance during the subrecipient's fiscal year, the organization must provide Single Audit coverage for that fiscal year. - less than $25,000 in federal financial assistance during the subrecipient's fiscal year, no federal audit requirement is imposed for that fiscal year; - $25,000 or more but less than $100,000 in federal financial assistance during the subrecipient's fiscal year, the organization may choose either to meet the specific audit requirements of the specific grant programs or to provide Single Audit coverage for that fiscal year; The thresholds for requiring audits under OMB Circular A-133 are consistent with these requirements except that entities receiving federal financial assistance under a single pro- gram have the option to have an A-133 audit or a program audit (a review based on the specifics of that one program). -- Determine other providers of financial assistance and iden- tify the audit requirements applicable to that assistance. 2. Arranging for Audit Coverage The subrecipient is responsible for obtaining audit coverage that will meet the requirements of OMB Circulars A-128 or A-133. An independent auditor should perform the audit. To increase the likelihood that audit coverage provided will meet the applicable audit requirements cost-effectively and will be of sufficient quality, the subrecipient should consider the follow- ing steps when it is responsible for procuring the audit: - Foster competition among prospective auditors by requesting audit proposals. - Clearly communicate the applicable audit requirements to prospective auditors. Inform the auditors of any review guides that will be used to evaluate the quality of their audit. - Technically evaluate the proposals received and the qualifi- cations of the auditors proposing. - Prepare a written agreement between the subrecipient organi- zation and the auditor selected. - Monitor the auditor's performance. Additional guidance in this area may be found in "How to Avoid a Substandard Audit: Suggestions for Procuring an Audit," National Intergovernmental Audit Forum; "Guidelines for Preparation of Requests for Audit Proposals," Western Intergovernmental Audit Forum; and Government Finance Officers Association (GFOA) Audit Management Handbook. 3. Distributing the Audit Report In addition to its normal distribution, the subrecipient should distribute audit reports to the following: - the National Clearinghouse For Single Audits if the audit report is for a Single Audit (See Section VII for the ad- dress) (NOTE: Several states collect subrecipient reports at a central location within the State for further distribution to the National Clearinghouse. This procedure seems to be an effective method to ensure proper distribution.) - the primary recipient(s), and - the applicable federal granting agency for any federal financial assistance received directly from a federal grant- ing agency. 4. Completing a Corrective Action Plan The corrective action plan is mandated by federal audit require- ments. The subrecipient should develop and implement a correc- tive action plan that addresses audit findings and recommenda- tions resulting from its A-128 audit. For A-133 audits, only material findings are to be reported. Thus, the subrecipient should develop and implement a corrective action plan that addresses all reported audit findings for A-133 audits. The corrective action plan becomes an integral part of the primary recipient's oversight of the subrecipient. In subsequent audits, the corrective action plan provides guidance for follow- up on audit recommendations already made. C. SUBGRANTS BY SUBRECIPIENT ORGANIZATIONS In some cases, a subrecipient may channel federal financial assistance to other organizations. In these cases, the subrecipient should assume the roles and responsibilities of a primary recipient. For guidance in this area, refer to Section II of this document. IV. ROLES AND RESPONSIBILITIES OF THE AUDITOR The independent auditor serves a critical function for both the recipient and the subrecipient in a situation involving pass-through of federal financial assistance. Although the roles of the independent auditors for the primary recipient and the subrecipient are similar in many ways, there are some key differ- ences. A. KNOWLEDGE OF AUDIT REQUIREMENTS When federal financial assistance is involved, both the primary recipient's and the subrecipient's independent auditors are responsible for auditing in accordance with Government Auditing Standards. (For purposes of this guide Government Auditing Standards incorporate by reference the requirements of Generally Accepted Auditing Standards and the OMB circulars or the grant requirements applicable to the engagement.) Because of the variety of audit requirements to which governmental entities are subject, the independent auditors should exercise due profession- al care in assuring that they and management understand the type of engagement to be performed. It is essential that the indepen- dent auditor be knowledgeable of the scope and the applicable requirements to be followed before accepting the engagement. Although the recipient/subrecipient is responsible for identify- ing and informing the independent auditor of the amount and type of assistance received, the auditor should know the client and be aware of activities where federal assistance may be involved as well as the accompanying audit requirements. The independent auditor should consider "matters relating to the entity's busi- ness and the industry in which it operates" and the "nature of reports expected to be rendered." Those matters include govern- ment regulations that could affect the industry in which the auditee operates. B. COMMUNICATIONS BETWEEN AUDITOR AND AUDITEE The auditee should prepare a written engagement letter clearly setting forth the scope of the audit engagement and describing the nature of the reports to be issued. If the independent auditor discovers that the type of engagement being requested or performed is not sufficient to meet the requirements imposed by the auditee's granting agency, the independent auditor should communicate this understanding to management and the appropriate federal or granting agency, as the auditor considers necessary. The auditor and auditee can then determine whether the scope or type of engagement should be revised or expanded. The auditor should obtain a clear understanding as to how the final audit will be evaluated. When the auditor has determined that addi- tional requirements are applicable and the client refuses to expand the scope of the engagement, the auditor should consider the guidance of AICPA Statement on Auditing Standards No. 54. C. ADDITIONAL AUDIT RESPONSIBILITIES Once the scope of services to be provided and the type of federal financial assistance involved in the pass through situation have been identified, the independent auditor should consider the additional responsibilities involved in a recipient versus a subrecipient audit engagement. In subrecipient engagements the auditor should look for - additional requirements imposed by the recipient, - indications that the relationship is one of a vendor rather than a subrecipient, and - instances of pass-through of federal financial assistance by the subrecipient, that subjects the subrecipient to certain recipient responsibilities. In some cases, the recipient will impose additional requirements on the subrecipient to assure compliance or adequate audit coverage of pass through assistance. For example, the recipient may receive and pass through assistance which, in total to all subrecipients, exceeds the audit requirements and/or thresholds for major federal financial assistance programs. However, the amount a subrecipient receives may fall short of these thresh- olds, causing the subrecipient to bypass obtaining audit coverage critical to the recipient. In these cases, the recipient may impose requirements similar to those required had the thresholds been met at the subrecipient level. Audit expertise is essential if the recipient chooses to issue audit requirements over and above those issued by the federal government or other recognized authorities. Evidence that the auditee has a procurement agreement to provide a recipient or a subrecipient with generally required goods or services that are related to "the administrative support of a federal assistance program" and that "will be paid for from federal assistance funds" could indicate that the auditee is a vendor and not a subrecipient. Then the auditee would be re- sponsible to meet only the requirements of the procurement. Moreover, the independent auditor would not be required to apply those audit requirements applicable to a subrecipient of federal financial assistance. When a subrecipient passes federal assistance through to another subrecipient, the former, in effect, assumes the role of a recipient with respect to monitoring, audit follow-up, and other such requirements. This often occurs when the recipient is a state agency or department that passes federal financial assis- tance through to various counties, which in turn pass the assis- tance through to cities, townships, or not-for-profit organiza- tions. Although the county, in this instance, would be consid- ered a subrecipient to the state, it would also have recipient responsibilities for the cities, the townships, or the not-for-profit organizations receiving pass through federal financial assistance. The independent auditor should be alert to review and test the subrecipient's monitoring and follow-up system with respect to the entities to which it has passed through funds, as discussed in the following section. D. DESIGN OF AUDIT PLAN The recipient's independent auditor should design the audit to meet the monitoring, follow-up, and adjustment responsibilities of a recipient who passes federal assistance through to subrecipients. This would include: -- Reviewing the recipient's systems of determining whether subrecipients have met applicable audit requirements. -- Reviewing the recipient's systems of determining whether the subrecipients spent federal financial assistance in accor- dance with applicable laws and regulations. -- Reviewing "the recipient's systems for obtaining and acting on subrecipient audit reports." -- Testing to determine "whether the system is functioning in accordance with prescribed procedures." -- Reporting which would include: - comments on the "recipient's monitoring and disbursing procedures with respect to subrecipients," as warrant- ed, - modification of the audit report for subrecipient findings which are material to the recipient, and - findings on due, but not received, subrecipient audit reports. -- Reviewing the timeliness of corrective action taken with respect to instances of noncompliance with federal laws and regulations at the subrecipient level. -- Reviewing the applicable adjustments made, as required, to the recipient's records resulting from findings at the subrecipient level. -- Reviewing whether the primary recipient informs and requires the subrecipient to permit independent auditors access to their records, as necessary. -- Obtaining additional written representation from management regarding monitoring of subrecipients, responsive corrective action and adjustments for subrecipient audit results. In addition to the aforementioned, the auditor should consider typical problem areas at the subrecipient level: - inaccurate communication by the primary recipient of the amount, type and other information required for inclusion in the schedule of federal financial assistance, - failure to adequately segregate federal financial assistance from other sources of pass-through assistance, - changes in the audit threshold for pass-through assistance, and - inadequate identification of all audit requirements, espe- cially certain requirements added by the primary recipient. E. AUDIT DISCLOSURE The recipient is responsible for assuring that the federal requirements accompanying federal financial assistance are met. Thus, the primary difference in audit approach for the indepen- dent auditor in a pass-through situation is to determine whether the recipient has made the appropriate effort, with respect to the subrecipient, to gain that assurance. If the recipient's system does not provide that assurance, the auditor should consider disclosing that fact and its related impact on the recipient's financial statements in the audit report. V. FINAL COMMENTS Fulfillment of the responsibilities and the functions described in the preceding sections should provide a means to build an effective system for managing subrecipient audits. The Mid- America Intergovernmental Audit Forum's Technical Issues Commit- tee, intends that this guide bring about a better understanding of the various roles and responsibilities associated with subrecipient audits. The Forum would like to thank the following members of the Technical Issues Committee and, especially, that committee's task force for the time and effort provided in the development of this guide. Other members and associates of the Forum provided technical assistance which was much appreciated. TECHNICAL ISSUES COMMITTEE Warren Jenkins (Chairman) Iowa State Auditor's Office Bob Coats Kansas Society of CPAs Vince Imbriani U.S. Department of Health/Human Services Ed Linderman U.S. Department of Agriculture Terry Livingston U.S. Department of Education Chris Madden Jackson County Jim McKay U.S. Department of Housing and Urban Development Herb Mortland Missouri Society of CPAs Randy Tongier Kansas Legislative Division of Post Audit TASK FORCE Bob Coats Kansas Society of CPAs John Fisher U.S. Department of Health/Human Services Terry Livingston U.S. Department of Education Wade Remmenga Nebraska Department of Health Randy Tongier Kansas Legislative Division of Post Audit Technical Assistance Myrana Gibler, Missouri State Auditor's Office Dave Jones, Chairman, MAIAF Margaret Kelly, Missouri State Auditor Ed Reck, Internal Auditor, City of St. Louis Susanne Valdez, Executive Director, MAIAF Marge Vallazza, Writer-editor, GAO VI. GLOSSARY Audit An auditor's examination of financial statements, of financial-related information, of economy and efficiency of operations, or of effectiveness in achieving program re- sults. Audit Resolution The point at which the audit organization and agency management agree on action to be taken on reported findings and recommendations; or, in the event of disagree- ment, the point at which the audit follow-up official deter- mines the matter to be resolved. Cognizant Federal Agency The federal agency assigned by OMB to (1) ensure that audit reports are received in a timely manner, (2) provide technical assistance to the auditor, (3) be the liaison with the auditee, (4) perform desk reviews of the audit reports received and quality control reviews of audit working papers for selected audit reports, (5) monitor the resolution of audit findings, and (6) ensure that the audit reports are distributed to all federal agencies and other federal departments providing funds to the organiza- tion. Compliance Following requirements or not violating prohibitions contained in statutes, regulations, contracts, and grants in binding policies and procedures governing entity conduct. Corrective Action Plan A recipient's description of corrective action taken or planned in response to findings identified by the auditor, as well as comments on the status of correc- tive action taken on prior findings. Cross-Cutting Audit Findings Audit findings that affect more than one agency or program. Desk Review A review of independent auditors' reports on not-for-profit organizations, universities, hospitals, and state and local governments to ensure the report has been prepared in accordance with all significant reporting stan- dards and requirements. Direct Funds Funds received by a not-for-profit organization, university, hospital, or state or local government directly from a federal agency. Federal Financial Assistance Assistance provided by a federal agency in the form of grants, contracts, cooperative agree- ments, loans, loan guarantees, property, interest subsidies, insurance, or direct appropriations. It does not include direct federal cash assistance to individuals. It includes awards received directly from federal agencies or indirectly through other units of state and local governments. Finding The result of information development - a logical pulling together of information to arrive at conclusions (or a response to an audit objective on the basis of the sum of the information) about an organization, program, activity, function, condition, or other matter which was analyzed or evaluated. It need not be critical or be concerned only with deficiencies or weaknesses. A finding will be the basis for conclusions and recommendations for corrective action. Granting Agency The agency providing federal funds to a not-for-profit organization, university, hospital, or state and local government. GAAS Generally Accepted Auditing Standards GAS Government Auditing Standards GAO U.S. General Accounting Office Independent Auditor A federal, state, or local government auditor who meets the standards specified in the Government Auditing Standards or a public accountant who meets such standards . Internal Control Structure Policies and procedures established to provide reasonable assurance that (1) resource use is consistent with laws, regulations, and award terms; (2) resources are safeguarded against waste, loss, and misuse; and (3) reliable data are obtained, maintained and fairly disclosed in reports. Major Programs As defined by OMB Circular A-133, an individual award or a number of awards in a category or federal assistance or support for which total expenditures are the larger of 3 percent of total federal funds expended or $100,000. As defined by OMB Circular A-128, an individual award or a number of awards in a category or federal assistance or support for which total expenditures are the larger of 3 percent of total federal funds expended or $300,000. Material Weakness A reportable condition in which the design or operation of the specific internal control structure ele- ments does not lower the risk that errors or irregularities in amounts that (1) would be material in relation to the financial statements being audited may occur and (2) would not be detected within a timely period by employees in the normal course of performing their assigned functions. National Clearinghouse For Single Audits Designated by OMB in 1985 as the clearinghouse for A-128 audits. State and local grantees receiving $100,000 or more in federal funds are required to submit a copy of completed A-128 audits within 30 days of issuance. (See the address in Section VII.) OMB Office of Management and Budget Organization Wide Audit An audit which encompasses all departments and programs of an agency. Oversight Agency The federal agency that provides the predominant amount of direct funding to a recipient not assigned a cognizant agency. If no direct funding is re- ceived, the oversight agency is the federal agency with the predominant indirect funding. Pass-Through Funds Federal funds received by a not-for-profit organization, university, hospital, or state or local gov- ernment and that have first been passed through another agency. PCIE The President's Council on Integrity and Efficiency Questioned Cost An alleged violation of a provision of a law, regulation, contract, grant, cooperative agreement, or other agreement or document governing the expenditures of funds; a finding that, at the time of the audit, such cost is not supported by adequate documentation; or a finding that the expenditure of funds for the intended purpose is unnecessary or unreasonable. Recipient An organization receiving financial assistance to carry out a program directly from federal agencies. Reportable Condition A matter coming to the auditors' attention relating to significant deficiencies in the design or operation of the internal control structure that, in their judgment, could adversely affect the entity's ability to record, process, summarize, and report financial data consistent with the assertions of management in the finan- cial statements. Single Audit Act of 1984 The United States federal statute which establishes uniform requirements for audits of federal financial assistance provided to state and local govern- ments. These requirements focus on a single coordinated audit of the aggregate federal financial assistance provided to a government with special emphasis on defined major federal financial assistance programs. Subgrants An award of financial assistance in the form of money, or property in lieu of money, made under a grant by a grantee to an eligible subgrantee. Subrecipient Any person or government department, agency, or establishment that receives federal financial assistance to carry out or administer a program but not an individual who is a beneficiary of such a program. Distinguishing charac- teristics of a subrecipient include such items as responsi- bility to meet compliance requirements, performance measured against meeting the objectives of a program, responsibility for programmatic decision making, and determining eligibili- ty for assistance. Vendor An entity responsible for providing generally required goods or services related to the administrative support of the federal assistance program. Distinguishing characteris- tics of a vendor include such items as providing the goods or services within normal business operations, operating for a profit, providing similar goods or services to many dif- ferent purchasers, operating in a competitive environment, and not having responsibility for adherence to program compliance requirements. VII. REFERENCE DOCUMENTS AMERICAN INSTITUTE OF CPAs (800)334-6961 (Technical Information (800)223-4158) (Library (800)223-4155) Catalog of Publications and Training Audits of State and Local Governmental Units Audits of Voluntary Health and Welfare Organizations Audits of Certain Nonprofit Organizations Audits of Colleges and Universities Journal of Accountancy Professional Accounting Standards Professional Auditing Standards COMMERCE CLEARING HOUSE, INC. (212)818-1730 New York 1301 Pennsylvania Avenue (202)626-2200 DC Washington, D.C. 20004 Federal Audit Guides DOCUMENT BUILDING-Capitol Hill Single Audit Act of 1984 FEDERAL COGNIZANT AGENCIES - Assigned on the basis of predominance of funding. Federal Agency Telephone Number* AGRICULTURE (816)926-7667 COMMERCE (404)347-4578 DOT (816)426-2761 EDUCATION (816)891-7981 ENERGY (505)846-1077 EPA (913)551-7824 HHS (800)732-0679 HUD (800)659-5692 INTERIOR (303)236-9243 LABOR (214)767-3711 * These are offices with cognizance for entities in the Mid-America Forum's region. GOVERNMENT FINANCE OFFICERS ASSOCIATION (312)977-9700 180 N. Michigan Avenue, Suite 800 Chicago, IL 60601-7476 Publication and Training Catalog Government Accounting and Financial Reporting Audit Management Handbook - Sample Procurement and Engagement GASB - Codification of Governmental Accounting and Financial Reporting Standards Guidance for - Certificate of...Excellence...in Financial Reporting MID-AMERICA INTERGOVERNMENTAL AUDIT FORUM (314)241-9080 Guide for Roles and Responsibilities In Subrecipient Audits Audit Procurement Guidance (Western Audit Forum) NATIONAL CLEARINGHOUSE FOR SINGLE AUDITS Data Preparation Division U.S. Bureau of the Census 1201 E. 10TH ST. Jeffersonville, IN 47132 Clearinghouse to send completed A-128 audits NATIONAL INTERGOVERNMENTAL AUDIT FORUM (202)275-9355 441 G Street NW Washington, D.C. 20548 NIAF - Guidelines For Preparation of Requests for Audit Proposals How to Avoid a Substandard Audit: Suggestions for Procuring an Audit STATE SOCIETY OF CERTIFIED PUBLIC ACCOUNTANTS News and Services Continuing Professional Education Course Catalog Speakers Bureau STATE BOARD OF PUBLIC ACCOUNTANCY License, referral, and quality enhancement programs THOMPSON PUBLISHING GROUP (202)872-1766 1725 K Street N.W., Suite 200 Washington, D.C. 20004 Single Audit Information Service - Tabbed, indexed binders of federal and related guidance updated monthly along with a monthly newsletter Common Rule - Federal Register, March 11, 1988 PCIE Desk Review Guide U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES (816)426-6169 Office Of Inspector General P.O. Box 15687 601 E. 12TH Street Kansas City, MO 64106 Guidelines for Audits of Federal Awards to Nonprofit Organizations Comprehensive Audit Management Package Desk Review Guide for Audit Reports and Quality Control Review Guide for Audit Workpapers U.S. DEPARTMENT OF THE TREASURY Office of Inspector General Room 7210 ICC Building 1201 Constitution Avenue NW Washington, DC 20220 Desk Review Guide Quality Control Review Guide PCIE Position Papers U.S. GOVERNMENT INTERAGENCY AUDITOR TRAINING PROGRAMS (202)382-8620 Course Catalog for Training on OMB grants administration requirements Cost principles and audit requirements in OMB Circulars A-102, A-87, A-128, A-133, and others. U.S. GOVERNMENT DEPOSITORY LIBRARIES Directory of U.S. Government Depository Libraries available from the Government Printing Office Bookstore Federal Documents - Executive orders, Federal Register, Code of Federal Regulations, OMB circulars, federal laws U.S. GOVERNMENT PRINTING OFFICE BOOKSTORE (Many major metropoli- tan areas) (816)926-7261 Kansas City OMB Compliance Supplement GAO Government Auditing Standards Federal Cognizant Agency Audit Organization Guidelines Federal regulations GSA Catalog of Federal Domestic Assistance - subscription service Guide to Record Retention Requirements Title 5 Part 13 Code of Federal Regulations - List of OMB circulars and phone number for ordering them (shown below) Federal statutes Executive Orders of the President of the United States Directory of U.S. Government Depository Libraries U.S. OFFICE OF MANAGEMENT AND BUDGET (OMB) PUBLICATIONS (202)395-7332 Questions and Answers on the Single Audit Act OMB Circulars: A-50 - Resolution of Audit Findings A-73 - Government-wide policy on reliance on non federal audits A-87 and A-122 Cost Principles A-88 - Assignment of cognizance for institutions of higher education A-102 and A-110 - (Issuance of Common Rule for) Grants Administration A-128 and A-133 - Single Audit or Coordinated Audit