Tag Archives for " Single Audit "

Single Audit major program determination can be challenging. And if this determination is wrong, your Single Audit will be wrong. 

So in this article, I explain how you can correctly determine your major programs in four steps. 

First, understand that Single Audits focus on major programs. This is how you know which programs to test. So if your auditee has multiple federal programs, it's important to determine which are major and which are not. 

Here is a summary of the four steps of Single Audit major program determination:

1. Identify Type A programs
2. Identify Type A low-risk programs
3. Identify Type B high-risk programs
4. Determine major programs

(If you desire a deeper dive, watch the following video with a case study.)

Before you do any of these, create a list of all federal programs, similar to the schedule of expenditure of federal awards (the SEFA). The list is comprised of each federal program and the amounts expended. 

Next, apply the four steps to this list. We'll start by identifying the type A programs.

1. Identify Type A Programs

The type A threshold is $750,000 when the total federal awards expended are $25 million or less. So if you have a federal program of $750,000 or greater, then it's a type A program. Type B programs are those of less than $750,000. 

When total federal awards exceed $25 million, see the table below.

Remove the Large-Loan Program Distortion

Clusters are One Program

No Type A Programs

What if there are no type A programs? Then go to step 4 and pick enough programs to satisfy the coverage requirement. 

Next, we'll see how to identify low-risk type A programs. 

2. Identify Low-Risk Type A Programs

The Uniform Guidance provides the auditor with criteria in §200.518 (c) for determining whether a type A program is low risk. Type A programs that meet these criteria are low-risk. Programs that do not meet these criteria are not low-risk. 

The Uniform Guidance says,

For a Type A program to be considered low-risk, it must have been audited as a major program in at least one of the two most recent audit periods.

Consequently, a type A program will be major at least once every three years.

Additionally, the Uniform Guidance goes on to say:

in the most recent audit period, the program must have not had:

(i) Internal control deficiencies which were identified as material weaknesses in the auditor's report on internal control for major programs as required under §200.515 Audit reporting, paragraph (c);

(ii) A modified opinion on the program in the auditor's report on major programs as required under §200.515 Audit reporting, paragraph (c); or

(iii) Known or likely questioned costs that exceed five percent of the total Federal awards expended for the program.

Additionally, federal agencies can request that programs not be considered low-risk for certain recipients. If such a request is made, the program will not be low risk. 

But if the factors listed above don't lead to a high-risk classification, can the auditor use inherent risk factors such as size and complexity to move the assessment to high risk? No. The auditor must use the criteria listed above. 

And what if there are no low-risk programs?

No Low-Risk Type A Programs

If there are no low-risk type A programs then step 3, identifying high-risk type B programs, is not necessary. Go directly to step 4: Determine major programs. 

Now, let's take a look at step 3: Identifying high-risk type B programs.

3. Identifying High-Risk Type B Programs

The auditor identifies the type B programs by using their judgment and criteria such as that listed below. But how many high-risk type B programs should the auditor identify? No more than at least one-fourth the number of low-risk type A programs.

Additionally, the auditor is only required to perform risk assessments of type B programs that exceed 25% of the type A threshold (e.g., 25% of 750,000 is $187,500). If all of the type B programs are less than this amount, then none are assessed. And you skip step 3. But if you have type B programs greater than this 25% amount, perform risk assessments.

In determining whether a type B program is high-risk, the auditor should use factors such as:

• The complexity of the program
• The phase of the program in its life cycle (newer programs may be higher risk)
• The degree of significant changes in the program or related statutes and regulations
• The size of the program (programs with larger expenditures are higher risk)
• Weaknesses in internal controls as related to compliance requirements (e.g., controls to ensure allowability of costs)
• Prior audit findings
• The structure of the internal control system (multiple structures tend to be higher risk)
• Federal programs not recently audited as a major program
• Oversight by a federal agency (if their review noted issues, then the program could be higher risk)

Other than known material control weaknesses in internal controls pertaining to compliance requirements or known compliance problems, a single risk criterion will seldom cause the program to be high risk.

But what if there are no high-risk type B programs?

No High-Risk Type B Programs

If there are no high-risk type B programs, then none are major. This is true even if there are low-risk type A programs. You can't make a type B program high-risk just because a low-risk type A program exists (and you're trying to meet the one-fourth of type A low-risk requirement). So, assess the program in light of the criteria. And let it be what it is, whether high-risk or low-risk.

If, however, there are multiple high-risk type B programs, a potential problem arises: identifying too many high-risk programs.

Identify Only What is Required

Don't make the mistake of identifying more high-risk type B programs than what is necessary. If you do, then you must test them all (those you identified as high-risk). So, once you have identified the requisite number of high-risk type B programs, stop. 

If there are multiple potential type B high-risk programs and not all are identified as high-risk, then consider rotating the programs tested each year. 

Rotate Programs Tested

The Uniform Guidance (§200.518) encourages providing "an opportunity for different high-risk type B programs to be audited as major over a period of time." So if the auditor only needs one type B high-risk program, for example, and there are multiple potential high-risk type B programs, then it is desirable to identify a different one as major each year. That way, different type B high-risk programs will be audited over time.

We're almost done. Now, let's determine the major programs.

4. Determine Major Programs

At a minimum, the following will be your major programs:

• All type A programs not identified as low risk
• All type B programs identified as high-risk
• Any additional programs needed to comply with the percentage of coverage rule

So what is the percentage of coverage rule? It's 20% for low-risk auditees and 40% for those that are not low-risk auditees. But what does this mean? Well, let's look at an example to clarify.

Suppose the entity is a low-risk auditee. And suppose the entity has type A program that is not low risk (it's a major program). It makes up 17% of the total federal awards. All other programs are type B and none is considered major. What should be done? Pick a type B program and test it. But the program picked must bring the total tested to at least 20% of the total federal awards. Now you've complied with the coverage rule.

The low-risk auditee criteria follows below. Though there are similarities with program risk assessment criteria shown above, there are differences as well. 

Low-Risk Auditee

Four Steps of Major Program Determination

Your organization received federal funds but you're not sure about Single Audit applicability. Should you engage an audit firm to perform a Single Audit or not? 

In this article, I'll help you determine whether a Single Audit is needed. I'll also explain the objectives of such an audit. Why? So you can understand what auditors are looking for.

Single Audit: What is it?

Many nonprofits and governments receive federal funds from the United States government. And some of those entities are required to have a Single Audit.

But what is a Single Audit? It's just what it says: a single audit. Of what? A single audit of all federal awards received by a nonprofit or a government. 

For example, a county government might receive disaster funds from FEMA and a block grant from HUD. But rather than contracting for two separate audits, a Single Audit of both programs is performed. This audit requirement is usually triggered when total federal awards exceed $750,000 in one year.

The Uniform Guidance

Single Audit Applicability

But what does expend mean? Typically the word means that an entity spends money. But the word expend has a broader meaning in Single Audits. For example, the word includes:

• receipt of federal property or goods (e.g., surplus property or commodities)
• receipt and use of federal loans 
• loan balances with the federal government (when there are continuing compliance requirements)
• interest subsidies from the federal government

So if the government or nonprofit expends at least $750,000 in federal funds during its fiscal year, a Single Audit is necessary. If it expends less than $750,000, then a Single Audit is normally not required. States may, however, require a Single Audit even though amounts expended are less than $750,000.

Does the entity look solely at funds received directly from the federal government? No. Federal awards may come directly from a federal agency. But they may also come indirectly through a pass-through entity such as a state. The nature of the federal funds does not change as it passes through an entity (e.g., a state). It's still federal money.

In light of these facts, how does the Uniform Guidance define federal financial assistance? Let's take a look.

What is Federal Financial Assistance?

The Uniform Guidance defines federal assistance in the following manner:

§ 200.40 Federal financial assistance.

(a) Federal financial assistance means assistance that non-Federal entities receive or administer in the form of:

  (1) Grants;

  (2) Cooperative agreements;

  (3) Non-cash contributions or donations of property (including                 donated surplus property);

  (4) Direct appropriations;

  (5) Food commodities; and

  (6) Other financial assistance (except assistance listed in paragraph       (b) of this section).

(b) For § 200.202 Requirement to provide public notice of Federal financial assistance programs and Subpart F - Audit Requirements of this part, Federal financial assistance also includes assistance that non-Federal entities receive or administer in the form of:

  (1) Loans;

  (2) Loan Guarantees;

  (3) Interest subsidies; and

  (4) Insurance.

Total of Federal Assistance

The non-federal entity adds all federal financial assistance together to see if they exceed the $750,000 threshold. If, for example, a county government expends $500,000 in block grant funds and $450,000 in disaster funds during its fiscal year, then a Single Audit is necessary. 

Now that you understand Single Audit applicability, you may be wondering what the objectives are. 

Objectives of a Single Audit

1. Opinion on Compliance with Federal Program Requirements

First, understand that the auditor provides an opinion regarding the entity's compliance with major federal program requirements.

A portion of that wording reads as follows:

Opinion on Each Major Federal Program

In our opinion, Example Entity complied, in all material respects, with the types of compliance requirements referred to above that could have a direct and material effect on each of its major federal programs for the year ended June 30,20X1.

2. Reporting on Internal Control Testing

Second, understand that the auditor reports on internal control testing. While no audit opinion is rendered by the auditor, the controls are tested nonetheless.  

A portion of that wording reads as follows:

Report on Internal Control Over Compliance

Management of Example Entity is responsible for establishing and maintaining effective internal control over compliance with the types of compliance requirements referred to above. In planning and performing our audit of compliance, we considered Example Entity's internal control over compliance with the types of requirements that could have a direct and material effect on each major federal program to determine the auditing procedures that are appropriate in the circumstances for the purpose of expressing an opinion on compliance for each major federal program and to test and report on internal control over compliance in accordance with the Uniform Guidance, but not for the purpose of expressing an opinion on the effectiveness of internal control over compliance. Accordingly, we do not express an opinion on the effectiveness of Example Entity's internal control over compliance.

Single Audit Applicability and Objectives

In summary, Single Audits are necessary when an entity expends $750,000 or more. And the objectives of the audit are to provide an opinion on compliance with federal requirements and to report on the internal control testing.