Subrecipient Monitoring from the Auditee and Auditor Perspective A Governmental Audit Quality Center Web Event March 7, 2012

Subrecipient Monitoring from the Auditee and Auditor Perspective

A Governmental Audit Quality Center Web EventMarch 7, 2012

Governmental Audit Quality Center 2

Administrative Notes

Troubleshooting Tips No Audio?• Ensure that your computer speakers are turned on and that the

volume is appropriately set• Check to ensure that audio streaming is enabled on your

computer

If the presentation slides stop advancing during the presentation• Close out of the presentation and re-launch the Web event

If you are still having audio or other technical difficulty• Check with your organization’s IT personnel to ensure that the

Web event is not being blocked by a firewall• Call the AICPA Service Center at 888.777.7077


Administrative Notes

We encourage you to submit your technical questions – please limit your questions to the content of today’s program

Submit your questions during the Web event by clicking on the “Q & A” tab on the lower right portion of your screen and then clicking on “Ask Question”

You can also download slides in PDF or PowerPoint by clicking on “Handouts” tab

This event is being recorded and will be posted in an archived format to the GAQC Web site


Continuing Professional Education

There will be a total of 8 participation pop-up markers during the event (i.e., about 1 every 15 minutes) To obtain CPE, you must click “OK” on 75% of the participation pop-up markers (i.e., 6 of 8) • To track your progress, click on the “Participation” tab

on the lower right- portion of your screen to see how many markers have been issued and how many you have clicked on

If you are not receiving CPE for this event, ignore the pop-up markers if they appear

Governmental Audit Quality Center 5American Institute of CPAs

Kevin W. Smith, CPA

&

Joel M. Black, CPA

Presenters


What will we cover

Roles & Responsibilities

The Subaward Agreement

The Risk Assessment

Monitoring Procedures

Monitoring Follow-Up

Auditor Review of Monitoring Activities


Roles & Responsibilities


Understanding Compliance

Grants funded by the federal government must be administered according to federal regulations, state laws, and specific terms and conditions of the awardAs a prime recipient of funding, the grant recipient is responsible for:• Complying with laws, regulations, rules, and procedures;• Monitoring contractors and sub-recipients;• Fulfilling required reporting; • Accomplishing the goals and objectives of the grant and the awarding

agency; and• Communication.


Prime recipients are responsible for sub-recipients and contractors.

Regulatory compliance;

Ensuring reporting is completed timely;

Data accuracy and completeness;

Prevention of misuse of funds;

Key steps:• Appropriately define an organization as a sub-recipient or

vendor;• Communicate applicable responsibilities and regulations; and• Act promptly when issues are observed.


Subrecipient / Vendor Determination

All characteristics need not be present

Judgment should be used in the determination process


Subrecipient Characteristics

Provider determines eligibility.Provider has performance measured against federal program objectives.Provider responsible for programmatic decisions.Provider responsible for federal program compliance requirements.Provider uses federal funds to carry out its own program.


Vendor Characteristics

Organization provides the goods and services within normal business operations.Organization provides similar goods or services to many different purchasers.Organization operates in a competitive environment.Organization provides goods or services that are ancillary to the operation of the federal program.Organization is not subject to compliance requirements of the federal program.


The Subaward Agreement


Subaward Agreements

Agreements shall outline:• Scope of Work• Budget• Performance Requirements• Program Authorizing Legislation• Program Regulations

Must also include:• CFDA Title and Number (www.CFDA.gov)• Award Name• Name of Federal Agency• Applicable Compliance Requirements• Notification of Annual Risk Assessment


Subaward Agreements, Cont.

Key provisions must include minimum administrative requirements:

Financial Management Procurement Financial Reports Program Reports Records Retention Cost Allocation Payment Matching

Period of Availability

Program Income Real Property Equipment Supplies Monitoring Audits Other


Sub-granting and Sub-contracting Federal Awards

Department of Energy Example• Contract provisions

- All contracts must include specific language pertaining to, but not limited to, the following areas:- Contract Work Hours and Safety Standards Act- Equal Employment Opportunity- Byrd Anti-Lobbying Amendment- Clean Air Act

- ARRA-specific language- Buy America requirements- Davis-Bacon applicability- Limits on use of funds- Reporting requirements

- Ownership of materials and products


The Risk Assessment


What is a Risk Assessment?

Risk assessment is completed annually.

Risk assessment measures two quantities:• Magnitude of the potential loss • Probability that the loss will occur

What is the overall risk assessment for the subrecipient? • Determines frequency of monitoring• Determines depth of monitoring


Identify and Limit Risk

Understand sub-recipients’ familiarity with the program and applicable regulations;

Design contracts in accordance with federal regulations and to account for all data and reporting requirements;

Incorporate contract language that allows your organization to amend contracts as additional guidance from the federal government is received;

Review the results of previous audits for any findings that may have resulted; and

Submit timely, detailed enforcement reports to the federal government to demonstrate that sub-recipient monitoring is a priority and is being executed when issues are observed.


Risk Assessment May Include…

Size of the award

Percentage of award vs. total federal awards received by the agency

Complexity of award requirements

Single or multi-year award

Subrecipient experience

Prior monitoring / audit results


Additional Items to Consider…

Provider History

Policies and Procedures

Financial Stability

Management Systems


Risk Assessment

The output should be a report indicating where gaps or deficiencies exist and recommendations for improvement:

What might be found?• Current procurement policies allow for use of unjustified sole sourcing

of vendors;• No sub-recipient monitoring plan exists so the organization is unsure

when to review sub-recipients and what should be reviewed when on-site;

• Financial management systems do not allow for the use of sub-accounts;

• Time reporting policies exist, but no one reviews them for accuracy; and

• Pre-approval from the federal government for the purchase of equipment and real property was not obtained in all circumstances.


Monitoring Procedures


Subrecipient Monitoring

Compliance Requirements - A pass-through entity is responsible for:

Award Identification

During-the-Award Monitoring

Subrecipient Audits

Ensuring Accountability of For-Profit Subrecipients

Pass-Through Entity Impact

Central Contractor Registration


What, Why, Who, and When?What is monitoring?• A process that evaluates how a grantee is administering a grant

according to the requirements of the grant:- Eligibility Determination- Allowability of Services- Allowable Costs- Internal Management Systems- Procurement Policy- Other

Why is monitoring important?• Ensure compliance with federal rules and regulations• Ensure services are provided in accordance with subaward agreement

What is the role of a monitor?• Notification of review • Request necessary policies and documents • Provide technical assistance as needed

When do you monitor?• As deemed necessary based on annual risk assessment


Monitoring Plan

Clearly identify necessary activities and responsible parties;

Review debarment lists;

Allow for consistency throughout monitoring activities;

Characteristics include:• Data quality reviews;• Required progress reporting;• Site and desk reviews, potentially

critical for large-scale projects;• Compliance auditing; and• Develop corrective action plans.


Monitoring Plan

Once the process has concluded, develop and implement an internal action plan:

• Revise policies and procedures;

• Enforce compliance with the internal requirements; and

• Execute ongoing monitoring.

Utilize your internal auditors to conduct regular, detailed reviews; and

Know where others have faltered.


How Do You Monitor?Techniques for conducting monitoring activities• Desk reviews

- Executed at the pass-through entity’s site (i.e. not at the sub-recipient’s location);

- May include, at a minimum, financial reviews for allowability prior to invoicing the federal government, reviews of progress reports, and assessments of the sub-recipient’s independent audit.

• On-site field reviews- Executed periodically and may follow a risk-based approach for

scheduling;- Should include sampling contracts, transactions, reviewing

supporting documentation, and assessing documented policies and procedures; and

- Should involve technical experts if the project is of a technical nature (e.g. construction or energy engineering).


Eligibility Determination

Verify that eligibility was properly determined.

Suggested activities:• Review program forms to ensure they capture accurate eligibility

requirements.• Review case files, completed applications, and other program

records and forms to determine that the subrecipient is appropriately assessing eligibility criteria.


Allowability of Services

Verify that services provided were allowable under grant rules and were provided as billed.

Suggested activities:• Review program records as well as brochures and any other

materials disseminated to the public. • Review program forms to ensure they capture accurate program

services. • Review program records to ensure documentation of service

delivery.


Allowable Costs

Verify that the cost of goods, services, and property are allowable, in accordance with federal regulations, and expenditures appear to be within the submitted budget.

Suggested activities:• Review purchasing records.• Review monthly expenditure reports.• Review invoices and budgets.


Cost Allocation

Verify financial records to assure accounting records identify the source of funds and provide for accurate division of charges and cost as related to the subaward agreement.

Suggested activities:• Review cost allocation methodology.• Observe use of acquired assets to verify they are being used as

charged.


Cash Management

Verify cash management system provides reasonable assurance that federal funds are drawn down only for immediate needs. (Not applicable for reimbursement basis agreements.)

Suggested activities:• Review start up funds.• Review funding requests vs. expenditures.


Program Income

Verify that program income practice provides reasonable assurance income is correctly earned, recorded and used in accordance with the program requirements.

Suggested activity:• Review records to ensure that program income was:

- Recorded as earned.- Deposited as collected.


Internal Management Systems

Verify that sufficient internal management systems are in place to ensure subrecipient has effective control over and accountability for all funds, property, and other assets.

Suggested activities:• Review subrecipient’s procedure manual and or operating

policies. • Review subrecipient’s inventory report/listing.• Review prior audits and corrective action plans.


Procurement Policy

Verify that the subrecipient’s procurement policy represents an acceptable level of internal control and is in accordance with federal procurement requirements.

Suggested activities:• Review any codes of conduct. • Review transactions


During-the-Award Monitoring

Factors that may affect the nature, timing, and extent of during-the-award monitoring:

Program complexity

Percentage passed through

Amount of awards

Subrecipient risk


Agreed-upon Procedures Engagements

A pass-through entity may arrange for agreed-upon procedures engagements for certain aspects of subrecipient activities, such as eligibility determinations.

Since the pass-through entity determines the procedures to be used and compliance areas to be tested, these agreed-upon procedures engagements enable the pass-through entity to target the coverage to areas of greatest risk.


Reports

Verify financial and other reports are supported by underlying accounting or performance records and are submitted in accordance with the provisions of the subaward agreement.

Suggested activity:• Review records to ensure:

- Timeliness- Accuracy- Completeness



Progress reports and performance metrics are frequently being required.

Recipients must report on progress toward achieving objectives and provide justification for variation from identified milestones.

Consider the Performance Metrics and Benefits Plan for the SGIG• Must specify two types of measures: build and impact metrics;• Report to the Data Hub; and• DOE may be involved to ensure alignment with federal goals

and objectives.



• Examples of Reporting Systems


Monitoring Results

Upon conclusion of monitoring:• Findings will be completed by the reviewer and signed by the

director of the agency or designee.• A copy will be mailed to the subrecipient identifying any

deficiencies.• Immediate action should be taken to correct issues involving

ineligible uses of federal funds.• A corrective action plan should be developed by the subrecipient

within 60 days from the issuance of the review findings to address deficiencies or noncompliance issues.


Monitoring Results, continued

• Review corrective action plans based on the pass-through entity’s monitoring work or the results of independent audits;

• Sanction subrecipients as allowed by federal regulations if they are found to be in noncompliance- Withhold payments- Require that sub-recipient reimburse the pass-through

entities- Terminate the contract

• Report noncompliance or sanctioning activities to the federal government for follow-up when required.

Document the execution of monitoring activities and corrective action taken.





Why is follow-up important?

Identify recurring problems to a program• Example: Incorrect eligibility determinations could result in

unallowable charges to federal program.

Identify recurring problems with a subrecipient• Example: Subrecipient that fails to correct monitoring findings is

at risk of incurring additional unallowable costs or audit findings.


Auditor Review of Monitoring Activities


Audit Objectives

Internal Control to support a low control risk assessment.

Compliance


Audit Planning Considerations

Effect of pass-through awards on the determination of major programs• Expenditure is based on when the activity related to the award

occurs• Federal awards are deemed to be expended by the pass-

through entity when the funds are disbursed to subrecipients, regardless of when subrecipients expend the federal funds

Materiality• Matter of professional judgment – influenced by the auditor’s

perception of the needs of a reasonable person who will rely upon the auditor’s work


Control Objectives

To provide reasonable assurance that Federal award information and compliance requirements are identified to subrecipients, subrecipient activities are monitored, subrecipient audit findings are resolved, and the impact of any subrecipient noncompliance on the pass-through entity is evaluated.

The pass-through entity should perform procedures to provide reasonable assurance that the subrecipient obtained required audits and takes appropriate corrective action on audit findings.


Control Environment

Establishment of “tone at the top” of management’s commitment to monitoring subrecipients.

Management’s intolerance of overriding established procedures to monitor subrecipients.

Entity’s organizational structure and its ability to provide the necessary information flow to monitor subrecipients are adequate.

Sufficient resources dedicated to subrecipient monitoring.

Knowledge, skills, and abilities needed to accomplish subrecipient monitoring tasks defined.

Individuals performing subrecipient monitoring possess knowledge, skills, and abilities required.

Subrecipients demonstrate that:• They are willing and able to comply with the requirements of the award, and• They have accounting systems, including the use of applicable cost principles,

and internal control systems adequate to administer the award.• Appropriate sanctions taken for subrecipient noncompliance.


Risk Assessment

Key managers understand the subrecipient’s environment, systems, and controls sufficient to identify the level and methods of monitoring required.

Mechanisms exist to identify risks arising from external sources affecting subrecipients, such as risks related to:

Economic conditions.

Political conditions.

Regulatory changes.

Unreliable information.

Mechanisms exist to identify and react to changes in subrecipients, such as: Financial problems that could lead to diversion of grant funds, Loss of essential personnel, Loss of license or accreditation to operate program, Rapid growth, New activities, products, or services, and Organizational restructuring.


Control Activities

Identify to subrecipients the Federal award information (e.g., CFDA title and number, award name, name of Federal agency, amount of award) and applicable compliance requirements.Include in agreements with subrecipients the requirement to comply with the compliance requirements applicable to the Federal program, including the audit requirements of OMB Circular A-133.Subrecipients’ compliance with audit requirements monitored.


Information and Communication

A listing of Federal requirements that the subrecipient must follow. Items can be specifically listed in the award document, attached as an exhibit to the document, or incorporated by reference to specific criteria.

The description and program number for each program as stated in the CFDA. If the program funds include pass-through funds from another recipient, the pass-through program information should also be identified.

A statement signed by an official of the subrecipient, stating that the subrecipient was informed of, understands, and agrees to comply with the applicable compliance requirements.

A recordkeeping system is in place to assure that documentation is retained for the time period required by the recipient.

Procedures are in place to provide channels for subrecipients to communicate concerns to the pass-through entity.


Monitoring

Establish a tracking system to assure timely submission of required reporting, such as: financial reports, performance reports, audit reports, onsite monitoring reviews of subrecipients, and timely resolution of audit findings.

Supervisory reviews performed to determine the adequacy of subrecipient monitoring.


Audit Procedures - Compliance

Gain an understanding of the pass-through entity’s subrecipient monitoring procedures

Test the pass-through entity’s subaward review and approval documents to determine whether, before award, the pass-through entity checked CCR to determine whether subrecipients were registered.

Test award documents and agreements to ascertain if: • (a) at the time of award the pass-through entity made subrecipients aware

of the award • (b) the activities approved in the award documents were allowable

Review the pass-through entity’s documentation of during-the-award monitoring.

Review the pass-through entity’s follow-up to ensure corrective action on deficiencies noted in during-the-award monitoring.


Compliance Continued

Verify that the pass-through entity: • a. Ensured that the required subrecipient audits were completed• b. Issued management decisions on audit findings within 6 months after receipt of

the subrecipient’s audit report.• c. Ensured that subrecipients took appropriate and timely corrective action on all

audit findings.

Verify that in cases of continued inability or unwillingness of a subrecipient to have the required audits, the pass-through entity took appropriate action using sanctions.

Verify that the effects of subrecipient noncompliance are properly reflected in the pass-through entity’s records.

Verify that the pass-through entity monitored the activities of subrecipients not subject to OMB Circular A-133, including for-profit entities.

Determine if the pass-through entity has procedures that allow it to identify the total amount provided to subrecipients from each Federal program.


When the Subrecipient Monitoring System is NOT Sufficient

Report a significant deficiency or material weakness in internal control over compliance

Consider whether the insufficient monitoring system represents an instance of noncompliance that should be reported as a compliance finding (very likely)

Consider the effect of the noncompliance on the opinion on compliance for major programs


When the Subrecipient Monitoring System is NOT Sufficient

Request by pass-through to perform additional audit procedures• Expansion of the scope • Would not remedy the internal control over compliance finding• May remedy the noncompliance

Potential impact on the financial statements• Financial statement opinion• Yellow Book finding


Reporting Considerations

SEFA should identify the total amount provided to subrecipients from each federal program• If unable to identify, determine if a finding in internal control over

compliance or compliance should be reported.

Evaluation of audit findings• Circular A-133 requires consideration of a finding whether or not

it can be quantified• Consider whether instances identified should be reported with

respect to subrecipient monitoring


Reporting Considerations

Effect of subrecipients’ noncompliance on the pass-through entity’s report• Noncompliance reported in the subrecipients’ audit reports are

not required to be included in the pass-through entity's audit report

• Auditor of pass-through should consider the effect of reported instances that could have a material effect on each of the pass-through entity’s major programs

Adjustment of pass-through entity financial records and reports


Audit Considerations of Subrecipients

Additional compliance requirements established by pass-through entities

Information included in the SEFA • A-133 requires the name of the pass-through entity and

identifying number assigned by the pass-through • Subrecipients may choose to provide information requested by

federal awarding agencies and pass-through entities

Audit findings

Submission of the report – A-133 §320(e)


Where do you look for guidance?

Current OMB Circular A-133 Compliance Supplement• http://www.whitehouse.gov/omb/circulars_default

AICPA Audit Guide, Government Auditing Standards and Circular A-133 Audits• http://www.cpa2biz.com

http://www.whitehouse.gov/omb/circulars_default

http://www.whitehouse.gov/omb/circulars_default

http://www.cpa2biz.com/AST/Main/CPA2BIZ_Primary/AuditAttest/IndustryspecificGuidance/NotforProfit/PRDOVR~PC-012743/PC-012743.jsp


Questions ?????


Kevin Smith

• Email: [email protected]

Joel Black

• Email: [email protected]

Have more questions?


How do I get my CPE certificate?

Just follow these steps:1. Go to CPA2Biz.com

2. Click on “My Account” at the top of the page and enter your CPA2Biz/AICPA username and password

3. Click on “My Web Events” tab

4. Click on “AICPA Learning Center Transcripts and Certificates” link (a new window or tab will open)

5. On the AICPA Learning Center, click on “My Transcripts” in the left-hand menu

6. Locate your completed course and click on “Go” to retrieve your certificate.

If you need assistance with locating your certificate, please contact the AICPA Service Center at 888.777.7077 or [email protected].

mailto:[email protected]


Evaluations

Please take a few minutes to let us know what you thought about today’s Web event

Click on the link below to begin a short evaluation

http://www.zoomerang.com/Survey/WEB22EV5SKRB8N/



Documents

Subrecipient Monitoring from the Auditee and Auditor Perspective A Governmental Audit Quality Center Web Event March 7, 2012