Single Audit Fundamental Series Part 2: Major Program Determination - AICPA

Action 3 – Recalculate the thresholdACTION 3 - RECALCULATE THE THRESHOLD EXCLUDING THE LARGE LOAN PROGRAM(S)Type A Threshold Calculation without "Large" LoansTotal Federal Expenditures (Loans and Non-Loans) Less "Large" Loan Program(s)Total Federal Expenditures without "Large" Loan programs Type A/B Threshold from Table/Recalculated ThresholdType A Programs for FY 20XXSFA ClusterR&D Cluster93.653 Child Support Enforcement10.415 Rural Rental Housing Loans14.881 Moving to Work Demonstration 5,721,000*.03) 165,149,00020,000,000825,00083,000,0002,225,000

Action 3 – Recalculate the thresholdACTION 3 - RECALCULATE THE THRESHOLD EXCLUDING THE LARGE LOAN PROGRAM(S)Type A Threshold Calculation without "Large" LoansTotal Federal Expenditures (Loans and Non-Loans) Less "Large" Loan Program(s)Total Federal Expenditures without "Large" Loan programs Type A/B Threshold from Table/Recalculated ThresholdType A Programs for FY 20XXSFA ClusterR&D Cluster93.563 Child Support Enforcement10.415 Rural Rental Housing Loans14.881 Moving to Work Demonstration Program771,630(25,721,000*.03) If did not recalculate threshold,would have missed theseType A ,00020,000,000825,00083,000,0002,225,000

Where we are Four-step approachStep 1Identify "typeA" programs37Step 2Step 3Step 4Identify lowrisk "type A"programsIdentify highrisk "type B"programsDeterminemajorprograms toaudit

Step 2: identify low-risk type A programs§200.518(c)Criteria for low-risk type A program Must have been audited as a major program in at least one of thetwo most recent audit periods; and In the most recent audit period, the program must not have had a– Modified opinion– Material weakness in internal control over compliance– Known or likely questioned costs exceeding 5% of total program expenditures38

Step 2: identify low-risk type A programsIn making the low-risk type A determination, the auditor must also considerwhether any of the following indicate significantly increased risk and would,therefore, preclude the program from being low-risk: Federal and PTE oversight Results of audit follow-up Changes in personnel or systemsA federal awarding agency may request that a type A program not beconsidered low-risk for a certain recipient39

Type A Risk AssessmentA client has 2 type A programs thatmeet the criteria for low-risk programs.Can the auditor judgmentally decide tocall the programs high-risk anyway,based on the fact that they arerelatively large and complex?40

Type A Risk Assessment§200.518(c)(1)No. The only judgmental criteria that theauditor is permitted to consider in the type Arisk assessment are the following: oversight by federal agencies or PTEs, the results of audit follow-up, or any changes in personnel or systems.The auditor is not permitted to use judgmentbased on the inherent risk of a type Aprogram.See also chapter 8 of the GAS-SA Guide41

Application of UG in type A program risk assessmentConsider a type A program that: Has been audited once in the 2 previous years Has no audit findings from the prior year that would preclude theprogram from being low-risk, and Has not had any federal/PTE oversight reviews performed, has noproblems noted in audit follow-up, has experienced minimalchanges in personnel, and no systems changes)42

Step 2: identify low-risk type A programsIf there are no low-risk type A programs Skip to Step 4 in major program determination process Risk assessment of type B programs is not required if there areno low-risk type A programs43

Where we are Four-step approachStep 1Identify “typeA" programs44Step 2Step 3Step 4Identify lowrisk “type A"programsIdentify highrisk “type B"programsDeterminemajorprograms toaudit

Step 3: Identify high-risk type B programsIf there are low-risk type A programs Perform risk assessments on type B programs until high-risk type B programshave been identified up to at least 1/4 of the number of low-risk A programsThe auditor is not expected to perform risk assessments on relatively smallfederal programs Auditor only required to perform risk assessments on type B programs thatexceed twenty-five percent (0.25) of the type A threshold determined in Step 1 For example, if type A threshold is 750,000, auditor would not have toperform risk assessments on type B programs of 187,500 or less45

Step 3: identify high-risk type B programs§200.519The auditor must identify type B programs which are high-risk using professionaljudgment and the criteria in § 200.519, Criteria for Federal program riskExcept for known material weakness in internal control or compliance problems asingle risk criterion seldom causes a type B program to be high-riskCriteria for Federal Program risk (§200.519(b) - (d)) Current and prior audit experience Oversight exercised by federal agencies and PTEs Inherent risk of the federal program46

Criteria for type B program inherent riskNature and complexity of the programPhase of program in life cycle at federal agencyPhase of program in life cycle at the auditeeType B programs with larger federal awardsexpended would be of higher risk than programswith substantially smaller federal awards expended47

Type B Risk AssessmentIn going through the 4-stepprocess, we only needed to identify 1high-risk type B program.My staff risk assessed all 5 type Bprograms and identified 2 as high-risk.Are we required to audit both highrisk type B programs as major?48

Type B Risk Assessment§200.518(e)(2)Yes. Under step 4 of the majorprogram determination process, anauditor is required to audit as majorall type B programs that are identifiedas high-risk.If more high-risk type B programs areidentified by the auditor than neededto satisfy step 3, the auditor must testthose high-risk type B programs asmajor programs.49

Type B risk assessment nuanceBackground There are 15 type A programs Engagement team has assessed five type A programs as high-riskand 10 type A programs are low-risk Therefore, only need to perform risk assessments until identify 3high-risk type B programs– ¼ (25%) of the 10 low-risk type A programs 2.5 (must round up to 3 to get atleast ¼ of Type A programs) There are 7 type B programs above the de minimus threshold50

Situation 1 - type B risk assessmentsType B ProgramsHIGH-RISKLOW-RISKNOT ASSESSEDProgram 1Program 2Program 3Program 4Program 5Program 6Program 7Staff started at top of list to risk assess type B programs.Extra effort in type B risk assessments.51

Situation 2 - type B risk assessmentsType B ProgramsHIGH-RISKLOW-RISKNOT ASSESSEDProgram 1Program 2Program 3Program 4Program 5Program 6Program 7Staff risk assessed all type B programs and came up with4 high-risk programs so team needs to audit ALL high-risktype B programs (one extra than needed in this example)52

Situation 3 - type B risk assessmentsType B ProgramsHIGH-RISKLOW-RISKNOT ASSESSEDProgram 1Program 2Program 3Program 4Program 5Program 6Program 7Staff and partner discussed assessment approach andknown information about type B programs, resulting inmost efficient assessment approach.53

Type B risk assessmentWhat if the client’s type B programs areall below the “small program” threshold(equal to or less than 25% of the type Athreshold)?Do I still need to risk assess andidentify a high-risk type B program?54

Type B risk assessment§200.518(d)No. The auditor is not required to risk assessrelatively small programs (i.e., those which areequal to or less than 25% of the type A threshold).For example, with a type A threshold of 750,000,relatively small programs would be those equal toor less than 187,500.In this example, since all of the type B programsare relatively small programs, the auditor wouldnot have to risk assess and identify any high-risktype B programs. However, the auditor may needto select some of those relatively small programsto meet the percentage of coverage.55

Type B risk assessmentIf there are no type Aprograms, should the type Bprograms be risk assessed orcan I just select the requisitenumber of type B programs toachieve the percentage ofcoverage needed?56

Type B risk assessment§200.518When there are no type A programs identified as lowrisk (either because there are no type A programs orbecause none of the type A programs are low-risk), theauditor is not required to perform step 3 of the majorprogram determination process (identify high-risk typeB programs), and therefore is not required to riskassess type B programs.In this scenario, the auditor can go directly to step 4and audit as major programs the number of type Bprograms needed to meet percentage of coverageusing auditor judgment.See also chapter 8 of the GAS-SA Guide57

Type B risk assessmentIn going through the 4-stepprocess, we need to identifytwo high-risk type B programs.We risk assessed all 5 type Bprograms and identified only 1as high-risk. What should wedo?58

Type B risk assessment§200.518It is possible to risk assess all of an auditee’s type Bprograms and find fewer high-risk type B programs thanyou need, or that none are high-risk type B programs.Be sure you have considered all of the criteria in section200.519, Criteria for Federal Program Risk, anddocumented your assessments.Move on to step 4 and using auditor judgment select anyadditional programs needed to meet percentage ofcoverage.See also chapter 8 of the GAS-SA Guide.59

Where we are Four-step ApproachStep 1Identify “typeA" programs60Step 2Step 3Step 4Identify lowrisk “type A"programsIdentify highrisk “type B"programsDeterminemajorprograms toaudit

Step 4: determine major programs to auditAll type A programs except those identified as lowrisk in Step 2 (i.e. “other than low-risk” type Aprograms)Type B programs identified as high-risk in Step 3Such additional programs necessary to comply withpercentage of coverage rule 40.0% or 20.0% if low-risk auditee61

Step 4: determine major programs to auditPercentage of coverage rule If considered a low-risk auditee, then – Minimum 20.0% of federal expenditures expended If not considered a low-risk auditee, then – Minimum 40.0% of federal expenditures expendedDetermination occurs at the end of all previous steps NONE of the steps in the major program determination processmay be bypassed just because minimum coverage is achieved62

Low-risk determination pitfallsAuditors sometimes confuse the various risk assessments Low-risk auditee determination (qualification for reducedaudit coverage) Risk-based approach for determining major programs– Identification of low-risk type A– Identification of high-risk type B Audit risk for each major program being tested Audit risk for each direct and material compliancerequirement (risk of material noncompliance)63

Example 1 – Determine the major programs (assumelow-risk auditee)Program 1 4,689,000Program 2208,000Program 3Program 4Total53,0001,600 4,951,60064Audited prior year with nofindings or other risk factorsNew program director incurrent year and knowncompliance problem due toPTE monitoring resultsType A/B threshold 750,000; program 1 is low-risk type A;program 2 is high-risk type B

Example 1 - SolutionWhat programs should be audited as major? Program 2 because it was identified as a high-risk type B program;and Program 1 to meet low-risk auditee coverage of 20% of totalfederal expenditures65

Example 2 – Determine the major programs (assume entity is not a low-riskauditee)Program 1Program 2708,500Program 3532,970Program 4187,900Total66 889,330Audited prior year with no findings or other riskfactorsNot audited in the prior 2 years and hascomplex eligibility criteria. Also known internalcontrol issues based on PTE monitoring resultsAudited prior year with no findings or other riskfactorsAudited prior year with no findings or other riskfactors 2,318,700Type A/B threshold 750,000; program 1 is low-risk type A;program 2 is high-risk type B

Example 2 - SolutionWhat programs should be audited as major? Need 40% coverage since entity not a low-risk auditee Program 2 because it is a high-risk type B program Pick another program to meet % of coverage67

Example 3 – Determine the major programs (assumelow-risk auditee)Program 1 275,000Audited prior year with nofindings or other risk factorsProgram 2250,000Audited prior year with nofindings or other risk factorsProgram 3Program 4Total175,000165,000 865,000Type A/B threshold 750,000; There are no type A programs68

Example 3 - SolutionNeed 20% coverage since entity is alow-risk auditeeCan pick any program(s) to meetcoverage of 20%Either Programs 1, 2, or 3 get you to20%Program 4 will not get you to 20%69

Example 4 – Determine the major programs (assumelow-risk auditee)Program #Type A/BProgramThreshold is 750,0001234567891011Expenditures ited in one oftwo prior yearswithout findingsYesYesYesNoNo**low-risk program because prior year finding was a significant deficiency in internal control over compliance thatdid not result in a compliance opinion modification nor known or likely questioned costs greater than 5% ofprogram expenditures.*1 Risk assessment not performed because the auditor only has to perform risk assessments on type B programsuntil high-risk type B programs have been identified up to at least ¼ the number of low-risk type A programs.

Example 4 – potential solutionMajor ProgramsProgram Number 4Program Number 8subtotals for 4 & 8Expenditures 825,000 A - High risk500,000 B - High risk1,325,000 percentage coverageProgram Number 3(judgmentally selected) percentage coverage71Program Type 6,700,000 in federalexpenditures 19.78%A low-risk programselected to achieve900,000 percentage coverage2,225,000 33.21%

Major program determination tipsEnsure documentation supports all decisions and the4-step process Required risk analyses Basis for the assessments of risk– Consideration of all programs– Consideration of clustering programs– Categorization of programs as type A or B§200.518(g)72

Major program determination tipsEnsure the risk assessment decision isconsistent with other information in the auditdocumentationCannot use inherent risk as a factor to classify atype A program as other than low-riskIf you identify a type B program as high-risk, itmust be audited as majorIf you have access to major program riskassessment tools, use them!73

Major program determination and risk assessment tips74RecalculateDetermineIf major programsdetermined duringinterim phase ofaudit, recalculateat the endDeterminepercentage ofcoverage at theend of the 4-stepprocess Check that totalexpenditures and typeA/B federal programthreshold haven’tchanged due toadjusting entries Do not assume that ifauditee is consideredlow-risk that 20.0%coverage is sufficientRecheckRecheck that allnecessary type Aand type B riskassessments weredoneUtilizeUtilize the AICPAGAS-SA Guide

75Communications withcognizant oroversight agency foraudit

Communications with cognizant or oversight agency for auditPlanning procedures may indicate a need to communicate with thecognizant or oversight agency for audit Cognizant agency for audit: the federal agency designated to carry out theresponsibilities described in §200.513(a) Oversight agency for audit: §200.513(b) the federal awarding agency thatprovides the predominant amount of direct funding to a recipient notassigned a cognizant agency for audit.If discussions are held, the auditor should document such communications,as well as any decisions reached as a result§200.51376

Communications with cognizant or oversightagency for auditSingle audit matters that may be discussed: Scope of the compliance testing of federal programs Intended use of the Compliance Supplement Identification of federal awards, including those that areconsidered to be major programs Form and content of the SEFA Testing of the monitoring of subrecipients77

Communications with cognizant or oversightagency for auditSingle audit matters that may be discussed: Scope of the review and testing of internal control overcompliance Testing of compliance requirements Status of prior-year findings and questioned costs Federal agency or PTE management decisions on prioryear findings Compliance requirements and any changes to thoserequirements78

Recap of topics coveredConsiderations prior to major program determinationApplying the risk-based approach for determining majorprogramsCommunications with cognizant or oversight agency for audit79

About the GAQC – www.aicpa.org/GAQCProvides resources (e.g., alerts, webevents, tools, etc.)Current areas of emphasis Government Auditing Standards Single audits Preparing for study on single auditqualityEven if not a member, GAQC Web siteprovides useful information for bothauditors and auditees For example, GAQC AuditeeResource Center80

Governmental AuditQuality CenterThank youCopyright 2020 American Institute of CPAs. All rights reserved.

awards expended from loans within the program is 50% or more of the total federal awards expended for the program When a loan program exceeds four times the largest non-loan program it is considered a "large" loan program If a program is considered a large loan program, it is considered a type A program and excluded in determining