ACTION: Final Revision of OMB Circular A-133, "Audits of Institutions of Higher Education and Other Non-Profit Institutions"

DATES: The standards set forth in §___.400 of the Attachment to this Circular, which apply directly to Federal agencies, shall be effective July 1, 1996, and shall apply to audits of fiscal years ending on or after June 30, 1997. The standards set forth in this Circular that Federal agencies are to apply to non-profit organizations shall be adopted by Federal agencies in codified regulations not later than November 30, 1996, so that they will apply to audits of fiscal years ending on or after June 30, 1997, with the exception that §___.305(b) of the Attachment applies to audits of fiscal years ending on or after June 30, 1999.

ADDRESSES: A copy of the Circular may be obtained from the OMB fax information line, 202-395-9068, document number 1133; OMB home page on the internet which is currently located at /OMB; or by writing or calling the Office of Administration, Publications Office, room 2200, New Executive Office Building, Washington, DC 20503, telephone (202) 395-7332.

FOR FURTHER INFORMATION CONTACT: Recipients should contact their cognizant or oversight agency for audit, or Federal awarding agency, as may be appropriate in the circumstances. Subrecipients should contact their pass-through entity. Federal agencies should contact Sheila O. Conley, Office of Management and Budget, Office of Federal Financial Management, Financial Standards and Reporting Branch, telephone (202) 395-3993, fax (202) 395-4915.

A. Background

Section B presents a summary of the major public comments grouped by subject and a response to each comment. Other changes were made to increase clarity and readability.

B. Public Comments and Responses

Common Rule Format

Response: Circular A-133 was reformatted to facilitate codification by Federal agencies.

Uniform Audit Requirements

Responses: Even though Circular A-133 does not apply to State and local governments, provisions were made to easily adapt Circular A-133 to include State and local governments if the Single Audit Act is amended. For example, changes were made to the risk-based approach to determine major programs for circumstances that most likely will only occur in large State-wide single audits.

Increased Threshold for Audit

Response: This final revision raises the audit threshold to $300,000. Pass-through entities should make appropriate changes in their agreements with subrecipients to reflect that Circular A-133 no longer requires an audit for entities expending less than the $300,000 threshold. Also, pass-through entities will need to consider this change, review their overall subrecipient monitoring process, and decide what, if any, additional monitoring procedures may be necessary to ensure subrecipient compliance for the subrecipients not required to have a Circular A-133 audit. It is expected these monitoring procedures could be more targeted and less costly than the full Circular A-133 audit.

Special Provision for Certain Small Subrecipients

Response: This provision was included in the proposed revision to provide audit coverage of Federal programs, such as the Job Training Partnership Act (JTPA) programs, which are structured such that substantial service delivery and expenditure of Federal funds are made by subrecipients that expend less than $300,000 in Federal awards.

The provision has not been added to the Circular. However, it is important to note that both the pass-through entity and the pass-through entity's auditor have responsibilities for these funds even when an audit of the subrecipient is not required. The pass-through entity is still responsible to monitor the activities of the subrecipient and ensure that Federal awards are only used for authorized purposes. Additional monitoring procedures may be necessary when a material amount of program funds is passed through to subrecipients which are not audited.

The pass-through entity's auditor is responsible for performing sufficient tests to support an opinion on compliance for each major program. When subrecipients which are not audited expend a material amount of funds from a major program, the auditor will need to consider obtaining compliance assurances by reviewing the pass-through entity's records and monitoring procedures, performing additional procedures to determine compliance, such as testing the subrecipient's records, or a combination of procedures. In addition, the pass-through entity's auditor is responsible for determining whether the pass-through entity's system for monitoring subrecipients is adequate and whether subrecipient noncompliance necessitates adjustment of the pass-through entity's records.

Consideration of Triennial Audit

However, Federal agency commenters were opposed to a triennial audit approach and cited problems, such as it would alert the non-profit organization in advance of which years should be audited, significantly complicate the risk-based approach for selecting major programs (e.g., under the risk-based approach a large program is only required to be audited once every three years and with triennial audits this could be once in every nine years), and result in only limited cost savings (e.g., under the triennial audit approach a financial statement audit and testing of internal control would still be required).

Response: The triennial audit approach was not added to the Circular. However, the Circular does provide significant audit relief to non-profit organizations by raising the audit threshold from $25,000 to $300,000, allowing a risk-based approach to selecting major programs, and streamlining the report distribution process by use of a certification form. The risk-based approach will permit low-risk non-profit organizations to reduce the percentage of Federal expenditures required to be covered as major programs. The certification form, as discussed later in this supplementary information, will simplify the pass-through entity's review of subrecipient reports which have no audit findings.

Risk-Based Approach to Determine Major Programs

Response: The auditor is best suited to determine major programs for reasons, such as independence and the understanding of risk to Federal programs obtained as part of the audit. Therefore, the proposal has been adopted, with no changes made to the requirement for the auditor to determine major programs. However, in recognition of the concerns expressed relative to larger audits, Appendix 1 (§___.520), Major Program Determination, was modified as follows:

Step 1 (§___.520(b)(1)) was modified to provide a sliding scale in determining Type A programs. This change only affects auditees with Federal expenditures over $100 million.

Step 2 (§___.520(c)(2)) was modified to permit a Federal agency, with OMB approval, to designate that a low-risk Type A program could not be considered low-risk. This designation could be for reasons, such as to help the Federal agency comply with Section 405 of the Government Management Reform Act (P.L. 103-356).

Step 3 (§___.520(d)(2)) was modified to add a sliding scale which defines relatively small Federal programs in terms of a percentage of total Federal expenditures. This benefits very large audits by reducing the number of Type B programs for which the auditor must perform risk assessments. The decrease in the total amount of Federal expenditures subject to audit will be relatively small because of the wide difference in size between the largest and smallest Federal programs.

Step 4 (§___.520(e)) was modified to only require one-half of the high-risk Type B programs to be audited as major and provide a limit that the number of these Type B programs audited as major need not exceed the number of low-risk Type A programs.

However, should the auditor choose not to exclude a low-risk Type A program, this would not affect the limit. The limit is on the number of low-risk Type A programs, not the number excluded. Also, even though larger dollar Type A programs may be excluded as low-risk, they may still need to be audited to meet the 50 percent rule.

To mitigate any implementation problems with the risk-based approach, the provision for deviation from use of risk criteria provided in §___.520(i) applies to the first year this Circular is applicable and permits auditors to defer implementation of the risk-based approach for one year.

Implementation of the Risk-Based Approach
to Determining Major Programs

Response: The reference in Appendix 1, step 2 (§___.520(c)(1)) to the two most recent audit periods means audit periods in which the audit was performed either under the prior Circular A-133 or this revision. Therefore, a Type A program which meets the Appendix 1, step 2 (§___.520(c)(1)) criteria for low-risk based on the results of an audit performed in accordance with the prior Circular A-133 may be considered low-risk. Similarly, the reference in the criteria for a low-risk auditee in Appendix 3 (§___.530) to the preceding two years applies to audits performed either under the prior Circular A-133 or this revision.

Request for a Program to be Audited
as a Major Program

Response: This provision has been adopted; however, a change was made to allow programs audited as major under this process to count towards meeting the 50 percent rule. This process does not significantly change the authority Federal agencies and pass-through entities now have to perform additional audits as long as they pay for them. The addition is that these audits may be incorporated within the framework of the single audit and thereby eliminate duplicative audit planning and reporting. Since the Federal agency or pass-through entity must still pay the full incremental audit cost, OMB does not expect a significant increase in major programs from this provision.

It should be pointed out that any Type A program selected to be audited under this provision must be low-risk. If it were not low-risk, it would have been audited as a major program under the risk-based approach. Therefore, this provision will not reduce the number of high-risk Type B programs audited as major.

Required Level of Internal Control Testing

Response: The proposal has been adopted, with no changes. Some commenters appeared to understand this provision to mean that, when control exceptions are found, the auditor is required to continue testing until a low level of risk is achieved. This is not the case. The auditor is not required to expand testing to try to achieve a low level of risk. The auditor is only required to plan the audit for a low level of assessed risk and report the results of this testing.

It has been a longstanding Federal policy that the recipient of Federal funds is required to establish internal control systems to provide reasonable assurance that it is managing Federal funds in compliance with applicable laws and regulations. Also, the Single Audit Act (31 U.S.C. Chapter 75) requires the auditor to test internal control over Federal funds subject to that Act. Therefore, it is reasonable to require the auditor to plan the audit consistent with the level of internal control the recipient of Federal funds is required to maintain. Also, the Circular permits the auditor to not test internal controls which are inadequate and instead disclose a reportable condition or material weakness and perform additional tests of compliance as necessary in the auditor's judgment.

Schedule of Expenditures of Federal Awards

Response: A provision has been added to encourage, but not require, pass-through entities to disclose in the schedule the total amount provided to subrecipients from each Type A program and from each Type B program which is audited as a major program. In most cases this information should be readily available and would improve the usefulness of the schedule.

Attestation on Internal Control and Compliance

Response: In light of the concerns raised, this proposed revision has not been added to the Circular.

Criteria for Reporting Questioned Costs

Response: OMB believes that the $10,000 threshold for reporting questioned costs provides the appropriate balance between reporting all questioned costs and only reporting large questioned costs. Also, audit findings which do not result in questioned costs but are material to the types of compliance requirements or an audit objective in the compliance supplements will still be reported as reportable conditions under §___.510(a)(1) or material noncompliance under §___.510(a)(2).

Generally accepted auditing standards require the auditor to project the amount of known questioned costs identified in the sample to the items in the major program and to consider the best estimate of total questioned costs (both known and likely) in determining an opinion on compliance. The Circular does not require the auditor to report an exact amount or statistical projection of likely questioned costs, but rather to include an audit finding when the auditor's extrapolation of these likely questioned costs is greater than $10,000.

Since the requirement for the auditor to consider likely questioned costs is not new, and since likely questioned costs which are greater than $10,000 may be significant to a Federal program, OMB believes they should be included in audit findings. In reporting likely questioned costs, it is important that the auditor follows the requirements of §___.510(b) and provides appropriate information for judging the prevalence and consequences of the audit finding.

Requirement to Follow up on Prior Audit Findings

Response: As a practical matter, unless an audit finding is repeated in a subsequent year, there is limited value in continuing to follow up on an audit finding when the Federal agency or pass-through entity chooses to take no action. Therefore, a provision has been added stating that a valid reason for considering an audit finding as not warranting further action is that: (a) two years have passed since the audit report was filed with the central clearinghouse designated by OMB, (b) the Federal agency or pass-through entity is not currently following up on the audit finding, and (c) a management decision was not issued.

Also, for the first year the entity is audited under this Circular, the prior year report may not have included the equivalent of a summary schedule of prior audit findings. In these cases, the auditee may exercise judgment and only include, to the extent practical, audit findings before the prior year.

Corrective Action Plan

Response: The proposal has been adopted, with no changes. Some commenters appeared to misunderstand this provision. It is important that a non-profit organization name a contact person or persons to be responsible for corrective action. However, contrary to the commenters' understanding, the non-profit organization has discretion to determine whether one person should be responsible for all or a group of audit findings or whether a separate person should be responsible for each audit finding.

Pass-Through Entity's Responsibility
for Subrecipient Audit

Response: This provision has been adopted, with no changes. There was no intention that this provision require the pass-through entity to perform extensive verification procedures to determine the total Federal expenditures of a subrecipient. OMB expects that, in many cases, the pass-through entity will have knowledge of the subrecipient sufficient to estimate the subrecipient's total Federal expenditures. Another technique would be for the pass-through entity to clearly explain the audit requirements to the subrecipient and then ask the subrecipient the amount of its total Federal expenditures.

Audit Cognizance

Response: The responsibilities for audit cognizance and indirect cost negotiation are different and, therefore, the same Federal agency does not need to be cognizant for both. The name for the cognizant agency has been changed to the cognizant agency for audit to clearly distinguish it from the cognizant agency for indirect cost rate negotiation.

Provision for Small and Minority Audit Firms

Response: As explained in the preamble to the proposed revision, this provision was proposed to be deleted because the requirements related to small and minority audit firms are more fully covered in §___.44(b)(4) of OMB Circular A-110, "Uniform Requirements for Grants and Agreements with Institutions of Higher Education, Hospitals and Other Non-Profit Organizations" (58 FR 62992; November 29, 1993). There was no intention to change or diminish the requirements for using small and minority audit firms. To ensure that these requirements continue to receive consideration, a provision has been added to the auditor selection paragraph that, whenever possible in procuring audit services, non-profit organizations shall make positive efforts to utilize small businesses, minority-owned firms, and women's business enterprises, as stated in OMB Circular A-110.

Restriction on Auditor also Preparing
Indirect Cost Proposal

Response: A provision (§___.305(b)) has been added to preclude the same auditor from preparing the indirect cost proposal or cost allocation plan when indirect costs exceeded $1 million in the prior year. This threshold was chosen to limit this restriction to a relatively small number of entities, while still protecting the Federal interest. The prior year was chosen because non-profit organizations often engage the auditor before the end of the year and at this time it may be unknown whether the current year's indirect costs will exceed the $1 million threshold. Based on available data, OMB estimates that entities with indirect costs exceeding $1 million cumulatively receive approximately 90 percent of the total indirect costs charged by non-profit organizations.

This restriction applies to the base year from which financial data is used to compute the rates even though the audit of the base year financial statements is often completed before the indirect cost proposal or cost allocation plan is prepared. The base year was included to enhance the appearance of independence to the Federal agencies which rely upon the auditor's testing of information used in both the calculation and application of indirect cost rates.

The disclosure statements required by OMB Circular A-21 have been excluded from this restriction because the disclosure statement is new, many of the statements will be submitted before the effective date of this Circular A-133 revision, and the disclosure statements are expected to have a long life. Under these circumstances, it does not seem appropriate public policy to restrict auditors who prepared the original disclosure statements from performing the audit for a long period of time. Therefore, the disclosure statements required by OMB Circular A-21 have been excluded from this restriction on auditor selection. OMB will monitor these disclosure statements and may revisit this issue again at a later date.

The implementation date for this provision is delayed two years until audits of fiscal years ending on or after June 30, 1999, to minimize any effect this provision could have on existing contracts for audit services. For example, an auditor that prepared an indirect cost proposal or cost allocation which is used as the basis for charging indirect costs in the fiscal year ending June 30, 1999, is not permitted to perform the 1999 audit.

Report Due Date

Response: This proposal has been adopted, with a change. The provision retains the requirement in the Circular that, when the audit is completed earlier than the due date, the reporting package must be submitted within 30 days of audit report issuance.

Certification

On a related issue, some State auditor and CPA commenters cited a possible logistical problem that the auditor would not be able to complete the audit report until the certification form was prepared (because the auditor must read the certification form and report as an audit finding material inconsistencies with the audit) and the certification form could not be prepared until the audit is completed.

Response: The requirements for the auditor to read the certification form and report as an audit finding any material inconsistencies has not been adopted. As a preventive control to ensure proper distribution of audit reports, a requirement (§___.500(f)) has been added for the auditor to identify to the auditee those Federal awarding agencies and pass-through entities which are required to receive a copy of the reporting package. Also, a requirement (§___.505(b)) was added for the schedule of findings and questioned costs prepared by the auditor to include a summary of the auditor's results. This summary will facilitate preparation of the certification form by the auditee.

Management Letter

Response: OMB agrees that it is not necessary to routinely include auditor's management letters as part of the report submission. Therefore, this provision has not been adopted. However, because management letters may contain information relevant to the needs of Federal agencies and pass-through entities to monitor Federal awards, a provision has been added that Federal agencies and pass-through entities can request a copy of management letters.

Coordinated Audit Approach