OIG UNDER REVIEW

& PERIOD REVIEWED:

NAME OF ENGAGEMENT:

CONTROL NO.:

NAME DATE

REVIEWER(S): 

DATE COMPLETED

+----------------------------------+---+---+---+------------------------+
|                                  | # |   |   | ########               |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **1. INDEPENDENCE** **(GAGAS     | # |   |   | ########               |
| 3.03-3.32)**                     | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 1.1 If adequate as prescribed,   |   |   |   |                        |
| were the OIG's policies and      |   |   |   |                        |
| procedures followed? Determine   |   |   |   |                        |
| whether the policies and         |   |   |   |                        |
| procedures were adhered to in    |   |   |   |                        |
| the conduct of the audits.       |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 1.2 If the prescribed policies   |   |   |   |                        |
| and procedures were inadequate,  |   |   |   |                        |
| inquire of management how it     |   |   |   |                        |
| determined that this standard    |   |   |   |                        |
| was met. (Obtain any             |   |   |   |                        |
| documentation necessary to       |   |   |   |                        |
| support this information.).      |   |   |   |                        |
| Assess all of the documentation  |   |   |   |                        |
| associated with the audit        |   |   |   |                        |
| staff's independence.            |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **2. PROFESSIONAL JUDGMENT**     |   |   |   |                        |
| **(GAGAS** **3.33-3.38)**        |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 2.1 If adequate as prescribed,   |   |   |   |                        |
| were the agency's policies and   |   |   |   |                        |
| procedures followed? Determine   |   |   |   |                        |
| whether the policies and         |   |   |   |                        |
| procedures were adhered to in    |   |   |   |                        |
| the conduct of the audits.       |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 2.2 If inadequate as prescribed, |   |   |   |                        |
| inquire of management as to how  |   |   |   |                        |
| it met the standard and assess.  |   |   |   |                        |
| (Obtain any documentation        |   |   |   |                        |
| necessary to support this        |   |   |   |                        |
| information.) Was the            |   |   |   |                        |
| information provided by          |   |   |   |                        |
| management sufficient to ensure  |   |   |   |                        |
| that the standards were met?     |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 2.3 Assess the audit product at  |   |   |   |                        |
| the completion of the review and |   |   |   |                        |
| determine if issues were         |   |   |   |                        |
| identified where reasonable      |   |   |   |                        |
| care, diligence, and             |   |   |   |                        |
| professional skepticism, et al,  |   |   |   |                        |
| were not met.                    |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **3. COMPETENCE** **(GAGAS       |   |   |   |                        |
| 3.39-3.41)**                     |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 3.1 If the OIG's prescribed      |   |   |   |                        |
| policies and procedures were     |   |   |   |                        |
| adequate, test whether they were |   |   |   |                        |
| followed during the course of    |   |   |   |                        |
| the audit.                       |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 3.2 If inadequate as prescribed, |   |   |   |                        |
| examine the composition of the   |   |   |   |                        |
| staffing. Inquire of management  |   |   |   |                        |
| as to how it concluded the       |   |   |   |                        |
| staffing standard was met, then  |   |   |   |                        |
| assess the experience and        |   |   |   |                        |
| qualifications of assigned staff |   |   |   |                        |
| and determine if adherence to    |   |   |   |                        |
| GAGAS appeared reasonable. Note  |   |   |   |                        |
| that GAGAS requires additional   |   |   |   |                        |
| qualifications for attestation   |   |   |   |                        |
| engagements to include knowledge |   |   |   |                        |
| of AICPA promulgations. Consider |   |   |   |                        |
| the complexity and uniqueness of |   |   |   |                        |
| the assignment and any unique    |   |   |   |                        |
| staffing requirements that       |   |   |   |                        |
| appeared warranted.              |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **4. SUITABILITY AND             |   |   |   |                        |
| AVAILABILITY OF CRITERIA**       |   |   |   |                        |
| **(GAGAS 6.03)**                 |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 4.1 If the OIG's policies and    |   |   |   |                        |
| procedures over the suitability  |   |   |   |                        |
| and availability of criteria     |   |   |   |                        |
| were adequate as prescribed,     |   |   |   |                        |
| were they followed?              |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 4.2 If the policies and          |   |   |   |                        |
| procedures were inadequate as    |   |   |   |                        |
| prescribed, did the engagement   |   |   |   |                        |
| meet the following requirements: |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| a.  The criteria used to measure |   |   |   |                        |
|     and present the subject      |   |   |   |                        |
|     matter of the engagement     |   |   |   |                        |
|     included the following       |   |   |   |                        |
|     attributes:                  |   |   |   |                        |
|                                  |   |   |   |                        |
|     1.  objectivity (free from   |   |   |   |                        |
|         bias)?                   |   |   |   |                        |
|                                  |   |   |   |                        |
|     2.  measurability?           |   |   |   |                        |
|         (reasonably consistent   |   |   |   |                        |
|         measurements,            |   |   |   |                        |
|         qualitative or           |   |   |   |                        |
|         quantitative, of the     |   |   |   |                        |
|         subject matter)          |   |   |   |                        |
|                                  |   |   |   |                        |
|     3.  completeness? (includes  |   |   |   |                        |
|         all relevant factors     |   |   |   |                        |
|         that would alter a       |   |   |   |                        |
|         conclusion, if omitted)  |   |   |   |                        |
|         and                      |   |   |   |                        |
|                                  |   |   |   |                        |
| > 4\. relevance? (has a specific |   |   |   |                        |
| > relation to the subject        |   |   |   |                        |
| > matter)                        |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| b.  The criteria was available   |   |   |   |                        |
|     to users of the reports in   |   |   |   |                        |
|     one of the following ways:   |   |   |   |                        |
|                                  |   |   |   |                        |
|     1.  publicly?                |   |   |   |                        |
|                                  |   |   |   |                        |
|     2.  the auditor's report?    |   |   |   |                        |
|                                  |   |   |   |                        |
|     3.  presentation of the      |   |   |   |                        |
|         subject matter or        |   |   |   |                        |
|         assertion to the users?  |   |   |   |                        |
|                                  |   |   |   |                        |
|     4.  generally understood by  |   |   |   |                        |
|         most users? or           |   |   |   |                        |
|                                  |   |   |   |                        |
|     5.  limited to specific      |   |   |   |                        |
|         parties?                 |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **5. ENGAGEMENT PLANNING**       |   |   |   |                        |
| **(GAGAS 6.04-6.16)**            |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 5.1 If adequate as prescribed,   |   |   |   |                        |
| were the OIG's policies and      |   |   |   |                        |
| procedures over engagement       |   |   |   |                        |
| planning followed?               |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 5.2 If inadequate as prescribed, |   |   |   |                        |
| was there evidence that the      |   |   |   |                        |
| following were considered in the |   |   |   |                        |
| planning phase? (AT 101.45)      |   |   |   |                        |
|                                  |   |   |   |                        |
| a\. criteria to be used,         |   |   |   |                        |
|                                  |   |   |   |                        |
| > b\. preliminary judgments      |   |   |   |                        |
| > about attestation risk and     |   |   |   |                        |
| > materiality for attest         |   |   |   |                        |
| > purposes,                      |   |   |   |                        |
| >                                |   |   |   |                        |
| > c\. the nature of the subject  |   |   |   |                        |
| > matter or the items within the |   |   |   |                        |
| > assertion that are likely to   |   |   |   |                        |
| > require revision or            |   |   |   |                        |
| > adjustment,                    |   |   |   |                        |
| >                                |   |   |   |                        |
| > d\. conditions that may        |   |   |   |                        |
| > require extension or           |   |   |   |                        |
| > modification of attest         |   |   |   |                        |
| > procedures, and                |   |   |   |                        |
|                                  |   |   |   |                        |
| e\. the nature of the report     |   |   |   |                        |
| expected to be issued.           |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 5.3 Did the auditor communicate  |   |   |   |                        |
| to the officials of the audited  |   |   |   |                        |
| entity and individuals           |   |   |   |                        |
| contracting for or requesting    |   |   |   |                        |
| the services, information        |   |   |   |                        |
| regarding the nature, timing,    |   |   |   |                        |
| and extent of testing and        |   |   |   |                        |
| reporting including the level of |   |   |   |                        |
| assurance provided, any          |   |   |   |                        |
| potential restriction of reports |   |   |   |                        |
| associated with the different    |   |   |   |                        |
| levels of assurance services,    |   |   |   |                        |
| and the auditor's and            |   |   |   |                        |
| management's responsibilities?   |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 4.  Was the communication        |   |   |   |                        |
|     incorporated into the audit  |   |   |   |                        |
|     documentation?               |   |   |   |                        |
|                                  |   |   |   |                        |
| 5.  Does the documentation show  |   |   |   |                        |
|     how the auditor considered   |   |   |   |                        |
|     the results of previous      |   |   |   |                        |
|     audits and attestation       |   |   |   |                        |
|     engagements and follow up on |   |   |   |                        |
|     known significant findings   |   |   |   |                        |
|     and recommendations that     |   |   |   |                        |
|     directly relate to the       |   |   |   |                        |
|     subject matter or the        |   |   |   |                        |
|     assertion of the attestation |   |   |   |                        |
|     engagement?                  |   |   |   |                        |
|                                  |   |   |   |                        |
| 6.  Is the engagement an         |   |   |   |                        |
|     examination-level            |   |   |   |                        |
|     attestation? (if no, skip    |   |   |   |                        |
|     steps 5.7- 5.8)              |   |   |   |                        |
|                                  |   |   |   |                        |
| 7.  Does the documentation for   |   |   |   |                        |
|     the examination-level        |   |   |   |                        |
|     attestation show that the    |   |   |   |                        |
|     auditors obtained a          |   |   |   |                        |
|     sufficient understanding of  |   |   |   |                        |
|     internal control material to |   |   |   |                        |
|     the subject matter or        |   |   |   |                        |
|     assertion to plan the        |   |   |   |                        |
|     engagement and design        |   |   |   |                        |
|     procedures to achieve the    |   |   |   |                        |
|     objectives of the            |   |   |   |                        |
|     engagement?                  |   |   |   |                        |
|                                  |   |   |   |                        |
| 8.  Does the documentation for   |   |   |   |                        |
|     the examination-level        |   |   |   |                        |
|     attestation show how the     |   |   |   |                        |
|     engagement was designed to   |   |   |   |                        |
|     provide reasonable assurance |   |   |   |                        |
|     of detecting fraud, illegal  |   |   |   |                        |
|     acts, or violations of       |   |   |   |                        |
|     provisions of contracts or   |   |   |   |                        |
|     grant agreements that could  |   |   |   |                        |
|     have a material effect on    |   |   |   |                        |
|     the subject matter or        |   |   |   |                        |
|     assertion of the engagement  |   |   |   |                        |
|     or situations or             |   |   |   |                        |
|     transactions that could      |   |   |   |                        |
|     indicate abuse?              |   |   |   |                        |
|                                  |   |   |   |                        |
| 9.  Is the engagement a          |   |   |   |                        |
|     review-level or              |   |   |   |                        |
|     agreed-upon-procedures       |   |   |   |                        |
|     attestation? If so, does the |   |   |   |                        |
|     documentation show how the   |   |   |   |                        |
|     engagement was designed to   |   |   |   |                        |
|     be alert to situations or    |   |   |   |                        |
|     transactions that could be   |   |   |   |                        |
|     indicative of fraud, illegal |   |   |   |                        |
|     acts, violations of          |   |   |   |                        |
|     provisions of contracts or   |   |   |   |                        |
|     grant agreements that could  |   |   |   |                        |
|     materially affect the        |   |   |   |                        |
|     subject matter or assertion  |   |   |   |                        |
|     and what procedures were     |   |   |   |                        |
|     used to determine the effect |   |   |   |                        |
|     those conditions had on the  |   |   |   |                        |
|     subject matter or assertion? |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+

+----------------------------------+---+---+---+------------------------+
| **6. SUPERVISION** **(GAGAS      |   |   |   |                        |
| 6.24e)**                         |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 1.  If the OIG's policies and    |   |   |   |                        |
|     procedures were adequate as  |   |   |   |                        |
|     prescribed, were they        |   |   |   |                        |
|     followed?                    |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 6.2 If the policies and          |   |   |   |                        |
| procedures were inadequate as    |   |   |   |                        |
| prescribed, inquire of           |   |   |   |                        |
| management how it defines and    |   |   |   |                        |
| ensures "proper supervision,"    |   |   |   |                        |
| assess this assertion for        |   |   |   |                        |
| adequacy in fulfilling the       |   |   |   |                        |
| standard, and test accordingly.  |   |   |   |                        |
| As supervision represents a      |   |   |   |                        |
| primary characteristic of the    |   |   |   |                        |
| overall quality control system,  |   |   |   |                        |
| evaluate the level of assurance  |   |   |   |                        |
| afforded. If weak, did anything  |   |   |   |                        |
| come to your attention that the  |   |   |   |                        |
| supervision performed was        |   |   |   |                        |
| inadequate? Was there evidence   |   |   |   |                        |
| that:                            |   |   |   |                        |
|                                  |   |   |   |                        |
| > a\. Supervisory instruction    |   |   |   |                        |
| > provided to the staff was      |   |   |   |                        |
| > adequate and timely?           |   |   |   |                        |
|                                  |   |   |   |                        |
| b\. The supervisor adequately    |   |   |   |                        |
| documented reviews of audit work |   |   |   |                        |
| and timely provided review       |   |   |   |                        |
| comments?                        |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| > c\. Comments were adequately   |   |   |   |                        |
| > addressed by the auditor and   |   |   |   |                        |
| > cleared in a timely manner by  |   |   |   |                        |
| > the supervisor?                |   |   |   |                        |
| >                                |   |   |   |                        |
| > d\. The engagement was         |   |   |   |                        |
| > performed and the report was   |   |   |   |                        |
| > issued timely?                 |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **7. EVIDENCE AND                |   |   |   |                        |
| DOCUMENTATION** **(GAGAS         |   |   |   |                        |
| 6.22-6.26)**                     |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 7.1 If the OIG's policies and    |   |   |   |                        |
| procedures were adequate as      |   |   |   |                        |
| prescribed, were they followed?  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 7.2 If the policies and          |   |   |   |                        |
| procedures were inadequate as    |   |   |   |                        |
| prescribed, was there evidence   |   |   |   |                        |
| that the auditor obtained:       |   |   |   |                        |
|                                  |   |   |   |                        |
| > a\. Sufficient evidence to     |   |   |   |                        |
| > support the conclusions        |   |   |   |                        |
| > (reviews), opinions            |   |   |   |                        |
| > (examinations), or findings    |   |   |   |                        |
| > (agreed upon procedures)       |   |   |   |                        |
| > expressed in the report?       |   |   |   |                        |
|                                  |   |   |   |                        |
| c.  Written representation about |   |   |   |                        |
|     the validity of evidence     |   |   |   |                        |
|     obtained from officials of   |   |   |   |                        |
|     the audited entity?          |   |   |   |                        |
|                                  |   |   |   |                        |
| 7.3 Does the attestation         |   |   |   |                        |
| documentation contain:           |   |   |   |                        |
|                                  |   |   |   |                        |
| > a\. Attestation objectives,    |   |   |   |                        |
| > scope and methodology,         |   |   |   |                        |
| > including any sampling         |   |   |   |                        |
| > criteria used?                 |   |   |   |                        |
| >                                |   |   |   |                        |
| > b\. If applicable, the         |   |   |   |                        |
| > auditor's determination that   |   |   |   |                        |
| > certain government auditing    |   |   |   |                        |
| > standards do not apply or      |   |   |   |                        |
| > standards were not followed,   |   |   |   |                        |
| > the reasons therefore, and the |   |   |   |                        |
| > known effect not following     |   |   |   |                        |
| > standards had or could have    |   |   |   |                        |
| > had on the engagement?         |   |   |   |                        |
| >                                |   |   |   |                        |
| > c\. Evidence of the work       |   |   |   |                        |
| > performed to support           |   |   |   |                        |
| > significant judgments and      |   |   |   |                        |
| > conclusions, including         |   |   |   |                        |
| > descriptions of transactions   |   |   |   |                        |
| > and records examined?          |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 4.  If data from computer-based  |   |   |   |                        |
|     systems were significant to  |   |   |   |                        |
|     the engagement objectives,   |   |   |   |                        |
|     and the auditors were not    |   |   |   |                        |
|     relying on internal control  |   |   |   |                        |
|     effectiveness does the       |   |   |   |                        |
|     attestation documentation    |   |   |   |                        |
|     address the following:       |   |   |   |                        |
|                                  |   |   |   |                        |
| ```{=html}                       |   |   |   |                        |
| <!-- -->                         |   |   |   |                        |
| ```                              |   |   |   |                        |
| a.  The rationale for            |   |   |   |                        |
|     determining the nature,      |   |   |   |                        |
|     timing, and extent of        |   |   |   |                        |
|     planned attest procedures,   |   |   |   |                        |
|                                  |   |   |   |                        |
| b.  The kinds and competence of  |   |   |   |                        |
|     available evidential matter  |   |   |   |                        |
|     produced outside the         |   |   |   |                        |
|     computerized information     |   |   |   |                        |
|     system, and/or plans for     |   |   |   |                        |
|     direct testing of data       |   |   |   |                        |
|     produced from a computerized |   |   |   |                        |
|     information system, and      |   |   |   |                        |
|                                  |   |   |   |                        |
| c.  The effect on the engagement |   |   |   |                        |
|     report if evidential matter  |   |   |   |                        |
|     to be gathered does not      |   |   |   |                        |
|     provide a reasonable basis   |   |   |   |                        |
|     for achieving the objectives |   |   |   |                        |
|     of the engagements.          |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  | # |   |   |                        |
|                                  | # |   |   |                        |
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **8. REPORTS ON ATTESTATION      | # |   |   |                        |
| ENGAGEMENTS** **(GAGAS           | # |   |   |                        |
| 6.27,6.32-6.45)**                |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.1 If the OIG's policies and    | # |   |   |                        |
| procedures were adequate as      | # |   |   |                        |
| prescribed, were they followed?  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.2 If the OIG's policies and    |   |   |   |                        |
| procedures were inadequate as    |   |   |   |                        |
| prescribed, did the report       |   |   |   |                        |
| provide the following:           |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 2.                               |   |   |   |                        |
|                                  |   |   |   |                        |
| 3.                               |   |   |   |                        |
|                                  |   |   |   |                        |
| 4.                               |   |   |   |                        |
|                                  |   |   |   |                        |
| 5.  a\. Identification of the    |   |   |   |                        |
|     subject matter or the        |   |   |   |                        |
|     assertion being reported on, |   |   |   |                        |
|     a description of the nature  |   |   |   |                        |
|     and scope of the work        |   |   |   |                        |
|     performed and a reference to |   |   |   |                        |
|     the standards governing the  |   |   |   |                        |
|     engagement?                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| > b\. The auditor's conclusions  |   |   |   |                        |
| > about the subject matter or    |   |   |   |                        |
| > the assertion in relation to   |   |   |   |                        |
| > the criteria against which the |   |   |   |                        |
| > subject matter was evaluated?  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| > c\. All of the auditor's       |   |   |   |                        |
| > significant reservations about |   |   |   |                        |
| > the engagement, the subject    |   |   |   |                        |
| > matter, and, if applicable,    |   |   |   |                        |
| > the assertion?                 |   |   |   |                        |
| >                                |   |   |   |                        |
| > d\. Proper restrictions on the |   |   |   |                        |
| > report's distribution, if      |   |   |   |                        |
| > applicable?                    |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| > e\. Deficiencies in internal   |   |   |   |                        |
| > control, fraud, illegal acts,  |   |   |   |                        |
| > violations of provisions of    |   |   |   |                        |
| > contracts or grant agreements, |   |   |   |                        |
| > and abuse?                     |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| > f\. Views of responsible       |   |   |   |                        |
| > officials on the findings and  |   |   |   |                        |
| > recommendations and any        |   |   |   |                        |
| > rebuttal, as needed?           |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| > g\. Meet timeliness            |   |   |   |                        |
| > requirements?                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.3 Do the findings presented in |   |   |   |                        |
| the attestation report contain   |   |   |   |                        |
| criteria, condition, cause,      |   |   |   |                        |
| effect and recommendations, when |   |   |   |                        |
| applicable?                      |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.4 Did the auditor properly     |   |   |   |                        |
| document the communication of    |   |   |   |                        |
| findings that were clearly       |   |   |   |                        |
| inconsequential to management    |   |   |   |                        |
| verbally or in a management      |   |   |   |                        |
| letter?                          |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.5 Did the report refer to the  |   |   |   |                        |
| communication of the             |   |   |   |                        |
| inconsequential conditions?      |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.6 Did the auditor properly     |   |   |   |                        |
| delete certain privileged and    |   |   |   |                        |
| confidential information from    |   |   |   |                        |
| report disclosure?               |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.7 Did the report on the        |   |   |   |                        |
| attestation engagement state the |   |   |   |                        |
| nature of information omitted    |   |   |   |                        |
| and the requirement that made    |   |   |   |                        |
| the omission necessary?          |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 8.8 Was the report submitted to  |   |   |   |                        |
| the appropriate officials of the |   |   |   |                        |
| audited entity and to the        |   |   |   |                        |
| appropriate officials of the     |   |   |   |                        |
| organizations requiring or       |   |   |   |                        |
| arranging for the engagement,    |   |   |   |                        |
| including external funding       |   |   |   |                        |
| organizations such as            |   |   |   |                        |
| legislative bodies, unless       |   |   |   |                        |
| legally restricted?              |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| **9.** **NONAUDIT SERVICES**     |   |   |   |                        |
| **(Applicable if nonaudit        |   |   |   |                        |
| services were performed that     |   |   |   |                        |
| were related to the audit        |   |   |   |                        |
| examined)** **(GAGAS 2.14-2.16,  |   |   |   |                        |
| 3.10-3.18)**                     |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 9.1 If adequate as prescribed,   |   |   |   |                        |
| were the agency's policies and   |   |   |   |                        |
| procedures followed? (Obtain any |   |   |   |                        |
| documentation necessary to       |   |   |   |                        |
| support this information.) Was   |   |   |   |                        |
| the information provided by      |   |   |   |                        |
| management sufficient to ensure  |   |   |   |                        |
| that the standards were met?     |   |   |   |                        |
|                                  |   |   |   |                        |
| 2.  If inadequate as prescribed, |   |   |   |                        |
|     inquire of management how it |   |   |   |                        |
|     met GAGAS and assess how the |   |   |   |                        |
|     agency ensured compliance    |   |   |   |                        |
|     with independence standards. |   |   |   |                        |
|     At a minimum, determine if   |   |   |   |                        |
|     the following safeguards     |   |   |   |                        |
|     were followed?               |   |   |   |                        |
|                                  |   |   |   |                        |
| ```{=html}                       |   |   |   |                        |
| <!-- -->                         |   |   |   |                        |
| ```                              |   |   |   |                        |
| a.  Was the consideration        |   |   |   |                        |
|     documented that the services |   |   |   |                        |
|     to be rendered did not       |   |   |   |                        |
|     involve performing           |   |   |   |                        |
|     management functions or      |   |   |   |                        |
|     making management decisions? |   |   |   |                        |
|                                  |   |   |   |                        |
| b.  Was the consideration        |   |   |   |                        |
|     documented that the services |   |   |   |                        |
|     to be performed did not      |   |   |   |                        |
|     encompass auditing the OIG's |   |   |   |                        |
|     own work or was              |   |   |   |                        |
|     significantly material to    |   |   |   |                        |
|     the subject matter of        |   |   |   |                        |
|     audits?                      |   |   |   |                        |
|                                  |   |   |   |                        |
| c.  Was the understanding with   |   |   |   |                        |
|     the audited entity           |   |   |   |                        |
|     established and documented   |   |   |   |                        |
|     regarding the objectives,    |   |   |   |                        |
|     scope of work, product or    |   |   |   |                        |
|     deliverables, and that       |   |   |   |                        |
|     management was responsible   |   |   |   |                        |
|     for the substantive outcomes |   |   |   |                        |
|     of the work?                 |   |   |   |                        |
|                                  |   |   |   |                        |
| d.  Did the audited entity:      |   |   |   |                        |
|                                  |   |   |   |                        |
| > 1\. Designate a management     |   |   |   |                        |
| > level individual to be         |   |   |   |                        |
| > responsible and accountable    |   |   |   |                        |
| > for overseeing the nonaudit    |   |   |   |                        |
| > services?                      |   |   |   |                        |
| >                                |   |   |   |                        |
| > 2\. Establish and monitor the  |   |   |   |                        |
| > performance of the nonaudit    |   |   |   |                        |
| > services to ensure it met      |   |   |   |                        |
| > management's objective?        |   |   |   |                        |
| >                                |   |   |   |                        |
| > 3\. Make decisions that        |   |   |   |                        |
| > involved management functions  |   |   |   |                        |
| > related to the nonaudit        |   |   |   |                        |
| > service and accept full        |   |   |   |                        |
| > responsibility for such        |   |   |   |                        |
| > decisions?                     |   |   |   |                        |
| >                                |   |   |   |                        |
| > 4\. Evaluate the adequacy of   |   |   |   |                        |
| > the services performed and any |   |   |   |                        |
| > findings that resulted?        |   |   |   |                        |
|                                  |   |   |   |                        |
| e.  Did the OIG preclude         |   |   |   |                        |
|     personnel that provided      |   |   |   |                        |
|     nonaudit services from       |   |   |   |                        |
|     planning, conducting, or     |   |   |   |                        |
|     reviewing audit work of the  |   |   |   |                        |
|     subject matter involving the |   |   |   |                        |
|     nonaudit service under the   |   |   |   |                        |
|     overreaching principle that  |   |   |   |                        |
|     auditors cannot audit their  |   |   |   |                        |
|     own work?                    |   |   |   |                        |
|                                  |   |   |   |                        |
| f.  Was the scope and extent of  |   |   |   |                        |
|     the audit work unaffected as |   |   |   |                        |
|     if no nonaudit service had   |   |   |   |                        |
|     been performed?              |   |   |   |                        |
|                                  |   |   |   |                        |
| > g\. Were the audit             |   |   |   |                        |
| > organization's independence    |   |   |   |                        |
| > requirements communicated in   |   |   |   |                        |
| > writing to the audited entity? |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
|                                  |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+
| 10\. QUALITY CONTROL PROCESS FOR |   |   |   |                        |
| EACH ENGAGEMENT (GAGAS           |   |   |   |                        |
| 3.49-3.56)                       |   |   |   |                        |
|                                  |   |   |   |                        |
| 1.  If adequate as prescribed,   |   |   |   |                        |
|     were the agency's policies   |   |   |   |                        |
|     and procedures followed?     |   |   |   |                        |
|                                  |   |   |   |                        |
| 2.                               |   |   |   |                        |
|                                  |   |   |   |                        |
| 3.  10.2 If inadequate as        |   |   |   |                        |
|     prescribed, inquire of       |   |   |   |                        |
|     management what job-specific |   |   |   |                        |
|     quality control process is   |   |   |   |                        |
|     employed (such as            |   |   |   |                        |
|     independent referencing).    |   |   |   |                        |
|                                  |   |   |   |                        |
| ```{=html}                       |   |   |   |                        |
| <!-- -->                         |   |   |   |                        |
| ```                              |   |   |   |                        |
| a.                               |   |   |   |                        |
| b.                               |   |   |   |                        |
|                                  |   |   |   |                        |
| a\. Assess the job-specific      |   |   |   |                        |
| quality control process for      |   |   |   |                        |
| adequacy, and test accordingly.  |   |   |   |                        |
|                                  |   |   |   |                        |
| > b\. As this represents a       |   |   |   |                        |
| > primary characteristic of the  |   |   |   |                        |
| > overall quality control        |   |   |   |                        |
| > system, evaluate the level of  |   |   |   |                        |
| > assurance afforded.            |   |   |   |                        |
+----------------------------------+---+---+---+------------------------+

  -----------------------------------------------------------------------
  **END OF CHECKLIST**

  -----------------------------------------------------------------------