# Presentation: 160877

## Improving Single Audits to Protect Taxpayers

- Department of the Interior
- Office of Inspector General
- March 11, 2008

## Delegation within DOI

- Oversight

- Audit Resolution

**Notes:**
Four years ago our Office of Inspector General, Department of the Interior contracted with a Company to conduct an independent, objective review of our Single Audit Process and Oversight program.  This Company identified all of our processes, met with the Clearinghouse and OMB and other IG personnel.  The Single Audit unit consisted of two functions, audit resolution and oversight.  After a thorough review and examination, the Company thought that report processing should be done by Management (the Department) and oversight should be done by the IG.  Report processing basically consisted of the audit resolution process, receiving the reports, distribution of reports, and tracking to make sure the Bureaus were resolving the findings of the Independent Public Accountants in the Single Audit Reports.

## OIG Responsibilities

- Monitor audit work performed by nonfederal auditors on Federal programs.
- Desk Reviews
- Quality Control Reviews
- Notify auditor oversight bodies about substandard audit work.
- Provide single audit technical assistance to auditors, auditees, DOI bureaus, and other Federal agencies.

## More OIG Responsibilities

- Consider grantee requests for extensions for submission of their single audit reports.
- Draft OIG policy regarding single audits.
- Serve as OIG’s liaison to the single audit community.
- Single Audit Roundtable
- OMB A-133 Workgroups

**Notes:**
OMB A-133 Workgroups = Audit Policy Workgroup, Compliance Supplement Team, Single Audit Testing and Sampling, Single Audit Sanctioning Process

## Desk Reviews

- Based on the PCIE *Uniform Guide for Initial Review of A-133 Audit Reports.*

- Revised by Single Audit Team to incorporate updated standards and regulations, as well as financial review items.

**Notes:**
We perform desk reviews of reports we receive from the FAC.  The FAC has a priority listing of reports that are automatically made available, beginning with all cognizant reports and oversight reports with findings.  The FAC does not make oversight reports with no findings available without a request for a specific audit. 

Questions added (we created some, some came from Hugh’s instrument, some came from AICPA peer review checklists):
Single audit questions – late reporting, 2-year lookback, major program coverage
GASB 34 questions – created questions to address reporting units and opinion units, cash and investment disclosures (new GASB 40 requirements), deferred revenue, cash collateralization
NFP questions – functional classification of expenses

## Desk ReviewsWhat We Review

- Auditor’s reports
- Schedule of Expenditures of Federal Awards
- Schedule of Findings and Questioned Costs
- Data Collection Form
- Financial statements
- Notes to the financial statements

**Notes:**
Reports – IPA report, GAGAS report, major program report
More cursory review for the financial statements and notes to the financial statements

## Desk ReviewsWhat We Find – Auditor Errors

- Incorrect opinions
- Incorrect auditee risk assessment
- Incorrect threshold calculation
- Major program(s) omission
- Insufficient major program coverage
- Deficient findings
- Data Collection Form errors
- Inconsistencies through the reporting package

**Notes:**
Incorrect opinions – omitted major fund and omitted discrete component units should receive an adverse opinion
Incorrect risk assessment – most of these errors are due to auditee receiving qualified/adverse opinion on financial statements in prior year but still assessing auditee as low-risk.
Incorrect threshold – FAC can query the database to isolate threshold calculation errors, major program coverage errors, 2-year lookback errors.
2-year lookback – Type A program has to be major in current year or one of the prior two years.
Deficient findings – most common – missing program identification and effect.
FY2007 Statistics
Major program omissions (2-year lookback, insufficient coverage, incorrect clustering) – 6%
Incorrect risk assessments – 3%
Incorrect threshold – 5%
Deficient findings – 17%
DCF errors – 43%

## Desk ReviewsWhat We Find – Auditee Errors

- Late reporting
- Deficient SEFA
- Misidentification of Federal agency
- Insufficient pass-through information
- Omission of CFDA number or other identifying number
- Deficient corrective action plan
- No implementation date
- No contact name
- Financial statement deficiencies
- Omission of financial statement note disclosures

**Notes:**
FY2007 Statistics
Late reporting – 39%, 71% when we first started tracking in late spring of 04’
SEFA errors – 41%
CAP errors – 41%
Financial statement deficiencies – about 5%, material balances between statements, or footnotes and statements, grouping a major fund with Other Governmental Funds, instead of presenting separately
Note disclosure and MD&A omissions – 40%

Common financial statement deficiencies – major fund is grouped with nonmajor fund column; balances don’t tie from statement to statement.

Common note disclosure omissions – interfund balances and transfers; MD&A components.

## Risk Assessment

- Tiered risk system
- Align monitoring with risk score
- Objectivity
- Factors:
- Number and types of deficiencies noted in desk review
- Auditor experience

## Low Risk Audits

- “FYI” letter to auditor and/or auditee, noting deficiencies.
- Review the audit report with the same firm/partner on a biennial basis.

## Moderate Risk Audits

- Require response from auditor and/or auditee.
- May require reissuance of report and/or Data Collection Form.
- Potential quality control review.

## High Risk Audits

- Require response from auditor and/or auditee.
- May require reissuance of audit report and/or Data Collection Form.
- Potential quality control review.
- Referral to AICPA and State Board.

## Slide 13

## Quality Control Reviews

- Factors for selection
- Moderate risk or higher in risk analysis
- Location and timing
- Common auditor in many of our audits
- Inquiries from other agencies
- Investigative results
- IG request
- Professional judgment

**Notes:**
Location and timing – training sessions; limited budget
Inquiries – Education and GSA

## Quality Control ReviewWhat We Review

- Auditor proficiency
- Licensing
- Continuing professional education (CPE)
- Peer review
- Audit planning
- Selection of major programs
- Identification of compliance requirements
- Testwork
- Internal control
- Compliance

## Quality Control ReviewsWhat We Find

- Auditor proficiency
- Insufficient CPE
- Audit planning
- Misidentification of applicable compliance requirements
- Testwork
- Incomplete understanding of internal control
- Omitted compliance procedures

## Our Results

**Report re-issuances**

- FY2005 – 14 %
- FY2006 – 5 %
- FY2007 – 5 %

**Auditor referrals**

- FY2005 – 7 auditors
- FY2006 – 2 auditors
- FY2007 – 2 auditors
*Six of the 11 individuals referred had completed less than 10 single audits.*

**Notes:**
Overall, the quality of the reports we’ve received has improved.
Late filing has decreased from 70% to 39%.
Overall risk has decreased from 33% to 30%.