Single audits: Using Compliance Supplements for success

The massive influx of federal relief funding in response to the COVID-19 pandemic has created many audit challenges. There are new programs subject to single audits, along with existing programs receiving new funding, and new and revised compliance requirements. Understanding how to use the Compliance Supplement is more important than ever for auditors responsible for single audits.

A session at the AICPA & CIMA Governmental Accounting & Auditing Online Update, scheduled Aug. 16–17, will discuss requirements of the soon-to-be-released 2021 Compliance Supplement along with certain continuing challenges introduced in the 2020 Compliance Supplement and subsequent Addendum. The session will be co-led by Kim McCormick, CPA, audit partner at Grant Thornton and chair of the AICPA Governmental Audit Quality Center (GAQC) Executive Committee; Lindsey Oakley, CPA, partner at BKD LLP; and Amanda Ward, CPA, partner at Plante Moran.

“Single audits are not the same as last year, and auditors must use the Compliance Supplement as a starting point to get it right,” McCormick said during a preconference telephone interview. “The devil is in the details, and there are a lot of details. There are new programs that didn’t exist last year and that don’t fit into existing models, new programs from last year we are still getting used to, and rules are changing midstream, so it’s a moving target to audit.”

A major challenge for auditors continues to be which guidance to apply and the timing of the Office of Management and Budget’s issuance of the Compliance Supplements and Addenda. Auditors need to be familiar with the requirements that apply to determine their audit scope, approach, and testing.

“The 2021 Compliance Supplement and Addenda will be applicable for audits of fiscal years ending on or after June 30, 2021. While we expect the 2021 Compliance Supplement to be issued this month, the Addenda is not expected until late fall. This may result in delayed single audits as auditors await compliance guidance necessary to complete major program testing,” Ward said. 

The timing of COVID-19 funding does not coincide with when the related regulations were developed, and keeping up with the changes has proved to be very challenging. New COVID-19 funding was signed into law at the end of December 2020 and again in March with the American Rescue Plan Act of 2021, P.L. 117-2, which allotted $1.9 trillion in aid. “The American Rescue Plan was the most significant amount of new money added to the system and includes new and existing programs that will be expended for the next three to five years,” Oakley said. “Some of the newly created programs are still under development, and the guidance may or may not be included in the 2021 Supplement.”

Like last year, auditors will again be waiting for additional OMB guidance to be issued in the second half of the calendar year.

Some guidance in the 2020 Supplement and Addendum is no longer applicable because money has been added to some relief programs and rules have changed.

For some programs, “agencies have changed what auditors are being asked to test in the 2021 Supplement, so auditors can’t rely on the 2020 Supplement or Addendum for their 2021 testing,” Oakley said.

“For new programs created out of the American Rescue Plan Act, there is really no audit guidance until the 2021 Addendum comes out, which will push out the ability to complete single audits,” Oakley added.

“Auditors should be transparent with their clients about the timing of what’s happening and set expectations, because this could be the second year in a row of a delay in the ability to complete single audits,” McCormick suggested.

All the session presenters recommend that auditors ask their clients a lot of questions this year about awards received and how the funds were used, to ensure completeness and accuracy. “There should be a lot of conversations, not just swapping paper back and forth, to understand the funding and uses,” Oakley said. Ward added, “And it may be necessary to talk to those outside of finance, including officers and boards of directors, because finance may not have been responsible for securing and administering COVID-19 funds in all organizations.”

Internal controls over compliance must be tested in single audits, and it is critical for auditors to understand how controls are designed and how they operated during the audit period. “For new programs, even for a longtime client, auditors should not assume controls are the same as for other major programs but need to take a step back and understand the new processes and new compliance requirements,” McCormick said. 

The pandemic and remote work create additional audit challenges relating to assessment of controls. “Because controls could have operated differently throughout the period under audit and based on how organizations chose to spend the funds, it’s important to gain an understanding of the program’s use of funds and how controls could differ based on different activities,” Ward said. Oakley added, “In addition, controls could have been lacking or bypassed, which could lead to findings and require more testing, and how the client has been monitoring programs remotely can create higher risk.”

An important part of audit planning is determining which programs are “major programs” as defined by the Uniform Guidance (see “Single Audit: Pandemic Aid and Major Program Determinations.”) “There is an OMB formula to apply, but this year federal agencies are designating more programs coming out of the pandemic funding as ‘higher risk,’ which is not a designation we see very often and could have a significant impact on the formula,” McCormick said. “The programs we thought we were going to audit this year may be different after considering the higher risk designations.”

“Because more programs are expected to be identified as higher risk by OMB, there will be a need for more documentation of the evaluation of Type A and Type B programs,” Ward said

Oakley said: “Very unusual scenarios are occurring now that can lead to errors. For example, the timing of when expenditures should be reported on the SEFA [Schedule of Expenditures of Federal Awards] is different for the Provider Relief Fund program and the Higher Education subprogram of the Educations Stabilization Fund than we have seen historically.”

Because of the increases in programs to be audited and changes in requirements, it is difficult for auditors to be experts in every one of the new programs. Oakley recommends that firms designate individuals to become subject matter experts in individual programs. Many firms are having to train staff auditors on performing single audits for the first time, and this is not an area that can be easily picked up.

“The Compliance Supplement is essential to single audits,” Ward said. “As auditors prepare for their upcoming single audits, Appendices V (List of Changes for the 2021 Compliance Supplement) and VII (Other Audit Advisories), in addition to Part 4, will be key for auditors to read and understand.”

The AICPA’s GAQC resources can be very helpful, including archived webcasts. “There have been many more GAQC alerts during the pandemic,” Ward said. “Auditors should pay attention to them and not skip over any of them, because new guidance is always coming out.” Oakley noted that the GAQC’s pandemic-related information is available to the public without having to be a member.

“Start the planning process early, ensuring that you allow for time to get up to speed,” Ward said. “This will be a year that you should not go at it alone. Be sure to leverage available resources, colleagues, firm experts, the GAQC, and federal agencies to name a few. There’s much more ambiguity that exists that may require significantly more interpretation during our compliance auditing procedures.”

— Maria L. Murphy, CPA, is a freelance writer based in North Carolina. To comment on this article or to submit an idea for another article, contact Ken Tysiac, the JofA’s editorial director, at Kenneth.Tysiac@aicpa-cima.com.