accounting and financial management conference may 13, 2008 audits of federal and state programs ann marie anderson, cp

1. 1  Accounting and Financial Management Conference May 13, 2008 Audits of Federal and State Programs Ann Marie Anderson, CPA WI Department of Health and Family Services

2. 2

3. 3 Topics for today Why are audits needed? Audit standards Our review of audit reports SOX creep Common problems – three views

4. 4 Why are audits needed? It’s the law - Federal Single Audit Act Amendments of 1996 as implemented by OMB Circular A-133 Agency is nonprofit or government that expended $500,000 or more in federal awards, i.e. grants, not purchases (more on this later) State of WI; all Counties, Tribes & VTAE’s; many cities, school districts, & nonprofits Waiver of audit is not possible When Federal audit law does not apply, purchaser has substantial flexibility in determining audit requirement to meet purchaser's needs

5. 5 Why are audits needed? It’s the law - Wisconsin Statute 46.036: “Unless waived by the department, biennially, or annually if required under federal law, provide the purchaser with a certified financial and compliance audit report if care and services purchased exceed $25,000. The audit shall follow standards that the department prescribes.” Applies to about 550 agencies contracting with DHFS and several thousand contracting with counties. DWD and DOC have similar statute from the time when their programs were part of DHFS; new DCF ?? The dept’s standards are in the State Single Audit Guidelines and Provider Agency Audit Guide

6. 6 Why are audits needed? It’s a condition of license Audit is a condition of license for group homes and residential care centers that provide residential care for kids It’s a condition of contract Contract might require audit even if federal or state law and regulations do not It’s good business practice

7. 7 Generally Accepted Auditing Standards (GAAS) Applies to all audits Auditee prepares financial statements and notes thereto Auditor issues opinion on the financial statements Auditor must be Certified Public Accountant

8. 8 Government Auditing Standards (GAS) (aka generally accepted government auditing standards/gagas or “yellow book”)  Applies to all audits involving federal funds; DHFS extends to all audits involving funds from DHFS Auditor issues opinion on internal controls and compliance based on financial statement audit Auditor must have peer review & continuing professional education with government focus

9. 9 Single Audit Act implemented through OMB Circular A-133 Applies if agency is nonprofit or local gov’t and if it expended $500K or more in federal awards/grants Auditee prepares Schedule of Federal Awards Schedule of Status of Prior Year Findings Corrective Action Plan Auditor prepares Report on internal controls and compliance at program level Schedule of findings and questioned costs

10. 10 Single Audit Act implemented through OMB Circular A-133 OMB’s A-133 Compliance Supplement has guidance for auditors for testing federal programs – can also use to self-test (http://www.whitehouse.gov/omb/circulars/ ) Part 2 – Matrix of Compliance Requirements – a chart crosswalking federal programs to the compliance requirements to be tested in an audit of the program Part 3 – Compliance Requirements – the audit requirements in general terms (113 pages) Part 4 – Agency Program Requirements – additional guidance for specific programs (DHHS section alone is 216 pages)

11. 11 DHFS audit standards State Single Audit Guidelines DHFS uses SSAG for A-133 audits of local governments (Counties, Tribes) Other Depts use SSAG for all A-133 audits Provider Agency Audit Guide DHFS uses PAAG for non-profits, for-profits, and small gov’ts that don’t need A-133 audits DWD and DOC also use the PAAG

12. 12 State Single Audit Guidelines Coordinated by the Department of Administration Started with original federal Single Audit Act of 1984 and OMB Circular A-128 Main document plus department appendices (DHFS, DWD, DOA, DOT, etc.) All documents are on the web at www.ssag.state.wi.us

13. 13 SSAG - Main document Defines roles and responsibilities of auditee, auditor, granting agency, state cognizant agency and the Department of Administration Extends federal single audit concept to state funded programs Auditor assess overall agency risk Auditor assess risk for individual programs to decide what to test Granting agency can designate specific programs to be tested Identifies elements of audit reporting package

14. 14 SSAG - DHFS appendix General requirements Auditor uses results of testing for general requirements to feed into risk assessment for determining which specific DHFS programs need to be tested in the audit Three declared major programs that always need to be tested Several declared Type A programs that always need risk assessment & tested if not low risk Guidance for several other programs

15. 15 Our review of audit reports At intake, screen for issues in schedule of findings and questioned costs If significant issues in initial screening or history of problems, assign for review immediately, otherwise review on first in first out basis Desk review to answer three essential questions: Does report reference applicable standards? Does the report show issues affecting government programs? If yes, does agency have adequate corrective action plan?

16. 16 Our review of audit reports If DHFS has cognizant agency responsibility (counties, tribes), notify other departments of findings related to their programs Send findings related to specific programs from our department to respective program staff Send findings related to purchase of services, segregation of duties, and certain other cross-cutting affecting the State/County Contract to Area Administrator Resolve findings related to general agency operations

17. 17 Our review of audit reports Options for addressing findings: Do nothing, i.e. issue is inconsequential Require agency to repay funds Accept agency’s corrective action plan Require a more detailed corrective action plan Withhold money to encourage corrective action Increase monitoring, including going onsite Require additional reporting Provide technical assistance Look at our own business functions, contract language, program instructions, etc.

18. 18 Was auditor qualified to perform the audit? Must be Certified Public Accountant License can be checked on the Dept of Regulation and Licensing's website (drl.wi.gov) Reciprocity agreement with other states Must have peer review within three years of doing first audit and every three years after that Auditors must provide copy of the peer review report upon request; we do request this of all firms that do audits of agencies receiving DHFS funds

19. 19 SOX creep  Enron, WorldCom, and other high profile corporate failures in 2001 led to the … Sarbanes-Oxley Act of 2002 (“SOX”), which created the … Public Company Accounting Oversight Board (PCAOB), which developed new definitions for internal control issues: Significant deficiency - more than a remote likelihood that a misstatement of the entity’s financial statements that is more than inconsequential will not be prevented or detected. Broader than previous “reportable condition.” Material weakness - more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected. Broader than previous “material weakness.”

20. 20 SOX creep American Institute of Certified Public Accountants (AICPA) issued Statement on Auditing Standards (SAS) 112 Effective for periods ending on or after 12/15/06. SAS’s convey the “auditing standards generally accepted in the United States” that apply to all audits, including those of governments and nonprofits. New SAS adopts PCAOB’s definitions for internal control deficiencies, so that what was applicable just to publicly traded companies is now applicable to all agencies that have audits. Requires auditors to communicate significant internal control issues in writing (this is a longstanding requirement for gov’t audits under GAS – slide 8)

21. 21 SOX creep SAS 112 identifies the following conditions as at least a significant deficiency: Deficiencies in controls over selection/application of accounting principles Deficiencies in antifraud policies and controls Deficiencies in controls over nonroutine and nonsystematic transactions Deficiencies in controls over year-end financial reporting process

22. 22 SOX creep SAS 112 identifies the following conditions as at least a significant deficiency and a strong indicator of a material weakness: Ineffective oversight of the financial reporting and internal control by those charged with governance Restatement of previously issued financial statements to reflect correction of a material misstatement Identification of misstatements that were not initially detected by the agency’s internal control system

23. 23 SOX creep SAS 112, cont’d Ineffective internal audit or risk assessment function in large or highly complex agencies Identification of fraud of any magnitude on the part of senior management Failure to correct a previous significant deficiency Ineffective internal control environment

24. 24 SOX creep Revisions to Government Auditing Standards Incorporate SAS 112 terminology Expand audit procedures beyond what’s needed for SAS 112 Revisions to A-133 Incorporate SAS 112 terminology Still to come – Incorporate changes to audit procedures coming from SAS 112 and Government Auditing Standards Incorporate recommendations of PCIE single audit study (slide 32)

25. 25 SOX creep What to expect for 2006 audits and beyond Audit reports will have more significant deficiencies and material weaknesses More significant internal control findings (and other changes to audit standards) will result in auditors needing to do more audit testing in other areas More audit testing leads to more audit cost Significant deficiencies or material weaknesses due to lack of financial expertise leading some agencies to hire additional qualified staff or contract for financial accounting services

26. 26 Common problems Three views: Common root causes of problems for both auditees and auditors Programs most likely to have findings Quality of audit work

27. 27 Root causes #1 Failure to read the contract Alternatively #1 Failure to realize that we actually meant that the agency would comply with those contract provisions

28. 28 Root causes #2 Failure to apply right audit standards I don’t have to do a fraud risk assessment in my audits. I know none of my clients have fraud. Your insisting on a peer review makes it too hard for small firms to do these audits. I tried using your family care audit guide for the family support program, and it’s completely useless.

29. 29 Root causes #3 Failure to understand allowable costs Fair market rent is fair. Reasonable salary for this person is salary of CEO + salary of COO + salary of CFO. We allocated costs based on the budget.

30. 30 Frequent findings Findings in County audits are usually for a program from DHFS: Department 2004 2005 DHFS 100+ 117+ DATCP 2 3 Commerce 1 3 DNR 1 4 DOA 2 1 DOC -- 1 DOJ -- 1 DOR -- 2 DOT 2 19 DWD 9 8

31. 31 Frequent findings Several DHFS program or requirements account for majority of findings in County audits: DHFS Appendix Section 2004 2005 2.1 Reporting costs 11 10 2.4 Purchase of care 32 25 2.8 Client rights/funds 10 10 3.1/3.5 COP, CIPII/COPW 18 16 3.2 CIP I 8 33 Segregation of duties 18 17 (New Section 2.5 in 2006 revision)

32. 32 Auditor quality issues PCIE study on quality of single audits from 2002-2003 time span 48% of audits covering 93% of federal funding in the sample were acceptable and can be relied on 16% covering 2% of funding had limited reliability 35% covering 5% of funding were unacceptable and cannot be relied on Single audits of large federal amounts more reliable than other single audits (“large” defined as federal expenditures of $50M or more. For perspective in 2005, St of WI expended $9.2B in federal funds, Milwaukee Co - $461M, Dane Co - $81M.)

33. 33 Auditor quality issues Serious, common deficiencies: Not documenting understanding of internal controls over compliance requirements Not documenting testing of internal controls of at least some compliance requirements Not documenting compliance testing of at least some compliance requirements Missing or having inadequate audit program Incorrectly reporting testing of major programs Not reporting audit findings

34. 34 Auditor quality issues Study’s recommendations Revise and improve single audit standards, criteria and guidance, in addition to changes for SOX & GAS Establish minimum requirements on training on performing single audits as prerequisite for doing this work and CPE thereafter Review and enhance process to address unacceptable single audits – suspension and debarment, sanctions, and fines of auditors Source: Report on National Single Audit Sampling Project, June 2007

35. 35 How to contact us Ann Marie Anderson, CPA Division of Enterprise Services Department of Health and Family Services 1 West Wilson Street, Room 627 P.O. Box 7850 Madison, WI 53707-7850 Tel: 608-267-2836 Email: anderam@dhfs.state.wi.us www.dhfs.state.wi.us/grants