Are you not-for-profit clients ready for compliance auditing?

The hundreds of thousands of U.S. not-for-profit organizations that receive funding directly or indirectly from the federal government will soon undergo audits under the new Circular A-133, Audits of Institutions of Higher Education and Other Nonprofit Organizations, issued by the Other Nonprofit Management and Budget (OMB). The provisions parallel those set forth in OMB Circular A-128, Audits of State and Local Governments, but they're different in several important respects. (See exhibit 1 on page 73.)

Independent accountants who serve not-for-profit organizations should advise their clients of this recent pronouncement and prepare their own staffs to comply with its provisions. CPAs who are members of grantee and not-for-profit committees of state CPA societies should consider programs for educating practitioners and recipients and discuss with state officials the possibility of implementing A-133 for federal money passed through state sources to not-for-profit entities. Those who work for not-for-profits also should be aware of the requirements. The purpose of this article is to offer some practical guidance on A-133 to all these CPAs.

RECIPIENTS OF FEDERAL FUNDS 

OMB circular A-133 establishes audit requirements for institutions of higher education and other nonprofit institutions that receive federal funds. It also covers hospitals "affiliated with a university," but not unaffiliated hospitals. It defines federal responsibilities for implementing and monitoring these requirements. For-profit corporations generally aren't covered by the circular.

A circular A-133 audit is an organization-wide audit and not a grant-by-grant review. The CPA will be reporting on compliance and controls, as well as financial results, for the organization's fiscal year--not for the period of individual awards.

The federal award categories covered by A-133 include interest subsidies, insurance, direct loans and appropriations, loan guarantees, contracts, cooperative agreements and grants.

A point of interpretation may be helpful. OMB circular A-128 permits states to include universities as well as other separate units as part of a statewide audit conducted under that circular. If a public university is part of such a process, then A-128, rather than A-133, would govern its audit. The CPA conducting an audit of a state university should make sure which requirements he or she is to apply.

Some observers are concerned about the definition of a major program at an entity that doesn't have expenditures but does have federal interest subsidies or loan guarantees. In the Questions and Answers on A-128, OMB consistently has maintained that the size of the loans guaranteed or the insurance provided in a particular year should serve instead of expenditures as a criterion for selecting a major program.

The $25,000 threshold. Circular A-133 establishes different requirements for different sizes of organizations. If an entity receives less than $25,000 in federal assistance, it's not covered by A-133--but records should be available for federal representatives on request. If a not-for-profit receives more than $25,000 but less than $100,000, management can choose a comprehensive audit under A-133 or an audit of its individual awards. An entity receiving more than $100,000 in federal assistance must have an A-133 audit.

Effective date and frequency. A-133 appeared in its final form in the Federal Register in March 1990. It applies to audits of entities that receive federal financial assistance for their fiscal years beginning January 1, 1990, and thereafter. Early adoption is encouraged. Although the OMB prefers an A-133 audit to conducted annually, a biennial audit is allowed. Hence, for an organization with a June 30 yearend, the first A-133 audit could cover the two years ended June 30, 1992.

While an annual report costs more, its timeliness can be worthwhile. For example, consider student financial aid programs. The U.S. Department of Education changes its regulations frequently--often more than once a year. If an institution has missed a change, it could make incorrect awards to students for as long as three years before a biennial audit would uncover the problem. This lag can be damaging; exposure to disallowance often isn't key for any one year but mounts with retroactive corrections.

SUBRECIPIENTS

Previously, certain states and municipalities required not-for-profit organizations that provided services supported by federal funds but passed through the state or municipality to undergo an audit under circular A-128. Now, circular A-133 will apply to these organizations.

Circular A-133 directs prime recipients to do the following:

1. Assure that not-for-profit subrecipients receiving $25,000 or more comply with A-133.

2. Take corrective action on noncompliance within six months after it's reported in an A-133 audit.

3. Consider whether the results of subrecipient audits require the prime recipient to adjust its records.

4. Require subrecipients to permit auditors access to their records.

In cases in which the subgrantee receives more than $25,000 a year, A-133 requires the prime grantee's independent auditor to assess the system by which his client monitors audits at subgrantees. It's not necessary, or expected, however, for the auditor of the prime recipient to visit the subgrantee. Thus, the auditor will rely on work done by others at the subgrantees.

Unfortunately, other auditors' work at the subgrantees often isn't timely enough. Reports may be done on a fiscal year basis that doesn't coincide with that of the prime grantee and they may not be done for some time after the subgrantee's fiscal yearend.

In Massachusetts, for example, approximately 85% to 90% of labor retraining programs are given by subrecipients. Although these agencies generally contract for independent single audits, the audits aren't complete until after the statements of the not-for-profit organizations that administer the program have to be certified. To deal with this problem, it's possible to arrange for fiscal monitoring of the subgrantees by a CPA to supplement and follow up on the subrecipients' audit reports. The prime grantee's auditor participates in the annual planning process and reviews the CPA's work. This approach has been successful in providing the timely information needed to complete the audit of the prime grantee. (See exhibit 2 on page 75.)

OBJECTIVES OF COMPREHENSIVE AUDITS

The three questions that must be answered in a comprehensive A-133 audit are quite straightforward.

* Are the financial statements presented fairly under generally accepted accounting principles?

* Does the control structure provide reasonable assurance of compliance with federal regulations?

* Has the recipient complied with applicable laws and regulations?

COORDINATED AUDITS

To satisfy the second and third objectives, the CPA must expand his tests beyond those that would be conducted under generally accepted auditing standards. Circular A-133 contains a provision for a coordinated audit under which there would be a designated external reporting auditor for each audit objective. Each auditor would rely on the work of the others. In OMB's view, the coordinated audit would limit duplication of testing, particularly where there's a resident state or federal auditor who's performing compliance audits as a matter of course.

It will take some time before the coordinated audit works smoothly. The Department of Defense already has begun a pilot program at certain research universities. It stipulates that the university's external auditor is responsible for reporting on the financial statements and for the control structure and compliance as they apply to the financial statements; the resident state or federal auditor is responsible for reporting on controls and compliance related to the institution's major programs.

While coordination with federal agencies may be a new development, it needn't be threatening. For example, a few years ago, we audited the research and other federally sponsored programs of a major university. Our auditors worked side by side with representatives of the Department of Health and Human Services, the DOD and the internal auditors. All learned from one another. Our firm issued all of the reports, but that responsibility easily could have been split among us.

INTERNAL CONTROL STRUCTURE

AND COMPLIANCE

Under A-133, the auditor is required not only to assess control risk but also to test the internal control structure unless the system is clearly ineffective. In that case, he must report material weaknesses and other reportable conditions in his report. Previous to A-133, the auditor simply could obtain a preliminary understanding of the system. That option is no longer possible.

MAJOR PROGRAMS

Circular A-133 divides a recipient's federal awards into major programs, which are to be given extended treatment, and other programs. The major programs include R&D and student financial aid. Also included is any other program (an award or group of awards) for which federal expenditures exceeded either $100,000 for more than 3% of the recipient's total income from federal sources, whichever is larger.

To meet circular A-133's requirement that the institution have an internal control structure sufficient to provide reasonable assurance it's managing federal programs in compliance with applicable laws and regulations, OMB and the American Institute of CPAs plan to work together to determine what testing is needed. The CPA, however, generally is not expected to provide an opinion-level assertion on internal control.

The report on major program compliance, however, is an opinion about the compliance features that were tested. The auditor's report on compliance should indicate whether

* The charges were allowed under the award.

* The recipients were eligible.

* The matching requirements were met.

* The federal financial reports were accurate.

* The other terms and conditions, as appropriate, were met.

It's significant that OMB did not adopt the Single Audit Act's requirement to disclose all findings, even those requirements that are immaterial. Instead, circular A-133 requires

* An opinion on whether each of the major programs was administered in compliance with laws and regulations.

* A statement of positive assurance on items tested and negative assurance on programs that weren't tested.

* A presentation of material findings in their "proper perspective" (a term from Government Auditing Standards issued by the General Accounting Office, commonly referred to as the yellow book), including disclosure of the universe, sample size and instances of noncompliance.

* The relationship of the findings to particular awards, where appropriate.

* The auditor's recommendation for corrctive action.

OMB's reliance on the concepts of materiality and proper perspective is significant. Any CPA who has reported significant compliance findings recognizes quickly that proper perspective has a meaning for the financial auditor just as critical and pervasive as fairly presents. In conducting circular A-133 audits, the auditor will need to

* Understand which aspects of a program and what level of deviation from requirements could be considered material by the report's readers.

* Select an adequate number of transactions from each major program to obtain sufficient evidence to support the opinion on compliance.

* Place the compliance findings in a proper perspective.

The R&D program at some universities ranges from $110 million to $1 billion and involves hundreds--if not thousands--of individual awards. At these institutions, extensive planning will be neede to determine the scope of an audit. OMB is confident sampling standards and audit judgment will be applied in a wise measure to compliance auditing.

REPORT ON GENERAL REQUIREMENTS

Most federal awards contain a clause that requires compliance with certain general areas--political activity, prevailing wages for construction workers (the Davis-Bacon Act), civil rights, cash management, relocation/real property acquisition, federal finance reports and a drug-free workplace. Although A-133 doesn't explicitly require the auditor to report on these, SAS no. 63, Compliance Auditing Applicable to Governmental Entities and Other Recipients of Governmental Financial Assistance, mandates the auditor review the entity's environment, policies, procedures and systems that relate to these general requirements and assess the risk of financial statement misstatement because of noncompliance with them. Thus, under both SAS no. 63 and A-133 the auditor provides a procedures and findings report on the tests that have been performed.

OTHER CIRCULAR A-133 REQUIREMENTS

The new circular also requires the auditor to report on a schedule of expenditures under federal financial programs. Furthermore, it requires that, within six months after the report is issued, the recipient write on its own letterhead a management decision in response to each of the auditor's comments. This is in addition to any responses the entity might make to particular findings. It's useful to bind management's response (on letterhead) in the overall report so it doesn't get misplaced.

OMB circular A-133 also directs the auditor to disclose the status of uncorrected significant findings from prior audits. Finally, any report on fraud or illegal acts that are subject to prosecution must be made separately.

PROCUREMENT OF AUDITS

According to A-133, "no cost may be charged to federal awards for audits that are not made in accordance with this circular. "Moreover, if a recipient doesn't contract for a proper audit or the audit is inadequate, federal agencies may withhold or suspend federal awards until a proper audit is made.

COMPLIANCE SUPPLEMENT

While much of circular A-133 has been tested in practice, the circular contains a reference to a compliance supplement, which the OMB still is preparing. A lengthy compliance supplement to OMB circular A-128 required federal agencies to set forth their most critical compliance objectives and suggest steps to test them.

It;s relatively easy for an auditor of an entity that receives limited federal assistance to devise his own list from a close reading of the laws and regulations involved--although the auditor is advised to check this list with the cognizant audit agency or the sponsor itself before beginning the audit. The auditor of a major recipient of federal funds with hundreds of different grants will have to rely on his own judgment in selecting the requirements that are likely to be material to those major programs.

ADDITIONAL HELP AVAILABLE

My experience with comprehensive audits of nonprofit organizations has convinced me that an independent and objective audit of federal programs can provide significant benefits for the grantee as well as the sponsor. It can assist not-for-profits in their stewardship of funds related to their sponsored activities.

The compliance auditing task force of the AICPA not-for-profit organizations committee is completing a comprehensive compliance auditing guidance for nonprofit organizations. It should be available by the end of 1990. Under Position Statement no. 5 of the President's Council on Integrity and Efficiency, independent accountants who are conducting audits of not-for-profit organizations before the release of the new AICPA guide should follow Guidelines for Audits of Federal Awards to Nonprofit Organizations, issued in 1989 by the Department of Health and Human Services. Additionally, the AICPA is sponsoring several one-day meetings on the subject beginning in August. (See exhibit 3 at left for details.)

ROBERT FORRESTER, CPA, is a partner of Coopers & Lybrand, Boston. He was a member of the Statement on Auditing Standards no. 63 task force and now serves as chairman of the compliance auditing task force of the American Institute of CPAs not-for-profit organizations committee. This article is based in part on a talk given before the Association of College and University Auditors (ACUA) in San Antonio, Texas, in September 1989. It is adapted with permission of the ACUA.