Single audit requirements are often viewed as challenging by organizations and their auditors, and that may be especially true now. The federal response to the COVID-19 pandemic included new federal programs that are subject to single audits, as well as new or revised compliance requirements. Some organizations will need a single audit solely because of the new federal funding, for example. Organizations must be aware of the new requirements associated with COVID-19 funding, and auditors need to stay informed to ensure single audits are performed when required and that all single audits are of high quality.
Much of the new COVID-19 funding to date was established by the Coronavirus Aid, Relief, and Economic Security (CARES) Act, P.L. 116-136, signed into law in March 2020. In August 2020, the Office of Management and Budget (OMB) released its annual guidance to auditors on performing single audits in the 2020 Compliance Supplement, effective for audits of fiscal years beginning on or after June 30, 2019. However, it did not include detailed guidance for auditing COVID-19 funding.
Additional single audit guidance related to COVID-19 funding was provided when the OMB issued an addendum to the 2020 Compliance Supplement in December 2020, with the same effective date as the original Supplement. OMB only posts the Supplement in one large PDF file. As a member service, both the original release of the Supplement and the addendum are available broken down by section on the GAQC 2020 Compliance Supplement webpage.
Information you need to know
A panel of experts provided an update on COVID-19 funding issues and single audit challenges in the AICPA Governmental Audit Quality Center (GAQC) webcast, Single Audit Lightning Round (archived broadcast). The panelists also shared tips for practitioners based on common questions the GAQC has received over the past year on the topic.
The panelists started the webcast by sharing some of the challenges they’ve been living through.
“Trillions of dollars of funding in response to the pandemic subject to single audits started in March 2020 before all the rules were in place, as we are normally used to, and the original 2020 Supplement did not include the new COVID-19 programs,” said Erica Forhan, CPA, partner at Moss Adams. In addition, new COVID-19 funding was signed into law at the end of December 2020 and again in March with the American Rescue Plan Act of 2021.
“The most challenging issue from the pandemic to a single audit practice is keeping up with the changing guidance,” said Lindsey Oakley, CPA, partner at BKD LLP. Agreeing with that statement was Stephen Blann, CPA, CGMA, principal and director of audit quality at Rehmann LLC. “There was a waiting game, because the guidance was spread out, organizations didn’t have the necessary information to spend the money, and audits didn’t start, which delayed the whole season,” he said.
Here are some other key takeaways covered in the webcast regarding the impact of COVID-19 funding on single audits.
Effective dates and extensions
The addendum provided a three-month extension for single audits of fiscal years ended Jan. 31, 2020, through Sept. 30, 2020, if the recipient received COVID-19 funding.
Thomas Sneeringer, CPA, partner at RSM, emphasized that the extension is automatic and does not require recipients or auditors to seek approval, but that organizations should document the reason for the delayed filing. This is important, as the entity will not get an acknowledgment from the Federal Audit Clearinghouse of its eligibility for an extension, and auditors will need to determine the entity’s eligibility for future low-risk auditee status from the client documentation. The panelists did remind participants that in providing the extension, the OMB still encouraged auditees and auditors to complete the audits as soon as possible.
There is no current extension for single audits of year ends after Sept. 30, 2020. Sneeringer noted that previous extensions for 2019 fiscal year-end audits provided by OMB to entities whose operations were affected by COVID-19 have expired, and the new audit extension provided by the addendum is the only one that remains in effect.
Which guidance to apply
For audits for fiscal years ended June 30, 2020, and later, auditors should use guidance in the addendum to audit new COVID-19 programs. Blann also discussed which OMB guidance auditors should apply to audits of new COVID-19 programs for 2020 year ends prior to the periods covered by the addendum (for example, for an audit of a May 31, 2020, fiscal year end). In that case, Blann stated that, technically, Part 7 of the 2019 Supplement should be used to determine the compliance requirements to test. However, in identifying the requirements and audit approach, the auditor could refer to the 2020 Supplement addendum to assist in better understanding the federal expectations for the new program.
Timing of single audit issuance
Sneeringer said that, in the past, his firm normally issued its clients’ financial statement audits and single audits at the same time. But, due to the late issuance of the addendum, his firm, like many others, decided not to finalize the single audit if there was COVID-19 funding as part of a client’s Schedule of Expenditures of Federal Awards (SEFA). Forhan reminded participants that when the auditor is issuing a separate stand-alone single audit, report-dating considerations and subsequent-event responsibilities up to the date of the compliance audit issuance should be factored in.
Addendum contents
The addendum includes auditor guidance on several new federal programs established in response to the COVID-19 pandemic that are subject to single audit. The three largest of the new programs included in the addendum are the Coronavirus Relief Fund (CRF), Education Stabilization Fund (ESF), and Provider Relief Fund (PRF). The panelists discussed some of the nuances and ongoing questions surrounding each of these programs. In particular, the PRF continues to generate the most unanswered questions. The GAQC team is working on getting answers to those questions from the Department of Health and Human Services, the federal sponsor of that program.
Existing programs also received additional COVID-19 funding, several of which are included in the addendum. Additionally, certain existing programs were granted compliance waivers and/or significant flexibilities because of the pandemic. The OMB has posted a table of the existing programs receiving CARES funding.
Major program determination
“The rules for determining major programs have not changed but may need to be looked at through a different lens due to new COVID-19 funding,” Forhan said. “Changes in personnel, systems, the entity’s delivery model, and how it is operating due to the pandemic can all change the determination. Auditors need to apply the major determination steps as defined in the Uniform Guidance and develop robust documentation of their evaluation and judgments in this area.”
New COVID-19 programs that are Type A would be considered high risk in the first year because they have not been audited in one of the two prior years, and new COVID-19 programs that are Type B would need to be evaluated as they normally would, using risk assessment criteria in the Uniform Guidance.
As they relate to existing programs that received significant new COVID-19 funding, Forhan again stressed that auditors should closely follow the Uniform Guidance rules for Type A and Type B program risk assessment and not assume that the addition of COVID-19 funding alone equates to automatic high-risk designation.
SEFA timing issues
Oakley said many questions have been raised in this area related to determining the award date and when costs (or lost revenue) should be reported on the SEFA. Although this is not a new issue, new questions are arising since many new programs include a performance period and permit costs (or lost revenue) to be incurred both before and after the award and may be incurred in more than one fiscal year. Additionally, per Oakley, there has also been confusion due to the mistaken impression that SEFA reporting must align exactly to reporting for financial statement purposes under GAAP. Due to the confusion in this area, the GAQC has developed a nonauthoritative practice aid on this topic.
Internal controls
Auditors need to consider the following questions relating to internal control: (1) Were there changes to client operations stemming from the pandemic?; (2) Are there new controls or revised controls due to new funding?; and (3) Have there been compliance requirement changes, flexibilities, or waivers due to the pandemic? “Many clients are making changes to their internal controls for both new and existing programs that received COVID-19 funding,” Forhan said. “Auditors also need to evaluate what controls should be in place that are not, as well as consider that controls to be tested may have been in place at different times during the fiscal year.” Further, there could be a need to increase compliance testing and sample sizes if controls cannot be relied upon, and the documentation of internal control test work is more important than ever.
New audit requirement on Federal Funding Accountability and Transparency Act (FFATA) reporting
The addendum requires auditors to test FFATA reporting for COVID-19 major programs included in the addendum, except for the CRF, where the client is a direct recipient that makes subawards over certain dollar thresholds. “The FFATA requirement had been removed from the Supplement seven or eight years ago but has now been added back and revised to focus auditors’ testing on the reporting input system, which is the FFATA Subaward Reporting System (FSRS),” Oakley said. The addendum also expands the FFATA testing requirements to all major programs, including non-COVID-19 funding, for single audits of fiscal years after Sept. 30, 2020. Oakley noted that testing FSRS can be challenging for auditors, especially during the pandemic, because the system is only accessible to the recipients. “Auditors will need to coordinate how they can review the information, either physically or virtually, and they may have to use screenshots as audit evidence,” she said.
What to do
Single audits are a highly specialized area, and COVID-19 funding has added new considerations to these audits. Auditors should spend the time necessary to understand the rules and how they apply to their single audit clients. Notably, because of the significant amount of new federal funding, many clients will require single audits for the first time. Because not all of the questions have yet been answered for several of the new programs and because the landscape has been changing over time, auditors and their clients need to continue to stay on top of this area to ensure compliance and high-quality audits. A good way to do this is to follow the activity of the GAQC and its COVID-19 resource page to stay current.
Get more news, resources, and professional insights by logging in and selecting your preferences so you can see more from the AICPA on topics that mean the most to you.
— Maria L. Murphy, CPA, is a freelance writer based in North Carolina. She has extensive experience in accounting, auditing, and finance. To comment on this article or to suggest an idea for another article, contact Ellen Goldstein, the Association’s director–Communications & Special Projects, at Ellen.Goldstein@aicpa-cima.com.