32.4 Internal Control over Compliance Testing

Internal Control over Compliance Testing

Uniform Guidance requires the auditor to plan and perform tests of internal control over compliance to support a low assessed level of control risk for each major program. If internal controls over a compliance requirement are non-existent or ineffective, the auditor must report a Significant Deficiency or Material Weakness and perform expanded substantive testing.

---

The Single Audit Reporting Package: The Six Core Components

Under 2 CFR 200.512, the complete Single Audit reporting package consists of six required documents:

+-----------------------------------------------------------------------------------+
|               THE SIX COMPONENTS OF THE SINGLE AUDIT REPORTING PACKAGE            |
+-----------------------------------------------------------------------------------+
|  1. AUDITED FINANCIAL STATEMENTS & SEFA                                           |
|     • Basic financial statements, notes, and the Schedule of Expenditures of      |
|       Federal Awards (identifying federal agencies, ALN/CFDA numbers, pass-through)|
|-----------------------------------------------------------------------------------|
|  2. AUDITOR'S REPORT ON FINANCIAL STATEMENTS & SEFA                               |
|     • Expressing an audit opinion on GAAP statements and an in-relation-to        |
|       opinion on the supplementary SEFA schedule.                                 |
|-----------------------------------------------------------------------------------|
|  3. AUDITOR'S GAGAS (YELLOW BOOK) INTERNAL CONTROL & COMPLIANCE REPORT            |
|     • Reporting on internal control over financial reporting and on compliance    |
|       with laws, regulations, and contracts affecting financial statements.       |
|-----------------------------------------------------------------------------------|
|  4. AUDITOR'S UNIFORM GUIDANCE (SINGLE AUDIT) REPORT                              |
|     • Expressing an opinion on compliance for each major federal program and      |
|       reporting on internal control over compliance.                              |
|-----------------------------------------------------------------------------------|
|  5. SCHEDULE OF FINDINGS AND QUESTIONED COSTS (SFQC)                             |
|     • Part I: Summary of Auditor's Results.                                       |
|     • Part II: Financial Statement Findings (Yellow Book).                        |
|     • Part III: Federal Award Findings & Questioned Costs (exceeding $25,000).    |
|-----------------------------------------------------------------------------------|
|  6. AUDITEE SUMMARY OF PRIOR AUDIT FINDINGS & CORRECTIVE ACTION PLAN (CAP)        |
|     • Prepared by management: status of prior findings and formal CAP detailing   |
|       actions, assigned personnel, and completion dates for all current findings. |
+-----------------------------------------------------------------------------------+

The Schedule of Findings and Questioned Costs (SFQC)

The SFQC is the centerpiece of the Single Audit reporting package, structured into three mandatory sections:

• Part I: Summary of Auditor's Results: Summary table disclosing the opinion on the financial statements (unmodified, qualified, adverse, disclaimer); whether significant deficiencies or material weaknesses in financial reporting internal controls were identified; the opinion on compliance for major programs; an explicit listing of all major programs audited; the dollar threshold used to distinguish Type A and Type B programs; and whether the auditee qualified as a low-risk auditee.
• Part II: Financial Statement Findings: Details all internal control deficiencies and compliance matters required to be reported under GAGAS (Yellow Book).
• Part III: Federal Award Findings and Questioned Costs: Details all compliance findings for major federal programs, including known questioned costs greater than $25,000, and known questioned costs less than $25,000 if likely questioned costs exceed $25,000.

+-----------------------------------------------------------------------------------+
|                    QUESTIONED COSTS REPORTING THRESHOLD ($25,000)                 |
+-----------------------------------------------------------------------------------+
|  KNOWN QUESTIONED COSTS   | An expenditure that is not allowed by law, regulation, |
|                           | or grant agreement, or is not supported by adequate   |
|                           | documentation, exceeding $25,000.                     |
|---------------------------|-------------------------------------------------------|
|  LIKELY QUESTIONED COSTS  | Auditor's statistical projection of questioned costs   |
|                           | across the population exceeding $25,000.              |
+-----------------------------------------------------------------------------------+

---

Electronic Submission to the Federal Audit Clearinghouse (FAC) & Submission Deadlines

Single Audit reporting is entirely electronic. Auditees and auditors must complete the online Form SF-SAC (Data Collection Form) and upload the complete reporting package to the Federal Audit Clearinghouse (FAC).

Submission Deadlines

Under 2 CFR 200.512, the reporting package must be submitted to the FAC within the earlier of:

1. 30 calendar days after the date the auditee receives the independent auditor's reports; or
2. 9 months after the end of the auditee's audit period (fiscal year-end).

+-----------------------------------------------------------------------------------+
|                       FAC SUBMISSION TIMELINE DEADLINE                            |
+-----------------------------------------------------------------------------------+
|  FISCAL YEAR-END: June 30                                                         |
|  • 9-Month statutory deadline: March 31 of following year.                       |
|  • If auditor delivers report early on November 15:                               |
|    --> Package is due 30 days later: December 15 (EARLIER OF THE TWO DATES).      |
+-----------------------------------------------------------------------------------+

---

Pass-Through Entity (PTE) Monitoring Responsibilities for Subrecipients

Federal grants frequently flow through state governments or county agencies before reaching local service providers. When an entity passes federal awards to another non-federal entity to carry out part of a federal program, it acts as a Pass-Through Entity (PTE), and the receiving entity is a subrecipient.

Mandatory PTE Responsibilities (2 CFR 200.332)

PTEs cannot simply distribute federal funds and walk away. Under Uniform Guidance, PTEs must:

1. Identify the Award: Provide the subrecipient with complete subaward data, including Federal Award Identification Number (FAIN), Assistance Listings Number (ALN / CFDA), federal award date, and all compliance requirements.
2. Evaluate Subrecipient Risk: Assess each subrecipient's risk of noncompliance (considering prior audit history, new personnel, and complexity of awards) to determine appropriate monitoring.
3. Monitor Subrecipient Activities: Review financial and performance reports, conduct on-site reviews, and perform regular operational desk audits.
4. Verify Single Audits: Ensure that any subrecipient expending $1,000,000 or more in federal awards undergoes a Single Audit in accordance with Subpart F.
5. Issue Management Decisions: Issue a formal Management Decision on all audit findings related to awards passed through within six months of the audit report's acceptance by the FAC, and ensure the subrecipient takes timely corrective action.

---

Practical Public Finance Scenario: Riverside County Federal Grant Portfolio Single Audit

Scenario: Riverside County expends $18,000,000 in federal awards across five federal grant programs during FY 2026. Programs:

1. Assistance Listings (AL) 93.558 - Temporary Assistance for Needy Families (TANF): $7,200,000
2. AL 20.205 - Highway Planning & Construction: $5,400,000
3. AL 14.218 - Community Development Block Grant (CDBG): $3,100,000
4. AL 16.575 - Crime Victim Assistance: $1,400,000
5. AL 84.010 - Title I Grants to LEAs: $900,000

Background: In FY 2024 and FY 2025, Riverside County received unmodified opinions on its financial statements and SEFA, had no material weaknesses or significant deficiencies, had zero questioned costs, and submitted its SF-SAC to the FAC within 5 months of year-end. During FY 2026 testing of TANF, the auditor discovers $45,000 in unallowable administrative catering expenses that were charged to the grant.

Professional Single Audit Analysis & Determinations

1. Type A Program Threshold Determination:

   • Total federal expenditures = $18,000,000.
   • Under 2 CFR 200.518, for total expenditures from $1,000,000 through $34,000,000, the Type A threshold is $1,000,000.
   • Result: TANF, Highway Planning, CDBG, and Crime Victim Assistance each exceed $1,000,000 and are Type A programs. Title I, at $900,000, is a Type B program.

2. Low-Risk Auditee Status Evaluation:

   • Review of FY 2024 and FY 2025 demonstrates: annual single audits, unmodified opinions, zero material weaknesses, timely FAC filings, and zero questioned costs.
   • Result: Riverside County qualifies as a low-risk auditee.

3. Percentage-of-Coverage & Major Program Selection:

   • Because Riverside County is a low-risk auditee, the auditor must test major programs encompassing at least 20% of total federal expenditures: $\text{Minimum Required Coverage} = 20\% \times \$18,000,000 = \$3,600,000$
   • If the auditor selects TANF ($7,200,000), TANF alone represents: $\frac{\$7,200,000}{\$18,000,000} = 40.0\% \ge 20\%$
   • The 20% coverage threshold is satisfied. However, under Step 2 risk criteria, the auditor must evaluate all Type A programs for risk factors (e.g., changes in systems or management).

4. Questioned Costs Determination:

   • The $45,000 in unallowable catering costs exceeds the $25,000 statutory reporting threshold under 2 CFR 200.516(a)(3).
   • Reporting Mandate: The auditor must report this finding in Part III of the Schedule of Findings and Questioned Costs (SFQC) as a known questioned cost of $45,000, describe the noncompliance with allowable cost principles, and require County management to submit a formal Corrective Action Plan (CAP).