PCIE STANDARDS COMMITTEE POSITION STATEMENT NO. 2 FEBRUARY 4, 1987 ISSUE Is an audit report that is submitted to meet the requirements of the Single Audit Act and OMB Circular A-128 acceptable if the internal control coverage prescribed by the AICPA's Audit and Accounting Guide Audits of State and Local Governmental Units (ASLGU) is not met? There are two things that need to.be considered relative to this issue. The first is the acceptability of an approach to the study and evaluation of internal controls that is different than the approach described in the guide. The second consideration is the authoritative status and enforceability of the guide for public accountants and governmental auditors. BACKGROUND AND DISCUSSION Requirement for a Review of Internal Controls The Single Audit Act requires auditors to determine and report whether the entity has internal control systems to provide reasonable assurance that it is managing Federal financial assistance programs in compliance with laws and regulations. The House Report which accompanied the passage of the Single Audit Act in the House indicated that the auditors report on internal controls should contain sufficient information to allow Federal, State and local officials to reach a conclusion regarding the above. Paragraph 8 of OMB Circular A-128 contains the specific requirements for making a study and evaluation of internal control. The paragraph requires that the auditor determine and report on whether the organization has internal control systems to provide reasonable assurance that it is managing Federal assistance programs in compliance with applicable laws and regulations. It further states: In order to provide this assurance the auditor must make a study and evaluation of internal control systems used in administering Federal assistance programs. The study and evaluation must be made whether or not the auditor intends to place reliance on such systems. As part of this review, the auditor shall test whether these internal control systems are functioning in accordance with prescribed procedures... The Need For Further Guidance Because the phrase "study and evaluation" is used to describe widely varying degrees of internal control reviews (i.e., from a preliminary review to a full study and evaluation) further guidance was needed regarding the level of work that is necessary to meet the intent of the requirement. It was recognized that a "preliminary review" type of evaluation did not meet the requirement because A-128 requires testing of the internal control systems. Although A-128 could be interpreted to require a full study and evaluation of all internal control systems used in administering Federal assistance programs, it was also recognized that this would not be practical for many entities. The 50% Rule The AICPA addressed the issue by prescribing a minimum level of coverage for the study and evaluation of internal controls over Federal assistance programs in its February 1986 revision of ASLGU. The approach prescribed by ASLGU is commonly referred to as the "50% rule." The GAO, OMB and the IG community were all consulted in developing this approach. The "50% rule" provides that a full study and evaluation (as described in AU Sections 320.53 to 320.72 of the AICPA Professional Standards) be conducted of the internal controls over the major Federal assistance programs. If major programs make up less than 50% of total Federal expenditures, the full study and evaluation should be extended to cover the controls over the largest nonmajor programs so that the controls over at least 50% of Federal expenditures are so studied and evaluated. The controls over the remaining nonmajor programs are to be subjected to at least a preliminary review as described in AU Section 320.53. The PCIE Standards Committee believes that the internal control coverage resulting from the application of the 50% rule is the minimum coverage needed to meet the requirements and intent of the Act and Circular. Audit Guide Status The two areas that need to be considered here are the authoritativeness of the guide and its applicability to State and local governmental auditors. While audit guides do not have the same standing as statements on auditing standards or their related interpretations, the following notice is included in the ASLGU: This accounting and auditing guide presents recommendations of the AlCPA State and Local Government Committee regarding the application of generally accepted auditing standards to audits of financial statements of State and local governmental units. It represents the considered opinion of the committee on the best auditing practice in the industry and has been reviewed by members of the AICPA Auditing Standards Board for consistency with existing auditing standards. AICPA members may have to justify departures from the recommendations contained in this guide if their work is challenged. This committee concurs with the AICPA State and Local Government Committee's opinion that the guide represents the best auditing practice in the industry. Neither the Act nor the Circular specifically requires the guide to be used, but they do require auditors to follow generally accepted governmental auditing standards which incorporates generally accepted auditing standards. We recognize that industry audit guides are not part of official GAAS. However, if the guide represents the best auditing practice in the industry, we believe that failure to consider the recommended practices contained in the guide when planning the audit, or departing from such recommended practices without adequate justification, violates the first standard of fieldwork and the general standard of due professional care. Based on this belief, it is the opinion of this committee that the ASLGU is equally applicable to all auditors conducting single audits regardless of whether they are in public practice or are State or local governmental employees. (Parenthetically, auditors of entities subject to the Single Audit Act that receive U.S. Department of Agriculture (USDA) funds are required to follow ASGLU by USDA regulations) POSITION As a general rule, cognizant agency audit organizations should not accept audits when the 50% rule is not followed. However, it is recognized that in some cases a departure from the 50% rule may be justified. If a cognizant agency audit organization (cog) determines that the 50% rule was not followed, it should require the auditor to justify not doing so. If the cog agrees that not following the 50% rule was justified, the report should be accepted (assuming it is otherwise acceptable.) Special care should be taken to make sure that the auditor's report on internal control accurately describes the work performed. If the auditor cannot justify the departure from the 50% rule to the satisfaction of the cog, the cog should require the auditor to do the work and recommend appropriate sanctions if the work is not done. In judging the acceptability of an alternative approach for the internal control review, the primary criteria is whether or not substantially the same coverage is obtained.