Table Of Content(Hnull UMASS/AMHERST * UFR
COMPLIANCE
AUDITOR'S
SUPPLEMENT
my
UNDER CMR
808 1.00
Commonwealth of Massachusetts
&
Executive Office for Administration Finance
Division of Purchased Services
Fiscal Year 1996
Document Number DPS-A029b
Rev.June 1996
965711
UNIFORM FINANCIAL STATEMENTS AND INDEPENDENT AUDITOR'S REPORT
AUDITOR'S COMPLIANCE SUPPLEMENT
TABLE OF CONTENTS
Page
Introduction 1
General Requirements 2
Terms Defined 3
Identifying Laws and Regulations 3
Materiality/Significance and Sensitivity 4
Determining the Extent ofCompliance Testing 5
Vulnerability Assessment 5
A. Inherent Risk 6
Considering Requirements ofLaws and Regulations 6
1.
2. Susceptibility to Noncompliance 7
3 Management Commitment 8
.
4. Testing Transactions 8
B Internal Controls 9
1. Identifying Objectives 9
2. Identifying Procedures 9
3. Testing Control Procedures 10
4. Needed Corrective Actions 10
Reporting Requirements
1
Suggested Areas ofCompliance Testing 13
Allocation ofCosts
1
Allowable Services
1
Eligible Clients 16
Performance and Service Documentation
1
Program FTE Documentation
1
Client Custodian Funds 19
Provider Reimbursements/Stipends 20
Assets Held in Trust for the Commonwealth 2
Disclosure ofNonreimbursable Costs 22
Related Party Disclosure 23
Record Keeping 26
Offsetting Income 27
Attachments:
Audit Risk Assessment Form
Regulations:
808 CMR 1.00
CMR
808 2.00
DPS General Conditions to the Master Agreement
DPS Summary Sheet Reimbursable and Non-Reimbursable Costs
DPS Audit Resolution Policy
OMB
Circular A-122 Cost Principles for Nonprofit Organizations
Digitized by the Internet Archive
2014
in
https://archive.org/details/ufrauditorscomplOOmass_0
OMB Circular A-110 Uniform Administrative Requirements for Grants and Agreements With Institutions of Higher
Education. Hospitals and Other Nonprofit Orgamzations
OMB Circular A-133 Audits ofInstitutions ofHigher Education and Other Non-Profit Institutions
Selected Sections ofEOHHS Secretariat Guidelines to Purchasing Agencies for Procurement and Contracting for Social
and Rehabilitative Services
DPS Policy Guidance/Regulatory Interpretation of808 CMR 1.15 (24) Salaries ofOfficers and Managers
Questions and Answers on Audit and Preparation ofthe UFR August 1994
Additional Questions and Answers on Audit and Preparation ofthe UFR May 1995
Massachusetts Society ofCPAs Questions November 17. 1995
June100oVersion iv.K«.*h. 1-4.?o« *o-. «"-*.ck
Introduction
When an independent auditor is engaged to audit the Uniform Financial Statements, the financial
audit must be conducted and reported in accordance with Generally Accepted Government
Auditing Standards (GAGAS). Government Auditing Standards (commonly referred to as the
"Yellow Book") have been promulgated by the Comptroller General ofthe United States General
Accounting Office (GAO). The guidance that follows has been adapted for use in audits of
providers contracting with the Commonwealth and excerpted from the "Yellow Book" and the
GAO office policy publication, "Assessing Compliance With Applicable Laws and Regulations."
GAO's standards require that all audits include an assessment ofcompliance with relevant laws and
regulations that are material to the engagement objectives. For financial statement audits, the
standard provides the following:
Auditors should follow up on known material findings and recommendations from
previous audits.
Auditors should design the audit to provide reasonable assurance of detecting
irregularities that are material to the financial statements.
Auditors should design the audit to provide reasonable assurance of detecting
material misstatements resuting from direct and material illegal acts.
Auditor's should be aware of the possibility that indirect illegal acts may have
occured. If specific information comes to the auditor's attention that provides
evidence concerning the existence of possible illegal acts that could have material
indirect effect on the financial statements, the auditor's should apply audit
procedures specifically directed to ascertaining whether an illegal act has occured.
Auditor's should design the audit to provide reasonable assurance of detecting
material misstatements resulting from noncompliance with provisions ofcontracts or
grant agreements that have a direct and material effect on the determination of
financial statement amounts. Ifspecific information comes to the auditors' attention
that provides evidence of possible noncompliance that could have a material direct
effect on the financial statements, auditors should apply audit procedures specifically
directed to ascertaining whether that noncompliance has occured.
In addition, the audit of the UFR requires the auditor to employ certain reporting and
fieldwork standards of GAGAS for performance audits when testing and reporting on
contract compliance (see paragraph 2.2 of 1994 "Yellow Book").
The "Yellow Book" also requires that financial audits be performed in accordance with the
fieldwork and reporting standards prescribed by the American Institute of Certified Public
Accountants (AICPA). AICPA has issued a series of Statements on Auditing Standards (SAS),
and the following are particularly applicable to detecting and reporting noncompliance with laws
and regulations on financial and certain aspects ofperformance audits:
Compliance Auditing Applicable to Government Entities and Other Recipients of
Governmental Financial Assistance (SAS 74);
1 June 1996 Version
Consideration ofthe Internal Control Structure in a Financial Statement Audit (SAS
55);
Illegal Acts by Clients (SAS 54); and
The Auditor's Responsibilities to Detect and Report Errors and Irregularities (SAS
53);
Omnibus Statement on Auditing Standards 1983 (SAS 45) AU Section 334, Related
Parties and Au Section 9334 Related Parties: Auditing Interpretations of Section
AU
334,
Audit Risk and Materiality in Conducting an audit (SAS 47).
Audits of providers for Single Audit purposes carry additional requirements that the auditor must
be aware of to conduct the audit. These requirements are noted in the Executive Office of The
OMB
President, Office of Management and Budget publication, Circular A-133 "Audits of
Institutions ofHigher Education and Other Nonprofit Organizations" and "Compliance Supplement
for Single Audits ofInstitutions ofHigher Education and Other Nonprofit Organizations."
General Requirements
Audits must be properly planned and include steps to provide reasonable assurance-not absolute or
complete-that material instances of noncompliance that directly relate to the engagement's
objective(s) are detected and reported Auditors should not presume the provider is in compliance
or not in compliance but should do sufficient testing to provide reasonable assurance that
noncompliance, which is individually or in the aggregate material, would have been identified.
Sufficient steps must be performed to detect major noncompliance without spending an
unreasonable amount of resources on those steps. Too much audit effort would waste valuable
resources needed elsewhere, while not enough work risks instances of material noncompliance
going undetected.
The standard does not expect auditors to uncover every impropriety; instead, it requires reasonable
tests to assure detection of major noncompliance (errors, fraud, illegal acts, or irregularities) and
abuse
The "Yellow Book" requires auditors to perform audit steps as follows:
1. Determine if engagement objectives require that tests of compliance with laws and
regulations be performed;
2. Identify laws and regulations that apply to the entity being audited and that are relevant to
engagement objectives;
3. Assess the risk that noncompliance with these laws and regulations could significantly affect
the program operations or financial statements being audited;
4. Consider whether internal controls deter or help detect noncompliance;
5. Design work steps to reasonably assure the (1) entity's compliance with relevant laws and
regulations and (2) detection of errors, irregularities, abuse, or illegal acts that could
significantly affect the engagement objectives;
6. Exercise appropriate caution in investigating illegal acts so as not to interfere with potential
future investigations and/or legal proceedings;
7. Promptly prepare an audit report that includes irregularities, illegal acts and other material
or significant noncompliance (for, example violations ofcontract provisions) and
8 In some circumstances, auditors should report irregularities and illegal acts directly to
parties external to the audited entity.
June 1996 Version 2
Terms Defined
Noncompliance with laws and regulations includes both intentional and unintentional acts as well as
a variety ofother terms, such as "fraud," "abuse," "errors," and "irregularities," and these and other
terms are defined as follows:
Abuse is distinguished from noncompliance in that abusive conditions may not directly violate laws
or regulations. Abusive activities may be within the letter of the laws and regulations but violate
either their spirit or the more general standards of impartial and ethical behavior. This would
include furnishing excessive services to beneficiaries; or performing what may be considered
improper practices, none ofwhich involves noncompliance with laws and regulations
Civil act - An illegal act for which penalties that do not include incarceration are available for a
statutory violation. Penalties may include monetary payments and corrective actions
Criminal act - An illegal act for which incarceration, as well as other penalties, is available if the
government obtains a guilty verdict
Error - Unintentional noncompliance with applicable laws and regulations and/or misstatement or
omission ofamounts or disclosures in financial statements.
Fraud - Action that violates a fraud-related statute ofthe federal or state government
Illegal act - Failure to follow requirements of laws or implementing regulations, including
intentional and unintentional noncompliance and criminal acts.
Irregularities - Intentional noncompliance with applicable laws and regulations and/or
misstatements or omissions ofamounts or disclosures in financial statements.
Identifying Laws and Regulations
During the early phase of an engagement, auditors should identify the laws and regulations that
apply to the engagement subject area and might significantly affect engagement objectives.
The first step is to identify general laws and regulations applicable to the subject ofthe engagement.
For example, when auditing the provider's Uniform Financial Statements, the laws and regulations
associated with the organization's charitable purpose and delivery ofsocial services will apply.
The second step is to identify more specific laws and regulations applicable to the provider's
activity. For example, the contract that is executed between the provider and the Commonwealth's
purchasing agency is governed by the incorporation ofgeneral conditions, procurement regulations
and contracting requirements.
The third step is to identify those provisions oflaws, regulations and policies relating directly to the
engagement objectives For example, violation of contract provisions or regulations that govern
reimbursement for services delivered by the provider could have a material effect on the financial
statements.
Sources ofinformation that auditors can use to identify applicable laws and regulations include:
Federal and State employment and labor laws.
Internal Revenue Code, Massachusetts Department of Revenue and Division of
Employment and Training laws.
Massachusetts Executive Office for Administration and Finance, Division of
Purchased Services General Conditions (Attachment ofMaster Agreement).
1
3 June 996 Version
1
Code ofMassachusetts Regulations (available from State Bookstore).
Code ofFederal Regulations (available from Federal Bookstore).
State agency contracting requirements (contained in Attachment C of state
purchasing agency contracts with the provider) and in Secretariat guidance furnished
to state purchasing agencies.
Division ofPurchased Services Contract Instructions and Forms.
Commonwealth ofMassachusetts Purchase ofService System User Handbook
Materiality/Significance and Sensitivity
The auditor should consider materiality and/or significance and sensitivity in planning the audit and
in selecting the methodology and designing audit tests and procedures, as well as in deciding
whether a matter requires disclosure in an audit report.
Materiality concerns the magnitude of omissions or misstatements of accounting information that,
in the light ofcircumstances, makes it probable that thejudgment ofa reasonable person relying on
the information would have been changed or influenced by omissions or misstatements. Materiality
judgments involve both quantitative and qualitative considerations One of the criteria to be
considered in determining materiality includes the monetary value ofthe item Qualitative factors
include, but are not limited to, the cumulative effect and impact ofimmaterial items, the objectives
ofthe work undertaken, and the use ofthe reported information by the users or groups ofusers of
the information.
Significance concerns the importance, in relation to the audit objectives, of items, events,
information, matters or problems the auditor identifies.
Sensitivity involves how given matters will be perceived by others It is possible for matters to be
both material/significant and sensitive. For example, a former high-level state official used
influence to convince a state agency to fund a program operated by a provider, and for minimal
effort the former official was paid a large fee by the provider.
In determining materiality and/or significance, sensitivity and audit risk, the auditor is expected to
consider the following:
a Amount ofrevenues and expenditures.
b Newness ofthe activity or changes in its condition.
c Adequacy ofinternal controls.
d Results ofprior audits
e. Level and extent ofreview or other form ofindependent oversight
f. Adequacy ofthe internal controls for ensuring compliance with laws and regulations,
g Management's adherence to applicable laws and regulations.
h Audit report users' expectations
Public perceptions and political sensitivity ofthe areas under audit,
i.
Audit requirements.
j.
In government audits the materiality level and/or threshold ofacceptable risk may be lower than in
similar-type audits in the private sector because of the public accountability of the entity, various
June 1996 Version 4
