E7-12320. Audits of States, Local Governments, and Non-Profit Organizations

AGENCY:

Office of Management and Budget.

ACTION:

Revisions to OMB Circular A-133.

SUMMARY:

This Notice revises Office of Management and Budget (OMB) Circular A-133, “Audits of States, Local Governments, and Non-Profit Organizations,” by (1) Updating the internal control terminology and related definitions used in the Circular; and (2) simplifying the auditee reporting package submission requirement to the Federal Audit Clearinghouse (FAC).

DATES:

All comments on this revision should be in writing, and must be received by August 27, 2007. The revisions shall apply to audits of fiscal years ending on or after December 15, 2006.

ADDRESSES:

Due to potential delays in OMB's receipt and processing of mail sent through the U.S. Postal Service, we encourage respondents to submit comments electronically to ensure timely receipt. We cannot guarantee that comments mailed will be received before the comment closing date.

Electronic mail comments may be submitted to: [e-mail]. Please include “A-133 Comments” in the subject line and the full body of your comments in the text of the electronic message and as an attachment. Please include your name, title, organization, postal address, telephone number, and e-mail address in the text of the message. Comments may also be submitted via facsimile to 202-395-4915.

Comments may be mailed to Gilbert Tran, Office of Federal Financial Management, Office of Management and Budget, Room 6025, New Executive Office Building, Washington, DC 20503.

A copy of the current Circular A-133 published in the Federal Register on June 27, 2003 is available on the Internet at http://www.whitehouse.gov/​omb/​circulars/​a133/​a133.pdf.

FOR FURTHER INFORMATION CONTACT:

Gilbert Tran, Office of Federal Financial Management, Office of Management and Budget, telephone [phone] (direct) or 202-395-3993 (main office) and e-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

A. Revisions of Internal Control Definitions and Related Matters

OMB Circular A-133 includes guidelines for the reporting of “reportable conditions” and “material weaknesses” in internal control in several places. These terms and/or their related definitions have become outdated and need updating due to recently issued standards by both the American Institute of Certified Public Accountants (AICPA) and the Government Accountability Office (GAO). The AICPA issued Statement on Auditing Standards (SAS) No. 112, Communicating Internal Control Related Matters Identified in an Audit (AICPA, Professional Standards, vol. 1, AU 325), which became effective for audits of periods ending on or after December 15, 2006. With regard to internal control over financial reporting, the SAS introduced and defined the term “control deficiency;” replaced the term “reportable condition” with “significant deficiency” and redefined that term; and also revised the definition of the term “material weakness.” Recently, the GAO issued a revision to Government Auditing Standards (GAS) and posted a related notice to its Web site that requires the new internal control terminology and definitions to be used in all financial audits performed under GAS as of the effective date of SAS 112. Therefore, to be consistent with the recent revisions to professional auditing standards, references to “reportable condition” and “material weakness” in internal control over financial reporting related to the audit of the financial statements in Circular A-133 are replaced by the terms “significant deficiency” and “material weakness” as those terms are defined in SAS 112 and GAS. This change is effective for single audits of periods ending on or after December 15, 2006.

As noted above, SAS 112 and GAS define control deficiencies in internal control over financial reporting. Because Circular A-133 also requires the auditor to report on internal control over compliance related to major federal programs, similar definitions had to be developed for control deficiencies in internal control over compliance. The AICPA, working with OMB and other federal agency staff, is issuing AICPA Auditing Interpretation No. 1, “Communicating Deficiencies in Internal Control Over Compliance in an Office of Management and Budget Circular A-133 Audit” of SAS No. 112 (AICPA, Professional Standards, vol. 1, AU 9325.01-.02), which can be found at the following link (http://www.aicpa.org/​Professional+​Resources/​Accounting+​and+​Auditing/​Audit+​and+​Attest+​Standards/​Authoritative+​Standards+​and+​Related+​Guidance+​for+​Non-Issuers/​Recently+​Issued+​Audit+​and+​Attestation+​Interpretations.htm). That interpretation includes the following definitions which should be used in single audits of periods ending on or after December 15, 2006:

A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect on a timely basis noncompliance with a type of compliance requirement of a Federal program.^[1]

A significant deficiency ^[2] is a control deficiency, or combination of control deficiencies, that adversely affects the entity's ability to administer a Federal program such that there is more than a remote likelihood ^[3] that noncompliance with a type of compliance requirement ^[4] of a Federal program that is more than inconsequential ^[5] will not be prevented or detected.

A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that material noncompliance with a type of compliance requirement ^[6] of a Federal program will not be prevented or detected.

In addition to the Interpretation, the AICPA has issued updated illustrative Circular A-133 audit reports that can be accessed on the AICPA Governmental Audit Quality Center Web site at the following link (http://gaqc.aicpa.org/​Resources/​Illustrative+​Auditors+​Reports/​). Further, updated illustrative reporting for financial statement audits performed under GAS can also be found at the same Web site link.

This change in terminology and related definitions may result in the reporting of additional internal control matters than had been reported using the previous terminology and definitions. The reporting of such additional matters may affect the scope of single audits, particularly as it relates to the determination of major programs and the auditee's low-risk status.

Auditees submitting single audits of periods ending between December 15, 2006 and December 31, 2006, should use the approved Data Collection Form (Form SF-SAC) for fiscal years ending 2004, 2005 and 2006 when filing with the Federal Audit Clearinghouse. Since this Form SF-SAC has not yet been updated for the new internal control terminology, any “significant deficiency” should be recorded under the term “reportable condition” on the following items: Part II—items 3 and 4, Part III—items 4 and 5, and Part 3, item 10(a). The Form SF-SAC terminology will be updated in the next SF-SAC form scheduled for January 1, 2008.

The Form SF-SAC approved for audits with fiscal period end dates in 2004, 2005, and 2006, is extended to apply to audits with fiscal period end dates in 2007. All submissions with fiscal period end dates in 2007 must use the 2004-2006 version of Form SF-SAC.

B. Streamlined Submission of Reporting Package to the Federal Audit Clearinghouse (FAC)

We are also streamlining the auditee's submission of the reporting package to the FAC. Due to technology advances, starting January 1, 2007, the auditee is no longer required to submit multiple copies of the reporting package to the FAC, in accordance with section 320(d) of Circular A-133. Instead, only one copy of the reporting package is necessary. However, Part III, item 8, of the Form SF-SAC should continue to be completed noting all agencies required to receive a copy of the reporting package.

Rob Portman,

Director.

Circular A-133 is revised as follows:

1. In the following sections, replace “reportable conditions” with “significant deficiencies”: § _.320(b)(2)(ii); § _.320(b)(2)(iv); § _.500(c)(3); § _.505(d)(1)(ii); § _.505(d)(1)(iv); § _.510(a)(1), and § _.520(d)(1).

2. Replace § _.320(d) with the following:

(d) Submission to clearinghouse. All auditees shall submit to the Federal clearinghouse designated by OMB a single copy of the data collection form described in paragraph (b) of this section and the reporting package described in paragraph (c) of this section.

Footnotes

1.  This reference to “type of compliance requirement” refers to the first 13 types of compliance requirements (that is, types of compliance requirements identified as “A” through “M”) described in Part 3 of the OMB Circular A-133 Compliance Supplement (the Compliance Supplement) and each individual special test and provision identified in Part 4 of the Compliance Supplement for each federal program. When a federal program is not included in the Compliance Supplement, the identification of types of compliance requirements that apply and are material to a federal program (including special tests and provisions) is made through a review of the program's contract and grant agreements and referenced laws and regulations.

2.  The term significant deficiency replaces the term reportable condition currently used in Circular A-133.

3.  The term remote likelihood as used in the definitions of the terms significant deficiency and material weakness has the same meaning as the term remote as used in Financial Accounting Standards Board Statement of Financial Accounting Standards No. 5, Accounting for Contingencies, found at the following link (http://www.aicpa.org/​download/​members/​div/​auditstd/​AU-00325.PDF). Therefore, the likelihood of an event is “more than remote” when it is at least reasonably possible.

4.  See footnote 1.

5.  Noncompliance with a type of compliance requirement is inconsequential if a reasonable person would conclude, after considering the possibility of further undetected noncompliance, that the noncompliance, either individually or when aggregated with other noncompliance related to the same type of compliance requirement, would clearly be immaterial to a federal program. If a reasonable person would not reach such a conclusion regarding a particular noncompliance, that noncompliance is more than inconsequential.

6.  See footnote 1.