Audit requirements applicable to nonprofit entities were changed significantly by federal Office of Management and Budget (OMB) Circular A-133, "Audits of Institutions of Higher Education and Other Nonprofit Institutions" (A-133). For the first time, uniform audit requirements will cover all federal financial assistance provided to nonprofit entities.

HISTORY

A-133 is the latest in a series of pronouncements dealing with federal financial assistance (FFA) that seek to establish uniform audit requirements to ensure recipients are complying with applicable laws and regulations.

The growth of the Great Society programs of the 1960s and 1970s greatly expanded the sizes and types of federal programs available to nonprofit, state and local government, and proprietary entities. With growth arose a need by federal administrators to obtain assurance that monies expended were in accordance with program objectives and that government program compliance requirements were satisfied. At first each federal agency and government program's management conducted its own audit to obtain this assurance. Because recipients often received federal assistance from more than one agency, this created significant audit redundancy and overlap.

In 1971, the OMB stepped in to establish some order by issuing Circular A-102, "Uniform Administrative Requirements for Grants to State and Local Governments" (A-102). The purpose of Attachment P of A-102 was to standardize federal agency audit requirements regarding recipients of federal aid. A-102, however, was not applicable to federal aid to nonprofits. This was remedied in 1976 with the issuance of A-110, "Grants and Agreements with Institutions of Higher Education, HospitaLs and Other Non-profit Organizations" (A-110).

Attachment F of A-110 directed federal grantor agencies to determine that controls of recipients would assure compliance with laws and regulations over federal financial assistance. It required that recipient financial and administrative systems provide the following:

* Effective financial management and internal procedures to meet terms and conditions of grant agreements.

* Maintain fiscal integrity of financial transactions on an organization--wide basis, as well as compliance with terms and conditions of the government agency

* A systematic method to assure timely and appropriate resolution of audit findings.

Neither Attachment P of A-102 covering state and local governments nor Attachment F of A-110 covering nonprofits, were ever adequately implemented. There was ambiguity about which applicable audit standards should be used, about the nature of testing of compliance with laws and regulations, and about the extent of study of internal controls. Also, federal agencies were not adopting uniform standards. This compounded confusion in the audit marketplace.

In 1984, Congress addressed the problems and passed the Single Audit Act (Act). it was applicable to all state and local government entities and imposed uniform audit requirements on those entities by force of law. Under the Act, OMB was directed to issue guidance on implementation of the Act; Circular A-128 contains that guidance. It superseded Attachment P of A-102 and called for each federal grantor agency to implement the entire text of the circular thereby finally establishing uniform audit requirements.

It requires an organization-wide audit by independent auditors in accordance with GAAS and Government Auditing Standards (GAS) and specifies that all "major federal programs" (defined) should be tested for effectiveness of the internal control structure--both accounting and administrative controls--and compliance with applicable laws and regulations, both general requirements and specific program requirements. The AICPA, working with OMB, developed the reporting formats to satisfy A-128 and the Act.

Also, a concept of a "dual client" relationship grew out of the Act. CPAs performing Single Audits had to consider not only audit client concerns but also those of the federal agency overseeing the audit. Indeed, federal agencies were as interested in the scope, extent of work and reporting on Single Audits as were managements of audited entities.

Nonprofit organizations were not specifically covered by A-128. However, many nonprofit entities became subject to audits in accordance with A-128 because of their subrecipient relationships with state or local governments. Nonprofits not subject to A-128 were subject to audits in accordance with terms of their government contracts or agreements, which generally referenced A-102 Attachment F.

To clarify this situation and to establish uniform audit requirements over nonprofits, OMB issued A-133. Its requirement is similar to A-128; however, there is significant operational difference.

A-128 has direct applicability to state and local government recipients of FFA because it was issued pursuant to federal law. A-133, on the other hand, is not applicable to nonprofit recipients unless it is made applicable by individual grantor agencies. Thus, it is possible that some federal agencies may not adopt A-133 into their regulations just as some did not adopt A-110.

DEFINITIONS AND MISCONCEPTIONS

Audit requirements of these OMB Circulars may include concepts new to many nonprofit managers and independent auditors. It is therefore helpful to explain key concepts and definitions and correct any misconceptions. A comparison of key requirements of A-110, A-128 and A- 133 is presented as an accompanying sidebar.

Applicability

A-133 relates to federal agency grants management. As previously discussed, it does not directly apply to nonprofit federal assistance recipients. Those recipients are subject to audit requirements identified in their grant/award agreements, which currently may refer to A-110 or other requirement, such as A-128. Nonprofits and their auditors should contact the grantor agency to ascertain how A-133 affects grant agreements. For example, if a state or local government passes through federal assistance to a nonprofit, it may have required an A-128 audit of the nonprofit subrecipient. In this case, it is not clear whether A- 133 would replace A-128. Nonprofit recipients and their auditors should not assume A-133 automatically applies. Applicability must be determined by the federal grantor agencies

Types of Audits

If A-133 is applicable, there may still be alternative types of audits that may be conducted. If a nonprofit receives at least $25,000 but less than $100,000 a year in federal awards, it may have an A-133 audit or an audit of each federal award in accordance with the audit requirements governing each award. Even if a nonprofit receives federal awards of $100,000 or more, it may still have an option if the awards are for only one federal program. In that case there would be a choice: it could have an A-133 audit or an audit of that one program in accordance with applicable audit requirements. In that regard all student financial assistance programs are treated as one major program as are all research and development programs.

Furthermore, nonprofits that have only loan guarantees or outstanding loans made previously to A-133, may be subject to continuing audit requirements in accordance with the original grant terms.

Federal Financial Assistance

FFA includes cash assistance to carry out program activities and non- cash assistance such as donated commodities, insurance, loan guarantees and property. It may be assistance provided directly by the federal government or indirectly by a direct recipient.

FFA for purposes of A-133 does not include direct cash assistance to individuals such as welfare or food stamps. It also does not include federal payments to vendors that are defined to be "organizations providing a recipient or subrecipient with generally required goods or services that are related to administration of the program." Medicare and Medicaid payments fall into this category.

Government Auditing Standards

GAS are established by the Comptroller General of the U.S. and were revised in 1988. They differ from GAAS in a number of ways but primarily in their emphasis on compliance with laws and regulations, documentation, and reporting. An audit in accordance with GAS does not automatically satisfy the audit requirements of A-133 or A-128 because each circular has scope considerations that go beyond GAS. As related to the scope of traditional audits of financial statements, there are no major differences between GAAS and GAS.

Effective Date

A-133 is effective for audits of fiscal years beginning on or after January 1, 1990, with earlier application encouraged. Attachment F of A- 110 continues to apply until A-133 is implemented. However, A-133 permits audits to be performed either annually or biannually. Therefore a nonprofit may elect to delay implementation of A-133 until its fiscal year 1991 and have the audit cover two fiscal years. Any election that prolongs implementation may be preferable at this time.

Also, it is advisable that nonprofit organizations contact grantor agencies to discuss the timing of the implementation of A-133.

Cognizant Agency

A cognizant agency is the federal agency assigned by OMB to ensure implementation of A-133, provide technical advice, perform quality control reviews of the audits and certain other specific responsibilities for an entity receiving FFA. A cognizant agency is assigned to the larger nonprofit institutions, and it would generally be the agency providing the largest amount of FFA to that institution. If a cognizant agency is not assigned, nonprofit organizations should look to their largest grantor agency for advice and assistance. That agency is referred to as the "oversight agency" in order to differentiate it from cognizant agencies.

Because of the quality control review aspect of these responsibilities, the cognizant agency is virtually a second client, creating the "dual client" relationship alluded to earlier.

Major Programs

Major programs are defined in A-133 and are the primary focus of audit work. A major program is any award or category of award for which total expenditures are the larger of 3% of total federal funds expended or $100,000.

Consistent with the determination of the number of grantors of funds, for this determination all research and development program categories and student financial assistance program categories should be combined, respectively. For example, if all student financial assistance awards are greater than the larger of 3% of total federal expenditures or $100,000, then these awards in total are defined as a major program.

AUDIT REQUIREMENTS

A-133 specifies the scope of audit that should be performed, and identifies the reports to be rendered by the independent auditor. It is easiest to understand the composition of an A-133 audit by focusing on its end results--the reports. Reporting on the following is required:

* General Purpose Financial Statements prepared in accordance with GAAP.

* Schedule of federal financial assistance.

* Internal control structure established to ensure compliance with laws and regulations that have a material impact on the general purpose financial statements.

* internal control structure established to ensure federal awards are being managed in compliance with applicable laws and regulations.

* Reportable conditions including identification of material weaknesses in controls.

* Compliance with laws and regulations including:

-opinion on compliance with specific laws and regulations for each major federal assistance program;

-for the other federal assistance programs, positive assurance on items tested and negative assurance on items not tested;

-material findings of noncompliance.

* Fraud or illegal acts of which the auditor becomes aware.

* Status of significant uncorrected findings and recommendations from prior audits.

It is important to understand that materiality levels may differ depending on the report to be issued. Specifically, for the following three reports materiality would be at the general purpose financial statement level:

* Report on the general purpose financial statements.

* Report on internal control structure.

* Report on compliance with laws and regulations that would have a direct and material effect on the general purpose financial statements.

Additional reports are required that focus on materiality at the FFA level:

* Report on schedule of FFA

* Report on internal control structure (accounting and administration) over FFA.

* Report on compliance with general requirements.

* Report on compliance with specific program requirements.

* Illegal acts and questioned costs.

To render these reports, A-133 specifies the audit should be conducted by an independent auditor in accordance with GAS on an organization-wide basis. GAS embody all of GAAS but have additional requirements dealing with continuing professional education, quality control, documentation and reporting.

A-133 also specifies expanded audit scope in certain areas. For example, the auditors must not only obtain an understanding of the internal control structure and assess levels of internal control risk in accordance with SAS 55, but also must "perform tests of controls to evaluate effectiveness of the design and operation of the policies and procedures in preventing or detecting material noncompliance" whether or not the auditor intends to asses control risk below the maximum. Also, the auditor is required to review the system for monitoring subrecipients and whether "controls are in effect to ensure direct and indirect costs were computed and billed in accordance with" general compliance requirements.

To report on compliance, the auditor must "select an adequate number of transactions from each major federal financial assistance program so the auditor obtains sufficient evidence to support the opinion on compliance." For tested transactions the auditor must determine whether a) expenditures were allowable, b) beneficiaries were eligible, c) matching, level of effort, and earmarking limitations were met, d) financial reports and claims are supported by books and records from which financial statements were prepared and, e) that amounts claimed or used for matching were in accordance with relevant federal cost principles.

UNRESOLVED ISSUES

There are a number of open issues involving application of A-133. Nonprofits should begin planning for A-133 audits but should remain flexible in anticipation of future, more specific guidance.

Compliance Requirements

The major unresolved issue is identification of the specific program compliance requirements. OMB is preparing a Compliance Supplement for Single Audits of Educational Institutions and Other Nonprofit Organizations which will identify compliance requirements for the largest nonprofit programs covering areas of allowable services, eligibility, matching requirements, and reporting. Many programs are the same for state and local governments and these compliance requirements are presented in Compliance Supplement for Single Audits of State and Local Governments. Nevertheless, it is probably too early to adequately identify necessary compliance tests that will be required under A-133.

Other Audit Guides

Another open issue is applicability of other federal agency audit guides. The Department of Education issued Audit Guide--Student Financial Assistance Programs (SFA Audit Guide) which specifies audit requirements for planning, field work and reporting on eligible student financial assistance programs. A-133 defines student financial assistance programs as a single category of major programs, yet it does not provide guidance on continued applicability of the SFA guide in an A-133 audit.

Similarly the Department of Health and Human Services issued Guidelines for Audits of Federal Assistance to Nonprofit Organizations. It is not clear how this guidance might be applicable to an A-133 audit. For state and local government entities OMB issued Questions and Answers on Single Audit Provisions of Circular A-128. it resolves a number of issues dealing with A-128; it is not clear whether OMB will issue a similar document for A-133.

Applicability of A-133

A nonprofit institution is defined to include institutions of higher education other than governmental entities audited pursuant to A-128, but the definition excludes hospitals except those affiliated with an institution of higher education. It is not clear whether hospitals affiliated with higher education hospitals are included, whether hospitals that have elements of both nonprofit organizations and hospitals such as research hospitals are included, or whether nonprofits which have clinics or other medical care services are included.

Continuing Professional Education

Continuing professional education (CPE) requirements for auditors remains an open issue under both A-128 and A-133 audits. GAS require 24 hours of CPE in areas directly related to the governmental environment. Guidance is lacking, however, as to which courses qualify. For example, if an auditor audits a hospital, a college, and a state and local government, is 24 hours required in each environment or would eight hours in each be satisfactory? GAO promised question and answer guidance on CPE requirements but it is as yet unpublished.

Form of Reports

The type of reports to be issued are named in A-133, but it does not include illustrative wording. The AICPA is working on a pronouncement that will clarify the matter.

Department Audits

Circular A-128 permits the entity subject to the Act to be defined as a department of a state or local government. This option may be helpful when only one or two departments receive the great majority of FFA. It is not clear whether this option will be permitted under A-133. For example, can a college or university with multiple campuses but with only one or two receiving the majority of federal financial assistance, satisfy A-133 on a campus by campus basis?

Extent of Internal Control Review

An A-128 audit requires a test of internal controls over federally assisted programs to the point that programs for at least half the amount of FFA are covered. If major programs do not comprise half of the FFA, an auditor is required to extend the programs tested to non-major programs until the 50% requirement is met. This provision was established in the AICPA State and Local Audit Guide and was endorsed by the Federal Inspectors General. It is not clear whether this feature will be extended to A-133 audits.

RELATED DEVELOPMENTS

Efforts are underway to assist nonprofits and their auditors to satisfy requirements of A-133. The AICPA has a project to provide guidance on compliance requirements, Statement of Position (SOP), "Compliance Auditing of Not-for-Profit Organizations. " The SOP is under review by the AICPA Not-for-Profit Organizations Committee. It must then go to the ASB for approval followed by exposure for public comment.

As noted earlier, OMB is preparing a Compliance Suppletnent for Single Audits of Educational Institutions and Other Nonprofit Organizations. A final document is not expected until early 1991.

The AICPA CPE Division is developing a course for A-133 that should be offered in 1991.

Finally, the GAO is preparing a question and answer document addressing CPE issues; it is uncertain as to when a final document will be issued.

FINAL NOTE

Because of the many unresolved issues, it is essential that the CPA and nonprofit managements watch attentively for developments. in the meantime, affected parties should proceed cautiously when implementing A-133.

IMPLEMENTING A-133

Even though all the specifics of implementing A-1 33 are not known, it is wise to begin to assess the ability to implement it. The following threshold questions should 6e asked of a nonprofit entity.

1. Is the nonprofit potentially subject to A-133?

It is applicable if the entity is a) a nonprofit institution as defined, b) an institution of higher education not subject to an A-1 28 audit, or c) a hospital affiliated with a higher education institution.

2. Must the nonprofit implement an A-133 audit?

The entity must do so if a) it receives $100,000 or more of FFA through more than one program, b) it receives more than $25,000 but less than $1 00,000 of FFA and elects to implement A-133, or c) it receives FFA of $1 00,000 or more from only one program and does not elect to continue with a program audit.

3. Do the grantor agencies agree that the nonprofit should adopt A- 133?

The nonprofit should discuss application of A-133 with its grantor agencies. In most cases, it is the grantor agency that will decide whether A-133 should be implemented for a program.

Once these questions are resolved and it is determined that an A-133 audit will be implemented, the following questions should be considered.

4. Is a schedule of FFA prepared?

The nonprofit must prepare a schedule of FFA that a) identifies FFA programs as research and development, student financial assistance or by catalogue number from the Catalog of Federal Domestic Assistance, b) shows total expenditures for each program, c) identifies major programs, d) shows the value of noncash assistance such as loan guarantees or commodities, and e) shows the outstanding balance of loans.

5. Is there a system of control over subrecipients?

Nonprofits that provide $25,000 or more to subrecipient must a) ensure that the subrecipient satisfies either A-133 or A-128 as applicable, 6) ensure appropriate corrective action is taken by the subrecipient within six months of receiving a report of noncompliance with federal laws and regulations, c) adjust its own records based on audit of subrecipients as appropriate and d) ensure that recipients' auditors have access to subrecipient records of financial statements.

6. Is there an internal control structure that provides reasonable assurance that the nonprofit is managing federal awards in compliance with applicable laws and regulations and contract terms and is safeguarding federal funds?

The nonprofit should identify its internal control structure policies and procedures established that are designed to provide reasonable assurance that a) financial statements are prepared in accordance with GAAP and are free of material misstatements, b) federal programs are operated in compliance (accounting and administrative) with laws and regulations, and c) direct and indirect costs are compiled and billed in accordance with laws and regulations. The nonprofit should 6e able to demonstrate these policies and procedures have been put in place and are operating effectively.

7. Can the nonprofit demonstrate it has complied with laws and regulations over major FFA programs?

The nonprofit should be able to demonstrate a) reported expenditures were allowable, b) program beneficiaries were eligible, c) matching, level of effort, or earmarking limitations were met, d) federal financial reports and claims are supported by books and records from which the financial statements were prepared, and e) amounts claimed or used for matching were determined in accordance with applicable federal cost principles.

8. Does the nonprofit follow up on uncorrected significant and material findings and recommendations from prior audits?

This is a specific reporting requirement under A-133.

Patrick F. Hardiman, CPA, is a Senior Manager in the National Office of Deloitte & Touche, concentrating on the governmental and nonprofit sectors of his firm's practice. Mr. Hardiman was formerly in the Comptroller's office of The City of New York, and has written for accounting and professional journals.

Stanley Corfman, CPA, is Assistant Executive Director and CFO of the YWCA of the U.S.A, National Board.

Carla Hunter, CPA, is Controller for the City Center of Music and Drama, Inc, New York City Opera and New York City Ballet Ms. Hunter is a member of the AICPA NYSSCPA CFO/ ARTS, and the Financial Women's Association.

Daniel H. Kalin, JD, CPA, is the Financial Manager of Odyssey House of New York, Inc Mr. Kalin joined the nonprofit sector after 12 years in Fortune 200 financial and management positions.