Attachment J USAID Financial Audit Guide for Foreign Organizations.pdf

USAID Financial Audit Guide for Foreign Organizations

A Mandatory Reference for ADS Chapter 591

Full Revision Date: 03/04/2019

Responsible Office: M/CFO File Name: 591maa_030419

Table of Contents

1. Purpose

1.1. Background

1.2. Applicability

1.3 Compliance with Auditing Standards

1.4 Audit Costs

1.5 Multiple Awards and Subrecipients

1.6 Audit Timelines

2. Roles and Responsibilities

2.1 USAID Operating Units

2.2 Office of Inspector General (OIG)

2.3 Auditee

3. Selection of an Auditor

3.1 USAID List of Audit Firms

3.2 Independent Audit Firms

3.3 Supreme Audit Institutions

4. Audits

4.1 Scope of Audit

4.2 Audit Objectives

4.3 Fund Accountability Statement

4.6 Audit Steps

4.7 Internal Controls

4.8 Compliance with Agreement Terms and Applicable Laws

4.9 Follow-up on Prior Audit Recommendations

4.10 Closeout Audits

5. Audit Reporting

Appendix 1

Appendix 2

Appendix 3

Appendix 4

Appendix 5

Acronyms

AICPA American Institute of Certified Public Accountants

CFR U.S. Code of Federal Regulations

GAAP Generally Accepted Accounting Principles

GAGAS Generally Accepted Government Auditing Standards

GAO U.S. Government Accountability Office

IAASB

International Auditing and Assurance Standards Board

IFAC International Federation of Accountants

IFRS International Financial Reporting Standards

INTOSAI International Organization of Supreme Audit Institutions

IPSAS

International Public Sector Accounting Standards

ISA

International Standards on Auditing

MCA

NFA

NICRA

Mission Contracted Audit

Non-Federal Audit

Negotiated Indirect Cost Rate Agreement

OIG USAID Office of the Inspector General

QCR Quality Control Review

RCA Recipient Contracted Audit

RIG USAID Regional Inspector General

SAI Supreme Audit Institution

1. Purpose

1.1. Background

The U.S. Agency for International Development (USAID) administers foreign economic development and humanitarian assistance programs on behalf of the United States Government.

USAID consists of a central headquarters staff in the United States and a number of overseas Operating Units and Offices. It provides assistance to countries through both non-U.S. nongovernmental and non-U.S. public (governmental) organizations that support programs generally managed at an Operating Unit level (and, on an exception basis, by headquarters offices).

The USAID Financial Audit Guide for Foreign Organizations (Guide) is to be used by foreign organization recipients, referred to as "recipients" throughout this Guide (see section 1.2 Applicability) and independent auditors to assist them with meeting the financial audit requirements of USAID awards. Awards1 are defined as USAID-funded grants, contracts, and cooperative agreements. The Guide also provides guidance to recipients in selecting independent auditors to perform the financial audits.

USAID awards require financial audits as prescribed by the Single Audit Act Amendments of 1996 (31 USC 7501-7506) and the Office of Management and Budget (OMB) Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). The purpose of the Single Audit Act Amendments of 19962 and the Uniform Guidance are to promote sound financial management, including effective internal controls; establish uniform requirements for audits of federal awards; promote the efficient and effective use of audit resources; and reduce burden.

To meet these requirements, recipients of USAID awards contract independent auditors to perform annual financial audits consistent with 2 CFR 200.

This Guide is issued by USAID’s Office of the Chief Financial Officer and supersedes any previous USAID Office of Inspector General (OIG) Guidelines for Financial Audits Contracted by Foreign Recipients. This Guide primarily focuses on recipient contracted audits (RCA), Agency contracted audits (ACA), and Mission contracted audits (MCA).

These audits were referred to as non-federal audits in previous guidance. This Guide is not applicable for audits conducted by the Office of the Inspector General (OIG) or Government Accountability Office (GAO).

1.2. Applicability

1 2 CFR 200.101 (b)(1) Applicability to different types of federal awards.

2 Single Audit Act Committee on Governmental Affairs US Senate May 13, 1996.

USAID assistance to foreign organizations3 and foreign public entities4 provide provisions for recipient responsibilities on annual financial audits. For federal financial assistance awards (ADS 303), the audit requirement in 2 CFR 2005, sets the audit threshold at $750,000 or more in combined federal fund expenditures during the recipient’s fiscal year. In the year an award concludes, the annual audit scope will be expanded to fulfill the closeout audit requirements. Even if an award does not meet the $750,000 audit threshold, the USAID Operating Unit may determine that an audit is warranted6. Some reasons may include a need to mitigate risk or prevent fraud, waste, and abuse.

Additionally, 2 CFR 2007, requires recipients to ensure their subrecipients, who expend $750,000 or more in federal funds within their fiscal year, are also audited. Further guidance is provided in section 1.5 Multiple Awards and Subrecipients.

The Food for Peace Development Assistance Program and Food Peace Emergency Program must also follow the 2 CFR 200, Appendix XI, Compliance Supplement issued April 2017 and April 2018 (both Supplements)8. The audit procedures to test compliance with the requirements for these federal programs are outlined in the document’s “Matrix of Compliance Requirements”. The auditor must use this Compliance Supplement guidance to perform the audits for any funds expended under these programs.

The requirements of 2 CFR 200 do not apply directly to USAID bilateral agreements with foreign public entities (such as agreements with public international organizations (PIOs) (ADS 308) and government-to-government assistance (ADS 220). However, agreements with host country governments must contain a requirement for an independent auditor and have audits performed in accordance with this Guide (see section 3.3 Supreme Audit Institutions). Agreements with PIOs must follow ADS 308 and its standard provisions, which contain a requirement for an independent audit.

3 2 CFR 200.47 Foreign organization means an entity that is: (a) A public or private organization located in a country other than the United States and its territories that are subject to the laws of the country in which it is located, irrespective of the citizenship of project staff or place of performance; (b) A private nongovernmental organization located in a country other than the United States that solicits and receives cash contributions from the general public;

(c) A charitable organization located in a country other than the United States that is nonprofit and tax exempt under the laws of its country of domicile and operation, and is not a university, college, accredited degree granting institution of education, private foundation, hospital, organization engaged exclusively in research or scientific activities, church, synagogue, mosque or other similar entities organized primarily for religious purposes; or (d) An organization located in a country other than the United States not recognized as a Foreign Public Entity.

4 2 CFR 200.46 Foreign public entity means: (a) A foreign government or foreign governmental entity; (b) A public international organization, which is an organization entitled to enjoy privileges, exemptions, and immunities as an international organization under the International Organizations Immunities Act (22 USC 288–288f); (c) An entity owned (in whole or in part) or controlled by a foreign government; or (d) Any other entity consisting wholly or partially of one or more foreign governments or foreign governmental entities.

5 2 CFR 200.501

6 Exemption when federal awards expended are less than $750,000 pursuant to 2 CFR 200.501 (d) and 200.503.

7 2 CFR 200.101(b)(1) Applicability to different types of federal awards. Non-federal entities must comply with requirements in this part regardless of whether the non-federal entity is a recipient or subrecipient of a federal award.

8 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A133/2017/Compliance_Supplement_2017.pdf and https://www.whitehouse.gov/wp-content/uploads/2018/05/2018-Compliance-Supplement.pdf

1.3 Compliance with Auditing Standards

In accordance with 2 CFR 200 and the terms of the award, audits of USAID funds provided to foreign organization recipients are to be performed by an independent auditor in accordance with U.S. Generally Accepted Government Auditing Standards (GAGAS or the Yellow Book); herein referred to as “GAGAS”, issued by the Comptroller General of the United States Government Accountability Office.9 In relation to other professional standards, an auditor may elect to apply the standards established by the International Auditing and Assurance Standards Board (IAASB) and the related International Standards on Auditing (ISA), although these standards must be applied in conjunction with GAGAS. The International Standards of Supreme Audit Institutions (ISSAIs) issued by the International Organization of Supreme Audit Institutions (INTOSAI) for public-sector audits may be used in conjunction with

GAGAS.

In order to assist recipients in selecting a qualified audit firm, USAID maintains a list of audit firms that have experience complying with USAID auditing standards. To be compliant with 2 CFR 200, auditors and audit organizations must provide services in accordance with GAGAS and be independent from an audited entity. The cost of audit services failing to meet these standards may be found disallowable. USAID is aware that some possible auditors contacted by foreign organizations’ recipients initially may not fully comply with this Guide because of a lack of technical knowledge and experience in using GAGAS. The USAID cognizant Controller will assess and consider this lack of institutional capability prior to the decision whether to accept the use of the audit firm for the required audit services. The USAID Controller may note and remove any auditors from the list of eligible audit firms that do not make adequate progress in upgrading their audit capabilities to comply with GAGAS (see section 3.1 USAID List of Audit Firms).

1.4 Audit Costs

Recipients may charge to USAID awards a reasonably proportionate share10 of the costs for performing the specific audit of their USAID-funded awards.11 The costs to be charged to the USAID awards will be a matter for negotiation at the time of award between USAID and the recipient. For audits meeting the $750,000 audit threshold, the audit firm is required to produce a final audit report that is approved by the OIG.

For all other audits, the final audit report must be accepted by the cognizant USAID Operating Unit.

9 GAGAS incorporates the American Institute of Certified Public Accountants (AICPA), Professional Standards that include

Statements on Auditing Standards (SASs). The SASs includes an “AU-C” identifier which represents section(s) in the Codification of SASs. The Codification was designed for clarity and converged the standards with the International Standards on Auditing (ISAs). See AICPA Clarified Statements on Auditing Standards (https://www.aicpa.org/research/standards/auditattest/clarifiedsas.html) 10 2 CFR 200.425(a) 11 See also ADS 303mab Mandatory Standard Provisions for Non-U.S. Nongovernmental Organizations M2.

If the USAID Operating Unit returns the work of an audit firm for revision due to noncompliance with professional auditing standards, only the cost of the audit work in accordance with the terms of the award may be charged to USAID until the final audit work is accepted. Any additional costs incurred in correcting deficient audit reports will not be reimbursed by USAID unless USAID provided prior approval to reimburse additional costs. Should the audit firm fail to make its report acceptable, a different audit firm may be requested to perform another audit. In such case, the original audit firm will not be considered acceptable to perform future audits until the cognizant Operating Unit determines otherwise and the firm is capable of substantially improved performance (see section 3.1 USAID List of Audit Firms).

1.5 Multiple Awards and Subrecipients

Some recipients may receive federal funding from more than one USAID award, from multiple USAID Operating Units, and/or from subawards provided by other U.S. or foreign entities, referred to as pass-through entities12. A recipient receiving subaward(s) from a pass-through entity is considered a subrecipient13. Under such circumstances, one annual financial audit covering the auditee’s (see section 2.3 Auditee) financial statements is required. The financial statements must include a schedule of expenditures of federal awards, referred to as a fund accountability statement that identifies funds for each specific federal award and USAID Operating Unit (see Appendix 2 Illustrative Report).

The responsibility as the cognizant office falls to the Operating Unit with the preponderance of USAID funds expended by the recipient.14 Both the cognizant Operating Units and the pass-through entities may attend the audit entrance and exit conferences, as necessary. The cognizant Operating Unit will be responsible for the management decisions related to the recommendations and questioned costs for their awards. Recipient organizations providing funding to subrecipients are responsible for the questionable costs and audit follow-up for their subawards.

A subrecipient of one or more U.S. or non-U.S. recipients must have an annual financial audit in accordance with the provisions of its award if it meets the threshold of $750,000 expenditures within the subrecipient’s fiscal year. When a non-U.S.

organization recipient of direct USAID assistance is a subrecipient of a U.S. recipient organization in addition to receiving funds directly from USAID as a recipient, then the annual audit performed must include the funding passing through the U.S. recipient organization. If a non-U.S. organization recipient is only a subrecipient to a U.S.

organization recipient, then the annual audit is subject to the guidelines provided under ADS 591.3.1, Audits of U.S. Organizations. If a subrecipient audit covers multiple recipients, the audit costs should be managed by the recipient with the largest expended amount and the cost shared on a pro-rata basis of the funds audited. The cognizant Operating Unit will make the determination as part of the annual audit plan.

12 Pass-through entities are defined in 2 CFR 200.74 13 Subrecipients are defined in 2 CFR 200.93 14 USAID Operating Units can access reports in the TRACS database to determine the amount of funds expended per recipient.

Subrecipients, some of which receive funding from multiple USAID recipients, manage a large portion of USAID funding. Consistent with USAID award provisions15, each recipient is responsible for ensuring they have full information about the combined total federal fund expenditures of their subrecipient(s) and monitoring the audit requirements of its subrecipients or contracts.

1.6 Audit Timelines

The recipient must submit final audit reports to the cognizant USAID Operating Unit as soon as possible and pursuant to the terms of the contract with the audit. Pursuant to the current award provisions, the final audit report must be submitted to USAID within 30 days after the recipient receives the auditor’s report, but no later than nine months after the end of the period audited. For audits meeting the $750,000 audit threshold, the cognizant Operating Unit should receive the final audit report within six months after the recipient’s fiscal year end, noting that the Operating Unit must have the final audit report in time to forward to the cognizant OIG audit unit no later than nine months after the recipient’s fiscal year end to be compliant with 2 CFR 200.

To meet these timelines, the selection of an independent audit firm (see section 3 Selection of Audit Firm), beginning the audit process, and interim audit work are likely needed before the close of a fiscal year, since initiating audits after the close of a fiscal year could hinder timely audit reporting and may restrict the scope of certain audit procedures, leading to additional questioned costs.

2. Roles and Responsibilities

2.1 USAID Operating Units16

USAID Operating Units are Missions, regional entities, and Washington-based Offices that expend U.S. federal funds. They must monitor the submission of required audit reports and encourage recipients to begin the audit process as soon as possible. For each audit of any amount of expenditures,17 the cognizant Operating Unit must take actions to ensure that their recipients meet the federal funds audit compliance standards. To meet this end, the cognizant Agreement Officer’s Representative can provide the Statement of Work (SOW) template (see Appendix 1) for the recipient to use when contracting audit services; the cognizant Controller will provide a list of acceptable audit firms available for the recipient to use; the cognizant AOR may review the final SOW; and the cognizant Operating Units may provide further assistance, expertise, as well as participate in the audit entrance and exit conferences, as needed.

15 See also ADS 303mab Mandatory Standard Provisions for Non-U.S. Nongovernmental Organizations M2.

16 USAID ADS Glossary: Operating Units are USAID field Missions, regional entities, and USAID/Washington Offices that expend funds to support Agency program objectives.

17 Audits with expenditures less than $750,000 will be entirely managed and resolved by the USAID Operating Unit.

Each USAID Operating Unit is responsible for timely submission (see section 1.6 Audit Timelines) of final audit reports meeting the $750,000 threshold to the cognizant OIG audit unit, preparing its own management decisions, and acting upon findings and recommendations applicable to its agreements with the recipient. For audits below the $750,000 threshold, the cognizant Operating Units will solely manage the audit without OIG audit unit interaction, unless directed otherwise.

Pursuant to 2 CFR 20018, USAID must take appropriate action in the event that their recipient has a continued inability or unwillingness to have an audit performed in accordance with the Guide. Remedies will be handled by the terms and conditions of the recipient’s agreement and could include suspension of disbursements to the recipient until a satisfactory audit is performed.

2.2 Office of Inspector General (OIG)

The OIG monitors the quality of financial audits by independent auditors meeting the $750,000 audit threshold. For these audits, the OIG performs desk reviews of final audit reports for compliance with professional reporting standards, including GAGAS.

After its review, the OIG will either reject the report and return it to USAID or issue a memorandum that transmits the audit report to USAID with any recommendations needing action. The transmittal memorandum is publically available on its external Web site.

The OIG does not normally conduct desk reviews of financial audit reports covering less than $750,000 in expenditures within the recipient’s fiscal year, but can do so at its discretion.

2.3 Auditee

The auditee, for the purposes of this document, is a recipient that expends federal awards which must be audited under 2 CFR 200. This includes USAID’s foreign organization recipients that expend a combined total of $750,000 or more in federal funds either directly or through another federally funded contractor or recipient (excluding fixed priced contracts and fixed amount awards), or recipients procuring audit services otherwise required or permitted by their USAID award.

In conformance with their USAID award, auditee responsibilities should be consistent with 2 CFR 20019 and failure to comply may result in the disallowance of costs.

Pursuant to 2 CFR 20020, the auditee responsibilities include procuring the audit work in accordance with GAGAS, preparing the appropriate financial statements including the fund accountability statement,21 prompt follow-up and corrective actions on audit findings, and providing the auditor with access to personnel, accounts, books, records, 18 2 CFR 200.505

19 2 CFR 200.508

20 2 CFR 200.509

21 The fund accountability statement meets the 2 CFR 200 requirement for a schedule of expenditures 2 CFR 500.510(b).

supporting documentation, and other information as needed for the auditor to perform the required audit services. In accordance with 2 CFR 20022, the auditee’s financial statements must reflect its financial position, results of operations or changes in net assets, and cash flows for the fiscal year audited.

3. Selection of an Auditor23

3.1 USAID List of Audit Firms

USAID maintains a list of audit firms that have experience with USAID-funded audits or have been screened and accepted by the cognizant Controller or designated Financial Analysts. The list provides information about each audit firm and their demonstrated ability to conduct a reliable audit that results in high-quality audit reports in accordance with this Guide’s section on “Compliance with Auditing Standards”. Prior to beginning any USAID-funded audit work, USAID advises that recipients choose an independent auditor from the List of Audit Firms. Failure to use a USAID-approved audit firm from the List of Audit Firms could result in an unacceptable audit report and disallowance of costs.

The cognizant Controller may decide to screen an audit firm not currently on the USAID List of Audit Firms. The process to critically examine a potentially acceptable audit firm may take time depending on the country’s audit environment. The cognizant Controller may determine that there is insufficient time to screen the audit firm and still meet the audit deadlines (see section 1.6 Audit Timelines). In this case, the Controller will offer any needed guidance to recipients regarding the List of Audit Firms. It is recommended to give the Controller at least six months advance notice to screen a new audit firm. USAID encourages local audit firms and rotating audits among eligible audit firms to ensure independence. USAID bases the decision to accept an audit firm for the List of Audit Firms on a combination of factors, including prior experience, host country audit environment, and Operating Unit-specific requirements. Below are the baseline criteria for all audit firms analyzed for the List of Audit Firms:

1. Audit firm meets ability to produce reports in English.

2. Audit firm has sufficient quality control program in place that meets the GAGAS quality control and external peer review standards.

3. Audit firm has received a passing quality control review within three years.

4. Audit firm is a good standing member of the AICPA or the country’s public accounting organization (PAO), which complies with the statements of membership obligations of IFAC, or another internationally recognized standard setting body.

22 2 CFR 200.510

23 2 CFR 200.509

5. Audit firm has been in operation at least three years, or its partners have previous acceptable experience with USAID-funded audits.

6. Audit firm requires continuing professional education (CPE) meeting GAGAS for audit partners and audit staff.

7. Audit firm senior staff has a Chartered Accountants or Certified Public Accountant designation.

8. Other possible considerations:

a. Affiliation with international audit firm.

b. Continuing Professional Education Program, differing from GAGAS.

c. Recent experience with USAID audits.

A firm may be noted for lacking certain criteria and determined not acceptable on the USAID List of Audit Firms. Auditors submitting unacceptable work or audit firms that do not provide timely responses to USAID’s requests may also be noted and excluded from the list. Audit firms may also be removed from the list if they have not performed any audits under this Guide for a period of five years. However, USAID will give firms an opportunity to update their information before removing them or give firms an opportunity to update their information and apply to be reinstated on the list.

USAID may consider pursuing further repercussions with U.S. affiliates of audit firms that do not perform audits in accordance with the requirements of 2 CFR 200, and accept audit work beyond their proven scope of abilities.

In conjunction with the List of Audit Firms, the recipient’s selection of an independent auditor should be based on factors such as the audit firm’s past performance in terms of quality, timeliness, and ability to conduct audits in accordance with professional auditing standards (see section 1.3 Compliance with Auditing Standards).

3.2 Independent Audit Firms

Auditors and audit firms should avoid situations that could lead reasonable and informed third parties to conclude that the auditors and audit firms are not independent and thus are not capable of exercising objective and impartial judgment on all issues associated with conducting the engagement and reporting on the work. Auditors and audit firms should be independent from an audited entity during and for any period of time that falls within the period covered by the financial statements or subject matter of the engagement unless the non-audit service was provided prior to the period of professional engagement; the non-audit service relates only to periods prior to the period covered by the financial statements; and the financial statements for the period to which the non-audit service relate have been audited by other auditors (or in the case of an examination, review, or review of financial statements, examined, reviewed, or audited by other auditors as appropriate).

In addition and pursuant to 2 CFR 200.509(b), an auditor who prepares the indirect cost proposal or cost allocation plan may not also be selected to perform the audit required by this part when the indirect costs recovered by the auditee during the prior year exceeded $1 million. This restriction applies to the base year used in the preparation of the indirect cost proposal or cost allocation plan and any subsequent years in which the resulting indirect cost agreement or cost allocation plan is used to recover costs.

Since non-audit services that auditors provide can affect independence of mind and appearance in periods after the non-audit services were provided, USAID would like to be notified of any such circumstances.

In accordance with the GAGAS, independence is defined as an independence of mind and independence in appearance. The state of an independent mind is one that permits the conduct of an engagement without being affected by influences that compromise professional judgment, thereby allowing an individual to act with integrity and exercise objectivity and professional skepticism. Independence in appearance means the absence of circumstances that would cause a reasonable and informed third party to reasonably conclude that the integrity, objectivity, or professional skepticism of an audit organization or member of the engagement team had been compromised.

The OIG, cognizant Controller, and Operating Unit may conduct reviews of the audit firms that conduct audit services of USAID funds. All audit records including the auditor’s working papers24 related to the USAID recipient and their subrecipients must be available to complete and support their review of the audit work. These reviews may be used to determine whether the audit work was performed in accordance with their contract and appropriate standards, and can result in a change in the audit firm’s eligibility to conduct audits of USAID funds. The Operating Unit will notify the recipient and the auditors of the results of these reviews.

3.3 Supreme Audit Institutions

The recipient country's principal government audit agency, often referred to as its "Supreme Audit Institution" (SAI), may audit foreign public entities under this Guide.

However, SAIs will only be accepted to audit USAID funds if the USAID cognizant Controller, or designee, determines that the SAI:

Complies with U.S. Generally Accepted Government Auditing Standards (GAGAS) or the International Auditing and Assurance Standards Board (IAASB)

24 31 U.S.C. 7503(f) standards and the related International Standards on Auditing (ISA) and International Standards on Assurance Engagements in conjunction with

GAGAS.

Complies with International Standards of Supreme Audit Institutions (ISSAIs) issued by the International Organization of Supreme Audit Institutions (INTOSAI) for public-sector audits in conjunction with GAGAS.

Is in fact in mind and in appearance, independent of the government recipient organizations to be audited and the executive branch of the government, and substantially meets the independence requirements set forth in GAGAS.

Does not participate in any way in pre-control, contract or transaction approval, check signing, or other activity that is incompatible with the audit function.

Maintains a professionally prepared and competent staff of duly qualified and licensed certified public accountants, or equivalent, experienced in the performance of financial audits and appropriately supervised by more experienced auditors.

Maintains a continuing program of staff training and professional development for its audit staff.

Agrees to perform audits pursuant to this Guide.

USAID may support SAIs in developing their auditing manuals, audit quality control systems, and other audit needs by facilitating coordination between SAIs and other resources, such as the U.S. GAO Center for Audit Excellence, before the SAI conducts audits of USAID funds. The cognizant USAID Operating Units will consider assisting SAIs if they manifest a desire to perform professional quality audits of USAID-financed activities and the recipient government places a high priority upon this function.

In the event that an SAI demonstrates an inability or unwillingness to perform audit work in compliance with this Guide, USAID will not accept its work until the SAI is capable of substantially improving its performance. If an SAI's audit work is rejected, USAID may require an audit by a professional audit firm or, at its discretion, make arrangements for its own audit on behalf of the governmental recipient in accordance with the standard audit provisions in the USAID awards.

4. Audits

4.1 Scope of Audit

A financial audit of USAID funds provided to recipients must be performed in accordance with GAGAS, ISA in conjunction with GAGAS, or ISSAI in conjunction with GAGAS. The primary purpose of a financial statement audit is to provide an opinion about whether an entity’s financial statements are presented fairly in all material respects in conformity with an applicable generally accepted accounting principles or financial reporting standards. Reporting on financial statement audits performed in accordance with GAGAS also includes reports on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts, and grant agreements that have a material effect on the financial statements.

The financial audit must cover the entire operations of the recipient, including the recipient’s general purpose financial statements on an organization-wide basis (balance sheet, income statement, and where appropriate, cash flow statement) if the recipient has been authorized to use a provisional indirect cost rate25, or if the Operating Unit specifically requests such an audit. The financial statements and the Fund Accountability Statement must be for the same audit period.26

The independent auditor must determine whether the financial statements of the recipient are presented fairly in all material respects in accordance with U.S. generally accepted accounting principles (U.S. GAAP), International Financial Reporting Standards (IFRSs), or International Public Sector Accounting Standards (IPSAS). The independent auditor must also determine whether the fund accountability statement (also referred to as a schedule of expenditures of federal awards) is stated fairly in all material respects in relation to the recipient’s financial statements as a whole.27

For financial audits of awards without provisional indirect cost rates, the fund accountability statement is the basic financial statement to be audited. The fund accountability statement must not include cost-sharing or matching contributions provided from the recipient’s own funds or in-kind. The cost-sharing or matching contribution must be presented in a separate schedule. The opinion on the fund accountability statement must comply with Statement on Auditing Standard (SAS) No.

122 AU-C Section 805 Special Considerations - Audits of Single Financial Statements and Specific Elements, Accounts, or Items of a Financial Statement. SAS No.122 AU- C Section 805 is part of the AICPA Professional Standards which are incorporated into

GAGAS.

4.2 Audit Objectives

The financial audit objectives must include the following and as such should be reflected in the audit contract SOW (Appendix 1):

Express an opinion on whether the fund accountability statement for the USAID-funded programs presents fairly in all material respects in relation to the recipient’s financial statements as a whole and in revenues received, costs incurred, and assets, commodities, and technical assistance directly procured

25 For additional help on indirect cost rates, see USAID’s Indirect Cost Rate Guide for Non-Profit Organizations.

26 2 CFR 200.510 (a) & (b) 27 2 CFR 200.514 (a) & (b) with USAID funding for the period audited in conformity with the terms of the award and generally accepted accounting principles.

Evaluate the recipient's internal control related to the USAID-funded programs, assess control risk, and identify significant deficiencies including material weaknesses.

Perform tests to determine whether the recipient complied, in all material respects, with agreement terms (including cost-sharing or matching contributions, if applicable) and applicable laws and regulations related to USAID-funded programs.

Evaluate whether the recipient has met its cost-sharing or matching contributions, if required by the agreement.

Perform an audit of the indirect cost rate(s) if the recipient has been authorized to charge indirect costs to USAID using provisional or 10 percent de minimis rates and USAID has not yet negotiated final rates with the recipient.

If the recipient has been authorized to charge provisional indirect cost rates, then perform a financial audit of the recipient’s organization-wide general-purpose financial statements.

Determine if the recipient has taken adequate corrective actions on prior audit report recommendations, if applicable.

4.3 Fund Accountability Statement

The recipient must accept the responsibility for the accuracy of the fund accountability statement before the audit commences regardless of whether the recipient received assistance in the preparation of the fund accountability statement from the books and records maintained by the recipient.

The fund accountability statement must reconcile to USAID provided fund information, the accounting records, and bank statements of the recipient. All currency amounts in the audit report must be stated in U.S. dollars. The auditors should calculate the exchange rate at the time the local currency was disbursed to the recipient by USAID and indicate the exchange rate(s) in the notes to the fund accountability statement. In audits of recipients covering awards from more than one USAID Operating Unit, the fund accountability statement must separately disclose the financial information (revenues, costs, etc.) for each award and program, and identify the USAID Operating Units that provide funding. Each Operating Unit must be able to identify its award in the audit report for resolution of findings and recommendations with the recipient. The same reporting principles apply when only one USAID award is covered by the audit. Auditors must not express separate opinions on fund accountability statements of each award or program unless specifically requested to do so by USAID.

4.4 Cost-Sharing/Matching Schedule28

The audit should determine whether cost-sharing or matching contributions were provided and accounted for by the recipient in accordance with the terms of the agreements, if applicable. The auditors will review the cost-sharing or matching contributions schedule to determine if the schedule is fairly presented in accordance with the basis of accounting used by the recipient to prepare the schedule. The auditors should question all cost-sharing or matching contributions that are either ineligible or unsupported costs. In addition, for audits of awards that present a cost-sharing or matching contribution budget on an annual basis and for closeout audits of awards that present cost-sharing or matching contribution budgets on a life-of-project basis, the auditors will review the cost-sharing or matching contributions schedule to determine if cost-sharing or matching contributions were provided by the recipient in accordance with the terms of the agreement.

4.5 Indirect Cost Rates29

In the case that the recipient has been authorized to use provisional indirect cost rates, the audit must be performed on the actual indirect cost rates for the year. The audit of the indirect cost rates should involve tests to determine whether the distribution or allocation base and the indirect cost pools includes only items or costs authorized by the USAID awards and applicable cost principles. These tests should also confirm that the indirect cost rates are accurately calculated. Costs must be consistently charged as either indirect or direct costs, but may not be double charged or inconsistently charged as both. If chosen, this methodology, once elected, must be used consistently for all federal awards until such time as the recipient chooses to negotiate for a rate.

As further provided in federal regulation (2 CFR 200.414), any foreign recipient that has never received a NICRA may elect to charge a de minimis rate of 10 percent of modified total direct costs. If chosen, this methodology, once elected, must be used consistently for all federal awards until such time as the recipient chooses to negotiate for a rate.

Additional information on the allocation and determination of indirect cost rates is provided in 2 CFR 200 Appendix IV to Part 200 – Indirect (F&A) Costs Identification and Assignment, and Rate Determination for Nonprofit Organization.

28 Leverage of non-USAID resources is different from cost-sharing or matching contributions. Pursuant to ADS 303.3.27 (Public-

Private Partnerships) leveraging represents all non-USAID resources, excluding cost sharing, expected to be applied to a program. Leveraging is limited to Public-Private Partnership awards. Leveraging includes resources that third-parties bring to the program without necessarily providing them to the recipient of the USAID assistance awards. These parties may include the host government private foundations, businesses, or individuals. The recipient is not responsible for meeting the leveraging amounts/resources and leveraging is not subject to audit; ADS 303.3.10 Cost Share and 2 CFR 200.306 Cost-sharing or matching.

29 For additional help on indirect cost rates, see USAID An Indirect Cost Rate Guide for Non-Profit Organizations and https://www.usaid.gov/india/partner-resources/infographic-de-minimis-rate-indirect-costs

In the case that the recipient has been authorized to use provisional indirect cost rates, an audit of the recipient’s organization-wide general purpose financial statements is needed to ensure sound financial management and provide reasonable assurance that all costs have been correctly included in the indirect cost rate calculation.

4.6 Audit Steps

Auditors must design audit steps and procedures in accordance with GAGAS to provide reasonable assurance of detecting situations or transactions in which fraud or illegal acts have occurred or are likely to have occurred. If such evidence exists, the auditors must contact the appropriate USAID Operating Unit and should exercise due professional care in pursuing indications of possible fraud and illegal acts so as not to interfere with potential future investigations or legal proceedings.

Auditors must conduct their audit in accordance with the SOW (Appendix 1), obtain a management representation letter (Appendix 4), and consult the reference materials (Appendix 5). The SOW contains a list of 12 documents, as applicable, that must be reviewed prior to beginning the audit.

4.7 Internal Controls

The auditors must review and evaluate the recipient's internal controls related to USAID programs to obtain a sufficient understanding of the design of relevant control policies and procedures and whether those policies and procedures have been placed in operation. The auditor's understanding of the internal controls must be documented in the audit documentation file.

Auditors must follow the steps outlined in the SOW (Appendix 1) and prepare the report required by the Guide (Appendix 2), identifying any significant deficiencies or material weaknesses in the design or operation of internal control. A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented or detected and corrected on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal controls that is less severe than a material weakness but that is important enough to merit attention by those charged with governance. Any significant deficiencies or material weaknesses must be set forth in the report as “findings”. Any other matters related to internal control

– such as suggestions for improving operational or administrative efficiency or internal control, or control deficiencies that are not significant deficiencies or material weaknesses – may be reported in a separate management letter to the recipient and referred to in the report on internal control.

4.8 Compliance with Agreement Terms and Applicable Laws

Auditors must follow the reporting standards contained in GAGAS for reporting on compliance which are based on the AICPA Professional Standards. The auditor's report on compliance must set forth as findings all material instances of noncompliance with agreement terms, and applicable laws and regulations, defined as instances that could have a direct and material effect on the financial statements and/or fund accountability statement. In accordance with AICPA Professional Standards, the auditor is not responsible for preventing noncompliance and cannot be expected to detect noncompliance with all laws and regulations.30 Nonmaterial instances of noncompliance must be included in a separate management letter to the recipient and referred to in the report on compliance. A copy of the management letter should be provided to the cognizant USAID Operating Unit along with the audit report.

The auditor's report must include relevant information about identified or suspected fraud based on sufficient, appropriate evidence obtained.31 Misstatements in the financial statements can arise from either fraud or error. The distinguishing factor between fraud and error is whether the underlying action that results in the misstatement of the financial statement is intentional or unintentional. In presenting material irregularities, illegal acts, or other noncompliance, auditors must continue to follow the reporting standards contained in GAGAS. If the auditors conclude that sufficient evidence of any known or likely fraud or illegal acts exists, regardless of whether material to the financial statements, they must contact the USAID cognizant Operating Unit and the OIG and exercise due professional care in pursuing indications of possible fraud and illegal acts to avoid interfering with potential future investigations or legal proceedings.

4.9 Follow-up on Prior Audit Recommendations

The status of actions taken on findings and recommendations reported in prior audits, including prior audits of organization-wide financial statements, attestation engagements, and other assessments must be reviewed. Auditors should evaluate whether the audited entity has taken appropriate corrective action and prepare a Summary Schedule of Prior Audit Findings (SSPAF) to address findings and recommendations from previous engagements that could have a material effect on the financial statements as per 2 CFR 200.511. When planning the audit, auditors should ask management of the audited entity to identify previous audits, attestation engagements, financial reviews, and other studies that directly relate to the objectives of the audit, including whether related recommendations have been implemented. Auditors must follow their contract Statement of Work (Appendix 1).

4.10 Closeout Audits

A closeout32 audit is an audit for an award that concluded during the period audited. Pursuant to ADS 591, Financial Audits of USAID Contractors, Recipients, and Host Government Entities, and the additional help in ADS 302sat, Guidance on Closeout Procedures for A&A Awards, closeout audits

30 See AICPA AU-C Section 250, Consideration of Laws and Regulations in an Audit of Financial Statements.

31 See AICPA AU-C Section 240, Consideration of Fraud in a Financial Statement Audit.

32 Closeout is defined in 2 CFR 200.16 and further explained in 2 CFR 200.343-344.

require additional scope of the audit services, including but not limited to the following:

Review unliquidated advances to the recipient and pending reimbursements by USAID.

Ensure that the recipient has returned any excess cash to USAID.

Review final share of costs in accordance with the terms of the agreement, if applicable.

Ensure that all assets (inventories, fixed assets, commodities, etc.)

procured with program funds were disposed of in accordance with the terms of the agreements.

The auditors must determine whether an annex to the fund accountability statement showing the balances and details of final inventories of nonexpendable property acquired under the awards is presented fairly in all material respects in relation to the financial statements. This inventory must indicate which items were titled to the U.S.

Government and which were titled to other entities. These closeout audit procedures must be performed for any award that expires during the period audited.

For closeout audits of awards with a life-of-project budget for cost-sharing or matching contributions, the auditors will review the cost-sharing or matching schedule to determine if the recipients provided such contributions in accordance with terms of the agreement. If actual contributions were less than budgeted contributions, the shortfall will be identified in the appropriate column of the cost-sharing or matching schedule.

5. Audit Reporting

As required by the template audit contract SOW, the final audit report will be submitted to the cognizant USAID Operating Unit as a portable document format (PDF) copy (or multiple copies) of the audit report in English and, if applicable, a PDF copy of the report in the recipient country’s official language. The timeline for the audit reports must be consistent with the award provisions and section 1.6 Audit Timeline of this Guide. The format and content of the audit reports should closely follow the Statement of Work (Appendix 1) and Illustrative Reports (Appendix 2) of this Guide. The audit report must specify the correct award number(s) of each award covered by the audit.

The report must contain, as applicable, a title page, table of contents, transmittal letter, and a summary which includes a background section. The background section must state a general description of the USAID programs audited, period covered, program objectives, clear identification of all entities mentioned in the report, follow-up audit recommendations, whether cost-sharing or matching contributions were required, and whether the recipient has a USAID-authorized provisional indirect cost rate. The report must also include the objectives and scope of the financial audit, clear explanation of the procedures performed and any scope limitations. The report must summarize, as applicable, the audit results of the fund accountability statement, questionable costs, internal control, compliance with agreement terms and applicable laws, indirect cost rates, status of any prior audit recommendations, the recipient’s general purpose financial statements on an organization-wide basis, the results of the review of the cost-sharing or matching contributions, and the recipient’s management comments regarding its view on the audit and any findings.

The auditor’s report must also include the auditor’s opinion on the fund accountability, the review of the schedule of cost-sharing or matching contributions, the internal control, compliance with the agreement terms and applicable laws, the indirect cost rates, and if applicable, the recipient’s general purpose financial statements on an organization-wide basis. The findings included in the reports on internal control and compliance related to USAID-funded programs must be developed with all elements of the findings pursuant to the auditing standards and include the following elements, condition, criteria, cause, effect and an actionable recommendation that corrects the cause and the condition, as applicable.

The reports must also contain, after each recommendation, pertinent views of responsible recipient officials concerning the auditor's findings and actions taken by the recipient to implement the recommendations. If possible, the auditor should obtain written comments.