ATTACHMENT C - 2006 Audit manual.pdf

IAF Grant Audit Manual for Use by Independent Auditors in Examining Inter-American Foundation Grants

Version 2006

Inter-American Foundation 901 N. Stuart Street, 10th Floor

Arlington, VA 22203, USA

This revision of the manual supersedes the 2003 revision. Its provisions are effective for attestation engagements of periods ending on or after June 30, 2006.

TABLE OF CONTENTS

A. Background……………………………………………………………………

B. Authority for Audit and Review of Audit Work……………………………..….…4

C. Communication with the Foundation………………………………………………4

D. Communication with the Grantee.………………………………………………

E. Audit Orientation/Initial Assessment Visit ………….………..……………………6

F. U.S. Government Auditing Standards………..…………………………………….7

1. General standards………………………………………………………..…..7

2. Field work standards……………………………………………………..….8

3. Audit report standards…………………………………………………..…...8

G. Inter-American Foundation Standards and Procedures…………….……………...9

1. Control environment……………………………………..…………...…

2. Accounting system……………………………………………………..…..10

3. Control risk……………………………………………………………....…10

4. Pre-audit responsibilities………………………………………………...…10

5. Entrance conference………………………………………………………..11

6. Potential significant problems…………………………………………..….11

7. Report preparation and procedures…………………………….…………...12

a. Report preparation standards………………………………………...12

b. The audit report………………………………………………...…

c. Report submission……………………………………………………13

H. Conducting the Audit………………………………………………………

1. Objective and scope……………………………………………………..…13

2. Audit Orientation/Initial Assessment and Audit Reports schedule……..…14

3. Changes to the audit plan………………………………………………..…15

4. Audit procedures and steps……………………………………………..….16

A. Pre-audit steps……………………………………………………….16 B. Preliminary audit steps………………………………………….…...17 C. Risk assessment……………………………………………………...17 D. Analytical procedures………………………………………………..17 E. Internal controls……………………………………………………...18 F. Field work …………………………………………………………...18 G. Examining Sub-Grant Funds………………………………………...22

5. Third party contributions to the grant project……………………...……...22

6. Reconciliation……………………………………………………..……

7. Concluding audit steps…………………………………………...……..…23

I. Audits of Corporate Programs Cooperative Agreements ……………………..…24

J. Audit Report Example……………………………………………………

-2-

A. Background

The Inter-American Foundation (the Foundation, or the IAF) is an independent agency of the US Government. The Foundation was established in 1969 as an experimental program to provide foreign aid to Latin America and the Caribbean. By means of direct grants to local organizations throughout the Region, the Foundation works to promote equitable development based on self-help, with the communities' participation and in response to their needs. It also partners with public and private sector entities to mobilize local, national, and international resources for grassroots development. The Foundation's annual budget includes funds appropriated by the U.S. Congress and allocated by the Social Progress Trust Fund.

The Foundation must ensure that the resources devoted to grassroots development projects are being used effectively to further the project, in accordance with the understanding reached in the grant agreement. The Foundation has mobilized the efforts of various individuals and organizations - in the United States and in the countries of the region - to achieve this goal in each country in which it works, including: the Foundation Representative assigned to the country, the IAF Auditor, the Local Liaison and Advisory Service (LLAS), the Data Verifier, and the Independent Auditor.

Purpose and scope

The IAF Grant Audit Manual provides detailed audit guidance in accordance with the IAF Grant Audit policy which is part of a comprehensive IAF strategy to maintain effective oversight of IAF grant activity. Federal laws and regulations do not require financial audits on foreign nonprofit organizations expending less than $300,000 of federal funding per the organization’s fiscal year. The IAF is, however, required to be responsible for ensuring financial accountability of its grant expenditures. It is therefore the policy of the IAF to require compliance audits on all grant agreements with an approved funding amount greater than $35,000. A Compliance Audit is defined as an examination-level attestation engagement as defined in section 6.02 of the Generally Accepted Government Auditing Standards, version 2003 (GAGAS or Yellow Book), and does not constitute a financial audit under GAGAS. The examination will include sufficient testing of a Grantee’s books and records to determine whether the Grantee is in compliance, in all material respects, with the requirements set forth in the grant agreement executed between the Foundation and the Grantee, and to render an opinion to that effect.

This Audit Manual is intended to provide a mutual understanding between the contracted auditor (Independent Auditor) and the IAF, with regard to the scope required to comply with the auditing standards issued by the Comptroller General of the United States. The Audit Manual also presents a logical sequence for the audit process. The audit steps should serve as a general guide and should be expanded or modified as necessary to fit actual audit requirements.

The Independent Auditor is expected to exercise professional judgment, while considering risk and materiality, in determining the scope of the audit. Transaction testing should be complete, ensuring that an adequate, substantive test has been carried out to provide a reasonable basis for an opinion.

Transaction testing should be carried out on the basis of the information obtained in the analytical processes and the results of the risk assessment. The Independent Auditor should follow audit steps and procedures necessary to provide a reasonable assurance of detecting errors, irregularities, abuse or material illegal acts.

This Audit Manual is intended to provide guidance to the Independent Auditor in order to achieve the following objectives:

-3-

• to assess whether the resources provided to Grantees are being effectively used;

• to assess whether the Grantee has materially complied with the grant agreement and applicable laws and regulations;

• to provide a uniform model for Independent Auditors;

• to provide guidance for consistency in audit areas, such as transaction testing, sampling, observation and reporting;

• to highlight and reinforce key areas of focus as required under the Yellow Book and Generally Accepted Auditing Standards (GAAS) prepared by the American Institute of Certified Public Accountants (AICPA); and

• to establish consistency in reporting contractual and financial data and information in accordance with the GAGAS and Generally Accepted Accounting Principles (GAAP).

Audit Period

The Audit Period is defined as the period of time to be covered in the Independent’s Auditor’s report as designated in the Task Orders issued to the Independent Auditor by the IAF Auditor and/or the IAF contracting officer technical representative (COTR). The Audit Period Ending Date refers to the last day of the Audit Period.

B. Authority for Audit and Review of Audit Work

The United States Inspector General’s Act of 1978, as amended, requires the IAF to ensure the financial accountability of its grant expenditures. The authority to perform examinations by Independent Auditors to ensure material financial compliance with a given grant agreement is established within the grant agreement.

The work papers and supporting documentation evidencing the Independent Auditor's work are subject to review by the Foundation. Quality control reviews (QCRs) are designed to assess the competency and qualifications of the Independent Auditors as well as ensure the working papers sufficiently support the conclusions reached in accordance with Government Auditing Standards.

C. Communication with the Foundation

If the Independent Auditor has questions relating to the Audit Manual, the audit program, or any other matter, he or she should consult the IAF Auditor. This communication is essential to the satisfactory accomplishment of an audit.

The Independent Auditor should resolve any question with the IAF Auditor before concluding the audit field work, in order to minimize repeat visits to the Foundation Grantee. The IAF Auditor may be contacted by telephone, e-mail, fax or letter (depending on the urgency).

During an audit, or at any other time, a potential significant problem is encountered, the Independent Auditor shall notify the IAF Auditor immediately and inform him or her of the facts and circumstances. See section 6.32 of the Yellow Book.

Examples of potential significant problems may include the following:

-4-

• the Independent Auditor's inability to trace (follow) IAF disbursements to the Grantee's accounts;

• gross misallocation of funds, contrary to the purposes specified in the agreement or contrary to the provisions in the agreement on the use of funds;

• suspected fraud; and

• conflict of interest between the Grantee, sub-grantee, LLAS, or Data Verifier.

The contact information for the IAF Auditor is:

Inter-American Foundation Attention: Brian Fyock

901 N. Stuart Street, 10th Floor Arlington, VA 22203, USA Telephone: (703) 306-4385

Fax: (703) 306-4369 E-mail: bfyock@iaf.gov

D. Communication with the Grantee

The Independent Auditor, along with the LLAS and the Data Verifier, acts as a representative of the Foundation in connection with the important grassroots development operations which the Grantees carry out with U.S. Government funds. The Independent Auditor often serves as the eyes, ears and even the face of the Foundation. It is vital that the Independent Auditor properly represent the Foundation in his or her interactions with the Grantees, always treating them with dignity and respect.

The IAF awards grants to its Grantees after rigorous competition. The Foundation Grantees may not be a country's most sophisticated institutions in terms of accounting methodology or technical capacity, but the IAF has entrusted them with U.S. Government funds because of their ability to serve their communities. An Independent Auditor not only fails to meet the Foundation's needs, but undermines the Foundation’s work, if he or she does not work respectfully and effectively with the Grantees.

To communicate respectfully and effectively with the Grantees, the Independent Auditor should:

• advise a Grantee of planned audit visits far enough in advance (prior to the audit period ending date) to be able to coordinate a mutually convenient time (generally four weeks is sufficient notice);

• explain, with similar advance notice, what documentation and materials the Grantee should make available to the Independent Auditor;

• answer the Grantee's questions about the audit;

-5-

• conduct the audit so as to cause a minimum of inconvenience to the Grantee's project-related operations; and

• always use a respectful tone of voice and vocabulary when addressing the Grantee.

The Independent Auditor is always responsible for complying with these requirements and for ensuring that all subordinates working for him or her also complies with these standards when communicating with the Grantees.

If a Grantee is uncooperative in facilitating an audit visit after having been given sufficient notice and a reasonable amount of time to prepare (maximum of two months after the audit period ending date), and the IAF Auditor and Foundation Representative have been notified of the delinquency issue in a timely manner, the Grantee will be considered in material non-compliance with the Grant Agreement.

In the case of extenuating circumstances, an Independent Auditor may delay an audit visit with written approval of the IAF Auditor.

E. Audit Orientation/Initial Assessment Visit

The Independent Auditor shall conduct an Audit Orientation/Initial Assessment of the Grantee’s accounting and financial control environment in order to communicate and assist the Grantee in obtaining an adequate understanding of the IAF’s accounting and financial reporting expectations.

The Audit Orientation/Initial Assessment visit is intended to be used as a development tool to assess and strengthen the Grantee’s ability and capacity to effectively administer IAF grant funds. In addition to orienting the Grantee as to the Foundation’s reporting and audit requirements as outlined in the Grant Agreement, the Independent Auditor will also discuss and highlight specific accounting and financial guidance provided in the IAF Grantee Accounting Guide. The Independent Auditor will also provide accounting and financial guidance and assistance based on the nature of the Grant Agreement and any other special circumstances.

The Independent Auditor must conduct an Audit Orientation/Initial Assessment with a new Grantee within sixty (60) days of the Independent Auditor’s receipt of a copy of the approved Grant Agreement. The visit is required to be held at the offices of the Grantee, or as otherwise specified by the IAF Auditor. The visit shall include the appropriate accounting and finance officials and the Project Director. This Audit Orientation/Initial Assessment may or may not coincide with the general orientation session facilitated by the Foundation Representative.

Audit Orientation/Initial Assessment Notification Responsibilities

Once the Audit Orientation/Initial Assessment visit date has been arranged, the Independent Auditor shall communicate the date to the IAF Country team: the Foundation Representative, LLAS, IAF Auditor and Data Verifier.

The Audit Orientation/Initial Assessment visit should include the following procedures;

1. Discuss the history of the Grantee organization and the nature, type and complexity of the grant project activities contemplated in the grant agreement including IAF, Grantee and counterparty interaction to facilitate a better understanding of accounting and auditing matters

2. Review all applicable annexes of the grant agreement with the Grantee and answer any questions that relate to accounting and auditing

-6-

3. Review and explain the Foundation financial reporting requirements, including frequency, content and report submission timing requirements

4. Provide the Grantee with a copy and discuss the IAF Grantee Accounting Guide. Highlight and discuss pertinent sections and topics that relate specifically to the Grant Agreement or the nature of the grant activities being performed

5. Observe the Grantee’s accounting and control environment by way of interviewing key staff and touring the facility

6. Explain the Foundation’s audit requirements with respect to frequency, planning, duration, Grantee participation, materials and reports to be prepared, etc.

7. Answer any and all relevant financial or accounting questions. Refer the Grantee to the appropriate IAF officials (including the Foundation Representative) to answer any non-accounting or non-financial programmatic questions.

Audit Orientation/Initial Assessment Report Deliverable

An Audit Orientation/Initial Assessment Report shall be created and submitted to the IAF Auditor within sixty (60) calendar days of the Independent Auditor’s receipt of a copy of the approved Grant Agreement. The Report, to be written in Microsoft Word format and limited to two pages in length, shall include the following information;

1. The name of the Grantee and the Grant Date (the date on which the Foundation President obligates the Grant)

2. The date the visit occurred

3. The names and titles of the individuals attending the Audit Orientation/Initial Assessment session

4. A brief summary of the procedures performed

5. A brief summary of the Independent Auditor’s observations related to the Grantee’s accounting and financial readiness.

The Independent Auditor shall send the report via e-mail as an attachment (with an electronic signature if possible) to the IAF Auditor with a copy to the country Foundation Representative.

F. U.S. Government Auditing Standards

The IAF requires Independent Auditors to adhere to the auditing standards established by the Comptroller General of the United States for audits of government organizations, programs, operations and functions. The GAGAS requires, at a minimum, the following:

1. General standards: These standards apply to all audit organizations, both governmental and non-governmental (for example, public accounting firms and consulting firms) conducting government audits, unless specifically excluded by the general standards.

a. Qualifications. The staff assigned to conduct audits must collectively possess adequate professional experience for the assigned task. This standard makes the audit organization responsible for ensuring that the audit is conducted by staff who collectively possess the necessary knowledge, including training and supervision, for respectful and effective interaction with the Foundation Grantees.

b. Independence. In all matters related to the audit work, the audit organization and the individual auditors, public or private, must be free of personal and external factors that

-7-could undermine their independence, be organizationally independent, and maintain an independent attitude and appearance.

c. Due professional care. The auditor must act with due professional care when conducting the audit and preparing the respective reports. This standard makes the auditor and the audit organization responsible for adhering to all applicable standards when conducting government audits. Acting with due professional care means using sound judgment in establishing the scope and selecting the methodology and procedures for the audit.

d. Quality control. The audit organization conducting government audits must have an appropriate internal quality control system and participate in an outside quality control oversight program, if applicable. The internal quality control system established by the audit organization should provide reasonable assurance that the auditor:

• has established and is adhering to proper audit guidelines and procedures and

• has adopted and is adhering to the applicable auditing standards.

e. Consequences of failing to adhere to the standards. The Independent Auditor who performs unacceptable work or who fails to respond to requests for information and other requests from the Foundation may be subject to rescission of their contract or may be considered unsuitable for contract renewal.

2. Field work standards: The GAGAS should be followed in the auditing process. For purposes of auditing programs, these standards include:

a. Planning: The work should be adequately planned.

b. Supervision: The staff should be properly supervised.

c. Legal and regulatory requirements: An evaluation of compliance with the applicable standards and regulations should be performed when necessary to satisfy the audit objectives.

d. Internal Controls: An evaluation of the applicable internal controls should be performed when necessary to satisfy the audit objectives.

e. Evidence: Competent, pertinent and sufficient evidence should be obtained to support the auditor's report and conclusions with respect to the organization, program, operation or function under audit. The Independent Auditor's work should be backed up with work documents, which may include tapes, films, disks and so forth.

3. Audit Report standards: For purposes of communication, the audit report should, at a minimum, adhere to the following standards:

a. Form: Audit reports should be prepared as Word documents in accordance with the requirements outlined in this Manual.

b. Timeliness: The Audit reports should be issued and received by IAF in accordance with the Delivery Schedule outlined in the contract.

-8-

c. Report content:

• Objective, scope and methodology. The report should include a statement of the audit objectives and a description of its scope and methodology.

• Audit results and conclusions. The report should include a complete description of the audit results and, when appropriate, the auditor's conclusions.

• Cause and recommendations. The report should include the cause of the problem areas noted in the audit and recommendations for correcting them and improving operations, when the audit objectives so require.

• Statement of auditing standards. The report should include a statement to the effect that the audit was conducted in accordance with the GAGAS and indicate the cases in which the applicable standards were not adhered to. If other auditing standards were used, they should be mentioned (for example, the GAAS).

• Internal controls. The report should identify the significant internal controls that were evaluated, the scope of the Independent Auditor's evaluation work, and any significant weakness found during the audit.

• Compliance with standards and regulations. The report should include all significant instances of noncompliance and abuse, and all indications or instances of illegal acts that could give rise to criminal prosecution, found during or in connection with the audit.

• Opinions of the responsible officials. The report should include the pertinent opinions of the responsible officials of the organization, program, operation, or function under audit, with respect to the Independent Auditor's findings, conclusions, and recommendations and the planned corrective measures.

• Noteworthy accomplishments. The report should include a description of any significant accomplishment, especially when the management improvements in one area may be applicable to another.

• Issues needing further study. The report should include a list of any significant issue needing further study and consideration.

• Privileged and confidential information. The report should include a statement about any pertinent information that was omitted because it was considered privileged or confidential. It should describe the nature of such information and state the reason it is being withheld. For example, a Grantee may refuse to provide certain information, considering it privileged and confidential. This may be due to an attempt by the Grantee to affect or reduce the scope of the audit.

G. Inter-American Foundation Audit Standards and Procedures

The IAF requires that its Independent Auditors comply with the standards adapted to its grant program in addition to the U.S. Government Auditing Standards (“Yellow Book”).

-9-

1. Control environment The Independent Auditor should achieve an adequate understanding of the Grantee's control environment and general accounting controls, including manual and computerized operations, in order to plan the respective audit. The control environment significantly affects the way in which the business operations are organized, objectives are established and risks are assessed. It can affect the control operations, the information and communication systems and oversight operations. The control environment sets the tone for an organization and affects the staff's awareness of control. It is the foundation for all other components of internal control and provides discipline and organization. This process requires that the Independent Auditor assess the adequacy and effectiveness of the Grantee's accounting guidelines and procedures. The following are some factors of the control environment:

a. integrity and ethical principles;

b. participation of a board of directors or an audit committee;

c. management philosophy and operating style;

d. organization structure; and

e. assignment of authority and responsibility.

2. Accounting system The Independent Auditor should achieve an adequate assessment of the Grantee's accounting system. The accounting system should include methods and documentation established to identify, assemble, analyze, classify, record and report an entity's transactions and maintain the accounts statement for the respective assets and liabilities. The accounting system should be well designed to provide reliable accounting information and prevent misstatements which could otherwise occur.

3. Control risk The Independent Auditor should evaluate the control risk, which reflects the probability that the Grantee's internal controls will fail to prevent or quickly detect a material error or irregularity or misstatement. When evaluating the control risk, the Independent Auditor should consider the effectiveness of the established control operations in achieving the stated control objectives. The more effective the control operations, the lower the control risk. For example, if the Independent Auditor concludes that the pertinent internal controls do not exist or that other, related audits could be conducted more efficiently, expanding the substantive testing, the control risk should be considered high.

4. Pre-audit responsibilities The Independent Auditor should follow the respective pre-audit steps to be well prepared for the audit at the time of the entrance conference. These steps include communicating with the IAF Grantee, at least four weeks in advance, to coordinate the field visit, establish the scope and time of the audit, and identify the documents that should be presented for examination. This initial communication may be written or verbal, followed by written confirmation of each item discussed.

-10-

5. Entrance conference The Independent Auditor should hold a brief entrance conference with a senior official (preferably a signer of the grant agreement). At the entrance conference, the Independent Auditor should:

a. Request cooperation from the Grantee and the Grantee's senior management officials, in order to expedite the compliance audit.

b. Give the Grantee's management staff the opportunity to explain how they complied with their responsibilities for establishing and maintaining adequate internal accounting and administrative controls in the review areas.

c. Ask the Grantee to identify all reports and analyses used by the management staff to evaluate and control the effectiveness, economy and efficiency of the review areas.

d. Ask the Grantee to provide an informational briefing on its organization and operations in order to reduce the duration of the audit. These briefings may address the organizational and functional assignments affecting the review areas and descriptions of systems or flowcharts of transactions and system controls.

e. Invite the Grantee to participate actively in the audit.

f. Explain in advance the IAF's procedures for submitting drafts that describe the conditions and recommendations, and establish timeframes for the Grantee to submit a response.

g. Explain that the audit will cover the organization's overall financial management as set forth in the grant agreement.

h. Explain to the Grantee that the audit will be conducted partly to help the organization identify and resolve problems that may arise in the financial management of the grant agreement.

6. Potential material problems (Findings)

The report of a skilled auditor may reveal significant problems, such as:

• inappropriate accounting and internal controls;

• inappropriate or unauthorized use of funds or resources vis-à-vis the terms of the grant agreement (for example, unauthorized reallocation of funds between budget categories in excess of the percentages allowable);

• conflicts of interest between the Grantee and the Local Liaison and Advisory Service or the Data Verifier;

• purchase of equipment not authorized in the grant agreement; and

• lack of supporting documentation.

-11-

The Independent Auditor shall report material findings, in accordance with section 6.34 of the Yellow Book, “Developing Elements of Findings for Attestation Engagements”. The findings shall include the following elements: criteria, condition, cause and effect. For each finding, the Independent Auditor shall also include a recommendation and a response from Grantee officials.

a. Sufficient factual data: The Independent Auditor should have obtained, during the audit process, sufficient information regarding significant problems to support the conclusions presented in the drafts. The Independent Auditor should include in the drafts and audit reports sufficient detail regarding the nature and seriousness of significant problems.

Statements such as "We noted questionable expenditures ..." are vague and unacceptable.

b. Cause of condition: When possible, the Independent Auditor should determine the cause of the condition needing improvement.

c. Recommendations: The Independent Auditor should include appropriate recommendations for the corrective measures the Grantee should take to improve or correct the noncompliance. The recommendations on controversial matters should reflect the fact that the Grantee and the auditor discussed the issue and indicate whether agreement on the necessary corrective measures was reached.

d. Responses: When appropriate, the Independent Auditor should include any responses from the Grantee on the significant problems reported.

e. Auditor’s assessment of responses: The Independent Auditor should include his or her assessment of the Grantee’s responses in the final audit report.

7. Report preparation and procedures

a. Report preparation standards: The audit report should contain reliable, complete statements about the significant problems (as described above), the Grantee's response (whether or not agreement was reached), the Independent Auditor’s assessment of the Grantee’s response and the action plan the Grantee should implement to correct each condition mentioned in the report. The Independent Auditor should allow no more than two weeks for a Grantee’s response. If the Grantee does not respond within this period, the Independent Auditor should include in the audit report a statement regarding the Grantee’s failure to provide a response on the part of the Grantee. Additionally, any difficulties encountered in conducting the audit or acquiring Grantee responses to the findings should be reported immediately to the IAF Auditor and documented in the audit report.

If the Grantee disagrees with the conditions reported and does not intend to take any corrective measure, the audit report should include the Grantee's specific reasons. If, in the Independent Auditor's judgment, a problematic condition still exists, he or she should explain his or her reasoning in a rebuttal of the Grantee's reasons.

b. The audit report: The audit report will consist of a cover page, a table of contents, and the applicable sections and appendices (see list below). See the example of the audit report in Section J.

The audit report should contain:

-12-

• a cover page and table of contents, with the Grantee's name and the grant number;

• the purpose of the audit;

• the audit period;

• the scope of the audit;

• the audit opinion;

• the Grantee's organization and systems;

• appendices, including the Grantee's responses and the Independent Auditor’s assessment of those responses; and

• disclosure, if applicable, regarding the audit organization’s and Independent Auditors’ compliance with the following GAGAS requirements:

1. Continuing Professional Education of at least 80 hours completed within the previous two years (GAGAS Section 3.45)

2. External Quality Control Review, or “peer review” conducted once every three years. (GAGAS Section 3.49 and 3.52)

If the audit organization does not comply with either or both of these provisions, the audit report submitted to the Foundation should mention the non-compliance.

For example, the audit report should state:

“This audit organization did not fully comply with the U.S. Government Auditing Standards because it did not participate in an external quality control review and its auditors did not fully satisfy the continuing professional education requirement. In all other respects, this audit firm fully complied with the required standards.”

c. Report Submission: Audit reports are due to the IAF no later than 90 days after the Audit Period Ending Date, as specified in the Task Order signed by the IAF and the Independent Auditor. If the Independent Auditor fails to deliver the contract on time without prior justification approved by the IAF Auditor, a 10% penalty will be assessed by the IAF to the audit payment that is contained in the Independent Auditor’s contract for services. Reports should be submitted by electronic mail and include an electronic signature.

H. Conducting the Audit

1. Objective and scope

a. This Audit Manual provides a logical sequence for the audit and promotes a mutual understanding between the Foundation and the Independent Auditor regarding the scope of the auditing standards and the Foundation's objectives. The steps which the Audit Manual establishes for the compliance audit are intended as a guide. They are not

-13-considered exhaustive or restrictive, and they do not exempt the Independent Auditor from using due professional care and judgment. The steps should be adapted to the local conditions and to the design, implementation procedures, and provisions of the specific project, which may differ from one Grantee to another.

The objective of the Foundation audit program is to determine whether the Foundation Grantee is complying with the requirements of the grant agreement and effectively obtaining, controlling and using the resources in accordance with the grant agreement.

Also, the objective of the Foundation audit program is to determine whether the expenditures incurred in fulfillment of the grant agreement are reasonable, allowable and allocatable in accordance with the grant agreement and the regulatory provisions applicable to government acquisitions.

b. The audit plan contains work steps and procedures on financial matters of interest to the

Foundation. The audit plan should include, in part:

• a determination of the adequacy of the accounting books and records;

• an examination of the basic internal controls;

• verification of the use of funds and the reliability of the respective reports submitted to the Foundation;

• verification of the contributions to the grant project by the Grantee or another party;

• verification, when appropriate, that management of sub-grant or loan funds complies with the grant agreement and the Grantee’s related regulatory provisions;

• an overall reconciliation of all funds received, the project expenditures, and the balances available;

• sampling procedures used in verifying the expenditures incurred during transaction testing;

• auditing procedures implemented to test individual transactions. The objective of the transaction testing is to determine, in part, if the costs are allowable, allocatable and reasonable; and

• verification that there is no conflict of interest between the Grantee and the LLAS or the Data Verifier.

2. Audit Orientation/Initial Assessment and Audit Reports Schedule

In the case of a typical three-year grant period, the IAF will contract the performance of three compliance audits as well as one Audit Orientation/Initial Assessment. Special Audits may be conducted at the discretion of the IAF Audit Office in consultation with IAF officials. Written reports for each of above-mentioned activities (Audits and Audit Orientation/Initial Assessments) will be submitted to the IAF Audit Office in accordance with the following schedule:

-14-

(1) A two-page summary of the Audit Orientation/Initial Assessment shall be submitted to the IAF Auditor within 60 calendar days of the Independent Auditor’s receipt of a copy of the approved new grant agreement, which will be sent directly to the Independent Auditor by the IAF Auditor.

(2) Frequency of Audits – The IAF Auditor and/or COTR will communicate with the

Independent Auditor to establish audit schedules based on a signed Task Order. The IAF Auditor and/or the COTR will send an updated audit schedule at least every six months reflecting new grants, amendments and other information. All Audit Reports are due no later than 90 days following the Audit Period Ending Date as set forth by the Task Order (with the exception of Special Audits described below or as agreed to by the IAF Auditor on an exception basis).

Audit Schedule – In addition to the Audit Orientation/Initial Assessment visit, the IAF requires audits in accordance with the following schedule which assumes a typical 3-year grant period:

• First Audit – The First Audit shall be conducted one year (twelve months) after the Grant Date.

• Second Audit – The Second Audit shall be conducted one year (twelve months) after the First Audit (24 months subsequent to the Grant Date), in the case of a 2-year grant period, the Second Audit shall serve as the Final Audit.

• Final Audit – The Final Audit shall be conducted one year (twelve months) subsequent to the Second Audit (36 months subsequent to the Grant Date). If a grant agreement is modified to extend the grant period, the Final Audit may be delayed a maximum of 12 months (in the case of a 12 month extension). If the grant agreement is extended more than 12 months, an additional audit will be scheduled so that no audit period exceeds 24 months.

• Special Audits – The Independent Auditor shall conduct special audits as requested in writing by the IAF Auditor and/or COTR on a case-by-case basis. Due to the unique, and often urgent, circumstances surrounding Special Audits, the reports are due to the IAF sixty (60) days subsequent to the request for the Special Audit, or as otherwise specified by the IAF Auditor.

Audit Visit Notification Responsibilities

Once the Independent Auditor has arranged the audit field work dates with the Grantee, the Independent Auditor is required to communicate those dates to the IAF Country team: the Foundation Representative, LLAS, IAF Auditor and Data Verifier. If a Grantee is uncooperative in facilitating an audit visit after having been given a sufficient and reasonable amount of time to prepare (maximum of two months after the audit period ending date) and the IAF Auditor and Foundation Representative have been notified of the delinquency issue in a timely manner, the Grantee will be considered in material non-compliance with the Grant Agreement. In the case of extenuating circumstances, an Independent Auditor may delay an audit visit with written approval of the IAF Auditor.

3. Changes to the audit plan

The Independent Auditor should use his or her professional judgment in determining the need to expand the audit beyond the requirements of the audit plan when there are sufficient indications of a potential problem.

-15-

If the Independent Auditor believes it is necessary to expand the audit beyond the planned steps, he or she should contact the IAF Auditor to advise him or her of the area of concern. Coordination between the Independent Auditor and the IAF Auditor is essential, not just to reach a mutual understanding regarding the need to expand the audit, but also to continuously improve the Foundation audit program.

4. Audit procedures and steps

Preliminary audit steps include analysis and evaluation of the various accounting principles and methodologies used by the Grantee to record financial transactions. The sufficiency of the Grantee's accounting records and related financial controls should be analyzed to determine whether the accounting records can independently identify the financial transactions that pertain to the grant project as established in the grant agreement. The analysis should be sufficient to determine whether reasonable internal controls are being used to ensure the safeguarding and appropriate use of project funds.

IAF grants also call for financial and in-kind contributions from the Grantee and other sources. The accounting records should show the receipts or other documentation corresponding to these counterpart contributions, separate from the Foundation grant funds.

A. Pre-audit steps

(1) The Independent Auditor should obtain and examine all the documentation considered necessary for the audit. In general, the following documents are considered necessary:

(a) the grant agreement, including the grant budget and all the other annexes;

(b) any amendments to the grant agreement;

(c) the sub-grant and loan agreements, when applicable;

(d) the agreements or memorandums of understanding with other sources of funding for the project;

(e) all the financial reports, reports on operations and progress reports related to the project;

(f) any previous audit report of the Grantee, including the previous results and recommendations and the Grantee's responses;

(g) the regulatory provisions on sub-grant and loan funds, if applicable; and

(h) the technical manuals that establish the U.S.Government accounting standards, including the "Yellow Book."

(2) Contact the Grantee to plan the field visit well in advance of arrival at the Grantee's offices. In general, the Independent Auditor should notify the Grantee four weeks in advance to allow the Grantee enough time to properly prepare for the audit.

Show respect to the Grantee and choose the audit time and place by mutual agreement.

-16-

B. Preliminary audit steps

(1) Formulate steps and procedures for transaction testing.

(2) Start making a record of any indicator of risk identified and the Grantee’s response to the risks identified. If additional steps are not required or indicators of risk are not identified, make a record of this fact in the audit plan and the work documents.

(3) Hold an entrance conference with the Grantee.

C. Risk assessment

Perform a risk assessment, taking into account:

(1) the relative importance of the declared grant project costs;

(2) an analysis of the over- or under-budgeted elements vis-à-vis the "actual cost" elements;

(3) the acceptability of the accounting system and the internal controls;

(4) the Grantee's history; and

(5) possible conflicts of interest between the Grantee, contractors, consultants, the LLAS and/or the Data Verifier.

Pay special attention to the problems and results recorded in previous audits of the Grantee.

A determination that a risk of fraud exists is a cumulative process that (i) includes consideration of the risk factors individually and collectively and (ii) should be ongoing throughout the audit. The government auditing standards require auditors, when determining the Grantee's compliance with the laws and regulatory provisions, to formulate audit steps and procedures that afford reasonable assurance of detecting errors, irregularities, abuse or illegal acts. Such abuse or acts may (1) affect, directly or indirectly and materially, the Grantee's financial representations or (2) significantly affect the audit objectives.

The Independent Auditor should proceed with due care when planning, conducting and evaluating the audit processes. A certain degree of skepticism is required for a reasonable assurance of detecting illegal operations or improper practices. Under the concept of professional skepticism, the Independent Auditor does not assume that the Grantee is acting either fraudulently or with unquestioned honesty. Rather, the Independent Auditor should recognize that the conditions observed and the documentation examined, including information from prior audits, should be objectively evaluated to determine if the Grantee's financial representations are free of material errors.

D. Analytical procedures

The analytical procedures should include:

(1) a chronology of significant events based on the data obtained in the preliminary audit steps; and

-17-

(2) a determination of the nature and extent of transaction testing of the major cost elements, based on the results of the risk assessment and the analytical procedures.

E. Internal controls

Determine whether the Grantee has implemented reasonable internal controls to oversee the safeguarding and use of project funds. Verify that the Grantee has implemented the following procedures:

(1) competent staff with appropriately limited and clearly defined responsibilities with respect to the receipt and disbursement of funds;

(2) measures for the prior authorization of expenditures by an appropriate individual with authority for the grant project; and

(3) adequate documentation, such as invoices and receiving reports for materials or equipment purchased, substantiating the declared expenditures. There should also be adequate documentation substantiating the work and travel expenditures for payments to individuals.

F. Field work

(1) Conduct a general examination of the Grantee's accounting system and financial controls.

(2) Determine whether the accounting system can identify:

• individual receipts that identify, separately, all funds received from the

Foundation;

• individual expenditures that identify, separately, all funds used in connection with the project by budget line item or category;

• total funds unused;

• the balance of project funds and resources undisbursed by the

Foundation;

• whether the Grantee has established internal controls for the safeguarding and use of assets (determine if prior approval of expenditures by appropriate authorized individuals is required); and

• whether documentation, such as invoices, receiving reports, etc., is retained to substantiate expenditures.

(3) Petty cash. Verify that the Grantee has implemented the necessary safeguards under the control of a single authorized individual. Verify the existence and use of procedures requiring the authorization and documentation of petty cash.

(4) Accounting and financial controls

-18-

(a) Bank accounts. Verify that the bank accounts used for grant transactions are reconciled monthly.

Analyze and summarize all interest and income earned with project funds.

(b) Assets. Verify that subsidiary records or files are maintained to adequately control project assets. These assets may include loan receivables under rotating loan projects and stock of materials and equipment under construction projects.

Verify that these records are reconciled periodically and that physical counts of stock of materials and equipment are taken are taken periodically to ensure the accuracy of the records.

(5) Expenditures

The audit includes an examination of the use of grant funds, including loans issued from revolving loan funds.

(a) Verify the documentation of the need to use grant funds in accordance with the conditions of the grant agreement and the grant budget schedule.

(b) Examine the Grantee's accounting records and document, in U.S. dollars, the total amount of expenditures posted in connection with the grant as of the Grantee's most recent expenditure report.

(c) Verify the reasonableness of the amount of significant expenditures, such as those incurred for real and personal property and equipment. These procedures require a physical verification of the real and personal property and equipment that may have been purchased and an examination of the accuracy of the expenditure reports the Grantee has furnished to the Foundation.

(d) Verify through reconciliation the total amount of expenditures declared by the Grantee as of the expenditure report date. This amount should be stated in U.S.

dollars and in the local currency. The total of the expenditures declared by the Grantee should be presented in the audit report as a worksheet by applicable budget categories established in the grant agreement.

(e) Any category of expenditures that cannot be included in a budget category should be identified separately.

(f) In the case of a revolving fund from which several small loans may be issued, 80 percent transaction testing is not necessarily applicable. However, an initial random sample may be taken and, if no exceptions are noted, additional transaction testing may be randomly performed in order to meet statistical sampling requirements. The Independent Auditor should use his/her professional judgment. He or she should document the rationale for the variations in the analyses and the conclusions reached.

(g) For grants with a revolving loan fund component, verify the receipt of loan funds. Verify and test a sufficient sample of transactions which will be

-19-determined based on the Independent Auditor's risk assessment and other audit factors. If the loans are numerous, the random and judgmental selection should be based on the risk assessment and any prior audit of the Foundation Grantee.

Rotating loans may be confirmed through the mail or visits to the major borrowers. If verification cannot be accomplished through the mail, a personal visit to the major borrowers will be required.

The audit and examination of expenditures, including loans from revolving funds, will be accomplished as follows:

• examine the status of loans and repayments to determine whether there are any late payment problems;

• verify and report the total of outstanding loans considered to be in arrears;

• verify and report the total of outstanding loans considered uncollectible;

• examine the use of loan recovery measures for compliance with the intent of the grant agreement;

• verify that the expenditures were necessary and appropriate in accordance with the terms and conditions of the grant agreement and the budget worksheet;

• advances included in the Grantee's expenditures should be reported if outstanding for inordinate amounts of time;

• advances constituting a substantial portion of a particular expense category should be noted in the audit report and related worksheets; and

• verify that the expenditures were approved by an individual with authority for the grant project and are substantiated by appropriate documentation.

(h) Purchasing procedures Examine the Grantee's guidelines and procedures for purchases to ensure that the Grantee has implemented the appropriate steps to determine that reasonable and competitive prices are obtained from vendors. In analyzing whether the Grantee has implemented reasonable guidelines and procedures, consider the following:

• the guidelines and procedures include price checking in applicable manufacturers' catalogues and price lists;

• the guidelines and procedures include obtaining competitive quotes from reputable sources;

• prices paid should not exceed that which other customers are charged for similar items and quantities under similar conditions;

-20-

• for land purchases, a study of the local market should be conducted (using several…