Appendix_A_-_Deliverable_Descriptions.xlsx

Appendix A

• A schedule of milestones for completing each section of the audit – These sections shall include (at a minimum) planning, internal control, testing, and reporting. This schedule should take IT control environment audit work into consideration.

• A schedule of budgeted hours by labor category for each section of the audit

• Crosswalk of the FAM methodology and deliverables to the Contractor’s audit methodology and deliverables

• The entity profile, audit strategy, and account risk analysis and cycle matrix or equivalents as described in the FAM 200

• The sampling plan to be used during the internal control and substantive testing

• Planning and design materiality and tolerable misstatement, including the basis for determination

• A schedule of the proposed site visits

• A fraud risk assessment which documents the brainstorming meeting(s) about potential fraud risks, including how and when the discussion(s) occurred, the audit team members who participated, the general matters discussed and the impact to the auditor’s planned approach

• A section on tests of significant internal controls identified during the planning phase

• A section on tests of compliance with applicable laws and regulations, and a list of the laws and regulations to be tested, including FFMIA

• A section on substantive testing procedures to be applied to the individual account balances

• A section on the procedures to be performed on Other Accompanying Information, RSSI, and RSI

• A section on tests of the IT control environment – The program shall, at a minimum, require the evaluation of general controls and shall be performed in accordance with the GAO FISCAM. If general controls are determined to be properly designed, testing shall be done to determine if they are operating effectively.

• Cycle memorandums for each significant cycle identified that demonstrates the auditor’s understanding of the five components of internal controls (control environment, entity risk assessment, information and communication, control activities, and monitoring), including relevant information systems

• Flowcharts that document the process flow of significant cycles

• Specific control evaluation (SCE) or the equivalent document that demonstrates an evaluation of specific control activities

• Account risk analyses or equivalent documents which have been updated for the internal control phase

Interim Audit Documentation shall include, as necessary, documentation of findings based on testing performed and which include the elements of a finding as described in FAM 580 and GAGAS.

Final Audit Documentation shall include, as necessary, documentation of findings based on testing performed and which include the elements of a finding as described in FAM 580 and GAGAS.

• The financial statements,

• Internal control,

• Whether the agency was substantially compliance with the requirements of FFMIA,

• Compliance with applicable laws and regulations, and

• Other unaudited information.

These reports may be combined into a single report or drafted as separate reports but must include the elements and report language described in FAM 595 A and consistent with OMB Bulletin 14-02. As applicable, the draft reports shall be cross-referenced to supporting findings and audit documentation.

The Contractor shall document its evaluation of misstatements, both known and likely, in a Schedule of Uncorrected Misstatements or equivalent document that is consistent with FAM section 540 guidance.

The Contractor shall submit the draft report(s) to the COR and the COR will provide comments within five (5) business days of receipt.

The report shall include the elements of a finding as described in FAM section 580 and GAGAS.

The Contractor shall submit the draft report to the COR and the COR will provide comments within five (5) business days of receipt.

The evaluation program shall include a description of the nature, timing and extent of procedures the Contractor will perform.

As applicable, the evaluation program shall identify when and how sampling will be used to execute testing procedures.

The evaluation program shall include the Contractor’s planned milestone schedule for completion of the FISMA evaluation, including reporting of results.

As necessary, FISMA Evaluation Documentation shall also include documentation of findings based on testing performed and which include the following elements: condition, cause, criteria, effect and recommendation.

The Contractor shall prepare the draft evaluation report in accordance with the guidance provided by OMB/DHS. The Commission is a micro-agency and must file reports via cyberscope utilizing the metrics for micro-agencies. The draft reports for Cyberscope should be two separate reports. One utilizing the IG Metrics and one utilizin ghe CIO metrics. The Contractor shall submit the draft report to the ACOR and the ACOR will provide comments within five (5) business days of receipt. Upon receipt of the ACOR’s comments, the Contractor shall submit the draft evaluation report to Commission management for written comments.

The report shall include a section that describes findings identified during performance of FISMA evaluation procedures, including recommendations for management. The report shall also include a section that describes the current status of prior year findings and recommendations.

The draft report shall be cross-referenced to supporting workpapers and documentation.

The Contractor and Commission management shall agree upon a reasonable timeframe for solicitation and receipt of comments not to exceed the overall submission deadline for the Commission to report FISMA results.

• A statement that the firm is independent with respect to this reporting entity

• Any existing, ongoing or planned non-audit services with respect to this reporting entity

• Any lawsuits with this reporting entity

• Any relationships with this reporting entity that could impair independence

• Explanation of the firm’s current internal quality control system, including such items as audit documentation review procedures, staff independence requirements, and continuing professional education requirements The Contractor shall also submit the following:

• A copy of the firm’s most recent internal inspection report or equivalent, external Peer Review, Letter of Comments, and management’s response

• Results or a copy of the firm’s most recent Inspection Report prepared by the Public Company Accounting Oversight Board (PCAOB) and the firm’s response

• Progress to date compared with the overall audit plan and timeline

• Significant accounting and auditing issues, including audit findings

• Potential scope limitations

• Matters that could impact deliverable due dates

• Staffing Plan to include labor hours incurred by individual (by month and cumulative), job title, and audit areas

The FISMA portion of the progress reports shall contain the following elements at a minimum:

• Progress to date compared with the overall evaluation plan and timeline

• Significant issues and discrepancies identified to date and any proposed resolution, including all matters that could impact the evaluation report

• Recommended adjustments to data provided by the Commission

• Matters that could impact deliverable due dates

• Staffing Plan to include labor hours incurred by individual (by month and cumulative), job title, and audit areas

• Significant accomplishments/results of work performed since the last status meeting

• Outstanding documentation requests and potential delays

• Findings identified to date

• Proposed audit adjustments (FSA only)

• Significant issues/concerns

• Planned work to be performed/completed by the next status meeting Electronic copy submitted CO, OM, COR and ACOR Due NLT 24 hours prior to the meeting

Appendix A - Deliverable Descriptions

Appendix A Page &P

Simmary