More Focus on Internal Controls in OMB Circular A-133 Revision

The Office of Management and Budget (OMB) published a revision to OMB Circular A–133 “Audits of States, Local Governments, and Non-Profit Organizations” in Tuesday’s (6/26/07)Federal Register. The revision updates terminology and definitions related to internal controls and simplifies reporting requirements to the Federal Audit Clearinghouse (FAC).

The revisions to the internal control terminology align OMB Circular A-133 standards with changes in the Statement on Auditing Standards issued by the American Institute of Certified Public Accountants (AICPA) and the Government Accountability Office’s revisions to Government Auditing Standards. Rather than requiring auditors to identify reportable conditions over internal controls, the revised OMB Circular A-133 will require auditors to classify findings as a “control deficiency,” “significant deficiency” or “material weakness.” The definition of each of these categories is available at: http://a257.g.akamaitech.net/7/257/2422/01jan20071800/edocket.access.gpo.gov/2007/pdf/E7-12320.pdf. In addition, OMB announced the release of AICPA Auditing Interpretation No. 1 of Statement on Accounting Standard No. 112, entitled “Communicating Deficiencies in Internal Control Over Compliances in an Office of Management and Budget Circular A-133 Audit.” The Interpretation is available at: www.aicpa.org.
Starting on January 1, 2007, the auditee is no longer required to submit multiple copies of the reporting package to the FAC. Instead, only one copy is necessary, except for Part III, item 8, which states that all required agencies receive a copy of the package.
As a practical matter, these revisions may lead to an increase in the number of internal control findings reported in single audits. They may also change how auditors determine which programs to audit and how to determine an auditee’s overall risk-level. This could have a significant impact on recipients of federal education grants. As we have previously reported, the U.S. Department of Education (ED) has become increasingly concerned about managing risk levels in state and local education agencies. It has developed a scorecard to assess risk levels across the country and has begun to visit states to discuss risk mitigation strategies. Ultimately, ED plans to use its assessments to determine who to monitor when, and how closely to scrutinize state and local practices. Although we do not know precisely what criteria ED uses as part of its risk determination, ED officials have stated they review single audit findings – especially findings related to internal controls.
These revisions apply to audits of fiscal years ending on or after December 15, 2006. OMB invites interested parties to submit comments by August 27, 2007. Instructions for submitting comments are available at: http://a257.g.akamaitech.net/7/257/2422/01jan20071800/edocket.access.gpo.gov/2007/pdf/E7-12320.pdf.
Author: TRW, SLK