Documenting and Testing Compliance and Internal Control Over Compliance in a Single Audit

In response to a June 2007 federal study on the quality of audits performed under Office of Management and Budget (OMB) Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations (Circular A-133), the AICPA’s Governmental Audit Quality Center (GAQC) established a series of task forces to address deficiencies noted in the report. One of the AICPA task forces, the Internal Control and Compliance Responsibilities in a Single Audit Task Force (ICC task force), was established in response to audit quality issues identified in the federal report that relate to the auditor’s responsibilities for internal control over compliance, as well as compliance testing. As a result, the ICC task force developed a practice aid to assist auditors in better understanding their responsibilities for internal control over compliance as well as compliance testing and to assist with documenting such procedures. The practice aid includes:

Major Program Risk Matrix. This audit tool provides a template to assist the auditor in assessing which of the 14 types of compliance requirements in the OMB Circular A-133 Compliance Supplement will be tested for each major federal program. The template also provides the auditor an opportunity to consolidate in one place the assessments of the various risks associated with each type of compliance requirement and references to audit documentation where the risk assessments are supported and testwork is performed.

Controls Overview Documents (Narrative and Checklist). Two different audit tools were developed to illustrate how an auditor might document in a Circular A-133 compliance audit the audit work associated with internal control over compliance for the types of compliance requirements selected for testing for each major program. Because audit documentation styles vary widely, both a narrative template and a checklist template were developed for the auditor to choose from.

Dual Purpose Testwork. This audit tool illustrates how an auditor might document the use of one sample to test both internal control over compliance and compliance.

Circular A-133 audits have additional requirements beyond generally accepted auditing standards and Government Auditing Standards. This illustrative practice aid will provide the auditor with an essential resource in performing the Circular A-133 compliance audit and documenting the additional Circular A-133 requirements.