2008 Governmental Audit Quality Center Annual Update Webcast April 29, 2008

1. 2008 Governmental Audit Quality Center Annual Update WebcastApril 29, 2008

2. Program Objectives This program is designed to help you: • Get an update on Center activities and membership • Learn about the latest technical matters relating to your 2008 audits • Get the latest news on audit quality including an update on the federal study on single audit quality (PCIE report) and the GAQC and agency response • Learn about resources to help you maintain or improve audit quality

3. Amanda Nelson, CPA Partner KPMG LLP ___ Mary Foelster, CPA Director AICPA Governmental Auditing and Accounting Bliss Jones, CPA Shareholder Jones and Kolb ___ John F. Hudson, CPA Moderator & President Hudson Consulting Group, LLC Today’s Speakers

4. What We Will Cover • Webcast Rules and Protocols • GAQC Update • Technical Update (including practice tips) • OMB, GAO, FAC, Single Audit Quality, HUD, DOE, AICPA, FASAB, FASB, and GASB • Resources Available to You

5. Webcast Rules and Protocol • Membership requirement for GAQC designated audit quality partner • Executive Committee believes that it is important to get leaders of governmental audit practices together at least once a year • Ask questions…even if we cannot address them all today, we will summarize and post to GAQC Member Discussion Forum Web site (http://gaqc.aicpa.org/Community/Member+Discussion+Forum.htm) • Webcast will be archived – encourage staff to view • CPE available for live viewing of Webcast only

6. GAQC Update

7. GAQC Update • Current Membership Statistics • Over 980 member firms representing 50 states, Puerto Rico, and US Virgin Islands • 81% of 2006 federal $$$ audited in Clearinghouse by firms • 42% of number of 2006 single audits performed by firms in the Clearinghouse • New stats will be generated using 2008 information when FAC database complete

8. GAQC Update • Recap Activities Since the Last Webcast • Significant increase in membership • Increased recognition as a valuable resource by regulators • Timely GAQC Alerts and GAQC Updates • More conference calls and CPE available for the first time • Member Discussion Forum growing • Technical guidance • Web site improvements (including resources such as dedicated HUD Information page) • Updated resources such as illustrative reports, peer review checklists, links, etc. • Continuing to market Center to non-member firms • Interacting with regulators and other stakeholders (Single audit Roundtable and PCIE Task Forces) • Membership compliance verification questionnaire

9. GAQC Update • Future Initiatives • Completion of Task Force activities relating to PCIE report • Continued advocacy efforts with federal agencies • Tools to help members address deficiencies noted in PCIE Report • Additional member-only conference calls on audit quality topics • Continued CPE for member calls • Improve audit quality!

10. GAQC Update – Membership Requirements • For questions about or more details on the GAQC membership requirements, check the membership Q&A document at: http://gaqc.aicpa.org/Memberships/Q+and+A+Membership+Requirements.htm

11. GAQC Update - Providing GAQC Web Site Access to Staff • Designated audit quality partner decides who to give access to within firm • Welcome letter received at joining provides instructions • GAQC membership Q&A document also includes instructions at: http://gaqc.aicpa.org/Memberships/Q+and+A+Membership+Requirements.htm • Any questions? E-mail gaqc@aicpa.org

12. Technical Update

13. OMB Federal Audit Clearinghouse GAO Single Audit Quality Update HUD Department of Education AICPA Update FASAB FASB GASB Technical Update

14. Technical Update - OMB • 2008 Compliance Supplement (CS) will be available at http://www.omb.gov/grants • Appendix V will list changes – You should review in detail • Proposed changes include: • 178 programs including 5 new programs • 43 programs with significant changes • 2 clusters with major changes • Research & Development Programs • Student Financial Assistance Programs • Release of 2008 CS expected within next few weeks • Watch for GAQC Alert when CS is released • Bigger changes expected for 2009 CS

15. Technical Update - OMB • 2008 Compliance Supplement - Practice Tips • Bookmark the OMB site that catalogs the various years’ Compliance Supplements • http://www.whitehouse.gov/omb/circulars/index.html • Understand your entity to make the proper modifications to the generic steps presented within the CS • Refrain from using the CS as a checklist • Use Part 2, Matrix of Compliance Requirements, appropriately • Understand the various federal programs to determine whether modifications to the audit approach are necessary • Part 4 cannot be used without Parts 2 and 3 and should not be your defacto audit program

16. Technical Update - OMB • Transparency Act Update • FFATA (Federal Funding Accountability and Transparency Act) • www.federalspending.gov • TF on Leveraging Single Audits • Improper Payments • Circular A-87

17. Technical Update – Federal Audit Clearinghouse • New Data Collection Form to be issued soon • Intended to be used for audit periods ending in 2008, 2009, and 2010 • Comments were due February 4, 2008 • To view the AICPA comment letter on proposed form changes visit GAQC Website • Future GAQC communications will inform you when the revised DCF is issued • Required electronic submission of reporting package starting with 2008 • The current form is being used for audit periods ending in 2004, 2005, 2006 and 2007 • Reporting package submission change for 2007 (only 1 hard copy)

18. Technical Update – Federal Audit Clearinghouse • Data Collection Form – Practice Tips • Obtain DUNS/EIN numbers early • Cross reference to final reports and schedules • GAQC member-call, Avoiding Data Collection Form Problems, in GAQC archives on www.aicpa.org/GAQC under “Resource” tab • Should be reviewed by manager or partner with the same scrutiny as other single audit reporting • Importance of correct CFDA for “cross cutting” issues • DCF should have same level of detail as SEFA • Importance of non-cash reconciling items from SEFA footnotes • Independent review of findings detail

19. Technical Update - GAO • July 2007 Revisions to Yellow Book • July 2007 revision supersedes the Jan. 2007 and 2003 revisions • For performance audits, the standards to become effective for audits beginning on or after January 1, 2008 • For financial audits and attestation engagements, the standards will become effective for audits of periods beginning on or after January 1, 2008 • Adopted new terminology (e.g., SAS Nos. 102 and 112) • AICPA Governmental Audit Quality Center (GAQC) has issued updated illustrative Yellow Book audit reports that reflect the new terminology on its Web site at: http://www.aicpa.org/GAQC under the Resources tab • Potential Future revisions relating to independence and corresponding Q&A guidance

20. Technical Update – Single Audit Quality • PCIE Report Update – Senate Hearing • GAQC Testified on October 25, 2007 • Senate Homeland Security and Governmental Affairs Committee's Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security • Topic of hearing: Single Audits: Are They Helping to Safeguard Federal Funds? • Focus of hearing was on PCIE report • Witnesses: PCIE, GAO, OMB, and AICPA • Written testimony can be found at http://hsgac.senate.gov/ under hearings (scroll to October 25, 2007) • Another follow-up hearing in 18 months a possibility

21. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Archived Center call, An Overview of the Results of the National Single Audit Sampling Project, can be found on GAQC Web site under the Resources tab • Task Forces formed to examine the study's detailed findings and recommendations for the AICPA as follows: • Sampling/Materiality Issues In A Single Audit Environment • Internal Control And Compliance Responsibilities In A Single Audit Environment • Schedule Of Expenditures Federal Awards Reporting Issues • Reporting Audit Findings In A Single Audit • Single Audit Training Needs And Continuing Professional Education Evaluation • Peer Review • SAS 74

22. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Sampling/Materiality TF - Activities: • Assessed members' sampling policies to determine the diversity in sampling practices pertaining to testing internal controls and compliance • Assessment of sampling by compliance requirement • Population definition; exceptions; risks; etc. • Decision to pursue attribute sampling for internal control testing and compliance testing • Working to determine minimal sample sizes for low and high risk populations • Ultimate outcome a new chapter in AICPA Audit Guide, Government Auditing Standards and Circular A-133 (GAS/A133 Guide) (perhaps in 2009)

23. Technical Update – Single Audit Quality • Sampling Materiality TF – Practice Tips • AICPA Sampling Guide • Document rationale • Properly identify the population • Sampling is NOT a default

24. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Internal Control & Compliance TF - Activities: • Evaluated PCIE findings Reviewed risk assessment suite of auditing standards in the context of compliance auditing • Suggested revisions to the 2008 GAS/A133 Guide to incorporate more discussion of auditor responsibility over internal control • Understand of each of the five elements of COSO for each direct and material compliance requirement for each major program • Test controls noted as key (not required to test all elements of COSO) • Documentation for assessment and testing • Working on workpaper templates to address the issues noted in the PCIE report

25. Technical Update – Single Audit Quality • Internal Control and Compliance TF – Practice Tips • Testing compliance gives indirect evidence on controls, but cannot serve as the basis for assessing controls as operating effectively • Controls: What did entity do to ensure compliance? • Compliance: Did entity comply? • Ensure dual-purpose testing is properly documented • Properly identify compliance tests & controls tests • Preliminary assessment of control risk • Evaluate ineffective control • Use SAS 112 criteria & evaluation guidance • Internal control must be continually reevaluated throughout the audit process • Testing Internal Control • Tickmark/Procedure Description for an Allowability Test

26. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Schedule of Expenditures of Federal Awards (SEFA) TF - Activities: • Evaluated the procedures required to issue an “in relation to” report under AU 551 • Determined that while many of the matters cited in the PCIE report were valid concerns, they could not be attributed to the ‘in relation to’ procedures • The procedures required to mitigate the findings noted in the PCIE report would justified by the Circular A-133 requirements • Reviewed the PCIE findings to determine the appropriate practice aids to assist auditors in avoiding such findings • Clarifying guidance in 2008 GAS/A133 Guide

27. Technical Update – Single Audit Quality • SEFA Practice Tips • Communicate with the clients who have difficulty in preparing the SEFA early in the planning process to try to avoid control deficiencies • Document any control deficiencies identified during the audit and conclude whether they are required to be reported • Document your procedures • Make sure SEFA includes required elements • Listen to the recent Center call on the SEFA which can be found on the GAQC Web site under the Resources tab

28. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Findings TF - Activities: • Discussed when audit findings must be reported • Determined that an audit tool in the form of a findings worksheet would help auditors document all elements of a finding and help evaluate finding to determine what is reportable • Decided to include in the audit tool SAS 112 considerations and to develop two worksheets (that is, one for single audit findings and one for Yellow Book financial statement findings) • Determined that illustrative findings of common deficiencies using the new audit tool would help auditors determine when and how to report findings • Discussed current guidance on how to determine "likely questioned costs" • Preparing illustrative findings

29. Technical Update – Single Audit Quality • Findings TF – Practice Tips • Decision not to report documented exceptions • Disclose reasons & basis for that decision • Specifically address why it does not meet the reporting requirements • Emphasis on questioned costs • Development of illustrative examples & tools for “how to” • Educate staff and partners about the importance of the Schedule of Findings and Questioned Costs (SFQC) • Include a “cold” review as part of the reporting procedures to review the SFQC and major program work • Start with a blank “pro forma” of the SFQC

30. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Training & CPE TF - Activities: • Discussed the PCIE recommendation for prerequisite single audit training to determine best practice training • Surveyed TF members about current firm single audit training practices • Surveyed TF members about what topics and hours the ideal single audit curriculum should include • Determined a proposed best practice Single Audit curriculum structured for 3 staff levels (basic, intermediate, advanced) that includes specific topics and suggestions for annual updates was needed • Obtained feedback from various AICPA committees, expert panels, and senior leadership • Developing a proposed "grandfathering" provision, delivery guidance, Q&A implementation guidance, and introductory narrative

31. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Training & CPE TF - Practice Tips • Ensure your single audit staff gets appropriate level single audit and Yellow Book training • Review the PCIE report with special emphasis on the deficiencies noted • As a team, review the compliance supplement • Review any archived events on the GAQC website that are applicable to your audit engagements • Ensure that Managers, Partners and “cold” reviewers on single audit engagements view the 2008 Webcast • Share the GAQC alerts and newsletters with single audit staff

32. Technical Update – Single Audit Quality • PCIE Report Update – AICPA Response • Peer Review TF • SAS No. 74 TF

33. Technical Update – Single Audit Quality • Other Practice Tip • GAQC Alert # 64 addresses material reporting errors (MRE) noted in PCIE report • MRE occurs when list wrong major programs in the SFQC • Alert provides ideas to avoid making MREs • Can find GAQC Alerts on the GAQC Web site under the Resources tab

34. Technical Update – Single Audit Quality • PCIE Report Update – OMB/Federal Update • Formed 8 TFs • Determining likely questioned costs (example approaches for calculating them) • Coverage of compliance requirements (clarification that have to test if applicable) • Sampling • Developing CPE curriculum (planning to draft rules for potential revisions to Circular A-133 – 6/30/08 is the OMB deadline for drafting amendments)

35. Technical Update – Single Audit Quality • PCIE Report Update – OMB/Federal Update • Formed 8 TFs (Continued) • Suspension and debarment • Dialog with AICPA and NASBA (ethics and peer review) • Approach for Federal Quality Control Reviews • Ideas for redesign of single audit

36. Technical Update – Single Audit Quality • PCIE Report Update – GAO Study • Senate request for GAO to study single audit issues • Focus on single audit process • Interviews with key stakeholders • Single Audit Expert Panel with key stakeholders this summer • Report to Senate in the Fall

37. Technical Update - HUD • Consolidated Audit Guide Revisions in Process • Chapter 1 – General Audit Guidance • Chapter 2 – Reporting requirements and sample reports • Chapter 3 – Multi-family Housing Programs • Chapter 4 –Nursing Homes • Effective Dates? • All other chapters revised, reissued, and effective • See GAQC HUD Information page (under the Resources tab on GAQC Web site) for details on previously revised chapters, including effective dates

38. Technical Update - HUD • Proposed IPA Roster • HUD proposal would create an Independent Public Accountant (IPA) roster of auditors that are allowed to perform HUD audits • Firms would have to register with HUD and agree to adhere to eligibility requirements • HUD would have the ability to remove auditors from the roster for various reasons including failing to maintain compliance with eligibility requirements • Once removed, a firm would no longer be allowed to perform HUD audits • GAQC Comment Letter on the proposal can be accessed on the GAQC Web site home page • 70+ comment letters submitted to HUD • New HUD page on GAQC Website

39. Technical Update - DOE • Recent Dear CPA Letter 08-1 • Amends December 1996 Audit Guide, Compliance Audits (Attestation Engagements) for Lenders and Lender Servicers Participating in the FFEL Program (Lender Guide), to provide for an agreed-upon procedures engagement relating to prohibited inducements paid by lenders to postsecondary institutions or other parties • Recent Dear CPA Letter 07-03 • Amends January 2000 Audit Guide, Audits of Federal Student Financial Assistance Programs at Participating Institutions and Institution Servicers, to provide inducement guidance • Status of Audit Guide Revisions (Lender and SFA) • Delayed

40. Technical Update - AICPA • Auditing Standards • Clarity Project • Risk Assessment Standards • SAS No. 112 • SLG and GAS/A-133 Guides • NPO Guide

41. Technical Update - AICPA • Auditing Standards • Clarity Project • Address concerns over length and complexity of standards • Make standards easier to read, understand and implement • Will lead to enhancements in audit quality

42. Technical Update - AICPA • Auditing Standards • Risk Assessment Standards • Objective is to guide auditors to areas of greatest risk whether caused by error or fraud • Issued in March 2006. • Effective for periods beginning after 12/15/06 • Archived Center call, An Overview of the New AICPA Risk Assessment Standards, providing general overall guidance on the risk assessment standards can be accessed via the GAQC Web site under the Resources tab • Upcoming Center call on May 14, 2008, to be held on implementing the risk assessment standards in a state and local government financial statement audit; CPE to be offered

43. Technical Update - AICPA • Auditing Standards • The risk assessment standards consist of: • SAS No. 104, Amendment to Statement on Auditing Standards No. 1 • SAS No. 105, Amendment to Statement on Auditing Standards No. 95, Generally Accepted Auditing Standards • SAS No. 106, Audit Evidence • SAS No. 107, Audit Risk and Materiality in Conducting an Audit (Audit Risk and Materiality) • SAS, No. 108, Planning and Supervision • SAS No. 109, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (Assessing Risks) • SAS No. 110, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (Performing Procedures) • SAS No. 111, Amendment to Statement on Auditing Standards No. 39, Audit Sampling

44. Gain an understanding of the entity Perform risk assessment procedures Assess the risks of material misstatement Assertion Level Overall financial statement Level Further audit procedures Overall Responses Evaluate Sufficiency of Audit Evidence

45. Technical Update - AICPA • Auditing Standards • SAS No. 112 • In June 2007, OMB issued a Notice in the Federal Register that revises Circular A-133 to adopt internal control terminology consistent with SAS No. 112 • Concurrently, Auditing Standards Board issued an auditing interpretation which defines the terms control deficiency, significant deficiency, and material weakness from the perspective of reporting on internal control over compliance in a Circular A-133 audit • At the same time, GAQC issued revised illustrative single audit reports • All illulstrative reports can be accessed at: http://gaqc.aicpa.org/Resources/Illustrative+Auditors+Reports/ • Listen also to archived Center call, Application of SAS 112 in a Single Audit, which can be found on the GAQC Web site under the Resources tab

46. Technical Update - AICPA • Auditing Standards • SAS No. 112 • PCAOB AS5 changed definitions • Conforming changes to SAS 112 will also likely be made • Any definitional changes will be effective most likely in 2009 (early implementation may be allowed?) • Other changes will be made through the clarity project • Archived center call, Impact of SAS 112 on Governmental Financial Audits, available on GAQC Web site under the Resources tab

47. Technical Update - AICPA • Status of A&A Guides • GAS/A133 Guide • Being drafted • July 2007 Yellow Book being incorporated • Risk Assessment Standards • SAS 102 “must and shoulds” • Some guidance on avoiding PCIE Report deficiencies • Expected released date of summer 2008

48. Technical Update - AICPA • Status of A&A Guides • State and Local A&A Guide • In production and available in early Summer 2008 • SAS 102 “must and shoulds” • Other new SAS guidance • New GASB standards that become effective this year • Footnotes to identify places where GASB standards issued but not yet effective

49. Technical Update - AICPA • Status of A&A Guides • NPO A&A Guide • In production and available in early Summer 2008 • SAS 102 “must and shoulds” • Other new SAS guidance • Task force working on complete overhaul to the Guide to address many issues that have accumulated • 2-4 year timeframe

50. Technical Update – FASB • NPO Update • Proposed FSP on Endowment (UPMIFA) • Review recent Center call on this exposure draft (ED) available on the GAQC Web site under the Resources tab • Proposed effective date of June 30, 2008, year-ends • Omnibus FSP • Fair Value Measurements • Consolidation and Equity Method Guidance • Upcoming NPO Webcast on June 5, 2008, will provide good information to assist you with your NPO financial statement audits