Compliance Audit Guide and Checklist: AU-C 935, AT-C 315 and Federal Programs

"Compliance audit" covers three different things in practice. In the CPA literature it usually means an audit of compliance with government requirements under AU-C 935, as in a single audit. It can also mean an attest engagement on compliance with specified requirements under AT-C 315. In industry it also describes internal reviews of regulatory compliance, such as wage and hour or privacy programs, which follow no AICPA standard at all.

This guide separates those meanings and then covers the AU-C 935 audit in detail, because that is where most CPA firm work and most deficiencies are.

What is a compliance audit?

A compliance audit tests whether an entity followed a defined set of requirements during a period and reports the result. The requirements can come from federal or state law, a grant or contract, a loan agreement or a regulator.

The examination engagement entry and the overview of the AU-C, AR-C and AT-C standards show where each sits.

What does a compliance audit under AU-C 935 involve?

AU-C 935 applies when the auditor is engaged or required to perform a compliance audit under GAAS, under Government Auditing Standards or under a governmental requirement that calls for an opinion on compliance. In a federal single audit the compliance audit covers each major program, and the auditor determines the major programs under 2 CFR 200.518. Materiality is applied to each major program rather than to the entity as a whole.

The auditor's two products are an opinion on compliance with the requirements that could have a direct and material effect on the program, and a report on internal control over compliance. A compliance audit does not substitute for the financial statement audit, and the financial statement opinion does not substitute for the compliance opinion. See financial audit vs single audit vs Yellow Book audit.

The requirement types in a federal program audit

For federal programs, the OMB Compliance Supplement identifies the compliance requirement types the auditor considers. They are:

• activities allowed or unallowed
• allowable costs and cost principles
• cash management
• eligibility
• equipment and real property management
• matching, level of effort and earmarking
• period of performance
• procurement and suspension and debarment
• program income
• reporting
• subrecipient monitoring
• special tests and provisions

Each program in the supplement states which types are direct and material and which are not, along with suggested audit objectives and procedures. Where a program is not in the supplement, 2 CFR 200.514(d)(3) directs the auditor to follow the supplement's guidance for programs not included. If requirements changed and the supplement has not caught up, the auditor determines the current requirements and modifies the procedures.

Step-by-step compliance audit procedures

1. Establish the requirements. List the programs, the award agreements and the compliance requirements that could have a direct and material effect. For federal programs start with the Compliance Supplement.
2. Plan and assess risk. Assess the risk of material noncompliance for each relevant requirement, considering the program's inherent risk, prior audit experience and oversight by agencies and pass-through entities.
3. Understand internal control over compliance. 2 CFR 200.514(c)(2) requires procedures to understand internal control over federal programs sufficient to plan the audit to support a low assessed level of control risk of noncompliance for major programs.
4. Plan and perform tests of controls. For major programs the auditor plans and performs testing of controls to support a low assessed level of control risk for the relevant assertions, unless the controls are likely to be ineffective. In that case the auditor reports a significant deficiency or material weakness, assesses control risk at the maximum and considers additional compliance tests (200.514(c)(4)).
5. Perform compliance tests. Tests of transactions and other procedures must provide sufficient appropriate evidence to support the opinion on compliance (200.514(d)(4)).
6. Evaluate results. Distinguish deficiencies in controls from instances of noncompliance, project likely questioned costs where the sample design allows, and determine materiality in relation to each requirement type.
7. Follow up on prior findings. The auditor follows up on prior audit findings regardless of whether they relate to a major program, including assessing the summary schedule of prior audit findings (200.514(e)).
8. Report. Issue the opinion on compliance and the report on internal control over compliance, and report findings in the schedule of findings and questioned costs.

What must be reported as a finding?

In a federal audit, 2 CFR 200.516(a) requires the auditor to report as findings, among other items:

• significant deficiencies and material weaknesses in internal control over major programs
• material noncompliance with federal statutes, regulations or award terms for a major program
• known questioned costs for a type of compliance requirement for a major program when either the known or the likely questioned costs are greater than $25,000
• known questioned costs greater than $25,000 for a federal program that is not audited as a major program

Deficiency classification follows AU-C 265 rather than a dollar cutoff. See the schedule of findings and questioned costs template.

Worked example (illustrative): testing eligibility

An agency program paid $600,000 in benefits to 400 participants during the year. The auditor selects 40 participant files and re-performs the income eligibility determination against the program rules and the participant's documentation.

• Two files show household income above the limit. Benefits paid in those two files were $900 each, so known questioned costs are 2 × $900 = $1,800.
• The error rate in the sample is 2 ÷ 40 = 5%. If the sample is representative and benefits per file are similar, projected likely questioned costs are 5% × $600,000 = $30,000.
• Because likely questioned costs of $30,000 exceed $25,000 for the eligibility requirement, the auditor reports the known questioned costs of $1,800 as a finding even though the known amount alone is below $25,000, and gives the context on likely questioned costs.
• The auditor also evaluates the control that should have caught the errors, in this case a second-person review of eligibility determinations, to see whether the deficiency is significant or a material weakness.

Projection methods depend on how the sample was designed. The simple ratio above applies only to a representative sample of similarly sized items.

Compliance audit checklist

Before fieldwork:

• Requirements and programs listed, with the Compliance Supplement parts for each
• Major program determination documented
• Entity's compliance controls understood and flowcharted
• Staff competent for the program and subject to the CPE rules that apply

During fieldwork:

• Controls tested for each direct and material requirement type
• Compliance transactions tested with sample sizes and selection method recorded
• Subrecipient monitoring and subaward information tested where applicable
• Reporting tested by agreeing federal reports to underlying records
• Questioned costs and exceptions quantified and carried to a summary

At completion:

• Findings evaluated against the reporting criteria
• Representation letter obtained with compliance assertions
• Prior-year findings followed up
• Reports drafted and cross-referenced to the file

The single audit compliance supplement checklist and the subrecipient monitoring checklist give item-by-item versions.

Mistakes to avoid

• Testing the financial statements and treating the compliance audit as covered.
• Using the entity-wide financial statement materiality for program compliance instead of materiality for each major program.
• Not testing controls when the Compliance Supplement approach assumes it.
• Missing subrecipient monitoring, a frequent source of findings.
• Not quantifying likely questioned costs.

Frequently asked questions

What is the difference between a compliance audit and a financial audit?

A financial audit gives an opinion on the financial statements. A compliance audit gives an opinion on compliance with specified requirements. A single audit includes both.

Is a compliance audit the same as an internal audit?

No. Internal reviews of compliance programs are management activities and follow no AICPA standard. An AU-C 935 audit is performed by an independent auditor and ends in a report on compliance.

What does AU-C 935 require?

It applies when a compliance audit is required under GAAS, Government Auditing Standards or a governmental requirement. The auditor expresses an opinion on compliance and reports on internal control over compliance, applying materiality to each major program.

What standard covers a compliance examination outside a single audit?

AT-C 315, Compliance Attestation, covers examinations or reviews of compliance with specified requirements or internal control over compliance.

Sources

• AICPA, AU-C Section 935, Compliance Audits
• AICPA, AT-C Section 315, Compliance Attestation
• OMB, 2 CFR 200.514, Scope of audit, and 200.516, Audit findings: https://www.ecfr.gov/current/title-2/part-200/subpart-F
• OMB, 2 CFR 200.518, Major program determination: https://www.ecfr.gov/current/title-2/section-200.518
• OMB, Compliance Supplement: https://www.whitehouse.gov/omb/information-for-agencies/circulars/
• AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error