Corrective Action Plan and Summary Schedule of Prior Audit Findings Under 2 CFR 200.511

A Single Audit reporting package carries two documents that the auditor does not write. Both come from the auditee under 2 CFR 200.511: the summary schedule of prior audit findings and the corrective action plan. They look administrative, but they feed directly into the auditor's work, into the federal agency's follow-up and into the auditee's next audit. A weak plan produces a repeat finding, and a repeat finding is a fact the auditor must report.

This guide walks through what each document must contain, where the auditor tests it and how a firm's staff can stage both before fieldwork closes. It paraphrases the regulation and is not a substitute for the text of 2 CFR 200.511 and 200.516.

Two documents, two jobs

The summary schedule of prior audit findings looks backward. It reports the status of findings and questioned costs from earlier audits. The corrective action plan looks forward. It responds to each finding in the current auditor's report.

Both belong to management. The auditor's schedule of findings and questioned costs states what the auditor found. The auditee's documents state what management did about earlier findings and what it will do about new ones. The corrective action plan must be a document separate from the auditor's findings described in 2 CFR 200.516, so it cannot be folded into the findings text.

What the summary schedule must contain

The summary schedule reports the status of all audit findings and questioned costs in the prior audit report, including findings carried in earlier summaries, except those marked corrected or no longer valid. Both documents must also cover the financial statement findings that GAGAS required the auditor to report, not only the federal program findings.

Each entry carries:

• The reference number the auditor assigned to the finding.
• The fiscal year in which the finding first occurred.

What else the entry says depends on the status.

Fully corrected. The entry needs only to be listed with a statement that corrective action was taken. No narrative history is required.

Not corrected or only partly corrected. The entry must describe the reasons the finding recurred, the planned corrective action and any partial corrective action already taken. If the action now planned differs significantly from what the auditee reported earlier, the summary must explain why.

Invalid or not warranting action. An auditee may describe a finding this way only when all three conditions are met: two years have passed since the audit report containing the finding was submitted to the Federal Audit Clearinghouse, the federal agency or pass-through entity is not following up on the finding, and no management decision has been issued. The auditee must describe the reasons it considers the finding invalid. Staff reviewing a draft summary should check all three conditions on the page, because an entry that cites only the passage of time does not meet the test.

What the corrective action plan must contain

The corrective action plan is prepared at the completion of the audit and addresses each finding in the current-year auditor's report. For each finding the plan states:

• The name or names of the responsible contact persons.
• The corrective action planned.
• The anticipated completion date.

If the auditee does not agree with a finding or believes no corrective action is required, the plan must include a detailed explanation of its position. Silence is not an accepted response. A finding with no entry in the plan, or an entry with no owner and no date, leaves the package incomplete.

Use the finding reference numbers consistently. The same number connects the auditor's schedule, the plan, the next year's summary schedule and any later management decision from the federal agency or pass-through entity.

How the auditor uses both documents

The summary schedule is not a courtesy. Under 2 CFR 200.516, the auditor reports instances where audit follow-up procedures show that the summary schedule of prior audit findings materially misrepresents the status of a prior finding. The auditor therefore performs follow-up procedures on prior findings and compares the results with what management reports.

In practice the follow-up work is a short set of steps:

1. List every finding from the prior reporting package, including questioned costs, by reference number.
2. Obtain management's draft summary schedule and tie each line to the list.
3. For each finding marked corrected, test the control or process that was changed. Inspect evidence that the fix operated, not a memo that says it was designed.
4. For each finding marked partly corrected or uncorrected, compare the reasons and planned action to what the auditor sees in the current testing.
5. Conclude and document whether any entry misrepresents status, then consider the effect on the schedule of findings and questioned costs.

The auditor also identifies, in each current finding, whether it repeats a finding from the immediately prior audit and cites the prior reference numbers. That is a required element of the finding itself, so the summary schedule and the findings should agree about which items repeat.

Writing a plan the agency can accept

Federal agencies and pass-through entities issue management decisions on audit findings, and the corrective action plan is the starting point for that decision. Under 2 CFR 200.521 the decision states whether the finding is sustained and what action the auditee is expected to take, and it can set a timetable if corrective action is incomplete. A plan that gives a named owner, a specific action and a date gives the decision-maker something to accept. A plan that says "management will review procedures" invites a request for more information.

Practical points for the plan:

• Tie the action to the cause. The auditor's finding states criteria, condition, cause and effect. The plan should answer the cause. If the cause is a missing review step, the action is a review step with a reviewer and a frequency.
• Name one owner per finding. Shared ownership delays correction.
• Date every action. An anticipated completion date lets the next year's summary schedule report status against a commitment.
• Address questioned costs. If the finding includes questioned costs, the plan should say how the auditee will resolve them, such as support obtained or costs repaid.

Staging the work before fieldwork closes

Both documents depend on the auditor's final finding numbers and wording, so they are often the last items collected. A firm can reduce the delay by building the shell early:

• Create the summary schedule skeleton from the prior-year package as soon as the engagement opens, with reference numbers and first-occurrence years filled in.
• Send management a template for the corrective action plan with the required fields: contact, action, completion date and, where needed, the explanation of disagreement.
• Agree on a date for management's responses before the exit conference, so findings are not reworded after the plan is drafted.
• Keep the plan and the findings in separate documents in the audit file, cross-referenced by number.

Common problems

• Status without evidence. Management marks a finding corrected, but the control was only designed, never operated.
• Missing first-occurrence year. Without it the schedule fails a required element and the age of the problem is hidden.
• Plan merged into the findings. The regulation requires a separate document.
• Disagreement without explanation. The plan says "no action required" and gives no reasoning.
• Stale entries. A finding is dropped as invalid after one year, not meeting the two-year, no-follow-up, no-decision conditions.

Related reading

For the finding elements the plan responds to, see writing findings for the schedule of findings and questioned costs. For the full process, see the Single Audit walkthrough. For the filing mechanics, see Single Audit data collection form and due dates.

CORAA prepares ready-to-review audit files for US CPA firms. The prior-finding tie-out lists and the document shells described here are the kind of preparation that arrives ready for your review; you keep the client, the review and the signature. See /us.

Sources

• Legal Information Institute, 2 CFR 200.511, Audit findings follow-up: https://www.law.cornell.edu/cfr/text/2/200.511
• Legal Information Institute, 2 CFR 200.516, Audit findings: https://www.law.cornell.edu/cfr/text/2/200.516
• Legal Information Institute, 2 CFR 200.521, Management decisions: https://www.law.cornell.edu/cfr/text/2/200.521

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error