Auditee responsibilities, auditor procurement and the cognizant agency

• List the four auditee responsibilities in 2 CFR 200.508
• Apply the 200.509 procurement and indirect cost proposal restrictions to auditor selection
• Identify the cognizant agency for audit or oversight agency for an auditee
• Recognize the remedies under 200.505 when an auditee fails to obtain an audit

What the auditee owns

2 CFR 200.508 puts four responsibilities on the auditee, not the auditor. The auditee must:

1. Arrange for the audit under 200.509 and ensure it is properly performed and submitted under 200.512.
2. Prepare financial statements, including the schedule of expenditures of federal awards (SEFA) under 200.510.
3. Promptly follow up and take corrective action on audit findings, including preparing the summary schedule of prior audit findings and the corrective action plan under 200.511.
4. Give the auditor access to personnel, accounts, books, records, supporting documentation and other information needed for the audit.

These responsibilities matter in practice because they frame the engagement letter and management representations. When the auditor drafts the SEFA or the financial statements as a nonaudit service, the auditee still owns them, and the auditor must evaluate the independence implications under GAGAS before accepting. The single audit engagement letter template spells out these responsibilities.

Procuring the auditor

200.509(a) requires the auditee to follow the procurement standards in 200.317 through 200.327 (or the FAR, as applicable) when buying audit services. The request for proposal must make the audit's objectives and scope clear and must ask for a copy of the audit organization's peer review report, which the auditor must provide under GAGAS. Evaluation factors include responsiveness, relevant experience, availability of qualified staff, the results of peer and external quality control reviews, and price.

Two restrictions follow:

• An auditor who prepares the indirect cost proposal or cost allocation plan may not be selected to perform the audit when the indirect costs recovered by the auditee during the prior year exceed $1 million (200.509(b)). The restriction applies to the base year and every later year the resulting rate or plan is used.
• Federal auditors may perform all or part of the work if they fully comply with Subpart F (200.509(c)).

Cognizant and oversight agencies

200.513(a) assigns a cognizant agency for audit to every non-federal entity expending more than $50 million a year in federal awards. It is the federal agency providing the largest amount of direct funding as listed on the SEFA, unless OMB designates another. When direct funding is less than 25 percent of total expenditures, the agency with the predominant amount of total funding becomes cognizant. Cognizance is set using direct awards expended in fiscal years ending in 2019 and every fifth year after that. Entities below $50 million have an oversight agency for audit instead.

The cognizant or oversight agency matters to you in three places: it can authorize an extension of the nine-month submission deadline (200.512(a)), it gives technical audit advice, and it coordinates management decisions on findings that cut across agencies.

When the auditee does not comply

If a non-federal entity continues to be unable or unwilling to have an audit conducted, federal agencies and pass-through entities must take appropriate action under 200.339 (200.505). Remedies include withholding payments, disallowing costs, suspending or terminating awards and initiating suspension or debarment. The late submission and remedies guide covers how agencies use these tools.

Common file mistakes

• The engagement letter is silent on the auditee's SEFA, summary schedule and corrective action plan responsibilities.
• Nonaudit services such as SEFA preparation are performed with no documented GAGAS independence evaluation.
• The firm prepared the indirect cost proposal and nobody checked the $1 million recovery test.
• The planning file does not identify the cognizant or oversight agency, so nobody knows who can grant a deadline extension.

Lakeshore Community College: can the firm keep both jobs?