Internal control over compliance: planning for low control risk and testing it

• Explain why 200.514(c) requires planning for a low assessed level of control risk
• Map controls to each direct and material compliance requirement using Part 6
• Identify when testing controls is not required and what must be reported instead
• Evaluate control deficiencies by type of compliance requirement

The rule is stricter than GAAS

In a financial statement audit, testing controls is a choice you make when it is efficient or when substantive procedures alone cannot provide enough evidence. A single audit removes that choice. 2 CFR 200.514(c) requires the auditor to:

• obtain an understanding of internal control over federal programs sufficient to plan the audit to support a low assessed level of control risk of noncompliance for major programs;
• plan the testing of internal control over compliance for each major program to support a low assessed level of control risk for the assertions relevant to the compliance requirements; and
• perform that testing as planned.

The one exception, in 200.514(c)(4): when internal control over some or all compliance requirements for a major program is likely to be ineffective in preventing or detecting noncompliance, the planning and testing are not required for those requirements. The auditor must then report a significant deficiency or material weakness under 200.516, assess control risk at the maximum and consider whether additional compliance testing is needed.

What the auditee must have

2 CFR 200.303(a) requires the recipient or subrecipient to establish, document and maintain effective internal control over the federal award that provides reasonable assurance it manages the award in compliance with statutes, regulations and award terms. Those controls should align with the Green Book (Standards for Internal Control in the Federal Government) or the COSO Internal Control - Integrated Framework. The 200.303 standard page covers the full list of 200.303 obligations.

Using Part 6

Part 6 of the Compliance Supplement applies the five COSO components (control environment, risk assessment, control activities, information and communication, monitoring) to federal programs and gives illustrative controls by type of compliance requirement. It is guidance, not a checklist. Your job is to identify the controls the entity actually relies on for each direct and material requirement.

A practical approach for each major program:

1. List the direct and material requirements from the Compliance Supplement scoping.
2. Walk through each one to identify the key control or controls that prevent or detect noncompliance, for example a second-person eligibility review, a grant manager's approval of allowability on each invoice, or a reconciliation of the federal report to the ledger.
3. Evaluate design and implementation.
4. Test operating effectiveness for the period, using attribute sampling or other appropriate methods.
5. Conclude on control risk for each requirement.

Shared and entity-level controls

Many controls serve several programs: a payroll certification process for allowable costs, a procurement policy, a centralized cash draw. You can test a shared control once and use the evidence for every major program that relies on it, as long as the population covers all those programs and the documentation says so. Entity-level elements such as the control environment and monitoring are assessed once, but the conclusion still has to land on each requirement for each program.

Evaluating deficiencies

The auditor evaluates whether a deficiency is a significant deficiency or material weakness in relation to a type of compliance requirement for a major program (200.516(a)(1)), not in relation to the financial statements. A control failure can be a material weakness over compliance for one program's eligibility requirement and immaterial to the financial statements. Deficiencies over compliance are reported in the report on internal control over compliance and as findings. See AU-C 265 for the deficiency definitions that carry into the compliance audit.

Common peer review findings

• Controls tested only substantively, with no testing of internal control over compliance and no 200.514(c)(4) conclusion.
• One walkthrough of the overall grant process with no link to specific compliance requirements.
• Control samples drawn from one program but relied on for others.
• Testing of the review step with no evidence of what the reviewer actually checked.
• Deficiencies over compliance evaluated against financial statement materiality.

The control testing guide and attribute sampling example cover the mechanics.

Summit Ridge Food Bank: eligibility controls for one major program