The reporting package, the data collection form and the FAC due date

• Compute the 2 CFR 200.512 submission due date
• List the four components of the reporting package
• Distinguish the auditee’s and the auditor’s certifications on the data collection form
• Prevent protected personally identifiable information from entering the package

The due date

The audit, the data collection form and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's reports, or nine months after the end of the audit period, whichever is earlier (2 CFR 200.512(a)(1)). If the due date falls on a Saturday, Sunday or federal holiday, the package is due the next business day. The cognizant agency for audit, or the oversight agency when there is no cognizant agency, may authorize an extension when the nine-month timeframe would place an undue burden on the auditee.

Timeliness has consequences beyond the deadline itself: an auditee that misses the 200.512 timeframe in either of the two preceding audit periods is not a low-risk auditee under 200.520(a), so the next audit needs 40 percent coverage instead of 20 percent. The late submission guide covers agency responses.

What the reporting package contains

200.512(c) lists four components:

1. Financial statements and the SEFA (200.510(a) and (b)).
2. The summary schedule of prior audit findings (200.511(b)).
3. The auditor's reports (200.515).
4. The corrective action plan (200.511(c)).

The summary schedule and corrective action plan are auditee documents. They are part of the package but not part of the auditor's reports, and the corrective action plan must be a document separate from the auditor's findings (200.511(c)).

The data collection form

The FAC is the repository of record for reporting packages and data collection forms (200.512(b)), and the form is submitted electronically at the Federal Audit Clearinghouse. The form captures information about the auditee, its federal programs and the audit results.

Two certifications go with it:

• Auditee. A senior-level representative (for example a state controller, finance director, CEO or CFO) signs that the auditee complied with Part 200, including that the form was prepared under Part 200 and its instructions, the package contains no protected personally identifiable information, the information is accurate and complete, and the FAC may make the package and form publicly available (200.512(b)(2)). Indian Tribes and tribal organizations may opt out of public posting, with additional distribution duties (200.512(b)(3)).
• Auditor. The auditor completes the applicable data elements from the reporting package and signs a statement on the source of the information, the auditor's responsibility for it, that the form does not substitute for the reporting package, and that its content is limited to what OMB prescribes (200.512(b)(4)). 200.514(f) makes completing and signing these sections part of the audit.

Protected PII

Auditees and auditors must keep protected personally identifiable information out of their parts of the package (200.512(a)(2)). Findings that cite participant names, Social Security numbers or case numbers tied to individuals are a common problem. Describe exceptions by sample item number instead.

Retention and management letters

The auditee keeps copies of the form and package for three years from the date of submission to the FAC (200.512(f)). When a federal agency or pass-through entity asks, the auditee must provide any management letters the auditor issued (200.512(e)).

Common file mistakes

• Using "nine months" as the deadline when the 30-day clock ran out first.
• Data collection form entries that disagree with the schedule of findings, such as a missing major program or a different Type A threshold.
• Findings that disclose participant-level PII.
• No evidence in the file that the auditor reviewed the auditee-entered sections before certifying.

Willow Creek Water District: when is the package due?