Southeastern Audit WorkshopSeptember 8-10, 2014
Asheville, North Carolina
Part 2
Internal Audit Guide
Internal Audit Guide Task Force Members
10 State DOTs represent both small and large Internal Audit shops. represent states with both combined as well as
separate Internal and External Audit functions. represent audit shops that follow GAGAS, IIA
Standards or a combination of both.
FHWA Liaison
Areas Covered in the New Internal Audit Guide
Chapter 1: Introduction (Revised); Chapter 2: Auditing Standards (Revised); Chapter 3: Types of Engagements (Revised); Chapter 4: Audit Risk Assessment and Audit Plan (Revised and expanded into
a separate chapter); Chapter 5:Internal Control (Revised and expanded into a separate chapter); Chapter 6: USDOT Agencies and Descriptions (Added since the original
draft last year) Chapter 7: Stewardship, Oversight, Laws and Regulations (Revised and
expanded into a separate chapter added Stewardship since the original draft last year);
Chapter 8: Innovative Financing and Construction Delivery Methods; (Added since the original draft last year);
Chapter 9: General Audit Program (Revised); Glossary (Revised).
Chapter 1: Introduction Sections
Overview Why a Guide? Provide Internal Auditors a reference tool that
addresses the following: Internal Controls Risk Assessment Compliance with Applicable Laws and Regulations Federal Programs Innovative Financing Effective Use of Resources
Auditing Standards Engagements- Overview of Internal Audit responsibilities.
Chapter 2: Auditing Standards
Sections Generally Accepted Government Auditing Standards
(GAGAS) International Standards for the Professional Practice
of Internal Auditing, Institute of Internal Auditors (IIA)
Comparison of GAGAS and IIA Standards
Chapter 3: Types of Engagements
Sections Types of Engagements Overview Types of Engagements- Financial, Performance,
Program Effectiveness and Results, Internal Control, Compliance, Information Technology, Follow-Up
Attestation Engagements- Examination, Review, Agreed Upon Procedures
Non-Audit or Consulting Services
Chapter 4- Risk Assessment and Development of an Audit Plan
Sections Agency Risk Assessment Overview Identify Audit Universe or Auditable Units Benefits of Auditable Units Permanent Files Risk Assessment Risk Assessment Criteria Consideration of Internal Controls and Common Threats Internal Control Weaknesses Analysis of Internal Audit Resources Developing The Audit Work Plan
Chapter 5: Internal Control
Sections Internal Control Overview COSO Categories Five Components of COSO COBIT Framework and COBIT Domains Understanding an Auditee’s Internal Controls Documenting Internal Controls Internal Controls Over Financial Reporting Evaluation of Internal Controls Classifying Internal Control Weaknesses
Chapter 6 USDOT Agencies Sections
USDOT Agencies and Descriptions General Overview Office of the Secretary Federal Aviation Administration Federal Highway Administration Federal Motor Carrier Safety Administration Federal Railroad Administration Federal Transit Administration Maritime Administration National Highway Traffic Safety Administration Office of Inspector General Pipeline and Hazardous Materials Safety Administration Research and Innovative Technology Administration Saint Lawrence Seaway Development Corporation Surface Transportation Board
Chapter 7: Stewardship, Oversight, Laws and Regulations
Stewardship and Oversight Agreement between the FHWA and State Transportation Agencies
Hierarchy Federal Requirements (2 CFR 200) Audit Requirements (Part of 2 CFR 200) Catalog of Federal Domestic Assistance (CFDA) State Law
Chapter 8: Innovative Financing and Construction Delivery Methods
Sections Grant Anticipation Revenue Vehicle (GARVEE) Transportation Infrastructure Finance Innovation Act
(TIFIA) Section 129 Loans (23 U.S.C. 129 (A) (7) Tax Increment Financing (TIF) Private Activity Bonds (PABS) Public-Private Partnerships (P3s) Design- Build (DB) Construction Manager/General Contractor (CMGC)
Chapter 9: General Audit Program
Sections Audit Program Purpose and Scope Phases
A. Preliminary Survey (Planning) Phase B. Execution (Fieldwork) Phase C. Closing (Reporting) Phase
Attestation Program Purpose and Scope
Glossary:
The glossary was expanded to address additional terms.
Practice Aid Content
Program Description; Statutes and Regulations; Catalog of Federal Domestic Assistance
(CFDA#) (if applicable); Audit Scope and Objectives; Audit Program.
Practice Aid Development Plan The Internal Audit Task Force will have ongoing
responsibilities to develop Practice Aids. As you will see from the list we began to develop, there is an extensive number of topics. Therefore, we need your assistance in providing drafts so the project can move forward more effectively. Please take the time to look at the various audits you have conducted. If you have an existing Audit Program for one of the areas or one you think should be included, please provide it for review by the Task Force. Working on this project together we will be able to accomplish more and arrive at a better product.
Benefits of Practice Aids Only an individual Practice Aid has to be amended rather than the
whole Internal Audit Guide if there are changes made to a specific program.
When there is a new program, a new Practice Aid addressing that program can be developed without amending the whole Internal Audit Guide.
Having separate Practice Aids by subject provides easier use. Each Practice Aid will focus exclusively on one program or activity.
Allowed the Task Force to break this project into manageable pieces through various projects rather than take on one huge project at once. Therefore, allowing us to provide usable products to AASHTO members more quickly.
To expedite this process, we would like to suggest having members submit audit programs to the Task Force for review and approval to be added to the site.
Completed Practice Aids
Disadvantaged Business Enterprise (DBE) Initial Certification Process
Metropolitan Planning Organizations (MPOs)
Practice Aids Currently Under Development
Federal Aid Billing Procurement Cards Materials Highway Planning and Construction (CFDA
20.205) Professional Services Consultants Airport Improvement Program, (CFDA #20.106) Transit Grants Subrecipient Monitoring
Possible Practice Aids
Disadvantage Business Enterprise (DBE) Labor & Workforce Utilization Monitoring
Value Engineering Liquidated Damages Recreational Trails Program Ferry Boat Program Congestion Mitigation and Air Quality Program
(CMAQ)
Possible Practice Aids Continued
Bridge Inspection Program Bridge Project Design & Review Bridge Analysis and Load Capacity Determinations Bridge Maintenance & Repair Oversize Overweight Permits Outdoor Advertising (Billboards) Motor Pool and Vehicle Fleet Operations Federal Funding Accountability & Transparency
Act (FFATA) Reporting
Possible Practice Aids
Land Acquisition Highway Construction Project Funds Management Highway Construction Project Cost Estimation Highway Construction Project Planning and
Preconstruction Activities Highway Construction Public Involvement Highway Construction Procurement- Bidding &
Awarding Construction Contracts Highway Construction Contractor Payments
Proposed Practice Aids Continued
Highway Construction Contractor Change Orders Highway Construction Site Audits Highway Construction Contract Administration and
Closeout Highway Construction Consultant Selection Highway Construction Consultant Contract
Modifications Highway Construction Consultant Payments Highway Safety Improvement Program Highway Rail Crossing Safety Program
Possible Practice Aids Continued
Operational Safety Inspections of Airports Operational Safety Inspections of Heliports Aircraft and Pilot Registration Aircraft Maintenance of State Fleet Airport Construction Project Funds Management Airport Construction Project Cost Estimation Airport Construction Project Planning and
Preconstruction Activities
Possible Practice Aids Continued
Airport Construction Procurement- Bidding & Awarding Construction Contracts
Airport Construction Contractor Payments Airport Construction Contractor Change Orders Airport Construction Site Audits Airport Construction Contract Administration and
Closeout Airport Construction Consultant Selection Airport Construction Consultant Contract Modifications Airport Construction Consultant Payments
Proposed Practice Aids Continued
Capital Assistance Program for Elderly Persons with Disabilities (CFDA#20.513)
Transit Capital Investment Grants (CFDA#20.500)
Transit Formula Grants (CFDA#20.507) Formula Grants for Other than Urbanized
Areas, (CFDA#20.509) Transit State Planning & Research
(CFDA#20.515)
Possible Practice Aids Continued Motor Carrier Safety (CFDA#20.218)- Truck and Charter
Bus Inspections; Motor Carrier Safety (CFDA#20.218)- Truck and Charter
Bus Compliance Reviews of New Entrants; Motor Carrier Safety (CFDA#20.218)- Safety Audits of
Trucking and Charter Bus Companies; State Traffic Safety Improvement Grants
(CFDA#20.600). National Priority Safety Programs (CFDA#20.616). High-Speed Rail Corridors and Intercity Passenger Rail
Service – Capital Assistance Grants (CFDA#20.319)Railroad Agreements;
Feedback- The Task Force Needs Your Input
Provide ideas for Practice Aids Submit Audit Programs to the Task Force
pertaining to the various topics for screening and formatting into Practice Aids by the Task Force
Where do I send my Feedback?
Alice Wilson, CPA- Co-Chair (Kentucky)[email protected]
(502) 782-4041
Stephen Kirk, CIA, CGAP- Co-Chair (Illinois)[email protected](217)557-1258
Uniform Audit and Accounting Guide Task Force
Audit Guide Survey Results
The Audit Guide Taskforce Members include representatives from 28 State DOTs
and DC. Also, 2 AASHTO and 3 FHWA representatives. 2010 issued Audit Guide update; updated 2012 2012 issued National Compensation Matrix; updated
annually 2013 Risk Assessment Framework 2013 Audit Guide Suggestion Form Current:
CPA Work paper review training 2015 Update
2014 Survey Results
Cognizance
Audits
CPA Work paper Reviews
Cognizance Cognizance Questions:
1. List top 10 cognizant firms in your state. Explain the reasons why a cognizant was not performed.
Response –Most states listed their cognizant firms but some said they are not performing cognizant reviews because of liability and/or limited/untrained staff.
5. If no cognizant is being performed, what ideas do you have for getting them completed?
Response –Multi-state joint cognizant reviews are the preferred solution.
Cognizance
Cognizance Questions:
6. Would you transfer cognizance?Response - Trust appears to still be an issue.
7. What would make it more likely for you to issue a cognizant letter of concurrence?
Response - Lack of training and staffing most cited.
Cognizance
Cognizance Questions:
8. What would make it more likely for you to transfer cognizance?
Response - Most states would agree to transfer cognizance. So what’s holding states back from issuing cognizance? Is there a need for training on the CPA Work paper review checklist?
Cognizance Questions:
9. Would you be interested in having other states assist you in performing a cognizant review using the CPA work paper review checklist?
Response - Mostly yes; however, some states citedworkload and out-of-state travel issues.
Cognizance Questions
10. Questions asked about Cognizance: What information would be useful to have in
cognizant letters? (standards followed, adjustment specifics, project specific rates, construction management, etc.)
Guidance on types of documentation? Protection and release policies?
Cognizance Questions
10. (cont.) Does FHWA have a list of consultants who need
cognizance and which states are assigned to those? What are the liabilities for the DOT in issuing a
cognizant letter? Are there significant differences between states that
are not being addressed in cognizant reviews? (OT Premium, G&A rates, allocation issues between field/home etc.)
Audits
Audit Questions:
2. Does your state perform audits of overhead rates in accordance with the Yellow Book?
Response - 11 respondents noted that they perform AICPA audits of
Indirect Cost Rates in accordance with GAGAS. Some noted that their states require audited rates
AuditsAudit Questions:
11. What, if any, standards do you follow when performing cognizance/audits/desk reviews?
Response - Audits were Yellow book or IIA Reviews:
8 Yellow book5 Attestations/Agreed upon Procedures2 IIA standards4 Non-audit services (no standards)2 AASHTO Guide
Audits Audit Questions:
12. If your shop follows Yellow book, what changes did you implement with the 2011 revisions?
Response - 12 No changes 2 Attestations, no changes necessary 2 Trained and made changes 4 Still determining impacts 2 reviewed and made changes
Audits
Audit Questions:
13. If you follow Red Book, what changes do you see when rulemaking is complete?
Response -• Most states don’t use IIA. Respondents indicated no
major impact.
CPA Work Paper reviews
CPA Work Paper Review questions:
3. Does your shop perform CPA work paper reviews?Response –
Mostly yes responses were received75% of respondents doing reviews issued Cognizant LettersSome states indicated performing work paper reviews but did not issue Cognizant Letters
CPA Work Paper reviews
CPA Work Paper Review questions:
4. If so, do you use the checklist in the Audit Guide?Response –
Most states responded YesOne state responded “not yet” One state responded that did in past but with Agency reorganization process has changed
2015 Update
Potential areas we are looking to add additional guidance: Uncompensated Overtime Premium Overtime Field Office Rates Use of “combined” rates NCM Team examining new BCA limit and impact Compensation – determining superior performance Bonuses Common Control
2015 Update
Review of non-executive compensation Allowable components in FCCM Bid and Proposal Costs – Design build Stipends Legal Costs Testing of Time Sheets Audit Reports and Minimum Disclosure Issuing/Transferring Cognizance Acceptance of CPA Audit Transferring cognizance
Questions?