Each year, the Office of Management and Budget (OMB) issues a 2 CFR Part 200, Appendix XI Compliance Supplement (Compliance Supplement). The Compliance Supplement provides a road map that auditors must follow when performing a Single Audit (established under the Single Audit Act of 1984), and it can be used as a tool by auditees to better understand the audit process and what auditors will be testing.
A deeper dive into the compliance supplement.
The 2021 Compliance Supplement is required to be used on Single Audits for years beginning after June 30, 2020. A summary listing of changes made to all Parts and Appendices of the 2021 OMB Compliance Supplement can be found in Appendix V to the Compliance Supplement. Appendix V and Appendix VII, described in more detail below, are always the first two sections we reference when a new Compliance Supplement is issued.
Part One
The Compliance Supplement comprises eight parts. Part One describes the background, purpose, and applicability of the Compliance Supplement and provides very general information.
Part Two
Part Two covers the matrix of compliance requirements for various programs designated by the program’s Assistance Listing or AL (formerly known as CFDA) number. Annually, federal agencies must submit a matrix detailing up to six of the twelve compliance requirements that will be Subject to Audit. Therefore, if a grant was required to follow the Allowable Cost principles, but Part 2 has “N” in the Allowable Cost column for that particular program, the Single Audit will not be testing Allowable Costs.
The 12 compliance requirements consist of:
Activities allowed or unallowed
Allowable costs/cost principles
Cash management
Eligibility
Equipment and real property management
Matching, level of effort, earmarking
Period of performance
Procurement suspension and disbarment
Program income
Reporting
Subrecipient monitoring
Special tests and provisions
The Federal agencies submit this information for ALs that have a high level of federal assistance issued from the agency. However, it does not include all ALs that have been issued. Updates are made annually and ALs are modified, added, or removed to this matrix. The yellow highlights in the 2021 Compliance Supplement – Part Two represent changes from the 2020 Compliance Supplement.
Part Three
Part Three of the Compliance Supplement covers the 12 previously mentioned compliance requirements, except for special tests and provisions. It provides an overview of each compliance requirement, based on the 12 compliance requirements. In addition, it provides an overview of the audit objectives and suggested audit procedures, for example sampling and reviewing policies. It also covers the requirement to obtain an understanding and test the effectiveness of internal controls over the compliance requirement. As special tests and provisions are unique to the specific program, the Compliance Supplement does not give guidance on how to test them, only that testing must be covered.
Part Four
Part Four covers the federal agencies’ specific program requirements for ALs included in the Compliance Supplement. Federal agencies may include key guidance in this area for the auditors to reference when testing the related programs. This part is updated regularly in the Compliance Supplement with any changes in federal programs.
In the 2020 Compliance Supplement, there were additions to Part Four for new Federal COVID programs, including the Coronavirus Relief Fund and Education Stabilization Fund. One of the factors to consider with the new federal programs is whether they will be audited as a major program. Understanding Part Four for your specific program is essential to understanding the key requirements that are being communicated to your auditor and the compliance requirements Subject to Audit.
Part Five
Part Five of the Compliance Supplement covers the same areas as Part Four, but instead of individual programs, it focuses on the clusters included in the Compliance Supplement, particularly the Research and Development and Student Financial Aid clusters. In addition, the last section of Part Five formally identifies program clusters, which is information needed to know when preparing the Schedule of Expenditures of Federal Awards (SEFA) and ensuring that, when applicable, federal programs are reported and subtotaled by cluster. These clusters are treated as a single program as part of the major program determination done by auditors and could impact the level of testing performed.
Part Six
Part Six of the Compliance Supplement covers internal controls. Organizations receiving federal assistance must maintain a system of internal controls that provides reasonable assurance of compliance with federal requirements. Under Single Audits, the auditor must gain an understanding and audit the controls over the applicable compliance requirement.
In addition, part six provides an example of a recommended control structure and control activities that organizations can adopt. It includes controls under the “Standards for Internal Control in the Federal Government” (Green Book) which is issued by the Government Accountability Office, and the “Internal Control Integrated Framework” (COSO Framework), issued by the Committee of Sponsoring Organization of the Treadway Commission. Although not required to implement the recommended control framework or control activities outlined in Part Six, the guidance in this section is very helpful to new or existing federal award recipients that need to implement or strengthen internal controls.
Part Seven
Part Seven of the Compliance Supplement provides guidance for when an AL is not included in the Compliance Supplement and how the program should be audited. This section does not provide the same level of insight for auditees as the other sections and is more geared towards auditors.
Part Eight
Part Eight of the Compliance Supplement includes the following appendices:
Federal Programs Excluded from the A-102 Common Rule and Portions of 2 CFR Part 200 (Appendix I)
Federal Agency Codification of Government-wide Requirements and Guidance for Grants and Cooperative Agreements (Appendix II)
Federal Agency Single Audit, Key Management Liaison, and Program Contacts (Appendix III)
Internal Reference Tables (Appendix IV)
Appendix IV identifies programs deemed by the OMB to be “higher risk”. Auditors use this information primarily when determining which federal awards should be audited as major programs . The 2021 Compliance Supplement includes all new programs created by the American Rescue Plan, as well as the following:
Title | Agency | AL/CFDA |
Medicaid Cluster | HHS | 93.778 / 93.777 / 93.775 |
Provider Relief Fund | HHS | 93.498 |
Testing for the Uninsured | HHS | 93.461 |
Airport Improvement Program | Transportation | 20.106 |
Federal Transit Cluster | Transportation | 20.500 / 20.507 / 20.525 / 20.526 |
Coronavirus Relief Fund | Treasury | 21.019 |
Emergency Rental Assistance* | Treasury | 21.023 |
Education Stabilization Fund | Education | 84.425 |
*This program, established by the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSAA), will not be included in the 2021 Compliance Supplement. Reference Appendix VII for more information about the planned timing of subsequent follow-up Supplement issuance(s).
Other Appendices
This Appendix covers key audit advisories and guidance on identifying COVID-19 federal programs in the SEFA, disclosure of donated Personal Protective Equipment, and how auditors should utilize Agency Guidance that has specifically been issued for many of the federal COVID-19 programs.
List of Changes for the 2021 Compliance Supplement (Appendix V)
Program-Specific Audit Guides (Appendix VI)
Other Audit Advisories (Appendix VII)
In addition, Appendix VII of the 2021 Compliance Supplement identifies that additional Compliance Supplement addendums are planned to be issued and posted on CFO.gov website for at least the following programs:
Final Appendices
Examinations of EBT Service Organizations (Appendix VIII)
Compliance Supplement Core Team (Appendix IX)
Takeaway
The Compliance Supplement serves as a roadmap for auditors and can be leveraged by auditees to understand the compliance requirements that are applicable to specific programs, and what auditors will likely be testing during the single audit. If you require a single audit or need help preparing for a single audit, our team is here to help. Let's get started.