COVID-19 and the Impact on Single Audits

Upon the passage of the Coronavirus Aid, Relief, and Economic Security (CARES) Act into law, small businesses, including not-for-profit organizations, began the process of applying for forgivable loans through the Paycheck Protection Program (“PPP”).  Many organizations have now completed the application process, which began on April 3, and the funding of the loans is starting.  This gives rise to various questions regarding whether the PPP Loans and other CARES Act funding (and the use of those funds) are subject to a Single Audit.  In the United States, the Single Audit, Subpart F of the U.S. Office of Management and Budget (“OMB”) Uniform Guidance, is a rigorous, organization-wide audit or examination of an entity that expends $750,000 or more of federal assistance (commonly known as federal funds, federal grants, or federal awards) received for its operations. It is intended to provide assurance to the federal government that a non-federal entity has adequate internal controls in place, and is generally in compliance with program requirements. Non-federal entities typically include states, local governments, Indian tribes, universities, and non-profit organizations.

On April 10, the Governmental Audit Quality Center (“GAQC”) of the AICPA issued a letter to the OMB to offer assistance to the OMB and other federal agencies, as well as bring to light some of the questions that have arisen, relating to the CARES Act funding. 

While the CARES Act had many provisions, perhaps the most popular relief options being sought are the PPP Loans and the Employee Retention Tax Credit (“ERTC”), which are mutually exclusive options.  Since the funding is from the federal government, questions have been raised whether the funding is required to be reported on the Schedule of Expenditures of Federal Awards (“SEFA”) and subject to the Single Audit requirements.

As of now, there is no clear cut answer to the questions; however, auditors and auditees need to be aware of the possibility of additional audit requirements and reporting, as they commence planning for their June 30, 2020 fiscal year-end audits.  This leads auditors and auditees to question where to look to for guidance on how to record and audit these funds.  When dealing with federal funding, most organizations would normally obtain the guidance from the OMB.  However, because of the need to have massive federal outlays of funding in such a quick timeframe, OMB has not yet been able to generate such guidance. Some of the specific questions that have been raised and need to be addressed by OMB are as follows:

• Are the PPP loans and other CARES Act funds subject to Single Audit?
• Do the PPP loans and other CARES Act funds need to be reported on the SEFA?
• What is the Catalog of Federal Domestic Assistance (“CFDA”) number associated with the funding, and what are the compliance requirements? There seems to be a lack of information surrounding how the funding flows down from the federal government.
• Will the CARES Act funding be included in the OMB Compliance Supplement?
• Will there be new clusters?
• Internal Controls – the COVID-19 situation may have changed an organization’s internal control structure. Processes may have changed prior to the organization transitioning to a working from home (“WFH”) protocol, during WFH, and when the organization starts to ramp-up again. If the auditor cannot test the internal controls, does this generate a significant deficiency or material weakness that needs to be reported?  Is the auditor required to sample testing during all three phases?
• Is the funding received by “for-profit” entities applicable to federal compliance or attestation requirements – similar to audits under the Housing and Urban Development (“HUD”) Consolidated Audit Guide (for multifamily housing and lenders) or the Department of Education Audit Guide for Proprietary Schools and Services?

The answer to whether the PPP and ERTC, as well as other aspects of the CARES Act funding, are within the Single Audit scope is important for auditees and auditors to understand early on, as it will have the potential to significantly impact the determination of major programs under the OMB Uniform Guidance (“UG”).   For other organizations, they may be subject to the requirements of a Single Audit for the first time.  Accordingly, organizations may need to budget for increased compliance costs related to additional audit requirements.

The OMB Compliance Supplement is usually issued in June or July, and OMB has stated its goal is to issue the final Compliance Supplement by the end of June 2020.  However, due to the current COVID-19 situation, this might be delayed.  Because of this, the GAQC has suggested in their letter to OMB, that they consider an automatic extension of time for submissions of the UG reports.

Regrettably, we do not have the answers to these questions and the guidance presently needed, but we all need to be aware of the possible impact the funding may have on the audit process.  EisnerAmper will keep you informed as updated guidance becomes available.