OMB Releases the 2020 Compliance Supplement Addendum – What auditors and auditees need to know

Every year the Office of Management and Budget (OMB) releases the Compliance Supplement which is typically used by auditors to perform single audits. Even as the auditee, there’s information that is also beneficial to you. On Dec. 22, 2020, the Office of Management and Budget (OMB) released the Addendum to the 2020 Compliance Supplement, which is effective for audits of fiscal years ending June 30, 2020, and after. Please be aware that the Supplement Addendum must be used in conjunction with the August 2020 Compliance Supplement to determine the appropriate audit procedures to support the compliance opinion. The Supplement Addendum addresses COVID-19 implications, provides audit guidance for certain COVID-19 programs, and provides key guidance to non-federal entities that receive federal funding. Access the 2020 Compliance Supplement and Compliance Supplement Addendum here.

Caution: The Addendum was issued with no consideration of any changes to these federal programs that will result from the Consolidated Appropriations Act, 2021 (COVID-19 relief bill) that passed at the end of 2020. For example, the new legislation extended the period for spending under the Coronavirus Relief Fund program (established by the CARES Act) to Dec. 31, 2021. This extension is granted to prime recipients. If you received CRF funds as a subrecipient, the pass-through entity will be required to grant an extension. We expect additional guidance from the federal agencies administering the programs, as well as OMB, as to the impact of program changes on future audits.

As you work to understand the 2020 Compliance Supplement Addendum in its entirety, here’s what you should know.

Key takeaways

• Due date extensions - Single audit report due dates were extended three months for organizations with 2020 year-ends through Sept. 30, 2020, only if the organization received COVID-19 funding. Refer to the chart below for additional guidance.
• Implementation guidance - The pandemic led many federal agencies to issue implementing guidance (FAQs and memos, etc.) outside of the normal regulatory process for new and existing programs receiving COVID-19 funding. Your organization must consider the provisions of federal statutes, regulations, and terms and conditions of the award. However, it’s imperative that you maintain the guidance documents in effect during the period of the award that supports your decision-making. OMB advised that auditors may conclude an organization is compliant based on consideration of applicable implementing guidance in effect at the time of the activity or transaction.
• PRF SEFA reporting - The Schedule of Expenditures of Federal Awards (SEFA) reporting for Provider Relief Fund (PRF), Assistance Listing number 93.498, is based on PRF reporting requirements as specified by the Secretary of Health and Human Services in program instructions.  Expenditures and lost revenue will be reported on the SEFA starting on or after fiscal years ending Dec. 31, 2020. For those organizations with fiscal years ending June 30 or Sept. 30, 2020, expenditures, including lost revenue will be reported on your SEFA in fiscal 2021. Although PRF expenditures, including lost revenue, may be excluded from the SEFA prior to those aforementioned fiscal periods, it’s important to evaluate whether your fiscal-year aggregate remaining federal expenditures exceed the single audit threshold, i.e. $750,000.
• For-profit audit requirement - The Department of Health and Human Services (HHS) imposes an audit requirement for commercial entities, including for-profit hospitals, that receive $750,000 or more of HHS federal awards during a fiscal year. Commercial entities have two audit options available to them. The company will need to determine which option is most advantageous. It’s unclear whether the audit extensions will also be granted to commercial entities.
• Donated personal protective equipment - The pandemic led federal agencies and recipients to donate PPE that was purchased with federal funds. During the emergency period, donors/funders didn’t provide Assistance Listing information or compliance or reporting guidance. If you received donated PPE, here’s what you need to know: the value of donated PPE is NOT reported on the SEFA. Instead, you’re required to include the fair market value of the PPE at the time of receipt, in a stand-alone footnote to the SEFA that can be marked unaudited. Also, the donated PPE will not count for the purpose of determining whether the single audit threshold is met or in determining the type A/B threshold for major program programs, nor is it required to be audited as major. Despite the guidance from OMB as it relates to federal award reporting, please remember that considerations under generally accepted accounting principles for reporting these donations within your financial statements will still need to be addressed, whether you are following the FASB or GASB reporting frameworks.

Programs included in the 2020 Compliance Supplement Addendum

The Addendum includes new COVID-19 federal programs and existing federal programs with COVID-19-related changes. Below is a listing of the programs included in the Addendum.

Single audit due dates

Appendix VII of the Addendum revised several extensions that were granted under various OMB memos including M-20-11, M-20-17 and M-20-26. An extension of up to 3 months beyond the normal due date for recipients and subrecipients that received COVID-19 funding with original due dates from July 1, 2020 through June 30, 2021.

No action is required on the organization’s part to act to take advantage of the revised due dates under Appendix VII, other than maintaining documentation of the reason for delayed filing. Please note that the organization still qualifies as a “low-risk auditee” under the criteria of 2 CFR 200.520, if the extension is exercised.

Provider Relief Fund considerations (Assistance Listing Number 93.498)

The PRF agency program requirements are listed in the Addendum. Also included is guidance on the program’s objectives, procedures, compliance requirements, and other relevant information, including the impact to SEFA reporting.

Let’s review the PRF agency program requirements in greater detail:

Reporting

For the calendar year ending Dec. 31, 2020/ and the six months ending June 30, 2021, as described in the General and Targeted Distribution Post-Payment Notice of Reporting Requirements issued on Sept. 19, 2020 (subsequently updated and final as of Nov. 2, 2020), PRF recipients must report healthcare-related expenses and lost revenues to the PRF reporting system. The expenditures and lost revenues reported in the PRF reporting system will determine what’s included on the SEFA.

The Addendum instructs SEFA reporting of expenditures and lost revenues to begin with Dec. 31, 2020 fiscal year-ends. Organizations with a calendar year-end of Dec. 31, 2020, will be the first to include expenditures and lost revenues on their 2020 SEFA. Organizations with fiscal years ending June 30, 2020 or Sept, 30, 2020, will not include expenditures or lost revenues on their 2020 SEFA, rather they will be reported on their 2021 SEFA. An organization’s audited financial statements and SEFA PRF expenditures and lost revenue may differ, especially if your organization doesn’t have a calendar year-end.

The following tables summarizes the SEFA reporting requirements:

Allowable activities

For all distributions, except for the Skilled Nursing Facility Infection Control Distribution, the Addendum includes the following board provision to define allowable activities:

• Payment will only be used to prevent, prepare for, and respond to coronavirus, and the payment shall reimburse the recipient only for healthcare-related expenses or lost revenues that are attributable to COVID-19.

Activities allowed for the Skilled Nursing Facility Infection Control Distribution include costs associated with administering COVID-19 testing as well as several requirements that address the administration, reporting, and other areas related to the testing.

In addition to allowable activities, the Addendum highlights the following terms and conditions that providers will need to comply with.

• Recipient will not seek to collect from the patient out-of-pocket expenses in an amount greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network recipient.
• A recipient that retains the payment for at least 90 days without contacting HHS regarding remittance of those funds is deemed to have accepted the terms and conditions.
• Recipient must provide or have provided after Jan. 31, 2020, diagnoses, testing, or care for individuals with possible or actual cases of COVID-19 or prevented in the spread of COVID-19.

PRF for-profit considerations

While both for-profit and foreign entities are excluded from the definition of a nonfederal entity, the Department of Health and Human Services imposes an audit requirement per 45 CFR 75.216 and 45 CFR 75.501(i). Commercial entities (including for-profit hospitals) that receive $750,000 or more of federal awards during a fiscal year have two audit options available:

• A financial-related audit of a particular award in accordance with Generally Accepted Government Auditing Standards (GAGAS) in cases where the commercial organization receives awards under only one HHS program. If awards are received under multiple HHS programs, a financial-related audit of all HHS awards in accordance with GAGAS.
• A single or program-specific audit (single audit) conducted in accordance with 45 CFR Subpart F.

Both options require that all HHS awards of your organization be included, including any additional CARES Act funding such as Assistance Listing numbers 93.461 – COVID-19 Testing for the Uninsured and 93.697 – COVID-19 Testing for Rural Health Clinics or any research and development grants received.

To assist in your evaluation of which option is more advantageous for your for-profit entity, let’s consider what’s required under each option:

Financial-related audit

• Auditee schedule of costs and lost revenue for the U.S. Department of Health and Human Services (HHS Schedule)
• Auditor opinion on the HHS Schedule
• Auditor report in accordance with GAGAS on internal control over financial reporting and on compliance and other matters
• Schedule of findings, if applicable

Single audit

• Auditee financial statements
• Auditor opinion on the financial statements under GAAS and GAGAS
• Auditee schedule of expenditures of HHS awards
• Auditor in relation to opinion on the schedule of expenditures of HHS awards
• Auditor report in accordance with GAGAS on internal control over financial reporting and on compliance and other matters
• Auditor report on compliance for each major program and report on internal control over compliance
• Schedule of findings and questioned costs, if applicable
• Corrective action place, if applicable

As noted above, the single audit option requires an audit of the financial statements of the overall entity to be performed under GAGAS, as well as for the auditor to provide an opinion on compliance and a report on internal control over compliance. You will need to exercise professional judgment as you evaluate which audit option is most advantageous.

Now that we’ve explored the Addendum, let’s discuss a few questions to help you prepare for your single audit. 

When is a single audit required?

A single audit is required for nonfederal entities that expend $750,000 or more of federal awards during a fiscal year. The Uniform Guidance (UG) defines a nonfederal entity as a state, local government, Indian tribe, higher education institution, or nonprofit organization that’s a direct recipient or subrecipient a federal award.

How do I ensure the Schedule of Expenditures of Federal Awards (SEFA) is complete?

The key to the single audit is the SEFA, which is essentially a listing of all the federal awards expended during the year that is subject to 2 CFR Part 200. Because the SEFA serves as the basis for the auditor’s determination of major programs, its completeness and accuracy are vital. Be sure your SEFA includes ALL federal expenditures for the fiscal year under audit, even if PRF isn’t reported. It’s also important to ensure the Assistance Listing Number, also known as the Catalog of Federal Domestic Assistance (CFDA) number, is correct. An incomplete or inaccurate SEFA could result in failure to identify the need for a single audit, audit inefficiencies, incorrect major program selection, or additional audit costs.

Preparing the SEFA is a management responsibility, and its completeness and accuracy set the stage for a smooth audit. As a best practice, review the following websites to determine if COVID-19 or other federal funding was received. While this is not an all-inclusive listing, it’s a great place to start.

• USA Spending: is the official source for spending data for the U.S. government. Its mission is to show the American public what the federal government spends annually and how it spends the money.
• TAGGS: shows HHS’ Tracking Accountability in Government Grants System (TAGGS) warehouses over 20 years of HHS grant-award program data.
• HUD.GOV: hosts spreadsheets that provide full-year allocations for the Office of Community Planning and Development's (CPD) formula programs: Community Development Block Grants (CDBG); CDBG Recovery Housing Program (RHP); HOME Investment Partnerships (HOME); Housing Opportunities for Persons with AIDS (HOPWA); Emergency Solutions Grants (ESG); Housing Trust Fund (HTF); and Coronavirus Aid, Relief, and Economic Security (CARES Act) supplemental funding.

In addition to reviewing the above-mentioned websites, ensure you have a thorough SEFA preparation process that includes communication between the finance, grants, and other relevant departments and allows for updates to be made regularly throughout the year rather than only at the end.

What are the requirements for internal controls under UG?

Your organization must establish and maintain effective internal controls over federal awards in order to provide reasonable assurance that you’re managing such awards in compliance with federal statutes, regulations, and the terms and conditions that apply. As you consider any increased funding your organization is receiving, including COVID-19 funding, in combination with changes as a result of the work-from-home environment, the organization’s processes and controls are likely to be affected. As your organization prepares for a single audit, you should regularly evaluate and monitor compliance so that you can assess the effectiveness of internal controls and take prompt action when noncompliance matters arise.

What should I do next?

• Read the Compliance Supplement Addendum to understand its full impact to your organization, including when SEFA reporting is required for certain programs.
• Review your organization’s SEFA (or Schedule of HHS award in the case of commercial entities) to assess completeness and ensure it includes all federal expenditures for the fiscal year under audit.
• Read all documents that accompany funding received and ensure processes and controls are established to achieve compliance.
• Document decisions, including guidance used, and track spending.
• Continue to monitor federal agency websites for additional guidance.

As you navigate the complexities of your federal funding, we’re here and ready to help. Please don’t hesitate to reach out.