- admin@RoseGroup.cpa
- 919-913-8081
The goal is an unmodified opinion without findings. What if your audit has findings?
For an executive director or board member, that can feel discouraging. Your team worked hard to manage the funding, deliver the services and get through the audit. Now there is a problem in a report that your funding agency will receive.
The next step matters.
A finding deserves attention, but it does not automatically mean fraud occurred or that your organization will lose its funding. You need to understand what happened, address the underlying cause and document that the correction actually works.
In our article on common Single Audit findings, we discussed problems nonprofits can prevent before the auditors arrive. This article addresses what happens when one of those problems becomes a finding, including how to write a Single Audit corrective action plan that holds up.
Before drafting a response, sit down with the finding and work through its parts:
Pay attention to the scope. Was one approval missing, or was there no approval process? Did a reconciliation contain an error, or were reconciliations never prepared?
An isolated exception and a process that consistently fails require different responses. But even one exception can reveal a broader weakness. Ask enough questions to understand which situation you have.
Also clarify whether the finding involves questioned costs, a significant deficiency, a material weakness or an effect on the compliance opinion. Those terms have different meanings. Your auditor should explain the classification and its implications in plain English.
The auditor identifies and reports the finding. Management is responsible for addressing it.
Under 2 CFR § 200.511, the organization must follow up on audit findings, prepare a corrective action plan for current findings and report the status of prior findings.
Your auditor can explain the requirement and discuss the deficiency. Management must make the decisions, assign responsibility and implement the changes.
That distinction matters when the response is something like:
“We will work with our auditor to make sure this does not happen again.”
Who inside the organization will change the process? Who will review the work? What happens when the employee responsible is out?
If those questions remain unanswered, the organization does not yet have a workable plan.
The Uniform Guidance requires a corrective action plan separate from the auditor’s findings. It must identify the responsible contact person or persons, the corrective action and the anticipated completion date. The plan must also reference the auditor’s finding number. If management disagrees with the finding or believes correction is unnecessary, it must explain why in detail.
Those are the required elements. A useful plan should also explain how the change addresses the cause.
Consider a finding involving grant reports submitted without reconciliation to the general ledger.
“Staff will receive additional training” might be part of the response, but it leaves important questions open. Did staff lack knowledge, or was nobody assigned to prepare and review the reconciliation?
An illustrative response could read:
The Finance Director, Maria Jones, will implement a reconciliation checklist by December 1. Before each grant financial report is submitted, the grant accountant will reconcile reported expenditures to the general ledger and explain differences. The Finance Director will review and approve the reconciliation. The reconciliation, supporting records and dated approval will be retained with the submitted report.
That gives the organization a process it can perform and evidence it can retain. Your own plan should reflect your staffing, awards and actual reporting requirements.
“We will fix it before next year’s audit” leaves too much room for delay.
Under 2 CFR § 200.521, corrective action must proceed as rapidly as possible and should begin no later than receipt of the audit report. Waiting for the funding agency’s management decision is not a reason to postpone starting.
Some changes take time. Hiring a qualified employee or replacing an accounting system may require several months.
While that work proceeds, determine what interim controls are practical. A designated reviewer might examine grant reports before submission, or management might temporarily increase its review of payroll allocations.
Set milestones and review progress. If the plan is falling behind, address the delay while there is still time to change course.
A finding may involve costs the auditor questions because of inadequate support, possible noncompliance or another issue.
Questioned costs are not automatically a final repayment determination.
The responsible federal agency or pass-through entity issues a management decision stating whether the finding is sustained and what action is expected. That may involve repayment of disallowed costs, financial adjustments or other corrective steps.
Keep the supporting records and respond promptly to requests for information.
Also recognize that correcting future procedures and resolving past expenditures are separate tasks. A new approval process does not, by itself, resolve unsupported costs from the audit period.
A prior finding does not disappear because the organization adopted a policy.
The summary schedule of prior audit findings must explain the status of earlier findings. When correction is incomplete, it must describe progress, remaining action and the reasons for recurrence. Significant changes from the earlier corrective action plan or management decision require explanation.
Before describing a finding as corrected, ask what evidence supports that conclusion.
A policy approved in June shows that management established a procedure. Completed reviews from July through October show whether employees actually followed it.
The distinction is especially important when a control happens only quarterly or annually. Management may have implemented the procedure without yet having enough activity to demonstrate that it operates consistently.
A repeat finding raises a practical question: Why did the earlier corrective action fail?
Perhaps management addressed the missing document but never changed the workflow. Perhaps the assigned employee left. Perhaps the plan required more time or expertise than the organization had available.
Repeating the same promise will not address those problems.
Revisit the cause and determine whether the organization needs different supervision, clearer responsibilities, additional resources or a simpler process.
Timing matters, too. A finding may recur because the next audit period included months before the new control began. Document when the change took effect and what happened afterward.
Changing auditors also does not resolve an outstanding finding. A nonprofit considering a new audit firm should be ready to discuss prior findings, corrective action taken and work still underway.
The board or audit committee should understand the significant findings and monitor management’s response.
Useful questions include:
The board should receive updates until the work is complete. If a deadline is missed, management should explain the reason and provide a revised plan.
Board oversight is most useful when it focuses on progress and results, while management handles implementation.
Create a file for each finding and retain the records supporting its resolution.
Depending on the issue, that might include revised procedures, completed reconciliations, dated approvals, training records, monitoring reports and correspondence with the funding agency.
Do not wait until the next audit to assemble the evidence. Keep it as employees perform the work.
Then have someone with appropriate knowledge review whether the change is achieving its purpose. Are reports being reconciled before submission? Are reviewers identifying and resolving exceptions? Does the process continue when the usual employee is unavailable?
The goal is to change the process that caused the finding and retain evidence that the change works.
A finding gives management and the board a specific problem to address. A clear response, realistic responsibilities and consistent follow-through can strengthen the organization’s grant compliance.
Rose Group CPAs works with nonprofits subject to Single Audits. If your organization had findings last year and you are unsure what to expect in the next audit—or you are considering a change in auditors—contact our team to discuss your audit needs and the status of your prior findings.