Southeastern Audit WorkshopSeptember 8-10, 2014

Asheville, North Carolina

Part 2

Internal Audit Guide

Internal Audit Guide Task Force Members

10 State DOTs represent both small and large Internal Audit shops. represent states with both combined as well as

separate Internal and External Audit functions. represent audit shops that follow GAGAS, IIA

Standards or a combination of both.

FHWA Liaison

Areas Covered in the New Internal Audit Guide

Chapter 1: Introduction (Revised); Chapter 2: Auditing Standards (Revised); Chapter 3: Types of Engagements (Revised); Chapter 4: Audit Risk Assessment and Audit Plan (Revised and expanded into

a separate chapter); Chapter 5:Internal Control (Revised and expanded into a separate chapter); Chapter 6: USDOT Agencies and Descriptions (Added since the original

draft last year) Chapter 7: Stewardship, Oversight, Laws and Regulations (Revised and

expanded into a separate chapter added Stewardship since the original draft last year);

Chapter 8: Innovative Financing and Construction Delivery Methods; (Added since the original draft last year);

Chapter 9: General Audit Program (Revised); Glossary (Revised).

Chapter 1: Introduction Sections

Overview Why a Guide? Provide Internal Auditors a reference tool that

addresses the following: Internal Controls Risk Assessment Compliance with Applicable Laws and Regulations Federal Programs Innovative Financing Effective Use of Resources

Auditing Standards Engagements- Overview of Internal Audit responsibilities.

Chapter 2: Auditing Standards

Sections Generally Accepted Government Auditing Standards

(GAGAS) International Standards for the Professional Practice

of Internal Auditing, Institute of Internal Auditors (IIA)

Comparison of GAGAS and IIA Standards

Chapter 3: Types of Engagements

Sections Types of Engagements Overview Types of Engagements- Financial, Performance,

Program Effectiveness and Results, Internal Control, Compliance, Information Technology, Follow-Up

Attestation Engagements- Examination, Review, Agreed Upon Procedures

Non-Audit or Consulting Services

Chapter 4- Risk Assessment and Development of an Audit Plan

Sections Agency Risk Assessment Overview Identify Audit Universe or Auditable Units Benefits of Auditable Units Permanent Files Risk Assessment Risk Assessment Criteria Consideration of Internal Controls and Common Threats Internal Control Weaknesses Analysis of Internal Audit Resources Developing The Audit Work Plan

Chapter 5: Internal Control

Sections Internal Control Overview COSO Categories Five Components of COSO COBIT Framework and COBIT Domains Understanding an Auditee’s Internal Controls Documenting Internal Controls Internal Controls Over Financial Reporting Evaluation of Internal Controls Classifying Internal Control Weaknesses

Chapter 6 USDOT Agencies Sections

USDOT Agencies and Descriptions General Overview Office of the Secretary Federal Aviation Administration Federal Highway Administration Federal Motor Carrier Safety Administration Federal Railroad Administration Federal Transit Administration Maritime Administration National Highway Traffic Safety Administration Office of Inspector General Pipeline and Hazardous Materials Safety Administration Research and Innovative Technology Administration Saint Lawrence Seaway Development Corporation Surface Transportation Board

Chapter 7: Stewardship, Oversight, Laws and Regulations

Stewardship and Oversight Agreement between the FHWA and State Transportation Agencies

Hierarchy Federal Requirements (2 CFR 200) Audit Requirements (Part of 2 CFR 200) Catalog of Federal Domestic Assistance (CFDA) State Law

Chapter 8: Innovative Financing and Construction Delivery Methods

Sections Grant Anticipation Revenue Vehicle (GARVEE) Transportation Infrastructure Finance Innovation Act

(TIFIA) Section 129 Loans (23 U.S.C. 129 (A) (7) Tax Increment Financing (TIF) Private Activity Bonds (PABS) Public-Private Partnerships (P3s) Design- Build (DB) Construction Manager/General Contractor (CMGC)

Chapter 9: General Audit Program

Sections Audit Program Purpose and Scope Phases

A. Preliminary Survey (Planning) Phase B. Execution (Fieldwork) Phase C. Closing (Reporting) Phase

Attestation Program Purpose and Scope

Glossary:

The glossary was expanded to address additional terms.

Practice Aid Content

Program Description; Statutes and Regulations; Catalog of Federal Domestic Assistance

(CFDA#) (if applicable); Audit Scope and Objectives; Audit Program.

Practice Aid Development Plan The Internal Audit Task Force will have ongoing

responsibilities to develop Practice Aids. As you will see from the list we began to develop, there is an extensive number of topics. Therefore, we need your assistance in providing drafts so the project can move forward more effectively. Please take the time to look at the various audits you have conducted. If you have an existing Audit Program for one of the areas or one you think should be included, please provide it for review by the Task Force. Working on this project together we will be able to accomplish more and arrive at a better product.

Benefits of Practice Aids Only an individual Practice Aid has to be amended rather than the

whole Internal Audit Guide if there are changes made to a specific program.

When there is a new program, a new Practice Aid addressing that program can be developed without amending the whole Internal Audit Guide.

Having separate Practice Aids by subject provides easier use. Each Practice Aid will focus exclusively on one program or activity.

Allowed the Task Force to break this project into manageable pieces through various projects rather than take on one huge project at once. Therefore, allowing us to provide usable products to AASHTO members more quickly.

To expedite this process, we would like to suggest having members submit audit programs to the Task Force for review and approval to be added to the site.

Completed Practice Aids

Disadvantaged Business Enterprise (DBE) Initial Certification Process

Metropolitan Planning Organizations (MPOs)

Practice Aids Currently Under Development

Federal Aid Billing Procurement Cards Materials Highway Planning and Construction (CFDA

20.205) Professional Services Consultants Airport Improvement Program, (CFDA #20.106) Transit Grants Subrecipient Monitoring

Possible Practice Aids

Disadvantage Business Enterprise (DBE) Labor & Workforce Utilization Monitoring

Value Engineering Liquidated Damages Recreational Trails Program Ferry Boat Program Congestion Mitigation and Air Quality Program

(CMAQ)

Possible Practice Aids Continued

Bridge Inspection Program Bridge Project Design & Review Bridge Analysis and Load Capacity Determinations Bridge Maintenance & Repair Oversize Overweight Permits Outdoor Advertising (Billboards) Motor Pool and Vehicle Fleet Operations Federal Funding Accountability & Transparency

Act (FFATA) Reporting

Possible Practice Aids

Land Acquisition Highway Construction Project Funds Management Highway Construction Project Cost Estimation Highway Construction Project Planning and

Preconstruction Activities Highway Construction Public Involvement Highway Construction Procurement- Bidding &

Awarding Construction Contracts Highway Construction Contractor Payments

Proposed Practice Aids Continued

Highway Construction Contractor Change Orders Highway Construction Site Audits Highway Construction Contract Administration and

Closeout Highway Construction Consultant Selection Highway Construction Consultant Contract

Modifications Highway Construction Consultant Payments Highway Safety Improvement Program Highway Rail Crossing Safety Program

Possible Practice Aids Continued

Operational Safety Inspections of Airports Operational Safety Inspections of Heliports Aircraft and Pilot Registration Aircraft Maintenance of State Fleet Airport Construction Project Funds Management Airport Construction Project Cost Estimation Airport Construction Project Planning and

Preconstruction Activities

Possible Practice Aids Continued

Airport Construction Procurement- Bidding & Awarding Construction Contracts

Airport Construction Contractor Payments Airport Construction Contractor Change Orders Airport Construction Site Audits Airport Construction Contract Administration and

Closeout Airport Construction Consultant Selection Airport Construction Consultant Contract Modifications Airport Construction Consultant Payments

Proposed Practice Aids Continued

Capital Assistance Program for Elderly Persons with Disabilities (CFDA#20.513)

Transit Capital Investment Grants (CFDA#20.500)

Transit Formula Grants (CFDA#20.507) Formula Grants for Other than Urbanized

Areas, (CFDA#20.509) Transit State Planning & Research

(CFDA#20.515)

Possible Practice Aids Continued Motor Carrier Safety (CFDA#20.218)- Truck and Charter

Bus Inspections; Motor Carrier Safety (CFDA#20.218)- Truck and Charter

Bus Compliance Reviews of New Entrants; Motor Carrier Safety (CFDA#20.218)- Safety Audits of

Trucking and Charter Bus Companies; State Traffic Safety Improvement Grants

(CFDA#20.600). National Priority Safety Programs (CFDA#20.616). High-Speed Rail Corridors and Intercity Passenger Rail

Service – Capital Assistance Grants (CFDA#20.319)Railroad Agreements;

Feedback- The Task Force Needs Your Input

Provide ideas for Practice Aids Submit Audit Programs to the Task Force

pertaining to the various topics for screening and formatting into Practice Aids by the Task Force

Where do I send my Feedback?

Alice Wilson, CPA- Co-Chair (Kentucky)Alice.Wilson@ky.gov

(502) 782-4041

Stephen Kirk, CIA, CGAP- Co-Chair (Illinois)Stephen.Kirk@Illinois.gov(217)557-1258

Uniform Audit and Accounting Guide Task Force

Audit Guide Survey Results

The Audit Guide Taskforce Members include representatives from 28 State DOTs

and DC. Also, 2 AASHTO and 3 FHWA representatives. 2010 issued Audit Guide update; updated 2012 2012 issued National Compensation Matrix; updated

annually 2013 Risk Assessment Framework 2013 Audit Guide Suggestion Form Current:

CPA Work paper review training 2015 Update

2014 Survey Results

Cognizance

Audits

CPA Work paper Reviews

Cognizance Cognizance Questions:

1. List top 10 cognizant firms in your state. Explain the reasons why a cognizant was not performed.

Response –Most states listed their cognizant firms but some said they are not performing cognizant reviews because of liability and/or limited/untrained staff.

5. If no cognizant is being performed, what ideas do you have for getting them completed?

Response –Multi-state joint cognizant reviews are the preferred solution.

Cognizance

Cognizance Questions:

6. Would you transfer cognizance?Response - Trust appears to still be an issue.

7. What would make it more likely for you to issue a cognizant letter of concurrence?

Response - Lack of training and staffing most cited.

Cognizance

Cognizance Questions:

8. What would make it more likely for you to transfer cognizance?

Response - Most states would agree to transfer cognizance. So what’s holding states back from issuing cognizance? Is there a need for training on the CPA Work paper review checklist?

Cognizance Questions:

9. Would you be interested in having other states assist you in performing a cognizant review using the CPA work paper review checklist?

Response - Mostly yes; however, some states citedworkload and out-of-state travel issues.

Cognizance Questions

10. Questions asked about Cognizance: What information would be useful to have in

cognizant letters? (standards followed, adjustment specifics, project specific rates, construction management, etc.)

Guidance on types of documentation? Protection and release policies?

Cognizance Questions

10. (cont.) Does FHWA have a list of consultants who need

cognizance and which states are assigned to those? What are the liabilities for the DOT in issuing a

cognizant letter? Are there significant differences between states that

are not being addressed in cognizant reviews? (OT Premium, G&A rates, allocation issues between field/home etc.)

Audits

Audit Questions:

2. Does your state perform audits of overhead rates in accordance with the Yellow Book?

Response - 11 respondents noted that they perform AICPA audits of

Indirect Cost Rates in accordance with GAGAS. Some noted that their states require audited rates

AuditsAudit Questions:

11. What, if any, standards do you follow when performing cognizance/audits/desk reviews?

Response - Audits were Yellow book or IIA Reviews:

8 Yellow book5 Attestations/Agreed upon Procedures2 IIA standards4 Non-audit services (no standards)2 AASHTO Guide

Audits Audit Questions:

12. If your shop follows Yellow book, what changes did you implement with the 2011 revisions?

Response - 12 No changes 2 Attestations, no changes necessary 2 Trained and made changes 4 Still determining impacts 2 reviewed and made changes

Audits

Audit Questions:

13. If you follow Red Book, what changes do you see when rulemaking is complete?

Response -• Most states don’t use IIA. Respondents indicated no

major impact.

CPA Work Paper reviews

CPA Work Paper Review questions:

3. Does your shop perform CPA work paper reviews?Response –

Mostly yes responses were received75% of respondents doing reviews issued Cognizant LettersSome states indicated performing work paper reviews but did not issue Cognizant Letters

CPA Work Paper reviews

CPA Work Paper Review questions:

4. If so, do you use the checklist in the Audit Guide?Response –

Most states responded YesOne state responded “not yet” One state responded that did in past but with Agency reorganization process has changed

2015 Update

Potential areas we are looking to add additional guidance: Uncompensated Overtime Premium Overtime Field Office Rates Use of “combined” rates NCM Team examining new BCA limit and impact Compensation – determining superior performance Bonuses Common Control

2015 Update

Review of non-executive compensation Allowable components in FCCM Bid and Proposal Costs – Design build Stipends Legal Costs Testing of Time Sheets Audit Reports and Minimum Disclosure Issuing/Transferring Cognizance Acceptance of CPA Audit Transferring cognizance

Questions?