Relating to the operation of state government, including the commencement of audits, information made available to the auditor of state, and disputes between governmental agencies

Description

Senate File 478 relates to the operation of State government, including the commencement of audits, information made available to the Auditor of State (AOS), and disputes between governmental agencies, and does the following:

• Establishes when an audit begins.
• Restricts the AOS from access to and, after the completion of an audit, retention of the following:
• Criminal identification files of law enforcement agencies.
• Personal information maintained by an educational institution regarding a student.
• Hospital, medical, and counselor records of an individual.
• Attorney work products that relate to litigation or claims made by or against a public body.
• Peace officers’ investigative reports, privileged records or information, and specific portions of email and phone billing records if that information is part of an ongoing investigation.
• Information obtained or held by an independent special counsel during an investigation conducted pursuant to Iowa Code section 68B.31A. This does not prohibit access to information that is disclosed to a legislative ethics committee after a determination of probable cause.
• Information concerning physical or critical infrastructure, cyber security, security, or emergency preparedness for the protection of life or property if disclosure could reasonably be expected to jeopardize such life or property.
• Personal information as defined in Iowa Code section 22A.1.
• Permits the AOS to access information listed above if the AOS demonstrates to the agency being audited that the information is necessary to the audit, the agency agrees the information is necessary, and the information is anonymized prior to its disclosure to the AOS.
• Restricts the AOS from retaining workpapers containing the information listed above following the completion of an audit.
• Restricts the AOS from disclosing information listed above in a report without the express written consent of the individuals identified.
• Restricts the AOS from access to personal information that an individual would reasonably expect to be kept private.
• Prohibits litigation between Commissions or Boards of the Executive Branch of State government, administrative departments, and constitutional and statutory offices.

Background

Iowa Code chapter 11, subchapter VIII, pertains to the AOS’s access to information. Iowa Code section 11.41 permits the AOS access to all information, records, instrumentalities, and properties used in the performance of the audited or examined entities’ statutory duties or contractual responsibilities. Additionally, if the information sought by the AOS is required by law to be kept confidential, the AOS is permitted access but must maintain the confidentiality of the information. The AOS is subject to the same penalties as the lawful custodian of the information for the dissemination of the information. The AOS is not permitted access to income tax returns of individuals or to an individual’s name or residential address from a reportable disease report under Iowa Code section 139A.3.

Code of Federal Regulations (CFR) Part 200 (Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards) defines terms and sets requirements for federal awards. “Auditor” is defined as a public accountant or a federal, state, local government, or Indian tribe audit organization that meets the general standard specified for external auditors in generally accepted government auditing standards (GAGAS). The term “auditor” does not include internal auditors of nonprofit organizations. CFR Section 200.501 sets the audit requirements. For compliance with the federal guidelines, the state must have a single audit conducted in accordance with CFR Section 200.514, which details the requirements of a single audit as follows:

• The audit must be completed in accordance with GAGAS.
• The audit must cover the entire operation of the auditee or include a series of audits that cover all organizational units that expended or administered federal awards during the audit period. Each such audit must encompass the financial statements and schedules of expenditures of federal awards for each nonfederal entity for the same audit period.
• The auditor must determine whether the financial statements of the auditee are presented fairly in accordance with generally accepted accounting principles (GAAP).
• The auditor must determine whether the schedule of expenditures of federal awards is stated fairly in relation to the auditee’s financial statements as a whole.
• Internal control standards must be met.
• Compliance standards must be met.
• The auditor must follow up on prior audit findings, assess the reasonableness of the summary schedule of prior audit findings, and report when the auditor concludes that the summary schedule of prior audit findings misrepresents the status of any prior finding. The auditor must perform audit follow-up procedures regardless of whether a prior audit finding relates to a major program in the current year.
• The auditor must complete and sign specified sections of the data collection form, as required in CFR Section 200.512(b)(3).

CFR Section 200.505 states that in cases of continued inability or unwillingness to have an audit completed in accordance with CFR Part 200, federal agencies and pass-through entities must take appropriate action as provided in CFR Section 200.339, including:

• Temporarily withholding cash payments pending correction of the deficiency by the nonfederal entity or more severe enforcement action by the federal agency or pass-through entity.
• Disallowing all or part of the cost of the activity or action not in compliance.
• Wholly or partly suspending or terminating the federal award.
• Initiating suspension or debarment proceedings.
• Withholding further federal awards for the project or program.
• Taking other remedies that may be legally available.

CFR Section 200.508 requires the auditee to provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit.

CFR Section 200.517 requires the auditor to retain audit documentation and reports for a minimum of three years after the date of issuance of the auditor’s report(s) to the auditee. Exceptions are made to extend the retention timeline to longer than three years under certain circumstances. Additionally, audit documentation must be made available upon request to an agency with the proper authority.

CFR Section 200.518 requires the auditor to use a risk-based approach to determine which federal programs are major programs and requires the auditor to identify which programs are low-risk. Terms and thresholds are established in the section. For a program to be considered low-risk, the program must have been audited as a major program in at least one of the two most recent audit periods and, in the most recent audit period, must not have had any of the following:

• Internal control deficiencies that were identified as material weaknesses in the auditor’s report on internal control for major programs.
• A modified opinion on the program in the auditor’s report on major programs.
• Known or likely questioned costs that exceed 5.0% of the total federal awards expended for the program.

All major programs not identified as low-risk must be audited.

The Bill may limit the ability of the AOS to perform oversight on the programs listed in Table 1.

Table 1 — Funding Audited by the AOSFunding Source Funds IPERS: State Share of Net Pension Liability 677.1$ IPERS: Other Entities Impacted 3,101.0 Other Postemployment Benefits (OPEB) Liability: State of Iowa 209.1 Other Postemployment Benefits (OPEB) Liability: Universities 259.7 Subtotal 4,246.9$

Funding Source Funds

Student Financial Aid (SFA) 478.3$ Unemployment Insurance 2,023.8 Children’s Health Insurance Program (CHIP) 142.4 Temporary Assistance for Needy Families (TANF) 74.2 Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) 40.4 Child Care and Development Block Grant (CCDBG) 202.0 Medicaid 4,390.1 Subtotal 7,351.2$

Funding Source Funds

Low-Income Home Energy Assistance Program (LIHEAP) 59.8$ Child Nutrition Cluster 275.8 Title I and Special Education 230.5 Subtotal 566.1$ Total 12,164.2$ Reported Balances That May Receive a Qualified Opinion (In Millions) Programs That May Receive a Scope Limitation or a Qualified Opinion or Disclaimer (In Millions) Federal Programs Administered by Locals That May Receive a Qualified Opinion or Disclaimer (In Millions)

Assumptions

• If a department denies the AOS access to requested information for an audit, the AOS will issue a modified opinion that the department is complying with CFR Part 200.
• A modified opinion on a major program in the auditor’s report will prohibit the program from receiving a low-risk determination.
• Without a low-risk determination, major federal programs will need to be audited more frequently.
• The AOS may be unable to keep information collected during an audit.

Fiscal Impact

Senate File 478 may impact the scope of an audit performed by the AOS, which may impact the State’s ability to comply with federal award requirements. A major federal program that loses its low-risk determination as a result of the AOS disclaiming its opinion will need to be audited each audit period. An increase in audit frequency could increase costs to the State; however, the fiscal impact cannot be determined. The State’s noncompliance with CFR Part 200 may result in the federal awarding agency taking action.

Sources

• Auditor of State
• Legislative Services Agency