Filed under: Audit & Assurance, Federal Grant & Contract Consulting
Current U.S. Department of Health and Human Services (HHS) regulations could impose an external audit requirement on commercial recipients of provider relief funds (PRF) under the CARES Act. If affected, the organization would need to contract with a CPA firm to perform the required audit.
What are the Source Regulations?
45 Code of Federal Regulations (CFR) 75.216 and 501(i) and (j) states that “Commercial Organizations” who receive HHS awards of $750,000 or more in a fiscal year are required to have either of the following two external audits performed within nine months of year end:
- A Single or program-specific audit (Single Audit) in accordance with 45 CFR Part 75 – Subpart F; or
- A Financial-related audit of all HHS awards in accordance with Government Auditing Standards.
We’ll describe the nature of these two audits further on, but first, we want to address two questions that immediately come to mind – What is considered a “Commercial Organization?,” and What are considered “HHS Awards”?
What is Considered a “Commercial Organization”?
Determining the scope of a potential audit is no easy task to understand and has been a source of confusion, especially for commercial providers with investment or management relationships involving a large number of organizations.
45 CFR Part 75.2 provides a basic definition of a Commercial Organization, with the scope of the audit being defined as follows in 45 CFR Part 75.514:
“The audit must cover the entire operations of the auditee or, at the option of the auditee, such audit must include a series of audits that cover departments, agencies and other organizational units that expended or otherwise administered Federal awards”.
Given 45 CFR Part 75 is the regulation requiring an audit, the two sections referenced above are what we have to work with. Historically, auditors have used Generally Accepted Accounting Principles (GAAP) to define the “entirety” of an auditee’s operations. The Health Resources and Services Administration (HRSA) has provided guidance that a commercial organization with multiple subsidiaries consolidated under Generally Accepted Accounting Principles (GAAP) and for-profit entities under common control that issue combined financial statements can have one financial-related audit that incorporates all entities. In addition, the AICPA Governmental Audit Quality Center (GAQC) has issued a practice aid to help determine the audit scope in parent-subsidiary relationships. Entities are encouraged to contact HRSA at ProviderReliefContact@hrsa.gov for scenarios not addressed in the HRSA FAQs or the Uniform Guidance.
What are Considered “HHS Awards”?
In short, all assistance awards from HHS are subject to audit. Though this would exclude Medicare and Medicaid payments, PRF assistance would be included, as well as any other award assistance that may be received from HHS, including COVID-19 testing for the uninsured and research and development awards from the National Institutes of Health.
45 CFR Part 75.501 states the “receipt” of HHS awards, but what does that mean? HRSA has clarified that for-profit entities that expend $750,000 or more in federal funds in a given fiscal year are subject to the audit requirements. For provider relief funds the amount expended would include both expenditures and lost revenues.
When are Provider Relief Funds Considered “Expended” for Determining the Amount of HHS Awards Subject to Audit in a Given Fiscal Year?
The amount of provider relief funds received by the entity are considered subject to audit based upon the date the payment was received (reporting period) and your fiscal year in which the end date of the period of availability to use the funds occurred. In other words, the provider relief funds are subject to audit at the point of time the deadline to use the funds is reached. Unexpended (unused) provider relief funds existing as of the end of the period of availability are not subject to audit as these funds are to be returned to HRSA.
The table below outlines the applicable PRF reporting periods and provides examples of which fiscal year the funding would be subject to the audit for June 30 and December 31 year-end entities. This, of course, could create a difference between when the underlying provider relief funds were recognized as revenue per GAAP versus when they are subject to audit.
What Does an Audit Look Like and How Can We Prepare?
As mentioned earlier, commercial organizations have the option of either conducting a Single Audit, Program-Specific Audit, or a Financial-related audit. Again, the recently issued AICPA GAQC PRF for-profit practice aid does a great job of describing the audit options.
For technical reasons, commercial organizations will likely select the Financial-related audit. This audit would include an audit opinion on a schedule of U.S. Department of Health and Human Services awards. It will also involve a consideration of internal controls over financial reporting and compliance with laws and regulations impacting those amounts reported. Auditors would be required to perform this audit in accordance with Government Auditing Standards and report findings if identified.
First and foremost, preparing for an audit of the PRF and other HHS assistance starts with understanding and applying the program requirements. Auditing of the HHS assistance will begin with what has been reported by your organization. Ensuring the amounts reported have been properly determined in accordance with PRF regulations, guidelines, and FAQs, as well as being supported by underlying records, will be key.
The Office of Management and Budget issued guidance to auditors of Single Audits in a Compliance Supplement Addendum, which could be helpful in understanding HHS’ expectations for auditing the PRF when using the Single Audit option.
When are the Audits for Commercial Entities Receiving Awards Required to be Completed?
Generally, the audit reports must be submitted at the earlier of 30 days after the auditee received the audit report or nine months after the entity’s fiscal year-end. Entities with fiscal year-ends through June 30, 2021 were provided with an additional six month extension under OMB Memo M-21-20. Reports are to be submitted electronically via email to HRSA’s Division of Financial Integrity at PRFAudits@hrsa.gov.
What Are the Next Steps for a Commercial Organization?
If they haven’t already, commercial organizations should begin discussions with their CPA firm now about whether a PRF audit is required, and, if so, the scope, timing, and details of the engagement. Not all CPA firms meet the requirements to perform audits in accordance with Government Auditing Standards, so the earlier the communication, the better. If you have a question regarding your audit or if you’re required to have one, please send us an email.
© Clark Nuber PS, 2022. All Rights Reserved.
