Objectives and Control Testing Additional Control Test Objectives for Written Procedures: When documenting and identifying the key control(s) in place to address the compliance requirement, consider if the client has written procedures to document the control process. UG requires a written policy for the requirements outlined in (c)(1), (c)(2), (d)(3), and (c). Document whether the non-Federal entity established written procedures consistent with the following requirements: 2 CFR 200.318(c)(1) for employee conflicts of interest. 2 CFR 200.318(c)(2) for organizational conflicts of interest. 2 CFR 200.320(d)(3) for selection and awarding of competitive contracts. 2 CFR 200.319(c) for minimum evaluation criteria for bids and proposals. It is auditor judgment how to report instances where the entity either lacks having a written policy or their written policy is insufficient to meet the requirements of 2 CFR 200.318(c)(1), 2 CFR 200.318(c)(2), 2 CFR 200.320(d)(3), and 2 CFR 200.319(c). auditors would normally use a written policy as the basis for the compliance control, there could be other key controls in place to ensure program compliance. The lack of a policy be noncompliance, which could rise to the level of material noncompliance and even a control deficiency (SD / MW) if there were underlying internal control deficiencies. If there are key controls in place operating effectively, AOS auditors would report the lack of the required UG policy as a management letter citation. However, in subsequent audits, evaluate if the noncompliance should be elevated if not adopted. Written policies aid in consistency and adherence to requirements strengthening internal control processes. What Control Procedures Address the Compliance Requirement (reference/link to documentation or where the testing was performed): for the control (reports, resources, etc. providing information needed to understand requirements and prevent or identify and correct errors): Control Procedure (description of how auditee uses the to prevent, or identify and correct or “Basis” detect errors): Person(s) responsible for performing the control procedure
Objectives and Control Testing Additional Control Test Objectives for Written Procedures: When documenting and identifying the key control(s) in place to address the compliance requirement, consider if the client has written procedures to document the control process. UG requires a written policy for the requirements outlined in (c)(1), (c)(2), (d)(3), and (c). Document whether the non-Federal entity established written procedures consistent with the following requirements: 2 CFR 200.318(c)(1) for employee conflicts of interest. 2 CFR 200.318(c)(2) for organizational conflicts of interest. 2 CFR 200.320(d)(3) for selection and awarding of competitive contracts. 2 CFR 200.319(c) for minimum evaluation criteria for bids and proposals. It is auditor judgment how to report instances where the entity either lacks having a written policy or their written policy is insufficient to meet the requirements of 2 CFR 200.318(c)(1), 2 CFR 200.318(c)(2), 2 CFR 200.320(d)(3), and 2 CFR 200.319(c). auditors would normally use a written policy as the basis for the compliance control, there could be other key controls in place to ensure program compliance. The lack of a policy be noncompliance, which could rise to the level of material noncompliance and even a control deficiency (SD / MW) if there were underlying internal control deficiencies. If there are key controls in place operating effectively, AOS auditors would report the lack of the required UG policy as a management letter citation. However, in subsequent audits, evaluate if the noncompliance should be elevated if not adopted. Written policies aid in consistency and adherence to requirements strengthening internal control processes. What Control Procedures Address the Compliance Requirement (reference/link to documentation or where the testing was performed): for the control (reports, resources, etc. providing information needed to understand requirements and prevent or identify and correct errors): Control Procedure (description of how auditee uses the “Basis” to prevent, or identify and correct or detect errors): Person(s) responsible for performing the control procedure
UG%20ED%20Direct%20Boilerplate%202018_IPAv_Final_Sept2018.docx