By Melisa Galasso, CPA, CSP, CPTD
This article originally appeared in the Winter 2023 issue of the South Carolina CPA Report.
Since many of these entities have never had a Single Audit, many of their auditors have limited to no experience with these engagement alternatives. A future audit quality study is expected. These alternative engagements will be subject to greater scrutiny as the federal government heavily relies on them as part of its oversight responsibilities.
While several programs impact for-profit entities, we’ll focus on the impact of Provider Relief Funds here.
Provider Relief Funds (93.498)
“The PRF and ARP Rural Distribution are administered by the Health Resources and Services Administration (HRSA) and support eligible healthcare providers in the battle against the COVID-19 pandemic. PRF provides relief funds to eligible providers of health care services and support for health care-related expenses or lost revenues attributable to coronavirus.”1 This program totals around $187 billion, which came in multiple phases. A mix of for-profit and non-federal entities (governments and nonprofit healthcare organizations) received this funding. Recipients included hospitals, physician groups, assisted living facilities, hospice providers, ambulatory health care facilities, and vision services providers. Nonprofit and governmental recipients are subject to Single Audit requirements (although they may qualify for a program-specific audit).
For-profit entities that expend $750,000 or more in DHHS funding in a fiscal year are subject to the HHS for-profit audit requirements. This amount includes both PRF expenditures and lost revenues. While this is often referred to as a PRF requirement, in reality, all HHS awards are subject to the HHS for-profit audit requirements including:
- 93.498, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution;
- 93.461, HRSA COVID-19 Claims Reimbursement for the Uninsured Program and the COVID-19 Coverage Assistance Fund; and
- 93.697, COVID-19 Testing and Mitigation for Rural Health Clinics.
It does not include other non-HHS federal sources (e.g., Coronavirus Relief Fund awards from a state pass-through entity). The requirements also explicitly exclude Medicare from the “expended” determination.
Determining the amount “expended” for PRF is consistent with the guidance for non-federal entities and based on reporting in the DHHS portal, not on when the funds are truly expended, which has added complexity. This summary of the reporting requirements can be found in the 2022 Compliance Supplement. “Payment Received Period” refers to payments exceeding $10,000 in aggregate received.:
|
|---|
On the other hand, the HRSA COVID-19 Claims Reimbursement for the Uninsured Program and the COVID-19 Coverage Assistance Fund provides claims reimbursement for testing uninsured individuals for COVID-19, treating uninsured individuals with a COVID-19 diagnosis, and administering COVID-19 vaccines to uninsured and underinsured individuals. As a result, these are deemed fee-for-service awards, and the amounts included on the schedule relate to the revenue recognized in the financial statements during the period under audit.
For-profit entities have two options:
- Single or program-specific audit (same rules as for a non-federal entity)
- Financial-related audit of all HHS awards in accordance with GAGAS
PRF GAGAS Financial Audit
The entity prepares a schedule of a specific element of a financial statement (revenues reported) instead of a SEFA. For-profit entities would prepare a schedule that includes all revenues (not just PRF). The schedule’s basis of accounting may be either GAAP or a special purpose framework (e.g., cash or tax basis), but not a regulatory or contractual basis of accounting. The AICPA has recommended using a revenue-based schedule. There are risks that some practitioners may erroneously opine that the schedule is in accordance with GAAP, which would be inappropriate, especially when out-of-period expenses and lost revenue are reported. An example schedule is available in the reference section of this article.
In addition, an audit of the entity’s full financial statements is not required. If a full financial statement audit is performed for other reasons, it would not need to be under GAGAS.
To perform the audit of the schedule, the auditor would follow AU-C 805, Special Considerations—Audits of Single Financial Statements and Specific Elements, Accounts, or Items of a Financial Statement, which would provide an opinion on the schedule (similar to the use of AU-C 805 when the auditor is required to opine directly on the SEFA in a program specific audit as it doesn’t qualify as supplementary information).
In addition, the auditor would issue the traditional Yellow Book report (a report on internal control over financial reporting, compliance, and other matters). Neither HHS regulations nor GAGAS requires the auditor to provide an opinion on internal control. However, the auditor still needs to identify appropriate controls related to the schedule’s preparation and understand whether those controls were implemented. Even though an opinion on compliance is not required, the auditor must consider noncompliance with laws and regulations that could result in material misstatements of the schedule (AU-C 250). GAGAS also has additional reporting requirements (in the Yellow Book report). Reports are due to DHHS the earlier of 30 calendar days after receipt of the auditor’s report(s) or nine months after the end of the audit period. However, as a Single Audit is not required, no data collection form is required, and there is no reporting to the federal audit clearinghouse (FAC).
When performing Yellow Book engagements, auditors need to pay close attention to the different requirements regarding independence (in particular, preparation of financial statements), CPE, reporting (the Yellow Book report), and reporting of noncompliance (beyond what is required by AU-C 250). In addition, additional verbiage is required in the engagement letter. Auditors should ensure they have a strong understanding of Yellow Book requirements that layer on top of GAAS.
Conclusion
As many of these entities may never have had a financial statement audit (or potentially any audit historically), their books, records, and internal controls may not be ready. Extra time and attention should be given to these engagements. As these alternative engagements are new for many entities, practitioners, who may never have had to apply GAGAS before, will have a steep learning curve. The alternative engagement is subject to GAGAS and will fall within the must-select population of engagements for peer review and have a high likelihood of selection. Clients must understand their options, and CPAs must perform the engagement in compliance with the various standards.
Link to further reading material: Engagement Alternatives to Single Audits for For-Profit Entities Receiving Provider Relief Funds – Further Reading – SCACPA
