69I-5.009. Criteria for Selecting State Projects for Audits Based on Inherent Risk

(1) The independent auditor’s selection of state projects for audit must be based on an overall analysis and evaluation of the risk of noncompliance occurring which could be material to the state project. The auditor must, consistent with applicable governmental auditing standards, use professional judgment and consider criteria, such as enumerated in subsections (2) through (4), below to identify risk in state projects. Also, as part of the risk analysis, the auditor may wish to discuss a particular state project with auditee management and the awarding state agency.

(2) The independent auditor must consider current and prior audit experience.

(a) Weakness in internal controls over state financial assistance would indicate higher risk. Consideration should be given to the control environment over state financial assistance and such factors as the expectation of management’s adherence to applicable laws, rules, and contract or grant provisions, and the competence and experience of personnel who administer the state financial assistance project.

(b) Prior audit findings would indicate higher risk, particularly when situations identified in the audit finding could have a significant impact on state financial assistance or have not been corrected.

(c) State projects not recently audited as major state projects may be of higher risk than state projects recently audited as major state projects without audit findings.

(3) The independent auditor must consider the extent of any oversight exercised by the state agencies and the results of any monitoring performed.

(4) When evaluating state projects, independent auditors must consider the inherent risk of the project, which includes the following:

(a) The nature of the project. This includes, for example, a project’s complexity, the presence of third parties, and the type of costs involved.

(b) The phase of the project in its life cycle at the state agency. A new project may not be as time-tested and, therefore, may present higher risk. The state agency’s monitoring procedures may not yet be implemented or effectively in place. Significant changes in the program, laws, rules, or contracts or grant agreements may also increase risk.

(c) The phase of the project in its life cycle at the auditee. If a project is new to the auditee, there may be higher risk simply because a learning curve may be present. During the first and last years that an auditee participates in a state project, the risk may be higher due to start-up or closeout of program activities and staff.

(d) Type B Projects with larger expenditures. Projects with larger amounts of expenditures would be of higher risk than projects with substantially smaller expenditures.

(5) The independent auditor must document in the working papers the risk analysis process used in determining major projects. State agencies may provide auditors guidance about the risk of a particular state project and the auditor must consider this guidance in determining major projects in audits not yet substantially completed.

Rulemaking Authority 215.97(4) FS. Law Implemented 215.97 FS. History–New 11-1-05, Amended 2-25-19.