Under Office of Management and Budget (OMB) Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations (Circular A-133), the auditor has additional testing and reporting responsibilities for compliance, as well as internal control over compliance, beyond a financial statement audit performed in accordance with Government Auditing Standards and generally accepted auditing standards (GAAS). A single audit has two main objectives:
1. An audit of the entity's financial statements and the reporting on the Schedule of Expenditures of Federal Awards (SEFA) in relation to those financial statements
2. A compliance audit of federal awards expended during the fiscal year (This compliance audit provides a basis for issuing an additional report on compliance related to major programs and on internal control over compliance.)
With regard to compliance, the auditor is required to determine whether the entity complied with laws, regulations, and the provisions of contracts or grant agreements pertaining to federal awards that have a direct and material effect on each major program. The auditor is required to express an opinion on whether the entity complied with laws, regulations, and the provisions of contracts or grant agreements that could have a direct and material effect on each major program. Where applicable, the auditor is also required to refer to a separate schedule of findings and questioned costs.
With regard to internal control over compliance, the auditor is required to do the following, in addition to the requirements of Government Auditing Standards:
• Perform procedures to obtain an understanding of internal control over federal programs that is sufficient to plan the audit to support a low assessed level of control risk for major programs.
• Plan the testing of internal control over major programs to support a low assessed level of control risk for the assertions relevant to the compliance requirements for each major program.
• Perform tests of internal control (unless the internal control is likely to be ineffective in preventing or detecting noncompliance).
A written report on internal control over major programs is required describing the scope of testing of internal control and the results of the tests, and, where applicable, referring to a separate schedule of findings and questioned costs.