§200.519. Criteria for Federal program risk. — Inbound Citations

(1) The auditor must identify Type A programs that are low-risk. In making this determination, the auditor must consider whether the requirements in § 200.519(c), the results of audit follow-up, or any changes in personnel or systems affecting the program indicate significantly increased risk and preclude the program from being low-risk. For a Type A program to be considered low-risk, it must have been audited as a major program in at least one of the two most recent audit periods (in the most recent audit period in the case of a biennial audit), and, in the most recent audit period, the program must not have had:

(i) Internal control deficiencies that were identified as material weaknesses in the auditor's report on internal control for major programs as required under § 200.515(c);

(ii) A modified opinion on the program in the auditor's report on major programs as required under § 200.515(c); or

(iii) Known or likely questioned costs that exceed five percent of the total Federal awards expended for the program.

(1) All States, local governments, nonprofit organizations, and for-profit entities that are recipients or subrecipients of TAA Program funds must follow the audit requirements under 2 CFR 200.500 through 200.521 and 2 CFR 2900.20.

(1) The auditor must identify high-risk Type B programs using professional judgment and the criteria in § 200.519. However, the auditor is not required to identify more high-risk Type B programs than at least one-fourth of the number of low-risk Type A programs identified as low-risk under step two. Except for known material weakness in internal control or compliance problems as discussed in § 200.519(b)(1), (2), and (c)(1), a single criterion in risk would rarely cause a Type B program to be considered high-risk. When identifying which Type B programs to assess for risk, the auditor is encouraged to use an approach that provides an opportunity for different high-risk Type B programs to be audited as major programs over a period of time.

(1) The auditor must identify high-risk Type B programs using professional judgment and the criteria in § 200.519. However, the auditor is not required to identify more high-risk Type B programs than at least one-fourth of the number of low-risk Type A programs identified as low-risk under step two. Except for known material weakness in internal control or compliance problems as discussed in § 200.519(b)(1), (2), and (c)(1), a single criterion in risk would rarely cause a Type B program to be considered high-risk. When identifying which Type B programs to assess for risk, the auditor is encouraged to use an approach that provides an opportunity for different high-risk Type B programs to be audited as major programs over a period of time.

(1) The auditor must identify Type A programs that are low-risk. In making this determination, the auditor must consider whether the requirements in § 200.519(c), the results of audit follow-up, or any changes in personnel or systems affecting the program indicate significantly increased risk and preclude the program from being low-risk. For a Type A program to be considered low-risk, it must have been audited as a major program in at least one of the two most recent audit periods (in the most recent audit period in the case of a biennial audit), and, in the most recent audit period, the program must not have had:

(i) Internal control deficiencies that were identified as material weaknesses in the auditor's report on internal control for major programs as required under § 200.515(c);

(ii) A modified opinion on the program in the auditor's report on major programs as required under § 200.515(c); or

(iii) Known or likely questioned costs that exceed five percent of the total Federal awards expended for the program.

(1) The auditor must identify high-risk Type B programs using professional judgment and the criteria in § 200.519. However, the auditor is not required to identify more high-risk Type B programs than at least one-fourth of the number of low-risk Type A programs identified as low-risk under step two. Except for known material weakness in internal control or compliance problems as discussed in § 200.519(b)(1), (2), and (c)(1), a single criterion in risk would rarely cause a Type B program to be considered high-risk. When identifying which Type B programs to assess for risk, the auditor is encouraged to use an approach that provides an opportunity for different high-risk Type B programs to be audited as major programs over a period of time.