Nonprofit and for-profit organizations that received Paycheck Protection Program loans could unexpectedly find themselves confronting the “single audit” requirement for the first time, even though PPP loans are supposedly exempt.
A single audit is an organization-wide audit of the financial statements and federal awards of a non-federal entity that spends $750,000 or more in federal funds in a single year. It aims to provide assurance to the federal government that a non-federal entity has the right internal controls in place, and is generally in compliance with the requirements of a federal program like the PPP. Whether or not the organization has prior experience with undergoing single audits, the process can be complicated and risky if it’s not done correctly.
The PPP is generally thought of as a program for helping small businesses get through the economic fallout from the COVID-19 pandemic by providing them with forgivable loans through the Small Business Administration and lenders. But the program has also been available to nonprofits and other types of organizations that may never have gone through such audits in the past.
“We have a lot of people who’ve received a lot of federal funding,” said Lee Klumpp, a national assurance partner at BDO USA. “Billions of dollars have gone through the system and a lot of them are actually going to be subject to a single audit and never been there before.”
They may find themselves subject to such audits if they have received $750,000 from the federal government. “When you think about it, if you’ve got an organization that receives over $750,000 to trip this threshold, then they have to have this compliance audit done,” said Klumpp. “A compliance audit looks at not only internal controls and compliance related to the requirements, but the subject matter of the audit is different.”
In a typical financial statement audit, the auditors may look at compliance with laws and regulations in terms of what is material to the financial statements, focusing mostly on the results of operations. In a single audit, they’re looking more at the risk of material noncompliance with the requirements of the federal program. “It could be something that is more compliance oriented and not number oriented, and maybe not have a financial ramification, or it might,” said Klumpp. “If it’s material on the compliance side and in the financial statements, that could trigger a single audit.”
The Paycheck Protection Program is supposed to be “scoped out” of a single audit, he noted. The SBA has gone on the record with the American Institute of CPAs saying that PPP loans won’t be subject to single audit requirements. However, the AICPA also said that nonprofit organizations that receive Economic Injury Disaster Loans, a close cousin to the PPP that was also introduced in the CARES Act last year, are subject to the requirements.
“On the other hand, SBA informed us that loans made to NFPs under the EIDL program are considered a direct loan program disbursed from SBA to loan recipients,” said the AICPA in a May 2020 alert. “Therefore, these loans are considered federal financial assistance and are subject to the Uniform Guidance single audit requirements.”
In addition, the SBA has said they plan to audit as the funding agency any PPP loans greater than $2 million. “The Treasury has stated that as well in some of the remarks and information they’ve pushed out,” said Klumpp.
The Government Accountability Office has been monitoring PPP loan activity since the program’s inception last year and has released several reports on the program, using a risk-based approach to audit costs in connection with the program. “It’s not subject to the single audit,” said Klumpp. “That said, a lot of the funding that comes from the federal government for coronavirus relief went to the state governments and cities directly that would put the funds under audit. Various programs for health and human services are subject to audit. Programs for safety and training and PPE are subject to audit. A lot of federal programs will be subject to audit. It will apply to for profit and not for profit. If you receive more than $750,000, you will be subject to single audits. A lot of companies haven’t been subject to single audits in the past.”
Some organizations may find themselves instead facing a less burdensome program-specific audit that falls short of being a full-blown financial statement audit, but they need to meet certain criteria.
“There’s a bunch of rules that make it difficult to just do a program-specific audit for just anybody in any situation,” said Klumpp. “You’re only allowed to have one program. You can’t have multiple programs. We’ve got a lot of health care clients that have not only been provided relief funds, but also they have some other federal programs through the Department of Health and Human Services as well, or they may have some programs through the Department of Justice or FEMA or Homeland Security, because of the things that a hospital does as a first responder. They could have multiple programs which will keep them out of the single-audit, program-specific option, but makes them have a full-blown single audit.”
Besides health care facilities, childcare providers may also find themselves subject to single audits. “Some childcare facilities that are charities have been getting this money in the past for different programs that they run under the Department of Education or HHS, but others may not, and now they’re getting federal funding in order to provide child care services for first responders,” said Klumpp. “It’s not hard to get over $750,000 when we’ve been out as long as we’ve been out. The world got turned upside down last March. If you get $120,000 a month in funding to provide first responders with childcare, you’re already over the threshold.”
Community groups that hand out food to the needy could also find themselves subject to single audits. “There’s a church in my community that’s tied to another community-based organization and the two together have been working really hard every Saturday to give out boxes of food to families in need,” said Klumpp. “Some of that money is coming through the community organization from the federal government. The other is coming through a coalition of churches that are coming together to make a difference in the community. As a community organization that really didn’t get federal funding before, it now has federal funding because they were able to get into one of the USDA food programs.”
Nonprofits should also talk with their accountants about preparing for the possibility of being audited and make sure they have the necessary documentation.
“The first thing that organizations should do, whether they’re not for profit or for profit, if they haven’t done so already, is they need to have a conversation with their auditors or accountants to make sure they understand what the requirements are,” said Klumpp. “Keep and protect the supporting documentation. Make sure they have copies of any agreements they would have signed. Make sure that they have remittances and documentation as it relates to payments to vendors for services they received. They need to have all that evidence to support it. The other thing is understanding where the money came from, what the source of those funds is, who the funding agency is. In a lot of cases, it’s really easy. The relief funds may have come from HHS based on a calculation of funding that they received as a third-party payer. But then you have to go out and understand what the requirements are.”
He recommended that organizations consult an August 2020 compliance supplement from the White House’s Office of Management and Budget, where organizations can look up specific federal assistance programs and find out the requirements. The OMB later issued an addendum in December that provides more COVID-specific information on programs such as the Provider Relief Fund, the Education Stabilization Fund and the Coronavirus Relief Fund.
Training and education are also important for accountants to help their clients with these complicated new areas. “Make sure that your staff and yourself are properly trained,” said Klumpp. “A lot of CPA firms as well as others are offering continuing education in these areas. The Government Audit Quality Center of the AICPA has got some excellent materials, and even a resource center, that people can use to get materials. There are a lot of tools out there, so people need to educate themselves.”