FHWA Resource Center
FINANCE SERVICES TEAM
INTERNAL AUDIT GUIDE
A Guide for Performing
Department of Transportation Internal Audits
Prepared by the
American Association of State Highway and Transportation Officials (AASHTO)
Audit Subcommittee and the
Federal Highway Administration (FHWA) Resource Center
Innovative Finance Technical Service Team
July 2005
Credits
American Association of State Highway and Transportation Officials Representatives
Arkansas State Highway and Department of Transportation, Leonard E. Grinstead
Delaware Department of Transportation, External Audit Team
Florida Department of Transportation, Ronnie Atkins, CPA
Kentucky Transportation Cabinet, External Audit Unit
Michigan Department of Transportation, Frank G. Morway, CPA
South Carolina Department of Transportation, J. Darrin Player
Texas Department of Transportation, Paula M. Bishir, CIA, CGAP
Utah Department of Transportation, Stephen C. Reitz, CIA
Virginia Department of Transportation, Alex Sabo, CIA, CFE, CBM
West Virginia Department of Transportation, Melissa A. Wood, CPA
Federal Highway Administration Representatives
Resource Center at Atlanta, Finance Technical Service Team
John P. Jeffers, CGFM, Taskforce Chair
Gina P. Laney, CPA
Contents
Chapter 1. Introduction 1
Why a Guide? 1
Auditing Standards 2
Chapter 2. Types of Government
Audits and Attestation Engagements 3
Financial Audits 3
Attestation Engagements 4
Performance Audits 4
Nonaudit Services of Audit Organizations 7
Chapter 3. Essentials 8
Laws and Regulations 8
Contract Terms 9
Defining an Eligible Cost 9
Internal Controls 9
Chapter 4. Project Cost Distribution 12
Appendix A
Project Cost Distribution Flowchart 14
Appendix B
Glossary 15
Appendix C
Internal Control Assessment 19
Control Environment 19
Risk Assessment 19
Control Activities 20
Information and Communication 20
Monitoring 20
Appendix D
General Audit Program 22
Purpose and Scope 22
Appendix E
Items of Consideration 24
Federal-Aid Billing 25
Project Funds Management 27
Project Cost Estimation 29
Project Planning 31
Consultant Project Selection and Payment 33
Preconstruction Activities 35
Construction Billing Process 37
Contract Modifications 39
Chapter 1
Introduction
This guide was developed by an American Association of State Highway and Transportation Officials (AASHTO) Audit Subcommittee task force of State transportation auditors and Federal Highway Administration (FHWA) Finance Technical Service Team specialists. The guide contains both the State Transportation Agencies (STAs) best practices and recommended audit practices developed by the task force team.
Why a Guide?
An essential role of government is the stewardship and oversight of public expenditures. The FHWA and STAs provide the stewardship and oversight of Federal-aid and State-funded transportation programs. As government transportation expenditures grow, the stewardship and oversight process for transportation programs must be enhanced. The purpose of this audit guide is to provide a tool that can be used by individual State internal auditors and public accounting firms that perform audits of transportation programs.
This guide is intended to help individuals understand processes, terminology, policies, audit techniques, and sources for regulations and specific procedures. The objective of the guide is to provide a focused audit program to identify and report on the following items:
· Internal controls.
· Adequate support of costs.
· Compliance with laws and regulations.
· Effective use of resources.
The guide includes an Internal Control Assessment, General Audit Program, and Items of Consideration as appendixes. These tools will help auditors develop audit programs to perform their oversight responsibilities.
Auditing Standards
Different organizations follow different audit standards; therefore, they should apply the appropriate standards for their organization (for example, generally accepted government auditing standards or The Institute of Internal Auditors).
Chapter 2
Types of Government Audits and Attestation Engagements
This section describes the three types of audits covered by generally accepted government auditing standards (GAGAS): financial audits, attestation engagements, and performance audits. The three audits differ primarily in their objectives. This section also describes nonaudit services performed by audit organizations. Nonaudit services are not covered by GAGAS.
A General Audit Program that can be incorporated into any type of the audits to ensure completeness of the intended audit coverage is contained in appendix D.
Financial Audits
Financial audits are primarily concerned with providing reasonable assurance that financial statements are presented fairly in all material respects in conformity with generally accepted accounting principles (GAAP) or with a comprehensive basis of accounting other than GAAP. Other objectives of financial audits, which provide for different levels of assurance and entail various scopes of work, may include:
· Providing special reports for specified elements, accounts, or items of a financial statement.
· Reviewing interim financial information.
· Issuing letters for underwriters and certain other requesting parties.
· Reporting on the processing of transactions by service organizations.
· Auditing compliance with regulations relating to Federal award expenditures and other governmental financial assistance in conjunction with or as a byproduct of a financial statement audit.
Financial audits are generally performed through the single audit process.
Attestation Engagements
Attestation engagements concern examining, reviewing, or performing agreed-upon procedures on a subject matter and reporting on the results. The subject matter of an attestation engagement may take many forms, including historical or prospective performance or condition, physical characteristics, historical events, analyses, systems processes, and behavior. Attestation engagements can cover a broad range of financial or nonfinancial subjects and can be part of a performance review. Possible subjects of attestation engagements could include reporting on the following items:
· An entity's internal control over financial reporting.
· An entity's compliance with requirements of specified laws, regulations, rules, contracts, or grants.
· The effectiveness of an entity's internal control over compliance with specified requirements, such as those governing the bidding for, accounting for, and reporting on grants and contracts.
· Management's discussion and analysis presentation.
· Prospective financial statements or pro-forma financial information.
· The reliability of performance measures.
· Final contract cost.
· Allowability and reasonableness of proposed contract amounts and specific procedures performed on a subject matter (agreed-upon procedures).
Performance Audits
Performance audits entail an objective and systematic examination of evidence to provide an independent assessment of the performance and management of a program against objective criteria. The performance auditor will make assessments that provide a prospective focus or that synthesize information on best practices or crosscutting issues. Performance audits provide information to improve program operations. They facilitate decisionmaking by parties with responsibility to oversee or initiate corrective action. Performance audits also improve public accountability.
Performance audits encompass a wide variety of objectives, including objectives related to assessing program effectiveness and results; economy and efficiency; internal control; compliance with legal or other requirements; and objectives related to providing prospective analyses, guidance, or summary information. These audits may entail a broad or narrow scope of work and apply a variety of methodologies; involve various levels of analysis, research, or evaluation; generally provide findings, conclusions, and recommendations; and result in the issuance of a report.
Effectiveness and results audits typically measure the extent to which a program is achieving its goals and objectives. Economy and efficiency audits determine whether an entity is acquiring, protecting, and using its resources in the most productive manner to achieve program objectives. Program effectiveness and results audits and economy and efficiency audits are often interrelated and may be concurrently addressed in performance audits. Examples of program effectiveness and results, and economy and efficiency audits include assessing:
· The extent to which legislative, regulatory, or organizational goals and objectives are being achieved.
· The relative ability of alternative approaches to yield better program performance or eliminate factors that inhibit program effectiveness.
· The relative cost and benefits or cost-effectiveness of program performance.
· Whether a program produces results or effects not intended by the objectives.
· The extent to which programs duplicate, overlap, or conflict with other programs.
· Whether the audited entity is following sound procurement practices.
· The validity and reliability of performance measures concerning program effectiveness and results, or economy and efficiency.
· The reliability, validity, or relevance of financial information related to the performance of a program.
Internal control audit objectives relate to management's plans, methods, and procedures used to meet its mission, goals, and objectives. Internal control includes the processes and procedures for planning, organizing, directing, and controlling program operations, and the system put in place for measuring, reporting, and monitoring program performance. Examples of audit objectives related to internal control include the extent a program provides reasonable assurance that:
· Organizational missions, goals, and objectives are achieved effectively and efficiently.
· Resources are used in compliance with laws, regulations, or other requirements.
· Resources are safeguarded against unauthorized acquisition, use, or disposition.
· Management information and public reports that are produced, such as performance measures, are complete, accurate, and consistent to support performance and decisionmaking.
· Security over computerized information systems will prevent or detect unauthorized access.
· Contingency planning for information systems provides essential backup to prevent unwarranted disruption of activities and functions the systems support.
Compliance objectives relate to criteria established by laws, regulations, and other requirements that could affect the entity's operations. Noncompliance could affect the acquisition, protection, and use of the entity's resources. Compliance objectives also concern the purpose of the program, the manner in which it is conducted, and services delivered.
Audit organizations also undertake work that provides a prospective focus or may provide guidance, best practices, and information that cuts across program or organizational lines. Examples of objectives pertaining to this work include:
· Assessing program or policy alternatives, including forecasting program outcomes under various assumptions.
· Assessing the advantages and disadvantages of legislative proposals.
· Analyzing views of stakeholders on policy proposals for decisionmakers.
· Analyzing budget proposals or budget requests to assist legislatures in the budget process.
· Identifying best practices for users in evaluating program or management system approaches, including financial and information management systems.
· Producing a high-level summary or a report that affects multiple programs or entities on issues studied or under study.
The reviews performed by internal auditors and/or financial specialists will be both attestation engagements and performance reviews.
Nonaudit Services of Audit Organizations
Audit organizations may also provide nonaudit services that are not covered by GAGAS. These nonaudit services consist of gathering, providing, or explaining information requested by decisionmakers, or providing advice or assistance to management officials. Nonaudit services generally differ from the financial audits, attestation engagements, and performance audits described above in that auditors provide information or data to a requesting party without providing verification, analysis, or evaluation of the information or data. Therefore, the work does not usually provide a basis for conclusions, recommendations, or opinions on the information or data. These other services may or may not result in a report. Some examples of these other professional services include:
· Assisting a legislative body by developing questions for use at a hearing.
· Gathering and reporting unverified external or third-party data to aid legislative and administrative decisionmaking.
· Compiling or reviewing financial statements or other information to assist entities and management officials.
· Advising an entity regarding its performance of internal control self-assessments.
· Providing professional advice to entities and management officials to help them perform activities such as designing or installing information systems and related internal control activities.
· Preparing an entity's indirect cost proposal or cost allocation plan.
· Developing audit methodologies, policies, and procedures.
Chapter 3
Essentials
Laws and Regulations
The FHWA/STA transportation program operates on a cost-reimbursement basis. STAs incur costs on approved projects and are reimbursed by FHWA for the eligible amounts. The funds are expended following State and Federal laws, regulations, and guidance. The specific regulatory information pertaining to Federal-aid transportation and highway programs are listed below.
23 United States Code, Highways (23 U.S.C.)
23 U.S.C. is the law governing the Federal-aid Highway Program. Section 302 of the law requires that States should have a suitably equipped STA to receive Federal-aid funds. Section 106 establishes the requirements for project approval and oversight.
23 Code of Federal Regulation (23 CFR, Highways)
23 CFR is the codification of the general and permanent rules published in the Federal Register. The regulations are derived from the law. The CFR contains criteria relating to the eligibility of cost reimbursement of Federal funds.
49 CFR Transportation (Part 18 "common rule")
The Part 18 common rule prescribes uniform administrative requirements for grants and cooperative agreements to State and local governments. Allowable costs are established in section 18.22. State and local governments are required to follow U.S. Office of Management and Budget (OMB) Circular A-87. For-profit organizations are required to follow 48 CFR Part 31. Section 18.36 provides for States to use their own procurement procedures.
OMB Circular A-87 Cost Principles for State, Local, and Indian Tribal Governments
A-87 establishes principles for determining the allowable costs incurred by State, local, and federally recognized Indian tribal governments (governmental units) under grants, cost reimbursement contracts, and other agreements with the Federal Government.
48 CFR, Federal Acquisition Regulations (FAR) Part 31, Contract Cost Principles and Procedures.
FAR 31 contains cost principles and procedures applicable to commercial organizations for pricing contracts, subcontracts, and modifications to contracts.
Contract Terms
For a project to be reimbursed, the contract terms must be fulfilled. The contract should clearly identify what the terms are and what is reimbursable.
Defining an Eligible Cost
In addition to the laws, regulations, and contract terms, a reimbursable cost must meet certain factors. A cost must be--
· Allowable. The most easily defined cost factor. If the laws, regulations, and contract allow the cost, it passes the allowability test.
· Allocable. A cost must be properly assigned to a project.
· Reasonable. While a definition of reasonable is provided in both OMB Circular A-87 and FAR 31 (see glossary), the application to reimbursable costs is still the most subjective of the three criteria.
A discussion on eligible costs follows in chapter 4.
Internal Controls
This review guide follows the internal control direction provided by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission. Internal control is defined as a process, effected by an entity's people, designed to accomplish specified objectives. The definition is broad, encompassing all aspects of controlling an organization, yet facilitates a directed focus on specific objectives. The internal control process seeks to achieve the following objectives:
· Effectiveness and efficiency of operations.
· Reliability of financial reporting.
· Compliance with applicable laws and regulations.
An audit determines if the entity is achieving the above objectives.
The COSO developed the following five interrelated components to achieve internal control within an organization:
· Control environment.
· Risk assessment.
· Control activities.
· Information and communication.
· Monitoring.
Control environment is the core of the entity and the most important of the internal control components. Individual values, ethics, integrity, and competence are part of the entity's environment. The control environment reflects the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.
Risk assessment is the process for identifying factors or conditions that can affect your ability to accomplish your mission. Risks can come from both internal and external sources. Risk assessment is the identification and analysis of relevant risks to achievement of established objectives, forming a basis for determining how the risks should be managed. Risk assessment should identify areas where controls are needed.
Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives.
Information and communication are the forms and methods enabling people to carry out their responsibilities. Appropriate information must be available to measure whether operations are efficient, financial reporting is accurate, and compliance with laws and regulations is achieved. The information must be communicated throughout the organization to permit personnel to carry out their responsibilities with regard to achieving efficiency, accuracy, and compliance.
Monitoring is necessary to maintain the quality of performance over time. Once a system of internal controls is established, it must be monitored to ensure that the components of the system are operating as designed.
Appendix C contains an Internal Control Assessment that auditors may use to develop an Internal Control Review for their entity.
Chapter 4
Project Cost Distribution
Project cost distribution is the application of allocability, allowability, and reasonableness. It is important that a cost not lose its identity when distributed to the applicable function.
A cost is allocable if it is assignable or chargeable to one or more cost objectives or cost centers on the basis of relative benefits received or some other equitable relationship. A cost must benefit both the project and other work of the entity and has to be distributed in some reasonable proportion to the benefits of incurring that cost. A cost is allocable to a project if it meets the following requirements:
· The cost is incurred specifically for the project.
· The cost benefits both the project and other work, and can be distributed to them in reasonable proportion to the benefits received.
· The cost is necessary to the overall operation of the entity, although a direct relationship to any particular cost objective cannot be shown.
Costs that are expressly or mutually agreed to be unallowable, including directly associated costs, must be identified and excluded from any billings. A directly associated cost is any cost that is generated solely as a result of incurring another cost, and which would not have been incurred had the other cost not been incurred. When an unallowable cost is incurred, its directly associated costs are also unallowable.
In evaluating a program, an auditor must consider direct as well as indirect costs. Direct and indirect costs should be consistently applied. A direct cost is any cost that can be identified specifically with a particular contract or project, while an indirect cost is applicable to more than one cost objective. Costs identified specifically with a contract or project are direct costs and are to be charged directly to the contract or project. All costs specifically identified with a project are direct costs of that project and cannot be charged to another project, either directly or indirectly. Finally, a cost cannot be charged as direct and also be included in any indirect cost pool. For reasons of practicality, any small-dollar direct cost may be treated as an indirect cost if the accounting treatment is consistently applied to all projects and produces substantially the same results as treating the cost as a direct cost.
A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person in the conduct of government business. The reasonableness of specific costs is not always easy to determine because such a determination depends to some extent on judgment and interpretation of the applicable regulations.
Reasonableness depends on a variety of considerations and circumstances, including the following factors:
· Whether the cost is generally recognized as ordinary and necessary for the project.
· Generally accepted sound business practices and Federal and State laws and regulations.
· The entity's responsibilities to the public.
· Any significant deviations from the entity's established practices.
Costs as they enter into a STA system go through iterations as part of the project cost-distribution process. Please see the flow chart listed in appendix A.
Appendix A
![Text version of the flow chart is written below.](iag1.gif)
Project Cost Distribution
Start with any eligible cost in the State DOT system
1. Are the costs eligible for Federal-aid participation?
a. If no, costs are assigned to an Ineligible cost account.
b. If yes, costs are determined to be either Indirect or Direct Costs.
2. If it is an Indirect or Administrative cost, does the STA have an approved OMB Circular A-87 Indirect Cost Plan?
a. If yes, the Indirect Costs are distributed to projects on an equitable approved basis.
b. If no, the costs are assigned to the Ineligible cost account.
3. If it is a Direct Cost, the cost is charged to the respective project.
Appendix B
Glossary
The following terms are used throughout this guide. We suggest that the reader become familiar with these terms.
actual costs
Amounts determined on the basis of costs incurred and supported by original source documentation, as compared to forecasted costs, costs thought to have been incurred, or costs based on historical averages.
administrative expenses
Costs that are not directly identified with any one item of work, but when taken as a whole, support or contribute to all activities of a firm.
agreement
A contract. A binding, legal, document that identifies the deliverable goods and services being provided, under what conditions, and the method of payment for such services. The document may include Federal criteria and State requirements, which will have to be adhered to by the recipient. The document will usually indicate start and finish dates, record-retention requirements, and other pertinent information relative to the actual work to be performed.
agreement (Federal-aid)
See project agreement and authorization.
allocable
A cost is allocable (to an agreement or cost of work being performed for the government) if it benefits both the agreement and other work of the firm and the cost can be distributed in reasonable proportion to the benefits of incurring that cost.
allowable (cost)
A cost that can be billed either directly to a project, or indirectly as overhead by the recipient. If the laws, regulations, and contract allow the cost, it is allowable.
audit trail
The record left by a transaction in accounting records from original source document into subsidiary ledgers through the general ledger and into the billing system.
contract modification
A contractual mechanism for making written changes and equitable adjustments to the terms of a contract. When a contract modification is made without an agreement, the change is bilateral. A change to a contract is a two-step process: the change order and the supplemental agreement reflecting the equitable adjustment in contract terms.
cost center
A grouping of incurred costs identified with a specific final cost objective.
cost principles
The underlying basis for determining how costs should be recorded when they are allowable or unallowable, and the specific basis for treating various costs as either allowable or unallowable. OMB Circular A-87 establishes the cost principles for State, local, and Indian tribal governments. 48 CFR Part 31 is the applicable regulation for third-party contracts.
direct cost
Any cost that can be identified specifically with a particular final cost objective; that is, a project-related cost. Direct costs would include labor, materials, and reimbursables incurred specifically for an agreement. It is irrelevant whether the costs are actually billed.
entrance conference
A meeting between the auditor and the reviewer, at which time the purpose and scope of the review are discussed.
exit conference
A meeting held after the auditor completes fieldwork at the recipient's place of business. Topics of discussion are preliminary findings of the review, which are subject to change and revision during the supervisory workpaper review process, and/or a formal request for the recipients' response to the draft audit report.
48 CFR, FAR Part 31, Contract Cost Principles and Procedures
Sets the criteria for allowable and unallowable costs for federally funded third- party agreements.
finding
A statement of noncompliance with the terms of an agreement. A finding includes the condition, criteria, cause, effect, and a recommendation for correction.
general administrative expenses
Any management, financial, and other expense, which is incurred by or allocated to a business unit, and which is for the general management and administration of the recipient as a whole.
indirect cost
Any cost not directly identified with a single, final cost objective, but identified with two or more final cost objectives or an intermediate cost objective. Recipients recover their indirect costs in their overhead rate.
ineligible cost
An item of cost that cannot be billed directly or indirectly by a recipient. These types of costs, if found during an audit, will be purged from the costs billed directly, or from those billed indirectly via an overhead rate or cost center. When an ineligible cost is incurred, its directly associated costs are also ineligible.
internal control
The plan of organization and methods and procedures adopted by management to ensure that its goals and objectives are met; that resources are used consistent with laws, regulations, and policies; that resources are safeguarded against waste, loss, and misuse; and that reliable data are obtained, maintained, and fairly disclosed in reports.
overhead expenses
All allowable general administrative expenses and fringe benefit costs (sometimes called payroll additives). Depending on the size of the firm, these costs may be separately identified on a schedule of overhead costs.
overhead rate
A computed rate developed by adding all of recipient's general and administrative costs, plus fringe benefit costs, then dividing by a base value, usually direct labor, to get a percentage. This rate is applied to direct labor to allow a recipient to recover the share of indirect costs allowable to the agreement.
project authorization and agreement (Federal-aid)
A contractual obligation of the Federal Government for payment of the Federal share of project costs. The agreement will include a description of the project, the Federal-aid project number, the work covered, total cost and amount of Federal-aid funds, the Federal share of funds, signature of State and Federal officials and any other provision set out by 23 U.S.C. 106 and/or 23 CFR.
reasonable cost
A cost that in its nature and amount does not exceed that which would be incurred by a prudent person in the conduct of competitive business.
resolution process
The process used to resolve review findings. It may involve negotiating a corrective action, reimbursing funds, and improving procedures.
single audit
In theory, an audit that satisfies the needs of all parties involved with funding or doing business with an organization, either private or public. In reality, such audits rarely satisfy all needs because funding agencies still request that their audit groups obtain specific information peculiar to their operations policies and procedures.
source documentation
Original documents, including but not limited to time sheets, invoices, room receipts, rental slips, gasoline tickets, canceled checks, tax returns, insurance policies, etc., which support the costs recorded in the recipient accounting ledgers and which may be used for billing purposes.
verify
The act of tracing a transaction from a ledger to the original supporting document.
Appendix C
Internal Control Assessment
The following questions are intended to provide general guidance to auditors in developing their Internal Control Review. Auditors should also consider more detailed questions that relate to the specific nature of the audit.
Control Environment
1. Is there evidence of management's respect for and adherence to program compliance requirements and/or control procedures?
2. Are responsibilities clearly defined for key personnel?
3. Do key personnel have adequate knowledge and experience to discharge their responsibilities?
4. Are personnel knowledgeable about compliance requirements and being given responsibility to communicate all instances of noncompliance to management?
5. Does management's commitment to competence ensure that staff receives adequate training to perform their duties?
6. Does management support an adequate information and reporting system?
7. Is management responsive to prior recommendations?
Risk Assessment
1. Are key personnel given the responsibility to identify and communicate changes?
2. Are employees who require close supervision (for example, because of inexperience) identified?
3. Is management aware of the results of monitoring audits and reviews considering the related risk of noncompliance?
Control Activities
1. Are operating policies and procedures clearly written and communicated?
2. Is adequate segregation of duties provided between performance, review, and recordkeeping of a task?
3. Do computer and program controls include:
a. Data entry controls (for example, edit checks)?
b. Exception reporting?
c. Access controls?
d. Computer general controls and security controls?
4. Is supervision of employees commensurate with their level of competence?
5. Are assets safeguarded and periodically counted and compared to recorded amounts?
Information and Communication
1. Does adequate source documentation exist to support amounts and items reported?
2. Is accurate information accessible to those who need it?
3. Do reconciliation and reviews ensure accuracy of reports?
4. Are employees' duties and control responsibilities effectively communicated?
5. Are actions taken as a result of communications received?
Monitoring
1. Are reviews performed to determine whether procedures are being followed as intended?
2. Does management review the results of internal reviews and audits and follow up on discrepancies?
3. Does management meet with program monitors, auditors, and reviewers to evaluate the condition of the program and controls?
Appendix D
General Audit Program
Purpose and Scope
This program has the following major objectives:
1. Understanding the organizations operations.
2. Understanding preliminary analytical procedures.
3. Identifying relevant risk factors.
4. Identifying significant compliance requirements.
5. Documenting the Internal Control Assessment.
A. Research and Planning Phase
1. Arrange for a meeting with organization personnel. Discuss the entity's activities and any changes in policies and procedures.Inquire with management if they aware of any fraud, waste, and abuse.
2. Review previous reports and workpapers issued by internal audit, legislative auditors, external auditors, or federal auditors. Document the findings in those reports for appropriate followup. Identify previously reported weaknesses that have not been corrected.
3. Review background material to become familiar with the accounting and administrative activities of the organization. For example, review:
· Legislative rules.
· Administrative code.
· State policies and procedures.
· Entity rules and regulations.
· Entity manuals.
· Federal Highway regulations.
· Stewardship agreement.
· Other auditor reports.
4. Obtain current organization chart.
5. Identify transactions and functions that are handled through the entity. Use plans, budgets, or discussions with department personnel to identify basic functions.
6. Prepare preliminary documentation of the organization's operations including the following:
· Management and organization
· Factors affecting operations.
· Internal factors affecting operations.
· Accounting policies and issues.
· Electronic data processing systems used in carrying out functions and activities.
7. Obtain policies and procedures related to the major functions of the organization. Note any changes in rules, regulations, or laws since the last audit.
8. Develop a program step for each area of the organization that has compliance requirements. Summarize the requirements for testing and evaluating controls over compliance.
9. Identify the functions or operations in the organization. Document processes activities and Internal Control Assessment.
B. Survey Phase
Gain an understanding of the processes in the review area through interviews with appropriate personnel and/or onsite observation. Document systems through flowcharts and/or narratives.
Identify control strengths and weaknesses. Develop conclusion as to adequacy of the system of internal controls. See appendix Internal Control Assessment.
Write scope and specific audit objectives and document any walkthroughs.Develop specific audit procedures and sampling plans for audit objectives. See appendix E for Items of Consideration.Consider the strengths and weaknesses identified in the evaluation of the system.
C. Fieldwork Phase
Complete audit tests and write up management comments/tracking forms identified during testing. Workpapers should include, at a minimum, a purpose, source, scope, and conclusion.
Relay comments to the entity management on any identified problems.
Assess the effectiveness of the controls established.
D. Conclusion
Hold exit conference with entity.
Prepare and issue audit report.
Consider management comments.
Track findings.
Appendix E
Items of Consideration
The following eight essential areas are those in which to perform reviews and/or audits:
1. Federal-aid billing.
2. Project funds management.
3. Project cost estimation.
4. Project planning.
5. Consultant project selection and payment.
6. Preconstruction activities.
7. Construction billing process.
8. Contract modifications.
Ultimately, the areas above lead to State payments to highway construction contractors and consultants.
A review program has been designed for each area noted above. The program is composed of a list of questions/program steps that are a guide for the reviewer. The objective will be to identify internal control weaknesses and inefficiencies that could be improved through implementing best practices related to the respective area.
The level of work carried out in each area can vary depending on the final objective of the individual auditor/reviewer. In general, the guidance provided for each area will be designed to help the reviewer carry out the audit.
Auditors should document their work by completing each program/questionnaire, supplementing responses with appropriate supporting workpapers, and preparing a report that encompasses the areas of concern noted and suggestions for improvement.
Federal-Aid Billing
Is there a current organization chart for the Federal-aid billing process?
Do current position descriptions exist for the personnel involved in this process?
What written procedures are available?
Do the Department of Transportation (DOT) employees involved in processing the Federal-aid current billing have the experience and training to properly oversee the Federal-aid billing process?
Is there an appropriate segregation of duties within the Federal-aid billing process to prevent inappropriate activity without collusion among employees?
Who reviews charges on the Current Bill for approval and appropriateness of charges?
Are the personnel assigned knowledgeable about the project and able to evaluate the appropriateness of the charges to the project?
What types of charges are accumulated for billing on Federal-aid projects?
Negotiated design agreements--consultant invoices? ____
Negotiated inspection agreements for construction inspection? ____
Bid construction contracts--construction estimates? ____
Work carried out under construction change orders--construction estimates? ____
Direct payroll charges of DOT personnel? ____
Payroll additive charges? ____
Other direct invoice charges? ____
Allocations of overhead/prorate amounts? ____
State-owned equipment charges (rental rate)? ____
What controls are in place to ensure that charges incurred prior to the Federal authorization date are accumulated as nonparticipating charges?
What controls are in place to ensure that the amounts billed for each type of project charge are properly limited to amounts under contract and the total Federal agreement amount? (Describe how limits are set on total project, contract payments, and agreement payments.)
Are there controls to assure that only allowable administrative and indirect costs are allowed to enter the current billing?
Is proper supporting documentation maintained to for the costs included in the Federal-aid current billing?
Does the STA have a method of segregating participating and nonparticipating charges on Federal-aid projects?
How does the system monitor participating charges that are unbilled due to costs in excess of Federal agreement limits?
Are there controls to assure removal of costs determined to be ineligible for Federal participation?
What controls exist to ensure the accuracy of the coding for charges entering the Federal-aid billing system (including front end edits and secondary reviews)?
Are there internal processing edits that flag questionable items found during the processing of the Federal-aid billing?
What costs are included in amounts prorated to projects?
Are there any edits to ensure only charges that would be allocable to Federal-aid projects are included in the pools?
Project Funds Management
Does a reconciliation process exist between the State records and the Federal records?
Is a process in place to consider deobligating funds for projects that have had no activity in a specified time frame?
Is incremental obligation being used on large dollar projects?
Incremental obligation allows projects to be obligated by phase so large amounts of dollars are not sitting idle for long periods of time.
Is a process in place to monitor the impact of the future 100 percent State match for projects using tapered match?
Tapered match allows projects to be funded with 100 percent Federal funds until 80 percent of the cost of the project has been completed.Is a process in place to track that funding is correctly allocated for projects funded by multiple fund sources?
For debt/toll projects that involve Federal funding, is a monitoring process in place to ensure compliance with bond covenants and Federal requirements? (For example, bond debt must be separated from State and Federal funds. Annual financial audits by independent accountants are required for toll funds.)
Is a process in place to ensure that any local agreements are executed prior to obligating Federal funds?
Is a process in place to ensure that final project payments trigger project closeout in a timely manner? (A process should be in place in the State and Federal system.)
Has the responsibility for analyzing Federal unbillables been assigned?
Does obligation get increased when change orders occur that increase project cost?
Or is a threshold dollar amount established in which the obligation gets increased when large change orders occur?
Is a process in place to identify and use toll credits?
Are performance measures in place to help manage the Federal funds?
(For example, goals for Federal unbillables; total amount of Federal funds obligated.)
Analyze the following items:
Projects under agreement--no expenditure activity for excessive period of time.
Projects authorized--not placed under agreement within a reasonable period of time.
Preliminary engineering projects not yet advanced to right-of-way (ROW) acquisition or construction.
ROW projects not yet advanced to construction.
Projects completed but not closed.
Projects with expenditures equal to or exceeding the project agreement limitation.
Projects with substantial unexpended balances but little or no activity.
Project Cost Estimation
Are any State laws or regulations in effect regarding release or protection of the engineer's estimate?
Are any State laws or administrative regulations in effect for determination of whether a contract award is proper, based on estimate overrun, competition, or other factors?
Review any procedures or instructions the State may have pertaining to preparation, revision, checking, and use of the engineer's estimate.
Briefly describe the intended process for preparation of estimates. Verify the actual method used in comparison with intended process and note any differences.
Does the State have an estimating section?
Which other portions of the agency become involved in preparing, checking, or approving the estimate?
Briefly describe the personnel resources available for preparing estimates and note any workload changes vs. personnel available over the past 3 years.
What is the primary basis for establishing estimated unit prices?
What methods are used to identify and incorporate anticipated changes in cost of labor, equipment, and material?
Are upcoming labor negotiations considered in the process?
Are material suppliers contacted for anticipated material costs?
Are adjustments made for individual project conditions? In what way?
What other factors are used to adjust the primary basis to determine the estimated prices for the project?
How is ROW estimated?
What is the process for utility adjustments?
In typical cases, how far in advance of the letting date is the estimate prepared?
How often is the estimate revised during the advertising period?
Discounting quantity changes, what are the usual reasons for revising estimated prices?
Is every estimate routinely evaluated by anyone other than preparer?
If so, when?
If possible, determine how often further study and/or revision is believed desirable but not accomplished due to workload restriction.
Is any information released publicly that may indicate the actual or approximate value of the estimate prior to opening bids?
Is the estimate released after opening bids?
a. When?
b. Is it published and where?
c. Who receives copies, if published?
d. In detail or only giving total cost?
Is any other information regarding the estimate available to contractor on request?
Review the contracting agency's procedure for evaluating bids received prior to recommending award or rejection.
a. Is there an established policy on, or apparent pattern of, awards or rejections of bids at a set level above the engineer's estimate?
b. In the case of poor competition or excessive difference between the estimate and the low bid, does the contracting agency contact the bidders and nonbidders who checked out proposal forms?
c. Are there any "ground rules" for adjusting estimates after receipt of bids?
Is such action taken on its own merits or may it be prompted by pressure to award an apparently excessive bid?
Does the State have a process to monitor estimated costs?
Look for large amounts of change orders.
Is there feedback and evaluation of the engineer's estimate and final project cost?
Project Planning
Does the State use a cash-forecasting plan in preparing the State Transportation Improvement Plan (STIP)?
What is the basis for the forecast?
Is there a multiyear plan?
Does the forecast consider tapered match?
How are revenues forecast?
Is there a revenue model?
What is the basis for the fiscal plan?
Commitments or cash?
Is the revenue estimate integrated with the cash forecast?
What is the basis for determining how funds are to be used?
Are assumptions in the fiscal plan related to a program of projects for multiple years?
Are there fiscal constraints?
How are the systems integrated?
Is project specific data used to develop the plan?
How far out are projects projected?
How are projects prioritized?
How are the environmental issues identified in the Environmental Impact Statement coordinated with ROW and followed through in the construction phase?
Is the work program based on a complete, balanced financial plan for the State Transportation Trust Fund and the other funds managed by STA?
Is the total amount of the liabilities accruing in each fiscal year of the work program equal to or less than the revenues available for expenditure during the respective fiscal year based on the cash forecast for that respective fiscal year?
Does the STA's work program provide for a minimum variance between contract lettings?
Has the STA stabilized the work program to ensure the timely and systematic completion of projects?
Does the work program maintain a minimum required cash balance?
What is the minimum required cash balance?
Determine by fiscal year the amount contained in the work program for highway projects demonstrating innovative techniques of highway construction and finance.Determine the dollar amount that is contained in the work program for right-of-way, construction, and product support for the State IHS compared to the total capacity improvement program for each fiscal year.
What is the acceptable maintenance standard planned to be achieved on the State Highway System in each fiscal year?
Does the work program implement the Interstate Highway System Program Development Policy?
If not, please explain.
Please provide the total dollar amount allocated to Intelligent Transportation System projects for each year of the work program?
Consultant Project Selection and Payment
What laws or regulations are you subject to regarding professional services procurement? Are they dictated at the Federal, State, or agency level?
Who is responsible for insuring that they are met and followed?
Are consultants required to pre-register?
What information is required?
How often are the consultants required to submit updated registration information?Who maintains the consultant's registration information?
Who has access to this information?
Are procedures in place for checking debarment status at initial registration, when submitting updated information, and at time of being short-listed?
Is debarment checked at a Federal, State, or Department level?
How are consultants notified of request for professional services (for example, advertising, letter of solicitation)?
Do you have short list and/or selection committees?
How are members of the short list committee selected?
How are members of the selection committee selected?
Ensure adequate controls exist over the consultant selection process.
Does the STA have standard criteria for consultant selection?
Are there exceptions to the standard?
What are the exceptions?
Does the STA enter into contracts with consultants that clearly describe the scope of work, basis for payment, retention of records, and provide for audit?
Is a change in the scope of work monitored?
How does the STA estimate consultant project costs?
How does the STA determine costs proposed by the consultant are fair and reasonable?
Is the consultant's prior service considered during selection process?
How is this service reviewed (for example, written evaluations)? Is the consultant's ability to provide services considered during selection?
When is the consultant required to submit proposed subconsultant work?
Is there a requirement for subconsultants to be registered?
Is there a limitation on the amount of subcontracted work?
If so, what is the limitation?
Are Disadvantaged Business Enterprise (DBE) requirements on the consultant selection?
What are the DBE requirements?
How are these requirements monitored?
Who is responsible for monitoring that DBE goals are met?
Who is responsible for monitoring DBE eligibility?
Who maintains the DBE information?
Who has access to this information?
Consultant BillingHow does the DOT determine that the work billed is properly accomplished in a timely manner?
Is there a proper coding of expenditures?
Review the following types of supporting documents
:a. Consultant agreements.
b. Consultant's work products (reports, briefings, etc.) and billings.
c. Travel vouchers and trip reports.
d. Any other documents that provide evidence of the nature and scope of services furnished and the reasonableness of the amounts charged.
Preconstruction Activities
What written procedures are available?
Determine if the projects are included in the STIP. Review selected projects to determine if any estimate of cost and Federal funds are shown.
Examine the allotment of construction funds to determine if they were prepared after receipt of the authorization to proceed from the Federal Highway Administration (FHWA).
Review the project agreement to determine if it was properly approved.
Design-- Evaluate the procedures and controls exercised in analyzing survey data and establishing geometric standards. Also, evaluate the assignment of work for developing preliminary plans and estimates.
Design Development--Evaluate procedures and controls exercised in coordination with in-house functional units in developing major design features and alternatives and in coordinating with other agencies (soil surveys, survey of material available, axel loading data, and traffic counts).
Preliminary Plan Development--Evaluate the procedures and controls exercised in determining specific plan requirements and in developing preliminary detail plans for office and field checks.
Design Public Hearing--Evaluate the procedures and controls exercised in determining the need for hearings, advertising the opportunity for public hearings, holding the design public hearing, and analyzing any views received.
Design Approval--Evaluate the procedures and controls exercised in preparing and submitting the request for approval and in publishing the request for approval.
Construction Plan Preparation--Evaluate the procedures and controls exercised in the refining, detailed drafting, developing, and computing of final quantities and in coordinating roadway and structure plans.
Construction Specification Development--Evaluate the procedures and controls exercised in reviewing standards specification for applicability and developing special provisions.
Engineer's Estimate Preparation--Evaluate the procedures and controls exercised in establishing and applying bid price data and in preparing the engineer's estimate.
Certification Development--Evaluate the procedures and controls exercised in preparing, compiling, and submitting required certifications.
Plans, Specifications, and Estimate (PS&E) Assembly--Evaluate the procedures and controls exercised in assembling the data and in coordinating and submitting the PS&E for FHWA approval.
Right of Way
Become familiar with the State's ROW manual. Contact the FHWA ROW officer for any particular concerns or comments.
In reviewing acquisitions, look at the amount of the first offer and determine who provided it and how it was developed.
Relocation and Assistance
Review relocation assistance and payments. What was the amount of any settlement? How much was justified, what was the basis of the approval, and who approved it?
Was there the potential for double payments in relocation that were compensated for during acquisition? Were administrative settlements justified?
Property Management
Property management is probably one of the most vulnerable areas for fraud, waste, and abuse. In this program area, revenues and income are generated back to the State.
Review the State's process to determine how the property management funds flow back to the State account and that the funds reach the appropriate State account. For example, are the funds reaching the State Highway account or the general fund?
Proceeds of sales and leases are not credited back to FHWA as long as the funds are used for Title 23 eligible activities. What type of tracking systems does the State have in place to assure the funds are spent on eligible activities?
Are airspace leases and property management rentals charging market rent? Was appropriate value captured upon disposal?
Construction Billing Process
For selected projects, review the plans to determine if they have the proper approvals.
Review completed plans to determine if they were completed to include quantities, etc.
What is the process for addressing environmental considerations?
For selected projects, determine if ROW, relocation, and Utility and Railroad Certifications are properly maintained. Is there evidence of review of the files?
Are there DBE requirements on construction projects?
What are the DBE requirements?
How are these requirements monitored?
Who is responsible for monitoring that DBE goals are met?
Who is responsible for monitoring DBE eligibility?
Who maintains the DBE information?
Who has access to this information?
Evaluate the procedures exercised in submitting, receiving, and safeguarding of bids, making public disclosure, tabulating bids, reviewing and analyzing bids, rejecting bids and, if necessary, readvertising. Review low bids to determine if they were properly prepared. Perform an analysis of bids submitted at various lettings to determine if bid patterns or irregularities exist.
Evaluate procedures and controls in computing extended contract time, assessing adequacy of progress of work, and extending and adjusting contract time as necessary.
Look at project time charges to make sure they are calculated in the method specified in the contract--fixed date or working days. Look at the resident engineer's diary for adequate support of all time charges.
Evaluate test reports--determine that the materials engineer compared test reports for each project with final contract quantities and testing frequency requirements have been met. Are the evaluators qualified?
What control do auditors have over the testing?
Look for required documentation relating to sources of material, spec requirements, bills of lading, delivery tickets. Who does the inspector receive delivery tickets from?
Does the Materials Certificate for each project have proper signature and authorization?
Contract pay items--Check that proper recording procedures were followed and methods and units of measurement have been documented in accordance with the specs.
Are expenditures coded properly?
Evaluate compliance with required contract provisions of determining the project is ready for final inspection and notification of project inspection. Determine that the resident engineer completed a walkthrough with the contractor to determine what must be completed before final inspection. Check that the notice of acceptance was prepared and properly approved.
How do project and financial managers track construction contract performance and progress?
What reports are produced and provided to construction and financial managers?
How often are these reports produced?
Is there evidence that district and headquarters project and financial managers use these reports?
Is there timeliness between project completion and the final estimate?
If the inspection is performed by consultants, and is their work monitored?
How are subcontractors monitored?
Is any of the construction performed as a result of Public-Private Partnerships (PPP)?
If Design Build or PPP, is the inspection also performed by the contractor?
Is there a STA followup on the inspection for quality assurance?
Contract Modifications
What percentage of all construction and/or consultant projects were contract modifications?
Does the State or entity have clearly established regulations or policy to govern the issuance of contract modifications?
Is there an area where contract modifications are most prevalent?
Are contract modifications more heavily concentrated in relatively few projects?
Is the number of contract modifications evenly distributed across the State or were they concentrated in a relatively small number of areas?
Is there a significant statistical relationship between the number of contract modifications and the engineers/consultants estimate?
Are design errors appropriately identified?
If consultant related, are the consultants billed for errors and omissions?
Does the Department maintain information documenting the cause of contract modifications?
Does the Department maintain strong recordkeeping regarding contract modifications?
Is there a strong link between preconstruction and construction regarding contract modifications and scope management?
What levels of authorization are required for the approval of contract modifications?
Is there a standard format for contract modifications documents?
Is there evidence that contract modifications are used to circumvent the bid process, such as lowballing a bid?
Are subsequent contract modifications used to raise the project cost?
Are contract modifications adequately supported with documentation and explanation?
Are contract modifications used to increase the contract amount when it has been exceeded even though the scope of work has not changed?
Do contract modifications initiate supplemental agreements when the project scope is increased?
Are contract modifications allowed after final payment has been made?
Do contract modifications have to be approved by an authority outside the cabinet, such as the State legislature?
If a contract modification is an engineering change, how is the process controlled?
Is the process for supplemental billing different from regular bill payments?
Are contract modifications closely tied with progress reports?
At what level must contract modifications payments be approved?
Are increased project costs due to contract modifications because of changes and/or additions or because of deficiencies in estimates or plans?
Does the Department look for trends to learn the causes of contract modifications?