(a) Each auditee must have its financial statements audited annually by an auditor selected by the auditee and approved by RUS as set forth in § 1773.4. All auditees, except those subject to the Single Audit Act, must submit audited financial statements on a comparative basis covering at least two consecutive 12-month periods, unless the entity has not been in existence for two consecutive 12-month audit periods. Financial statements should be prepared in accordance with GAAP, or if prepared using a special purpose framework, reconciling schedules should be included. Audits of consolidated financial statements of the parent are not an acceptable replacement for an audit of the auditee.

(b) Each auditee must establish an annual audit date within 12 months of the date of the first advance and must prepare annual financial statements for the audit date established. Each auditee must notify RUS of the audit date at least 90 days prior to the selected audit date.

(c) Auditees must furnish a reporting package to RUS within 120 days of the audit date. (See § 1773.21) Until all loans made or guaranteed by RUS are repaid and unliquidated obligations rescinded, auditees must continue to provide annual audited financial statements. Auditees with grant funding only must furnish annual audited financial statements in the year of the first advance and until all funds have been advanced or rescinded, and all financial compliance requirements have been fully satisfied.

(d) An auditee that is identified as a non-Federal entity as defined in 2 CFR 200.1, which means a State, local government, Indian tribe, Institution of Higher Education (IHE), or nonprofit organization that carries out a Federal award as a recipient or subrecipient, must meet the audit requirements outlined in 2 CFR 200.501 and 200.502 and the Single Audit Act, and not this part.

(1) For auditees expending less than the threshold for expenditure in Federal awards during the year, RUS reserves its right under 2 CFR 200.503 to arrange for an audit performed in accordance with this part.

(2) Within 30 days after the audit date, auditees subject to 2 CFR part 200, subpart F, must notify RUS, in writing via email, of the total Federal awards expended during the year and must state whether the audit will be performed in accordance with the Single Audit Act or this part.

(e) Subpart F of 2 CFR part 200 does not apply to audits of RUS electric and telecommunications cooperatives and for-profit telecommunications awardees unless the awardee has contractually agreed with another Federal agency (e.g., Federal Emergency Management Agency) to provide a financial audit performed in accordance with 2 CFR part 200, subpart F. In no circumstance will an auditee be required to submit separate audits performed in accordance with this part and 2 CFR part 200, subpart F.

[88 FR 7563, Feb. 6, 2023]

(a) Selection of a qualified auditor. The auditee's governance board is responsible for the selection of a qualified auditor that meets the requirements set forth in § 1773.5. When selecting an auditor, the auditee should consider, among other matters:

(1) The qualifications of auditors available to do the work;

(2) The auditor's experience in performing audits of utilities, related industries, or in the case of grantees, experience in auditing entities comparable to the grantee; and

(3) The auditor's ability to complete the audit and submit the reporting package to the auditee within 90 days of the audit date.

(b) Board approval of selection. The board's approval of an auditor must be recorded by a board resolution that states:

(1) The auditor represents that it meets RUS qualifications to perform an audit; and

(2) The auditee and auditor will enter into an audit engagement in accordance with § 1773.6.

(c) Notification of selection. When the initial selection or subsequent change of an auditor has been made, the auditee must notify RUS, in writing via email, at least 90 days prior to the audit date. Changes in the name of an auditor are considered to be a change in the auditor.

(1) Within 30 days of the date of receipt of such notice, RUS or its designated representative will notify the auditee, in writing via email, if the selection or change in auditor is not satisfactory as identified in § 1773.5.

(2) Notification that the same auditor has been selected for succeeding audits of the auditee's financial statements is not required; however, the procedures outlined in this part must be followed for each new auditor selected, even though such auditor may previously have been approved by RUS to audit records of other RUS auditees.

(d) Audit engagement letter. The auditee must enter into an audit agreement with the auditor that complies with § 1773.6 prior to the initiation of the audit.

(e) Debarment certification. The auditee must obtain, from the selected auditor, a lower tier covered transaction certification or other method in accordance with 2 CFR 180.300 or 2 CFR part 417, as required by Executive Orders 12549 and 12689 and any rules or regulations in this chapter issued thereunder.

(f) Peer review report. The auditee must obtain, from the selected auditor, a copy of the auditor's most recently accepted peer review report, which should be dated within 36 months of the engagement letter.

(g) Preparation of schedules. The auditee must prepare any schedules that are required by the auditor to perform the audit, including a complete set of financial statements, a schedule of deferred debits and deferred credits and a detailed schedule of investments in subsidiary and affiliated companies accounted for on the cost, equity, or consolidated basis. The detailed schedule of investments can be included in the notes to the financial statements or as a separate schedule as long as all information required is adequately disclosed. If the auditee uses a method other than GAAP, reconciliation schedules should be included with the reporting package.

(1) The schedule of deferred debits and deferred credits must include a description of the deferral and a notation as to whether the deferral has received written approval from RUS. If a determination is made that prior written approval is not required, cite the specific authority for the deferral.

(2) The schedule of investments must include investments in subsidiary and affiliated companies, corporations, limited liability corporations and partnerships, joint ventures, etc. accounted for on either the cost, equity or on a consolidated basis. For all investments, the auditee must list the name of the entity, ownership percentage, and the principal business in which the entity is engaged. For investments recorded on the cost basis, the auditee must include the original investment, advances, dividends declared or paid in the current and prior years and the net investment. For investments recorded on the equity or consolidated basis, the auditee must include the ownership percentage, original investment, advances, dividends declared or paid in the current and prior years, and current and prior years' earnings and losses, including accumulated losses in excess of the original investment.

(h) Scope limitations. The auditee will not limit the scope of the audit to the extent that the auditor is unable to provide an unmodified opinion that the financial statements are presented fairly in conformity with GAAP due to the scope limitation.

(i) Submission of reporting package. The auditee must submit to RUS, via the Agency designated system, the required reporting package as set forth in § 1773.21.

(1) A reporting package that fails to meet the requirements detailed in this part will be returned to the auditee via email with a written explanation of noncompliance.

(2) The auditee must, within 30 days of the date of the email detailing the noncompliance, submit a corrected reporting package to RUS via the Agency designated system.

(3) If a corrected reporting package is not received within 30 days of the date of the email detailing the noncompliance, RUS will take appropriate action, depending on the severity of the noncompliance. Per § 1773.1(d), failure to provide an audit in compliance with this part is a serious violation of the RUS security agreement. RUS relies on audited financial statements to assess and monitor the financial condition of its awardees and to fulfill its fiduciary responsibilities.

(j) Submission of a plan of corrective action. If the auditor's report contains findings and recommendations but does not include the auditee's response, the auditee must submit written responses via email to RUS within 180 days of the audit date. The written responses must address:

(1) The corrective action already taken or planned, or the reason the auditee believes no action is necessary; and

(2) The status of corrective action taken on previously reported findings and recommendations.

[83 FR 19907, May 7, 2018, as amended at 88 FR 7563, Feb. 6, 2023]

Auditors must meet the qualifications criteria of this section and enter into an audit engagement with the auditee that complies with § 1773.6 to be considered satisfactory to RUS.

(a) Licensing. Auditors that audit the financial statements of an RUS auditee must be licensed to perform attestation engagements in the United States of America. Auditors do not have to be licensed by the state in which the auditee is located; however, auditors must abide by the rules and regulations of professional conduct promulgated by the accountancy board of the state in which the auditee is located.

(b) Independence. Auditors must be independent as determined by the standards for independence in the AICPA Code of Professional Conduct and in GAGAS in effect at the time of the audit.

(c) Peer review requirement. Auditors must be enrolled in and comply with the requirements of an approved peer review program and must have undergone a satisfactory peer review of their accounting and audit practice. The peer review must be in effect at the date of the audit report opinion.

(d) Peer review reports. RUS or its designated representative reserves the right to request peer review reports from selected auditors, including evidence indicating actions taken to correct deficiencies identified in the peer review report, if applicable.

[83 FR 19907, May 7, 2018, as amended at 88 FR 7564, Feb. 6, 2023]

(a) Under GAGAS and AICPA professional auditing standards, the auditor should agree upon the terms of the engagement with management or those charged with governance, as appropriate. The agreed-upon terms of the engagement should be documented in an audit engagement letter or other suitable form of written agreement. RUS requires the auditor's communication to take the form of an audit engagement letter prepared by the auditor and that it be formally accepted by the auditee's governance board or an audit committee representing the governance board. In addition to the requirements of the AICPA's professional auditing standards and GAGAS, the engagement letter must also include the following:

(1) The nature of planned work and level of assurance to be provided related to internal control over financial reporting and compliance with laws, regulation, and provision of contracts or grant agreements;

(2) That the auditee and auditor acknowledge that the audit is being performed and that the reporting package is being issued to enable the auditee to comply with the provisions of RUS's security instrument which requires compliance with this part;

(3) That the auditor acknowledges the mandatory reporting requirements for fraud, illegal acts, or noncompliance with provisions of laws, regulations, contracts, and grant agreements in § 1773.9. Acceptance of the engagement letter by the auditee is required, thus granting the auditor permission to directly notify the appropriate officials which may include but is not limited to the governance board, RUS, and OIG;

(4) That the auditor acknowledges that it is required under § 1773.7 to contact RUS if the auditor is unable to resolve scope limitations imposed by the auditee, or if such limitations in scope violate this part. Acceptance of the engagement letter by the auditee is required, thus granting the auditor permission to directly notify RUS as needed;

(5) That the auditee and auditor acknowledge that RUS will consider the auditee to be in violation of its RUS Security Agreement and this part if the auditee fails to have an audit performed and documented in compliance with GAGAS and this part;

(6) That the auditor represents that it meets the requirements under this part to perform the audit;

(7) That the auditor will perform the audit and will issue the required reports and the auditee will prepare and submit the reporting package in accordance with the requirements of this part;

(8) That the auditor will document the audit work performed in accordance with GAGAS, and the requirements of this part; and

(9) That the auditor will make all audit documentation available to RUS or its representatives (including but not limited to OIG and GAO), upon request, and will permit the photocopying or imaging of all such audit documentation.

(b) A copy of the audit engagement letter must be retained by both the auditee and auditor. The engagement letter must be available at the auditee's office for inspection by RUS personnel or its designated representatives.

[83 FR 19907, May 7, 2018, as amended at 88 FR 7564, Feb. 6, 2023]

(a) The audit of the financial statements must be performed in accordance with GAGAS and this part in effect at the audit date unless the auditee is directed otherwise, in writing, via email by RUS.

(b) The audit of the financial statements must include such tests of the accounting records and such other auditing procedures that are sufficient to enable the auditor to express an opinion on the financial statements.

(c) Audit scope limitations are as follows:

(1) As noted under § 1773.4(h), the auditee will not limit the scope of the audit to the extent that the auditor is unable to meet RUS audit requirements without prior written approval of RUS.

(2) If the auditor determines during the audit that an unmodified opinion cannot be issued due to a scope limitation imposed by the auditee, the auditor should use professional judgment to determine what levels of the auditee's management and/or those charged with governance should be informed.

(3) After informing the auditee's management and/or those charged with governance, if the scope limitation is not adequately resolved, the auditor should immediately contact RUS.

[88 FR 7564, Feb. 6, 2023]

The annual audit must be performed as of the end of the same calendar month each year unless prior approval to change the audit date is obtained, in writing via email, from RUS or its designated representative.

(a) An auditee may request a change in the audit date by writing via email to RUS at least 60 days prior to the currently approved audit date, providing justification for the change.

(b) The time period between the prior audit date and the newly requested audit date must be no longer than twenty-three months.

(c) Comparative financial statements must be prepared and audited for the 12 months ending as of the new audit date and for the 12 months immediately preceding that period.

[88 FR 7564, Feb. 6, 2023]

(a) In accordance with GAGAS, the auditor is responsible for planning and performing the audit to provide reasonable assurance about whether the financial statements are free of material misstatement due to error or fraud. The auditor must also plan the audit to provide reasonable assurance of detecting material misstatements resulting from violations of provisions of laws, regulations, contracts, or grant agreements that could have a direct and material effect on the financial statements.

(b) If specific information comes to the auditor's attention that provides evidence concerning the existence of possible violations of provisions of laws, regulations, contracts, or grant agreements that could have a material indirect effect on the financial statements, the auditor should apply audit procedures specifically directed to ascertaining whether a violation of provisions of laws, regulations, contracts, or grant agreements has occurred.

(c) Pursuant to the terms of its audit engagement letter with the auditee, the auditor must immediately report, in writing via email, all instances of fraud, illegal acts, and all indications or instances of noncompliance with laws, whether material or not, to:

(1) The president of the auditee's governance board;

(2) RUS; and

(3) OIG, as follows:

(i) For all audits performed in accordance with § 1773.3(d) (audits conducted in accordance with 2 CFR part 200), report to the USDA-OIG-Audit, National Single Audit Coordinator for USDA, 1400 Independence Ave. SW, Ste. 419, Washington, DC 20250, email: [email protected], or online at: http://usdaoig.oversight.gov.

(ii) For all other audits conducted in accordance with § 1773.3 report to the USDA Office of Inspector General online at: https://usdaoig.overight.gov. If you need to provide any documents concerning your complaint, please fax to (202) 690-2474 or mail to USDA, OIG Hotline, P.O. Box 23399, Washington, DC 20026-3399, or alternately by telephone (800) 424-9121. Please note on your documents that you submitted your complaint online or by telephone.

[88 FR 7564, Feb. 6, 2023]

Pursuant to the terms of this part and the audit engagement letter, the auditor must make all audit documentation available to RUS, or its designated representative, upon request and must permit RUS, or its designated representative, to photocopy or image all audit documentation.

[88 FR 7565, Feb. 6, 2023]