(a) General. The audit shall be conducted in accordance with GAGAS. The audit shall cover the entire operations of the auditee; or, at the option of the auditee, such audit shall include a series of audits that cover departments, agencies, and other organizational units which expended or otherwise administered Federal awards during such fiscal year, provided that each such audit shall encompass the financial statements and schedule of expenditures of Federal awards for each such department, agency, and other organizational unit, which shall be considered to be a non-Federal entity. The financial statements and schedule of expenditures of Federal awards shall be for the same fiscal year.
(b) Financial statements. The auditor shall determine whether the financial statements of the auditee are presented fairly in all material respects in conformity with generally accepted accounting principles. The auditor shall also determine whether the schedule of expenditures of Federal awards is presented fairly in all material respects in relation to the auditee's financial statements taken as a whole.
(c) Internal control.
(1) In addition to the requirements of GAGAS, the auditor shall perform procedures to obtain an understanding of internal control over Federal programs sufficient to plan the audit to support a low assessed level of control risk for major programs.
(2) Except as provided in paragraph (c)(3) of this section, the auditor shall:
(i) Plan the testing of internal control over major programs to support a low assessed level of control risk for the assertions relevant to the compliance requirements for each major program; and
(ii) Perform testing of internal control as planned in paragraph (c)(2)(i) of this section.
(3) When internal control over some or all of the compliance requirements for a major program are likely to be ineffective in preventing or detecting noncompliance, the planning and performing of testing described in paragraph (c)(2) of this section are not required for those compliance requirements. However, the auditor shall report a reportable condition (including whether any such condition is a material weakness) in accordance with § 99.510, assess the related control risk at the maximum, and consider whether additional compliance tests are required because of ineffective internal control.
(d) Compliance.
(1) In addition to the requirements of GAGAS, the auditor shall determine whether the auditee has complied with laws, regulations, and the provisions of contracts or grant agreements that may have a direct and material effect on each of its major programs.
(2) The principal compliance requirements applicable to most Federal programs and the compliance requirements of the largest Federal programs are included in the compliance supplement.
(3) For the compliance requirements related to Federal programs contained in the compliance supplement, an audit of these compliance requirements will meet the requirements of this part. Where there have been changes to the compliance requirements and the changes are not reflected in the compliance supplement, the auditor shall determine the current compliance requirements and modify the audit procedures accordingly. For those Federal programs not covered in the compliance supplement, the auditor should use the types of compliance requirements contained in the compliance supplement as guidance for identifying the types of compliance requirements to test, and determine the requirements governing the Federal program by reviewing the provisions of contracts and grant agreements and the laws and regulations referred to in such contracts and grant agreements.
(4) The compliance testing shall include tests of transactions and such other auditing procedures necessary to provide the auditor sufficient evidence to support an opinion on compliance.
(e) Audit follow-up. The auditor shall follow-up on prior audit findings; perform procedures to assess the reasonableness of the summary schedule of prior audit findings prepared by the auditee in accordance with § 99.315(b); and report, as a current year audit finding, when the auditor concludes that the summary schedule of prior audit findings materially misrepresents the status of any prior audit finding. The auditor shall perform audit follow-up procedures regardless of whether a prior audit finding relates to a major program in the current year.
(f) Data collection form. As required in § 99.320(b)(3), the auditor shall complete and sign specified sections of the data collection form.