(a) GAGAS and AICPA standards require that the auditor communicate with the auditee the auditor's understanding of the services to be performed and document that understanding through a written communication to those charged with governance. To be acceptable to RUS, the auditor's communication must take the form of an audit engagement letter prepared by the auditor and must be formally accepted by the governance board or an audit committee representing the governance board. In addition to the requirements of the AICPA's professional auditing standards and GAGAS, the engagement letter must also include the following:
(1) The nature of planned work and level of assurance to be provided related to internal control over financial reporting and compliance with laws, regulation, and provision of contracts or grant agreements;
(2) That the auditee and auditor acknowledge that the audit is being performed and that the reporting package is being issued to enable the auditee to comply with the provisions of RUS's security instrument which requires compliance with this part;
(3) That the auditor acknowledges the mandatory reporting requirements for fraud, illegal acts, or noncompliance with provisions of laws, regulations, contracts, and grant agreements in § 1773.9. Acceptance of the engagement letter by the auditee is required, thus granting the auditor permission to directly notify the appropriate officials which may include but is not limited to the governance board, RUS, and OIG;
(4) That the auditor acknowledges that it is required under § 1773.7 to contact RUS if the auditor is unable to resolve scope limitations imposed by the auditee, or if such limitations in scope violate this part. Acceptance of the engagement letter by the auditee is required, thus granting the auditor permission to directly notify the AA-PARA as needed;
(5) That the auditee and auditor acknowledge that RUS will consider the auditee to be in violation of its RUS Security Agreement and this part if the auditee fails to have an audit performed and documented in compliance with GAGAS and this part;
(6) That the auditor represents that it meets the requirements under this part to perform the audit;
(7) That the auditor will perform the audit and will prepare the reporting package in accordance with the requirements of this part;
(8) That the auditor will document the audit work performed in accordance with GAGAS, and the requirements of this part; and
(9) That the auditor will make all audit documentation, including the reporting package available to RUS or its representatives (including but not limited to OIG and GAO), upon request, and will permit the photocopying of all such audit documentation.
(b) A copy of the audit engagement letter must be available at the auditee's office for inspection by RUS personnel. One copy of the current audit engagement letter must be maintained in the auditor's audit documentation.