[Code of Federal Regulations]
[Title 7, Volume 15]
[Revised as of January 1, 2005]
From the U.S. Government Printing Office via GPO Access
[CITE: 7CFR3052.525]

[Page 267-268]
 
                          TITLE 7--AGRICULTURE
 
                         CHAPTER XXX--OFFICE OF
                      THE CHIEF FINANCIAL OFFICER,
                        DEPARTMENT OF AGRICULTURE
 
PART 3052_AUDITS OF STATES, LOCAL GOVERNMENTS, AND NON-PROFIT 
ORGANIZATIONS--Table of Contents
 
                           Subpart E_Auditors
 
Sec. 3052.525  Criteria for Federal program risk.

    (a) General. The auditor's determination should be based on an 
overall evaluation of the risk of noncompliance occurring which could be 
material to the Federal program. The auditor shall use auditor judgment 
and consider criteria, such as described in paragraphs (b), (c), and (d) 
of this section, to identify risk in Federal programs. Also, as part of 
the risk analysis, the auditor may wish to discuss a particular Federal 
program with auditee management and the Federal agency or pass-through 
entity.
    (b) Current and prior audit experience. (1) Weaknesses in internal 
control over Federal programs would indicate higher risk. Consideration 
should be given to the control environment over Federal programs and 
such factors as the expectation of management's adherence to applicable 
laws and regulations and the provisions of contracts and grant 
agreements and the competence and experience of personnel who administer 
the Federal programs.
    (i) A Federal program administered under multiple internal control 
structures may have higher risk. When assessing risk in a large single 
audit, the auditor shall consider whether weaknesses are isolated in a 
single operating unit (e.g., one college campus) or pervasive throughout 
the entity.
    (ii) When significant parts of a Federal program are passed through 
to subrecipients, a weak system for monitoring subrecipients would 
indicate higher risk.
    (iii) The extent to which computer processing is used to administer 
Federal programs, as well as the complexity of that processing, should 
be considered by the auditor in assessing risk. New and recently 
modified computer systems may also indicate risk.
    (2) Prior audit findings would indicate higher risk, particularly 
when the situations identified in the audit findings could have a 
significant impact on a Federal program or have not been corrected.
    (3) Federal programs not recently audited as major programs may be 
of higher risk than Federal programs recently audited as major programs 
without audit findings.
    (c) Oversight exercised by Federal agencies and pass-through 
entities. (1) Oversight exercised by Federal agencies or pass-through 
entities could indicate risk. For example, recent monitoring or other 
reviews performed by an oversight entity which disclosed no significant 
problems would indicate lower risk. However, monitoring which disclosed 
significant problems would indicate higher risk.
    (2) Federal agencies, with the concurrence of OMB, may identify 
Federal programs which are higher risk. OMB plans to provide this 
identification in the compliance supplement.
    (d) Inherent risk of the Federal program. (1) The nature of a 
Federal program may indicate risk. Consideration should be given to the 
complexity of the program and the extent to which the Federal program 
contracts for goods and services. For example, Federal programs that 
disburse funds through third party contracts or have eligibility 
criteria may be of higher risk. Federal programs primarily involving 
staff payroll costs may have a high-risk for time and effort reporting, 
but otherwise be at low-risk.
    (2) The phase of a Federal program in its life cycle at the Federal 
agency may indicate risk. For example, a new Federal program with new or 
interim regulations may have higher risk than an established program 
with time-tested regulations. Also, significant changes in Federal 
programs, laws, regulations, or the provisions of contracts or grant 
agreements may increase risk.
    (3) The phase of a Federal program in its life cycle at the auditee 
may indicate risk. For example, during the first

[[Page 268]]

and last years that an auditee participates in a Federal program, the 
risk may be higher due to start-up or closeout of program activities and 
staff.
    (4) Type B programs with larger Federal awards expended would be of 
higher risk than programs with substantially smaller Federal awards 
expended.