As we get ready to head into the audit season for Arizona school districts, auditors will be completing an updated version of the Uniform System of Financial Records (USFR) Compliance Questionnaire (CQ) as part of your audit. As a reminder, the completed USFRCQ must be submitted with the audit reporting package to the Arizona Office of the Auditor General. School districts should be aware of the changes and take the proper steps now to ensure you are in compliance.
To help prepare you for the upcoming audit season, our Arizona school district specialists have developed the following summary of the most impactful 2021 USFRCQ changes.
The comprehensive changes that were made to last year’s USFRCQ may make this year’s changes seem a little underwhelming, but there are still a handful of new questions that districts should be aware of to avoid audit findings in their 2021 report.
NEW/UPDATED QUESTIONS
- Procurement: PRO17
This question was on last year’s USFRCQ, however the requirement did not go into effect until July 1, 2020. This means that this will be the first year that this question will be tested. Auditors are required to obtain documentation showing that district personnel involved in the procurement process received “training and guidance related to restrictions on soliciting, accepting, or agreeing to accept any personal gift or benefit with a value of $300 or more.” - Student Attendance Reporting: SAR22 and SAR23
Auditors are now required to review the graduation codes for graduating students and year end codes for all other students. There are no new compliance requirements for districts’ student information personnel to be aware of; they should continue to follow ADE’s Graduation, Dropout, and Persistence Rate Technical Manual and Withdrawal Codes Cheat Sheet. The only change is that auditors are now required to test these students.
The other new question is related to the distance learning plans that districts had to implement the past year. Auditors will be required to obtain the district’s distance learning plan that was submitted to ADE via the “Common Login” and select a sample of students to determine if the district followed the plan that was in place for a certain time period. - Information Technology: IT13
This question related to the districts’ recovery and contingency planning documents (i.e., disaster recovery plan) is not new this year. However, the Auditor General has added some clarification and additional wording that requires auditors to obtain documentation showing that the district’s IT personnel reviewed the plan during the fiscal year, as well as the date of the review and method used to review the plan, such as a tabletop discussion or a system test. Additionally, the auditors are still required to obtain documentation showing that the plan was tested during the fiscal year to identify internal and external vulnerabilities.
With the continuing rise in cybercrime over the past several years, the Auditor General has instructed audit firms to put more scrutiny on the Information Technology section of the USFRCQ. In particular, the questions related to passwords, systems access/use, and employee awareness training. Districts should be providing an IT security awareness training that addresses prevention and detection of technology-related threats (i.e., phone and email phishing, website and ransomware attacks, and data breaches), at least annually to all employees. The bad actors continue to get more creative with their attacks, so everyone needs to remain vigilant in preventing, detecting, and reporting suspicious activity to protect district data and operations.
SUMMARY
These are just the new questions and compliance requirements from the 2021 USFRCQ. The Auditor General also changed wording, consolidated, and broke out several other questions, but these changes did not affect auditors’ testing or create any new compliance requirements for districts. By taking the time to review these new questions and ensure your district is in compliance, you reduce the risk of receiving a deficiency on your upcoming audit.
For questions regarding the 2021 updates to the USFRCQ, or to receive information on upcoming accounting changes, please contact Dennis Maschke, Audit Partner, at [email protected] or (480) 678-7462. We also invite you to visit our CWDL LinkedIn page or connect directly with Dennis.