U.S. Department of the Treasury, State and Local Fiscal Recovery Funds: "2022 SLFRF Compliance Supplement"
Summary
The April 2022 Compliance Supplement section for the Coronavirus State and Local Fiscal Recovery Funds, Assistance Listing 21.027, administered by the US Department of the Treasury. It notes the program is considered a "higher risk" program for 2022 and that CSLFRF provides $350 billion in direct payments, including $195.3 billion reserved for the 50 states and the District of Columbia and $20 billion for tribal governments. Auditors are told to test that award funds covered only costs incurred between March 3, 2021 and December 31, 2024, with the period of performance ending December 31, 2026. The section lists activities not permitted, such as deposits into pension funds and debt service, and describes a one-time $10 million standard allowance for government services under the Final Rule. An appendix names the Compliance Supplement Core Team.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“U.S. Department of the Treasury, State and Local Fiscal Recovery Funds: ‘2022 SLFRF Compliance Supplement.’”
Original at home.treasury.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/u-s-department-of-the-treasury-state-and-local-fiscal-recovery-funds-2-ee7264f325/
, SHA-256 1730b0d5291df133bd58abcc092325e0c1e52073e86f74b1d2ef8ae478297e4f.Full text
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
DEPARTMENT OF THE TREASURY
ASSISTANCE LISTING 21.027 CORONAVIRUS STATE AND LOCAL FISCAL
RECOVERY FUNDS
I. PROGRAM OBJECTIVES
Note: This program is considered a “higher risk” program for 2022, pursuant to 2 CFR section
200.519(c)(2). Refer to the “Programs with Higher Risk Designation” section of Part 8,
Appendix IV, Internal Reference Tables, for a discussion of the impact of the “higher risk”
designation on the major program determination process.
Note: Per Part IV, “Other Information,” certain Coronavirus State and Local Fiscal Recovery
Funds recipients are provided with an option to have an alternative compliance examination
engagement in lieu of a Single Audit or a Program-Specific Audit under 2 CFR Part 200, Subpart
F.
The purpose of the Coronavirus State and Local Fiscal Recovery Funds (“CSLFRF”) is to
provide direct payments to states (defined to include the District of Columbia), US territories
(defined to include Puerto Rico, US Virgin Islands, Guam, Northern Mariana Islands, and
American Samoa), tribal governments, metropolitan cities, counties, and (through states) non-
entitlement units of local government (collectively the “eligible entities”) to:
1. Respond to the public health emergency, COVID-19 or its negative economic impacts,
including providing assistance to households, small businesses, nonprofits, and impacted
industries, such as tourism, travel, and hospitality;
2. Respond to workers performing essential work during the COVID-19 public health
emergency by providing premium pay to eligible workers of eligible employers that have
eligible workers who are performing essential work, or by providing grants to eligible
entities who perform essential work;
3. Provide government services, to the extent COVID-19 caused a reduction in revenues
collected in the most recent full fiscal year of the state, territory, tribal government,
metropolitan city, county, or non-entitlement units of local government;
4. Make necessary investments in water, sewer, or broadband infrastructure.
II. PROGRAM PROCEDURES
A. Overview
Sections 602 and 603 of the Social Security Act (the “Act”), as added by section 9901 of
the American Rescue Plan Act of 2021, Pub. L. No. 117-2 (Mar. 11, 2021) authorized the
Coronavirus State Fiscal Recovery Fund (“CSFRF”) and Coronavirus Local Fiscal
Recovery Fund (“CLFRF”), respectively (referred to collectively as the “Coronavirus
State and Local Fiscal Recovery Funds” or “CSLFRF”). CSLFRF is administered by the
Compliance Supplement 2022 4-21.027-1
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
US Department of the Treasury (“Treasury”) and provides assistance in the form of direct
payments for specified use. CSLFRF provides $350 billion for payments to eligible
entities.
The total allocations to the eligible entities under CSLFRF are as follows:
(1) $195.3 billion reserved for making payments to the 50 states and the District of
Columbia;
(2) $4.5 billion reserved for making payments to the US territories;
(3) $20 billion reserved for making payments to tribal governments;
(4) $45.57 billion reserved for making payments to metropolitan cities;
(5) $65.1 billion reserved for making payments to counties; and
(6) $19.53 billion reserved for making payments to Non-entitlement Units of Local
Government (NEU).
Amounts paid to eligible states and local governments were based on 2019 population
data from the US Census Bureau as well as latest available data from the Bureau of Labor
Statistics at the time of the issuance of Treasury’s Interim Final Rule. Treasury made a
determination to allocate payments to tribal governments based on enrollment and
employment data as well as consultation with tribal leaders.
Prior to receipt of award funds, all eligible entities are required to execute a Financial
Assistance Agreement, which includes the Award Terms and Conditions that recipients
must comply with in carrying out the objectives of their award. As a condition of
receiving payment from CSLFRF, states, the District of Columbia, and US territories
executed a Financial Assistance Agreement that included the required section 602(d)(1)
certification. tribal and local governments are not required to provide such certification as
a condition of receiving payment under CSLFRF. Eligible entities are expected to use the
direct payments to meet pandemic response needs and rebuild a strong, more equitable
economy as the country recovers.
Please note that, as discussed in Part IV. Other Information, certain CSLFRF recipients
are provided with an option to have an alternative compliance examination engagement
in lieu of a Single Audit or a Program-Specific Audit under 2 CFR Part 200, Subpart F.
Source of Governing Requirements
The Coronavirus State and Local Fiscal Recovery Funds program is authorized by sections 602
and 603 of the Social Security Act as added by section 9901 of the American Rescue Plan Act of
2021, Pub. L. No. 117-2 (Mar. 11, 2021), and codified at 42 USC 802 and 803 and implemented
by Treasury’s Interim Final Rule and Final Rule at 31 CFR Part 35.
Compliance Supplement 2022 4-21.027-2
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
On January 6, 2022, Treasury adopted a Final Rule to implement the requirements of the
CSLFRF program. The Final Rule responded to comments Treasury received on the Interim
Final Rule and is effective as of April 1, 2022.
Along with the Final Rule, Treasury published a Statement Regarding Compliance with the
Coronavirus State and Local Fiscal Recovery Funds Interim Final Rule and Final Rule (the
“Statement”) that clarifies the transition from compliance with the Interim Final Rule to
compliance with the Final Rule. Recipients should review the Final Rule for additional
information. Recipients must comply with the Final Rule that was effective as of April 1, 2022.
Prior to April 1, 2022, recipients may take actions and use funds in a manner consistent with the
Final Rule, and Treasury will not take action to enforce the Interim Final Rule if a use of funds is
consistent with the terms of the Final Rule, regardless of when the CSLFRF funds were used.
This means that Treasury will not take action to enforce against uses of the Interim Final Rule to
the extent that the recipient wishes to change its planned uses of CSLFRF funds in a manner
consistent with the Final Rule.
Auditors must audit recipients on award funds they expended for their fiscal year 2022 based on
the requirements set forth in the Act, Treasury’s Interim Final Rule, Treasury’s Final Rule, and
Frequently Asked Questions (FAQs) that were in effect at the time of those expenditures.
Auditors must audit recipients on award funds they expended in accordance with the Final Rule
at 31 CFR Part 35 on and after April 1, 2022, the date the Final Rule became effective, as well as
FAQs that are in effect at the time of those expenditures. See the IV., “Other Information”
section below for auditor guidance relating to the criteria auditors should use for compliance
testing purposes.
Availability of Other Program Information
Additional information on the requirements for CSLFRF is available through the program
webpage on Treasury’s website at https://home.treasury.gov/policy-
issues/coronavirus/assistance-for-state-local-and-tribal-governments/state-and-local-fiscal-
recovery-funds. CSLFRF’s Compliance and Reporting Guidance can be found at
https://home.treasury.gov/policy-issues/coronavirus/assistance-for-state-local-and-tribal-
governments/state-and-local-fiscal-recovery-funds/recipient-compliance-and-reporting-
responsibilities.
FAQs about CSLFRF are outlined on the program webpage on Treasury’s website at
https://home.treasury.gov/policy-issues/coronavirus/assistance-for-state-local-and-tribal-
governments/state-and-local-fiscal-recovery-funds. If there are specific questions regarding
CSLFRF, the Office of Recovery Programs may be contacted via e-mail at
SLFRF@treasury.gov.
III. COMPLIANCE REQUIREMENTS
In developing the audit procedures to test compliance with the requirements for this federal
program, the auditor must determine, from the following summary (also included in Part 2,
“Matrix of Compliance Requirements”), which of the 12 types of compliance requirements have
Compliance Supplement 2022 4-21.027-3
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
been identified as subject to the audit (noted with a “Y” in the summary matrix below), and then
determine which of the compliance requirements that are subject to the audit are likely to have a
direct and material effect on the federal program at the auditee. For each such compliance
requirement subject to the audit, the auditor must use Part 3 (which includes generic details about
each compliance requirement other than Special Tests and Provisions) and this program
supplement (which includes any program-specific requirements) to perform the audit. When a
compliance requirement is shown in the summary below as “N,” it has been identified as not
being subject to the audit. Auditors are not expected to test requirements that have been noted
with an “N.” See the Safe Harbor Status discussion in Part 1 for additional information.
A B C E F G H I J L M N
Matching, Procurement
Equipment/
Cash
Period
Activities Allowable
Level of Effort, Subrecipient Special
Eligibility Reporting
Allowed or Costs/Cost Real Property Of Suspension & Program Tests and
Unallowed Principles Management Management Earmarking Performance Debarment Income Monitoring Provisions
Y Y N N N N Y Y N Y Y N
A. Activities Allowed or Unallowed
Recipients may use CSLFRF payments for any eligible expenses subject to the
restrictions set forth in sections 602 and 603 of the Social Security Act as added by
section 9901 of the American Rescue Plan Act of 2021 (codified as 42 USC 802 and 42
USC 803 respectively), Treasury’s Interim Final Rule and Final Rule at 31 CFR sections
35.7 and 35.8, and FAQs at
(https://home.treasury.gov/system/files/136/SLFRPFAQ.pdf).
The following activities are not permitted under CSLFRF:
• Offset a reduction in net tax revenue (applicable to states and territories)
• Deposits into pension funds (applicable to all recipients except Tribes)
• Debt service or replenishing financial reserves (e.g., “rainy day funds”)
(applicable to all recipients)
• Satisfaction of settlements and judgements (applicable to all recipients)
• Programs, services, or capital expenditures that include a term or condition that
undermines efforts to stop the spread of COVID-19 (applicable to all recipients)
Compliance Supplement 2022 4-21.027-4
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
Recipients may use payments from CSLFRF to:
• Support public health expenditures, by funding COVID-19 mitigation efforts,
medical expenses, behavioral healthcare, and certain public health and safety
staff;
• Address negative economic impacts caused by the public health emergency,
including economic harms to workers, households, small businesses, impacted
industries, and the public sector;
• Replace lost public sector revenue to provide government services; recipients
may use this funding to provide government services to the extent of the reduction
in revenue experienced due to the pandemic.
• Provide premium pay for essential workers, offering additional support to
those who have borne and will bear the greatest health risks because of their
service in critical infrastructure sectors; and
• Invest in water, sewer, and broadband infrastructure, making necessary
investments to improve access to clean drinking water, support vital wastewater
and stormwater infrastructure, and to expand access to broadband internet.
Under the Final Rule, recipients can elect a one-time “standard allowance” of $10 million
(not to exceed the recipient’s award amount) to spend on the “provision of government
services” during the period of performance. Alternatively, recipients can calculate lost
revenue based on the formula provided in the Final Rule to determine the limit for the
amount of CSLFRF funds that can be used for the “provision of government services.”
Recipients should provide auditors with evidence that they meet the requirements to elect
the standard allowance or provide auditors with evidence supporting their revenue loss
calculation.
The dollar amount of the revenue loss determines the limit for the amount of CSLFRF
funds that can be used to “provide government services” (which is one of four eligible
uses of CSLFRF funds). For SEFA reporting purposes, the aggregate expenditures for all
four eligible use categories are reported on the SEFA and not the result of the revenue
loss calculation or standard allowance. See the IV, “Other Information” section below for
guidance on the related Schedule of Expenditures of Federal Award reporting.
B. Allowable Cost/Cost Principles
CSLFRF is considered “other financial assistance” per 2 CFR section 200.1 and is
administered as direct payments for specified use. The 2 CFR Part 200, Subpart E is
applicable to expenditures under CSLFRF unless stated otherwise.
Compliance Supplement 2022 4-21.027-5
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
H. Period of Performance
The period of performance for the award under CSLFRF begins on the date the awards
are issued (i.e., the date funds are disbursed to recipients) and ends on December 31,
2026, pursuant to the Financial Assistance Agreement.
Recipients may only use funds to cover costs incurred during the period beginning on
March 3, 2021 and ending on December 31, 2024, per section 602(g)(1) of the Social
Security Act as added by section 9901 of the American Rescue Plan Act of 2021, Pub. L.
No. 117-2 and Treasury’s Interim Final Rule and Final Rule at 31 CFR section 35.5(a).
Recipients must liquidate all obligations incurred by December 31, 2024 under the award
no later than December 31, 2026, which is the end of the period of performance. As such,
auditors should test that recipients only used award funds to cover costs incurred from the
period beginning on March 3, 2021 and ending on December 31, 2024. Auditors should
also test that recipients did not incur and apply to their award any new costs during the
period beginning December 31, 2024 and ending on December 31, 2026. During this
two-year period, recipients are only permitted to liquidate all obligations they incurred by
December 31, 2024.
I. Procurement and Suspension and Debarment
1. Procurement
Recipients may use award funds to enter into contracts to procure goods and
services necessary to implement one or more of the eligible purposes outlined in
sections 602(c) and 603(c) of the Act and Treasury’s Interim Final Rule and Final
Rule. As such, recipients are expected to have procurement policies and
procedures in place that comply with the procurement standards outlined in the
Uniform Guidance. Specifically, a state must follow the same policies and
procedures it uses for procurements from its non-federal funds and comply with 2
CFR sections 200.321, 200.322, and 200.323. States must also ensure that every
contract includes the applicable contract clauses required by 2 CFR section
200.327. All other entities under the program, including subrecipients of a state,
must follow the procurement standards in 2 CFR sections 200.318 through
200.327, including ensuring that the procurement method used for the contracts
are appropriate based on the dollar amount and conditions specified in 2 CFR
section 200.320.
2. Suspension and Debarment
Prior to entering into subawards and contracts with award funds, recipients must
verify that such contractors and subrecipients are not suspended, debarred, or
otherwise excluded pursuant to 31 CFR section 19.300.
Compliance Supplement 2022 4-21.027-6
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
L. Reporting
1. Financial Reporting
a. SF-270, Request for Advance or Reimbursement – Not Applicable
b. SF-271, Outlay Report and Request for Reimbursement for Construction
Programs – Not Applicable
c. SF-425, Federal Financial Report – Not Applicable
2. Performance Reporting
See Special Reporting below.
3. Special Reporting
a. There are three types of reporting requirements for the CSLFRF program:
1. Interim Report: Provide initial overview of status and uses of
funding. The interim report will include a recipient’s expenditures
through July 31, 2021 by category and at the summary level. The
reporting requirements vary by type of recipient, the total
allocation amount, and the date which the recipient first received
its allocation. This is a one-time report.
2. Project and Expenditure Report: Report on financial data, projects
funded, expenditures, and contracts and subawards over $50,000,
and other information. Project and Expenditure Reports are due on
a regular, recurring basis after the Interim Reports. The reporting
frequency and deadlines vary by type of recipient and total
allocation amount.
3. Recovery Plan Performance Report: The Recovery Plan
Performance Report (the “Recovery Plan”) will provide
information on the projects that large recipients are undertaking
with program funding and how they plan to ensure program
outcomes are achieved in an effective, efficient, and equitable
manner. It will include key performance indicators identified by
the recipient and some mandatory indicators identified by
Treasury. The Recovery Plan will be posted on the website of the
recipient as well as provided to Treasury.
The reporting threshold is based on the total allocation expected under the
SLFRF program, not the funds received by the recipient as of the time of
reporting. Treasury may extend reporting deadlines.
Compliance Supplement 2022 4-21.027-7
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
Reporting requirements include which reports a recipient must file, the
frequency at which the recipient must report, the covered period of
reporting, and the report deadlines. Reporting requirements for each type
and size of recipient can be found in Part 2, Section B of the Compliance
and Reporting Guidance.
b. NEUs are recipients under CSLFRF and are required to report their award
expenditures on their SEFA and data collection form. The states that
distributed award funds to the NEUs must not report the amounts provided
to the NEUs on their SEFA.
c. Key Line Items – The following line items contain critical information for
the Interim Report:
1. Obligations and Expenditures
• Current period obligation
• Cumulative obligation
• Current period expenditure
• Cumulative expenditure
d. Key Line Items – The following line items contain critical information for
the Project and Expenditure Report:
1. Obligations and Expenditures
• Current period obligation
• Cumulative obligation
• Current period expenditure
• Cumulative expenditure
2. Subawards
3. Detailed information on any loans issued; contracts and grants
awarded; transfers made to other government entities; and direct
payments made by the recipient that are greater than $50,000. For
amounts less than $50,000, the recipient must report in the
aggregate for these same categories of loans issued; contracts and
grants awarded; transfers made to other government entities; and
direct payments made by the recipient.
e. Key Line Items – The following line items contain critical information for
the Recovery Plan Performance Report:
1. Public Disclosure Link
• The URL is publicly accessible.
Compliance Supplement 2022 4-21.027-8
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
• The URL is prominently displayed on the main page or the
main COVID response page of the recipient’s website
Please see Treasury’s Compliance and Reporting Guidance at
(https://home.treasury.gov/policy-issues/coronavirus/assistance-for-state-local-
and-tribal-governments/state-and-local-fiscal-recovery-funds/recipient-
compliance-and-reporting-responsibilities) for more information.
4. Special Reporting for Federal Funding Accountability and Transparency Act
(FFATA)
a. Treasury received approval from the Office of Management and Budget
(OMB) to increase the subaward reporting threshold outlined in 2 CFR
Part 170 from $30,000 to $50,000 for CSLFRF.
b. Although FFATA reporting is applicable to CSLFRF, Treasury is making
all required FFATA reporting on behalf of recipients. Thus, compliance
with FFATA reporting requirements is not subject to audit.
M. Subrecipient Monitoring
Applicable
Note that subrecipient monitoring is not required for entities deemed to be beneficiaries.
Because non-entitlement units of local government are considered by Treasury to be
direct recipients of CSLFRF (and not subrecipients or beneficiaries), states have no
subrecipient monitoring responsibilities related to the funding states were required to
distribute to non-entitlement units of local government.
The subrecipient or beneficiary designation is an important distinction as funding
provided to beneficiaries is not subject to audit pursuant to the Single Audit Act and 2
CFR Part 200, Subpart F, but funding provided to subrecipients is subject to those audit
requirements. When recipients of CSLFRF provide award funds to entities to respond to
the negative economic impacts of COVID-19 as end users, and not for the purpose of
carrying out program requirements, the entities receiving such funding are beneficiaries
of CSLFRF. Alternatively, when recipients of CSLFRF provide award funds to an entity
to carry out a program on behalf of the CSLFRF recipient, the entities receiving such
funding are subrecipients.
IV. OTHER INFORMATION
The CSLFRF program is authorized by sections 602 and 603 of the Social Security Act as added
by section 9901 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 (Mar. 11, 2021) as
implemented by Treasury’s Interim Final Rule and Final Rule at 31 CFR Part 35.
Compliance Supplement 2022 4-21.027-9
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
On January 6, 2022, Treasury adopted a Final Rule to implement the requirements of the
CSLFRF program. The Final Rule responded to comments Treasury received on the Interim
Final Rule and is effective as of April 1, 2022.
Along with the Final Rule, Treasury published a Statement Regarding Compliance with the
Coronavirus State and Local Fiscal Recovery Funds Interim Final Rule and Final Rule (the
“Statement”) that clarifies the transition from compliance with the Interim Final Rule to
compliance with the Final Rule. Recipients should review the Final Rule for additional
information. Recipients must comply with the Final Rule, effective on April 1, 2022. Prior to
April 1, 2022, recipients may take actions and use funds in a manner consistent with the Final
Rule, and Treasury will not take action to enforce the Interim Final Rule if a use of funds is
consistent with the terms of the Final Rule, regardless of when the CSLFRF funds were used.
This means that Treasury will not take action to enforce against uses of the Interim Final Rule to
the extent that the recipient wishes to change its planned uses of CSLFRF funds in a manner
consistent with the Final Rule.
Auditors must audit recipients on award funds they expended for their fiscal year 2022 based on
the requirements set forth in the Act, Treasury’s Interim Final Rule, and Frequently Asked
Questions (FAQs) that were in effect at the time of those expenditures.
Auditors must audit recipients on award funds they expended in accordance with Treasury’s
Final Rule at 31 CFR Part 35 on and after April 1, 2022, the date when the Final Rule became
effective, as well as FAQs that are in effect at the time of those expenditures. See below for
auditor guidance relating to the criteria auditors should use for compliance testing purposes.
Schedule of Expenditures of Federal Awards (SEFA)
As noted above in Activities Allowed or Unallowed, the dollar amount of the revenue loss
determines the limit for the amount of CSLFRF funds that can be used to “provide government
services” (which is one of four eligible uses of CSLFRF funds). For SEFA reporting purposes,
the aggregate expenditures for all four eligible use categories are reported on the SEFA and not
the result of the revenue loss calculation or standard allowance.
Additionally, because NEUs are considered direct recipients under CSLFRF, NEUs that do not
elect or are not eligible for the alternative compliance examination engagement are required to
report their award expenditures on the SEFA and data collection form as direct awards. Further,
States must not report award funds that were required to be distributed to the NEUs on State
SEFAs or data collection forms.
Requirements for an Alternative Compliance Examination Engagement for Recipients
That Would Otherwise be Required to Undergo a Single Audit or Program-Specific
Audit as a Result of Receiving CSLFRF Awards
A. OVERVIEW
The US Department of the Treasury (“Treasury”) recognizes that many recipients of
Coronavirus State and Local Fiscal Recovery Funds (“CSLFRF”) may newly be required to
Compliance Supplement 2022 4-21.027-10
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
complete a Single Audit or a Program-Specific Audit pursuant to the Single Audit Act and its
implementing regulations, 2 CFR Part 200, Subpart F, due to their receipt of an CSLFRF
award which may lead to them expending $750,000 or more during their fiscal year in
Federal awards. This may be because the recipient has not received federal financial
assistance before, or the other federal financial assistance they expended did not exceed the
$750,000 audit threshold set forth 2 CFR 200.501(a). This section describes an alternative
approach for CSLFRF recipients that would otherwise not be required to undergo an audit
pursuant to 2 CFR Part 200, Subpart F, if it was not for the expenditures of CSLFRF funds
directly awarded by Treasury. This alternative approach is permitted by OMB as further
described in the 2021 OMB Compliance Supplement, Part 8, Appendix VII – Other Audit
Advisories and as detailed below. However, an CSLFRF recipient may still elect to undergo a
Single Audit or a Program-Specific Audit under 2 CFR Part 200, Subpart F.
Recipient Eligibility
Recipient eligibility to use this alternative approach is as follows:
CSLFRF recipients that expend $750,000 or more during the recipient’s fiscal year in federal
awards and which meet both criteria listed below have the option to follow the alternative
CSLFRF compliance examination engagement:
1. The recipient’s total CSLFRF award received directly from Treasury or received (through
states) as a non-entitlement unit of local government is at or below $10 million; and
2. Other federal award funds the recipient expended (not including their CSLFRF award
funds) are less than $750,000 during the recipient’s fiscal year.
Alternative Compliance Examination Engagement
The alternative approach to a Single Audit or Program-Specific Audit under 2 CFR Part 200,
Subpart F, permits eligible recipients to engage a practitioner to perform a compliance
examination engagement in accordance with the Government Accountability Office (GAO)
Government Auditing Standards. The GAO Government Auditing Standards direct
practitioners to conduct these engagements in accordance with the American Institute of
Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements.
The AICPA attestation standards are codified in the AT-C section of the AICPA’s
Professional Standards and AT-C section 315, Compliance Attestation, which is the standard
to be followed. This engagement, which results in an opinion on compliance, is to be directed
at the compliance requirements described below in D. Compliance Requirements.
This alternative is intended to reduce the burden of a full Single Audit or Program-Specific
Audit on eligible recipients and practitioners, as well as uphold Treasury’s responsibility to
be good stewards of federal funds. This balance of burden reduction and Treasury
responsibility to be good stewards is achieved in several ways as follows:
• A financial statement audit is not required for those eligible recipients that expend
award funds from other Federal programs.
Compliance Supplement 2022 4-21.027-11
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
• A compliance examination engagement simplifies the engagement for both recipients
and practitioners.
• A formal schedule of expenditures of federal awards is not required as the practitioner
opines directly on compliance for a single program.
• The requirements for internal control in 2 CFR 200.514(c) are not relevant to the
engagement, although AT-C 315, paragraph .15, still requires the practitioner to
obtain an understanding of relevant portions of internal control over compliance
sufficient to plan the engagement and to assess control risk for compliance with
specified requirements.
• The engagement still involves testing of the compliance requirements described below
and results in a related examination opinion which is similar to the compliance
opinion provided under 2 CFR Part 200, Subpart F.
• The engagement reporting is simplified as compared to audit report required by 2
CFR Part 200, Subpart F. One compliance examination opinion is issued (versus up to
3 reports for a Single Audit or Program-Specific Audit) and the reporting allows for
reporting findings that are noted in a similar manner to how they are reported for
audits under 2 CFR Part 200, Subpart F.
The following subsections of this section align with normal OMB Compliance Supplement
presentation for a Federal program; however, practitioners performing the alternative
compliance examination engagement should use this “Other Information” section as a
standalone document. Practitioners should not use Part 3 of the OMB Compliance
Supplement or the full Part 4 section of the CSLFRF Program Compliance Supplement
(designated for audits of the program performed under 2 CFR Part 200, Subpart F) when
testing compliance. Instead, the examination objectives and suggested examination
procedures below should be used on their own.
B. PROGRAM OBJECTIVES
CSLFRF provides direct payments to states (defined to include the District of Columbia), US
territories (defined to include Puerto Rico, US Virgin Islands, Guam, Northern Mariana
Islands, and American Samoa), tribal governments, metropolitan cities, counties, and (through
states) non-entitlement units of local government (collectively the “eligible entities”) to:
1. Respond to the COVID-19 public health emergency or its negative economic
impacts, including by providing assistance to households, small businesses,
nonprofits, and impacted industries, such as tourism, travel, and hospitality;
2. Respond to workers performing essential work during the COVID-19 public health
emergency by providing premium pay to eligible workers of the recipient that
perform essential work or by providing grants to eligible employers that have
eligible workers who are performing essential work;
Compliance Supplement 2022 4-21.027-12
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
3. Provide government services, to the extent the COVID-19 public health emergency
caused a reduction in revenues relative to the revenues collected in the most recent full
fiscal year of the eligible entities; and,
4. Make necessary investments in water, sewer, or broadband infrastructure.
C. PROGRAM PROCEDURES
1. Overview
Sections 602 and 603 of the Social Security Act (the “Act”), as added by section 9901
of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 (Mar. 11, 2021)
authorized the Coronavirus State Fiscal Recovery Fund and Coronavirus Local Fiscal
Recovery Fund, respectively (referred to collectively as the “Coronavirus State and
Local Fiscal Recovery Funds” or “CSLFRF”). CSLFRF is administered by the
Treasury and provides assistance in the form of direct payments for specified uses.
CSLFRF provides $350 billion for payments to eligible entities.
The total allocations to the eligible entities under CSLFRF are as follows:
1. $195.3 billion reserved for making payments to the 50 states and the District of
Columbia;
2. $4.5 billion reserved for making payments to the US territories;
3. $20 billion reserved for making payments to tribal governments;
4. $45.57 billion reserved for making payments to metropolitan cities;
5. $65.1 billion reserved for making payments to counties; and
6. $19.53 billion reserved for making payments to states for distribution to Non-
entitlement Units of Local Government (NEU).
Prior to receipt of award funds, all eligible entities are required to execute a Financial
Assistance Agreement, which includes the Award Terms and Conditions that recipients
must comply with in carrying out the objectives of their award. As a condition of
receiving payment from CSLFRF, states, the District of Columbia, and US territories
executed a Financial Assistance Agreement that included the certification required by
section 602(d)(1) of the Act. Tribal and local governments are not required to provide
such certification as a condition of receiving payment under CSLFRF. Eligible entities
are required to use their award funds as set forth in sections 602(c)(1) and 603(c)(1) of the
Act and Treasury’s Final Rule, 31 CFR Part 35 to meet pandemic response needs and
rebuild a strong, more equitable economy as the country recovers.
Compliance Supplement 2022 4-21.027-13
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
2. Source of Governing Requirements
The Coronavirus State and Local Fiscal Recovery Funds program is authorized by
sections 602 and 603 of the Social Security Act as added by section 9901 of the
American Rescue Plan Act of 2021, Pub. L. No. 117-2 (Mar. 11, 2021) and codified at 42
USC 802 and 803, and implemented by Treasury’s Interim Final Rule and Final Rule at
31 CFR Part 35.
On January 6, 2022, the US Department of the Treasury adopted a Final Rule
implementing the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF). The
Final Rule responds to comments received on the Interim Final Rule and took effect on
April 1, 2022.
Along with the Final Rule, Treasury published a Statement Regarding Compliance with
the Coronavirus State and Local Fiscal Recovery Funds Interim Final Rule and Final
Rule (the “Statement”) that clarifies the transition from compliance with the Interim
Final Rule to compliance with the Final Rule. Recipients should also review the Final
Rule for additional information.
Recipients must comply with the Final Rule beginning on April 1, 2022, when the
Final Rule takes effect. Prior to April 1, 2022, recipients may take actions and use
funds in a manner consistent with the Final Rule, and Treasury will not take action to
enforce the Interim Final Rule if a use of funds is consistent with the terms of the Final
Rule, regardless of when the CSLFRF funds were used. This means that Treasury will
not take action to enforce against uses of the Interim Final Rule to the extent that the
recipient wishes to change its planned uses of CSLFRF funds in a manner consistent
with the Final Rule.
Auditors must audit recipients on award funds they expended for their fiscal year 2022
based on the requirements set forth in the Act, Treasury’s Interim Final Rule, Treasury’s
Final Rule, and Frequently Asked Questions (FAQs) that were in effect at the time of
those expenditures.
Auditors must audit recipients on award funds they expended on and after April 1, 2022,
when the Final Rule at 31 CFR Part 35 became effective as well as FAQs that are in
effect at the time of those expenditures.
3. Availability of Other Program Information
Additional information on the requirements for CSLFRF available through the
program webpage on Treasury’s website at Coronavirus State and Local Fiscal
Recovery Funds | US Department of the Treasury.
CSLFRF’s Compliance and Reporting Guidance can be found at Recipient
Compliance and Reporting Responsibilities | US Department of the Treasury.
Compliance Supplement 2022 4-21.027-14
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
The Final Rule, an overview of the Final Rule, and FAQs about CSLFRF are outlined on
the program webpage on Treasury’s website at https://home.treasury.gov/policy-
issues/coronavirus/assistance-for-state-local-and-tribal- governments/state-and-local-
fiscal-recovery-funds.
If there are specific questions regarding CSLFRF, the Office of Recovery Programs
may be contacted by e-mail at SLFRF@treasury.gov.
D. COMPLIANCE REQUIREMENTS
Preconditions for the Compliance Examination Engagement
Consistent with, and in addition to, the preconditions for an attestation engagement are outlined
in the AICPA’s attestation standards in AT-C 105, Concepts Common to All Attestation
Engagements, AT-C 205, Examination Engagements, and AT-C 315, Compliance Attestation.
As a precondition to this compliance examination engagement, the practitioner should determine
that:
a. management can provide evidence to the practitioner that it meets the recipient eligibility
criteria for the alternative compliance examination engagement as outlined in Section A,
“Recipient Eligibility;”
b. management accepts responsibility for the entity's compliance with the compliance
requirements below and the entity's internal control over compliance; and
c. management evaluates the entity's compliance with the compliance requirements in this
section.
Compliance Requirements Relevant to the Compliance Examination Engagement
The requirements noted with a “Y” in the “Matrix of Compliance Requirements” below are
subject to the compliance examination engagement.
A B C E F G H I J L M N
Matching, Procurement
Equipment/
Cash
Period
Activities Allowable
Level of Effort, Subrecipient Special
Eligibility Reporting
Allowed or Costs/Cost Real Property Of Suspension & Program Tests and
Unallowed Principles Management Management Earmarking Performance Debarment Income Monitoring Provisions
Y Y N N N N N N N N N N
Compliance Supplement 2022 4-21.027-15
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
A. Activities Allowed or Unallowed
Compliance Requirement Recipients have considerable flexibility to use CSLFRF
funds on activities to address the diverse needs of their communities. However, the
CSLFRF Final Rule identifies specific restrictions. In-depth description of the
unallowed activities (referred to in the CSLFRF Final Rule as ineligible uses) can be
found in the “Restrictions on Use” section of the Coronavirus State and Local Fiscal
Recovery Funds: Overview of the Final Rule. The ineligible uses are listed below:
• Offset a reduction in net tax revenue (applicable to states and territories)
• Deposits into pension funds (applicable to all recipients except Tribes)
• Debt service or replenishing financial reserves (e.g., “rainy day funds”)
(applicable to all recipients)
• Satisfaction of settlements and judgements (applicable to all recipients)
• Programs, services, or capital expenditures that include a term or condition that
undermines efforts to stop the spread of COVID-19 (applicable to all
recipients)
Examination Objective Determine whether the recipients used CSLFRF funds for
ineligible uses.
Suggested Examination Procedures
• Obtain an understanding of the design of relevant portions of internal control
over compliance regarding unallowable activities by performing some or all of
the following:
a. Inquiries of appropriate management, supervisory, and staff personnel
b. Inspection of the entity's relevant documents
c. Observation of the entity's activities and operations
• Review a sample of CSLFRF expenditures to determine if recipients used
CSLFRF funds for ineligible uses
B. Allowable Cost/Cost Principles
Compliance Requirement Recipients that are eligible for the alternative compliance
examination engagement may elect the standard allowance for revenue loss, pursuant
to which they could use the entirety of their allocation for the provision of government
services. Recipients are required to comply with 2 CFR 200.404(e) regarding
Compliance Supplement 2022 4-21.027-16
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
reasonable costs, and, as such, are required to not deviate from their established
practices and policies regarding the incurrence of costs.
Examination Objective Determine whether the recipient significantly deviated from
its established practices and policies regarding the incurrence of costs.
Suggested Examination Procedures
• Obtain an understanding of the design of relevant portions of internal control
over compliance and established practices and policies regarding the incurrence
of costs by performing some or all of the following:
a. Inquiries of appropriate management, supervisory, and staff personnel
b. Inspection of the entity's relevant documents
c. Observation of the entity's activities and operations
• Test a sample of SLFRF expenditures to determine that the recipient treated costs
consistently with its established practices and policies.
E. REPORTING
As described in the GAO Government Auditing Standards, and elaborated upon in AICPA
standards, the practitioner issues the following reporting in the alternative compliance
examination engagement:
• Practitioner’s Examination Report prepared in accordance with AT-C 315 and
Government Auditing Standards.
• Schedule of Findings and Responses (if applicable) that includes findings required to
be reported under GAGAS and the related finding elements required by GAGAS.
F. COMPLIANCE EXAMINATION ENGAGEMENT SUBMISSION
INSTRUCTIONS
The submission deadlines for the alternative compliance examination engagement are the
same as those for Single Audits and Program Specific audits due in accordance with 2 CFR
Part 200, Subpart F. Therefore, the results of the alternative compliance examination
engagement must be submitted within the earlier of 30 calendar days after receipt of the
auditor's report(s), or nine months after the end of the audit period.
Per OMB Memorandum M-21-20, Promoting Public Trust in the Federal Government through
Effective Implementation of the American Rescue Plan Act and Stewardship of the Taxpayer
Resources, recipients that have not yet filed their Single Audits with the Federal Audit
Clearinghouse as of the date of OMB Memorandum M-21-20 (i.e., March 19, 2021) that have
Compliance Supplement 2022 4-21.027-17
April 2022 Coronavirus State and Local Fiscal Recovery Funds Treasury
fiscal year-ends through June 30, 2021, may delay the completion and submission of the
Single Audit reporting package, as required under 2 CFR 200.501, to six months beyond the
normal due date. This extension can also be applied to the completion and submission of the
alternative compliance examination engagement for the same periods as described in OMB
Memorandum M-21-20 for Single Audits.
Additional instructions for where and how to submit the results of the alternative compliance
examination engagement will be forthcoming and posted to the Coronavirus State and Local
Fiscal Recovery Funds’ website.
Compliance Supplement 2022 4-21.027-18
April 2022 List of Changes for the 2022 Compliance Supplement
APPENDIX V
LIST OF CHANGES FOR THE 2022 COMPLIANCE SUPPLEMENT
This appendix provides a list of changes from the 2021 Supplement dated August 2022,
including changes to documents added from addenda 1 & 2 and the technical update. Please
note that changes in the Matrix of Compliance Requirements are reflected in Part 2 of this
supplement and are not reflected in this appendix.
Table of Contents
The Table of Contents has been updated to show additions and deletions.
Part 1 – Background, Purpose, and Applicability
• Updated for the effective date of the Supplement.
Part 2 – Matrix of Compliance Requirements
• Matrix of Compliance changes and corrections were made for 2022; these are
indicated in the Part 2 Matrix. Changes are shown in yellow highlights.
Part 3 – Compliance Requirements
Updated website links for the following programs:
• 10.000 – Updated link to the FNS contact.
• 10.500 – Updated II, “Program Procedures,” updated link for Plans of Work.
• 10.555 and 10.553 and 10.556 and 10.559 and 10.582 – Updated II, “Program
Procedures,” new link to Summer Food Service Program (SFSP) rates; updated
link to FSN web page; and new link to COVID-19 Waivers.
• 11.300 and 11.307 – Updated III.N.2, RFL Awards: Loan Requirements”
subsection Compliance Requirements new link for more information on EDA
temporary waiver of the requirement to collect evidence demonstrating that credit
is not otherwise available.
• 14.218 and 14.225 – Updated II, “Program Procedures,” updated link to CDBG-
MIT and CDBG-MIT; III.A., “Activities Allowed or Unallowed,” to add a new
link to the Federal Register notices; III.J., “Program Income,” to add two new
links to the Federal Register notices for alternative requirements.
• 14.228 – Updated I, “Program Objectives,” new link to public laws; II, “Program
Procedures,” links to CDBG-MIT, to see NSP funds notices, notices at
HUDClips, additional information about CDBG-CV, RFP, updates to NSP notices
and a new link to NSP Definition and Modification Notice, and Federal Register
Compliance Supplement 2022 8-V-1 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
notices; III.A., “Activities Allowed or Unallowed,” HUD Exchange Federal
Register notices; III.N.3., “Environmental Reviews,” CPD Notice 20-07; IV,
“Other Information” link to CDBG-DR laws, regulations, and Federal Register
notices.
• 14.231 – Updated II, “Program Procedures,” section on Source of Government
Requirements, new link to notice CPD-21-05.
• 14.239 – Updated II, “Program Procedures,” including section Source of
Governing Requirements and Availability of Other Program Information two new
links to the HOME-ARP Program; III.A., “Activities Allowed or Unallowed,”
new links to the HOME-ARP Program; III.N.2., “Maximum Per-unit Subsidy and
Underwriting Requirements” link to HOME-ARP Implementing Notice.
• 14.241 – Updated III.E.1., “Eligibility” section Eligibility for Individuals added
links to CPD waiver memoranda; III.N.2., “Housing Quality Standards,” new link
to waiver memoranda.
• 14.862 – Updated IV, “Other Information,” section on Indian CDBG-ARP
Imminent Threat Grants to add links to the Indian CDBG implementing
regulations at 24 CFR Part 1003; ICDBG-ARP Implementation Notice, PIH-
2021-22; COVID-19 Recovery Programs site, and Code Talk.
• 14.872 – Updated II, “Program Procedures,” section Availability of Other
Program Information, for links to the Office of Capital Improvements and REAC
• 14.873 – Updated IV, “Other Information,” with link to NHHBG-ARP
Implementation Notice PIH-2021-13.
• 15.025 – Updated II, “Program Procedures,” deleted link to the revised Pub. L.
No. 102-477 reporting forms.
• 15.605 and 15.611 and 15.626 – Updated II, “Program Procedures,” deleted link
to FWS Grant Information.
• 15.615 – Updated II, “Program Procedures,” updated link to FWS website.
• 17.235 – Updated II, “Program Procedures,” for the link to the SCSEP website.
• 17.245 – Updated II, “Program Procedures,” links to FY 2020 TAA Program
Annual Report to Congress, TEN 01-21 and TEN 24-20; II, “Program
Procedures,” subsection Availability of Other Program Information updated link
to TAA program procedures; III.L.1., “Reporting,” link to TEGL 02-16 and to the
form ETA 9130, and the website to submit SF-424 form to ETA.
Compliance Supplement 2022 8-V-2 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
• 17.264 – Updated II, “Program Procedures,” section Availability of Other
Program Information updated link to National Farmworker Jobs Program; III.L.2.,
“Reporting,” section on Performance Reporting new link for additional
information on performance reporting.
• 17.265 – Updated IV, “Other Information,” deleted two links for 477 Plan and
additional information at the index page.
• 20.205 and 20.219 and 20.224 and 23.003 – Updated III.I., “Procurement and
Suspension and Debarment,” updated link to qualified youth service or
conservation corps
• 20.600 and 20.611 and 20.616 – Updated II, “Program Procedures,” subsection
Availability of Other Program Information new link to the Federal Register for
program procedures.
• 21.016 – Updated II, “Program Procedures” subsection Source of Governing
Requirements new link to public notices issued by DOJ Wires.
• 21.027 – Updated II, “Program Procedures” subsection Source of Governing
Requirements new link to Treasury’s Interim Final Rule and Treasury’s Final
Rule at 31 CFR Part 35, and subsection Availability of Other Program
Information updated links including email address for Office of Recovery
Programs; III.A., “Activities Allowed or Unallowed” new link to Interim Final
Rule, Final Rule, and FAQs; III.L.3, new link to Treasury’s Compliance and
Reporting Guidance.
• 32.006 – Updated I, “Program Objectives,” link to the April 2, 2020 Report and
Order and to the Round 1 and Round 2 websites; “Program Procedures” new
email address to Telehealth Application Support, the CARES Act, Round 12
Report and Order, FCC COVID-19 Telehealth Program, FCC 21-39, CFR Title 2
(2021), and additional program information, including FAQs; III.A.2., “Activities
Unallowed,” link to DA 21-309; III.B., “Allowable Costs/Cost Principles,” Round
1 FAQs and Round 2 Telehealth Program; III.I., “Procurement and Suspension
and Debarment,” DA 21-309; III.N.1., “Eligibility,” links for health care provider
entity types.
• 81.041 – Updated II, “Program Procedures” subsection Availability of Other
Program Information updated links to SEP 2021 ALRD and a new link for SEP
2021 State Energy Program PY21 Grant Application Instructions; IV, “Other
Information” a new link for applicable guidance SEP Program Notice 10-008F.
• 81.042 – Updated III.E., “Eligibility,” links to paragraphs in CFR section 440.22;
III.L.2., “Reporting,” new link to DOE F 540.3.
Compliance Supplement 2022 8-V-3 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
• 84.000 – Updated II, “Introduction” new link to ESEA; II, “Program Procedures,”
subsection Availability of Other Program Information updated link to ESSA.
• 84.010 – Updated II, “Program Procedures,” section Availability of Other
Program Information new links to List of Invited Waivers and Frequently Asked
Question about the waiver due to COVID-19.
• 84.027 and 84.173 – Updated II, “Program Procedures,” section Availability of
Other Program Information and III.G.2., updated links to OSEP Memorandum 10-
5 and OSEP Memorandum 15-10.
• 84.032-G – Updated II, “Program Procedures,” updated link to Dear Colleague
Letter GEN-21-03 in Availability of Other Program Information; III.N.9,
Investments – Federal Fund, link to DCLID 99-G-316.
• 84.367 – Updated III.A., “Activities Allowed or Unallowed,” updated link to Part
3 of Non-Regulatory Guidance for Title II, Part A: Building Systems of Support
for Excellent Teaching and Leading.
• 84.425 – Updated ERF Section 1: II, “Program Procedures” new and/or updated
links to the states approved applications under subsection CRRSA EANS and
ARP EANS subsection; under Source of Governing Requirements new links;
under Availability of Other Program Information multiple new and updated links,
including EANS program and ESF-SEA, ESF-Governor, and ARP OA-SEA for
FAQs, Fact Sheet, and State Educational Agency Plan; III.G., “Matching, Level
of Effort, Earmarking.”
ESF Section 2; new link to more information on the Note before Program
Objectives; new link to ED Office of OIG and in section Source of Governing
Requirements, two new links for (a)(2) and one link for (a)(3), Availability of
Other Program Information new links for FAQs, Webinars, and Other Materials;
III.L.3., “Reporting,” subsection Special Reporting new link.
• 93.044 and 93.045 and 93.053 – Updated II, “Program Procedures,” new and
updated links to BPHC website and COVID-19 funding resources in Availability
of Other Program Information.
• 93.224 and 93.527 – Updated II, “Program Procedures,” section Availability of
Other Program Information updated link to BPHC program requirements and a
new link for COVID-19 funding resources; III.L.3., “Special Reporting” section
new links to UDS Resources and UDS Reporting Manual.
• 93.461 – Updated II, “Program Procedures,” section Additional Sources of
Information, for Terms and Conditions, and new links for HRSA COVID-19
CAF, including COVID-19 coverage assistance, FAQs, and terms and conditions
Compliance Supplement 2022 8-V-4 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
for coverage assistance; III.A.2, “Activities Allowed and Unallowed,” for
Medicare coverage; IV, “Other Information,” new link to HRSA webpages.
• 93.498 – Updated II, “Program Procedures” section Availability of Other Program
Information new links to Assistance Listing for PRF and ARP Rural Distribution,
and new links for additional information about the PRF, including General
Information, FAQs, all four phases of General Distributions; a variety of links for
Targeted Distribution payments; and websites with information about the ARP
Rural Distribution; III.B., “Allowable Costs/Cost Principles” deleted link.
• 93.767 – Updated I, “Program Objectives II” link to Medicaid; “Program
Procedures,” subsection A. Overview, new link to SHO letter #21-002; III.E.,
“Eligibility,” link to November 1, 2021 fact sheet on Health Coverage Options for
Afghan Evacuees; III.N.1, “Provider Eligibility,” link to Medicaid Provider
Enrollment Compendium (MPEC).
• 93.778 and 93.775 and 93.777 – Updated II, “Program Procedures” added new
links to transcripts for podcasts, SHO letter #21-002, and State Medicaid Director
(SMD) Letter #21-003, CMCS Informational Bulletin; deleted the link to
COVID-19 toolkit, and updated the link to CMS guidance available on
Medicaid.gov; III.E., “Eligibility,” new links to in State Health Official letter #21-
005, fact sheet on Health Coverage Options for Afghan Evacuees, State Medicaid
Director letter #21-002; III.N.4., new link for Medicaid Provider Enrollment
Compendium (MPEC); III.N.8., new link for the Annual Report to Congress –
Medicare and Medicaid Integrity Programs – Fiscal Year 2018; III.N.12., new
link to Appendix B of SMD #21-003.
• 94.006 – Updated III.B., “Allowable Costs/Cost Principles,” link for additional
instructions to grantees; III.N.2., “National Service Criminal History Checks,”
new link to NSCHC Manual and the Using NSOPW and State Repositories
Manual.
• 94.011 and 94.016 – Updated III.E.1., “Eligibility,” new link to AmeriCorps
website; III.N.1., “National Service Criminal History Checks,” new link to
NSCHC Manual and the Using NSOPW and State Repositories Manual.
Part 4 – Agency Program Requirements
Changes were made to the following programs:
• 10.000 – Updated, including a new email address for FNS’s Office of Financial
Management, Office of Internal Controls, Audits and Investigations.
• 10.555 and 10.553 and 10.556 and 10.559 and 10.582 – Updated the cluster
deleting 10.579 and adding 10.582; I, “Program Objectives”; II, “Program
Procedures,” including subsections Source of Government Requirements and in
Compliance Supplement 2022 8-V-5 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
Availability of Other Program Information, a new subsection on COVID-19
Pandemic Flexibilities, including a website; III Compliance Matrix C, “Cash
Management,” changed to an N from a Y, J, “Program Income,” changed to an N
from a Y, and L, “Reporting” changed to a Y from an N; III.A., “Activities
Allowed or Unallowed”; III.E., “Eligibility,” all subsections; III.I., “Procurement
and Suspension and Debarment”; III.N.1., “Verification of Free and Reduced
Price Applications (NSLP)”; III.N.3., “Non-Profit School Food Service
Accounts”; III.N.4., “Paid Lunch Equity (NSLP)”; IV, “Other Information.”
• 10.566 – Updated II, “Program Procedures,” subsection on Benefit Redemption;
III.A., “Activities Allowed or Unallowed.”
• 10.568 and 10.565 and 10.569 – Updated I, “Project Objectives”; II, “Program
Procedures”; III.E., “Eligibility,” all subsections.
• 10.649 – Updated II, “Program Procedures” including a new subsection on P-EBT
Administrative Cost Grant Awards; III.A., “Activities Allowed or Unallowed”;
III.H., “Period of Performance”; III.L., “Reporting,” section III.L.1, Financial
Reporting.
• 11.300 and 11.307 – Updated I, “Program Objectives”; II, “Program Procedures”;
III.A.1.f., “Activities Allowed and Unallowed,” to add new subsection in
Activities Allowed on participant support costs and Activities Allowed to update
CFR references; III.J., “Program Income,” to update CFR references; III.L.1,
“Reporting,” and III.L.3., “Special Reporting”; III.M., “Subrecipient Monitoring”
to update CFR references; III.N.2, “RLF Awards: Loan Requirements,”
subsection Compliance Requirements; III.N.4., “Wage Rate Requirements,”
subsection Compliance Requirements for CFR references; IV, “Other
Information.”
• 11.611 – Updated II, “Program Procedures,” subsection A, including subsection
on Base Cooperative Agreements to Create and Support Centers, and subsection
on Cooperative Agreements for Emergency Assistance; III.L.3.a., “Reporting,”
subsection on Financial Reporting for SF-425, Federal Financial Report.
• 14.169 – Please note: The program has made the decision to pull the current CSP
package for 14.169 from the FY 22 package. They will refine and look to
resubmit the package guidance for FY 23.
• 14.218 and 14.225 – Updated II, “Program Procedures”; III.A., “Activities
Allowed or Unallowed,” including a new content on additional flexibilities that
apply to CDBG-DR and CDBG-MIT funds and a new link to the Federal Register
notices; III.B., “Allowable Costs/Cost Principles”; III.H., “Period of
Performance”; III.J., “Program Income”; III.L., “Reporting”; III.N.2, “Citizen
Participation,” subsections Compliance Requirements and Suggested Audit
Compliance Supplement 2022 8-V-6 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
Procedures; III.N.5., “Rehabilitation,” subsection Compliance Requirements; IV,
“Other Information.”
• 14.228 – Updated I, “Program Objectives”; II, “Program Procedures,” including
new links in both Source of Governing Requirements and Availability of Other
Program Information; Compliance Matrix, F “Equipment/Real Property
Management” changed to a Y from an N; III.A., “Activities Allowed or
Unallowed”; III.B., “Allowable Costs/Cost Principles”; III.F., “Equipment and
Real Property Management,” new narrative added; III.H., “Period of
Performance”; III.J., “Program Income”; III.L., “Reporting”; III.N.2.,
“Environmental Oversight”; III.N.3., “Environmental Reviews,” new content for
subsection Compliance Requirements; III.N.4, “Citizen Participation,” new
content for subsection Compliance Requirements; IV, “Other Information.”
• 14.231 – Updated II, “Program Procedures,” including a new link in section
Source of Government Requirements; III.A., “Activities Allowed and
Unallowed”; III.G., “Matching, Level of Effort, Earmarking”; III.N.2,
“Maintenance as Homeless Shelters.”
• 14.239 – Updated I, “Program Objectives” to add information on HOME-ARP; II.
“Program Procedures,” including section Source of Governing Requirements and
Availability of Other Program Information, including a new website; III.A.,
“Activities Allowed or Unallowed” updated for HOME and HOME-ARP
narratives; III.E., “Eligibility,” updated for HOME-ARP narrative; III.J.,
“Program Income” updated for HOME-ARP narrative; III.M., “Subrecipient
Monitoring”; III.N.1., “Wage Rate Requirements”; III.N.2., “Maximum Per-unit
Subsidy and Underwriting Requirements”; III.N.3., “Drawdowns of
HOME/HOME-ARP Funds”; III.N.3., “Housing Quality Standards”; III.N.4,
“Housing Quality Standards”; IV, “Other Information.”
• 14.241 – Updated I, “Program Objectives”; II, “Program Procedures”; III.E.1.,
“Eligibility” section Eligibility for Individuals, including new links to CPD
waiver memoranda; III.L.2., “Reporting,” sections Financial Reporting and
Performance Reporting; III.N.1., “Maintenance of Structures,” subsection
Suggested Audit Procedures; III.N.2., “Housing Quality Standards,” subsection
Compliance Requirements; III.N.3., “Community Residences,” subsection
Suggested Audit Procedures.
• 14.862 – Updated II, “Program Procedures”; III.L.2., “Reporting,” section on
Performance Reporting changed to “Not Applicable”; IV, “Other Information,”
added new section on Indian CDBG-ARP Imminent Threat Grants.
• 14.867 – Updated III.L.2., “Reporting,” section of Performance Reporting;
III.N.3., “Investment of IHBG Funds,” subsection Compliance Requirements; IV,
“Other Information” for sections on Indian Housing Block Grant-CARES Grant
and Indian Housing Block Grant-ARP Grants.
Compliance Supplement 2022 8-V-7 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
• 14.871 and 14.879 – Updated II, “Program Procedures,” to add under subsection
B. Subprograms/Program Elements on Emergency Housing Voucher Program;
III.A., “Activities Allowed and Unallowed”; III.N.11, new section Emergency
Housing Vouchers Program Funding.
• 14.872 – Updated II, “Program Procedures,” including new links in Availability
of Other Program Information; III.A.2, “Activities Allowed or Unallowed,” with
new content for the Activities Unallowed section; III.B, “Allowable Costs/Cost
Principles.”
• 14.873 – Updated II, “Program Procedures”; IV, “Other Information,” for
subsections on Native Hawaiian housing Block Grants-ARP Grants, including a
new link, Waivers and Alternative Requirements Applicable Only to NHHBG-
ARP Funding.
• 17.207 and 17.801 – Updated title to change name for 17.801 and to delete
17.804; I, “Program Objectives”; III.E., “Eligibility.”
• 17.225 – Updated II, “Program Procedures,” subsections on A. Overview, B.
Subprograms/Program Elements, and C. Program Funding; III, Compliance
Requirements, B, “Allowable Costs/Cost Principles” to a Y from an N; III.E.1,
“Eligibility”; III.H., “Period of Performance”; III.N.4, “UI Program Integrity–
Overpayments,” subsection Compliance Requirements.
• 17.235 – Updated II, “Program Procedures,” including updating website; III.L.2.,
“Reporting,” subsection on Performance Reporting, including the addition of a
Key Line Item for Individuals Formerly Incarcerated.
• 17.245 – Program Title updated to Trade Adjustment Assistance for Workers;
Updated I, “Program Objectives”; II, “Program Procedures,” including new link,
and subsections Source of Governing Requirements and Availability of Other
Program Information; III.A.1., “Activities Allowed or Unallowed”; III.E.1.,
“Eligibility”; III.L., “Reporting.”
• 17.264 – Updated II, “Program Procedures,” section Source of Governing
Requirements and a new link in Availability of Other Program Information;
III.A., “Activities Allowed or Unallowed”; III.L.2., “Reporting,” new narrative
for section on Performance Reporting, including new links.
• 20.315 – Updated, III.N., added three new narratives for III.N.1., “Use and
Reporting of Overtime for Agreement Employees”; III.N.2., “Preventing and
Reporting on Employee Furloughs”; III.N.3., Buy American Act/Domestic
Buying Preference.”
Compliance Supplement 2022 8-V-8 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
• 20.600 and 20.611 and 20.616 – Updated to remove 20.601 and 20.602 and
20.609 and 20.610 and 20.612 and 20.613 from the cluster; II, “Program
Procedures,” including a new link in Availability of Other Program Information;
III.A.1., “Activities Allowed or Unallowed”; III.G.3.b, “Matching, Level of
Effort, Earmarking,” subsection Earmarking.
• 21.016 – Updated II, “Program Procedures,” including subsection Source of
Governing Requirements; III.A.1., “Activities Allowed or Unallowed”; III.B,
“Allowable Costs/Cost Principles”; III.E.4,” Eligibility for Groups of Individuals
or Area of Service Delivery”; III.G.3, “Matching, Level of Effort, Earmarking”
changed from Not Applicable; III.I., “Procurement and Suspension and
Debarment”; III.L., “Reporting.”
• 21.027 – Updated I, “Program Objectives”; II, “Program Procedures,” sections on
Governing Requirements and Availability of Other Program Information,
including new links; III.A., “Activities Allowed or Unallowed,” including new
link; III.B., “Allowable Cost/Cost Principles”; III.H., “Period of Performance;”
III.I., “Procurement and Suspension and Debarment;” III.L., “Reporting,” new
narrative for 3. Special reporting and for III.4; III.M., Subrecipient Monitoring;
IV, “Other Information.”
• 32.006 – Updated I, “Program Objectives”; II, “Program Procedures,” including
new websites in Source of Governing Requirements and Availability of Other
Program sections; III. Compliance Matrix, changed E, “Eligibility,” to an N from
a Y; and I, “Procurement and Suspension and Debarment” to a Y from an N;
III.A., “Activities Allowed or Unallowed,” both sections; III.B., “Allowable
Costs/Cost Principles”; III.E., “Eligibility,” section III.E.1, changed to Not
Applicable; III.H., “Period of Performance”; III.I., “Procurement and Suspension
and Debarment,” narrative added; III.L., “Reporting,” narrative added; III.N.1.,
“Eligibility,” narrative added.
• 81.041 – Updated II, “Program Procedures,” including subsection Availability of
Other Program Information to update links; III.L.2, “Reporting” subsection
Performance Reporting changed from “Not Applicable” to Progress Report; IV,
“Other Information.”
• 81.042 – Updated II, “Program Procedures” subsection Source of Governing
Requirements; III.A.2.b.(3), “Activities Allowed or Unallowed,” subsection
Activities Unallowed; III.E.1, “Eligibility,” subsection; III.L.2., “Reporting,”
including a new link in section on Performance Reporting.
• 84.000 – “Introduction,” updated link in Waivers and Expanded Flexibility and
changes to Cross-Cutting Requirements; II, “Program Procedures,” section on
Availability of Other Program Information; III.A., “Activities Allowed or
Unallowed”; III.B., “Allowable Costs/Cost Principles”; III.C., “Cash
Compliance Supplement 2022 8-V-9 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
Management”; III.G., “Matching, Level of Effort, Earmarking”; III.N.1.,
“Participation of Private School Children.”
• 84.010 – II, “Program Procedures,” including new links; III.A., “Activities
Allowed or Unallowed”; III.E.1., “Eligibility”; III.G.2, “Matching, Level of
Effort, Earmarking.”
• 84.032-G – Updated II, “Program Procedures,” subsection Availability of Other
Program Information; III.N.5., “Collection Efforts,” subsection Compliance
Requirements; III.N.7., “Assignment of Defaulted Loans to ED,” all subsections;
III.N.8., “Federal Fund and Agency Operating Fund,” subsection Compliance
Requirements; III.N.10., “Collection Charges,” all subsections; added new section
III.N.13., “Implementation of Dear Colleague Letter GEN-21-03 “Expansion of
Collections Pause to Defaulted FFEL Program Loans Managed by Guaranty
Agencies (Updated May 24, 2021)”; added new section III.N.14., “Calculation of
Lost Revenue.”
• 84.126 – Updated III.L.2., “Reporting” section on Performance Reporting.
• 84.425 – Updated Introduction, including list of subprograms, and IV, “Other
Information,” including a new figure and an example table.
ESF Section 1: Added 84.425V American Rescue Plan – Emergency Assistant to
Non-Public schools (ARP EANS) subprogram; I, “Program Objectives”; II,
“Program Procedures,” including new links in Source of Governing Sources and
updated and new links in Availability of Other Program Information; III.A.,
“Activities Allowed or Unallowed,” including new content on ESF-Governor
Funds, ESF-SEA Funds, and ARP-OA SEA Funds; III.B., “Allowable Costs/Cost
Principles”; III.F., “Equipment/Real Property Management”; III.G., “Matching,
Level of Effort, Earmarking” new narrative; III.L.3, “Reporting,” subsection
Special Reporting; III.N., “Special Tests and Provisions,” added new subsection
III.N.3., “Identifying Non-Public Schools under ARP EANS that Enroll a
Significant Percentage of Students from Low-Income Families and are Most
Impacted by the COVID-10 Emergency.”
ESF Section 2: Added 84.425P HEERF Institutional Resilience and Expanded
Postsecondary Opportunity (IREPO) Program and 84.425T HEERF Supplemental
Support Under American Rescue Plan (SSARP) Program; and added a note on
84.425Q and new link before Program Objectives; II, “Program Procedures,”
including new links; III “Compliance Requirements” changed “Cash
Management” to a Y from an N; III.A., “Activities Allowed and Unallowed”;
III.B., “Allowable Costs/Cost Principles”; III.C, “Cash Management” narrative
added; III.G, “Matching, Level of Effort, Earmarking”; III.H., “Period of
Performance”; III.I, “Procurement and Suspension and Debarment”; III.L,
“Reporting,” subsection Special Reporting, including links.
• 93.044 and 93.045 and 93.053 – Title change for 93.044 to add American Rescue
Plan and 93.045 to add in reference to CARES Act and American Rescue plans
Compliance Supplement 2022 8-V-10 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
under Title III-C of the Older Americans Act; I, “Program Objectives”; II,
“Program Procedures,” including new and updated links in Availability of Other
Program Information; III.G.1., “Matching, Level of Effort, Earmarking” added
new subsection titles and new subsection for NSIP grants.
• 93.224 and 93.527 – Updated II, “Program Procedures,” including sections
Sources of Governing Requirements and Availability of Other Program
Information for links for HRSA COVI-19 CAF; III.A.2., “Activities Allowed and
Unallowed”; III.L.3., “Reporting” section on Special Reporting to UDS resources
link and Key Line Items; III.N.2., “Compliance with Consolidated Appropriations
Act,” subsections Compliance Requirements and Audit Objectives.
• 93.461 – Title change to add in COVID-19 Coverage Assistance Fund; Updated I,
“Program Objectives; “ II, “Program Procedures, including Sources of Governing
Requirements and Availability of Program Information, including new website
links; III.A., “Activities Allowed or Unallowed,” including new link; III.B.,
“Allowable Costs/Cost Principles”; III.E., “Eligibility”; IV, “Other Information,”
link updated.
• 93.498 – Title change to add in American Rescue Plan; Updated I, “Program
Objectives,” including table that outlines PRF and ARP Rural Distribution
recipients’ payments eligible expenses and lost revenues; II, “Program
Procedures,” including new links for PRF in subsection Availability of Other
Program Information; III. Compliance Requirements, III.N., “Special Tests and
Provisions” changed to an N from a Y; III.A., “Activities Allowed or
Unallowed”; III.B, “Allowable Costs/Cost Principles,” with a deleted link; III.L.,
“Reporting”; IV, “Other Information,” including update to the HRSA PRF and
ARP Rural Distribution reporting requirements table.
• 93.558 – Updated I, “Program Objectives”; II, “Program Procedures” to add a
section on the American Rescue Plan and to update subsection Availability of
Other Program Information; III.A., “Activities Allowed and Unallowed” a new
section 3 on Pandemic Emergency Assistance Fund; III.E., “Eligibility” section
III.E.2 Eligibility for the Pandemic Emergency Assistance Fund added; III.G.,
“Matching, Level of Effort, Earmarking,” new narrative for subsection 2.2 for
Pandemic Emergency Assistance Fund; III.L., “Reporting,” section Special
Reporting.
• 93.575 and 93.489 and 93.596 – Updated II, “Program Procedures,” subsection
Availability of Other Program Information for additional web site links;
Compliance Matrix change in L, “Reporting” to a Y from an N; III.A.1.,
Activities Allowed or Unallowed subsection added for Activities Allowed for
CCDF ARP Act Stabilization Funds; III.E., “Eligibility,” changes to subsection
on Eligibility for Subrecipients, and a new subsection 4, eligibility for Child Care
Providers Receiving CCDF ARP Act Stabilization Funds; III.G., “Matching,
Level of Effort, Earmarking;” III.H., “Period of Performance” new mandatory
Compliance Supplement 2022 8-V-11 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
funds for Assistance Listing 93.596 and charts updated for FY 2021 and FY 2022;
III.L., new narrative; III.N.4, “Child Care Provider Eligibility for ARP Act
Stabilization Funds,” new subsection; III, “Other Information,” new subsection on
Funding Sources Within the CCDF Cluster.
• 93.767 – Updated I, “Program Objectives,” with a new link; II, “Program
Procedures,” including updating a link; III.A., “Activities Allowed and
Unallowed”; III.B, “Allowable Costs/Cost Principles”; III.E., “Eligibility,”
including new links; III.G., “Matching, Level of Effort, Earmarking”; III.H,
“Period of Performance”; III.N.1., “Provider Eligibility (Screening and
Enrollment), subsection Compliance Requirements, including a new link; III.N.2.,
“Refunding of Federal Share of CHIP Overpayments to Providers,” subsections
Compliance Requirements and Suggested Audit Procedures.
• 93.778 and 93.775 and 93.777 – Updated I, “Program Objectives”; II, “Program
Procedures,” including new links; III.A., “Activities Allowed or Unallowed”;
III.B., “Allowable Costs/Cost Principles”; III.E., “Eligibility,” including new
links; III.G., “Matching, Level of Effort, Earmarking”; III.L., “Reporting”;
III.N.1., “Utilization Control and Program Integrity,” subsections Compliance
Requirements and Audit Objectives; III.N.4., “Provider Eligibility (Screening and
Enrollment,” subsection Compliance requirements; III.N.7., “Refunding of
Federal Share of Medicaid Overpayments to Providers” subsections Compliance
Requirements and Suggested Audit Procedures; III.N.8, “Medicaid National
Correct Coding Initiative (NCCI),” subsection Compliance Requirements; III.N.9,
Investments – Federal Fund for new link; III.N.12, a new section “American
Rescue Plan Act of 2021 (ARP) Section 9817; IV, “Other Information.”
• 94.006 – Updated II, “Program Procedures”; III.B., “Allowable Costs/Cost
Principles”; III.E., “Eligibility,” subsections on Eligibility for Individuals;
III.N.1., “Living Allowances,” including the living allowances chart for 2020;
III.N.2., “National Service Criminal History Checks,” all subsections updated,
including two new links.
• 94.011 and 94.016 – Updated throughout to change CNCS to AmeriCorps;
III.E.1., “Eligibility,” updated links; III.N.1., “National Service Criminal History
Checks,” all subsections updated, including two new links.
• 96.001 and 96.006 – Updated II, “Program Procedures”; III.N.1., subsection
Suggested Audit Procedures.
Part 5 – Clusters of Programs
Part 5.1 and 5.2 – updated for the effective date of the Supplement.
Part 5.3 – major edits implemented.
Compliance Supplement 2022 8-V-12 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
Part 5.4 – updated the cluster list.
Part 6 – Internal Control
• Updated for the effective date of the Supplement.
Part 7 – Guidance for Auditing Programs Not Included in This Compliance Supplement
• Updated for the effective date of the Supplement.
Part 8 – Appendixes
Appendix I – Federal Programs Excluded from the A-102 Common Rule and Portions of
2 CFR Part 200
• Updated for the effective date of the Supplement.
Appendix II – Federal Agency Codification of Governmentwide Requirements and
Guidance for Grants and Cooperative Agreements
• Updated for the effective date of the Supplement.
Appendix III – Federal Agency Single Audit, Key Management Liaison, and Program
Contacts
• Updated for this year’s program contacts.
Appendix IV – Internal Reference Tables
• Updated the list of programs currently designated as high risk.
• List updated with new programs with requirements defined in IV, “Other Information.”
Appendix V – List of Changes for the 2022 Compliance Supplement
• List updated with changes to the programs and appendixes for 2022.
Appendix VI – Program-Specific Audit Guides
• Updated for the effective date of the Supplement.
Appendix VII – Other Audit Advisories
• Major updates sections, including Definition of COVID-19 Funding, Alternative
Compliance Examination Engagement for Eligible SLFRF Recipients, and Due Date for
Submission of Audit Reports and Low-Risk Auditee Criteria nd the Federal Audit
Clearinghouse transition from Census to GSA.
Compliance Supplement 2022 8-V-13 Appendix V
April 2022 List of Changes for the 2022 Compliance Supplement
• Updated for the effective date of the Supplement.
Appendix VIII – Examinations of EBT Service Organizations
• Updated for the effective date of the Supplement.
Appendix IX – Compliance Supplement Core Team
• Updated for this year’s team members.
Compliance Supplement 2022 8-V-14 Appendix V
April 2022 Program-Specific Audit Guides
APPENDIX VI
PROGRAM-SPECIFIC AUDIT GUIDES
This appendix lists program-specific audit guides for use by auditors. The listing includes the
title of the guide, the date of issuance or latest update, and where to obtain a copy.
Department of Education
• Audit Guides for Student Aid Programs
(https://www2.ed.gov/about/offices/list/oig/nonfed/index.html)
Department of Housing and Urban Development
• HUD Consolidated Audit Guide (HUD Consolidated Audit Guide | Office of Inspector
General, Department of Housing and Urban Development (hudoig.gov))
Compliance Supplement 2022 8-VI-1 Appendix VI
April 2022 Other Audit Advisories
APPENDIX VII
OTHER AUDIT ADVISORIES
I. Novel Coronavirus (COVID-19)
This section provides guidance to the following areas affecting single audits arising due to
COVID-19:
• Definition of COVID-19 funding
• Treatment of donated personal protective equipment (PPE) on the Schedule of
Expenditures of Federal Awards (SEFA)
• Agency Guidance Document References
• Identification of COVID-19 related awards and single audit applicability
• Identification of COVID-19 related awards on the SEFA and SF-SAC
• Identification of COVID-19 related awards in audit findings
• Identification of compliance requirements for COVID-19 related awards
• Responsibilities for informing subrecipients
• Alternative Compliance Examination Engagement for Eligible SLFRF Recipients
Definition of COVID-19 Funding
As a result of the COVID-19 pandemic, many new federal programs have been established and
funding has been added to existing federal programs from the following Acts:
Coronavirus Preparedness and Response Supplemental Appropriations Act
Families First Coronavirus Response Act
Coronavirus Aid, Relief, and Economic Security Act (CARES Act)
Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA)
American Rescue Plan Act (ARP)
Funding arising from these sources, both to new and existing programs, is referred to as
“COVID-19 funding,” “COVID-19 programs,” or “COVID-19 related awards” throughout this
section. Refer also to Appendix IV, Internal Reference Tables, for a listing of programs with a
“higher risk” designation, many of which involve COVID-19 funding, and for information about
how that designation impacts the major program determination process.
Compliance Supplement 2022 8-VII-1 Appendix VII
April 2022 Other Audit Advisories
Donated Personal Protective Equipment (PPE)
During the emergency period of COVID-19 pandemic and as allowed under OMB Memorandum
M-20-20 (April 9, 2020), federal agencies and recipients can donate PPE purchased with federal
assistance funds to various entities for the COVID-19 response. The donated PPE were mostly
provided without any compliance or reporting requirements or Assistance Listing information
from the donors. As such, the non-federal entities that received donated PPE should provide the
fair market value of the PPE at the time of receipt as a stand-alone footnote accompanying their
SEFA. The amount of donated PPE should not be counted for purposes of determining the
threshold for a single audit or determining the type A/B threshold for major programs and is not
required to be audited as a major program. Because donated PPE has no bearing on the single
audit, the donated PPE footnote may be marked “unaudited.”
As a reminder, the above only relates to donated PPE provided without any compliance or
reporting requirements or assistance listing from donors. There could be some PPE that must
appear on the SEFA as a federal program (e.g., when the recipient uses funds provided under an
Assistance Listing to purchase PPE).
Agency Guidance Document References for COVID-19 Programs
The COVID-19 pandemic has led many federal agencies to issue implementing guidance (e.g.,
frequently asked questions, memos) outside of the normal regulatory process for new and
existing programs receiving COVID-19 funding. Such guidance is issued to communicate an
agency’s understanding of how the relevant statutes, regulations, or the terms and conditions of
the federal awards and apply to a particular circumstance, but it does not create new compliance
requirements. Due to the evolving nature of the pandemic environment, it has been common for
federal agencies to update, change, or delete their specific guidance over time.
The Part 4 sections for COVID-19 programs often refer auditors to agency guidance documents
to obtain a better understanding of statutory and regulatory compliance requirements subject to
audit. When evaluating a non-federal entity’s compliance, auditors must consider provisions of
federal statutes, regulations, and the terms and conditions of federal awards. However, auditors
may also consider guidance documents in effect during the period to understand the program
requirements. An auditor may conclude whether the non-federal entity is in compliance with a
type of compliance requirement based on consideration of applicable implementing guidance in
effect at the time of the activity or transaction.
When citing criteria for audit findings, 2 CFR 200.516(b)(2) states that the following information
must be included in finding detail: “The criteria or specific requirement upon which the finding
is based, including the Federal statutes, regulations, or the terms and conditions of the Federal
awards.” Therefore, auditors should refer to a statute, regulation, or term and condition as criteria
for the audit finding.
Identification of COVID-19 Related Awards and Single Audit Applicability
Federal agencies may have incorporated COVID-19 funding into an existing program and
Assistance Listing number or set up a separate COVID-19 program with a unique Assistance
Compliance Supplement 2022 8-VII-2 Appendix VII
April 2022 Other Audit Advisories
Listing number. Federal agencies are required to specifically identify COVID-19 related awards,
regardless of whether the funding is provided under a new or existing Assistance Listing number.
However, in the early days of the crisis caused by the COVID-19 pandemic with the need to
respond quickly, in some cases cash was sent to non-federal entities without application or
Assistance Listing number. The non-federal entity was required to either agree to the terms and
conditions or return the funds.
When COVID-19 funding is subawarded by a pass-through entity from an existing program, the
information furnished to subrecipients should distinguish the subawards of incremental COVID-
19 funding included in the subawards from non-COVID-19 funding.
In order to assist recipients and auditors in the identification of all the COVID-19 funds and their
related program Assistance Listing numbers, OMB has issued several summaries of federal
programs that were created by COVID-19 funding and also existing programs that received
COVID-19 funding. A summary of programs that received funding under the CARES Act (and
other earlier COVID-19 legislation) as of May 20, 2020, can be accessed at:
https://www.cfo.gov/wp-content/uploads/2020/07/M-20-21_FAQ_07312020_UPDATED.pdf. A
summary of programs that received funding under the ARP Act as of October 29, 2021, can be
found at: https://www.cfo.gov/assets/files/Revised-American-Rescue-Plan-Assistance-
Listings_10-29-2021.pdf. Each summary includes program Assistance Listing numbers and an
asterisk (*) next to Assistance Listing numbers denoting a new Assistance Listing number.
Identification of COVID-19 Related Awards on the SEFA and SF-SAC
As described in 2 CFR section 200.510(b), auditees must complete the SEFA and include
Assistance Listing numbers when reporting their federal awards and subawards. To maximize
the transparency and accountability of COVID-19 related award expenditures, OMB M-20-26
(June 18, 2020) instructed recipients and subrecipients to separately identify the COVID-19
Emergency Acts expenditures on the Schedules of Expenditures of Federal Awards. Therefore,
non-federal entities should separately identify COVID-19 expenditures on the SEFA and SF-
SAC. For existing programs that have both COVID-19 expenditures and non-COVID-19
expenditures, this may be accomplished by identifying COVID-19 expenditures on the:
• SEFA – On a separate line by Assistance Listing number with “COVID-19” as a prefix to
the program name. For example:
o COVID-19 – Temporary Assistance for Needy Families – 93.558 – $1,000,000
o Temporary Assistance for Needy Families – 93.558 – $3,000,000
o Total – Temporary Assistance for Needy Families – 93.558 – $4,000,000
• SF-SAC – On a separate row by Assistance Listing number with “COVID-19” as the first
characters in Part II, Item 1c, Additional Award Information. Example:
Compliance Supplement 2022 8-VII-3 Appendix VII
April 2022 Other Audit Advisories
a b c d e f g h
Assistance Assistance
Listing # Listing #
Assistance Listing Three-
Federal Program Name
Row Number (auto- Federal Program Total
Amount Expended
Federal Awarding Additional Award Cluster Total
Cluster Name
Digit Extension (auto-generated)
generated) Agency Prefix Identification (auto-generated)
($) ($) ($)
TEMPORARY ASSISTANCE $3,000,000.00 $4,000,000.00
1 93 558 FOR NEEDY FAMILIES
COVID- COVID-19 - TEMPORARY $1,000,000.00 $4,000,000.00
2 93 558 19 ASSISTANCE FOR NEEDY
FAMILIES
Total Federal Awards $4,000,000.00
Expended =
Identification of COVID-19 Related Awards in Audit Findings
Consistent with identifying COVID-19 expenditures on the SEFA, auditors should include the
COVID-19 identification for audit findings that are applicable to programs that are entirely
COVID-19 funded and existing programs with COVID-19 funding.
Identification of Compliance Requirements for COVID-19 Related Awards
As noted in OMB Memorandum M-20-26 (June 18, 2020), federal awarding agencies are
responsible for identifying COVID-19 related awards and communicating the applicable
compliance requirements to the recipient. Similarly, pass-through entities are responsible for
identifying COVID-19 related awards and communicating the applicable requirements to their
subrecipients. Normally, this information would be in the award terms and conditions. However,
for COVID-19 related awards, the compliance requirements may have been communicated
through an agency website and the compliance requirements may have been modified or
compliance requirements not included in original terms and conditions may have been added.
For new COVID-19 related programs that are not included in this Supplement, the auditor must
use the framework provided by Part 7 of this Supplement. Part 7 includes procedures to
determine which of the compliance requirements to test.
Responsibilities for Informing Subrecipients
As noted in OMB Memorandum M-20-26 (June 18, 2020), pass-through entities agree to
separately identify to each subrecipient, and document at the time of subaward and at the time of
disbursement of funds, the federal award number, Assistance Listing number, and amount of
COVID-19 funds. When COVID-19 funds are subawarded for an existing program, the
information furnished to subrecipients should distinguish the subawards of incremental COVID-
19 funds from regular subawards under the existing program.
Compliance Supplement 2022 8-VII-4 Appendix VII
April 2022 Other Audit Advisories
This information is needed to allow the pass-through entity to properly monitor subrecipient
expenditures of COVID-19 funds, as well as for oversight by the federal awarding agencies,
Federal Offices of Inspector General, and the Government Accountability Office.
Alternative Compliance Examination Engagement for Eligible SLFRF Recipients
The US Department of the Treasury (“Treasury”) recognizes that many recipients of Coronavirus
State and Local Fiscal Recovery Funds (“SLFRF”) may now be required to complete a Single
Audit or a Program-Specific Audit pursuant to the Single Audit Act and its implementing
regulations, 2 CFR Part 200, Subpart F, due to their receipt of an SLFRF award, which may lead
to them expending $750,000 or more during their fiscal year in Federal awards. This may be
because the recipient has not received federal financial assistance before, or the other federal
financial assistance they expended did not exceed the $750,000 audit threshold set forth 2 CFR
200.501(a). As a result, Treasury has developed an alternative approach which is available for
SLFRF recipients that would otherwise not be required to undergo an audit pursuant to 2 CFR
Part 200, Subpart F, if it was not for the expenditures of SLFRF funds directly awarded by
Treasury.
Under its authority 2 CFR section 200.102(a), OMB is authorizing the use of an alternative
compliance examination engagement in accordance with the Government Accountability
Office’s Government Auditing Standards in lieu of a full single audit or program-specific audit
as required per 2 CFR 200, Subpart F. The alternative approach along with the criteria for
eligible recipients are detailed in the Part 4 – Section IV, “Other Information” of assistance
listing 21.027 – Coronavirus State and Local Recovery Funds.
This alternative is intended to reduce the burden of a full Single Audit or Program-Specific Audit
on eligible recipients and practitioners, as well as uphold Treasury’s responsibility to be good
stewards of federal funds.
II. Effect of Changes to Compliance Requirements and Other Clusters
Removal of Compliance Requirement from Part 2 Matrix
In any instance in which a compliance requirement has been removed from a program/cluster, as
shown in the Part 2 matrix, if there was an audit finding related to that compliance requirement
in an audit conducted using the prior year’s Supplement that finding must continue to be reported
in the summary schedule of prior audit findings and considered in the major program
determination under 2 CFR section 200.518. The procedures to assess the reasonableness of the
summary schedule of prior year audit findings must include all prior audit findings included in
the summary schedule, regardless of whether the current Part 2 matrix identified a requirement
subject to audit. For example, if there was an audit finding relating to subrecipient monitoring in
the prior year but the current year Part 2 matrix identified “M. Subrecipient Monitoring” as not
subject to audit with a “No,” the auditor’s procedures to determine the reasonableness of the
summary schedule of prior audit findings must include subrecipient monitoring. In any instance
in which a compliance requirement was added to a program/cluster in the current year’s
Supplement, auditors are not expected to have tested for that requirement under the prior year’s
audit. This includes correction of an error, if any, as identified in Appendix V of the Supplement.
Compliance Supplement 2022 8-VII-5 Appendix VII
April 2022 Other Audit Advisories
Addition of a New Program to an Other Cluster
One of the criteria for an “other cluster” to be considered a low-risk Type A program is that it
must have been audited as a major program in at least one of the two most recent audit periods
(“2-year look back” under 2 CFR section 200.518(c)(1)). In the year that this Supplement adds a
new program to another cluster listed in Part 5, the determination of whether the resulting other
cluster meets the 2-year look back criterion requires additional consideration. During that year,
the other cluster cannot qualify as having been audited as a major program in one of the two
most recent audit periods unless the auditee’s current-year expenditures for the newly added
program were less than or equal to 25 percent (0.25) of the Type A threshold, or all of the
programs included in the resulting other cluster met the “2-year look back” criterion. The
additional criteria in 2 CFR section 200.518(c) must also be evaluated by the auditor to
determine if the other cluster can be considered a low-risk Type A program in the current year.
In years after this Supplement adds a program to another cluster, such addition in a prior year
does not require additional consideration for the 2-year look back criterion.
The following examples are intended to illustrate consideration of the addition of a new program
to another cluster. They are illustrative only and not based on the contents of the current
Supplement.
Background for Examples:
Type A threshold $750,000.
Human Services existing other cluster (93.123, 93.125, and 93.127) was audited in 2015 with no
audit findings.
Part 5 of the 2017 Compliance Supplement added Assistance Listing 93.129 to form the new
other cluster with the following federal awards expended in 2017:
93.123: $ 500,000
93.125: $ 300,000
93.127: $ 400,000
93.129: $ 300,000
Considerations for 2017 major program determination using these facts:
Example 1
The Human Services cluster was audited in 2015. However, the auditee’s current year
expenditures for newly added Assistance Listing 93.129 exceed 0.25 of the Type A threshold of
$750,000 or $187,500; therefore, the resulting other cluster fails the 2-year look back criterion
and cannot be considered a low-risk Type A program in 2017.
Compliance Supplement 2022 8-VII-6 Appendix VII
April 2022 Other Audit Advisories
If, however, the auditee’s expenditures for newly added Assistance Listing 93.129 were equal to
or less than $187,500, the other cluster would pass the 2-year look back criterion and could be
considered to have been audited as a major program in one of the two prior years.
Example 2
The Human Services cluster was audited in 2015. The newly added program Assistance Listing
93.129 was audited in 2016. If both the cluster and the newly added program met all criteria in 2
CFR section 200.518(c) to be considered low-risk programs for 2017, the other cluster would be
a low-risk Type A program in 2017.
III. Due Date for Submission of Audit Reports and Low-Risk Auditee Criteria
As provided in 2 CFR Part 200, Subpart F (2 CFR section 200.520), in order to meet the criteria
for a low-risk auditee in the current year, the two prior years’ audits must have met the specified
criteria, including report submission to the Federal Audit Clearinghouse (FAC) by the due date.
The auditor may consider using the following steps to identify FAC submissions that do not meet
the due date.
Suggested Steps
1. Inquire of entity management and review available prior-year financial reports and audits
to ascertain if the entity had federal awards expended of $750,000, in the prior two audit
periods and, therefore, was required to have an audit under the uniform guidance and file
with the FAC.
2. If the entity was below the $750,000 threshold in either of the prior two audit periods,
and an audit was not required under the uniform guidance obtain written representation
from management to this fact and no further audit procedures are necessary as the entity
does not qualify as a low-risk auditee.
3. If a prior-year audit was conducted, obtain a copy of the data collection form (Form SF-
SAC) and the reporting package.
a. Calculate the “Nine Month Due Date” to file with the FAC as the date nine (9)
months after the end of the audit period. For example, for audit periods ending
June 30, 2022, the audit report would be due March 31, 2023.
b.. Access the FAC web page at https://harvester.census.gov/facweb.
• Select the “Find Audit Information” option and using the “Federal Audit
Clearinghouse IMS” and “Search for Single Audits” options for the audit
year in question, locate the FAC record for the entity. Verify correct
record by comparing both the entity name and Entity Identification
Number (EIN) number from the entity’s copy of the SF-SAC to the FAC
web page.
Compliance Supplement 2022 8-VII-7 Appendix VII
April 2022 Other Audit Advisories
• For this record, located on the FAC web page, compare the “Date
Received” to the Nine Month Due Date to determine if the due date was
met.
If the entity was not in compliance with the Nine Month Due Date or Extended
Due Date (if applicable) or did not submit the required audit to the FAC for either
of the prior two audit periods, then the entity does not qualify as a low-risk
auditee.
4. Contact the FAC at govs.fac@census.gov or 866-306-8799 if additional information is
needed on using the FAC website or determining the date the FAC accepted the report
submission as complete.
IV. Treatment of National Science Foundation and National Institutes of Health
Awards
National Science Foundation
All awards issued by the National Science Foundation (NSF) meet the definition of “Research
and Development” at 2 CFR section 200.87. As such, auditees must identify NSF awards as part
of the R&D cluster on the Schedule of Expenditures of Federal Awards (SEFA) and the auditor
must use the Research and Development cluster in Part 5 when testing any of those awards. NSF
recognizes that some awards may have another classification for purposes of reimbursement of
indirect costs. The auditor is not required to report this difference in treatment (i.e., the award is
classified as R&D for 2 CFR Part 200, Subpart F purposes, but non-research for indirect cost rate
purposes), unless the auditee is charging indirect costs at a rate other than the rate(s) specified in
the award document(s). This guidance complies with the NSF Proposal and Award Policies and
Procedures Guide (PAPPG), the current and prior versions of which may be found at
http://www.nsf.gov/bfa/dias/policy/.
National Institutes of Health
Effective for grants and cooperative agreements with budget periods beginning on or after
December 26, 2014, and awards that receive supplemental funding on or after December 26,
2014, all awards issued by the National Institutes of Health (NIH) meet the definition of
“Research and Development” at 45 CFR section 75.2. As such, auditees must identify NIH
awards as part of the R&D cluster on the SEFA, and the auditor must use the Research and
Development cluster in Part 5 when testing any of those awards. NIH recognizes that some
awards may have another classification for purposes of reimbursement of indirect costs. The
auditor is not required to report this disconnect (i.e., the award is classified as R&D for 2 CFR
Part 200, Subpart F, purposes, but non-research for indirect cost rate purposes), unless the
auditee is charging indirect costs at a rate other than the rate(s) specified in the award
document(s). (See the NIH Grants Policy Statement, the current and prior versions of which may
be found at http://grants.nih.gov/grants/policy/policy.htm.)
Compliance Supplement 2022 8-VII-8 Appendix VII
April 2022 Other Audit Advisories
V. Exceptions to the Guidance in 2 CFR Part 200
OMB does not maintain a complete listing of approved agency exceptions to the uniform
guidance in 2 CFR Part 200.
For programs included in the Supplement, the auditor should review the program supplement
and, as necessary, agency regulations adopting/implementing the OMB uniform guidance in
2 CFR Part 200 to determine if there is any exception related to the compliance requirements that
apply to the program. For programs not included in the Supplement that are audited using Part 7,
the auditor should review agency regulations adopting/implementing 2 CFR Part 200 to
determine if an exception applies to the program.
Questions about the agency-level rulemakings that adopt/implement 2 CFR Part 200 should be
directed to the federal agency key management liaisons specified in Appendix III to the
Supplement.
VI. Audit Sampling
Certain suggested audit procedures in this Compliance Supplement lend themselves to testing
using sampling. Auditors are reminded that when performing an audit under generally accepted
auditing standards (GAAS), including single audits, that AU-C section 530, Audit Sampling,
https://www.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments
/au-c-00530.pdf, provides auditor requirements and guidance related to an auditor’s use of
sampling. Failure to follow the standards, including the requirement to determine sample sizes
that are sufficient to reduce sampling risk to an acceptably low level, may result in the audit
being considered nonconforming by the federal cognizant agency for audit as part of a quality
control review.
The guidance in AU-C section 530 primarily addresses sampling considerations when
performing a financial statement audit. The AICPA Audit Guide, Government Auditing
Standards and Single Audits, contains auditor guidance for, among other things, designing an
audit approach that includes audit sampling to achieve both compliance and internal control over
compliance related audit objectives in a single audit or program-specific audit performed in
accordance with the Uniform Guidance. It also includes suggested minimum sample sizes for
tests of controls over compliance and tests of compliance based on certain engagement-specific
inputs.
Another AICPA Audit Guide, Audit Sampling also provides additional guidance and technical
background, which forms the basis of the practical application of audit sampling to Uniform
Guidance audits.
VII. Federal Audit Clearinghouse Transition from Census to GSA
The provider of the Federal Audit Clearinghouse (FAC) will change from Census to the General
Services Administration (GSA) on October 1, 2022. Single audits with a fiscal period ending in
2021 (or earlier) should be submitted to Census. Census will continue to receive and process
single audits for a limited period after September 30, 2022, allowing auditees an opportunity to
complete remaining in-process submissions.
Compliance Supplement 2022 8-VII-9 Appendix VII
April 2022 Other Audit Advisories
Single audits with a fiscal period ending in 2022 will be submitted to the GSA FAC beginning
on October 1, 2022. Therefore, single audits with a fiscal period ending in 2022 cannot be
submitted before that date. The 2 CFR 200.512(1) states that single audits must be submitted
within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after
the end of the audit period. If it is not possible to meet the 30-day aspect of that requirement due
to the timing of the opening of the GSA FAC for submissions, the audits will not be considered
late if they are submitted within nine months after the end of the audit period.
For example, a March 31, 2022, fiscal year-end single audit that is issued on June 30, 2022,
would technically be due to the FAC on July 30, 2022 (i.e., 30 calendar days after the auditee’s
receipt of the auditor’s reports). Because the GSA FAC will not be available for submissions
until October 1, 2022, if the single audit is submitted to the FAC by December 31, 2022, it would
be considered timely and have no impact on the low-risk auditee status of the auditee.
Compliance Supplement 2022 8-VII-10 Appendix VII
April 2022 Examinations of EBT Service Organizations
APPENDIX VIII
EXAMINATIONS OF EBT SERVICE ORGANIZATIONS
Background
States must obtain an examination report by an independent auditor of the state electronic
benefits transfer (EBT) service providers (service organizations) regarding the issuance,
redemption, and settlement of benefits under the Supplemental Nutrition Assistance Program
(SNAP) (Assistance Listing 10.551) in accordance with the American Institute of Certified
Public Accountants (AICPA) Statement on Standards for Attestation Engagements (AT) Section
801, Reporting on Controls at a Service Organization. Also, states are required to ensure that the
service organization has these examinations performed at least annually, that the examinations
cover the entire period since the previous examination period, and that the examination reports
are submitted to the state within 90 days after the end of the examination period. The
examination report must include a list of all states whose systems operate under the same control
environment. The auditor of the service organization is required to issue a report on controls
placed in operation and tests of operating effectiveness of controls, which is commonly referred
to as a “service organization control (SOC) 1 type 2 report” (7 CFR section 274.1(i)).
In performing audits of SNAP under 2 CFR Part 200, Subpart F, an auditor may use these SOC 1
type 2 reports to gain an understanding of internal controls and obtain evidence about the
operating effectiveness of controls.
A SOC 1 type 2 report includes (1) a description by the service organization’s management of its
system of policies and procedures for providing services to user entities (including control
objectives and related controls as they relate to the services provided) throughout the specified
period of time; (2) a written assertion by the service organization’s management about whether,
in all material respects and based on suitable criteria, (a) the aforementioned description fairly
presents the system throughout the specified period, (b) the controls were suitably designed
throughout the specified period to achieve the control objectives stated in that description, and
(c) the controls operated effectively throughout the specified period to achieve those control
objectives; and (3) the report of the service auditor, which (a) expresses an opinion on the
matters covered in management’s written assertion, and (b) includes a description of the
auditor’s tests of operating effectiveness of controls and the results of those tests.
This appendix is intended to assist service organizations and their auditors by describing
illustrative control objectives and controls that service organizations may have in place. When
such controls are present and operating effectively, they may enable auditors of user
organizations to assess control risk below the maximum for financial statement assertions related
to EBT transactions. The illustrative control objectives and controls in this appendix may not
necessarily reflect how a specific service organization considers and implements internal control.
Also, this appendix is not a checklist of required controls. Service organizations’ controls may be
properly designed and operating effectively even though some of the controls included in this
appendix are not present. Further, service organizations could have other controls operating
effectively that have not been included in this appendix. Service organizations and their auditors
will need to exercise professional judgment in determining the most appropriate and cost
effective controls in a given environment or circumstance.
Compliance Supplement 2022 8-VIII-1 Appendix VIII
April 2022 Examinations of EBT Service Organizations
Many of the illustrative controls are stated in relation to the kinds of policies and procedures that
are “established” or “in place” at an organization. It would be insufficient for such policies and
procedures to merely exist on paper and not be implemented. To meet the criteria of a SOC 1
type 2 examination, the policies and procedures would need to be suitably designed, placed in
operation, and operating effectively.
1. Control Environment
Illustrative Control Objective:
Controls provide reasonable assurance that the EBT system functions in a manner
consistent with the service organization’s policies and complies with applicable laws and
regulations (Food and Nutrition Act of 2008, as amended (7 USC 2011 et seq.) and
(7 CFR section 277.18(p)).
Illustrative Controls:
• The service organization has written policies and procedures for the system
processing EBT transactions.
• The organization identifies and analyzes relevant risks to the EBT process.
• Policies and procedures regarding acceptable employee practices, conflicts of
interests, and codes of conduct have been established and communicated to
employees with EBT responsibilities.
• Policies and procedures are established for performing background investigations
of employees prior to employment.
• Policies and procedures have been established to segregate incompatible functions
(e.g., application programming, systems and operation, financial duties, data
storage, government reimbursement payment requests, transaction processing, and
reconciliation) so no individual interacting with the system can exercise unilateral
control over EBT transactions.
• Policies and procedures are in place for management to monitor the effectiveness
of EBT controls and correct deficiencies or weaknesses when found.
• Policies and procedures are in place to prevent management or staff from
overriding controls.
Compliance Supplement 2022 8-VIII-2 Appendix VIII
April 2022 Examinations of EBT Service Organizations
2. Systems Development and Maintenance
Illustrative Control Objective:
Controls provide reasonable assurance that changes (including emergency procedures) to
EBT applications and system software are authorized, tested, approved, implemented,
and documented.
Illustrative Controls:
• The service organization follows a system development methodology.
• System documentation for new and existing applications is current and complete
in accordance with programming and documentation standards used by the
service organization.
• Systems development staff are not responsible for system maintenance.
3. Access Controls
Illustrative Control Objective:
Controls provide reasonable assurance that the EBT system is protected against
unauthorized physical and logical access.
Illustrative Controls:
• The responsibility for the development and enforcement of a security policy is at
an organizational level that facilitates compliance by service organization
personnel and enables enforcement of policies and procedures.
• Security policy and procedures are in place and are communicated to appropriate
employees and contractors.
• Policies and procedures are in place for reporting security incidents or observed
irregularities to an organizational level where such matters can be investigated
and resolved.
• Policies and procedures are established for the security over filing, retention, and
destruction of EBT system files.
• Policies and procedures are in place for conducting security system training.
• Policies and procedures are in place for discontinuing an employee or contractor’s
ability to access EBT hardware, software, and data when the employee is
terminated or the employee’s duties are changed.
• Access to EBT files or processes is limited based upon users’ needs.
Compliance Supplement 2022 8-VIII-3 Appendix VIII
April 2022 Examinations of EBT Service Organizations
• Passwords control access to EBT files, personal identification numbers (PIN), and
privacy data.
• A password change policy is in place and requires a password change at a
specified interval, generally at least every 90 days.
• Firewalls or other procedures prevent unauthorized access to data from an
external network.
• Policies and procedures are in place to prevent a state from reviewing or altering
data for another state.
4. Computer Operations – Processing
Illustrative Control Objective:
Controls provide reasonable assurance that processing is scheduled and deviations from
scheduling are identified and resolved.
5. Computer Operations – Data Transmission
Illustrative Control Objective:
Controls provide reasonable assurance that data transmissions are complete, accurate and
secure.
Illustrative Controls:
• Policies and procedures require that PINs and data be encrypted throughout
processing.
• Encryption keys are stored in a secure manner.
• Maintenance of encryption keys is performed by authorized service center staff.
• Policies and procedures of the service organization require proper identification,
validation, and acceptance of EBT transactions processed.
6. Computer Operations – Output
Illustrative Control Objective:
Controls provide reasonable assurance that output data and documents are complete,
accurate, and distributed to authorized recipients on a timely basis.
Compliance Supplement 2022 8-VIII-4 Appendix VIII
April 2022 Examinations of EBT Service Organizations
7. EBT Controls – Transactions Received from Authorized Sources
Illustrative Control Objective:
Controls provide reasonable assurance that transactions are received only from authorized
sources.
Illustrative Controls:
• Policies and procedures are in place to ensure that updates of point of sale (POS)
device parameters are restricted to authorized personnel.
• Policies and procedures require that POS transactions be properly validated.
• Policies and procedures for direct data entry, such as adjustments, require proper
review and approval.
• Policies and procedures are in place to approve voucher transactions.
• Policies and procedures for voucher transactions prevent unauthorized access to
recipient or retailer accounts.
8. EBT Controls – Transaction Amounts and Recording
Illustrative Control Objective:
Controls provide reasonable assurance that transactions are for authorized amounts and
are recorded completely and accurately.
Illustrative Controls:
• Records identify the activity and events in client accounts (e.g., deposits,
withdrawals, charges, and type of transactions).
• Records identify client accounts for which benefits have not been withdrawn or
used beyond pre-established periods (i.e., identify inactive accounts for which
deposits are still made).
• System edits prevent individual client accounts from being credited with benefits
in excess of authorized amounts.
9. EBT Controls – Processing
Illustrative Control Objective:
Controls provide reasonable assurance that transactions are processed completely and
accurately.
Compliance Supplement 2022 8-VIII-5 Appendix VIII
April 2022 Examinations of EBT Service Organizations
Illustrative Controls:
• Policies and procedures of the service organization include controls to:
monitor and investigate any unsuccessful file transfers,
recover or reproduce lost or damaged data,
examine edit checks for unusual conditions,
reconcile input and output of transactions processed,
log and store transactions, and
monitor rejected transactions and account adjustment actions.
10. EBT Controls – Settlement
Illustrative Control Objective:
Controls provide reasonable assurance that settlement of funds received from benefit
providers and distributed to benefits acquirers for SNAP benefit purchases and
withdrawals is performed timely and accurately.
Illustrative Controls:
• Policies and procedures are in place to perform reconciliations (at least weekly)
of:
account balances,
net settlements, and
government funds.
• Policies and procedures are established for resolution of disputed transactions.
• Policies and procedures are established for requesting federal and state
reimbursements.
11. Physical Environment
Illustrative Control Objective:
Controls exist to provide reasonable assurance that physical assets are protected.
Illustrative Controls:
• Policies and procedures are established for environmental controls (e.g.,
maintenance schedules, fire suppression equipment, water detection and
protection considerations, and the availability of an uninterruptable power system
designed to protect and ensure continued operations).
• Policies and procedures call for periodic facility inspections.
Compliance Supplement 2022 8-VIII-6 Appendix VIII
April 2022 Examinations of EBT Service Organizations
• Policies and procedures for proper maintenance of hardware have been
established.
12. Contingency Planning
Illustrative Control Objective:
Controls exist within the data center to provide reasonable assurance of continuity of
operations.
Illustrative Controls:
• Disaster recovery and business continuity plans exist for the system processing
EBT transactions.
• The business continuity plan provides for periodic testing at the backup facility
and the service organization has performed such testing.
• The service organization has a contractually protected access right to the backup
facility.
• Backup arrangements for key applications, processes, and files are in place.
13. Card Controls
Illustrative Control Objective:
Controls are established to provide reasonable assurance that users of EBT benefit cards
are authorized.
Illustrative Controls:
• Each transaction is validated with a unique account number and PIN.
• For benefit card issuance services provided by the EBT service organization
policies and procedures are in place to:
prevent unauthorized assignment and replacement of PINs;
properly deliver benefit cards to participants;
activate cards by only authorized users;
deactivate damaged, lost, or stolen cards;
record and destroy active cards returned to the service organization; and
control access to and inventory levels of pre-printed unused card stock.
Compliance Supplement 2022 8-VIII-7 Appendix VIII
April 2022 Compliance Supplement Core Team
APPENDIX IX
COMPLIANCE SUPPLEMENT CORE TEAM
The Compliance Supplement Core Team is responsible for the annual production of the Office of
Management and Budget (OMB) Compliance Supplement with the assistance of a support
contractor. The Core Team is composed of audit and program representatives from the federal
grant-making agencies, OMB, and the Census Bureau. The support contractor is CP2S.
The following is a list of team members (alphabetical by last name) responsible for the
production of this Supplement:
Dexter Brereton, Department of Education
Kimberly Butler, US Small Business Administration
Audrey Clarke, Department of Transportation
Carole Clay, Department of State
Kevin Cone, Department of Veterans Affairs
Antanese Crank, National Aeronautics and Space Administration
Laura M. H. Davis, National Endowment for the Humanities
Mark Dixon, Census Bureau, Department of Commerce
Christopher Eck, National Archives and Records Administration
Nasr Fahmy, Department of Homeland Security
Beth Flowers, Denali Commission
Cindy Galyen, Corporation for National and Community Service
John Geisen, Department of Commerce
David Gilliland, Gulf Coast Ecosystem Restoration Council
Joel Gonzalez, Department of Energy
Jeff Haley, Department of Justice
Kysha Holliday, Environmental Protection Agency
Siporah Jackson, Department of the Treasury
Nicki Jacobs, National Endowment for the Humanities
Xanthia James, Department of the Interior
Sheela Kailasanath, Federal Communications Commission
Johanna Nestor, Department of Health and Human Services
Lisa Newton, Office of National Drug Control Policy
Kate Pesin, Social Security Administration
Trae Sommer, Social Security Administration
Rochelle Ray, National Science Foundation
Mark Robinson, Department of Education
Steve Sigler, Gulf Coast Ecosystem Restoration Council
Shannon Steinbauer, Department of Housing and Urban Development
Steve Tashjian, US Agency for International Development
Latonya Torrence, Department of Labor
Gilbert Tran, Office of Management and Budget
Annie Walker-Bradley, Department of Agriculture
Sandra Webb, Institute for Museum and Library Services
Compliance Supplement 2022 8-IX-1 Appendix IX
File and source
- File
- TREAS-21.027-SLFRF-2022-Compliance-Supplement.pdf
- Size
- 22,777,545 bytes
- SHA-256
- 1730b0d5291df133bd58abcc092325e0c1e52073e86f74b1d2ef8ae478297e4f
- Original
- home.treasury.gov