Contracting for Audit Services and Due Dates

OSA-Connect Online Portal is for contracting and contacting with the Office of the State Auditor (OSA). The OSA-Connect portal was created to easily contract for yearly financial compliance audits, agreed-upon procedures (AUP), tier certification compliance and keeping contact information up to date.

Note: For online registration for the OSA-Connect portal please contact by e-mail at Jason Chavez or Ralen Randel  or at 505-476-3800.

We also have a OSA-Connect step by step instructional video available at:
Instructional OSA-Connect step by step video

OSA Connect Instructions (Printable Instructions)

CONTRACT DUE DATES AT-A GLANCE:

(a) Regional education cooperatives, cooperative educational services, independent housing authorities, hospitals and special hospital districts: April 15;

(b) school districts, counties, and higher education: May 1;

(c) incorporated counties (of which Los Alamos is the only one), local workforce investment boards and local public bodies that do not qualify for the tiered system: May 15;

(d) councils of governments, district courts, district attorneys, state agencies and the state of New Mexico CAFR: June 1;

(e) local public bodies that qualify for the tiered system pursuant to Subsections A and B of Section 2.2.2.16 NMAC with a June 30 fiscal year end: July 30;

(f) local public bodies that qualify for the tiered system pursuant to Subsections A and B of 2.2.2.16 NMAC with a fiscal year end other than June 30 shall use a due date 30 days after the end of the fiscal year;

(g) agencies with a fiscal year end other than June 30 shall use a due date 30 days before the end of the fiscal year;

(h) component units that are being separately audited: on the primary government’s due date;

Audit Rule Citations:

Audit Rule Link

2.2.2.8 THE PROCUREMENT AND AUDIT PROCESS:

  1. Procedures to obtain professional services from an IPA: Concurrent with publication of the list of approved firms, the OSA shall authorize agencies to select an IPA to perform their audit or AUP engagement. Agencies are prohibited from beginning the process of procuring IPA services until they receive the OSA authorization. Agencies that wish to begin the IPA procurement process prior to receiving OSA authorization may request an exception, however any such exceptions granted by OSA are subject to changes in the final audit rule applicable to the audit and changes in restrictions to, or disqualifications of, IPAs. The notification shall inform the agency that it shall consult its prospective IPA to determine whether the prospective IPA has been restricted by the OSA as to the type of engagement or number of contracts it is eligible to perform. Agencies that may be eligible for the tiered system shall complete the evaluation described in Subsection B of Section 2.2.2.16 NMAC. Agencies that receive and expend federal awards shall follow the uniform guidance procurement requirements from 2 CFR 200.317 to 200.326 and 200.509, and shall also incorporate applicable guidance from the following requirements. Agencies shall comply with the following procedures to obtain professional services from an IPA for an audit or AUP engagement.

(1) Upon receipt of written authorization from the OSA to proceed, and at no time before then unless OSA has granted an exception, the agency shall identify all elements or services to be solicited pursuant to this rule and conduct a procurement that includes each applicable element of the annual financial and compliance audit, special audit, attestation engagement, performance audit, forensic audit or AUP engagement.

(2) Quotations or proposals for annual financial audits shall contain each of the following elements: 2.2.2 NMAC

(a) financial statement audit;

(b) federal single audit (if applicable);

(c) financial statement preparation so long as the IPA has considered any threat to independence and mitigated it;

(d) other non-audit services (if applicable and allowed by current government auditing standards); and

(e) other (i.e., audits of component units such as housing authorities, charter schools, foundations and other types of component units).

(3) The agency is encouraged to request multiple year proposals for audit and AUP services (not to exceed three years), however the term of the contract shall be for one year only. The parties shall enter a new audit contract each year. The agency is responsible for procuring IPA services in accordance with all applicable laws and regulations which may include, but are not limited to, the State Procurement Code (Chapter 13, Article 1 NMSA 1978) or equivalent home rule procurement provisions; GSD Rule, Section 1.4.1 NMAC, Procurement Code Regulations, if applicable; DFA Rule, Section 2.40.2 NMAC, Governing the Approval of Contracts for the Purchase of Professional Services; Uniform Guidance; and Section 13-1-191.1 NMSA 1978 relating to campaign contribution disclosure forms. In the event that either of the parties to the contract elects not to contract for all of the years contemplated by a multiple year proposal, or the state auditor disapproves the contract, the agency shall use the procedures described above to procure services from a different IPA.

(4) If the agency is a component of a primary government, the agency’s procurement for audit services shall include the AU-C 600 (group audits) requirements for the IPA to communicate and cooperate with the group engagement partner and team, and the primary government. This requirement applies to agencies and universities that are part of the statewide CAFR, other component units of the statewide CAFR and other component units of any primary government that use a different audit firm from the primary government’s audit firm. Costs for the IPA to cooperate with the group engagement partner and team, and the primary government, caused by the requirements of AU-C 600 (group audit) may not be charged in addition to the cost of the engagement, as the OSA views this in the same manner as compliance with any other applicable standard.

(5) Agencies are encouraged to include representatives of the offices of separately elected officials such as county treasurers, and component units such as charter schools and housing authorities, in the IPA selection process. As part of their evaluation process, the OSA recommends that agencies consider the following when selecting an IPA:

(a) responsiveness to the request for proposal (the firm’s integrity, record of past performance, financial and technical resources);

(b) relevant experience, availability of staff with professional qualifications and technical abilities;

(c) results of the firm’s peer and external quality control reviews; and

(d) weighting the price criteria less than fifteen percent of the total criteria taken into consideration by the evaluation process or selection committee.

Upon the OSA’s request, the agency shall make accessible to the OSA all of the IPA procurement and selection documentation.

(6) After selecting an IPA, each agency shall enter the appropriate requested information online on the OSA-connect website (www.osa-app.org). In order to do this, the agency shall register on OSA-Connect and obtain a user-specified password. The agency’s user shall then use OSA-Connect to enter information necessary for the contract and for the OSA’s evaluation of the IPA selection. After the agency enters the information, the OSA-Connect system generates a draft contract containing the information entered. The agency shall submit to the OSA for approval a copy of the unsigned draft contract by following the instructions on OSA-Connect. Note that the IPA recommendation form no longer exists as a separate document, because OSA-Connect gathers and delivers to the OSA the information historically submitted on the IPA recommendation form.

(7) The OSA shall notify the agency as to the OSA’s approval or rejection of the selected IPA and contract. The OSA’s review of audit contracts does not include evaluation of compliance with any state or local procurement laws or regulations; each agency is responsible for its own compliance with applicable procurement laws, regulations or policies. After the agency receives notification of approval of the selected IPA and contract from the OSA, the agency is responsible for getting the contract signed and sent to any oversight agencies, including DFA, for approval (if applicable). The OSA shall not physically sign the contract. After the agency obtains all the required signature and approvals of the contract, the agency shall submit an electronic portable document format (PDF) copy of the final signed contract to the OSA by electronic mail to: reports@osa.state.nm.us.

(8) The agency shall deliver the unsigned contract generated by OSA-Connect to the OSA by the due date shown below. In the event that the due date falls on a weekend or holiday, the due date shall be the next business day. If the unsigned contract is not submitted to the state auditor by these due dates, the IPA may, according to professional judgment, include a finding of non-compliance with Subsection F of Section 2.2.2.8 NMAC in the audit report or AUP report.

(a) Regional education cooperatives, cooperative educational services, independent housing authorities, hospitals and special hospital districts: April 15;

(b) school districts, counties, and higher education: May 1;

(c) incorporated counties (of which Los Alamos is the only one), local workforce investment boards and local public bodies that do not qualify for the tiered system: May 15;

(d) councils of governments, district courts, district attorneys, state agencies and the state of New Mexico CAFR: June 1;

(e) local public bodies that qualify for the tiered system pursuant to Subsections A and B of Section 2.2.2.16 NMAC with a June 30 fiscal year end: July 30;

(f) local public bodies that qualify for the tiered system pursuant to Subsections A and B of 2.2.2.16 NMAC with a fiscal year end other than June 30 shall use a due date 30 days after the end of the fiscal year;

(g) agencies with a fiscal year end other than June 30 shall use a due date 30 days before the end of the fiscal year;

(h) component units that are being separately audited: on the primary government’s due date;

(i) Charter schools that are chartered by the PED and agencies that are subject to oversight by the HED have the additional requirement of submitting their audit contract to PED or HED for approval (Section 12-6-14 NMSA 1978); and

(j) In the event the agency’s unsigned contract is submitted to the OSA, but is not approved by the state auditor, the state auditor shall promptly communicate the decision, including the reason(s) for disapproval, to the agency, at which time the agency shall promptly submit a contract with a different IPA using OSA-Connect. This process shall continue until the state auditor approves an unsigned contract. During this process, whenever an unsigned contract is not approved by the state auditor, the agency may submit a written request to the state auditor for reconsideration of the disapproval. The agency shall submit its request no later than 15 calendar days after the date of the disapproval and shall include documentation in support of its IPA selection. If warranted, after review of the request, the state auditor may hold an informal meeting to discuss the request. The state auditor shall set the meeting in a timely manner with consideration given to the agency’s circumstances.

(9) The agency shall retain all procurement documentation, including completed evaluation forms, for five years and in accordance with applicable public records laws.

(10) If the agency fails to submit an unsigned contract by the due date set forth in this rule, or, if no due date is applicable, within 60 days of notification from the state auditor to engage an IPA, the state auditor may conduct the audit or select the IPA for that agency. The reasonable costs of such an audit shall be borne by the agency audited unless otherwise exempted pursuant to Section 12-6-4 NMSA 1978.

(11) In selecting an IPA for an agency pursuant to Subsection F of Section 2.2.2.8 NMAC the state auditor shall at a minimum consider the following factors, but may consider other factors in the state auditor’s discretion that serve the best interest of the state of New Mexico and the agency:

(a) the IPA shall be drawn from the list of approved IPAs maintained by the state auditor;

(b) an IPA subject to restriction pursuant to Subsection D of Section 2.2.2.8 NMAC, is ineligible to be selected under this paragraph;

(c) whether the IPA has conducted one or more audits of similar government agencies;

(d) the physical proximity of the IPA to the government agency to be audited;

(e) whether the resources and expertise of the IPA are consistent with the audit requirements of the government agency to be audited;

(f) the IPA’s cost profile, including examination of the IPA’s fee schedule and blended rates;

(g) the state auditor shall not select an IPA in which a conflict of interest exists with the agency or that may be otherwise impaired, or that is not in the best interest of the state of New Mexico.

(12) The state auditor shall consider, at a minimum, the following factors when considering which agencies shall be subject to the state auditor’s selection of an IPA:

(a) whether agency is demonstrating progress in its own efforts to select an IPA;

(b) whether the agency has funds to pay for the audit;

(c) whether the agency is on the state auditor’s “at risk” list;

(d) whether the agency is complying with the requirements imposed on it by virtue of being on the state auditor’s “at risk” list;

(e) whether the agency has failed to timely submit its e-mailed draft unsigned contract copy in accordance with the audit rule on one or more occasions;

(f) whether the agency has failed to timely submit its annual financial audit report in accordance with the audit rule due dates on one or more occasions.

(13) The state auditor may appoint a committee of the state auditor’s staff to make recommendations for the state auditor’s final determination as to which IPAs shall be selected for each government agency subject to the discretion of the state auditor.

(14) Upon selection of an IPA to audit a government agency subject to the discretion of the state auditor, the state auditor shall notify the agency in writing regarding the selection of an IPA to conduct its audit. The notification letter shall include, at a minimum, the following statements:

(a) the agency was notified by the state auditor to select an IPA to perform its audit or AUP engagement;

(b) 60 days or more have passed since such notification, or the applicable due date in this rule has passed, and the agency failed to deliver its draft contract in accordance with this subsection;

(c) pursuant to Subsection A of Section 12-6-14 NMSA 1978, the state auditor is selecting the IPA for the agency;

(d) delay in completion of the agency’s audit is contrary to the best interest of the state and the agency, and threatens the functioning of government and the preservation or protection of property;

(e) in accordance with Section 12-6-4 NMSA 1978, the reasonable costs of such an audit shall be borne by the agency unless otherwise exempted; and

(f) selection of the IPA is final, and the agency shall immediately take appropriate measures to procure the services of the selected IPA.

  1. State auditor approval/disapproval of unsigned contract: The state auditor shall use discretion and may not approve:

(1) An unsigned audit contract, special audit contract, attestation engagement contract, performance audit contract, forensic audit contract or AUP professional services contract under Section 2.2.2.16 NMAC that does not serve the best interests of the public or the agency or local public body because of one or more of the following reasons:

(a) lack of experience of the IPA;

(b) failure to meet the auditor rotation requirements as follows:

(i) the IPA is prohibited from conducting the agency audit or AUP engagement for a period of two years because the IPA already conducted those services for that agency for a period of six consecutive years;

(ii) if firm A purchases the stock or assets of firm B, or if firm B merges into firm A with firm A being the surviving firm, firm A shall not be affected for purposes of the auditor rotation requirement; the auditor rotation clock shall continue to run without interruption for firm B’s audit contracts, despite the fact that such audit contracts may be issued by firm A after the purchase or merger. Because of the impact of firm purchases and mergers on IPA independence the OSA may evaluate historical mergers when applying this section;

(c) lack of competence or staff availability;

(d) circumstances that may cause untimely delivery of the audit report or AUP report;

(e) unreasonably high or low cost to the agency or local public body;

(f) terms in the proposed contract that the state auditor considers to be unfavorable, unfair, unreasonable, or unnecessary;

(g) lack of compliance with the procurement code, the audit act, or this rule;

(h) the agency giving too much consideration to the price of the IPA’s response to the request for bids or request for proposals in relation to other evaluation criteria;

(i) newness of the IPA to the state auditor’s list of approved firm;

(j) noncompliance with the requirements of Section 12-6-3 NMSA 1978 the audit act by the agency for previous fiscal years; or

(k) any other reason determined by the state auditor to be in the best interest of the state of New Mexico.

(2) An audit contract, special audit contract, attestation engagement contract, performance audit contract, or forensic audit contract or AUP contract of an IPA that has:

(a) breached a prior-year contract;

(b) failed to deliver an audit or AUP report on time;

(c) failed to comply with state laws or regulations of the state auditor;

(d) performed non-audit services (including services related to fraud) for an agency or local public body it is performing an audit, special audit, attestation engagement, performance audit, forensic audit or an AUP for, without prior approval of the state auditor;

(e) performed non-audit services under a separate contract for services that may be disallowed by GAGAS independence standards;

(f) failed to respond, in a timely and acceptable manner, to an OSA audit, special audit contract, attestation engagement contract, performance audit contract, forensic audit contract, AUP report review or working paper review;

(g) impaired independence during an engagement;

(h) failed to cooperate in providing prior-year working papers to successor IPAs;

(i) not adhered to external quality control review standards as defined by GAGAS and Section 2.2.2.14 NMAC;

(j) has a history of excessive errors or omissions in audit or AUP reports or working papers;

(k) released the audit report or AUP report to the agency, local public body or the public before the audit release letter or the OSA letter releasing the AUP report was received from the OSA;

(l) failed to submit a completed signed contingency subcontractor form, if required;

(m) failed to submit a completed firm profile as required by Subsection A of Section 2.2.2.8 NMAC or failed to include all staff in the firm profile who would be working on the firm’s engagements;

(n) reached the limit of contracts to which the state auditor restricted the IPA;

(o) failed to respond to communications from the OSA or engagement clients within a reasonable amount of time; or

(p) otherwise, in the opinion of the state auditor, the IPA was unfit to be awarded a contract.

(3) An audit, special audit contract, attestation engagement contract, performance audit contract, forensic audit contract or AUP contract for an IPA received by the OSA, which the state auditor decides to perform himself with or without the assistance of an IPA, and pursuant to Section 12-6-3 NMSA 1978, even if the agency or local public body was previously designated for audit or AUP to be performed by an IPA.

  1. Audit contract requirements: The agency shall use the appropriate audit or AUP engagement contract form provided by the OSA through the OSA-connect website at www.osa-app.org. The OSA may provide audit or agreed-upon procedures engagement contract forms to the agency via facsimile or U.S. mail if specifically requested by the agency. Only contract forms provided by the state auditor shall be accepted and shall:

(1) be completed and submitted in its unsigned form by the due date indicated at Subsection F of Section 2.2.2.8 NMAC;

(2) for all agencies whose contracts are approved through the DFA’s contracts review bureau, have the IPA’s combined reporting system (CRS) number verified by the taxation and revenue department (TRD) after approval by the state auditor; and

(3) in the compensation section of the contract, include the dollar amount that applies to each element of the contracted procedures that shall be performed;

(4) if the agency requires the IPA to provide additional services outside the scope of work described in the audit or AUP contract form provided through the OSA-connect website, the additional services shall be described in detail in the “other provisions section” of the contract; if the additional services required by the “other provisions” section of the contract cause a significant change in the scope of the audit, then the contract amendment provisions of Subsection N of Section 2.2.2.8 NMAC shall apply.