Audit Report Due Dates At-A Glance

REPORT DUE DATES AT-A GLANCE:

Regional education cooperatives, cooperative educational services and independent housing authorities: September 30;

Hospitals and special hospital districts: October 15;

Higher education, state agencies not specifically named elsewhere in this Subsection , district courts, district attorneys, the New Mexico finance authority, the New Mexico lottery authority, and other agencies with June 30 fiscal year-ends that are reported as component units in the state of New Mexico comprehensive annual financial report: November 1;

School districts and the state of New Mexico component appropriation funds (state general fund): November 15;

PED, the state investment council, and the three post-employment benefit agencies (PERA, ERB and the retiree health care authority): the Wednesday before Thanksgiving day;

Counties, incorporated counties (of which Los Alamos is the only one), workforce investment boards, councils of governments, and the New Mexico mortgage finance authority: December 1;

Local public bodies including municipalities: December 15;

The State of New Mexico comprehensive annual financial report (CAFR): December 31;

ERB, PERA and retiree health care authority schedules of employer allocations reports and related employer guides required by Subsections Z and DD of Section 2.2.2.10 NMAC: June 15;

Agencies with a fiscal year-end other than June 30 shall submit the audit report no later than five months after the fiscal year-end;

Regarding component unit reports (e.g., housing authorities, charter schools, hospitals, foundations, etc.), all separate audit reports prepared by an auditor that is different from the primary government’s auditor, are due fifteen days before the primary government’s audit report is due, unless some other applicable due date requires the report to be submitted earlier;

Any agency that requires its report to be released by December 31st for any reason (bonding, GFOA, etc.): the earlier of its agency due date or December 1; and

Late audit or AUP reports of any agency (not performed in the current reporting period): not more than six months after the date the contract was executed.

AUDIT RULE CITATIONS

Audit Rule Direct Link

2.2.2.9 REPORT DUE DATES:

  1. Report due dates: The IPA shall deliver the organized and bound annual financial audit report to the state auditor by 5:00 p.m. on the date specified in the audit contract or send it postmarked by the due date. IPAs and agencies are encouraged to perform interim work as necessary and appropriate to meet the following due dates.

(1) The audit report due dates are as follows:

(a) regional education cooperatives, cooperative educational services and independent housing authorities: September 30;

(b) hospitals and special hospital districts: October 15;

(c) higher education, state agencies not specifically named elsewhere in this Subsection , district courts, district attorneys, the New Mexico finance authority, the New Mexico lottery authority, and other agencies with June 30 fiscal year-ends that are reported as component units in the state of New Mexico comprehensive annual financial report: November 1;

(d) school districts and the state of New Mexico component appropriation funds (state general fund): November 15;

(e) the PED, the state investment council, and the three post-employment benefit agencies (PERA, ERB and the retiree health care authority): the Wednesday before Thanksgiving day;

(f) counties, incorporated counties (of which Los Alamos is the only one), workforce investment boards, councils of governments, and the New Mexico mortgage finance authority: December 1;

(g) local public bodies including municipalities: December 15;

(h) the state of New Mexico comprehensive annual financial report (CAFR): December 31;

(i) the ERB, PERA and retiree health care authority schedules of employer allocations reports and related employer guides required by Subsections Z and DD of Section 2.2.2.10 NMAC: June 15;

(j) agencies with a fiscal year-end other than June 30 shall submit the audit report no later than five months after the fiscal year-end;

(k) regarding component unit reports (e.g., housing authorities, charter schools, hospitals, foundations, etc.), all separate audit reports prepared by an auditor that is different from the primary government’s auditor, are due fifteen days before the primary government’s audit report is due, unless some other applicable due date requires the report to be submitted earlier;

(l) any agency that requires its report to be released by December 31st for any reason (bonding, GFOA, etc.): the earlier of its agency due date or December 1; and

(m) late audit or AUP reports of any agency (not performed in the current reporting period): not more than six months after the date the contract was executed.

(2) If an audit report is not delivered on time to the state auditor, the auditor shall include this instance of non-compliance with Subsection A of Section 2.2.2.9 NMAC as an audit finding in the audit report. This requirement is not negotiable. If appropriate, the finding may also be reported as a significant deficiency or material weakness in the operation the agency’s internal controls over financial reporting pursuant to AU-C 265.

(3) An organized bound hard copy of the report shall be submitted for review by the OSA with the following: copy of the signed management representation letter and a copy of the completed state auditor report review guide (available at www.saonm.org). A report shall not be considered submitted to the OSA for the purpose of meeting the due date until a copy of the signed management representation letter and the completed report review guide are also submitted to the OSA. All separate reports prepared for component units shall also be submitted to the OSA for review, along with a copy of the management representation letter, and a completed report review guide for each separate audit report. A separate component unit report shall not be considered submitted to the OSA for the purpose of meeting the due date until a copy of the signed management representation letter and the completed report review guide are also submitted to the OSA. If a due date falls on a weekend or holiday, or if the OSA is closed due to inclement weather, the audit report is due the following business day by 5:00 p.m. If the report is mailed to the state auditor, it shall be postmarked no later than the due date to be considered filed by the due date. If the due date falls on a weekend or holiday the audit report shall be postmarked by the following business day.

(4) AU-C 700.41 requires the auditor’s report to be dated after audit evidence supporting the opinion has been obtained and reviewed, the financial statements have been prepared and the management representation letter has been signed. AU-C 580.20 requires the management representation letter to be dated the same date as the independent auditor’s report.

(5) As soon as the auditor becomes aware that circumstances exist that will make an agency’s audit report be submitted after the applicable due date provided in Subsection A of Section 2.2.2.9 NMAC, the auditor shall notify the state auditor in writing. This notification shall consist of a letter, not an email. However, a scanned version of the official letter sent via email is acceptable. A copy of the letter shall be sent to the legislative finance committee and any applicable oversight agency: PED, FCD, LGD, or HED. There shall be a separate notification for each late audit report. The notification shall include a specific explanation regarding why the report will be late, when the IPA expects to submit the report and a concurring signature by a duly authorized representative of the agency. If the IPA is going to miss the expected report submission date, then the IPA shall send a revised notification letter. In the event the contract was signed after the report due date, the notification letter shall still be submitted to the OSA explaining the reason the audit report will be submitted after the report due date. The late report notification letter is not required if the report was submitted to the OSA for review by the due date, and then rejected by the OSA, making the report late when resubmitted. Reports resubmitted to the OSA with changes of the IPA’s opinion after the report due date shall be considered late and a late audit finding shall be included in the audit report.

  1. Delivery and release of the audit report:

(1) All audit reports (and all separate reports of component units, if applicable) shall be organized, bound and paginated. The OSA does not accept facsimile or e-mailed versions of the audit reports for initial review. The IPA shall deliver to the state auditor a hard copy of the audit report for review by 5:00 p.m. on the day the report is due. Reports postmarked by the due date shall be considered received by the due date. Unfinished or excessively deficient reports shall not satisfy this requirement; such reports shall be rejected and returned to the IPA and the OSA may take action in accordance with Subsection C of Section 2.2.2.13 NMAC. When the OSA rejects and returns a substandard audit report to the IPA, the OSA shall consider the audit report late if the corrected report is not resubmitted by the due date. The IPA shall also report a finding for the late audit report in the audit report. The firm shall submit an electronic version of the corrected rejected report for OSA review. The name of the electronic file shall be “corrected rejected report” followed by the agency name and fiscal year.

(2) Before initial submission, the IPA shall review the report using the appropriate report review guide available on the OSA’s website. The report review guide shall reference applicable page numbers in the audit report. The audit manager or person responsible for the IPA’s quality control system shall either complete the report review guide or sign off as having reviewed it. All questions in the guide shall be answered, and the reviewer shall sign and date the last page of the guide. If the review guide is not accurately completed or incomplete, the report shall not be accepted.

(3) IPAs are encouraged to deliver completed audit reports before the due date. The OSA shall review all audit reports submitted by the report due date before reviewing reports that are submitted after the report due date. Once the review of the report is completed pursuant to Subsection A of Section 2.2.2.13 NMAC, and any OSA comments have been addressed by the IPA, the OSA shall indicate to the IPA that the report is ready to print. After the OSA issues the “ok to print” communication for the audit report, the OSA shall authorize the IPA to submit the corrected report with the following items to the OSA within five business days; an electronic searchable version of the audit report labeled “final”, in PDF format, an electronic excel version of the summary of findings report, an electronic excel version of the indigent care schedules for hospitals, if applicable, and an electronic excel version of the schedule of asset management costs for investing agencies, if applicable (all available at www.saonm.org). The OSA shall not release the report until the searchable electronic PDF version of the report and all required electronic excel schedules are received by the OSA. The electronic file containing the final audit report shall:

(a) be created and saved as a PDF document in a single PDF file format (simply naming the file using a PDF extension .pdf does not by itself create a PDF file);

(b) be version 5.0 or newer;

(c) not exceed 10 megabytes (MB) per file submitted (contact the OSA to request an exception if necessary);

(d) have all security settings like self-sign security, user passwords, or permissions removed or deactivated so the OSA is not prevented from opening, viewing, or printing the file;

(e) not contain any embedded scripts or executables, including sound or movie (multimedia) objects;

(f) have a file name that ends with .pdf;

(g) be free of worms, viruses or other malicious content (a file with such content shall be deleted by the OSA);

(h) be “flattened” into a single layer file prior to submission;

(i) not contain any active hypertext links, or any internal/external links (although it is permissible for the file to textually reference a URL as a disabled link);

(j) be saved at 300 dots per inch (DPI) (lower DPI makes the file hard to read and higher DPI makes the file too large);

(k) have a name that starts with “final version,” followed by the name of the agency and the fiscal year; and

(l) be searchable.

(4) The IPA shall deliver to the agency the number of copies of the audit report indicated in the audit contract only after the state auditor has officially released the audit report with a “release letter”. Release of the audit report to the agency or the public prior to it being officially released by the state auditor shall result in an audit finding. The agency or the IPA shall ensure that every member of the agency’s governing authority receives a copy of the audit report.

(5) After the release of a report, the OSA shall provide DFA and the legislative finance committee with notification that the report is available on the OSA website.

(6) If an audit report is reissued pursuant to AU-C 560, subsequent events and subsequently discovered facts, or AAG GAS 13.29-.30 for uniform guidance compliance reports, the reissued audit report shall be submitted to the OSA with a cover letter addressed to the state auditor. The cover letter shall explain that:

(a) the attached report is a “reissued” report;

(b) the circumstances that caused the reissuance; and

(c) a summary of the changes that appear in the reissued report. The OSA shall subject the reissued report to the report review process and upon completion of that report review process, shall issue a “release letter.” The contents of the reissued audit report are subject to the confidentiality requirements described in Subsection M of Section 2.2.2.10 NMAC. Agency management and the IPA are responsible for ensuring that the latest version of the report is provided to each recipient of the prior version of the report. The OSA shall notify the appropriate oversight agencies regarding the updated report on the OSA website.

(7) If changes to a released audit report are submitted to the OSA, and the changes do not rise to the level of requiring a reissued report, the IPA shall submit a cover letter addressed to the agency, with a copy to the state auditor, which includes the following minimum elements:

(a) a statement that the changes did not rise to the level of requiring a reissued report;

(b) a description of the circumstances that caused the resubmitted updated report; and

(c) a summary of the changes that appear in the resubmitted updated report compared to the prior released report. Agency management and the IPA are responsible for ensuring that the latest version of the resubmitted report is provided to each recipient of the prior version of the report. The OSA shall notify the appropriate oversight agencies regarding the updated report on the OSA website.

  1. Required status reports: For an agency that has failed to submit audit or agreed-upon procedures reports as required by this rule, and has therefore been designated as “at risk” due to late reports, the state auditor requires the agency to submit written status reports to the OSA on each March 15, June 15, September 15, and December 15 that the agency is not in compliance with this rule. Status reports are not required for agencies that are included on the “at risk” list solely due to an adverse or disclaimed independent auditor’s opinion. The status report shall be signed by a member of the agency’s governing authority, a designee of the governing authority or a member of the agency’s top management. If the agency has a contract with an IPA to conduct the audit or perform the AUP engagement, the agency must send the IPA a copy of the quarterly status report. IPAs engaged to audit or perform AUP engagements for agencies with late reports are responsible for assisting these agencies in complying with the reporting requirements of this section. Failure to do so shall be noted by the OSA and taken in to account during the IPA Firm Profile evaluation process. At a minimum, the quarterly written status report shall include:

(1) a detailed explanation of the agency’s efforts to complete and submit its audit or agreed-upon procedures;

(2) the current status of any ongoing audit or agreed-upon procedures work;

(3) any obstacles encountered by the agency in completing its audit or agreed-upon procedures; and

(4) a projected completion date for the financial audit or agreed-upon procedures report.

[2.2.2.9 NMAC – Rp, 2 2.2.9 NMAC, 2/27/2018; A, 3/12/2019; A, 5/28/2019]