How Auditors Get it Wrong on Risk Assessments for Monitoring

There’s an old saying that To a Hammer, Everything Looks Like a Nail. To an auditor,
​everything can look like an audit—even when it’s not an audit, but a subrecipient monitoring review.

​​​Although there is overlap, auditing and subrecipient monitoring are distinctly different professions governed by different rules. When it comes to risk assessments, this is especially important. That’s because Single Audits—required of agencies accepting federal funds—and other audits routinely find that pass-through entities “violate” risk assessment procedures in determining what organizations to monitor. This results in the dreaded audit finding.

​​For example, one state’s Single Audit found that the pass-through entity improperly determined that subrecipients were low risk despite negative publicity and significant leadership turnover. Auditors disagreed with the pass-through entity that only subrecipients who distribute grants are high risk.

Read More