N.M. Admin. Code § 2.2.2.15

Current through Register Vol. 35, No. 23, December 10, 2024

Section 2.2.2.15 - SPECIAL AUDITS AND EXAMINATIONS

A.Fraud, waste or abuse in government reported by agencies, IPAs or members of the public:

(1) Reports of fraud, waste & abuse: Pursuant to the authority set forth Subsection C of Section 12-6-3 NMSA 1978, the OSA may initiate special investigation or examination procedures in connection with reports of financial fraud, waste and abuse in government. Reports received or created by the OSA are confidential audit information and audit documentation in connection with the state auditor's statutory duty to examine and audit the financial affairs of every agency, or in connection with the state auditor's statutory discretion to audit the financial affairs and transactions of an agency in whole or in part.

(2) Confidentiality of sources: The identity of a person making a report to the OSA alleging financial fraud, waste, or abuse in government is confidential audit information and may not be disclosed, except as required by Section 12-6-6 NMSA 1978.

(3) Confidentiality of files: A report alleging financial fraud, waste, or abuse in government that is made to the OSA and any resulting special audit, performance audit, attestation engagement or forensic accounting or other non-attest engagement files are confidential audit documentation and may not be disclosed by the OSA or the agency, except to an independent auditor, performance audit team or forensic accounting team in connection with a special audit, performance audit, attestation engagement, forensic accounting engagement, non-attest engagement, or other existing or potential engagement regarding the financial affairs or transactions of an agency.

(a) Any records that result in, or are part of, any subsequent or resulting special audit, performance audit, attestation engagement or forensic accounting or other non-attest engagement will be audit workpapers and therefore confidential. Records that result from, or are part of OSA, special investigations that do not result in a subsequent special audit, performance audit, attestation engagement or forensic accounting or other non-attest engagement may be disclosed, with personal identifier information redacted, once the examination or investigation is closed.

(b) Any information related to a report alleging financial fraud, waste, or abuse in government provided to an independent auditor, performance audit team or forensic accounting team, is considered to be confidential audit or engagement documentation and is subject to confidentiality requirements, including but not limited to requirements under Subsections E and M of 2.2.2.10 NMAC, the Public Accountancy Act, and the AICPA Code of Professional Conduct.

(4) If the OSA makes inquiries of agencies as part of the investigation process, agencies shall respond to the OSA inquiries within 15 calendar days of receipt or as soon as practicable under the circumstances with written notice to the OSA stating the basis for any delay. IPAs shall test compliance with this requirement and report noncompliance as a finding in the annual financial and compliance audit report.

B.Special audit or examination process:

(1) Designation: Pursuant to Section 12-6-3 NMSA 1978, in addition to the annual audit, the state auditor may cause the financial affairs and transactions of an agency to be audited in whole or in part. Accordingly, the state auditor may designate an agency for special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement regarding the financial affairs and transactions of an agency or local public body based on information or a report received from an agency, IPA or member of the public. For purposes of this rule "special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement" includes, without limitation, AUP, consulting, and contract close-out (results-based award) engagements that address financial fraud, waste, or abuse in government. It also includes non-attest engagements performed under the forensic services standards issued by the AICPA and engagements performed following the Code of Professional Standards issued by the Association of Certified Fraud Examiners (ACFE). The state auditor shall inform the agency of the designation by sending the agency a notification letter. The state auditor may specify the subject matter, the scope and any procedures required, the AICPA or other professional standards that apply, and for a performance audit, performance aspects to be included and the potential findings and reporting elements that the auditors expect to develop. Pursuant to Section 200.503 of Uniform Guidance, if a single audit was previously performed, the special audit, attestation engagement, performance audit or forensic accounting engagement shall be planned and performed in such a way as to build upon work performed, including the audit documentation, sampling, and testing already performed by other auditors. The attestation and performance audit engagements may be conducted pursuant to government auditing standards if so specified by the OSA.

(2) Costs: All reasonable costs of special audits, attestation engagements, forensic accounting engagements, non-attest engagements, or single-entity performance audits conducted pursuant to this Section shall be borne by the agency audited pursuant to Section 12-6-4 NMSA 1978. The state auditor, in its sole discretion, may apportion among the Agencies audited some or all of the reasonable costs of a multi-entity performance audit.

(3) Who performs the engagement: The state auditor may perform the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement alone or with other professionals selected by the state auditor. Alternatively, the state auditor may require the engagement to be performed by an IPA or a team that may be comprised of any of the following: independent public accountants; individuals with masters degrees or doctorates in a relevant field such as business, public administration, public policy, finance, or economics; individuals with their juris doctorate; CFE-certified fraud examiners; CFF-certified forensic auditors; CIA-certified internal auditors; or other specialists. If the state auditor designates an agency for an engagement to be conducted by an IPA or professional team, the agency shall:

(a) upon receipt of notification to proceed from the state auditor, identify all elements or services to be solicited, obtain the state auditor's written approval of the proposed scope of work, and request quotations or proposals for each applicable element of the engagement;

(b) follow all applicable procurement requirements which may include, but are not limited to, Uniform Guidance, Procurement Code (Sections 13-1-28 through 13-1-199 NMSA 1978), or equivalent home rule procurement provisions when selecting an IPA or team to perform the engagement;

(c) submit the following information to the state auditor by the due date specified by the state auditor:

(i) a completed template for special audits, attestation engagements, performance audits or forensic accounting engagements, provided at www.osanm.org, which the agency shall print on agency letterhead; and

(ii) a completed contract form including the contract fee, start and completion date, and the specific scope of services to be performed in the format prescribed by the OSA, provided at www.osanm.org, with all required signatures on the contract.

(d) If the agency fails to select an IPA and submit the signed contract to OSA by the due date specified by the state auditor, or, if none within 60 days of notification of designation from the state auditor, the state auditor may conduct the engagement or select the IPA for that agency in accordance with the process described at Subsection F of 2.2.2.8 NMAC.

(4) Errors: Contracts that are submitted to the OSA with errors or omissions shall be rejected by the state auditor. The state auditor shall return the rejected contract to the agency indicating the reason(s) for the rejection.

(5) Recommendation rejections: In the event the agency's recommendation is not approved by the state auditor, the state auditor shall promptly communicate the decision, including the reason(s) for rejection, to the agency, at which time the agency shall promptly submit a different recommendation. This process shall continue until the state auditor approves a recommendation and related contract. During this process, whenever a recommendation and related contract are not approved, the agency may submit a written request to the state auditor for reconsideration of the disapproval. The agency shall submit its request no later than 15 calendar days from the date of the disapproval and shall include documentation in support of its recommendation. If warranted, after review of the request, the state auditor may hold an informal meeting to discuss the request. The state auditor shall set the meeting in a timely manner with consideration given to the agency's circumstances.

(6) Contract amendments: Any proposed contract amendments shall be processed in accordance with Subsection N of 2.2.2.8 NMAC.

(7) Access to records and documents: For any special audit, attestation engagement, performance audit or forensic accounting engagement, or non-attest engagement, the state auditor and any engaged professionals shall have available to them all documents necessary to conduct the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement. Furthermore, pursuant to Section 12-6-11 NMSA 1978, when necessary for a special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement the state auditor may apply to the district court of Santa Fe County for issuance of a subpoena to compel the attendance of witnesses and the production of books and records.

(8) Entrance, progress and exit conferences: The IPA or other professional shall hold an entrance conference and an exit conference with the agency, unless the IPA or other professional has submitted a written request to the state auditor for an exemption from this requirement and has obtained written approval of the exemption. The OSA has the authority to notify the agency or IPA or other professional that the state auditor shall be informed of the date of the entrance conference, any progress meetings and the exit conference. If such notification is received, the IPA or other professional and the agency shall invite the state auditor or the auditor's designee to attend all such conferences no later than 72 hours before the proposed conference or meeting. The state auditor may also require the IPA or other professional to submit its audit plan to the state auditor for review and approval. The date of the exit conference(s) and the names and titles of personnel attending shall be stated on the last page of the special audit report.

(9) Required reporting: All reports for special audits, attestation engagements, performance audits, forensic accounting engagements, or non-attest engagements related to financial fraud, waste or abuse in government undertaken pursuant to 2.2.2.15 NMAC (regardless of whether they are conducted pursuant to AICPA standards for consulting services, forensic services or for attestation engagements, non-attest engagements, or other professional standards) shall report as findings any fraud, illegal acts, non-compliance or internal control deficiencies, pursuant to Section 12-6-5 NMSA 1978. Each finding shall comply with the requirements of Subsection L of 2.2.2.10 NMAC for audit and attest engagements or Subsection D of 2.2.2.15 NMAC for non-attest engagements.

(10) Report review: As required by Section 12-6-14 NMSA 1978, the state auditor shall review reports of any special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement made pursuant to this section for compliance with the professional services contract and this rule. Upon completion of the report, the IPA or other professional shall deliver the electronic report to the state auditor with a copy of any signed management representation letter, if applicable. Unfinished or excessively deficient reports shall be rejected by the state auditor. If the report is rejected the firm shall submit an electronic version of the corrected rejected report for state auditor review. The name of the electronic file shall be "corrected rejected report" followed by the agency name and fiscal year. The IPA or other professional shall respond to all review comments as directed by the state auditor.

(11) Report release: After OSA's review of the report for compliance with the professional services contract and this rule, the state auditor shall authorize the IPA to print and submit the final report. An electronic version of the report, in the PDF format described at Subsection B of 2.2.2.9 NMAC, shall be delivered to the state auditor within five business days. The state auditor shall not release the report until all the required documents are received by the state auditor. The state auditor shall provide the agency with a letter authorizing the release of the report pursuant to Section 12-6-5 NMSA 1978. Agency and local public body personnel shall not release information to the public relating to the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement until the report is released and has become a public record pursuant to Section 12-6-5 NMSA 1978. Except for the exception under Subsection B of 2.2.2.15 NMAC, at all times during the engagement and after the engagement report becomes a public record, the IPA or other professional(s) shall not disclose to the public confidential information about the auditee or about the engagement. Confidential information is information that is not generally known to the public through common means of providing public information like the news media and internet.

(12) Disclosure by professionals: The IPA or other professional shall not disclose information identified as confidential information provided to them by the state auditor unless otherwise specified by the state auditor. Disclosure of confidential information by the IPA or other professional may result in legal action by the state auditor, or in the case of an IPA, restriction pursuant to Subsection D of 2.2.2.8 NMAC.

(13) Payment: Progress payments up to (but not including) ninety-five percent of the contract amount do not require state auditor approval and may be made by the agency if the agency monitors the progress of the services procured. If requested by the state auditor, the agency shall provide a copy of the approved progress billing(s). Final payments over ninety-five percent may be made by the agency pursuant to either of the following:

(a) stated in the letter accompanying the release of the report to the agency, or

(b) in the case of ongoing law enforcement investigations, stated in a letter prior to the release of the report to the agency.

C.Agency-initiated special audits or examinations:

(1) Applicability: With the exception of agencies that are authorized by statute to conduct performance audits and forensic accounting engagements, this section applies to all special audits and examinations in which an agency enters into a professional services contract for a special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement relating to financial fraud, waste or abuse, but the agency has not been designated by the state auditor for the engagement pursuant to this rule. For purposes of this rule, "special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement" includes, without limitation, AUP, consulting, forensic services and contract close-out (results-based award) engagements that address financial fraud, waste or abuse in government.

(2) Any agency, local public body, IPA or other professional that enters into a professional services contract for a special audit or examination of the financial affairs and transactions of an agency or local public body that was not designated by the state auditor for the engagement must notify the OSA and provide a copy of any resulting report or any resulting findings of violations of law or good accounting practices to the OSA. Findings shall be reported as described in Subsection D of 2.2.2.15 NMAC. All findings relating to any violation of a criminal statute in connection with financial affairs must be reported immediately to the OSA pursuant to Section 12-6-6, NMSA 1978.

D.Finding requirements for special audits or examinations: Communicating findings: All finding reference numbers shall follow a consistent format. Findings required by Section 12-6-5 NMSA 1978 shall be presented in a separate schedule of findings and placed at the end of the report.

(1) Section 12-6-5 NMSA 1978 requires that for every special audit and examination made "each report set out in detail, in a separate section, any violation of law or good accounting practices found by the audit or examination."

(2) Each finding shall specifically state and describe the following:

(a) condition (provides a description of a situation that exists and includes the extent of the condition and an accurate perspective, the number of instances found, the dollar amounts involved, if specific amounts were identified);

(b) criteria (identifies the required or desired state or what is expected from the program or operation; cites the specific section of law, regulation, ordinance, contract, or grant agreement if applicable);

(c) effect (the logical link to establish the impact or potential impact of the difference between the situation that exists (condition) and the required or desired state (criteria); demonstrates the need for corrective action in response to identified problems or relevant risks);

(d) cause (identifies the reason or explanation for the condition or the factors responsible for the difference between what the auditors found and what is required or expected; the cause serves as a basis for the recommendation);

(e) recommendation addressing each condition and cause; and

(f) agency response (the agency's response shall include specific planned corrective actions with a timeline and designation of what employee position(s) are responsible for meeting the deadlines in the timeline).

N.M. Admin. Code § 2.2.2.15

2.2.2.15 NMAC - Rp, 2.2.2.15 NMAC, 2-28-14, Adopted by New Mexico Register, Volume XXVI, Issue 05, March 16, 2015, eff. 3/16/2015, Adopted by New Mexico Register, Volume XXVII, Issue 05, March 15, 2016, eff. 3/15/2016, Adopted by New Mexico Register, Volume XXVIII, Issue 05, March 14, 2017, eff. 3/14/2017, Adopted by New Mexico Register, Volume XXIX, Issue 04, February 27, 2018, eff. 2/27/2018, Amended by New Mexico Register, Volume XXX, Issue 05, March 12, 2019, eff. 3/12/2019, Adopted by New Mexico Register, Volume XXXI, Issue 05, March 10, 2020, eff. 3/10/2020, Adopted by New Mexico Register, Volume XXXII, Issue 06, March 23, 2021, eff. 3/23/2021, Adopted by New Mexico Register, Volume XXXIII, Issue 06, March 22, 2022, eff. 3/22/2022, Adopted by New Mexico Register, Volume XXXIV, Issue 06, March 28, 2023, eff. 3/28/2023, Amended by New Mexico Register, Volume XXXV, Issue 13, July 16, 2024, eff. 7/16/2024