Correction re: mandatory use of the Green Book

Well, I got a little too excited about audit criteria in my last newsletter. And a very kind reader wrote to correct me. Here is what he said:

In you latest notification you state that “The feds just made the use of the COSO model mandatory for grantees!”; however, in looking at the paragraph you referenced from the Uniform Administrative Rules, Cost Principles, and Audit Requirements for Federal Grants it has a ‘should’ and a ‘must’. Given the guidance in COFAR Q&A document, a ‘should’ is a best practice, not a mandatory requirement. As a result, COSO and the Green book are not mandatory for grantees. Below is a screenshot of slide I used during training to illustrate which parts relate to the ‘should’ and the ‘must’:

The ‘should’ relates to everything within the two lines, whereas the must is everything outside of the lines.

I know this is very confusing. If you hear of another interpretation please let me know. I want to make sure I have it right.

I really appreciate his kind correction. Thank you!

But this doesn’t mean auditors can’t use the Green Book as an audit criteria. Because in the Yellow Book lists ‘defined business practices’ as a possible audit criteria.

6.37 Auditors should identify criteria. Criteria represent the laws, regulations, contracts, grant agreements, standards, specific requirements, measures, expected performance, defined business practices, and benchmarks against which performance is compared or evaluated. Criteria identify the required or desired state or expectation with respect to the program or operation. Criteria provide a context for evaluating evidence and understanding the findings, conclusions, and recommendations included in the report. Auditors should use criteria that are relevant to the audit objectives and permit consistent assessment of the subject matter.

So, in a pinch, absent of other criteria that is earlier on the list in section 6.37, auditors can use the Green Book as criteria on the Single Audit.

Sorry I made that mistake. It is a risk I take in creating this newsletter. If you know of any other nuance of this issue, please write directly to me at leita@yellowbook-cpe.com and thanks for reading!