Financial Audits And Performance Audits; Authority Of The Nebraska Auditor Of Public Accounts

STATE OF NEBRASKA ~ffice of tbe ~ttornep ~eneral 2115 STATE CAPITOL BUILDING LINCOLN, NE 68509-8920 (402) 471-2682 TOO (402) 471-2682 CAPITOL FAX (402) 471 -3297 K STREET FAX (402) 471 -4725 JAMES D. SMITH DON STENBERG ATTORNEY GENERAL CHIEF DEPUTY ATTORNEY GENERAL HO. STATE OF NEBRASKA OFFICIAL DEC 2 2002 DEPT. OF JUSTICE SUBJECT: Financial Audits And Performance Audits; Authority Of The Nebraska Auditor Of Public Accounts. REQUESTED BY: Lori McClurg, Director Department of Administrative Services WRITTEN BY: Don Stenberg, Attorney General Dale A. Comer, Assistant Attorney General In early June, 2002, the Nebraska Auditor of Public Accounts ("APA" or "Auditor") sent the Department of Administrative Services (the "Department") and a number of other state agencies a letter indicating that the Auditor was "conducting a review of contracts." That letter included a request for a number of documents from the Department. That letter also included an "Internal Control Questionnaire" ("ICQ") which posed a number of questions to the Department regarding its contracting process. You state that you have provided the Auditor with all of the documents which were requested in her initial letter. However, you also believe that the Auditor was conducting a performance audit. As a result, you have posed a number of questions to us regarding the Auditor's authority to do such audits and the propriety of the internal control questionnaires propounded to state agencies by the AP A. We will discuss each of your questions separately below. However, we will alter the order of your questions somewhat in order to facilitate our discussion. Jennifer M. Amen David K. Arterburn William R. Barger l . Jay Bartel Samuel J. Bethune Vicki l . Boone-lawson J. Kirk Brown Marie C. Clarl<e Delores N. Coe-Barbee Dale A. Comer David D. Cookson Douglas D. Dexter Jodi M. Fenner Lynne R. Fritz Susan J. Gustafson Royce N. Harper Jason W. Hayes Amber F. Herrick William l. Howland Marilyn B. Hutchinson Kimberly A. Klein Charlotte R. Koranda Amy l. Kuzila George R. l ove Printed with soy ink on recycled paper Charles E. l owe lisa D. Martin-Price l ynn A. Melson Eric S. Miller Ronald D. Moravec Fredrick F. Neid Teresa J. Nulzman-Buller Mark D. Raffety Hobert B. Rupe Kevin J. Slimp James H. Spears Mark D. Starr Martin Swanson John R. Thompson Bradley D. Thornton Melanie J. Whitlamore-Mantzios linda l. Willard Lori McClurg Page 2 Your Question No.2. "What is a financial audit versus a performance audit?" The powers and duties of the Auditor are set out at Neb. Rev. Stat. § 84-304 (Cum. Supp. 2002). Subsection (9) of§ 84-304 provides that it shall be the duty of the APA: To conduct all audits and examinations in a timely manner and in accordance with the standards for audits of governmental organizations, programs, activities, and functions published by the Comptroller General of the United States. The Comptroller General of the United States publishes generally-accepted government auditing standards in a publication entitled "Government Auditing Standards." That publication is also commonly referred to as the "Yellow Book." The Auditor has provided us with a copy of the Yellow Book, and those auditing standards contain definitions of "Financial Audits" and "Performance Audits" which, in light of§ 84-304 (9), have a direct bearing on your second question. 1 Chapter 2 of the Government Auditing Standards discusses the 'Types of Government Audits." Section 2.4 deals with Financial Audits and states as follows: 2.4 Financial audits include financial statement and financial related audits. a. Financial statement audits provide reasonable assurance about whether the financial statements of an audited entity present fairly the financial position, results of operations, and cash flows in conformity with generally accepted accounting principles. Financial statement audits also include audits of financial statements prepared in conformity with any of several other bases of accounting discussed in auditing standards issued by the American Institute of Certified Public Accountants (AICPA). b. Financial related audits include determining whether (1) financial information is presented in accordance with established or stated criteria, (2) the entity has adhered to specific financial compliance requirements, or (3) 1 The APA was given authorization to retain outside counsel to represent her in connection with the controversy surrounding the review of contracts and ICQ's which are the subject of your opinion request. The Auditor and her counsel have provided us with numerous materials pertinent to this opinion, including a specific response to each of the questions you have presented to us. I· Lori McClurg Page 3 the entity's internal control structure over financial reporting and/or safeguarding assets is suitably designed and implemented to achieve the control objectives. (Footnotes and Note omitted). Sections 2.6 and 2.7 of the Yellow Book describe Performance Audits: 2.6 A performance audit is an objective and systematic examination of evidence for the purpose of providing an independent assessment of the performance of a government organization, program, activity, or function in order to provide information to improve public accountability and facilitate decision-making by parties with responsibility to oversee or initiate corrective action. 2.7 Performance audits include economy and efficiency and program audits. a. Economy and efficiency audits include determining (1) whether the entity is acquiring, protecting, and using its resources (such as personnel, property, and space) economically and efficiently, (2) the causes of inefficiencies or uneconomical practices, and (3) whether the entity has complied with laws and regulations on matters of economy and efficiency. b. Program audits include determining (1) the extent to which the desired results or benefits established by the legislature or other authorizing body are being achieved, (2) the effectiveness of organizations, programs, activities, or functions, and (3) whether the entity has complied with significant laws and regulations applicable to the program. We will rely on the Yellow Book definitions set out above with respect to what constitutes a financial audit versus a performance audit. Your Question No. 1. "Is the Auditor legally authorized to conduct periormance audits?" We have considered aspects of this question previously. In our Op. Att'y Gen. No. 91072 (October 2, 1991 ), we responded to an inquiry from Senator Moore as to whether passage of a particular statute was "necessary" for the APA to have authority to conduct performance audits of state agencies, the University of Nebraska and State Colleges, or other entities supported by the State. In the course of our opinion, we noted that Neb. Rev. Stat. § 84-304.01 (1987) gave the Auditor authority to conduct performance audits Lori McClurg Page4 of a broadly defined group of political subdivisions including counties, townships, municipalities and other public corporations and entities. Based upon that broad language, we concluded that§ 84-304.01 might give the APA the authority to conduct performance audits of some of the public bodies referenced in Senator Moore's opinion request. On the other hand, we also pointed out in Opinion No. 91072 that the APA had no express statutory authority to conduct performance audits of state agencies, state officers and other state entities. In addition, we noted that the Auditor had briefly been given specific statutory authority to conduct performance audits of state agencies and state entities, but that such authority had later been repealed.2 For those reasons, we concluded that " ... additional legislative enactment would be necessary for the Auditor of Public Accounts to conduct performance audits of state officials, agencies and other entities supported by the state." Op. Att'y Gen. No. 91072 at 3 (October 2, 1991 ). We continue to believe, as we stated in Opinion No. 91072, that the Auditor has no statutory authority to conduct performance audits of state agencies or state officers. The current version of Section 84-304.01 specifically allo.ws the APA to conduct performance audits of certain governmental subdivisions, butthere is still no analogous specific statutory authority for such audits of state agencies set out in the statutes pertaining to the Auditor. Indeed, the fact that the Legislature has chosen to specifically give the Auditor the authority to do performance audits of governmental subdivisions but not of state agencies, supports the notion that such authority ca·nnot be generally implied for all audits conducted by the APA. Moreover, it is our understanding that, while bills have been introduced in several recent legislative sessions which would have given the Auditor specific authority to conduct performance audits of state agencies, none of those bills have been enacted into law. For example, LB 964, introduced in 2002, contained language which would have given the Auditor the duty to: conduct performance audits, at such time as he or she determines, of the books, accounts, vouchers, records, and expenditures of state executive branch officers, state bureaus, state boards, state commissioners, societies, association, and institutions, state colleges, and the University of Nebraska, except when required to be performed by other officers or persons; 2197 4 Neb. Laws LB 280 amended § 84-304 to give the Auditor specific statutory authority to analyze the performance, management, and accomplishments of the programs of all state officers, boards, commissions, agencies and other state institutions. That authority was removed from § 84-304 by 1977 Neb. Laws LB 193. I I Lori McClurg Page 5 LB 964 was indefinitely postponed by the Legislature on April19, 2002. As a result, when the Legislature has had an opportunity to specifically authorize the Auditor to perform performance audits of state agencies, it has declined to do so. Section 84-304 was amended by LB 509 in 1995 to provide that all audits and examinations conducted by the Auditor must be done in accordance the Government Auditing Standards or the Yellow Book. 1995 Neb. Laws LB 506, § 1. Since that federal publication contains provisions pertaining to performance audits, an argument has been made that LB 509 gave the Auditor authority to do performance audits through its adoption of the Yellow Book standards. However, we have reviewed the legislative history of LB 509, and we found nothing there to indicate that the intent of that bill was to give the Auditor new statutory auditing powers. Rather, the purpose of the bill with regard to the adoption of government auditing standards was, at least in part, to reduce the possibilities for political rhetoric by the Auditor. Committee Hearing on LB 509, 941h Neb. Leg., 1st Sess. 7 (February 15, 1995). Furthermore, if LB 509 gave the Auditor authority for performance audits in 1995, then there would be no reason to introduce subsequent bills such as LB 964 in 2002 to give the Auditor specific authority to do performance audits for state agencies and state officers. Therefore, we do not believe that the APA has statutory 8uthority to conduct performance audits, except for the performance audits of governmental subdivisions authorized in § 84-304.01. However, apart from the Auditor's statutory authority in this area, we must also consider whether the authority to conduct performance audits is a part of the Auditor's inherent constitutional authority. In our Op. Att'y Gen. No. 93012 (March 4, 1993), we concluded that portions of LB 579, a bill then pending before the Nebraska Legislature which would have divested the Auditor's office of authority to conduct independent audits of the Legislature, were unconstitutional. That conclusion was based upon our belief that the Auditor has inherent constitutional duties and authority which cannot be removed or vitiated by legislative enactment.3 If those inherent constitutional duties and authority extend to performance 3 Our conclusion in Opinion No. 93012 is supported by the Lancaster County District Court's decision in State of Nebraska ex ref. John A. Breslow v. Lawrence S. Primeau, et a/, Doc. 496, Page 039 (Dist. Ct. Lancaster County, Neb., April18, 1994). We filed that lawsuit on behalf of the Auditor against members of the Legislature to test the constitutionality of LB 579, the legislative bill at issue in Opinion No. 93012. Ultimately, the District Court of Lancaster County concluded that the bulk of that bill limiting the Auditor's right to conduct an audit of the accounts and expenditures of the Legislature was unconstitutional, based in part upon the Auditor's constitutional authority to conduct audits. The district court's decision in the Primeau case was not appealed by any of the parties. Lori McClurg Page 6 audits, then the Auditor may conduct such audits, even in the absence of specific statutory authorization to do so. As we noted at page 3 of our Op. Att'y Gen. No. 214 (March 15, 1982), "[t]he dividing line between duties which are inherent in the constitutional office of Auditor of Public Accounts and those which are solely the product of statute is not clear." However, our Opinion No. 93012 contains a discussion of that issue which we will rely on in the present instance: Thus, in determining whether a particular duty is an inherent constitutional duty, a Nebraska court would examine whether the duty is such that it may be implied from the nature of the office. As an aid in this determination, the court may also examine the nature of the duties of the officer at the time the constitution was adopted. "Where constitutional provisions create the office of auditor without defining its duties, the duties of the state auditor are those pertaining to the office of public auditor at common law, or those which a territorial auditor was performing at the time of the adoption of the constitution." 81A C.J.S. § 134, States at 574. Under Nebraska's Territorial Laws of 1855, the Auditor of Public Accounts had the following duties, among others: Sec. 2. The Auditor shall be the general accountant of the Territory, and the keeper of all public accounts, books, vouchers, documents, and all other papers relating to the accounts and contracts of the Territory, and its revenue and fiscal affairs. Sec. 4. The Auditor shall: 1st--Audit all claims against the Territory, payable out of the treasury thereof, except such as are required to be adjusted and settled by law, by some other person; Therefore, the Nebraska Supreme Court did not consider the constitutionality of the legislation at issue. i . Lori McClurg Page 7 3rd--Audit and settle the accounts of all persons collecting the revenue of the Territory, or holding the money thereof; ... Neb. Terr. Laws 1855, Ch. XXV, § 2, 4. Similarly, at the time of statehood Nebraska law provided, "The Auditor is declared to be the general accountant of the territory . .. " The auditor's duties included the duty "To audit, adjust and settle all claims for services rendered, or expenditures made for the benefit of the territory .. . II Revised Statutes of the Territory of Nebraska, Ch. IV, §§ 2, 4 (1866). The duties now codified at Neb. Rev. Stat. § 84-304 are very similar to those in existence under territorial law before the constitution was adopted. Thus, the Auditor of Public Accounts would likely be deemed by a court to have inherent constitutional power to audit all claims payable out of state funds. Such duties are deemed core functions which may not be removed by legislative enactment. This conclusion is supported by extensive authority from other jurisdictions as well as previous opinions of this office. Opinion No. 93012 at 9, 10. Our analysis in Opinion No. 93012 is also consistent with the Lancaster County District Court's order on summary judgment in the Primeau case described in Footnote 3 above, where the court stated: It would appear that the Auditor has the duty to audit. LB 579 in effect, attempts to take him out of the business of auditing a substantial part of the financial affairs of the legislature. Primeau at 7 (Order of April 18, 1994 ). While the Auditor has inherent constitutional authority to conduct audits, it seems to us that such authority goes to matters encompassed under the Financial Audits definitions set out in the Yellow Book standards discussed above rather than to matters encompassed under the Performance Audit definitions, because the Auditor's constitutional authority allows the audit of all claims payable out of state funds and the financial affairs of state agencies. For that reason, we do not believe that the APA has inherent constitutional authority to conduct performance audits of state agencies. Absent any specific statutory authority to conduct such audits, the Auditor is not legally authorized to conduct performance audits apart from the ·performance audits of governmental subdivisions authorized in § 84-304.01 . Lori McClurg Page 8 Your Question No. 3. "What documents can the Auditor have authorization to review?" Two Nebraska statutes have application to this particular question. First of all, Neb. Rev. Stat.§ 84-304 (3)(Cum. Supp. 2002) provides that it shall be the duty of the Auditor: To examine or cause to be examined, as such time as he or she shall determine, books, accounts, vouchers, records, and expenditures of all state offers, state bureaus, state boards, state commissioners, the state library, societies and associations supported by the state, state institutions, state colleges, and the University of Nebraska, except when required to be performed by other officers or persons. In addition, Neb. Rev. Stat. § 84-305 (1999) states that: The Auditor of Public Accounts shall have access to all records of any public entity, in whatever form or mode the records may be, unless the auditor's access to the records is specifically prohibited or limited by federal or state law. No provisions of state law shall be construed to change the nonpublic nature of the data obtained as a result of the access. When an audit or investigative finding emanates from nonpublic data which is nonpublic pursuant to federal or state law, all the nonpublic information shall not be made public. Under the two statutes cited above, and in conformance with the Auditor's constitutional authority, we believe that the APA has broad authority to review any and all records of public entities, including state agencies, in the performance of his or her proper duties, absent a state or federal law which specifically limits the Auditor's access.4 Your Question No. 5. "Is an agency required to respond to questions (other than to provide requested documents) in connection with a financial audit?" 4 The Auditor's broad authority to review agency records in the performance of his or her duties is accompanied by strictures on the release of that information. For example, under Neb. Rev. Stat. § 84-311 (1999), if the Auditor or any employee of that office knowingly divulges or makes known in any manner not permitted by law any record or document, the disclosure of which is restricted by law, that person may be prosecuted for a Class Ill Misdemeanor or removed from office. • . 4.; Lori McClurg Page 9 As noted in our discussion of your Question No. 2, § 84-304 (9) provides that the APA must conduct all audits and examinations in accordance with the standards for audits of governmental organizations, programs, activities, and functions set out the Yellow Book. Based upon that statute, it appears to us that an agency of state government is required to respond to questions in a financial audit apart from simply providing documents to the Auditor if such questions are contemplated and authorized by the Yellow Book standards for financial audits. After reviewing those standards, we believe that they do require agencies to answer proper inquiries from the Auditor in the context of a financial audit. Chapter 4 of the Government Auditing Standards· is entitled "Field Work Standards for Financial Audits." Section 4.2 of that Chapter states as follows: For financial statement audits, generally accepted government auditing standards (GAGAS) incorporate the American Institute of Certified Public Accountants' (AICPA) three generally accepted standards of field work, which are: a. The work is to be adequately planned and assistants, if any, are to be properly supervised. b. A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed. c. Sufficient competent evidential matter is to be obtained through inspection, observation, inquiries, and confirmations to afford a reasonable basis for an opinion regarding the financial statements under audit. (Emphasis added). The reference in Section 4.2 of the Yellow Book to obtaining evidence in financial statement audits through "inquiries" leads us to conclude that questions of auditees are contemplated in connection with a financial statement audit. That conclusion is supported by an opinion from Warren G Jenkins, CPA, Chief Deputy Auditor of the State of l.owa which was provided to us by the APA. That conclusion is also supported by other materials provided to us by the APA which indicate that the Auditor has used ICQ's routinely over the years in connection with financial audits of Nebraska state agencies. The "Field Work Standards for Financial Audits" set out in Chapter 4 of the Yellow Book also contain standards for financial related audits. However, the Yellow Book does not set out specific field work standards for such audits. Instead, in§ 4.39 of Chapter 4, it simply incorporates certain other AI CPA standards for specific types of financial related audits. We have reviewed the other AICPA standards for financial related audits incorporated in § 4.39 which seem closest to the audit procedure which the APA has Lori McClurg Page 10 undertaken in the present instance, at least as we understand it. Those standards include the Statement on Standards for Attestation Engagements (SSAE) No 1 Attestation Standards, SSAE No. 2 Reporting on an Entity's Internal Control Over Financial Reporting and SSAE No. 3 Compliance Attestation. All of those standards were revised and recodified by SSAE No. 10, dated January, 2001, and all of those standards contain some reference to inquiries made of auditees. For example, SSAE No 1 Attestation Standards contains a section entitled "Obtaining Sufficient Evidence." Paragraph No. 55 within that section states: In an attest engagement designed to provide a moderate level of assurance (referred to as a review),5 the objective is to accumulate sufficient evidence to restrict attestation risk to a moderate level. To accomplish this, the types of procedures are generally limited to inquiries and analytical procedures (rather than also including search and verification procedures). Consequently, we believe that the APA may properly ask questions of auditees in the context of financial related audits as well as in financial statement audits. Your Question No.4. "Is an agency required to respond to questions (other than to provide requested documents) from the Auditor in response to a performance audit?" Since the Auditor, in our view, has no constitutional or statutory authority to conduct performance audits, there is little need for us to respond to this question in detail. The Auditor cannot currently conduct performance audits, and an agency has no obligation to respond to questions in the context of such an audit. Your Question No. 6. "Would a court order an agency to provide documents requested by the Auditor if the agency refused to provide them?" As discussed above, the Auditor has broad statutory authority to review any and all records of public entities, including state agencies, in the performance of his or her proper duties, unless there is another state or federal law which specifically limits the Auditor's access to particular records. Given that broad statutory authority, it is likely that a court would order an agency to provide documents requested by the Auditor to the Auditor if the agency refused to provide them. An action in that regard might involve either declaratory judgment or mandamus. 5 The original letter from the Auditor's office which precipitated the controversy in this case stated that "[w]e are conducting a review of contracts." Lori McClurg Page 11 Question No.7. "Would a court order an agency to answer questions posed by the Auditor in connection with a financial or performance audit?" For the reasons discussed above, it seems to us that the Auditor can pose questions to auditees in the context of a proper financial audit. Given that authority, we also believe it likely that a court would order an agency to answer questions posed by the Auditor in the conduct of a proper financial audit, so long as those questions were pertinent to the audit. Again, the cause of action in such a case might involve either declaratory judgment or mandamus. We do not believe that a court would require an agency to answer questions in connection with a performance audit. Your Question No. 8. "Is the Letter and accompanying Questionnaire a performance audit or financial audit?" From the beginning, the actual underlying purpose and nature of the audit procedure at issue in your opinion request have not been clear, and as is discussed below, explanations for that audit procedure appear to have changed somewhat over time. That uncertainty has caused confusion and much of the controversy which led to your opinion request. The Auditor's letter referenced in your Question No.8, which was sent to a number of state agencies on or about June 11, 2002, initiated the audit procedure in question in this instance by stating: We are conducting a review of contracts. This review is being performed in accordance with Neb. Rev. Stat. Sections 84-304(3) and 84-305, and AI CPA Professional Standards for Consulting Services Section 100.01 through 100.10, specifically, Advisory Services Standards under Section 1 00.05b. Under the Advisory Services Standards, it is the Auditor of Public Account's responsibility to develop findings, conclusions, and recommendations for your consideration and decision-making. While the Auditor's initial letter also stated that the Auditor was involved in reviewing agencies' internal control processes and procedures, there was no statement in that letter which indicated that the contract review in question was in connection with a financial statement audit or a financial related audit. To the contrary, many aspects of the June letter seemed to be more consistent with a performance audit than a financial audit. For example, the AICPA Standards cited as applicable were the Standards for Consulting Services. Consulting services are described as follows: Lori McClurg Page 12 Consulting services differ fundamentally from the CPA's function of attesting to the assertions of other parties. In an attest service, the practitioner expresses a conclusion about the reliability of a written assertion that is the responsibility of another party, the asserter. In a consulting service, the practitioner develops the findings, conclusions, and recommendations presented. The nature and scope of work is determined solely by the agreement between the practitioner and the client. Generally, the work is performed only for the use and benefit of the client. AI CPA Professional Standards for Consulting Services,§§ 100.02. As a result, consulting services are based upon an understanding between the client and the CPA as to the nature of the services to be performed. AI CPA Professional Standards for Consulting Services,§§ 100.02 and 100.07. Presumably, such an understanding between the client and the CPA would also include a solicitation of the services by the client, which, to the best of our knowledge, didn't occur in this case. Moreover, Consulting Services and Advisory Services, in particular, result in "findings, conclusions, and recommendations for client consideration and decision making."6 AICPA Professional Standards for Consulting Services, § 100.05b Advisory Services. (Emphasis added.) That latter language is similar to language in the Yellow Book definition of performance audits which states that such audits are performed to provide an independent assessment of the performance of a government organization to "provide information to improve public accountability and facilitate decision making by parties with responsibility to oversee or initiate corrective action." (Emphasis added.) However, that latter language is not contained in the definition of financial audits contained in the Yellow Book. Government Auditing Standards, § 2.4. Consequently, a number of state agencies, including the Attorney General, refused to answer the questions posed in the Internal Control Questionnaire which accompanied the Auditor's June letter because the Auditor appeared to be engaged in a performance audit.7 We believe that refusal was 6The text of the Auditor's initial letter also specifically stated that "[u]nder the Advisory Services Standards, it is the Auditor of Public Account's responsibility to develop findings, conclusions, and recommendations for your consideration and decision-making." Letter from Don Dunlap, Assistant Deputy Auditor to Ken Fougeron, State Building Administrator (sent on or about June 11, 2002)(emphasis added). 7 The Attorney General provided the Auditor with access to all the records which she requested in her initial letter, which was received by the Attorney General on or about July 2, 2002. The Attorney General has also since answered all the questions in and responded fully to the Internal Control Questionnaire which was included with the Auditor's initial letter. . ( ( . Lori McClurg Page 13 justified at that time, because the Auditor's initial letter does appear to constitute a performance audit. Subsequently, in a letter dated July 11, 2002, the Auditor responded to the Attorney General's initial refusal to answer the questions propounded in the Internal Control Questionnaire which is the subject of this opinion request. That response asserted that the ICQ was designed to gather internal control and compliance information, and that the Auditor was authorized to conduct financial procedures to be used in subsequent financial statement audits. However, that response also included some additional language which seemed to indicate that the procedure under consideration wasn't an audit at all, but some form of service other than an audit under § 2.10 of the Government Auditing Standards: Government Auditing Standards, section 2.10 states, "Auditors may perform services other than audits." According to GAS, section 2.11, "The head of the audit organization may wish to establish policies applying standards in this statement to its employees performing these and other types of nonaudit work." We have enclosed a copy of our Policies and Procedural Manual, Subsection 708, which refers to Other Engagements. Letter from Kate Witek, Nebraska Auditor of Public Accounts to Don Stenberg, Nebraska Attorney General (July 11, 2002). After we received your opinion request, the Auditor provided us, through counsel, with a great deal of additional material regarding the matters raised in your request. Portions of that material now indicate that what was actually contemplated by the Auditor's initial letter in June was a financial related audit, the results of which may be rolled into subsequent audit reports (which presumably will be financial statement audits). Letter from W. Scott Davis, Counsel for the APA to Dale A. Comer, Assistant Attorney General (November 8, 2002). Unfortunately, that final explanation was not clearly set out in any of the early written communications from the Auditor to state agencies. After reviewing all of the materials provided to us in connection with this opinion request and the contentions of the parties, we noted the following language from the Government Auditing Standards: 2.2 All audits begin with objectives, and those objectives determine the type of audit to be conducted and the audit standards to be followed. The types of audits, as defined by their objectives, are classified in these standards as financial audits or performance audits. 2.3 Audits may have a combination of financial and performance audit objectives or may have objectives limited to only some aspects of one audit Lori McClurg Page 14 type. For example, auditors conduct audits of government contracts and grants with private sector organizations, as well as government and nonprofit organizations, that often include both financial and performance objectives . .These are commonly referred to as "contract audits" or "grant audits." Other examples of such audits include audits of specific internal controls, compliance issues, and computer-based systems. Auditors should follow the standards that are applicable to the individual objectives of the audit. Based upon that language from the Yellow Book, we requested copies of the planning materials and specific objectives created for the audit procedure at issue in this instance because it appeared to us that those materials might offer some guidance as to the exact nature of that audit procedure. The Auditor provided us with those materials through counsel. As noted in our response to your Question No. 2 above, a financial related audit under the Yellow Book standards involves a determination as to whether (1) financial information is presented in accordance with established or stated criteria, (2) the entity has adhered to specific financial compliance requirements, or (3) the entity's internal control structure over financial reporting and/or safeguarding assets is suitably designed and implemented to achieve the control objectives. Government Auditing Standards,§ 2.4. In addition, financial related audits may include audits of internal controls over compliance with laws and regulations such as those governing bidding for contracts. Government Auditing Standards, § 2.5. The Auditor's plan for the audit procedure at issue in this opinion listed thirteen objectives. It appears to us that twelve of those objectives fairly relate to the procedures and internal controls in place within state agencies for contracting on behalf of the State of Nebraska, or to compliance by those state agencies with laws and regulations pertaining to contracting by the State. Those objectives seem consistent with a financial related audit, and are proper under the Auditor's current authority. On the other hand, one objective within the thirteen deals with the alleged practice whereby state agencies terminate an employee and then hire that person back on a contractual basis. That objective appears to us tp deal more with issues of whether an agency is acting economically, efficiently and effectively. Those issues are related to performance audits, and we believe that thirteenth objective is improper under the Auditor's current statutory and constitutional authority.8 Therefore, based upon the totality of the information ultimately provided to us, it is our view that the audit procedure initiated by the letter and questionnaire referenced in your Question No 8 is primarily a financial related audit, because twelve of the objectives forth at 8As noted above, particular audits may have a combination of financial and performance audit objectives. Government Auditing Standards, § 2.3. ( I . ' I I Lori McClurg Page 15 procedure pertain to internal control and compliance. We believe the Auditor has authority to go forward with that portion of the audit.9 However, the Auditor has no authority to proceed with an audit based upon the thirteenth objective for the procedure which pertains to contracting for services after a person has been terminated by the state, since that objective, in our view, pertains to a performance audit. Your Question No. 9. "If the Questionnaire is partly a financial audit and partly a performance audit is it legally appropriate to respond to the questions relating to the financial audit but not the performance audit?" As discussed at length above, the Auditor has statutory and constitutional authority to do financial audits, and no statutory or constitutionalauthority to do performance audits. If the Auditor has no authority to do performance audits, then we fail to see how an agency could be required to respond to questions in an ICQ relating to a performance audit. Therefore, we believe that it is legally appropriate to respond to questions in an ICQ which relate to a financial audit, but not to any questions which relate to a performance audit. Your Question No. 10. "Which questions in the Questionnaire, taken in context with the Letter, are financial audit related and which are performance audit related?" We have reviewed the Internal Control Questionnaire which accompanied the Auditor's initial letter in detail, and we have compared it with other ICQ's which the Auditor has used in connection with financial statement audits. There do not appear to be any questions in the questionnaire pertaining directly to the thirteenth objective of the audit which we believe to be an improper performance audit objective. Rather, all of the questions in the ICQ appear to us to pertain to the financial related audit regarding internal controls and compliance which was designed in light of the twelve proper objectives described in our response to your Question No. 8 above. As a result, none of the questions appears performance audit related in the context of those objectives, and we believe that agencies should complete the questionnaire in its entirety. 9 If the Auditor issues any report as a result of that portion of the audit, that report should be consistent with the Reporting Standards for Financial Audits contained in Chapter 5 of the Government Auditing Standards rather than the Reporting Standards for Performance Audits contained in Chapter 7 of the Government Auditing Standards. Government Auditing Standards, Chapters 5 and 7. j Lori McClurg Page 16 Concluding Observations Most, if not' all, of the controversy regarding the audits in question could have been avoided if the Auditor had clearly stated to the agencies involved the objectives of the audit. As previously noted, the Auditor's initial communications to state agencies gave the agencies every reason to believe that they were being subjected to an unauthorized performance audit. We note that §§ 4.6.3 through 4.6.9 of the Government Auditing Standards specifically require the Auditor to communicate the nature and extent of the planned audit and to "establish an understanding with the client." (§ 4.6.4) This is required "in order to reduce the risk that the needs or expectations of the parties involved may be misinterpreted." (§ 4.6.4) We recommend that the Auditor establish the necessary internal controls to ensure that this required communication is properly carried out by the Auditor's staff in the future. 10 Sincerely yours, DON STENBERG j;:]/leL Dale A. Comer Assistant Attorney General Approved by: 10 See Government Auditing Standards § 3.31 which provides, "Each audit organization conducting audits in accordance with these standards should have an appropriate internal quality control system in place and undergo an external quality control review."