Section 15. Special Audits And Examinations

A. Fraud, waste or abuse in government reported by agencies, IPAs or members of the public: (1) Reports of fraud, waste & abuse: Pursuant to the authority set forth Subsection C of Section 12-6-3 NMSA 1978, the OSA may initiate special investigation or examination procedures in connection with reports of financial fraud, waste and abuse in government. Reports received or created by the OSA are confidential audit information and audit documentation in connection with the state auditor’s statutory duty to examine and audit the financial affairs of every agency, or in connection with the state auditor’s statutory discretion to audit the financial affairs and transactions of an agency in whole or in part. (2) Confidentiality of sources: The identity of a person making a report to the OSA alleging financial fraud, waste, or abuse in government is confidential audit information and may not be disclosed, except as required by Section 12-6-6 NMSA 1978. (3) Confidentiality of files: A report alleging financial fraud, waste, or abuse in government that is made to the OSA and any resulting special audit, performance audit, attestation engagement or forensic accounting or other non-attest engagement files are confidential audit documentation and may not be disclosed by the OSA or the agency, except to an independent auditor, performance audit team or forensic accounting team in connection with a special audit, performance audit, attestation engagement, forensic accounting engagement, non- attest engagement, or other existing or potential engagement regarding the financial affairs or transactions of an agency. (a) Any records that result in, or are part of, any subsequent or resulting special audit, performance audit, attestation engagement or forensic accounting or other non-attest engagement will be audit workpapers and therefore confidential , forensic accounting engagement, non- attest engagement, or other existing or potential engagement regarding the financial affairs or transactions of an agency. (a) Any records that result in, or are part of, any subsequent or resulting special audit, performance audit, attestation engagement or forensic accounting or other non-attest engagement will be audit workpapers and therefore confidential. Records that result from, or are part of OSA, special investigations that do not result in a subsequent special audit, performance audit, attestation engagement or forensic accounting or other non-attest engagement may be disclosed, with personal identifier information redacted, once the examination or investigation is closed. (b) Any information related to a report alleging financial fraud, waste, or abuse in government provided to an independent auditor, performance audit team or forensic accounting team, is considered to be confidential audit or engagement documentation and is subject to confidentiality requirements, including but not limited to requirements under Subsections E and M of 2.2.2.10 NMAC, the Public Accountancy Act, and the AICPA Code of Professional Conduct. (4) If the OSA makes inquiries of agencies as part of the investigation process, agencies shall respond to the OSA inquiries within 15 calendar days of receipt or as soon as practicable under the circumstances with written notice to the OSA stating the basis for any delay. IPAs shall test compliance with this requirement and report noncompliance as a finding in the annual financial and compliance audit report. B. Special audit or examination process: (1) Designation: Pursuant to Section 12-6-3 NMSA 1978, in addition to the annual audit, the state auditor may cause the financial affairs and transactions of an agency to be audited in whole or in part is for any delay. IPAs shall test compliance with this requirement and report noncompliance as a finding in the annual financial and compliance audit report. B. Special audit or examination process: (1) Designation: Pursuant to Section 12-6-3 NMSA 1978, in addition to the annual audit, the state auditor may cause the financial affairs and transactions of an agency to be audited in whole or in part. 2.2.2 NMAC 38 Accordingly, the state auditor may designate an agency for special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement regarding the financial affairs and transactions of an agency or local public body based on information or a report received from an agency, IPA or member of the public. For purposes of this rule “special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement” includes, without limitation, AUP, consulting, and contract close-out (results-based award) engagements that address financial fraud, waste, or abuse in government. It also includes non-attest engagements performed under the forensic services standards issued by the AICPA and engagements performed following the Code of Professional Standards issued by the Association of Certified Fraud Examiners (ACFE). The state auditor shall inform the agency of the designation by sending the agency a notification letter. The state auditor may specify the subject matter, the scope and any procedures required, the AICPA or other professional standards that apply, and for a performance audit, performance aspects to be included and the potential findings and reporting elements that the auditors expect to develop . The state auditor shall inform the agency of the designation by sending the agency a notification letter. The state auditor may specify the subject matter, the scope and any procedures required, the AICPA or other professional standards that apply, and for a performance audit, performance aspects to be included and the potential findings and reporting elements that the auditors expect to develop. Pursuant to Section 200.503 of Uniform Guidance, if a single audit was previously performed, the special audit, attestation engagement, performance audit or forensic accounting engagement shall be planned and performed in such a way as to build upon work performed, including the audit documentation, sampling, and testing already performed by other auditors. The attestation and performance audit engagements may be conducted pursuant to government auditing standards if so specified by the OSA. (2) Costs: All reasonable costs of special audits, attestation engagements, forensic accounting engagements, non-attest engagements, or single-entity performance audits conducted pursuant to this Section shall be borne by the agency audited pursuant to Section 12-6-4 NMSA 1978. The state auditor, in its sole discretion, may apportion among the Agencies audited some or all of the reasonable costs of a multi-entity performance audit. (3) Who performs the engagement: The state auditor may perform the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement alone or with other professionals selected by the state auditor e state auditor, in its sole discretion, may apportion among the Agencies audited some or all of the reasonable costs of a multi-entity performance audit. (3) Who performs the engagement: The state auditor may perform the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement alone or with other professionals selected by the state auditor. Alternatively, the state auditor may require the engagement to be performed by an IPA or a team that may be comprised of any of the following: independent public accountants; individuals with masters degrees or doctorates in a relevant field such as business, public administration, public policy, finance, or economics; individuals with their juris doctorate; CFE-certified fraud examiners; CFF-certified forensic auditors; CIA-certified internal auditors; or other specialists. If the state auditor designates an agency for an engagement to be conducted by an IPA or professional team, the agency shall: (a) upon receipt of notification to proceed from the state auditor, identify all elements or services to be solicited, obtain the state auditor’s written approval of the proposed scope of work, and request quotations or proposals for each applicable element of the engagement; (b) follow all applicable procurement requirements which may include, but are not limited to, Uniform Guidance, Procurement Code (Sections 13-1-28 through 13-1-199 NMSA 1978), or equivalent home rule procurement provisions when selecting an IPA or team to perform the engagement; (c) submit the following information to the state auditor by the due date specified by the state auditor: (i) a completed template for special audits, attestation engagements, performance audits or forensic accounting engagements, provided at www.osanm.org, which the agency shall print on agency letterhead; and (ii) a completed contract form including the contract fee, start and completion date, and the specific scope of services to be performed in the format prescribed by the O by the state auditor: (i) a completed template for special audits, attestation engagements, performance audits or forensic accounting engagements, provided at www.osanm.org, which the agency shall print on agency letterhead; and (ii) a completed contract form including the contract fee, start and completion date, and the specific scope of services to be performed in the format prescribed by the OSA, provided at www.osanm.org, with all required signatures on the contract. (d) If the agency fails to select an IPA and submit the signed contract to OSA by the due date specified by the state auditor, or, if none within 60 days of notification of designation from the state auditor, the state auditor may conduct the engagement or select the IPA for that agency in accordance with the process described at Subsection F of 2.2.2.8 NMAC. (4) Errors: Contracts that are submitted to the OSA with errors or omissions shall be rejected by the state auditor. The state auditor shall return the rejected contract to the agency indicating the reason(s) for the rejection. (5) Recommendation rejections: In the event the agency’s recommendation is not approved by the state auditor, the state auditor shall promptly communicate the decision, including the reason(s) for rejection, to the agency, at which time the agency shall promptly submit a different recommendation. This process shall continue until the state auditor approves a recommendation and related contract. During this process, whenever a recommendation and related contract are not approved, the agency may submit a written request to the state auditor for reconsideration of the disapproval. The agency shall submit its request no later than 15 calendar days from the 2.2.2 NMAC 39 date of the disapproval and shall include documentation in support of its recommendation. If warranted, after review of the request, the state auditor may hold an informal meeting to discuss the request roved, the agency may submit a written request to the state auditor for reconsideration of the disapproval. The agency shall submit its request no later than 15 calendar days from the 2.2.2 NMAC 39 date of the disapproval and shall include documentation in support of its recommendation. If warranted, after review of the request, the state auditor may hold an informal meeting to discuss the request. The state auditor shall set the meeting in a timely manner with consideration given to the agency’s circumstances. (6) Contract amendments: Any proposed contract amendments shall be processed in accordance with Subsection N of 2.2.2.8 NMAC. (7) Access to records and documents: For any special audit, attestation engagement, performance audit or forensic accounting engagement, or non-attest engagement, the state auditor and any engaged professionals shall have available to them all documents necessary to conduct the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement. Furthermore, pursuant to Section 12-6-11 NMSA 1978, when necessary for a special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement the state auditor may apply to the district court of Santa Fe County for issuance of a subpoena to compel the attendance of witnesses and the production of books and records. (8) Entrance, progress and exit conferences: The IPA or other professional shall hold an entrance conference and an exit conference with the agency, unless the IPA or other professional has submitted a written request to the state auditor for an exemption from this requirement and has obtained written approval of the exemption. The OSA has the authority to notify the agency or IPA or other professional that the state auditor shall be informed of the date of the entrance conference, any progress meetings and the exit conference with the agency, unless the IPA or other professional has submitted a written request to the state auditor for an exemption from this requirement and has obtained written approval of the exemption. The OSA has the authority to notify the agency or IPA or other professional that the state auditor shall be informed of the date of the entrance conference, any progress meetings and the exit conference. If such notification is received, the IPA or other professional and the agency shall invite the state auditor or the auditor’s designee to attend all such conferences no later than 72 hours before the proposed conference or meeting. The state auditor may also require the IPA or other professional to submit its audit plan to the state auditor for review and approval. The date of the exit conference(s) and the names and titles of personnel attending shall be stated on the last page of the special audit report. (9) Required reporting: All reports for special audits, attestation engagements, performance audits, forensic accounting engagements, or non-attest engagements related to financial fraud, waste or abuse in government undertaken pursuant to 2.2.2.15 NMAC (regardless of whether they are conducted pursuant to AICPA standards for consulting services, forensic services or for attestation engagements, non-attest engagements, or other professional standards) shall report as findings any fraud, illegal acts, non-compliance or internal control deficiencies, pursuant to Section 12-6-5 NMSA 1978. Each finding shall comply with the requirements of Subsection L of 2.2.2.10 NMAC for audit and attest engagements or Subsection D of 2.2.2.15 NMAC for non-attest engagements. (10) Report review: As required by Section 12-6-14 NMSA 1978, the state auditor shall review reports of any special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement made pursuant to this section for compliance with the professional services contract and this rule ttest engagements or Subsection D of 2.2.2.15 NMAC for non-attest engagements. (10) Report review: As required by Section 12-6-14 NMSA 1978, the state auditor shall review reports of any special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement made pursuant to this section for compliance with the professional services contract and this rule. Upon completion of the report, the IPA or other professional shall deliver the electronic report to the state auditor with a copy of any signed management representation letter, if applicable. Unfinished or excessively deficient reports shall be rejected by the state auditor. If the report is rejected the firm shall submit an electronic version of the corrected rejected report for state auditor review. The name of the electronic file shall be “corrected rejected report” followed by the agency name and fiscal year. The IPA or other professional shall respond to all review comments as directed by the state auditor. (11) Report release: After OSA’s review of the report for compliance with the professional services contract and this rule, the state auditor shall authorize the IPA to print and submit the final report. An electronic version of the report, in the PDF format described at Subsection B of 2.2.2.9 NMAC, shall be delivered to the state auditor within five business days. The state auditor shall not release the report until all the required documents are received by the state auditor. The state auditor shall provide the agency with a letter authorizing the release of the report pursuant to Section 12-6-5 NMSA 1978. Agency and local public body personnel shall not release information to the public relating to the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement until the report is released and has become a public record pursuant to Section 12-6-5 NMSA 1978 with a letter authorizing the release of the report pursuant to Section 12-6-5 NMSA 1978. Agency and local public body personnel shall not release information to the public relating to the special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement until the report is released and has become a public record pursuant to Section 12-6-5 NMSA 1978. Except for the exception under Subsection B of 2.2.2.15 NMAC, at all times during the engagement and after the engagement report becomes a public record, the IPA or other professional(s) shall not disclose to the public confidential information about the auditee or about the engagement. Confidential information is information that is not generally known to the public through common means of providing public information like the news media and internet. (12) Disclosure by professionals: The IPA or other professional shall not disclose information identified as confidential information provided to them by the state auditor unless otherwise specified by the state 2.2.2 NMAC 40 auditor. Disclosure of confidential information by the IPA or other professional may result in legal action by the state auditor, or in the case of an IPA, restriction pursuant to Subsection D of 2.2.2.8 NMAC. (13) Payment: Progress payments up to (but not including) ninety-five percent of the contract amount do not require state auditor approval and may be made by the agency if the agency monitors the progress of the services procured. If requested by the state auditor, the agency shall provide a copy of the approved progress billing(s). Final payments over ninety-five percent may be made by the agency pursuant to either of the following: (a) stated in the letter accompanying the release of the report to the agency, or (b) in the case of ongoing law enforcement investigations, stated in a letter prior to the release of the report to the agency. C e state auditor, the agency shall provide a copy of the approved progress billing(s). Final payments over ninety-five percent may be made by the agency pursuant to either of the following: (a) stated in the letter accompanying the release of the report to the agency, or (b) in the case of ongoing law enforcement investigations, stated in a letter prior to the release of the report to the agency. C. Agency-initiated special audits or examinations: (1) Applicability: With the exception of agencies that are authorized by statute to conduct performance audits and forensic accounting engagements, this section applies to all special audits and examinations in which an agency enters into a professional services contract for a special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement relating to financial fraud, waste or abuse, but the agency has not been designated by the state auditor for the engagement pursuant to this rule. For purposes of this rule, “special audit, attestation engagement, performance audit, forensic accounting engagement, or non-attest engagement” includes, without limitation, AUP, consulting, forensic services and contract close-out (results-based award) engagements that address financial fraud, waste or abuse in government. (2) Any agency, local public body, IPA or other professional that enters into a professional services contract for a special audit or examination of the financial affairs and transactions of an agency or local public body that was not designated by the state auditor for the engagement must notify the OSA and provide a copy of any resulting report or any resulting findings of violations of law or good accounting practices to the OSA. Findings shall be reported as described in Subsection D of 2.2.2.15 NMAC. All findings relating to any violation of a criminal statute in connection with financial affairs must be reported immediately to the OSA pursuant to Section 12-6-6, NMSA 1978. D t notify the OSA and provide a copy of any resulting report or any resulting findings of violations of law or good accounting practices to the OSA. Findings shall be reported as described in Subsection D of 2.2.2.15 NMAC. All findings relating to any violation of a criminal statute in connection with financial affairs must be reported immediately to the OSA pursuant to Section 12-6-6, NMSA 1978. D. Finding requirements for special audits or examinations: Communicating findings: All finding reference numbers shall follow a consistent format. Findings required by Section 12-6-5 NMSA 1978 shall be presented in a separate schedule of findings and placed at the end of the report. (1) Section 12-6-5 NMSA 1978 requires that for every special audit and examination made “each report set out in detail, in a separate section, any violation of law or good accounting practices found by the audit or examination.” (2) Each finding shall specifically state and describe the following: (a) condition (provides a description of a situation that exists and includes the extent of the condition and an accurate perspective, the number of instances found, the dollar amounts involved, if specific amounts were identified); (b) criteria (identifies the required or desired state or what is expected from the program or operation; cites the specific section of law, regulation, ordinance, contract, or grant agreement if applicable); (c) effect (the logical link to establish the impact or potential impact of the difference between the situation that exists (condition) and the required or desired state (criteria); demonstrates the need for corrective action in response to identified problems or relevant risks); (d) cause (identifies the reason or explanation for the condition or the factors responsible for the difference between what the auditors found and what is required or expected; the cause serves as a basis for the recommendation); (e) recommendation addressing each condition and cause; and (f) agency response (the agency’s response shall i ion in response to identified problems or relevant risks); (d) cause (identifies the reason or explanation for the condition or the factors responsible for the difference between what the auditors found and what is required or expected; the cause serves as a basis for the recommendation); (e) recommendation addressing each condition and cause; and (f) agency response (the agency’s response shall include specific planned corrective actions with a timeline and designation of what employee position(s) are responsible for meeting the deadlines in the timeline). [2.2.2.15 NMAC - Rp, 2.2.2.15 NMAC, 3/28/2023; A, 7/16/2024] 2.2.2.16 ANNUAL FINANCIAL PROCEDURES REQUIRED FOR LOCAL PUBLIC BODIES WITH ANNUAL REVENUES LESS THAN FIVE HUNDRED THOUSAND DOLLARS ($500,000) (TIERED SYSTEM): A. Annual revenue and state funded capital outlay expenditures determine type of financial reporting: All local public bodies shall comply with the requirements of Section 6-6-3 NMSA 1978. Pursuant to Section 12-6-3 NMSA 1978, the annual revenue of a local public body determines the type of financial reporting a 2.2.2 NMAC 41 local public body shall submit to the OSA. Local public bodies are mutual domestic water consumers associations, land grants, incorporated municipalities, and special districts. (1) The annual revenue of a local public body shall be calculated on a cash basis as follows: (a) Revenue shall exclude capital outlay funds. OSA defines capital outlay funds as funds expended pursuant to the Property Control Act definition of a capital outlay project. Per section 15-3B-2 NMSA 1978 “Capital outlay project" means the acquisition, improvement, alteration or reconstruction of assets of a long-term character that are intended to continue to be held or used, including land, buildings, machinery, furniture and equipment. A “capital outlay project” includes all proposed expenditures related to the entire undertaking. (b) Revenue shall exclude federal or private grants B-2 NMSA 1978 “Capital outlay project" means the acquisition, improvement, alteration or reconstruction of assets of a long-term character that are intended to continue to be held or used, including land, buildings, machinery, furniture and equipment. A “capital outlay project” includes all proposed expenditures related to the entire undertaking. (b) Revenue shall exclude federal or private grants. For the purpose of 2.2.2.16 NMAC “private grant” means funding provided by a non-governmental entity. (2) For the purposes of 2.2.2.16 NMAC “state funded capital outlay expenditures” are expenditures made pursuant to any funding provided by the New Mexico legislature for a capital outlay project as defined in the Property Control Act, Section 15-3B-2 NMSA 1978, either received directly by the local public body or disbursed through an administering agency. B. Determination of revenue and services: Annually, following the procedures described in Subsection F of 2.2.2.8 NMAC, the state auditor shall provide local public bodies written authorization to obtain services to conduct a financial audit or other procedures. Upon receipt of the authorization, a local public body shall determine its annual revenue in accordance with Subsection A of 2.2.2.16 NMAC. The following requirements for financial reporting apply to the following annual revenue amounts (tiers): (1) if a local public body’s annual revenue is less than ten thousand dollars ($10,000) and the local public body did not directly expend at least fifty percent of, or the remainder of, a single capital outlay award, then the local public body is exempt from submitting a financial report to the state auditor, except as otherwise provided in Subsection C of 2.2.2.16 NMAC (tier one); (2) if a local public body’s annual revenue is ten thousand dollars ($10,000) or more but less than fifty thousand dollars ($50,000), then the local public body is exempt from submitting a financial report to the state auditor, except as otherwise provided in Subsection C of 2.2.2.16 NMAC (t cial report to the state auditor, except as otherwise provided in Subsection C of 2.2.2.16 NMAC (tier one); (2) if a local public body’s annual revenue is ten thousand dollars ($10,000) or more but less than fifty thousand dollars ($50,000), then the local public body is exempt from submitting a financial report to the state auditor, except as otherwise provided in Subsection C of 2.2.2.16 NMAC (tier two); (3) if a local public body’s annual revenue is less than fifty thousand dollars ($50,000), and the local public body expended at least fifty percent of, or more of, a single capital outlay award during the fiscal year, then the local public body shall procure the services of an IPA for the performance of a tier three AUP engagement in accordance with the audit contract for a tier three AUP engagement; (4) if a local public body’s annual revenue is greater than fifty thousand dollars ($50,000) but less than two hundred-fifty thousand dollars ($250,000), then the local public body shall procure the services of an IPA for the performance of a tier four AUP engagement in accordance with the audit contract for a tier four AUP engagement; (5) if a local public body’s annual revenue is greater than fifty thousand dollars ($50,000) but less than two hundred-fifty thousand dollars ($250,000), and the local public body expended any capital outlay funds during the fiscal year, then the local public body shall procure the services of an IPA for the performance of a tier five AUP engagement in accordance with the audit contract for a tier five AUP engagement; (6) if a local public body’s annual revenue is two hundred-fifty thousand dollars ($250,000) or greater, but less than five hundred thousand dollars ($500,000), the local public body shall procure services of an IPA for the performance of a tier six AUP engagement in accordance with the audit contract for a tier six AUP engagement; the report shall include at a minimum, a compilation of financial statements and a financial report consistent with the agreed-upon procedu dollars ($250,000) or greater, but less than five hundred thousand dollars ($500,000), the local public body shall procure services of an IPA for the performance of a tier six AUP engagement in accordance with the audit contract for a tier six AUP engagement; the report shall include at a minimum, a compilation of financial statements and a financial report consistent with the agreed-upon procedures; (7) if a local public body’s annual revenue is five hundred thousand dollars ($500,000) or more, this section shall not apply and the local public body shall procure services of an IPA for the performance of a financial and compliance audit in accordance with other provisions of this rule; (8) notwithstanding the annual revenue of a local public body, if the local public body expended seven hundred-fifty thousand dollars ($750,000) or more of federal funds subject to a federal single audit during the fiscal year then the local public body shall procure a single audit. C. Exemption from financial reporting: A local public body that is exempt from financial reporting to the state auditor pursuant to Subsection B of 2.2.2.16 NMAC shall submit written certification to LGD and the state auditor. The certification shall be provided on the form made by the state auditor, available through OSA-Connect. The local public body shall certify, at a minimum: (1) the local public body’s annual revenue for the fiscal year; and (2) that the local public body did not expend fifty percent of or the remainder of a single capital outlay award during the fiscal year. 2.2.2 NMAC 42 (3) The OSA will not accept the certification of exemption from financial reporting for the current year until the prior year certifications or AUP reports (whichever is appropriate) have been submitted. D. Procurement of IPA services: A local public body required to obtain an AUP engagement shall procure the services of an IPA in accordance with Subsection F of 2.2.2.8 NMAC. E year. 2.2.2 NMAC 42 (3) The OSA will not accept the certification of exemption from financial reporting for the current year until the prior year certifications or AUP reports (whichever is appropriate) have been submitted. D. Procurement of IPA services: A local public body required to obtain an AUP engagement shall procure the services of an IPA in accordance with Subsection F of 2.2.2.8 NMAC. E. Access to Records and Documents: For any AUP the agency should produce all documents necessary to conduct the engagement. F. Requirements of the IPA selected to perform the AUP: (1) The IPA shall provide the local public body with a dated engagement letter during the planning stages of the engagement, describing the services to be provided. See Subsection F of 2.2.2.10 NMAC for applicable restrictions on the engagement letter. (2) The IPA may not subcontract any portion of the services to be performed under the contract with the local public body except for the activation of a contingency subcontractor form in the event the IPA is unable to complete the engagement. (3) The IPA shall hold an entrance conference and an exit conference with the local public body. The entrance and exit conference shall occur in the forum agreed to by the local public body and the IPA, to include virtual or telephonic options. The OSA reserves the right to require an in-person entrance or exit conference. The OSA has the authority to notify the agency or IPA that the state auditor shall be informed of the date of the entrance conference, any progress meetings and the exit conference. If such notification is received, the IPA and agency shall invite the state auditor to attend all such conferences no later than 72 hours before the proposed conference or meeting. (4) The IPA shall submit the report to the OSA for review in accordance with the procedures described at Subsection B of 2.2.2.9 NMAC f the date of the entrance conference, any progress meetings and the exit conference. If such notification is received, the IPA and agency shall invite the state auditor to attend all such conferences no later than 72 hours before the proposed conference or meeting. (4) The IPA shall submit the report to the OSA for review in accordance with the procedures described at Subsection B of 2.2.2.9 NMAC. Before submitting the report to OSA for review, the IPA shall review the report using the AUP report review guide available on the OSA’s website at www.saonm.org. The report shall be submitted to the OSA for review with the completed AUP report review guide. Once the AUP report is officially released to the agency by the state auditor (by a release letter) and the required waiting period of five calendar days has passed, unless waived by the agency in writing, the AUP report shall be presented by the IPA, to a quorum of the governing authority of the agency at a meeting held in accordance with the Open Meetings Act, if applicable. This requirement only applies to agencies with a governing authority, such as a board of directors, board of county commissioners, or city council, which is subject to the Open Meetings Act. The IPA shall ensure that the required communications to those charged with governance are made in accordance with AU-C 260.12 to 260.14. G. Progress payments: (1) Progress payments up to ninety-five percent of the contract amount do not require state auditor approval and may be made by the local public body if the local public body ensures that progress payments made do not exceed the percentage of work completed by the IPA. If requested by the state auditor, the local public body shall provide the OSA a copy of the approved progress billing(s) ayments: (1) Progress payments up to ninety-five percent of the contract amount do not require state auditor approval and may be made by the local public body if the local public body ensures that progress payments made do not exceed the percentage of work completed by the IPA. If requested by the state auditor, the local public body shall provide the OSA a copy of the approved progress billing(s). (2) Final payments from ninety-five percent to one hundred percent may be made by the local public body pursuant to either of the following: (a) stated in the letter accompanying the release of the report to the agency, or (b) in the case of ongoing law enforcement investigations, stated in a letter prior to the release of the report to the agency. In this situation a letter releasing the report to the agency will be issued when it is appropriate to release the report. H. Report due dates, notification letters and confidentiality: (1) For local public bodies with a June 30 fiscal year-end that qualify for the tiered system, the report or certification due date is December 15. Local public bodies with a fiscal year end other than June 30 shall submit the AUP report or certification no later than five months after the fiscal year-end. Late AUP reports (not the current reporting period) are due not more than six months after the date the contract was executed. An electronic copy of the report shall be submitted to the OSA. AUP reports submitted via fax or email shall not be accepted. A copy of the signed dated management representation letter shall be submitted with the report. If a due date falls on a weekend or holiday, or if the OSA is closed due to inclement weather, the report is due the following business day by 11:59 p.m. If the report is mailed to the state auditor, it shall be postmarked no later than the due date to be considered filed by the due date. If the due date falls on a weekend or holiday the audit report shall be postmarked by the following business day a due date falls on a weekend or holiday, or if the OSA is closed due to inclement weather, the report is due the following business day by 11:59 p.m. If the report is mailed to the state auditor, it shall be postmarked no later than the due date to be considered filed by the due date. If the due date falls on a weekend or holiday the audit report shall be postmarked by the following business day. (2) As soon as the IPA becomes aware that circumstances exist that will make the local public body’s AUP report be submitted after the applicable due date, the auditor shall notify the state auditor of the situation in writing. This notification shall consist of a letter, not an email. However, a scanned version of the official letter sent via email is acceptable. The late AUP notification letter is subject to the confidentiality 2.2.2 NMAC 43 requirements detailed at Subsection M of 2.2.2.10 NMAC. This does not prevent the state auditor from notifying the legislative finance committee or applicable oversight agency pursuant to Subsections F and G of Section 12-6-3 NMSA 1978. There shall be a separate notification for each late AUP report. The notification shall include a specific explanation regarding why the report will be late, when the IPA expects to submit the report and a concurring signature by the local public body. If the IPA will not meet the expected report submission date, then the IPA shall send a revised notification letter. In the event the contract was signed after the report due date, the notification letter shall still be submitted to the OSA explaining the reason the AUP report will be submitted after the report due date. The late report notification letter is not required if the report was submitted to the OSA for review by the deadline, and then rejected by the OSA, making the report late when resubmitted tter. In the event the contract was signed after the report due date, the notification letter shall still be submitted to the OSA explaining the reason the AUP report will be submitted after the report due date. The late report notification letter is not required if the report was submitted to the OSA for review by the deadline, and then rejected by the OSA, making the report late when resubmitted. (3) Local public body personnel shall not release information to the public relating to the AUP engagement until the report is released and has become a public record pursuant to Section 12-6-5 NMSA 1978. At all times during the engagement and after the AUP report becomes a public record, the IPA shall follow applicable professional standards and 2.2.2 NMAC regarding the release of any information relating to the AUP engagement. I. Findings: All AUP engagements shall report as findings any fraud, illegal acts, non-compliance or internal control deficiencies, consistent with Section 12-6-5 NMSA 1978. The findings shall include the required content listed at Subparagraph (d) of Paragraph (1) of Subsection L of 2.2.2.10 NMAC. J. Review of AUP reports and related workpapers: AUP shall be reviewed by the OSA for compliance with professional standards and the professional services contract. Noncompliant reports shall be rejected and not considered received. Such reports shall be returned to the firm and a copy of the rejection letter shall be sent to the local public body. If the OSA rejects and returns an AUP report to the IPA, the report shall be corrected and resubmitted to the OSA by the due date, or the IPA shall include a finding for non-compliance with the due date. The IPA shall submit an electronic version of the corrected rejected report for OSA review. The name of the electronic file shall be “corrected rejected report” followed by the agency name and fiscal year. The OSA encourages early submission of reports to avoid findings for late reports resubmitted to the OSA by the due date, or the IPA shall include a finding for non-compliance with the due date. The IPA shall submit an electronic version of the corrected rejected report for OSA review. The name of the electronic file shall be “corrected rejected report” followed by the agency name and fiscal year. The OSA encourages early submission of reports to avoid findings for late reports. After its review of the AUP report for compliance with professional standards and the professional services contract, the OSA shall authorize the IPA to print and submit the final report. An electronic version of the AUP report, in PDF format, as described at Subsection B of 2.2.2.9 NMAC, shall all be delivered to the OSA within five business days. The OSA shall not release the AUP report until the electronic version of the report is received by the OSA. The OSA shall provide the local public body with a letter authorizing the release of the report after the required five-day waiting period. Released reports may be selected by the OSA for comprehensive report and workpaper reviews. After such a comprehensive report and workpaper review is completed, the OSA shall issue a letter to advise the IPA about the results of the review. The IPA shall respond to all review comments as directed. If during the course of its review, the OSA finds significant deficiencies that warrant a determination that the engagement was not performed in accordance with provisions of the contract, applicable AICPA standards, or the requirements of this rule, any or all of the following action(s) may be taken: (1) the IPA may be required to correct the deficiencies in the report or audit documentation, and reissue the AUP report to the agency and any others receiving copies; (2) the IPA’s eligibility to perform future engagements may be limited in number or type of engagement pursuant to Subsection D of 2.2.2.8 NMAC; (3) for future reports, for some or all contracts, the IPA may be required to submit working papers with the reports for review by t ficiencies in the report or audit documentation, and reissue the AUP report to the agency and any others receiving copies; (2) the IPA’s eligibility to perform future engagements may be limited in number or type of engagement pursuant to Subsection D of 2.2.2.8 NMAC; (3) for future reports, for some or all contracts, the IPA may be required to submit working papers with the reports for review by the OSA prior to the release of the report; or (4) the IPA may be referred to the New Mexico public accountancy board for possible licensure action. K. IPA independence: IPAs shall maintain independence with respect to their client agencies in accordance with the requirements of the current government auditing standards.