New
Mexico Register / Volume XXXVII, Issue 8 / April 21, 2026
TITLE 2 PUBLIC
FINANCE
CHAPTER 2 AUDITS OF
GOVERNMENTAL AGENCIES
PART 2 REQUIREMENTS
FOR CONTRACTING AND CONDUCTING AUDITS OF AGENCIES
2.2.2.1 ISSUING AGENCY: Office of the state auditor.
[2.2.2.1 NMAC -
Rp, 2.2.2.1 NMAC, 4/21/2026]
2.2.2.2 SCOPE: All agencies and local public bodies as
defined by the Audit Act and designated independent public accountants contracting
for and performing professional services related to the examination of
financial affairs and transactions of those agencies and local public bodies.
[2.2.2.2 NMAC -
Rp, 2.2.2.2 NMAC, 4/21/2026]
2.2.2.3 STATUTORY AUTHORITY: Audit Act, Section 12-6-12 NMSA 1978.
[2.2.2.3 NMAC - Rp, 2.2.2.3 NMAC, 4/21/2026]
2.2.2.4 DURATION: Permanent.
[2.2.2.4 NMAC - Rp, 2.2.2.4 NMAC, 4/21/2026]
2.2.2.5 EFFECTIVE DATE: April 21, 2026, unless a later date is cited
at the end of a section.
[2.2.2.5 NMAC -
Rp, 2.2.2.5 NMAC, 4/21/2026]
2.2.2.6 OBJECTIVE: The objective is to establish policies,
procedures, rules and requirements for contracting and conducting financial
audits, special audits, attestation engagements, performance audits, and
forensic accounting engagements for the examination of the financial affairs of
all governmental agencies and local public bodies of the state of New Mexico.
[2.2.2.6 NMAC -
Rp, 2.2.2.6 NMAC, 4/21/2026]
2.2.2.7 DEFINITIONS: In addition to the definitions in the Audit
Act, Section 12-6-2 NMSA 1978, the following definitions will apply to all
financial examinations performed under this rule:
A. Definitions beginning with the letter “A”:
(1) “AAG
GAS” means AICPA Audit and Accounting Guide - Government Auditing Standards
and Single Audits (latest edition).
(2) “AAG
SLV” means AICPA Audit and
Accounting Guide - State and Local Governments (latest edition).
(3) “Abuse” includes, but is not
limited to, behavior that is deficient or improper when compared with behavior
that a prudent person would consider reasonable and necessary business practice
given the facts and circumstances but excludes fraud and noncompliance with
provisions of laws, regulations, contracts, and grant agreements. Abuse also includes misuse of authority or
position for personal interests or for the benefit of another or those of an
immediate or close family member or business associate.
(4) “ACFR” means
the state of New Mexico’s annual comprehensive financial report.
(5) “Attestation engagement” means an
engagement to issue, or where an IPA issues, an examination, a review, AUP
report, or report on subject matter, or an assertion about subject matter that
is the responsibility of an agency or local public body, including engagements
performed pursuant to AICPA and GAGAS attestation standards and all engagements
pursuant to Subsection A of Section 12-6-3 NMSA 1978.
(6) “Audit”
means an examination of the financial affairs or performance of an agency or
local public body pursuant to the authority of the Audit Act, 12-6-1, et seq.,
NMSA 1978.
(7) “Audit documentation” means the
record of procedures performed, relevant evidence obtained, and conclusions
reached (terms such as working papers or workpapers are also sometimes used).
(8) “Auditor” means
designated independent public accountants, including auditors of the OSA,
performing audit or attestation work as defined in the Audit Act and the Public
Accountancy Act.
(9) “AICPA”
means American institute of certified public accountants.
(10) “AU-C”
means AICPA codification of U.S. auditing standards (clarified).
(11) “AUP”
means agreed upon procedures.
B. Definitions beginning with the letter
“B”: [RESERVED]
C. Definitions beginning with the letter
“C”:
(1) “Component
unit” means a legally separate
entity required to be reported in the financial statements of an agency or LPB
due to the entity’s close financial relationship with the primary agency or
LPB.
(2) “CPE” means continuing professional
education.
D. Definitions beginning with the letter
“D”: “DFA” means the New
Mexico department of finance and administration.
E. Definitions beginning with the letter
“E”: “ERB” means the New
Mexico educational retirement board.
F. Definitions
beginning with the letter “F”:
(1) “FCD”
means financial control division of DFA.
(2) “FDS” means financial data schedule.
(3) “Fraud” means obtaining
something of value through willful misrepresentations. This includes, but is not limited to,
fraudulent financial reporting, misappropriation of assets, corruption, and use
of public funds for activities prohibited by the constitution or laws of the
state of New Mexico. Fraudulent
financial reporting means intentional misstatements or omissions of amounts or
disclosures in the financial statements to deceive financial statement users,
which may include intentional alteration of accounting records,
misrepresentation of transactions, or intentional misapplication of accounting
principles. Misappropriation of assets
means theft of an agency’s or LPB’s assets, including theft of property,
embezzlement of receipts, or fraudulent payments. Corruption means bribery and other illegal
acts.
G. Definitions beginning with the letter
“G”:
(1) “GAAP” means generally accepted
accounting principles that are accepted in the United States of America.
(2) “GAAS” means generally accepted
auditing standards, which are systematic guidelines used by auditors when
conducting audits of an entity’s financial records in the United States of
America.
(3) “GAGAS” means generally
accepted government auditing standards, or the most recent revision of the
yellow book issued by the comptroller general of the United States.
(4) “GASB”
means governmental accounting standards board.
(5) “GASBS” means governmental
accounting standards board statements.
(6) “GSD”
means the New Mexico general services department.
H. Definitions beginning with the letter
“H”:
(1) “HCA” means the New Mexico health
care authority
(2) “HED”
means the New Mexico higher education department.
(3) “HUD” means the United States
department of housing and urban development.
I. Definitions beginning with the
letter “I”:
(1) “Independence” means both:
(a) independence of mind: The state of mind that permits the conduct of
an engagement without being affected by influences that compromise professional
judgment, thereby allowing an individual to act with integrity and exercise
objectivity and professional skepticism; and
(b) independence in appearance: The absence of circumstances that would cause
a reasonable and informed third party to reasonably conclude that the
integrity, objectivity, or professional skepticism of an audit organization or
member of the engagement team had been compromised.
(2) “IPA” means an independent
public accountant designated by the state auditor to perform financial audits,
special audits, attestation engagements, performance audits, and forensic
accounting engagements for the examination of the financial affairs of agencies
and local public bodies.
J. Definitions beginning with the
letter “J”: [RESERVED]
K. Definitions beginning with the letter “K”: [RESERVED]
L. Definitions beginning with the letter “L”:
(1) “LGD” means the local
government division of DFA.
(2) “LPB” means local public body
as defined in the Audit Act, Section 12-6-2 NMSA 1978.
M. Definitions beginning with the letter
“M”: “MT” means mountain time zone.
N. Definitions beginning with the letter
“N”:
(1) “NMAC” means New Mexico
administrative code.
(2) “NMSA” means New Mexico
statutes annotated.
(3) “Non-attestation engagement” means
any engagement that is not an attestation engagement, including, but not
limited to, services performed in accordance with the statement on standards
for consulting services or the statement on standards for forensic services, or
any other engagement that is not under Section 12-6-3 NMSA 1978, including
certain agency-initiated or other engagements in which the IPA’s role is to
perform an engagement, assist the client or testify as an expert witness in
accounting, auditing, taxation, or other matters, given certain stipulated
facts.
O. Definitions beginning with the letter
“O”: “Office” or “OSA” means the office of the state
auditor of New Mexico.
P. Definitions beginning with the
letter “P”:
(1) “PED” means the New Mexico public
education department.
(2) “PERA” means the New Mexico
public employee retirement association.
(3) “Primary
government” means the primary agency or primary local public body that a
component unit is attached to due to their financial relationship.
Q. Definitions beginning with the letter
“Q”: [RESERVED]
R. Definitions beginning with the letter
“R”:
(1) “REC”
means regional education cooperative.
(2) “Report” means a document issued as a
result of an annual financial and compliance audit, special audit, attestation
engagement, performance audit, forensic accounting engagement, or AUP
engagement regardless of whether the document is on the contractor’s letterhead
or signed by the contractor.
(3) “RHCA” means the New Mexico
retiree health care authority.
(4) “RSI” means required supplementary
information.
S. Definitions beginning with the
letter “S”:
(1) “SHARE”
means statewide human resources accounting and management reporting system.
(2) “SOC”
means system organization controls, which is an audit review in connection with
system-level controls of a service organization or entity-level controls of
other organizations.
(3) “SOC-1” means an audit that
provides an opinion regarding the controls as the service organization that are
likely to be relevant to user entities’ internal control over financial
reporting.
(4) “SOC-2” means an audit that
provides an opinion about controls at the service organization related to
security, availability, processing integrity, confidentiality, or privacy to
support users’ evaluations of their own system of internal control.
(5) “SOC-3” means an audit to
provide an opinion about the effectiveness of controls at the service
organization relevant to security, availability, processing integrity,
confidentiality, or privacy.
(6) “Special audit” means a
limited-scope audit of an agency’s or local public body’s financial affairs and
transactions, in whole or in part, including both attest engagements and
non-attest engagements, performance audits, forensic accounting engagements,
and any other engagement that is not part of the annual financial statement and
compliance audit, depending on designation or scope.
(7) “Special investigation” or “special
examination” means a limited-scope investigation into or examination of an
agency’s or local public body’s financial records and other information
designed to investigate allegations of waste, fraud, abuse, theft,
non-compliance, or misappropriation of funds, or to quantify the extent of such
losses.
(8) “State auditor” may refer to either the
elected state auditor of the state of New Mexico, or personnel of the office
designated by the state auditor.
T. Definitions beginning with the letter
“T”: “Tier” is established based on the
amount of each LPB’s annual revenue, pursuant to Section 12-6-3 NMSA 1978.
U. Definitions beginning with the letter
“U”:
(1) “Uniform guidance” means Title 2 U.S.
Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost
Principles, and Audit Requirements for Federal Awards.
(2) “U.S. GAO” means the United
States government accountability office.
V. Definitions beginning with the letter
“V”: [RESERVED]
W. Definitions beginning with the letter
“W”: “Waste” includes, but is not limited to, the
act of using or expending resources carelessly, extravagantly, or to no
purpose. Importantly, waste can include
activities that do not include abuse.
Rather waste relates primarily to mismanagement, inappropriate actions,
and inadequate oversight. Waste does not
necessarily involve fraud or illegal acts.
However, waste may be an indication of internal control weakness,
non-compliance, fraud, or illegal acts.
X. Definitions
beginning with the letter “X”: [RESERVED]
Y. Definitions beginning with the letter
“Y”: [RESERVED]
Z. Definitions beginning with the letter
“Z”: [RESERVED]
[2.2.2.7 NMAC -
Rp, 2.2.2.7 NMAC, 4/21/2026]
2.2.2.8 THE PROCUREMENT AND AUDIT PROCESS:
A. Firm
profiles: For an IPA to be included on the OSA’s list
of approved firms to perform audits, AUPs, and other attestation engagements,
an IPA shall submit a firm profile online annually on the fifth business day in
January, in accordance with the guidelines set forth herein. The OSA shall review each firm profile for
compliance with the requirements set forth in this rule. IPAs shall notify the state auditor of
changes to the firm profile as information becomes available. The state auditor shall approve contracts for
audit, AUPs, and other attestation engagements only with IPAs who have submitted a complete and correct firm
profile that has been approved by the OSA, and who have complied with all the
requirements of this rule, including but not limited to:
(1) Subsection
A of 2.2.2.14 NMAC, continuing professional education requirements for all
staff that the firm will use on any New Mexico governmental engagements;
(2) for
IPAs who have audited agencies under this rule in the past, they shall have
previously complied with: 2.2.2.9 NMAC,
report due dates, including notifying the state auditor regarding late audit
reports and 2.2.2.13 NMAC, review of audit reports and audit documentation.
B. List of approved firms: The state auditor shall maintain a list of
independent public accounting (IPA) firms that are approved and eligible to
compete for audit contracts, AUPs, and other attestation engagements with
agencies. The state auditor’s list of
approved firms shall be reviewed and updated on an annual basis. An IPA on the list of approved firms is
approved to perform government audits, AUPs, and other attestation engagements
for agencies and local public bodies until the list of approved firms is
published for the following year; provided that the OSA may restrict firms at
any time for failure to submit firm profile updates timely. An IPA that is included on the state
auditor’s list of approved firms for the first time may be subject to an OSA engagement
quality review of the IPA’s working papers for audits, AUPs and other
attestation engagements. This review
shall be conducted as soon as the documentation completion date, as defined by
AU-C Section 230, has passed (60 days after the report release date, as posted
on the OSA’s audit reports website). The state auditor shall approve contracts
for audits, AUPs and other attestation engagements only with IPA firms that
have submitted a complete and correct firm profile complying with all the
requirements set forth in this rule and that has been approved by the OSA. The OSA shall inform all IPAs whose firm
profiles were submitted by the due date whether they are on the list of
approved firms for audits, AUPs and other attestation engagements and shall
publish the list of approved firms concurrent with notification to government
agencies to begin the procurement process to obtain an IPA to conduct the
agency’s annual financial audit. Firms that only perform non-attestation
engagements, or otherwise do not meet applicable requirements, be included on
the list of approved firms with appropriate descriptors.
C. Disqualified
firms: An IPA firm may not be included on the list of
approved firms for audits, AUPs, and other attestation engagements if any of
the following applies to that IPA:
(1) the
firm received a peer review rating of “failed”;
(2) the
firm does not have a current New Mexico firm permit to practice, if applicable;
(3) the
firm profile does not include at least one certified public accountant with a
current CPA certificate who has met the GAGAS CPE requirements described at
Subsection A of 2.2.2.14 NMAC, to perform GAGAS audits (however, firms seeking
to contract only for AUP engagements will not be disqualified if GAGAS CPE
requirements have not been met);
(4) the
IPA has been restricted in the past and has not demonstrated improvement (this
includes submitting excessively deficient audit reports or having excessively
deficient workpapers);
(5) the
IPA made false statements in their firm profile or any other official
communication with the OSA that were misleading enough to merit
disqualification; or
(6) any
other reason determined by the state auditor to serve the interest of the state
of New Mexico.
D. Restriction:
(1) IPAs
may be placed on restriction based on the OSA’s review of the firm profile and
deficiency considerations as described below.
Restriction may take the form of limiting either the type of engagements
or the number of audit contracts, or both, that the IPA may hold. The OSA may impose a corrective action plan
associated with the restriction. The
restriction remains in place until the OSA notifies the IPA that the
restriction has been modified or removed.
The deficiency considerations include, but are not necessarily limited
to:
(a) failure
to submit reports in accordance with report due dates provided in Subsection A
of 2.2.2.9 NMAC, or the terms of their individual agency contract(s);
(b) failure
to submit late report notification letters in accordance with Subsection A of
2.2.2.9 NMAC;
(c) failure
to comply with this rule;
(d) poor
quality reports as determined by the OSA;
(e) poor
quality working papers as determined by the OSA;
(f) a
peer review rating of “pass with deficiencies” with the deficiencies being
related to governmental audits;
(g) failure
to contract through the OSA for New Mexico governmental audits or AUP
engagements;
(h) failure
to inform agency in prior years that the IPA is restricted;
(i) failure
to comply with the confidentiality requirements of this rule;
(j) failure
to invite the state auditor or the auditor's designee to engagement entrance
conferences, progress meetings or exit conferences after receipt of related
notification from the OSA;
(k) failure
to comply with OSA referrals or requests in a timely manner;
(l) suspension or debarment by the U.S.
general services administration;
(m) false statements in the IPA’s firm
profile or any other official communication with the OSA;
(n) failure to cooperate timely with
requests from successor IPAs, such as reviewing workpapers;
(o) failure to have required contracts approved by the
OSA; or
(p) any
other reason determined by the state auditor to serve the interest of the state
of New Mexico.
(2) The
OSA shall notify any IPA that it proposes to place under restriction. If the proposed restriction includes a
limitation on the number of engagements that an IPA is eligible to hold, the
IPA shall not submit proposals or bids to new agencies if the number of
multi-year proposals the IPA possesses at the time of restriction is equal to
or exceeds the limitation on the number of engagements for which the IPA is
restricted.
(3) An
IPA under restriction is responsible for informing the agency whether the
restricted IPA is eligible to engage in a proposed contract.
(4) If
an agency or local public body submits an unsigned contract to the OSA for an
IPA that was ineligible to perform that contract due to its restriction, the
OSA shall reject the unsigned contract.
E. Procedures for imposition of restrictions:
(1) The
state auditor may place an IPA under restriction in accordance with Subsection
D of 2.2.2.8 NMAC.
(a) The
state auditor or the auditor’s designee shall cause written notice of the
restriction to be sent by email and certified mail, return receipt requested,
to the IPA, which shall take effect as of the date of the letter of
restriction. The letter shall contain
the following information:
(i) the
nature of the restriction;
(ii) the
conditions of the restriction;
(iii) the
reasons for the restriction;
(iv) the
action to place the IPA on restriction is brought pursuant to Subsection A of
Section 12-6-3 NMSA 1978 and these regulations;
(v) the
IPA may request, in writing, reconsideration of the proposed contract
restriction which shall be received by the OSA within 15 calendar days from the
date of the letter of restriction; and
(vi) the
e-mail or street address where the IPA’s written request for reconsideration
shall be delivered, and the name of the person to whom the request shall be
sent.
(b) The
IPA’s written request for reconsideration shall include sufficient facts to
rebut on a point for point basis each deficiency noted in the OSA’s letter of
restriction. The IPA may request an
opportunity to present in person its written request for reconsideration and
provide supplemental argument as to why the OSA’s determination should be
modified or withdrawn. The IPA may be
represented by an attorney licensed to practice law in the state of New Mexico.
(c) The IPA shall have forfeited its
opportunity to request reconsideration of the restriction(s) if the OSA does
not receive a written request for reconsideration within 15 calendar days of
the date of the letter of restriction.
The state auditor may grant, for good cause shown, an extension of the
time an IPA has to submit a request for reconsideration.
(2) The
OSA shall review an IPA’s request for reconsideration and shall make a
determination on reconsideration within 15 calendar days of the IPA response
letter unless the IPA has asked to present its request for reconsideration in
person, in which case the OSA shall make a determination within 15 calendar
days from the date of the personal meeting.
The OSA may uphold, modify or withdraw its restriction pursuant to its
review of the IPA’s request for reconsideration, and shall notify the IPA of
its final decision in writing which shall be sent to the IPA via email and
certified mail, return receipt requested.
F. Procedures
to obtain professional services from an IPA: Concurrent with publication of the list of
approved firms, the OSA shall authorize agencies to select an IPA to perform
their annual audit or AUP engagement.
Agencies are prohibited from beginning the process of procuring IPA
services for annual audits or AUPs pursuant to Section 12-6-3 NMSA 1978 until
they receive the OSA authorization.
Agencies that wish to begin the IPA procurement process for their annual
audit or AUP pursuant to Section 12-6-3 NMSA 1978 prior to receiving OSA
authorization may request an exception, however any such exceptions granted by
OSA are subject to changes in the final audit rule applicable to the annual
audit or AUP pursuant to Section 12-6-3 NMSA 1978 and changes in restrictions
to, or disqualifications of, IPAs. The
notification shall inform the agency that it shall consult its prospective IPA
to determine whether the prospective IPA has been restricted by the OSA as to
the type of engagement or number of contracts it is eligible to perform. Agencies that may be eligible for the tiered
system shall complete the evaluation to determine the level of financial
reporting described in Subsection B of 2.2.2.16 NMAC. Agencies that receive and expend federal
awards shall follow the uniform guidance procurement requirements from 2 CFR
200.317 to 200.327 and 200.509, and shall also incorporate applicable guidance
from the following requirements.
Agencies shall comply with the following procedures to obtain
professional services from an IPA for an audit or AUP engagement.
(1) Upon
receipt of written authorization from the OSA to proceed, and at no time before
then unless OSA has granted an exception, the agency shall identify all
elements or services to be solicited pursuant to this rule and conduct a
procurement that includes each applicable element of the annual financial and
compliance audit, special audit, attestation engagement, performance audit,
forensic audit or AUP engagement.
(2) Quotations
or proposals for annual financial audits shall contain each of the following
elements:
(a) financial
statement audit;
(b) federal
single audit (if applicable);
(c) financial
statement preparation so long as the IPA has considered any threat to
independence and mitigated it;
(d) other
non-audit services (if applicable and allowed by current government auditing
standards); and
(e) other
(i.e., audits of component units such as housing authorities, charter schools,
foundations and other types of component units).
(3) Auditor
rotation rule: An IPA may not
provide services to an agency or LPB consecutively for more than eight years.
After the eighth consecutive year, the agency or LPB must obtain a proposal for
another IPA for at least two years before returning to the prior IPA.
(4) The
agency is encouraged to request multiple year proposals for audit and AUP
services, however the term of the contract shall be for one year only. The parties shall enter a new audit contract
each year. The agency is responsible for
procuring IPA services in accordance with all applicable laws and regulations
which may include, but are not limited to, the State Procurement Code (Chapter
13, Article 1 NMSA 1978) or equivalent home rule procurement provisions; GSD
Rule 1.4.1 NMAC, Procurement Code Regulations, if applicable; DFA Rule, 2.40.2 NMAC, Governing the Approval of
Contracts for the Purchase of Professional Services; Uniform Guidance; and
Section 13-1-191.1 NMSA 1978 regarding campaign contribution disclosure
forms. If either of the parties to the
contract elects not to contract for all of the years contemplated by a multiple
year proposal, or the state auditor disapproves the contract, the agency shall
use the procedures described above to procure services from a different IPA.
(5) If
the agency is a component unit of a primary government, the agency’s
procurement for audit services shall include the AU-C 600 (group audits)
requirements for the IPA to communicate and cooperate with the group engagement
partner and team, and the primary government.
This requirement applies to agencies and universities that are part of
the statewide ACFR, other component units of the statewide ACFR and other
component units of any primary government that use a different audit firm from
the primary government’s audit firm.
Costs for the IPA to cooperate with the group engagement partner and
team, and the primary government, caused by the requirements of AU-C 600 (group
audit) may not be charged in addition to the cost of the engagement, as the OSA
views this in the same manner as compliance with any other applicable standard.
(6) Agencies
are encouraged to include representatives of the offices of separately elected
officials such as county treasurers, and component units such as charter
schools and housing authorities, in the IPA selection process. As part of their evaluation process, the OSA
recommends that agencies consider the following when selecting an IPA for their
annual audit or AUP pursuant to Section 12-6-3 NMSA 1978:
(a) responsiveness
to the request for proposal (the firm’s integrity, record of past performance,
financial and technical resources);
(b) relevant
experience, availability of staff with professional qualifications and
technical abilities;
(c) results
of the firm’s external peer and external quality control reviews; and
(d) weighting
the price criteria less than fifteen percent of the total criteria taken into
consideration by the evaluation process or selection committee.
Upon the OSA’s
request, the agency shall make accessible to the OSA all of the IPA procurement
and selection documentation.
(7) After
selecting an IPA for their annual audit or AUP pursuant to Section 12-6-3 NMSA
1978, each agency shall enter the appropriate requested information online on
the OSA-Connect website at osaconnect.osa.nm.gov. To do this, the agency shall register on
OSA-Connect and obtain a user-specified password. The agency’s user shall then use OSA-Connect
to enter information necessary for the contract and for the OSA’s evaluation of
the IPA selection. After the agency
enters the information, the OSA-Connect system generates a draft contract
containing the information entered. The
agency shall submit to the OSA for approval a copy of the unsigned draft
contract by following the instructions on OSA-Connect.
(8) The
OSA shall notify the agency as to the OSA’s approval or rejection of the
selected IPA and contract. The OSA’s
review of audit contracts does not include evaluation of compliance with any
state or local procurement laws or regulations; each agency is responsible for
its own compliance with applicable procurement laws, regulations or
policies. After the agency receives
notification of approval of the selected IPA and contract from the OSA, the
agency is responsible for getting the contract signed and sent to any oversight
agencies for approval (if applicable).
The OSA shall not physically sign the contract. After the agency obtains all the required
signatures and approvals of the contract, the agency shall, within three weeks
of OSA’s approval of the contract, submit a copy of the fully executed contract
in an electronic portable document format (PDF) by uploading it in OSA-Connect.
(9) The
agency shall submit the unsigned contract generated by OSA-Connect to the OSA by the due date
shown below; submission prior to the due date shown below is permissible. If the due date falls on a weekend or
holiday, the due date shall be the next business day. If the unsigned contract is not submitted to
the state auditor by these due dates, the IPA may, according to professional
judgment, include a finding of non-compliance with Subsection F of 2.2.2.8 NMAC
in the audit report or AUP report.
(a) RECs,
cooperative educational services, independent housing authorities, hospitals
and special hospital districts: April 15;
(b) school
districts, counties, and higher education: May 1;
(c) incorporated
counties (of which Los Alamos is the only one), local workforce investment
boards and local public bodies with a June 30 year end that do not qualify for
the tiered system: May 15;
(d) councils
of governments, district courts, district attorneys, state agencies: June 1 and
the state of New Mexico ACFR: July 31;
(e) local
public bodies that qualify for the tiered system pursuant to Subsections A and
B of 2.2.2.16 NMAC with a June 30 fiscal year end: July 30;
(f) local
public bodies that qualify for the tiered system pursuant to Subsections A and
B of 2.2.2.16 NMAC with a fiscal year end other than June 30 shall use a due
date 30 days after the end of the fiscal year;
(g) agencies
and local public bodies that do not qualify for the tiered system with a fiscal
year end other than June 30 shall use a due date 30 days before the end of the
fiscal year;
(h) component
units that are being separately audited: on the primary government’s due date;
(i) Charter
schools that are chartered by the PED and agencies that are subject to
oversight by the HED have the additional requirement of submitting their audit
contract to PED or HED for approval (Section 12-6-14 NMSA 1978); and
(j) If
the agency’s unsigned contract is submitted to the OSA, but is not approved by
the state auditor, the state auditor shall promptly communicate the decision,
including the reason(s) for disapproval, to the agency, at which time the
agency shall promptly submit a contract with a different IPA using
OSA-Connect. This process shall continue
until the state auditor approves an unsigned contract. During this process, whenever an unsigned
contract is not approved by the state auditor, the agency may submit a written
request to the state auditor for reconsideration of the disapproval. The agency shall submit its request no later
than 15 calendar days after the date of the disapproval and shall include
documentation in support of its IPA selection.
If warranted, after review of the request, the state auditor may hold an
informal meeting to discuss the request.
The state auditor shall set the meeting in a timely manner with
consideration given to the agency’s circumstances.
(10) The agency shall retain all procurement
documentation, including completed evaluation forms, for five years and in
accordance with applicable public records laws.
(11) If
the agency fails to submit an unsigned contract by the due date set forth in
this rule, or, if no due date is applicable, within 60 days of notification
from the state auditor to engage an IPA, the state auditor may conduct the
audit or select the IPA for that agency.
The reasonable costs of such an audit shall be borne by the agency
audited unless otherwise exempted pursuant to Section 12-6-4 NMSA 1978.
(12) In
selecting an IPA for an agency pursuant to Subsection F of 2.2.2.8 NMAC the
state auditor shall at a minimum consider the following factors, but may
consider other factors in the state auditor’s discretion that serve the best
interest of the state of New Mexico and the agency:
(a) the
IPA shall be drawn from the list of approved IPAs maintained by the state
auditor;
(b) an
IPA subject to restriction pursuant to Subsection D of 2.2.2.8 NMAC, is
ineligible to be selected under this paragraph;
(c) whether
the IPA has conducted one or more audits of similar government agencies;
(d) the
physical proximity of the IPA to the government agency to be audited;
(e) whether
the resources and expertise of the IPA are consistent with the audit
requirements of the government agency to be audited;
(f) the
IPA’s cost profile, including examination of the IPA’s fee schedule and blended
rates;
(g) the
state auditor shall not select an IPA in which a conflict of interest exists
with the agency or that may be otherwise impaired, or that is not in the best
interest of the state of New Mexico.
(13) The
state auditor shall consider, at a minimum, the following factors when
considering which agencies shall be subject to the state auditor’s selection of
an IPA:
(a) whether
the agency is demonstrating progress in its own efforts to select an IPA;
(b) whether
the agency has funds to pay for the audit;
(c) whether
the agency is on the state auditor’s “at risk” list;
(d) whether
the agency is complying with the requirements imposed on it by virtue of being
on the state auditor’s “at risk” list;
(e) whether
the agency has failed to timely submit its e-mailed draft unsigned contract
copy in accordance with the audit rule on one or more occasions;
(f) whether
the agency has failed to timely submit its annual financial audit report in
accordance with the audit rule due dates on one or more occasions.
(14) The
state auditor may appoint a committee of the state auditor’s staff to make
recommendations for the state auditor’s final determination as to which IPAs
shall be selected for each government agency subject to the discretion of the
state auditor.
(15) Upon selection of an IPA to audit a
government agency subject to the discretion of the state auditor, the state
auditor shall notify the agency in writing regarding the selection of an IPA to
conduct its audit. The notification
letter shall include, at a minimum, the following statements:
(a) the
agency was notified by the state auditor to select an IPA to perform its audit
or AUP engagement;
(b) 60
days or more have passed since such notification, or the applicable due date in
this rule has passed, and the agency failed to deliver its draft contract in
accordance with this subsection;
(c) pursuant
to Subsection A of Section 12-6-14 NMSA 1978, the state auditor is selecting
the IPA for the agency;
(d) delay
in completion of the agency’s audit is contrary to the best interest of the
state and the agency, and threatens the functioning of government and the
preservation or protection of property;
(e) in
accordance with Section 12-6-4 NMSA 1978, the reasonable costs of such an audit
shall be borne by the agency unless otherwise exempted; and
(f) selection
of the IPA is final, and the agency shall immediately take appropriate measures
to procure the services of the selected IPA.
G. State auditor approval/rejection
of unsigned contract: The state auditor shall use discretion and may reject unsigned
contracts as follows:
(1) An
unsigned audit contract, special audit contract, attestation engagement
contract, performance audit contract, forensic accounting engagement contract
or AUP professional services contract under 2.2.2.16 NMAC that does not serve
the best interests of the public or the agency or local public body because of
one or more of the following reasons:
(a) lack
of experience of the IPA;
(b) failure
to meet the auditor rotation requirements as follows: the IPA is prohibited
from conducting the agency audit for a period of two years because the IPA
already conducted those services for that agency for a period of eight consecutive
years;
(c) lack of competence or staff
availability;
(d) circumstances
that may cause untimely delivery of the audit report or AUP report;
(e) unreasonably
high or low cost to the agency or local public body;
(f) terms
in the proposed contract that the state auditor considers to be unfavorable,
unfair, unreasonable, or unnecessary;
(g) lack
of compliance with the procurement code, the audit act, or this rule;
(h) the
agency giving too much consideration to the price of the IPA’s response to the
request for bids or request for proposals in relation to other evaluation
criteria;
(i) newness of the IPA to the state
auditor’s list of approved firms;
(j) noncompliance
with the requirements of Section 12-6-3 NMSA 1978 of the Audit Act by the
agency for previous fiscal years; or
(k) any
other reason determined by the state auditor to be in the best interest of the
state of New Mexico.
(2) An audit contract, special audit
contract, attestation engagement contract, performance audit contract, or
forensic accounting engagement contract or AUP contract of an IPA that has:
(a) breached
a prior-year contract;
(b) failed
to deliver an audit or AUP report on time;
(c) failed to comply with state laws or
regulations of the state auditor;
(d) performed
non-audit services (including services related to fraud) for an agency or local
public body it is performing an audit, special audit, attestation engagement,
performance audit, forensic accounting engagement or an AUP for, without prior
approval of the state auditor;
(e) performed
non-audit services under a separate contract for services that may be
disallowed by GAGAS independence standards;
(f) failed to respond, in a timely and
acceptable manner, to an OSA audit, special audit contract, attestation
engagement contract, performance audit contract, forensic accounting engagement
contract, AUP report review or working paper review;
(g) impaired
independence during an engagement;
(h) failed
to cooperate in providing prior-year working papers to successor IPAs;
(i) not adhered to external peer review
standards as defined by GAGAS and 2.2.2.14 NMAC;
(j) has a history of excessive errors or
omissions in reports or working papers;
(k) released
the audit report or AUP report to the agency, local public body or the public
before the audit release letter or the OSA letter releasing the AUP report was
received from the OSA;
(l) failed
to submit a completed signed contingency subcontractor form, if required;
(m) failed
to submit a completed firm profile as required by Subsection A of 2.2.2.8 NMAC
or failed to include all staff in the firm profile who would be working on the
firm’s engagements;
(n) reached
the limit of contracts to which the state auditor restricted the IPA;
(o) failed to respond to communications
from the OSA or engagement clients within a reasonable amount of time; or
(p) otherwise,
in the opinion of the state auditor, the IPA was unfit to be awarded a
contract.
(3) An
audit contract, special audit contract, attestation engagement contract,
performance audit contract, forensic accounting engagement contract or AUP
contract for an IPA received by the OSA, which the state auditor decides to
perform himself with or without the assistance of an IPA, and pursuant to
Section 12-6-3 NMSA 1978, even if the agency or local public body was
previously designated for audit or AUP to be performed by an IPA.
H. Audit contract requirements: The agency shall use OSA-Connect at osaconnect.osa.nm.gov
to submit the appropriate audit or AUP engagement contract. The OSA may provide audit or AUP engagement
contract forms to the agency via facsimile, e-mail, or U.S. mail if
specifically requested by the agency.
Only contract templates generated through OSA-Connect shall be accepted
and shall:
(1) be
completed and submitted in its unsigned form by the due date indicated at
Subsection F of 2.2.2.8 NMAC;
(2) for all agencies whose contracts are
approved through the GSD’s contracts review bureau, have the IPA’s business tax
identification number verified by the New Mexico taxation and revenue
department after approval by the state auditor; and
(3) in
the compensation section of the contract, include the dollar amount that
applies to each element of the contracted procedures that shall be performed;
I. Professional liability insurance: The IPA shall maintain professional liability
insurance covering any error or omission committed during the term of the
contract. The IPA shall provide proof of
such insurance to the state auditor with the firm profile. The amount maintained should be commensurate
with the risk assumed. The IPA shall
provide to the state auditor, prior to expiration, updated insurance
information.
J. Breach of contract: A breach of any terms of the contract shall
be grounds for immediate termination of the contract. The injured party may seek damages for such
breach from the offending party. Any IPA
who knowingly makes false statements, assurances, or disclosures may be
disqualified from conducting audits or AUP engagements of New Mexico
governmental agencies.
K. Subcontractor requirements:
(1) Audit
firms that have only one individual qualified to supervise a GAGAS audit and
issue the related audit report pursuant to Section 61-28B-17 NMSA 1978 shall
submit with the firm profile, a completed contingency subcontractor form that
is dated to be effective until the date the next firm profile shall be
submitted. The form shall indicate which
IPA on the state auditor’s current list of approved IPAs shall complete the
IPA’s audits if the one individual with the qualifications described above
becomes incapacitated and unable to complete the audit. See the related contingency subcontractor
form available at osa.nm.gov. The OSA
shall not approve audit contracts for such a firm without the required
contingency subcontractor form.
(2) If
an IPA chooses to use a subcontractor to assist the IPA in working on a
specific audit, then the IPA shall submit a subcontract with the reason for
subcontracting a portion of the audit work to the OSA for approval. The IPA may subcontract only with IPAs on the
approved IPA list. Subcontractors are
subject to an independence analysis, which may include the auditor rotation
rule requirements of Subsection F of 2.2.2.8 NMAC.
(3) “Technical review contracts” are
considered subcontracting and are subject to the requirements of this
section. The audit contract shall
specify subcontractor responsibility, who shall sign the report(s), and how the
subcontractor shall be paid. For
additional information see the subcontract work section of the OSA website.
L. IPA
independence: IPAs shall maintain independence with respect
to their client agencies in accordance with the requirements of the current government auditing standards.
M. Progress Payments: The state auditor shall approve progress and
final payments for the annual audit contract as follows:
(1) Subsection
A of Section 12-6-14 NMSA 1978 (contract audits) provides that “payment of
public funds may not be made to an independent auditor unless a contract is
entered into and approved as provided in this section.”
(2) Subsection
B of Section 12-6-14 NMSA 1978 (contract audits) provides that “based upon
demonstration of work in progress, the state auditor may authorize progress
payments to the independent auditor by the agency being audited under
contract.” Such payments shall be made on the basis of evidence of the
percentage of audit work completed as of the date of the request for partial
payment.
(3) Progress
payments up to seventy percent do not require state auditor approval provided
that the agency certifies the receipt of services before any payments are made
to the IPA. If the report has been
submitted, progress payments up to eighty-five percent do not require state
auditor approval. The agency shall
monitor audit progress and make progress payments only up to the percentage
that the audit is completed. If
requested by the state auditor, the agency or the IPA shall provide a copy of
the approved invoices and progress billing(s).
Progress payments between seventy percent and ninety-five percent if no
report has been submitted, or eighty-five and ninety-five percent if a report
has been submitted, require state auditor approval after being approved by the
agency. When component unit audits are
part of a primary government’s audit contract, requests for progress payments
on the component unit audit(s) shall be included within the primary
government’s request for progress payment approval. In this situation, the OSA shall not process
separate progress payment approvals submitted by the component unit.
(4) The
state auditor may limit progress payments allowed to be made without state
auditor approval for an IPA whose previous audits were submitted after the due
date specified in Subsection A of 2.2.2.9 NMAC to only the first fifty percent
of the total fee.
(5) Section
12-6-14 NMSA 1978 (contract audits) provides that final payment under an audit
contract may be made by the agency to the IPA only after the state auditor has
determined, in writing, that the audit has been made in a competent manner in
accordance with contract provisions and this rule. The state auditor's determination with
respect to final payment shall be communicated as follows:
(a) stated
in the letter accompanying the release of the report to the agency; or
(b) in
the case of ongoing law enforcement investigations, stated in a letter prior to
the release of the report to the agency.
In no circumstance may the total
billed by the IPA under the audit contract exceed the total contract amount, as
amended if applicable. Further, as the
compensation section of the contract shall include the dollar amount that
applies to each element of the contracted procedures that shall be performed,
if certain procedures, such as a single audit, are determined to be unnecessary
and are not performed, the IPA may not bill the agency for these services. Final payment to the IPA by the agency prior
to review and release of the audit report by the state auditor is considered a
violation of Section 12-6-14 NMSA 1978 and this rule and shall be reported as
an audit finding in the audit report of the agency. If this statute is violated, the IPA may be
removed from the state auditor’s list of approved auditors.
N. Contract amendment requirements:
(1) Contract
amendments to contracts for audit services, AUP services, or non-attestation
services shall be submitted to the OSA regarding executed contracts. Contracts may not be amended after they
expire. The contract should be amended
prior to the additional work being performed or as soon as practicable
thereafter. The agency shall use
OSA-Connect at osaconnect.osa.nm.gov to submit the appropriate draft audit or
AUP engagement contract amendment. The
OSA’s review of audit contracts and amendments does not include an evaluation
of compliance with the state procurement code or other applicable
requirements. Although the parties may
amend the delivery dates in a contract, audit report regulatory due dates
cannot be modified by amendment. The
OSA’s review of audit contract amendments does not include evaluation of
compliance with any state or local procurement laws or regulations; each agency
is responsible for its own compliance with applicable procurement laws,
regulations, or policies.
(2) Contract amendments submitted for
state auditor approval shall include a detailed explanation of:
(a) the
work to be performed and the estimated hours and fees required for completion
of each separate professional service contemplated by the amendment; and
(b) how
the work to be performed relates to the scope of work outlined in the original
contract.
(3) Because
annual financial audit contracts are fixed-price contracts, contract amendments
for fee increases shall only be approved if there is a significant change in
the scope of an audit. For example, if
an audit contract did not include a federal single audit, a contract amendment
shall be approved if a single audit is required. Other examples of significant changes in the
scope of an audit include: the addition of a new program, function or
individual fund that is material to the government-wide financial statements;
the addition of a component unit; and the addition of special procedures
required by this rule, a regulatory body or a local, state, or federal
grantor. Contract amendments shall not
be approved to perform additional procedures to achieve an unmodified
opinion. The state auditor shall also
consider the auditor independence requirements of Subsection L of 2.2.2.8 NMAC
when reviewing contract amendments for approval. The OSA shall review amendment requests and
respond to the agency and the IPA within 30 calendar days of receipt.
(4) If
a proposed contract amendment is rejected for lack of adequate information, the
IPA and agency may submit a corrected version for reconsideration.
O. Termination of audit contract requirements:
(1) The state auditor may terminate an
audit contract to be performed by an IPA after determining that the audit has
been unduly delayed, or for any other reason, and perform the audit entirely or
partially with IPAs contracted by the OSA.
The OSA shall provide written notice of the contract termination to the
IPA and the agency or LPB.
(2) If the agency or IPA terminates the
audit or AUP engagement contract pursuant to the termination paragraph of the
contract, the OSA shall be notified of the termination immediately. The party sending out the termination
notification letter shall simultaneously send a copy of the termination
notification letter to the OSA with an appropriate cover letter, addressed to
the state auditor.
(a) The
agency is responsible for procuring the services of a new IPA in accordance
with all applicable laws and regulations, and this rule.
(b) The unsigned contract for the newly
procured IPA shall be submitted to the OSA within 30 calendar days of the date
of the termination notification letter.
(c) As
indicated in Subsection A of 2.2.2.9 NMAC, the state auditor shall not grant
extensions of time to the established regulatory due dates.
(d) If
the IPA does not expect to deliver the engagement report by the regulatory due
date, the IPA shall submit a written notification letter to the state auditor
and oversight agency as required by Subsection A of 2.2.2.9 NMAC or Subsection H
of 2.2.2.16 NMAC.
[2.2.2.8 NMAC - Rp, 2.2.2.8 NMAC,
4/21/2026]
2.2.2.9 REPORT
DUE DATES:
A. Report due dates: The IPA shall deliver the electronic draft
annual financial audit report to the state auditor by 11:59 p.m. MT on the date
specified in the audit contract and send it electronically by the due date.
IPAs and agencies are encouraged to perform interim work as necessary and
appropriate to meet the following due dates.
(1) The
audit report due dates are as follows:
(a) RECs,
cooperative educational services and independent housing authorities: September 30;
(b) hospitals
and special hospital districts: October
15;
(c) higher
education, state agencies not specifically named elsewhere in this subsection,
district courts, district attorneys, the New Mexico finance authority, the New
Mexico lottery authority, and other agencies with June 30 fiscal year-ends that
are reported as component units in the state of New Mexico ACFR: November 1;
(e) PED,
New Mexico department of homeland security and emergency management, the state
investment council, PERA, ERB and RHCA:
the Wednesday before Thanksgiving day;
(f) counties, incorporated counties (of
which Los Alamos is the only one), workforce investment boards, councils of
governments, the New Mexico mortgage finance authority, and the state of New
Mexico component appropriation funds (state general fund): December 1;
(g) local
public bodies and municipalities:
December 15;
(h) the
state of New Mexico ACFR: December 31;
(i) PERA,
ERB and RHCA schedules of employer allocations reports and related employer
guides required by Subsections Y and AA of 2.2.2.10 NMAC: June 15;
(j) agencies
with a fiscal year-end other than June 30 shall submit the audit report no
later than five months after the fiscal year-end;
(k) regarding
component unit reports (e.g., housing authorities, charter schools, hospitals,
foundations, etc.), all separate audit reports prepared by an auditor that is
different from the primary government’s auditor, are due fifteen days before the primary government’s audit report is due,
unless some other applicable due date requires the report to be submitted
earlier;
(l) any agency that requires its report
to be released by any specific date (e.g., due to board meeting, federal
reporting, etc.): the earlier of its agency due date or one month prior to the
requested release date; and
(m) late
audit or AUP reports of any agency (not performed in the current reporting
period): not more than six months after the date the contract was executed.
(2) If an audit report is not delivered on
time to the state auditor, the auditor shall include this instance of
non-compliance with Subsection A of 2.2.2.9 NMAC as an audit finding in the
audit report. This requirement is not
negotiable. If appropriate, the finding
may also be reported as a significant deficiency or material weakness in the
operation the agency’s internal controls over financial reporting pursuant to
AU-C 265.
(3) An
electronic copy of the report shall be submitted for review by the OSA with the
following: copy of the signed management
representation letter and a copy of the completed state auditor report review
guide (available at osa.nm.gov). A
report shall not be considered submitted to the OSA for the purpose of meeting
the due date until a copy of the signed management representation letter and
the completed report review guide are also submitted to the OSA. All separate reports prepared for component
units shall also be submitted to the OSA for review, along with a copy of the
management representation letter, and a completed report review guide for each
separate audit report. A separate
component unit report shall not be considered submitted to the OSA for the
purpose of meeting the due date until a copy of the signed management
representation letter and the completed report review guide are also submitted
to the OSA. If a due date falls on a
weekend or holiday, or if the OSA is closed due to inclement weather, the audit
report is due the following business day by 11:59 p.m. MT.
(4) AU-C 700.43 requires that the
auditor’s report should be dated no earlier than the date on which the auditor
has obtained sufficient appropriate audit evidence on which to base the
auditor’s opinion on the financial statements, including evidence that all
statements and disclosures that the financial statements comprise have been
prepared and that management has asserted that it has taken responsibility for
those financial statements. AU-C 580.20
requires that the management representation letter be dated the same date as
the independent auditor’s report.
(5) As
soon as the auditor becomes aware that circumstances exist that will make an
agency’s audit report be submitted after the applicable due date provided in
Subsection A of 2.2.2.9 NMAC, the auditor shall notify the state auditor in
writing. This notification shall consist
of a letter, not an email. However, a
scanned version of the official letter sent via email is acceptable. The late audit notification letter is subject
to the confidentiality requirements detailed at Subsection M of 2.2.2.10 NMAC. This does not prevent the state auditor from
notifying the legislative finance committee or applicable oversight agency
pursuant to Subsections F and G of Section 12-6-3 NMSA 1978. There shall be a separate notification for
each late audit report. The notification
shall include a specific explanation regarding why the report will be late,
when the IPA expects to submit the report and a concurring signature by a duly
authorized representative of the agency.
If the IPA is going to miss the expected report submission date, then
the IPA shall send a revised notification letter. If the contract was signed after the report
due date, the notification letter shall still be submitted to the OSA
explaining the reason the audit report will be submitted after the report due
date. The late report notification
letter is not required if the report was submitted to the OSA for review by the
due date, and then rejected by the OSA, making the report late when
resubmitted. Reports resubmitted to the
OSA with changes of the IPA’s opinion after the report due date shall be
considered late and a late audit finding shall be included in the audit report.
(6) The due date of any report not listed
in Subsection A of 2.2.2.9 NMAC shall be the date specified in the contract.
B. Delivery
and release of the audit report:
(1) The
IPA shall deliver to the state auditor an editable electronic copy of the audit
report for review by 11:59 p.m. MT on the day the report is due. Unfinished or excessively deficient reports
shall not satisfy this requirement; such reports shall be rejected and returned
to the IPA and the OSA may take action in accordance with Subsection C of
2.2.2.13 NMAC. When the OSA rejects and
returns a substandard audit report to the IPA, the OSA shall consider the audit
report late if the corrected report is not resubmitted by the due date. The IPA shall also report a finding for the
late audit report in the audit report.
The firm shall submit an electronic version of the corrected rejected
report for OSA review. The name of the
electronic file shall be “corrected rejected report” followed by the agency
name and fiscal year.
(2) Before
initial submission, the IPA shall review the report using the appropriate
report review guide available on the OSA’s website. The report review guide shall reference
applicable page numbers in the audit report.
The audit manager or person with appropriate authority under the IPA’s
system of quality management shall either complete the report review guide or
sign off as having reviewed it. All
questions in the guide shall be answered, and the reviewer shall sign and date
the last page of the guide. If the
review guide is not accurately completed or incomplete, the report shall not be
accepted.
(3) All
reports prepared by IPAs shall be addressed to the state auditor, the agency
executive and governing body (if applicable).
Reports prepared by the OSA will be addressed to the agency executive
and governing body (if applicable). The
OSA will review all audit reports submitted by the report due date before
reviewing reports that are submitted after the report due date. Once the review of the report is completed
pursuant to Subsection A of 2.2.2.13 NMAC, the OSA will issue an “OSA review
notes” communication that lists any comments, corrections, or issues that are
required to be addressed by the IPA prior to final submission to the OSA. Within five days of receipt of the “OSA
review notes” communication, the IPA shall submit the corrected report with the
following items to the OSA: an electronic searchable version of the audit
report labeled “final” in PDF format, a written response to any OSA comments,
corrections, and issues, and an electronic excel version of the summary of
findings report and any other required electronic schedule if applicable, and
an electronic excel version of the schedule of asset management costs for
investing agencies, if applicable (all available at osa.nm.gov). The OSA will not release the report until all
comments, corrections, and issues have been addressed and the searchable
electronic PDF version of the report and all required electronic excel
schedules have been received. The electronic file containing the
final audit report shall:
(a) be created and saved as a PDF document
in a single PDF file format (simply naming the file using a PDF extension .pdf
does not by itself create a PDF file);
(b) be
version 5.0 or newer;
(c) not
exceed 10 megabytes (MB) per file submitted (contact the OSA to request an
exception if necessary);
(d) have
all security settings like self-sign security, user passwords, or permissions
removed or deactivated so the OSA is not prevented from opening, viewing, or
printing the file;
(e) not
contain any embedded scripts or executables, including sound or movie
(multimedia) objects;
(f) have
a file name that ends with .pdf;
(g) be
free of worms, viruses or other malicious content (a file with such content
shall be deleted by the OSA);
(h) be “flattened” into a single layer
file prior to submission;
(i) not
contain any active hypertext links, or any internal/external links (although it
is permissible for the file to textually reference a URL as a disabled link);
(j) be saved at 300 dots per inch (DPI)
(lower DPI makes the file hard to read and higher DPI makes the file too
large);
(k) have a name that starts with the OSA
agency number, followed by the agency name, the fiscal year, and “final”; and
(l) be
searchable.
(4) The
IPA shall deliver to the agency the number of copies of the audit report
indicated in the audit contract only after the state auditor has officially
released the audit report with a “release letter.”
(a) The audited agency may waive the
five-day waiting period required by Section 12-6-5 NMSA 1978. To do so, the agency’s governing authority or
the governing authority’s designee must provide written notification to the OSA
of the waiver. The notification must be
signed by the agency’s governing authority or the governing authority’s
designee and be sent via letter, e-mail or fax to the attention of the state
auditor. The OSA encourages agencies
wishing to waive the five-day waiting period to provide the written
notification prior to the submission
of the final report to the OSA.
(b) The IPA shall deliver to the agency
the number of copies of the audit report indicated in the audit contract only
after the state auditor has officially released the audit report with a
“release letter”. Release of the audit
report to the agency or the public prior to it being officially released by the
state auditor shall result in an audit finding.
(5) After the release of a report, the OSA
shall provide DFA and the legislative finance committee with notification that
the report is available on the OSA website.
(6) If
an audit report is reissued pursuant to AU-C 560, subsequent events and
subsequently discovered facts, or AAG GAS 13.29-.31 for uniform guidance
compliance reports, the reissued audit report shall be submitted to the OSA
with a cover letter addressed to the state auditor. The cover letter shall explain that:
(a) the
attached report is a “reissued” report;
(b) the
circumstances that caused the reissuance; and
(c) a
summary of the changes that appear in the reissued report. The OSA shall subject the reissued report to
the report review process and upon completion of that report review process,
shall issue a “release letter.” The
contents of the reissued audit report are subject to the confidentiality
requirements described in Subsection M of 2.2.2.10 NMAC. Agency management and the IPA are responsible
for ensuring that the latest version of the report is provided to each
recipient of the prior version of the report.
The OSA shall notify the appropriate oversight agencies regarding the
updated report on the OSA website.
(7) If
changes to a released audit report are submitted to the OSA, and the changes do
not rise to the level of requiring a reissued report, the IPA shall submit a
cover letter addressed to the agency, with a copy to the state auditor, which
includes the following minimum elements:
(a) a
statement that the changes did not rise to the level of requiring a reissued
report;
(b) a
description of the circumstances that caused the resubmitted updated report;
and
(c) a
summary of the changes that appear in the resubmitted updated report compared
to the prior released report. Agency
management and the IPA are responsible for ensuring that the latest version of
the resubmitted report is provided to each recipient of the prior version of
the report. The OSA shall notify the
appropriate oversight agencies regarding the updated report on the OSA website.
C. Required status reports: For an agency that has failed to submit audit
reports as required by this rule, and has therefore been designated as late,
the state auditor requires the agency to submit written status reports to the
OSA on each March 15, June 15, September 15, and December 15 unless and until
the late audit report has been submitted.
Status reports shall be signed by a member of the agency’s governing
authority, a designee of the governing authority or a member of the agency’s
top management. If the agency has a contract
with an IPA to conduct the audit, the agency must send the IPA a copy of the
quarterly status report. IPAs engaged to
audit agencies with late reports are responsible for assisting these agencies
in complying with the reporting requirements of this section. Failure to do so shall be noted by the OSA
and taken into account during the IPA firm profile evaluation process. At a minimum, the quarterly written status
report shall include:
(1) a
detailed explanation of the agency’s efforts to complete and submit its audit;
(2) the
current status of any ongoing audit work;
(3) any
obstacles encountered by the agency in completing its audit; and
(4) a projected completion date for the
financial audit report.
[2.2.2.9 NMAC - Rp,
2 2.2.9 NMAC, 4/21/2026]
2.2.2.10 GENERAL CRITERIA:
A. Annual financial and compliance audits:
(1) The
financial audit shall cover the entire financial reporting entity including the
primary government and the component units of the primary government, if
any. For any financial and compliance
audit the agency should produce all documents necessary to conduct the
engagement.
(a) The
primary government shall determine whether an agency that is a separate legal
entity from the primary government is a component unit of the primary
government as defined by GASBS 14, 39, 61, and 80 (as amended). The flowchart at GASBS 61.68 may be useful in
making this determination. The primary
government shall notify all other agencies determined to be component units by
September 15 of the subsequent fiscal year.
Failure to meet this due date results in a compliance finding. IPAs shall use GASB guidelines as found in
relevant GASBS to determine the correct presentation of the component
unit. All agencies that meet the
criteria to be a component unit of the primary government shall be included
with the audited financial statements of the primary government by discrete
presentation or blended, as appropriate. Component units are reported using the
government financial reporting format.
Component units of component units are also subject to OSA review, and
must be reported using the government financial reporting format. If a component unit does not qualify to be
reported using the governmental format and is not statutorily required to be
reported using the governmental format, that fact shall be explained in the
notes to the financial statements (summary of significant accounting policies:
financial reporting entity). If there
was a change from the prior year’s method of presenting a component unit or
change in component units reported, the notes to the financial statements shall
disclose the reason(s) for the change.
(b) If
a primary government has no component units, that fact shall be disclosed in
the notes to the financial statements (summary of significant accounting
policies: financial reporting entity).
If the primary government has component units that are not included in
the financial statements due to materiality, that fact shall also be disclosed
in the notes.
(c) The
state auditor requires component unit(s) to be audited by the same audit firm
that audits the primary government (except for public housing authority
component units that are statutorily exempt from this requirement, and the
statewide ACFR). For clarification,
housing departments of a local government or a regional housing authority are
not exempt from this requirement. Requests
for exemption from this requirement shall be submitted in writing by the
primary government to the state auditor.
If the request to use a different auditor for the component unit is
approved in writing by the state auditor, the following requirements shall be
met:
(i) the
IPAs of the primary government and all component units shall consider and
comply with the requirements of AU-C 600;
(ii) the group engagement partner shall
agree that the group engagement team will be able to obtain sufficient
appropriate audit evidence through the use of the group engagement team’s work
or use of the work of the component auditors (AU-C 600.15);
(iii) the
component unit auditor selected shall appear on the OSA list of approved IPAs;
(iv) all
bid and auditor selection processes shall comply with the requirements of this
rule;
(v) the
OSA standard contract template shall be used by both the primary government and
the component unit;
(vi) the
primary government, the primary engagement partner, management of the component
unit, and the component unit auditor shall all coordinate their efforts to
ensure that the audit reports of the component unit and the primary government
are submitted by the applicable due dates;
(vii) all
component unit findings shall be disclosed in the primary government’s audit
report (except the statewide ACFR, which shall include only component unit
findings that are significant to the state as a whole); and
(viii) any
separately issued component unit financial statements and associated auditors’
reports shall be submitted to the state auditor by the due date in Subsection A
of 2.2.2.9 NMAC for the review process described in Subsection A of 2.2.2.13
NMAC.
(d) With
the exception of the statewide ACFR, the following supplementary information (SI)
pertaining to component units for which separately issued financial statements
are not available shall be audited and opined on as illustrated in AAG SLV 17.103
example A-15: financial statements for
each of the component unit’s major funds, combining and individual fund
financial statements for all of the component unit’s non-major funds, and
budgetary comparison statements for the component unit’s general fund and major
special revenue funds that have legally adopted annual budgets.
(2) Audits
of agencies shall be comprised of a financial and compliance audit of the
financial statements and schedules as follows:
(a) The
level of planning materiality described at AAG SLV 4.169-4.184 and exhibit 4-2
shall be used. Planning materiality for
component units is at the individual component unit level.
(b) The
scope of the audit includes the following statements and disclosures which the
auditor shall audit and give an opinion on.
The basic financial statements (as defined by GASB and displayed in AAG
SLV exhibit 4-2) consisting of:
(i) the
governmental activities, the business-type activities, and the aggregate
discretely presented component units;
(ii) each
major fund and the aggregate remaining fund
information;
(iii) The
state auditor requires that every agency’s audit report include budgetary
comparisons as SI. The budgetary
comparisons shall be audited, and an auditor’s opinion shall be rendered. An AU-C 725 opinion does meet this requirement.
The associated explanation of
significant variations between original and final budget amounts, and final
budget amounts and actual results, shall be presented as RSI; and
(iv) the
related notes to the financial
statements.
(c) Budgetary
comparison statements for the general fund and major special revenue funds may
be presented as RSI, pursuant to GASB 103, on a fund, organization, or program
structure basis upon the agency obtaining prior written approval from the OSA.
(d) The
auditor shall apply procedures and report in the auditor’s report on the
following RSI (if applicable) pursuant to AU-C 730:
(i) management’s
discussion and analysis (GASBS 34.8-.11);
(ii) RSI
data required by GASBS 67 and 68 for defined benefit pension plans;
(iii) RSI
schedules required by GASBS 43 and 74 for postemployment benefit plans other
than pension plans;
(iv) RSI
schedules required by GASBS 45 and 75 regarding employer accounting and
financial reporting for postemployment benefits other than pensions; and
(v) infrastructure
modified approach schedules derived from asset management systems (GASBS
34.132-133);
(vi) RSI shall include an explanation of
significant variations between original and final budget amounts and final
budget amounts and actual results.
(e) The
audit engagement and audit contract compensation include an AU-C 725 opinion on
the SI schedules presented in the audit report.
The auditor shall subject the information on the SI schedules to the
procedures required by AU-C 725. The
auditor shall report on the remaining SI in an other-matter paragraph following
the opinion paragraph in the auditor’s report on the financial statements
pursuant to AU-C 725. Except for the statewide ACFR, the following SI schedules
are required to be included in the AU-C 725 opinion if the schedules are
applicable to the agency:
(i) primary government combining and
individual fund financial statements for all non-major funds (GASBS 34.383);
(ii) the
schedule of expenditures of federal awards required by uniform guidance;
(iii) the schedule of pledged collateral
required by Subsection P of 2.2.2.10 NMAC;
(iv) the
FDS of housing authorities pursuant to Subsection B of 2.2.2.12 NMAC;
(v) the
school district schedule of cash reconciliation required by Subsection C of
2.2.2.12 NMAC. In addition, the school
district schedule of cash reconciliation SI shall be subjected to audit
procedures that ensure the cash per the schedule reconciles to the PED reports
as required by Subsection C of 2.2.2.12 NMAC;
(vi) any other SI schedule required by this
rule.
B. Governmental auditing, accounting and
financial reporting standards:
The audits shall be conducted in accordance with:
(1) the
most recent revision of GAGAS issued by the United States government
accountability office;
(2) U.S.
auditing standards-AICPA (clarified);
(3) uniform
administrative requirements, cost principles, and audit requirements for
federal awards (uniform guidance);
(4) AICPA
audit and accounting guide, government auditing standards and single audits,
(AAG GAS) latest edition;
(5) AICPA
audit and accounting guide, state and local governments (AAG SLV) latest
edition; and
(6) 2.2.2
NMAC, requirements for contracting and conducting audits of agencies, latest
edition, as amended.
C. Financial statements and notes to the
financial statements: The financial statements and notes to the
financial statements shall be prepared in accordance with accounting principles
generally accepted in the United States of America (USA). Governmental accounting principles are
identified in the government accounting standards board (GASB) codification,
latest edition. IPAs shall follow
interpretations, technical bulletins, and concept statements issued by GASB,
other applicable pronouncements, and GASB illustrations and trends for
financial statements. In addition to the
revenue classifications required by NCGAS 1.110, the OSA requires that the
statement of revenues, expenditures, and changes in fund balance - governmental
funds include classifications for intergovernmental revenue from federal
sources and intergovernmental revenue from state sources, as applicable.
D. Requirements
for preparation of financial statements:
(1) The
financial statements presented in audit reports shall be prepared from the
agency's books of record and contain amounts rounded to the nearest dollar.
(2) The
financial statements are the responsibility of the agency. The agency shall maintain adequate accounting
records, prepare financial statements in accordance with accounting principles
generally accepted in the USA, and provide complete, accurate, and timely
information to the IPA as requested to meet the audit report due date specified
in Subsection A of 2.2.2.9 NMAC.
(3) If
there are differences between the financial statements and the books, the IPA
shall provide to the agency the adjusting journal entries and the supporting
documentation that reconciles the financial statements in the audit report to
the books.
(4) If
the IPA prepared the financial statements in their entirety from the
client-provided trial balance or underlying accounting records the IPA should
conclude significant threats to independence exist and shall document the
threats and safeguards applied to mitigate the threats to an acceptable
level. If the threats cannot be
documented as mitigated the IPA may appropriately decide to decline to provide
the service. IPAs should refer to the
GAGAS conceptual framework to evaluate independence. The fact that the auditor prepared the
financial statements from the client-provided trial balance or underlying
records shall be disclosed on the exit conference page of the audit report.
E. Audit documentation requirements:
(1) The
IPA’s audit documentation shall be retained for a minimum of five-years from
the date shown on the opinion letter of the audit report or longer if requested
by the federal oversight agency, cognizant agency, or the state auditor. Audit documentation, including working
papers, are the property of the IPA or responsible certificate holder per
Subsection A of Section 61-28B-25 NMSA 1978.
Audit documentation includes all documents used to support any opinions
or findings included in the report. The
state auditor shall have access to the audit documentation at the discretion of
the state auditor.
(2) When
requested by the state auditor, all the audit documentation shall be delivered
to the state auditor by the due date specified in the request. State auditor review of audit documentation
does not transfer the ownership of the documents. Ownership of the audit documentation is
maintained by the IPA or responsible certificate holder.
(3) The
audit documentation of a predecessor IPA shall be made available to a successor
IPA in accordance with AU-C 510.07 and 510.A3 to 510.A11, and the predecessor
auditor’s contract. Any photocopy costs
incurred shall be borne by the requestor.
If the successor IPA finds that the predecessor IPA’s audit
documentation does not comply with applicable auditing standards and this rule,
or does not support the financial data presented in the audit report, the
successor IPA shall notify the state auditor in writing specifying all
deficiencies. If the state auditor
determines that the nature of deficiencies indicate that the audit was not
performed in accordance with auditing or accounting standards generally
accepted in the USA and related laws, rules and regulations, and this rule, any
or all of the following actions may be taken:
(a) the
state auditor may require the predecessor IPA firm to correct its working
papers and reissue the audit report to the agency, federal oversight or
cognizant agency and any others receiving copies;
(b) the
state auditor may deny or limit the issuance of future audit contracts; or
(c) the
state auditor may refer the predecessor IPA to the New Mexico public
accountancy board for possible licensure action.
F. Auditor communication requirements:
(1) The IPA shall comply with the
requirements for auditor communication with those charged with governance as
set forth in AU-C 260 and GAGAS 6.06 and 6.07.
(2) After
the agency and IPA have an approved audit contract in place, the IPA shall
prepare a written and dated engagement letter during the planning stage of a
financial audit, addressed to the appropriate officials of the agency, keeping
a copy of the signed letter as part of the audit documentation. In addition to meeting the requirements of
the AICPA professional standards and the GAGAS requirements, the engagement
letter shall state that the engagement shall be performed in accordance with
2.2.2 NMAC.
(3) The audit engagement letter shall not
include any fee contingencies. The
engagement letter shall not be interpreted as amending the contract. Nothing in the engagement letter can impact
or change the amount of compensation for the audit services. Only a contract amendment submitted pursuant
to Subsection N of 2.2.2.8 NMAC may amend the amount of compensation for the
audit services set forth in the contract.
(4) A separate engagement letter and list
of client prepared documents is required for each fiscal year audited. The IPA shall provide a copy of the
engagement letter and list of client prepared documents immediately upon
request from the state auditor.
(5) The
IPA shall conduct an audit entrance conference with the agency with
representatives of the agency’s governing authority and top management, which
may include representatives of any component units (housing authorities,
charter schools, hospitals, foundations, etc.), if applicable. The OSA has the authority to notify the
agency or IPA that the state auditor shall be informed of the date of the
entrance conference and any progress meetings.
If such notification is received, the IPA and agency shall invite the
state auditor or the auditor’s designee to attend all such conferences no later
than 72 hours before the proposed conference or meeting.
(6) All
communications with management and the agency’s oversight officials during the
audit, regarding any instances of non-compliance or internal control
weaknesses, shall be made in writing.
The auditor shall obtain and report the views of responsible officials
of the audited agency concerning the audit findings, pursuant to GAGAS
6.57-6.60. Any violation of law or good
accounting practice, including instances of non-compliance or internal control
weaknesses, shall be reported as audit findings per Section 12-6-5 NMSA
1978. Separate management letter
comments shall not be issued as a substitute for such findings.
G. Reverting
or non-reverting funds: Legislation can designate a fund as reverting
or non-reverting. The IPA shall review
the state law that appropriated funds to the agency to confirm whether any
unexpended, unencumbered balance of a specific appropriation shall be reverted
and to whom. The law may also indicate
the due date for the required reversion.
Appropriate audit procedures shall be performed to evaluate compliance
with the law and accuracy of the related liability account balances due to
other funds, governmental agencies, or both.
The financial statements and the accompanying notes shall fully disclose
the reverting or non-reverting status of a fund or appropriation. The financial statements shall disclose the
specific legislation that makes a fund or appropriation non-reverting and any
minimum balance required. If
non-reverting funds are commingled with reverting appropriations, the notes to
the financial statements shall disclose the methods and amounts used to
calculate reversions. For more information
regarding state agency reversions, see Subsection A of 2.2.2.12 NMAC and the
DFA white papers “calculating reversions to the state general fund,” and “basis
of accounting-modified accrual and the budgetary basis.” The statewide ACFR is exempt from this
requirement.
H. Referrals
and risk advisories: The Audit Act (Section 12-6-1 et seq. NMSA 1978) states that “the
financial affairs of every agency shall be thoroughly examined and audited each
year by the state auditor, personnel of the state auditor’s office designated
by the state auditor or independent auditors approved by the state auditor.”
(Section 12-6-3 NMSA 1978). Further,
audits of New Mexico governmental agencies “shall be conducted in accordance
with generally accepted auditing standards and rules issued by the state
auditor.” (Section 12-6-3 NMSA 1978).
(1) In
an effort to ensure that the finances of state and local governments are
thoroughly examined, OSA may provide IPAs with written communications to inform
the IPA that OSA received information that may suggest elevated risk in
specific areas relevant to a particular agency’s annual financial and
compliance audit. These communications
shall be referred to as “referrals.”
Referrals are considered confidential audit documentation. Referrals may relate to any topic, including
the scope of the annual financial and compliance audit. IPAs shall take the circumstances described
in OSA referral communications into account in their risk assessment and
perform such procedures as, in the IPA’s professional judgment, are necessary
to determine what further actions, if any, in the form of additional
disclosures, findings, and recommendations are appropriate in connection with
the annual audit of the agency. After
the conclusion of fieldwork but at least 14 days prior to submitting the draft
annual audit report to the OSA for review, IPAs shall provide written
confirmation to the OSA that the IPA took appropriate action in response to the
referral. This written confirmation shall
be submitted separately from any draft report and addressed to the attention of
the OSA’s special investigations division.
The written confirmation shall be submitted electronically to
SIDreferrals@osa.nm.gov and shall respond to all aspects of the referral and list any
findings associated with the subject matter of the referral. IPAs shall retain adequate documentation in
the audit workpapers to support the written confirmation to OSA that the IPA
took appropriate action in response to the referral. As described in 2.2.2.13 NMAC the OSA may
review IPA workpapers associated with the annual audit of any agency. OSA workpaper review procedures shall include
examining the IPA documentation associated with referrals. Insufficient or inadequate documentation may
result in deficiencies noted in the workpaper review letter and may negatively
impact the IPA during the subsequent firm profile review process. In accordance with Subsection D of 2.2.2.8
NMAC, an IPA may be placed on restriction if an IPA refuses to comply with OSA
referrals in a timely manner.
(2) OSA may issue written communications to inform
agencies and IPAs that OSA received information that suggests elevated risk in
specific areas relevant to the annual financial and compliance audits of some
agencies. These communications shall be
referred to as “risk advisories.” Risk
advisories shall be posted on the OSA website in the following location:
osa.nm.gov/accountability-office/risk-advisories. Risk advisories may relate to
any topic relevant to annual financial and compliance audits of New Mexico
agencies. IPAs shall take the
circumstances described in OSA risk advisories into account in their risk assessment
and perform such procedures and testwork as, in the IPA’s professional
judgment, are necessary to determine what further action, if any, in the form
of disclosure, findings and recommendations are appropriate in connection with
the annual audit of the agency.
I. State auditor workpaper requirement: The state auditor requires that audit
workpapers include a written audit program for fund balance and net position
that includes tests for proper classification of fund balance pursuant to GASBS
54 and proper classification of net position pursuant to GASBS 34.32-.37 (as
amended) and GASBS 46.4-.5 (as amended).
J. State
compliance audit requirements: An IPA shall identify significant state
statutes, rules, and regulations applicable to the agency under audit and
perform tests of compliance. In
designing tests of compliance, IPAs may reference AU-C 250 relating to
consideration of laws and regulations in an audit of financial statements and
AU-C 620 relating to using the work of an auditor’s specialist. As discussed in AU-C 250.A23, in situations
where management or those charged with governance of the agency, or the
agency’s in-house or external legal counsel, do not provide sufficient
information to satisfy the IPA that the agency is in compliance with an
applicable requirement, the IPA may consider it appropriate to consult the
IPA’s own legal counsel. AU-C 620.06 and
620.A1-A2 discuss the use of an auditor’s specialist in situations where
expertise in a field other than accounting or auditing is necessary to obtain
sufficient, appropriate audit evidence, such as the interpretation of
contracts, laws and regulations. In
addition to the significant state statutes, rules and regulations identified by
the IPA, compliance with the following shall be tested if applicable (with the
exception of the statewide ACFR):
(1) Procurement
Code, Sections 13-1-1 to 13-1-199 NMSA 1978 including providing the state
purchasing agent with the name of the agency’s chief procurement officer,
pursuant to Section 13-1-95.2 NMSA 1978, and Procurement Code Regulations,
1.4.1 NMAC, or home rule equivalent. All
agencies must retain support for procurement until the contract expires or the
minimum time required for record retention is met, whichever is longer.
(2) Per
Diem and Mileage Act, Sections 10-8-1 to 10-8-8 NMSA 1978, and Regulations
Governing the Per Diem and Mileage Act, 2.42.2 NMAC.
(3) Public
finances and public money, Sections 6-10-1 to 6-10-63 NMSA 1978, including the
requirements that county and municipal treasurers deposit money in their
respective counties, and that the agency receive a joint safe keeping receipt
for pledged collateral. (In instances
when another statute provides for a different timeline applicable to the
agency, that statute shall control.)
(4) Public
School Finance Act, Sections 22-8-1 to 22-8-49 NMSA 1978.
(5) Investment
of public money, Sections 6-8-1 to 6-8-25 NMSA 1978.
(6) Public
Employees Retirement Act, Sections 10-11-1 to 10-11-142 NMSA 1978. IPAs shall
test to ensure eligible contributions are remitted to PERA. The IPA shall evaluate and test internal
controls regarding employee eligibility for PERA and other benefits. IPAs shall evaluate risk associated with
employees excluded from PERA and test that employees are properly excluded.
(7) Educational
Retirement Act (ERA), Sections 22-11-1 to 22-11-55 NMSA 1978. IPAs shall test to ensure eligible
contributions are remitted to ERB. The
IPA shall evaluate and test internal controls regarding employee eligibility
for ERA and other benefits. IPAs shall
evaluate risk associated with employees excluded from the ERA and test that
employees are properly excluded.
(8) Sale
of public property, Sections 13-6-1 to 13-6-8 NMSA 1978.
(9) Anti-Donation
Clause, Article IX, Section 14, New Mexico Constitution.
(10) Special,
deficiency, and supplemental appropriations (appropriation laws applicable for
the year under audit).
(11) State
agency budget compliance with Sections 6-3-1 to 6-3-25 NMSA 1978, and local
government compliance with Sections 6-6-1 to 6-6-20 NMSA 1978.
(12) Lease
purchase agreements, Article IX, Sections 8 and 11, New Mexico Constitution;
Sections 6-6-11 to 6-6-12 NMSA 1978; Montano
v. Gabaldon, 108 NM 94, 766 P.2d 1328 (1989).
(13) Accounting
and control of fixed assets of state government, 2.20.1.1 to 2.20.1.18 NMAC,
(updated for GASBS 34 as applicable).
(14) Requirements
for contracting and conducting audits of agencies, 2.2.2 NMAC.
(15) Article
IX of the state constitution limits on indebtedness.
(16) Any
law, regulation, directive or policy relating to an agency’s use of gasoline
credit cards, telephone credit cards, procurement cards, and other
agency-issued credit cards.
(17) Retiree
Health Care Act, Sections 10-7C-1 to 10-7C-19 NMSA 1978. IPAs shall test to ensure eligible
contributions are reported to RHCA. The
IPA shall evaluate and test internal controls regarding employee eligibility
for RHCA and other benefits. IPAs shall
evaluate risk associated with employees excluded from RHCA and test that
employees are properly excluded.
(18) Governmental
Conduct Act, Sections 10-16-1 to 10-16-18 NMSA 1978.
(19) School
Personnel Act, Sections 22-10A-1 to 22-10A-40.1 NMSA 1978.
(20) School
Athletics Equity Act, Sections 22-31-1 to 22-31-6 NMSA 1978. IPAs shall test whether the district has
submitted the required school-district-level reports, but no auditing of the
reports or the data therein is required.
(21) The New Mexico opioid allocation
agreement.
K. Federal
requirements: IPAs shall conduct
their audits in accordance with the requirements of the following government
pronouncements and shall test federal compliance audit requirements as
applicable:
(1) generally accepted government auditing standards (GAGAS) issued by the United States
government accountability office, most recent revision;
(2) uniform
administrative requirements, cost principles, and audit requirements for
federal awards;
(3) compliance
supplement, latest edition; and
(4) internal
revenue service (IRS) employee
income tax requirements. IRS Publication
15-B, employer’s tax guide to fringe benefits, available online, provides
detailed information regarding the taxability of fringe benefits.
(5) In
situations where expenditures reported in the schedule of expenditures of
federal awards (SEFA) do not tie to federal revenues reported in the
basic financial statements (due to outstanding loan balances, timing of grant
awards, expenditures incurred in a prior period, etc.), a reconciliation shall
be included in the notes to the SEFA.
L. Audit finding requirements:
(1) Communicating
findings: IPAs shall communicate findings in accordance with generally accepted
auditing standards and the requirements of GAGAS 6.17-6.30. All finding reference numbers shall follow a
standard format with the four-digit audit year, a hyphen, and a three-digit
sequence number (e.g. 20XX-001, 20XX-002, 20XX-999). All prior year findings shall include the
finding numbers used when the finding was first reported under historical
numbering systems in brackets, following the current year finding reference
number (e.g., 2021-001 (2020-003)) to enable the report user to see what year
the finding originated and how it was identified in previous years. Finding reference numbers for single audit
findings reported on the data collection form shall match those reported in the
schedule of findings and questioned costs and the applicable auditor’s
report. Depending on the IPA’s
classification of the finding, the finding reference number shall be followed
by one of the following descriptions: “material weakness”; “significant
deficiency”; “material non-compliance”; “other non-compliance”; or “other
matters.”
(a) IPAs
shall evaluate deficiencies to determine whether individually or in combination
they are significant deficiencies or material weaknesses in accordance with
AU-C 265.
(b) Findings
that meet the requirements described in AAG GAS 4.12 shall be included in the
report on internal control over financial reporting and on compliance and other
matters based on an audit of financial statements performed in accordance with
government auditing standards. AAG GAS
13.35 and 13.36 table 13-2 provides guidance on whether a finding shall be
included in the schedule of findings and questioned costs.
(c) Section
12-6-5 NMSA 1978 requires that “each report set out in detail, in a separate
section, any violation of law or good accounting practices found by the audit
or examination.”
(i) When
auditors detect violations of law or good accounting practices that shall be
reported per Section 12-6-5 NMSA 1978, but that do not rise to the level of
significant deficiencies or material weaknesses, such findings are considered
to warrant the attention of those charged with governance due to the statutory
reporting requirement. The auditor shall
communicate such violations in the “compliance and other matters” paragraph in
the report on internal control over financial reporting and on compliance and
other matters based on an audit of financial statements performed in accordance
with government auditing standards.
(ii) Findings
required by Section 12-6-5 NMSA 1978 shall be presented in a separate schedule
of findings labeled “Section 12-6-5 NMSA 1978 findings”. This schedule shall be placed in the back of
the audit report following the financial statement audit and federal award
findings. Per AAG GAS 13.39 there is no
requirement for such findings to be included or referenced in the uniform
guidance compliance report.
(d) Each audit finding (including current
year and unresolved prior-year findings) shall specifically state and describe
the following:
(i) condition
(provides a description of a situation that exists and includes the extent of
the condition and an accurate perspective, the number of instances found, the
dollar amounts involved, if specific amounts were identified, and for repeat findings, management’s progress
or lack of progress towards implementing the prior year planned corrective
actions);
(ii) criteria
(identifies the required or desired state or what is expected from the program
or operation; cites the specific section of law, regulation, ordinance,
contract, or grant agreement if applicable);
(iii) effect
(the logical link to establish the impact or potential impact of the difference
between the situation that exists (condition) and the required or desired state
(criteria); demonstrates the need for corrective action in response to
identified problems or relevant risks);
(iv) cause
(identifies the reason or explanation for the condition or the factors
responsible for the difference between what the auditors found and what is
required or expected; the cause serves as a basis for the recommendation);
(v) recommendation
addressing each condition and cause; and
(vi) agency
response (the agency’s comments about the finding, including specific planned
corrective actions with a timeline and designation of what employee position(s)
are responsible for meeting the deadlines in the timeline).
(e) Uniform
guidance regarding single audit findings (uniform guidance 200.511): The
auditee is responsible for follow-up and corrective action on all audit
findings. As a part of this
responsibility, the auditee shall prepare a summary schedule of prior audit
findings and a corrective action plan for current year audit findings in
accordance with the requirements of uniform guidance 200.511. The corrective action plan and summary
schedule of prior audit findings shall include findings relating to the financial
statements which shall be reported in accordance with GAGAS. The summary schedule of prior year findings
and the corrective action plan shall be included in the reporting package
submitted to the federal audit clearinghouse (AAG GAS 13.39 fn 40). In addition to being included in the agency
response to each audit finding, the corrective action plan shall be provided on
the audited agency’s letterhead in a document separate from the auditor’s
findings. (Council on financial assistance reform frequently asked questions on
the office of management and budget’s uniform administrative requirements, cost
principles, and audit requirements for federal awards at 2 CFR 200, Section
511-1).
(f) All
audit reports shall include a summary of audit results preceding the
presentation of audit findings (if any).
The summary of audit results shall include the type of auditor report
issued and whether the following categories of findings for internal control
over financial reporting were identified: material weakness, significant
deficiency, and material noncompliance.
AUP reports completed pursuant to 2.2.2.16 NMAC are not required to
include a summary of audit results.
(2) Prior
year findings:
(a) IPAs
shall comply with the requirements of the most recent version of GAGAS relating
to findings and recommendations from previous audits and attestation
engagements. In addition, IPAs shall
report the status of all prior-year
findings and all findings from
special audits performed under the oversight of the state auditor in the
current year audit report in a summary schedule of prior year audit
findings. The summary schedule of prior
year audit findings shall include the prior year finding number, the title, and
whether the finding was resolved, repeated, or repeated and modified in the
current year. No other information shall
be included in the summary schedule of prior year audit findings. All findings from special audits performed
under the oversight of the state auditor shall be included in the findings of
the annual financial and compliance audits of the related fiscal year. IPAs shall consider including findings from
special audits in annual audit reports.
(b) Uniform
guidance regarding single audit prior year findings (uniform guidance
200.511): The auditor shall follow up on
prior audit findings, perform procedures to assess the reasonableness of the
summary schedule of prior audit findings prepared by the auditee in accordance
with the uniform guidance, and report, as a current-year audit finding, when
the auditor concludes that the summary schedule of prior audit findings
materially misrepresents the status of any prior audit finding (AAG GAS 13.54).
(3) Current-year
audit findings: Written audit findings
shall be prepared and submitted to management of the agency as soon as the IPA
becomes aware of the findings so the agency has time to respond to the findings
prior to the exit conference. The agency
shall prepare “planned corrective actions” as required by GAGAS 6.57 and
6.58. The agency shall respond, in
writing, to the IPA’s audit findings within 10 business days. Lack of agency responses within the 10
business days does not warrant a delay of the audit report. The agency’s responses to the audit findings
and the “planned corrective actions” shall be included in the finding after the
recommendation. If the IPA disagrees
with the management’s comments in response to a finding, they may explain in
the report their reasons for disagreement, after the agency’s response (GAGAS
6.59). Pursuant to GAGAS 6.60, “if the
audited agency refuses to provide comments or is unable to provide comments
within a reasonable period of time, the auditors may issue the report without
receiving comments from the audited agency.
In such cases, the auditors should indicate in the report that the
audited agency did not provide comments.”
(4) If
appropriate in the auditor’s professional judgment, failure to submit the
completed audit contract to the OSA by the due date at Subsection F of 2.2.2.8
NMAC may be reported as a current year compliance finding.
(5) If
an agency has entered into any professional services contract with an IPA with
a scope of work that relates to fraud, waste, or abuse, and the agency did not
notify the OSA, the IPA shall report a finding of non-compliance with Paragraph
(2) of Subsection C of 2.2.215 NMAC.
(6) If
an agency subject to the procurement code failed to meet the requirement to
have a certified chief procurement officer during the fiscal year, the IPA
shall report a finding of non-compliance with 1.4.1.94 NMAC.
(7) Component
unit audit findings shall be reported in the primary government’s financial
audit report. This is not required for
the statewide ACFR unless a finding of a legally separate component unit is
significant to the state as a whole.
(8) Except
as discussed in Subsections A and E of 2.2.2.12 NMAC, release of any portion of
the audit report by the IPA or agency prior to being officially released by the
state auditor is a violation of Section 12-6-5 NMSA 1978 and requires a
compliance finding in the audit report.
(9) If
an agency response to a finding indicates in any way that the OSA is the cause
of the finding, the OSA may require that a written response from the OSA be
included in the report, below the other responses to that finding.
M. Exit conference and related confidentiality
issues:
(1) The
IPA shall hold an exit conference with representatives of the agency’s
governing authority and top management, which may include representatives of
any component units (housing authorities, charter schools, hospitals,
foundations, etc.), if applicable. The
OSA has the authority to notify the agency or IPA that the state auditor shall
be informed of the date of any progress meetings and the exit conference. If such notification is received, the IPA and
agency shall invite the state auditor to attend all such conferences. If component unit representatives cannot
attend the combined exit conference, a separate exit conference shall be held
with the component unit's governing authority and top management. The exit conference and presentation to
governance shall occur in the forum agreed to by the agency and the IPA, to
include virtual or telephonic options.
The OSA reserves the right to require an in-person exit conference and
presentation to the board. The date of
the exit conference(s) and the names and titles of personnel attending shall be
stated in the last page of the audit report.
(2) The
IPA, with the agency’s cooperation, shall provide to the agency for review a
draft of the audit report (stamped “draft”), a list of the “passed audit
adjustments,” and a copy of all the adjusting journal entries at or before the
exit conference. The draft audit report
shall include, at minimum, the following elements: independent auditor’s
report, basic financial statements, audit findings, summary schedule of prior
year audit findings, and the reports on internal control and compliance
required by government auditing standards and uniform guidance.
(3) Agency
personnel and the agency’s IPA shall not release information to the public
relating to the audit until the audit report is released by the OSA, and has
become a public record. This does not
preclude an agency from submitting financial statements and notes to the
financial statements, clearly marked as “draft” or “unaudited” to federal or
state oversight agencies or bond rating agencies. Any draft financial statements provided to
federal or state oversight agencies or to bond rating agencies shall exclude
draft auditor opinions and findings, and any pages including references to
auditor opinions or findings. This also
does not preclude an IPA from complying with communication requirements,
between component auditors and the group auditor, detailed in AU-C 600, Special
Considerations - Audits of Group Financial Statements. State agency IPAs, constitutional institutes
of higher education IPAs and state of New Mexico component unit IPAs are all
component auditors for the New Mexico ACFR Group Audit.
(4) Once
the audit report is officially released to the agency by the state auditor (by
a release letter) and the required waiting period of five calendar days has
passed, unless waived by the agency in writing as described in Subparagraph (a)
of Paragraph (4) of Subsection B of 2.2.2.9 NMAC, the audit report shall be
presented by the IPA, to a quorum of the governing authority of the agency at a
meeting held in accordance with the Open Meetings Act, within 60 calendar days. This requirement only applies to agencies
with a governing authority, such as a board of directors, board of county
commissioners, or city council, which is subject to the Open Meetings Act. The IPA shall ensure that the required
communications to those charged with governance are made in accordance with
AU-C 260.10 to 260.14.
(5) At
all times during the audit and after the audit report becomes a public record,
the IPA shall follow applicable standards and 2.2.2 NMAC regarding the release
of any information relating to the audit.
Applicable standards include but are not limited to the AICPA Code of
Conduct ET Section 1.700.001 and related interpretations and guidance, and
GAGAS 6.53-6.55 and GAGAS 6.63-6.65. The
OSA and the IPA shall not disclose audit documentation if such disclosure would
undermine the effectiveness or integrity of the audit process. AU-C 230.A29.
N. Possible violations of criminal statutes in
connection with financial affairs:
(1) IPAs
shall comply with the requirements of GAGAS 6.19-6.24 relating to fraud,
noncompliance with provisions of laws, regulations, contracts and grant
agreements, waste, and abuse. Relating
to contracts and grant agreements, IPAs shall extend the AICPA requirements
pertaining to the auditors’ responsibilities for laws and regulations to also
apply to consideration of compliance with provisions of contracts or grant
agreements. Concerning abuse, if an IPA
becomes aware of abuse that could be quantitatively, or qualitatively material
to the financial statements or other financial data significant to the audit
objectives, the IPA shall apply audit procedures specifically directed to
ascertain the potential effect on the financial statements or other financial
data significant to the audit objectives.
(2) Pursuant
to Section 12-6-6 NMSA 1978 (criminal violations), an agency, LPB, or IPA shall
notify the state auditor immediately upon discovery of any apparent violation
of a criminal statute in connection with financial affairs. If an agency or IPA has already made a report
to law enforcement that fact shall be included in the notification. If not immediately known, a follow-up
notification shall include an estimate of the dollar amount involved, if known
or estimable, and a description of the apparent violation, including names of
persons involved and any action taken or planned.
O. Special revenue funds authority: The authority for creation of special revenue
funds and any minimum balance required shall be shown in the audit report
(i.e., cite the statute number, code of federal regulation, executive order,
resolution number, or other specific authority) on the divider page before the
combining financial statements or in the notes to the financial
statements. This requirement does not
apply to the statewide ACFR.
(1) All
monies coming into all agencies (i.e., vending machines, fees for photocopies,
telephone charges, etc.) shall be considered public monies and be accounted for
as such. For state agencies, all
revenues generated shall be authorized by legislation (FCD’s manual of model
accounting practices (MAPs) FIN 11.4).
(2) If
the agency has investments in
securities and derivative instruments, the
IPA shall comply with the requirements of AU-C 501.04-.06. If the IPA elects to use the work of an
auditor’s specialist to meet the requirements of AU-C 501, the requirements of
AU-C 620 shall also be met.
(3) Pursuant
to Section 12-6-5 NMSA 1978, each audit report shall include a list of
individual deposit and investment accounts held by the agency. The information presented in the audit report
shall include at a minimum:
(a) name
of depository (i.e., bank, credit union, state treasurer, state investment
council, etc.);
(b) account
name;
(c) type
of deposit or investment account (also required in separate component unit
audit reports):
(i) types
of deposit accounts include non-interest bearing checking, interest bearing
checking, savings, money market accounts, certificates of deposit, etc.; and
(ii) types
of investment accounts include state treasurer general fund investment pool
(SGFIP), state treasurer local government investment pool (LGIP), U.S. treasury
bills, securities of U.S. agencies such as Fannie Mae (FNMA), Freddie Mac
(FHLMC), government national mortgage association (GNMA), Sallie Mae, small
business administration (SBA), federal housing administration (FHA), etc.
(d) account
balance of deposits and investments as of the balance sheet date;
(e) reconciled
balance of deposits and investments as of the balance sheet date as reported in
the financial statements; and
(f) for
state agencies only, SHARE fund number. In auditing the balance of a state
agency’s investment in the SGFIP, the IPA shall review the individual state
agency’s cash reconciliation procedures and determine whether those procedures
would reduce the agency’s risk of misstatement in the investment in SGFIP, and
whether the agency is actually performing those procedures. The IPA shall also take into consideration
the complexity of the types of cash transactions that the state agency enters
into and whether the agency processes its deposits and payments through
SHARE. The IPA shall use professional
judgment to determine each state agency’s risk of misstatement in the
investment in the SGFIP and write findings and modify opinions as deemed
appropriate by the IPA.
(4) Pledged
collateral:
(a) All
audit reports shall disclose applicable collateral requirements in the notes to
the financial statements. In addition, there shall be a SI schedule or note to
the financial statements that discloses the collateral pledged by each
depository for public funds. The SI
schedule or note shall disclose the type of security (i.e., bond, note,
treasury, bill, etc.), security number, committee on uniform security
identification procedures number, fair market value and maturity date.
(b) Pursuant
to Section 6-10-17 NMSA 1978, the pledged collateral for deposits in banks and
savings and loan associations shall have an aggregate value equal to one-half
of the amount of public money held by the depository. If this requirement is not met the audit
report shall include a finding. No
security is required for the deposit of public money that is insured by the
federal deposit insurance corporation (FDIC) or the national credit union
administration (NCUA) in accordance with Section 6-10-16 NMSA 1978. Collateral requirements shall be calculated
separately for each bank and disclosed in the notes.
(c) All applicable GASB 40 disclosure
requirements relating to deposit and investment risk shall be met. In
accordance with GASBS 40.8, relating to custodial credit risk, the notes to the
financial statements shall disclose the dollar amount of deposits subject to
custodial credit risk, and the type of risk the deposits are exposed to. To determine compliance with the fifty
percent pledged collateral requirement of Section 6-10-17 NMSA 1978, the
disclosure shall include the dollar amount of each of the following for each
financial institution: fifty percent pledged collateral requirement per
statute, total pledged collateral, uninsured and uncollateralized.
(d) Repurchase
agreements shall be secured by pledged collateral having a market value of at
least one hundred two percent of the contract per Subsection H of Section
6-10-10 NMSA 1978. To determine
compliance with the one hundred two percent pledged collateral requirement of
Section 6-10-10 NMSA 1978, the disclosure shall include the dollar amount of
the following for each repurchase agreement:
one hundred-two percent pledged collateral requirement per statute, and
total pledged collateral.
(e) Per Subsection A of Section 6-10-16
NMSA 1978, “deposits of public money shall be secured by: securities of the
United States, its agencies or instrumentalities; securities of the state of
New Mexico, its agencies, instrumentalities, counties, municipalities or other
subdivisions; securities, including student loans, that are guaranteed by the
United States or the state of New Mexico; revenue bonds that are underwritten
by a member of the financial industry regulatory authority (known as FINRA),
and are rated “BAA” or above by a nationally recognized bond rating service; or
letters of credit issued by a federal home loan bank.”
(f) Securities shall be accepted as
security at market value pursuant to Subsection C of Section 6-10-16 NMSA 1978.
(g) State
agency investments in the state treasurer’s general fund investment pool do not
require disclosure of specific pledged collateral for amounts held by the state
treasurer. However, the notes to the
financial statements shall refer the reader to the state treasurer’s separately
issued financial statements which disclose the collateral pledged to secure
state treasurer cash and investments.
(h) If
an agency has other “authorized” bank accounts, pledged collateral information
shall be obtained from the bank and disclosed in the notes to the financial
statements. The state treasurer monitors
pledged collateral related to most state agency bank accounts. State agencies should not request the pledged
collateral information from the state treasurer. In the event pledged collateral information
specific to the state agency is not available, the following note disclosure
shall be made: detail of pledged collateral specific to this agency is
unavailable because the bank commingles pledged collateral for all state funds
it holds. However, the state treasurer’s
office (STO) collateral bureau monitors pledged collateral for all state funds
held by state agencies in such “authorized” bank accounts.
(5) Agencies
that have investments in the state treasurer’s local government investment pool
shall disclose the information required by GASBS 79 in the notes to their
financial statements. Agencies with
questions about the content of these required note disclosures may contact STO
for assistance.
(1) Prior
year balance included in budget:
(a) If
the agency prepares its budget on the accrual or modified accrual basis, the
statement of revenues and expenditures (budget and actual) or the budgetary
comparisons shall include the amount of fund balance on the budgetary basis
used to balance the budget.
(b) If
the agency prepares its budget on the cash basis, the statement of revenues and
expenditures (budget and actual) or the budgetary comparisons shall include the
amount of prior-year cash balance used to balance the budget (or fund balance
on the cash basis).
(2) The
differences between the budgetary basis and GAAP basis revenues and
expenditures shall be reconciled. If the
required budgetary comparison information is included as SI, the
reconciliation shall be included on the statement itself. If the required budgetary comparison is
presented as RSI, the reconciliation to GAAP basis shall appear in either a
separate schedule or in the notes to the RSI (AAG SLV 11.14). The notes to the financial statements shall
disclose the legal level of budgetary control for the entity. The legal level of budgetary control for
local governments is at the fund level. The
legal level of budgetary control for school districts is at the function level. The legal level of budgetary control for
state agencies is described in Subsection A of 2.2.2.12 NMAC. For additional information regarding the
legal level of budgetary control the IPA may contact the applicable oversight
agency (DFA, HED, or PED).
(3) Budgetary
comparisons shall show the original and final appropriated budget (same as
final budget approved by DFA, HED, or PED), a column with variances between original
and final budget amounts, and a
column with the variance between the final budget and actual amounts.
R. Appropriations:
(1) Budget
related findings:
(a) If
actual expenditures exceed budgeted expenditures at the legal level of
budgetary control, that fact shall be reported in a finding and disclosed in
the notes to the financial statements.
(b) If
budgeted expenditures exceed budgeted revenues (after prior-year cash balance
and any applicable federal receivables used to balance the budget), that fact may
be reported in a finding. This type of finding may be confirmed with the
agency’s budget oversight entity (if applicable).
(2) Special,
deficiency, specific, and capital outlay appropriations:
(a) Special,
deficiency, specific, and capital outlay appropriations shall be disclosed in
the notes to the financial statements.
The original appropriation, the appropriation period, expenditures to
date, outstanding encumbrances, unencumbered balances, and amounts reverted
shall be shown in a SI schedule or in a note to the financial statements. The accounting treatment of any unexpended
balances shall be fully explained in the SI schedule or in a note to the
financial statements. This is a special
requirement of the state auditor, and it does not apply to the statewide ACFR
audit.
(b) The
accounting treatment of any unexpended balances shall be fully explained in the
SI schedule or in a note to the financial statements regarding the special
appropriations.
S. Consideration of internal control and risk
assessment in a financial statement audit:
(1) Audits performed under this rule shall
include tests of internal controls (manual or automated) over assertions about
the financial statements and about compliance related to laws, regulations, and
contract and grant provisions. IPAs and agencies are encouraged to reference
the U.S. GAO’s Standards for
Internal Control in the Federal Government, known as the “Green Book”, which may be adopted by
state, local, and quasi-governmental agencies as a framework for an internal
control system.
(3) A SOC-2 audit shall include, at a
minimum,
(a) user controls relevant to financial
reporting for all modules used by the agency;
(b) information technology general
controls, including user access management, change management, system
operations, and data backup and recovery;
(c) application controls supporting
payroll, accounts payable, general ledger, and other financial processes to
include transaction entry, approval as well as reconciling inputs to outputs;
(d) controls addressing segregation of
duties risks;
(e) identification of subservice
organizations and complementary user entity controls;
(f) third party interface and upload
controls.
(4) A
SOC audit shall be conducted by IPA that:
(a) is approved and listed on the OSA’s
approved auditor list;
(b) meets all independence requirements
under GAGAS;
(c) has demonstrated experience performing
SOC audits of comparable size and complexity.
(d) has a SOC engagement peer rating of
“pass” to qualify for a SOC engagement.
(5) Any SOC audit contract must be
approved by OSA on an OSA formatted contract pursuant to standard annual audit
procedures.
(6) A draft SOC-2 audit report shall be
submitted to OSA for review prior to finalization.
(7) OSA shall provide comment or required
revisions within a reasonable timeframe.
(8) The SOC-2 audited agency and contracted
IPA shall address OSA’s comments before issuing a final SOC-3 report.
(9) The SOC-2 or SOC-3 report shall not be
distributed to other agency auditors until OSA has issued written approval.
(10) There shall be an annual SOC-2 audit of
the department of finance and administration (DFA) service organization responsible for the
operation and management of the statewide human resources, accounting, and management
reporting system (“SHARE”). A SOC-2 and subsequently redacted SOC-3 reports
shall be delivered to the state auditor by the dates specified in the audit
contract.
(11) A SOC-2 and subsequent SOC-3 report of
SHARE system shall also address controls of segregation of duties risk arising
from DFA’s dual role as system operator and processor of statewide financial
transactions.
(12) Upon OSA approval, the final SOC-2
report shall be made available to all IPA’s conducting financial audits of
state agencies that rely on SHARE for financial reporting.
(13) OSA reserves the right to select other
agencies’ application systems of records for SOC audit.
(14) A SOC audit contract shall comply with
all progress payment requirements pursuant to 2.2.2.8(M) NMAC.
T. Required auditor’s reports:
(1) The
AICPA provides examples of independent auditor’s reports in the appendix to
chapter 4 of AAG GAS and appendix A to chapter 17 of AAG SLV. Guidance is provided in footnote 4 to
appendix A to chapter 17 of AAG SLV regarding wording used when opining on
budgetary statements on the GAAP basis.
IPAs conducting audits under this rule shall follow the AICPA report
examples. All independent auditor’s
reports shall include a statement that the audit was performed in accordance
with auditing standards generally accepted in the United States of America and with applicable government auditing
standards per GAGAS 6.36. This
statement shall be modified in accordance with GAGAS 2.17b if some GAGAS
requirements were not followed. Reports
for single audits shall reference Title 2 U.S. Code of Federal Regulations
(CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit
Requirements for Federal Awards (Uniform Guidance 200, AAG GAS 4.92, Example
4-1).
(2) The
AICPA provides examples of the report on internal control over financial
reporting and on compliance and other matters based on an audit of financial
statements performed in accordance with government auditing standards in the
appendix to chapter 4 of AAG GAS. IPAs conducting audits under this rule shall
follow the AICPA report examples.
(a) The
state auditor requires the report on internal control over financial reporting
and on compliance and other matters based on an audit of financial statements
performed in accordance with government auditing standards be dated the same
date as the independent auditor’s report.
(b) No
separate management letters shall be issued to the agency by the auditor. Issuance of a separate management letter to
an agency shall be considered a violation of the terms of the audit contract
and may result in further action by the state auditor. See also Subsection F of 2.2.2.10 NMAC
regarding this issue.
(3) The
AICPA provides examples of the
report on compliance for each major federal program and on internal control
over compliance required by the uniform guidance in the appendix to chapter 13
of AAG GAS. IPAs conducting audits under this rule shall follow the AICPA
report examples.
(4) The
state auditor requires the financial statements, RSI, SI, and other information
required by this rule, and the following reports to be included under one report cover: the independent auditor’s
report; the report on internal control over financial reporting and on
compliance and other matters based on an audit of financial statements
performed in accordance with government auditing standards; and the report on
compliance for each major federal program and on internal control over
compliance required by the uniform guidance.
If applicable, the independent auditor’s report shall include the AU-C
725 opinion on SI, the schedule of expenditures of federal awards and the HUD
FDS (required by HUD guidelines on reporting and attestation requirements of
uniform financial reporting standards).
The report shall also contain a table of contents and an official
roster. The IPA may submit a written request
for an exemption from the “one report cover”
requirement, but shall receive prior written approval from the state auditor in
order to present any of the above information under a separate cover.
U. Disposition
of property: Sections 13-6-1 and 13-6-2 NMSA 1978 govern
the disposition of tangible personal property owned by state agencies, local
public bodies, school districts, and state educational institutions. At least 30 days prior to any disposition of
property included on the agency inventory list, written notification of the
official finding and proposed disposition duly sworn and subscribed under oath
by each member of the authority approving the action shall be sent to the state
auditor. The disposition list shall
include worn out, unusable or obsolete items, and may include trade-ins, and
lost, stolen, or destroyed items, as applicable.
(1) Any
joint powers agreement (JPA) shall be listed in a SI schedule in the audit
report. The statewide ACFR schedule
shall include JPAs that are significant to the state as a whole. The schedule shall include the following
information for each JPA: participants; party responsible for operations; description; beginning and ending dates of the JPA; total estimated amount of
project and portion applicable to the agency; amount the agency contributed in
the current fiscal year; audit responsibility; fiscal agent if applicable; and
name of the government agency where revenues and expenditures are reported.
(2) For self-insurance obtained under a
JPA, see the GASB Codification Sections J50.113 and C50.
W. Inventory
certification:
X. Tax increment development districts: A tax increment development district (TIDD)
created pursuant to the Tax Increment for Development Act (Chapter 5, Article
15 NMSA 1978) and its audit firm shall apply the criteria of GASBS 14, 39, 61,
and 80 to determine whether the TIDD is a component unit of the municipality or
county that approved it, or whether the TIDD is a related organization of the
municipality or county that approved it.
If the TIDD is determined to be a related organization per the GAAP
requirements, then the TIDD shall contract separately for an audit separate
from the audit of the municipality or county that approved it.
Y. GASBS 68, accounting
and financial reporting for pensions:
(1) PERA
and ERB shall each prepare schedules of employer allocations as of June 30 of
each fiscal year. The state auditor
requires the following:
(a) Prior
to distribution of the schedule of employer allocations, PERA and ERB shall
obtain audits of their respective schedules.
These audits shall be conducted in accordance with government auditing
standards and AU-C 805, special considerations - audits of single financial
statements and specific elements, accounts, or items of a financial statement.
(b) Pursuant to AU-C 805.16, the PERA and
ERB auditors shall each issue a separate auditor’s report and express a
separate opinion on the AU-C 805 audit performed (distinct from the agency’s
regular financial statement and compliance audit). Additionally, the auditor shall apply the
procedures required by AU-C 725 to all supplementary information schedules
included in the schedule of employer allocations report in order to determine
whether the supplementary information is fairly stated, in all material respects,
in relation to the financial statements as a whole. The IPA shall include the supplementary
information schedules in the related reporting in the other-matter paragraph
pursuant to AU-C 725.09, regarding whether such information is fairly stated in
all material respects in relation to the schedule of employer allocations as a
whole.
(c) PERA
and ERB shall include note
disclosures in their respective schedule of employer allocations reports that
detail each component of allocable pension expense at the fund level, excluding
employer-specific pension expense for changes in proportion. Each plan shall also include note disclosures
by fund detailing collective fund-level deferred outflows of resources and
deferred inflows of resources. The
disclosures shall include a summary of changes in the collective deferred and
inflows outflows of resources (excluding employer specific amounts), by year of
deferral.
(d) The AU-C 805 audits and resulting
separate reports on the PERA and ERB schedules of employer allocations shall be
submitted to the OSA for review and release pursuant to Subsection A of
2.2.2.13 NMAC, prior to distribution to the participant employers.
(e) As
soon as the AU-C 805 reports become public record, PERA and ERB shall make the
information available to their participant employers.
(f) PERA
and ERB shall each prepare an
employer guide that illustrates the use of their respective schedule of
employer allocations report to create journal entries generally required by
GASBS 68. The calculations necessary at
the employer level (for adjusting journal entries, amortization of deferred
amounts, etc.) shall be described and illustrated. The employer guides shall be made available
to the participant employers by June 30 of the subsequent fiscal year. Stand-alone state agency financial statements
that exclude the proportionate share of the collective net pension liability of
the state of New Mexico shall include note disclosure referring the reader to
the statewide ACFR for the state’s net pension liability and other pension-related information.
(2) Stand-alone
state agency financial statements that exclude the proportionate share of the
collective net pension liability of the state of New Mexico shall include note
disclosure referring the reader to the statewide ACFR for the state’s net
pension liability and other pension-related information.
Z. GASBS 77, tax abatement agreements: Unaudited,
but final, GASBS 77 disclosure information shall be provided to any agency
whose tax revenues are affected by the reporting agency’s tax abatement
agreements no later than September 15 of the subsequent fiscal year. This due date does not apply if the reporting
agency does not have any tax abatement agreements that reduce the tax revenues
of another agency. All tax abatement
agreements entered into by an agency’s component unit(s) shall be disclosed in
the same manner as the tax abatement agreements of the primary government. If an agency determines that any required
disclosure is confidential, the agency shall cite the legal authority for the
determination.
AA. GASBS 75, accounting and financial
reporting for postemployment benefits other than pensions: RHCA shall prepare a schedule of employer
allocations as of June 30 of each fiscal year.
The state auditor requires the following:
(1) Prior
to distribution of the schedule of employer allocations, RHCA shall obtain an
audit of the schedule. This audit shall
be conducted in accordance with government auditing standards and AU-C 805,
special considerations - audits of single financial statements and specific
elements, accounts, or items of a financial statement.
(2) Pursuant to AU-C 805.16, the RHCA
auditors shall issue a separate auditor’s report and express a separate opinion
on the AU-C 805 audit performed (distinct from the agency’s regular financial
statement and compliance audit).
Additionally, the auditor shall apply the procedures required by AU-C
725 to all supplementary information schedules included in the schedule of
employer allocations report in order to determine whether the supplementary
information is fairly stated, in all material respects, in relation to the
financial statements as a whole. The IPA
shall include the supplementary information schedules in the related reporting
in the other-matter paragraph pursuant to AU-C 725.09, regarding whether such
information is fairly stated in all material respects in relation to the
schedule of employer allocations as a whole.
(3) RHCA shall include note disclosures in the
schedule of employer allocations report that detail each component of allocable
other post-employment benefits (OPEB) expense at the fund level, excluding
employer-specific OPEB expense for changes in proportion. RHCA shall also
include note disclosures by fund detailing collective fund-level deferred
outflows of resources and deferred inflows of resources. The disclosures shall include a summary of
changes in the collective deferred outflows and inflows of resources (excluding
employer specific amounts), by year of deferral.
(4) The AU-C 805 audit and resulting
separate report on the RHCA schedule of employer allocations shall be submitted
to the OSA for review and release pursuant to Subsection A of 2.2.2.13 NMAC,
prior to distribution to the participant employers.
(5) As
soon as the AU-C 805 reports become public record, RHCA shall make the
information available to its participant employers.
(6) RHCA
shall prepare an employer guide that illustrates the correct use of the
schedule of employer allocations report by its participant employers. The guide shall explicitly distinguish
between the plan-level reporting and any employer-specific items. The calculations and record-keeping necessary
at the employer level (for adjusting journal entries, amortization of deferred
amounts, etc.) shall be described and illustrated. The employer guide shall be made available to
the participant employers by June 30 of the subsequent fiscal year.
(7) Stand-alone
state agency financial statements that exclude the proportionate share of the
collective OPEB liability of the state of New Mexico, shall include note
disclosure referring the reader to the statewide ACFR for the state’s net OPEB
liability and other OPEB-related information.
[2.2.2.10 NMAC -
Rp, 2.2.2.10 NMAC, 4/21/2026]
2.2.2.11 [RESERVED]
2.2.2.12 SPECIFIC
CRITERIA: The specific criteria
described in this section shall be considered in planning and conducting
governmental audits. These requirements
are not intended to be all-inclusive; therefore, OSA recommends that IPAs
review the NMSA and NMAC while planning governmental audits.
A. Pertaining to audits of state agencies:
(1) Due dates for
agency audits: audit reports of agencies under the oversight of DFA FCD are due
to OSA in accordance with the requirements of Subsection D of Section 12-6-3
NMSA 1978 and Subsection A of 2.2.2.9 NMAC.
(2) All the individual
SHARE funds shall be reported in the financial statements, either within the
basic financial statements or as SI.
(3) Accounts payable
at year-end and reversion calculation:
If goods and services were received (as defined by generally accepted
accounting principles) by the end of the fiscal year but not paid for by the
end of the fiscal year, an accounts payable shall be reported for the
respective amount due in both the government-wide financial statements and the
fund financial statements. The “actual” expenditures in the
budgetary comparison exclude any accounts payable that were not paid timely and
therefore require a request to the financial control division to pay prior year
bills out of the current year budget.
They are paid out of the budget of the following fiscal year. An agency’s reversions are calculated using
the budgetary basis expenditures
because the agency does not have the legal authority to obligate the state for
liabilities once the appropriation period has lapsed. Thus, the agency cannot keep the cash related
to accounts payable that were not paid timely.
This results in a negative fund balance in the modified accrual basis
financial statements of a reverting fund.
(4) Net position/fund balance:
(a) Pursuant to GASBS
63.8 the government-wide statement of net position and the proprietary fund
statement of net position show net position as:
(i) net
investment in capital assets as defined by GASBS 63.9;
(ii) restricted
(distinguishing between major categories of restrictions) as defined by GASBS
63.10; and
(iii) unrestricted
as defined by GASBS 63.11.
(b) Governmental fund
financial statement fund balances shall be reported in accordance with GASBS
54.
(5) Book
of record:
(a) The
state maintains the centralized accounting system SHARE. The SHARE data and reports are the original
book of record that the auditor is auditing.
Each fiscal year, the agency shall record all audit adjusting journal
entries in SHARE. The financial
information in SHARE shall agree to the agency’s audited financial statements, except
for accounts payable as described in Subsection A of 2.2.2.12 NMAC. If the agency maintains a separate accounting
system, it shall be reconciled with the SHARE system and all applicable
adjustments shall be recorded in SHARE in the month in which the transactions
occurred. DFA FCD provides guidance to
agencies, which IPAs shall review, regarding policy and procedure
requirements. These documents are
available on the DFA FCD website and include:
(i) the
manual of model accounting practices (MAPs);
(ii) various
white papers, yearly closing instructions; and
(iii) various
accounting guideline memos.
(b) The
statement of revenues and expenditures in the audit report shall be presented
in accordance with GAAP, by function or program classification and object
code. However, the budgetary comparison
statements shall be presented using the level of appropriation reflected in the
final approved budget. The SHARE chart
of accounts reflects the following appropriation unit levels:
|
Appropriation unit code/appropriation unit description |
|
|
200 |
personal
services & employee benefits |
|
300 |
contractual
services |
|
400 |
other |
|
500 |
other financing
uses |
|
600 |
non-budgeted |
(c) Revenue
categories of appropriations to state agencies are listed below. The budgetary comparison statements for state
agencies shall be presented in the audit report by the revenue categories shown
below and by the expenditure categories that appear in the agency’s final
approved budget.
(i) state general
fund;
(ii) other state funds;
(iii) internal service
funds/inter-agency transfers; or
(iv) federal funds.
(d) For more detail
about the SHARE chart of accounts see the DFA website.
(6) Reversions
to state general fund:
(a) All
reversions to the state general fund shall be identified in the financial
statements or the notes to the financial statements by the fiscal year of
appropriation (i.e., reversion to state general fund - FY 16). The gross amount of the appropriation and the
gross amount of the reversion shall be shown separately.
(b) Subsection A of Section 6-5-10 NMSA
1978 states “all unreserved undesignated fund balances in reverting funds and
accounts as reflected in the central accounting system as of June 30 shall
revert by September 30 to the general fund.
The division may adjust the reversion within 45 days of release of the
audit report for that fiscal year.”
Failure to transfer reverting funds timely in compliance with the statute
requires an audit finding.
(7) Non-reciprocal
(not payments for materials or services rendered) interfund (internal) activity
includes:
(a) transfers;
and
(b) reimbursements
(GASBS 34.410):
(i) intra-agency
transfers between funds within the agency shall offset (i.e. balance). Reasons for intra-agency transfers shall be
fully explained in the notes to the financial statements. In the separate audit reports of state
agencies, transfers between their internal funds are shown as other financing
sources or uses in the fund financial statements and as transfers (that get
eliminated) in the government-wide financial statements;
(ii) inter-agency
transfers (between an agency’s internal funds and other funds of the state that
are outside the agency such as state general fund appropriations, special
appropriations, bond proceeds appropriations, reversions to the state general
fund, and transfers to/from other state agencies) shall be segregated from
intra-agency transfers and fully explained in the notes to the financial
statements along with the agency number and SHARE fund number to whom and from
whom transferred. The transfers may be detailed
in supporting schedules rather than in the notes, but agency and SHARE fund
numbers shall be shown. The schedule
shall be presented on the modified accrual basis. The IPA is responsible for performing audit
procedures on all such inter-agency transfers.
(c) Regarding
inter-agency transfers between legally separate component units and the primary
government (the state of New Mexico):
(i) if the
inter-agency transfer is between a blended component unit of the state and
other funds of the state, then the component unit’s separately issued financial
statements report such activity between itself and the primary government as
revenues and expenses. When the blended
component unit is included in the primary government’s financial statements,
such inter-agency transfers are reclassified as transfers (GASBS 34.318);
(ii) all resource flows between a
discretely presented component unit of the state and other funds of the state
shall be reported as external transactions - revenues and expenses - in the
primary government’s financial statements and the component unit’s separately
issued financial statements (GASBS 34.318);
(d) All transfers to
and from SHARE fund 853, the state general fund appropriation account, shall be
clearly identifiable in the audit report as state general fund appropriations,
reversions, or collections;
(e) Reimbursements are
transfers between funds that are used to reallocate the revenues and
expenditures/expenses to the appropriate fund.
Reimbursements are not reported as inter-fund activity in the financial
statements.
(8) GSD
capital projects: in general, GSD records the state of New Mexico capitalized
land and buildings for which it is responsible, in its accounting records. The cost of furniture, fixtures, and moveable
equipment owned by agencies is to be capitalized in the accounting records of
the agency that purchased them. The
agency shall capitalize those assets based on actual amounts expended in
accordance with GSD instructions issued in 2.20.1.10 NMAC.
(9) State-owned
motor vehicle inventory: successful management of state-owned vehicles pursuant
to the Transportation Services Act (Sections 15-8-1 to 15-8-11 NMSA 1978) is
dependent on reliable and accurate capital assets inventory records and
physical verification of that inventory.
Thus, the annual audit of state agencies shall include specific tests of
the reliability of the capital assets inventory and verification that a
physical inventory was conducted for both the agency's owned vehicles and
long-term leased vehicles.
(10) Independent auditor’s
report: The independent auditor’s report
for state agencies, district attorneys, district courts, and the educational
institutions created by New Mexico Constitution Article XII, Sec. 11 shall include
an emphasis of matter paragraph referencing the summary of significant
accounting principles disclosure regarding the reporting agency. The emphasis of matter paragraph shall
indicate that the financial statements are not intended to present the
financial position and changes in financial position of the primary government,
the state of New Mexico, but just the financial position and the changes in
financial position of the department.
The emphasis of matter paragraph shall follow the example provided in
AAG SLV 17.103 ex. A-17.
(11) Budgetary
basis for state agencies: the state budget is adopted on the modified accrual
basis of accounting except for accounts payable accrued at the end of the
fiscal year that do not get accrued by the statutory deadline per Section
6-10-4 NMSA 1978. Those accounts payable
that do not get paid timely or accrued by the statutory deadline shall be paid
out of the next year’s budget. If an
agency needs to recognize additional accounts payable amounts that were not
accrued by the statutory deadline, then the budgetary statements and the fund
financial statements require a reconciliation of expenditures, as discussed at
Subsection Q of 2.2.2.10 NMAC. All
transactions are recorded in the state’s book of record, SHARE, under the
modified accrual basis of accounting except for accounts payable not meeting
the statutory deadline; therefore, the “actual” expenditures in the budgetary
comparison schedules equal the expenditures as recorded in SHARE for the fund. Encumbrances related to single year
appropriations lapse at year end.
Appropriation periods are sometimes for periods in excess of 12 months
(multiple-year appropriations). When
multiple-year appropriation periods lapse, the authority for the related
budgets also lapse and encumbrances can no longer be charged to those
budgets. The legal level of budgetary
control shall be disclosed in the notes to the financial statements. Per Subsection C of Section 9 of the General
Appropriation Act of 2017, all agencies, including legislative agencies, may
request category transfers among personal services and employee benefits,
contractual services and other.
Therefore, the legal level of budgetary control is the appropriation
program level (A-Code, P-Code, and Z-Code).
A-Codes pertain to capital outlay appropriations (general
obligation/severance tax or state general fund). P-Codes pertain to program/operating funds.
Z-Codes pertain to special appropriations.
The IPA shall compare total expenditures for each program to the
program’s approved final budget to evaluate compliance.
(12) Budgetary
comparisons of state agencies shall show the original and final appropriated
budget (same as final budget approved by DFA), a column with variances between
original and final budget amounts, the actual amounts on the budgetary basis,
and a column with the variance between the final budget and actual
amounts. If a state agency presents
budgetary comparisons by fund, the appropriation program code(s) (A-Code,
P-Code, and Z-Code) shall be reported on the budgetary comparison schedule.
(13) Accounting for special capital outlay
appropriations financed by bond proceeds.
(14) Amounts “due from other
state agencies” and “due to other state agencies”: if a state agency reports
amounts “due from” or “due to” other state agencies the notes shall disclose
the amount “due to” or “due from” each agency, the name of each agency, the SHARE
fund account numbers, and the purpose of the account balance.
(15) Investments in the state
general fund investment pool (SGFIP): these balances are presented as cash and
cash equivalents in the statements of net position and the balance sheets of
the participant agencies, with the exception of the component appropriation
funds (state general fund). The notes to
the financial statements of the component appropriation funds shall contain
GASBS 40 disclosures for the SGFIP. This
disclosure may refer the reader to the separate audit report for STO for
additional information regarding the SGFIP.
(16) Format for the statement
of activities: state agencies that have
more than one program or function shall use the financial statement format
presented in GASBS 34, Illustrations B-1 through B-4. The simplified statement of activities (GASBS
34, Illustration B-5) may not be used for agencies that have multiple programs
or functions. GASBS 34.41 requires governments to report direct expenses for
each function.
B. Pertaining to audits of housing authorities:
(1) Housing
authorities within the state of New Mexico consist of regional housing
authorities, component units or departments of local governments, component
units of housing authorities, and housing authorities created by
intergovernmental agreements between cities and counties that are authorized to
exercise all powers under the Municipal Housing Law, Section 3-45-1 et seq., NMSA 1978.
(2) The
financial statements of a housing authority that is a department, program or
component unit of a primary government shall be included in the financial audit
report of the primary government. IPAs
shall use GASB guidelines as found in relevant GASBS to determine the correct
presentation of the component unit.
(3) Audits of public
housing authorities (PHAs) that are departments of a local government shall be
conducted by the same IPA that performs the audit of the local government. Separate audit contracts shall not be
approved.
(a) Local
governments are encouraged to include representatives from PHAs that are
departments of the local government in the IPA selection process.
(b) The
IPA shall include the housing authority’s governing board and management
representatives in the entrance and exit conferences with the primary
government. If it is not possible to
hold such combined conferences, the IPA shall hold separate entrance and exit
conferences with housing authority’s management and a member of the governing
board. The OSA has the authority to
notify the agency or IPA that the state auditor shall be informed of the date
of the entrance conference, any progress meetings and the exit conference. If such notification is received, the IPA and
agency shall invite the state auditor to attend all such conferences no later
than 72 hours before the proposed conference.
(4) The following
information relates to housing
authorities that are component units of a local government.
(a) The housing
authority shall account for financial activity in proprietary funds.
(b) At the PHA’s
discretion, the agency may “be audited separately from the audit of its local
primary government entity, other than a housing department of a local
government or a regional housing authority.
If a separate audit is made, the public housing authority audit shall be
included in the local primary government entity audit and need not be conducted
by the same auditor who audits the financial affairs of the local primary
government entity” (Subsection E of Section 12-6-3 NMSA 1978). The Audit Act further stipulates in
Subsection A of Section 12-6-4 NMSA 1978 that “a public housing authority other
than a regional housing authority shall not bear the cost of an audit conducted
solely at the request of its local primary government entity.”
(c) Audit reports of separate audits of
component unit housing authorities shall be released by the state auditor
separately from the primary government’s report under a separate release letter
to the housing authority.
(5) Public housing authorities and their
IPAs shall follow the requirements of Guidelines
on Reporting and Attestation Requirements of Uniform Financial Reporting
Standards (UFRS), which is available on the U.S. department of housing and
urban development’s website under a search for UFRS. Additional administrative issues related to
audits of public housing authorities follow.
(a) Housing authority audit contracts
include the cost of the audit firm’s AU-C 725 opinion on the FDS. The preparation and submission cost for this
HUD requirement shall be included in the audit contract. The public housing authority shall
electronically submit a final approved FDS based on the audited financial
statements no later than nine months after the public housing authority’s
fiscal year end. The IPA shall:
(i) electronically
report on the comparison of the electronic FDS submission in the real estate
assessment center staging database through the use of an identification (ID)
and password;
(ii) include
an electronic version of the FDS in the audit report;
(iii) render an AU-C 725
opinion on the FDS; and
(iv) explain
in the notes any material differences between the FDS and the financial
statements.
(b) The
IPA shall consider whether any fee accountant used by the housing authority is
a service organization and, if applicable, follow the requirements of AU-C 402
regarding service organizations.
(c) The IPA shall
provide the housing authority with an itemized cost breakdown by program area
for audit services rendered in conjunction with the housing authority.
(6) Single audit
reporting issue: If a single audit is
performed on the separate audit report for the public housing authority,
including the housing authority’s schedule of expenditures of federal awards,
the housing authority federal funds do not need to be subjected a second time
to a single audit during the single audit of the primary government. In this
situation, the housing authority’s federal expenditures do not need to be
included in the primary government’s schedule of expenditures of federal
awards. See AAG GAS 6.15 for more
information.
C. Pertaining to audits of school districts:
(1) If a
state-chartered charter school subject to oversight by PED is not subject to
the requirement to use the same auditor as PED, the charter school shall submit
their audit contract to PED for approval.
Charter schools shall ensure that sufficient time is allowed for PED
review. See Subsection F of 2.2.2.8 NMAC
for the due date for submission of the audit contract to the OSA.
(2) REC audits:
(a) A separate
financial and compliance audit is required on activities of RECs. The IPA shall provide copies of the REC
report to the participating school districts and PED once the report has been
released by the state auditor.
(b) Audits of RECs
shall include tests for compliance with 6.23.3 NMAC.
(c) Any ‘on-behalf’
payments for fringe benefits and salaries made by RECs for employees of school
districts shall be accounted for in accordance with GASB Cod. Sec. N50.135 and
communicated to the employer in accordance with GASB Cod. Sec. N50.131.
(d) The audit report
of each REC shall include a cash reconciliation schedule which reconciles the
cash balance as of the end of the previous fiscal year to the cash balance as
of the end of the current fiscal year.
This schedule shall account for cash in the same categories used by the
REC in its monthly cash reports to the PED.
If there are differences in cash per the REC financial statements and
cash per the REC accounting records, the IPA shall provide the adjusting
entries to the REC to reconcile cash per the financial statements to cash per
the REC accounting records. If cash per
the REC accounting records differs from the cash amount the REC reports to PED
in the monthly cash report, the IPA shall issue a finding which explains that
the PED reports do not reconcile to the REC accounting records.
(3) School district
audits shall address the following issues:
(a) Audits of school
districts shall include tests for compliance with 6.20.2 NMAC and PED’s manual
of procedures for public schools accounting and budgeting (PSAB), with specific
emphasis on supplement 7, cash controls.
(b) The
audit report of each school district shall include a cash reconciliation
schedule which reconciles the cash balance as of the end of the previous fiscal
year to the cash balance as of the end of the current fiscal year. This schedule is also required for each
charter school chartered by a school district and each charter school chartered
by PED. This schedule shall account for
cash in the same categories used by the district in its monthly cash reports to
PED. Subsection D of 6.20.2.13 NMAC
states that school districts shall use the “cash basis of accounting for
budgeting and reporting”. The financial
statements are prepared on the accrual basis of accounting. Subsection E of 6.20.2.13 NMAC states that
“if there are differences between the financial statements, school district
records and department records, the IPA should provide the adjusting entries to
the school district to reconcile the report to the school district records.” If there are differences between the school
district records and the PED report amounts, other than those explained by the
adjusting entries, the IPA shall issue a finding which explains that the PED
reports do not reconcile to the school district records.
(c) Any joint ventures
or other Agencies created by a school district are agencies subject to the
Audit Act.
(d) Student
activity funds: Risk should be assessed,
and an appropriate sample tested regarding controls over student activity
funds.
(e) Relating
to capital expenditures by the New Mexico public school facilities authority
(PSFA), school districts shall review capital expenditures made by PSFA for
repairs and building construction projects of the school district. School districts shall also determine the
amount of capital expenditures that shall be added to the capital assets of the
school district and account for those additions properly. The IPA shall test the school district
capital asset additions for proper inclusion of these expenditures.
(f) Sub-funds
of the general fund: school district audit reports shall include individual
fund financial statements for the following sub-funds of the general fund: operational, transportation, instructional
materials and teacherage (if applicable).
(4) Pertaining
to charter schools:
(a) A charter school
is a conversion school or start-up school within a school district authorized
by the local school board or PED to operate as a charter school. A charter school is considered a public
school, accredited by the state board of public education and accountable to
the school district’s local school board, or PED, for ensuring compliance with
applicable laws, rules and charter provisions.
A charter school is administered and governed by a governing body in a
manner set forth in the charter.
(b) Certain GASBS 14
criteria (as amended by GASBS 39, 61, and 80) shall be applied to determine
whether a charter school is a component unit of the chartering entity (the
district or PED). The chartering agency
(primary government) shall make the determination whether the charter school is
a component unit of the primary government.
(c) No charter school that has been
determined to be a component unit may be omitted from the financial statements
of the primary government based on materiality.
All charter schools that are component units shall be included in the
basic financial statements using one of the presentation methods described in
GASBS 34.126, as amended.
D. Pertaining to audits of counties: Tax roll reconciliation county
governments: Audit reports for counties
shall include two SI schedules.
(1) The
first one is a “tax roll reconciliation of changes in the county treasurer’s
property taxes receivable” showing the June 30 receivable balance and a
breakout of the receivable for the most recent fiscal year ended, and a total
for the previous nine fiscal years. Per
Subsection C of Section 7-38-81 NMSA 1978, property taxes that have been
delinquent for more than 10 years, together with any penalties and interest,
are presumed to have been paid.
(2) The
second schedule titled “county treasurer’s property tax schedule” shall show by
property tax type and agency, the amount of taxes: levied; collected in the current year;
collected to-date; distributed in the current year; distributed to-date; the
amount determined to be uncollectible in the current year; the uncollectible
amount to-date; and the outstanding receivable balance at the end of the fiscal
year. This information is necessary for
proper revenue recognition on the part of the county as well as on the part of
the recipient agencies, under GASBS 33.
If the county does not have a system set up to gather and report the
necessary information for the property tax schedule, the IPA shall issue a
finding.
E. Pertaining to audits of educational
institutions:
(1) Educational
institutions are reminded that audit contracts shall be submitted to HED for
approval. Refer to Subsection F of
2.2.2.8 NMAC for the due date for submission of the audit contract to the OSA.
(2) Budgetary
comparisons: the legal level of
budgetary control per 5.3.4.10 NMAC shall be disclosed in the notes to the
financial statements. The state auditor
requires that every educational institution’s audit report include budgetary
comparisons as SI. The budgetary
comparisons shall be audited and an auditor’s opinion shall be rendered. An AU-C 725 opinion does not meet this
requirement. The budgetary comparisons
shall show columns for: the original budget; the revised budget; variances
between the original budget and the revised budget, actual amounts on the
budgetary basis; and variances between the revised budget and actual amounts. The IPA shall confirm the final adjusted and
approved budget with HED. The IPA shall
compare the financial statement budget comparison to the related September 15
budget submission to HED. The only
differences that should exist between the HED budget submission and the
financial statement budgetary comparisons are adjustments made by the institution
after September 15 and audit adjustments.
If the HED budget submission does not tie to the financial statement
budgetary comparison, taking into account only those differences, then the IPA
shall write a related finding. A
reconciliation of actual revenue and expense amounts on the budgetary basis to
the GAAP basis financial statements shall be disclosed at the bottom of the
budgetary comparisons or in the notes to the financial statements. The reconciliation is required only at the
“rolled up” level of “unrestricted and restricted - all operations” and shall
include revenues and expenses. HED
approved the following categories which shall be used for the budgetary
comparisons.
(a) Unrestricted and restricted - All
operations (schedule 1): beginning fund balance/net position; unrestricted and restricted revenues; state general fund appropriations; federal revenue sources; tuition and fees; land and permanent fund; endowments
and private gifts; other; total unrestricted & restricted
revenues; unrestricted and
restricted expenditures; instruction; academic support; student services; institutional
support; operation and maintenance
of plant; student social &
cultural activities; research; public service; internal services; student aid, grants & stipends; auxiliary services; intercollegiate athletics; independent operations; capital outlay; renewal &
replacement; retirement of
indebtedness; total unrestricted
& restricted expenditures; net transfers; change in fund balance/net position (budgetary basis); ending fund
balance/net position.
(b) Unrestricted
instruction & general (schedule 2):
beginning fund balance/net position;
unrestricted revenues; tuition; miscellaneous fees; federal government appropriations; state government appropriations; local government appropriations; federal government contracts/grants; state government contracts/grants; local government contracts/grants; private contracts/grants; endowments; land & permanent fund; private
gifts; sales and services; other; total unrestricted revenues;
unrestricted expenditures; instruction; academic support; student services; institutional
support; operation & maintenance
of plant; total unrestricted expenditures;
net transfers; change in fund
balance/net position (budgetary basis); ending
fund balance/net position.
(c) Restricted
instruction & general (schedule 3):
beginning fund balance/net position;
restricted revenues; tuition; miscellaneous fees; federal government appropriations; state government appropriations; local government appropriations; federal government contracts/grants; state government contracts/grants; local government contracts/grants; private contracts/grants; endowments; land & permanent fund; private
gifts; sales and services; other; total restricted revenues; restricted
expenditures; instruction; academic support; student services; institutional
support; operation & maintenance
of plant; total restricted
expenditures; net transfers; change in fund balance/net position
(budgetary basis); ending fund balance/net position.
(3) Educational
institutions shall present their financial statements using the business type
activities model.
(4) Compensated absence liability is
reported as follows: the statement of net position reflects the current portion
of compensated absences under current liabilities and the long-term portion of
compensated absences under noncurrent liabilities.
(5) Component
unit issues: educational institutions shall comply with the requirements of
Subsection A of 2.2.2.10 NMAC.
Additionally:
(a) individual component unit budgetary
comparisons are required if the component unit has a “legally adopted
budget.” A component unit has a legally
adopted budget if it receives any federal funds, state funds, or any other
appropriated funds whose expenditure authority derives from an appropriation
bill or ordinance that was signed into law; and
(b) there is no level of materiality for
reporting findings of component units that do not receive public funds. All component unit findings shall be
disclosed in the primary government’s audit report.
(6) Required supplementary information (RSI): The RSI of
educational institutions shall include analysis of significant variations
between original and final budget amounts and between final budget amount and
actual budget results. The analysis
shall include any currently known reasons for those variations that are
expected to have a significant effect on future services or liquidity.
(7) Educational
institutions established by Section 11 of Article XII of the New Mexico state
constitution shall provide the department of finance and administration’s
financial control division with a draft copy of their financial statements
excluding opinions and findings, pursuant to Subsection A of 2.2.2.12 NMAC.
F. Pertaining
to audits of investing agencies: Investing agencies, which are defined as STO,
PERA, ERB, and the state investment council, shall prepare schedules of asset
management costs which include
management fee information by investment class.
(1) For all asset classes except private
asset classes and alternative investment classes, the schedules shall, at
minimum, include the following information:
(a) relating to consultants: the name of
the firm or individual, the location of the consultant (in-state or
out-of-state), a brief description of investments subject to the agreement, and
fees;
(b) relating to
third-party marketers (as defined in
Section 6-8-22 NMSA 1978): the name of the firm or individual, the location of
the marketer (in-state or out-of-state), a brief description of investments
subject to the agreement, and any fees, commissions or retainers;
(c) relating to
traditional asset classes: name of the investment, asset class, value of the
investment, and fees (including both “direct” and “embedded” costs).
(2) For private asset classes and
alternative investment classes, the schedules shall, at minimum, include the
following information:
(a) relating to consultants: the aggregate
fees by asset class and consultant location (in-state or out-of-state), and a
brief description of investments included in each asset class;
(b) relating to
third-party marketers (as defined in
Section 6-8-22 NMSA 1978): aggregate fees, commissions and retainers by asset
class and third-party marketer location (in-state or out-of-state), and a brief
description of investments included in each asset class;
(c) relating to
alternative asset classes: the total fees by asset class (including both
“direct” and “embedded” costs), and a brief description of the investments
included in each asset class.
(3) These schedules shall be included as
unaudited other information in the audit report.
G. Pertaining to audits
of local public bodies; budgetary comparisons: Auditors shall test local public body budgets
for compliance with required reserves and disclose those reserves on the face
of the financial statements and in notes financial statements (if applicable).
[2.2.2.12 NMAC -
Rp, 2.2.2.12 NMAC, 4/21/2026]
2.2.2.13 REVIEW OF AUDIT REPORTS AND AUDIT DOCUMENTATION:
A. Statutory
requirement to review audit reports: Subsection B of Section 12-6-14 NMSA 1978
requires the state auditor or personnel of the office designated by the state
auditor to examine all reports of audits of agencies made pursuant to
contract. All audits performed under
contracts approved by the state auditor are subject to review. The OSA shall review all reports submitted by
the IPA to determine if the reports are presented in accordance with the
requirements of this rule and applicable auditing, accounting and financial
reporting standards. The OSA shall
review all audit reports submitted by the report due date before reviewing
reports that are submitted after the report due date. As discussed in Subsection B of 2.2.2.9 NMAC,
audit reports reissued by the agency and IPA, pursuant to AU-C 560, are also
subject to OSA review procedures.
B. Comprehensive reviews: Released audit reports are subject to a
comprehensive report and audit documentation review by the state auditor. The IPA’s audit documentation shall be
assembled in one complete file or one complete set of files in one location,
whether the documentation is hardcopy or electronic. The documentation shall be either all
hardcopy or all electronic. OSA reviews
of audit and AUP working papers include inspection of firm documentation related
to compliance with governmental auditing, accounting and financial reporting
standards, rules and other requirements issued by GASB, AICPA, GAO, and the OSA.
C. Consequences of deficiencies: If during the course of its review of an audit
report or the related audit documentation, the OSA finds significant
deficiencies that warrant a determination that the audit was not made in
accordance with the provisions of the contract or applicable standards and
requirements, any or all of the following action(s) may be taken;
(1) the IPA may be
required by OSA to correct the deficiencies in the report or audit
documentation, and reissue the audit report to the agency and any others
receiving copies;
(2) the
IPA’s eligibility to perform future engagements may be limited in number or
type of engagement pursuant to Subsection D of 2.2.2.8 NMAC;
(3) for future audit
reports, for some or all audit contracts,
the IPA may be required to submit working papers with the audit reports for
review by the OSA prior to the release of the report; or
(4) the IPA may be
referred to the New Mexico public accountancy board for possible licensure
action.
D. Results of work paper reviews: After the review is completed, the OSA shall
issue a letter to advise the IPA about the results of the review. The IPA shall respond in writing to all
review comments when directed. If the
firm disagrees with any comments, the firm shall provide references to
professional standards supporting the firm’s disagreement. Failure to respond shall be noted during the
firm profile review process. Results of
work paper reviews are confidential audit documentation.
[2.2.2.13 NMAC -
Rp, 2 2.2.13 NMAC, xx/xx/2026]
2.2.2.14 CONTINUING PROFESSIONAL EDUCATION AND PEER REVIEW
REQUIREMENTS:
A. Continuing professional education: IPAs performing annual financial and
compliance audits, or other attest engagements under GAGAS shall ensure that
all members of their staff comply with the CPE requirements of the most recent
revision of GAGAS.
B. Peer review requirements: IPAs performing annual financial and
compliance audits, or other attest engagements under GAGAS shall comply with
the requirements of the most recent revision of GAGAS relating to quality management,
engagement quality reviews and external peer review.
(1) An
audit firm’s due date for its initial peer review is 18 months from the date
the firm enrolled in the peer review program or should have enrolled, whichever
is earlier. A firm’s subsequent peer
review is due three years and six months from the previous peer review year
end.
(2) The
IPA firm profile submission to the state auditor shall include copies of the
following peer review documentation:
(a) the
peer review report for the auditor’s firm;
(b) if
applicable, detailed descriptions of the findings, conclusions and
recommendations related to deficiencies or significant deficiencies required by
GAGAS 5.91;
(c) if
applicable, the auditor's response
to deficiencies or significant deficiencies; and
(d) the
letter of acceptance from the peer review program in which the firm is enrolled.
(3) A
peer review rating of “failed” on the auditor’s peer review may disqualify the
IPA from performing New Mexico governmental audits.
(4) During
the procurement process IPAs shall provide a copy of their most recent external
peer review report to the agency with their bid proposal or offer. Any subsequent peer review reports received
during the period of the contract shall also be provided to the agency.
(5) The
peer review shall meet the requirements of GAGAS 5.60 to 5.95.
C. State auditor engagement quality reviews: The state auditor may perform its own engagement
quality review of IPA audit reports and working papers. An IPA that is included on the state
auditor’s list of approved firms for the first time may be subject to an OSA engagement
quality review of the IPA’s working papers.
This review may be conducted as soon as the documentation completion
date, as defined by AU-C Section 230, has passed (60 days after the report
release date). During the work paper
review process, the state auditor shall take into consideration the fact that
AICPA peer reviews are performed on a risk-based or key-element approach
looking for systemic problems, while the state auditor reviews are
engagement-specific reviews.
[2.2.2.14 NMAC -
Rp, 2.2.2.14 NMAC, 4/21/2026]
2.2.2.15 SPECIAL
AUDITS AND EXAMINATIONS:
A. Fraud, waste or abuse in government
reported by agencies, IPAs or members of the public:
(1) Reports
of fraud, waste & abuse: Pursuant to
the authority set forth Subsection C of Section 12-6-3 NMSA 1978, the OSA may
initiate special investigation or examination procedures in connection with
reports of financial fraud, waste and abuse in government. Reports received or created by the OSA are
confidential audit information and audit documentation in connection with the
state auditor’s statutory duty to examine and audit the financial affairs of
every agency, or in connection with the state auditor’s statutory discretion to
audit the financial affairs and transactions of an agency in whole or in part.
(2) Confidentiality
of sources: The identity of a person
making a report to the OSA alleging financial fraud, waste, or abuse in
government is confidential audit information and may not be disclosed, except
as required by Section 12-6-6 NMSA 1978.
(3) Confidentiality
of files: A report alleging financial
fraud, waste, or abuse in government that is made to the OSA and any resulting
special audit, performance audit, attestation engagement or forensic accounting
or other non-attestation engagement files are confidential audit documentation
and may not be disclosed by the OSA or the agency, except to an independent
auditor, performance audit team or forensic accounting team in connection with
a special audit, performance audit, attestation engagement, forensic accounting
engagement, non-attestation engagement, or other existing or potential
engagement regarding the financial affairs or transactions of an agency.
(a) Any records that result in, or are
part of, any subsequent or resulting special audit, performance audit,
attestation engagement or forensic accounting or other non-attestation
engagement will be audit workpapers and therefore confidential. Records that result from, or are part of OSA,
special investigations that do not result in a subsequent special audit,
performance audit, attestation engagement or forensic accounting or other
non-attestation engagement may be disclosed, with personal identifier information
redacted, once the examination or investigation is closed.
(b) Any information related to a report
alleging financial fraud, waste, or abuse in government provided to an
independent auditor, performance audit team or forensic accounting team, is
considered to be confidential audit or engagement documentation and is subject
to confidentiality requirements, including but not limited to requirements
under Subsections E and M of 2.2.2.10 NMAC, the Public Accountancy Act, and the
AICPA Code of Professional Conduct.
(4) If
the OSA makes inquiries of agencies as part of the investigation process,
agencies shall respond to the OSA inquiries within 15 calendar days of receipt
or as soon as practicable under the circumstances with written notice to the
OSA stating the basis for any delay. IPAs
shall test compliance with this requirement and report noncompliance as a
finding in the annual financial and compliance audit report.
B. Special audit or examination process:
(1) Designation: Pursuant to Section 12-6-3 NMSA 1978, in
addition to the annual audit, the state auditor may cause the financial affairs
and transactions of an agency to be audited in whole or in part. Accordingly, the state auditor may designate
an agency for special audit, attestation engagement, performance audit,
forensic accounting engagement, or non-attestation engagement regarding the
financial affairs and transactions of an agency or local public body based on
information or a report received from an agency, IPA or member of the
public. For purposes of this rule
“special audit, attestation engagement, performance audit, forensic accounting
engagement, or non-attestation engagement” includes, without limitation, AUP,
consulting, and contract close-out (results-based award) engagements that
address financial fraud, waste, or abuse in government. It also includes non-attestation engagements
performed under the forensic services standards issued by the AICPA and
engagements performed following the Code of Professional Standards issued by
the Association of Certified Fraud Examiners (ACFE). The state auditor shall inform the agency of
the designation by sending the agency a notification letter. The state auditor may specify the subject
matter, the scope and any procedures required, the AICPA or other professional
standards that apply, and for a performance audit, performance aspects to be
included and the potential findings and reporting elements that the auditors
expect to develop. Pursuant to Section 200.503
of Uniform Guidance, if a single audit was previously performed, the special
audit, attestation engagement, performance audit or forensic accounting
engagement shall be planned and performed in such a way as to build upon work
performed, including the audit documentation, sampling, and testing already
performed by other auditors. The
attestation and performance audit engagements may be conducted pursuant to
government auditing standards if so specified by the OSA.
(2) Costs:
All reasonable costs of special audits, attestation engagements,
forensic accounting engagements, non-attestation engagements, or single-entity
performance audits conducted pursuant to this Section shall be borne by the
agency audited pursuant to Section 12-6-4 NMSA 1978. The state auditor, in its sole discretion,
may apportion among the agencies audited some or all of the reasonable costs of
a multi-entity performance audit.
(3) Who
performs the engagement: The state
auditor may perform the special audit, attestation engagement, performance
audit, forensic accounting engagement, or non-attestation engagement alone or
with other professionals selected by the state auditor. Alternatively, the state auditor may require
the engagement to be performed by an IPA or a team that may be comprised of any
of the following: independent public accountants; individuals with masters
degrees or doctorates in a relevant field such as business, public
administration, public policy, finance, or economics; individuals with a juris
doctorate; CFE-certified fraud examiners; CFF-certified forensic auditors;
CIA-certified internal auditors; or other specialists. If the state auditor designates an agency for
an engagement to be conducted by an IPA or professional team, the agency shall:
(a) upon
receipt of notification to proceed from the state auditor, identify all
elements or services to be solicited, obtain the state auditor’s written
approval of the proposed scope of work, and request quotations or proposals for
each applicable element of the engagement;
(b) follow
all applicable procurement requirements which may include, but are not limited
to, Uniform Guidance, Procurement Code (Sections 13-1-28 through 13-1-199 NMSA
1978), or equivalent home rule procurement provisions when selecting an IPA or
team to perform the engagement;
(c) submit the following information to
the state auditor by the due date specified by the state auditor:
(i) a
completed template for special audits, attestation engagements, performance
audits or forensic accounting engagements, provided at www.osanm.org, which the
agency shall print on agency letterhead; and
(ii) a
completed contract form including the contract fee, start and completion date,
and the specific scope of services to be performed in the format prescribed by
the OSA, provided at www.osanm.org,
with all required signatures on the contract.
(d) If
the agency fails to select an IPA and submit the signed contract to OSA by the
due date specified by the state auditor, or, if none within 60 days of
notification of designation from the state auditor, the state auditor may
conduct the engagement or select the IPA for that agency in accordance with the
process described at Subsection F of 2.2.2.8 NMAC.
(4) Errors: Contracts that are submitted to the OSA with
errors or omissions shall be rejected by the state auditor. The state auditor shall return the rejected
contract to the agency indicating the reason(s) for the rejection.
(5) Recommendation
rejections: If the agency’s
recommendation is not approved by the state auditor, the state auditor shall
promptly communicate the decision, including the reason(s) for rejection, to
the agency, at which time the agency shall promptly submit a different
recommendation. This process shall
continue until the state auditor approves a recommendation and related
contract. During this process, whenever
a recommendation and related contract are not approved, the agency may submit a
written request to the state auditor for reconsideration of the
disapproval. The agency shall submit its
request no later than 15 calendar days from the date of the disapproval and
shall include documentation in support of its recommendation. If warranted, after review of the request,
the state auditor may hold an informal meeting to discuss the request. The state auditor shall set the meeting in a
timely manner with consideration given to the agency’s circumstances.
(6) Contract
amendments: Any proposed contract
amendments shall be processed in accordance with Subsection N of 2.2.2.8 NMAC.
(7) Access
to records and documents: For any
special audit, attestation engagement, performance audit or forensic accounting
engagement, or non-attestation engagement, the state auditor and any engaged
professionals shall have available to them all documents necessary to conduct
the special audit, attestation engagement, performance audit, forensic
accounting engagement, or non-attestation engagement. Furthermore, pursuant to Section 12-6-11 NMSA
1978, when necessary for a special audit, attestation engagement, performance
audit, forensic accounting engagement, or non-attestation engagement the state
auditor may apply to the district court of Santa Fe county for issuance of a
subpoena to compel the attendance of witnesses and the production of books and
records.
(8) Entrance,
progress and exit conferences: The IPA
or other professional shall hold an entrance conference and an exit conference
with the agency, unless the IPA or other professional has submitted a written
request to the state auditor for an exemption from this requirement and has
obtained written approval of the exemption.
The OSA has the authority to notify the agency or IPA or other
professional that the state auditor shall be informed of the date of the
entrance conference, any progress meetings and the exit conference. If such notification is received, the IPA or
other professional and the agency shall invite the state auditor or the
auditor’s designee to attend all such conferences no later than 72 hours before
the proposed conference or meeting. The
state auditor may also require the IPA or other professional to submit its
audit plan to the state auditor for review and approval. The date of the exit conference(s) and the
names and titles of personnel attending shall be stated on the last page of the
special audit report.
(9) Required
reporting: All reports for special
audits, attestation engagements, performance audits, forensic accounting
engagements, or non-attestation engagements related to financial fraud, waste
or abuse in government undertaken pursuant to 2.2.2.15 NMAC (regardless of
whether they are conducted pursuant to AICPA standards for consulting services,
forensic services or for attestation engagements, non-attestation engagements,
or other professional standards) shall report as findings any fraud, illegal
acts, non-compliance or internal control deficiencies, pursuant to Section
12-6-5 NMSA 1978. Each finding shall
comply with the requirements of Subsection L of 2.2.2.10 NMAC for audit and
attestation engagements or Subsection D of 2.2.2.15 NMAC for non-attestation
engagements.
(10) Report
review: As required by Section 12-6-14
NMSA 1978, the state auditor shall review reports of any special audit,
attestation engagement, performance audit, forensic accounting engagement, or
non-attestation engagement made pursuant to this section for compliance with
the professional services contract and this rule. Upon completion of the report, the IPA or
other professional shall deliver the electronic report to the state auditor
with a copy of any signed management representation letter, if applicable. Unfinished or excessively deficient reports
shall be rejected by the state auditor.
If the report is rejected the firm shall submit an electronic version of
the corrected rejected report for state auditor review. The name of the electronic file shall be
“corrected rejected report” followed by the agency name and fiscal year. The IPA or other professional shall respond
to all review comments as directed by the state auditor.
(11) Report
release: After OSA’s review of the report for compliance with the professional
services contract and this rule, the state auditor shall authorize the IPA to
print and submit the final report. An
electronic version of the report, in the PDF format described at Subsection B
of 2.2.2.9 NMAC, shall be delivered to the state auditor within five business
days. The state auditor shall not
release the report until all the required documents are received by the state
auditor. The state auditor shall provide
the agency with a letter authorizing the release of the report pursuant to
Section 12-6-5 NMSA 1978. Agency and
local public body personnel shall not release information to the public
relating to the special audit, attestation engagement, performance audit,
forensic accounting engagement, or non-attestation engagement until the report
is released and has become a public record pursuant to Section 12-6-5 NMSA
1978. Except for the exception under
Subsection A of 2.2.2.15 NMAC, at all times during the engagement and after the
engagement report becomes a public record, the IPA or other professional(s)
shall not disclose to the public confidential information about the auditee or
about the engagement. Confidential information is information that is not generally
known to the public through common means of providing public information like
the news media and internet.
(12) Disclosure
by professionals: The IPA or other
professional shall not disclose information identified as confidential
information provided to them by the state auditor unless otherwise specified by
the state auditor. Disclosure of
confidential information by the IPA or other professional may result in legal
action by the state auditor, or in the case of an IPA, restriction pursuant to
Subsection D of 2.2.2.8 NMAC.
(13) Payment: Progress payments up to (but not including)
ninety-five percent of the contract amount do not require state auditor
approval and may be made by the agency if the agency monitors the progress of
the services procured. If requested by
the state auditor, the agency shall provide a copy of the approved progress
billing(s). Final payments over
ninety-five percent may be made by the agency pursuant to either of the
following:
(a) stated in the letter accompanying the
release of the report to the agency, or
(b) in
the case of ongoing law enforcement investigations, stated in a letter prior to
the release of the report to the agency.
C. Agency-initiated
special audits or examinations:
(1) Applicability: With the exception of agencies that are
authorized by statute to conduct performance audits and forensic accounting
engagements, this section applies to all special audits and examinations in
which an agency enters into a professional services contract for a special
audit, attestation engagement, performance audit, forensic accounting
engagement, or non-attestation engagement relating to financial fraud, waste or
abuse, but the agency has not been designated by the state auditor for the engagement
pursuant to this rule. For purposes of
this rule, “special audit, attestation engagement, performance audit, forensic
accounting engagement, or non-attestation engagement” includes, without
limitation, AUP, consulting, forensic services and contract close-out
(results-based award) engagements that address financial fraud, waste or abuse
in government.
(2) Any agency, local public body, IPA or
other professional that enters into a professional services contract for a
special audit or examination of the financial affairs and transactions of an
agency or local public body that was not designated by the state auditor for
the engagement must notify the OSA and provide a copy of any resulting report
or any resulting findings of violations of law or good accounting practices to
the OSA. Findings shall be reported as
described in Subsection D of 2.2.2.15 NMAC.
All findings relating to any violation of a criminal statute in
connection with financial affairs must be reported immediately to the OSA
pursuant to Section 12-6-6, NMSA 1978.
D. Finding requirements
for special audits or examinations: Communicating findings: All finding reference numbers shall follow a
consistent format. Findings required by
Section 12-6-5 NMSA 1978 shall be presented in a separate schedule of findings
and placed at the end of the report.
(1) Section
12-6-5 NMSA 1978 requires that for every special audit and examination made
“each report set out in detail, in a separate section, any violation of law or
good accounting practices found by the audit or examination.”
(2) Each finding shall specifically state
and describe the following:
(a) condition
(provides a description of a situation that exists and includes the extent of
the condition and an accurate perspective, the number of instances found, the
dollar amounts involved, if specific amounts were identified);
(b) criteria
(identifies the required or desired state or what is expected from the program
or operation; cites the specific section of law, regulation, ordinance,
contract, or grant agreement if applicable);
(c) effect
(the logical link to establish the impact or potential impact of the difference
between the situation that exists (condition) and the required or desired state
(criteria); demonstrates the need for corrective action in response to
identified problems or relevant risks);
(d) cause
(identifies the reason or explanation for the condition or the factors
responsible for the difference between what the auditors found and what is
required or expected; the cause serves as a basis for the recommendation);
(e) recommendation
addressing each condition and cause; and
(f) agency
response (the agency’s response shall include specific planned corrective actions with a timeline and designation of
what employee position(s) are responsible for meeting the deadlines in the
timeline).
[2.2.2.15 NMAC -
Rp, 2.2.2.15 NMAC, 4/21/2026]
2.2.2.16 ANNUAL FINANCIAL PROCEDURES
REQUIRED FOR LOCAL PUBLIC BODIES WITH ANNUAL REVENUES LESS THAN FIVE HUNDRED
THOUSAND DOLLARS ($500,000) (TIERED SYSTEM):
A. Annual revenue and state funded
capital outlay expenditures determine type of financial reporting: All local public bodies shall comply with the
requirements of Section 6-6-3 NMSA 1978. Pursuant to Section 12-6-3 NMSA 1978, the
annual revenue of a local public body determines the type of financial
reporting a local public body shall submit to the OSA. Local public bodies are mutual domestic water
consumers associations, land grants, incorporated municipalities, and special
districts.
(1) The
annual revenue of a local public body shall be calculated on a cash basis as
follows:
(a) Revenue
shall exclude capital outlay funds. OSA
defines capital outlay funds as funds expended pursuant to the Property Control
Act definition of a capital outlay project.
Per section 15-3B-2 NMSA 1978 “capital outlay project" means the
acquisition, improvement, alteration or reconstruction of assets of a long-term
character that are intended to continue to be held or used, including land,
buildings, machinery, furniture and equipment.
A “capital outlay project” includes all proposed expenditures related to
the entire undertaking.
(b) Revenue
shall exclude federal or private grants.
For the purpose of 2.2.2.16 NMAC “private grant” means funding provided
by a non-governmental entity.
(2) For
the purposes of 2.2.2.16 NMAC “state funded capital outlay expenditures” are
expenditures made pursuant to any funding provided by the New Mexico
legislature for a capital outlay project as defined in the Property Control
Act, Section 15-3B-2 NMSA 1978, either received directly by the local public
body or disbursed through an administering agency.
B. Determination of revenue and services: Annually, following the procedures described
in Subsection F of 2.2.2.8 NMAC, the state auditor shall provide local public
bodies written authorization to obtain services to conduct a financial audit or
other procedures. Upon receipt of the
authorization, a local public body shall determine its annual revenue in
accordance with Subsection A of 2.2.2.16 NMAC.
The following requirements for financial reporting apply to the
following annual revenue amounts (tiers):
(1) if
a local public body’s annual revenue is less than ten thousand dollars
($10,000) and the local public body did not directly expend at least fifty
percent of, or the remainder of, a single capital outlay award, then the local
public body is exempt from submitting a financial report to the state auditor,
except as otherwise provided in Subsection C of 2.2.2.16 NMAC (tier one);
(2) if
a local public body’s annual revenue is ten thousand dollars ($10,000) or more
but less than fifty thousand dollars ($50,000), then the local public body is
exempt from submitting a financial report to the state auditor, except as
otherwise provided in Subsection C of 2.2.2.16 NMAC (tier two);
(3) if a local public body’s annual
revenue is less than fifty thousand dollars ($50,000), and the local public
body expended at least fifty percent of, or more of, a single capital outlay
award during the fiscal year, then the local public body shall procure the
services of an IPA for the performance of a tier three AUP engagement in
accordance with the audit contract for a tier three AUP engagement;
(4) if
a local public body’s annual revenue is greater than fifty thousand dollars
($50,000) but less than two hundred-fifty thousand dollars ($250,000), then the
local public body shall procure the services of an IPA for the performance of a
tier four AUP engagement in accordance with the audit contract for a tier four
AUP engagement;
(5) if
a local public body’s annual revenue is greater than fifty thousand dollars
($50,000) but less than two hundred-fifty thousand dollars ($250,000), and the
local public body expended any capital outlay funds during the fiscal year,
then the local public body shall procure the services of an IPA for the
performance of a tier five AUP engagement in accordance with the audit contract
for a tier five AUP engagement;
(6) if a local public body’s annual
revenue is two hundred-fifty thousand dollars ($250,000) or greater, but less
than five hundred thousand dollars ($500,000), the local public body shall
procure services of an IPA for the performance of a tier six AUP engagement in
accordance with the audit contract for a tier six AUP engagement; the report
shall include at a minimum, a compilation of financial statements and a
financial report consistent with the agreed-upon procedures;
(7) if
a local public body’s annual revenue is five hundred thousand dollars
($500,000) or more, this section shall not apply and the local public body
shall procure services of an IPA for the performance of a financial and
compliance audit in accordance with other provisions of this rule;
(8) notwithstanding
the annual revenue of a local public body, if the local public body expended
seven hundred-fifty thousand dollars ($750,000) or more of federal funds
subject to a federal single audit during the fiscal year then the local public
body shall procure a single audit.
C. Exemption from financial reporting: A local public body that is exempt from
financial reporting to the state auditor pursuant to Subsection B of 2.2.2.16
NMAC shall submit written certification to LGD and the state auditor. The
certification shall be provided on the form made by the state auditor,
available through OSA-Connect. The local
public body shall certify, at a minimum:
(1) the local public body’s annual revenue
for the fiscal year; and
(2) that
the local public body did not expend fifty percent of or the remainder of a
single capital outlay award during the fiscal year.
(3) The
OSA will not accept the certification of exemption from financial reporting for
the current year until the prior year certifications or AUP reports (whichever
is appropriate) have been submitted.
D. Procurement of IPA services: A local public body required to obtain an AUP
engagement shall procure the services of an IPA in accordance with Subsection F
of 2.2.2.8 NMAC.
E. Access to Records and Documents: For any AUP the agency should produce all
documents necessary to conduct the engagement.
F. Requirements of the IPA selected to perform
the AUP:
(1) The
IPA shall provide the local public body with a dated engagement letter during
the planning stages of the engagement, describing the services to be
provided. See Subsection F of 2.2.2.10
NMAC for applicable restrictions on the engagement letter.
(2) The
IPA may not subcontract any portion of the services to be performed under the
contract with the local public body except for the activation of a contingency
subcontractor form in the event the IPA is unable to complete the engagement.
(3) The IPA shall hold an entrance
conference and an exit conference with the local public body. The entrance and exit conference shall occur
in the forum agreed to by the local public body and the IPA, to include virtual
or telephonic options. The OSA reserves
the right to require an in-person entrance or exit conference. The OSA has the authority to notify the
agency or IPA that the state auditor shall be informed of the date of the
entrance conference, any progress meetings and the exit conference. If such notification is received, the IPA and
agency shall invite the state auditor to attend all such conferences no later
than 72 hours before the proposed conference or meeting.
(4) The IPA shall submit the report to the
OSA for review in accordance with the procedures described at Subsection B of
2.2.2.9 NMAC. Before submitting the report to OSA for review, the IPA shall
review the report using the AUP report review guide available on the OSA’s
website at osa.nm.gov. The report shall
be submitted to the OSA for review with the completed AUP report review
guide. Once the AUP report is officially
released to the agency by the state auditor (by a release letter) and the
required waiting period of five calendar days has passed, unless waived by the
agency in writing, the AUP report shall be presented by the IPA, to a quorum of
the governing authority of the agency at a meeting held in accordance with the
Open Meetings Act, if applicable. This
requirement only applies to agencies with a governing authority, such as a
board of directors, board of county commissioners, or city council, which is
subject to the Open Meetings Act. The
IPA shall ensure that the required communications to those charged with
governance are made in accordance with AU-C 260.10 to 260.14.
(1) Progress
payments up to ninety-five percent of the contract amount do not require state
auditor approval and may be made by the local public body if the local public
body ensures that progress payments made do not exceed the percentage of work
completed by the IPA. If requested by
the state auditor, the local public body shall provide the OSA a copy of the
approved progress billing(s).
(2) Final
payments from ninety-five percent to one hundred percent may be made by the
local public body pursuant to either of the following:
(a) stated
in the letter accompanying the release of the report to the agency, or
(b) in
the case of ongoing law enforcement investigations, stated in a letter prior to
the release of the report to the agency. In this situation a letter releasing
the report to the agency will be issued when it is appropriate to release the
report.
H. Report due dates, notification letters and
confidentiality:
(1) For local public bodies with a June 30
fiscal year-end that qualify for the tiered system, the report or certification
due date is December 15. Local public
bodies with a fiscal year end other than June 30 shall submit the AUP report or
certification no later than five months after the fiscal year-end. Late AUP reports (not the current reporting
period) are due not more than six months after the date the contract was
executed. An electronic copy of the
report shall be submitted to the OSA.
AUP reports submitted via fax or email shall not be accepted. A copy of the signed dated management
representation letter shall be submitted with the report. If a due date falls on a weekend or holiday,
or if the OSA is closed due to inclement weather, the report is due the
following business day by 11:59 p.m. MT.
If the report is mailed to the state auditor, it shall be postmarked no
later than the due date to be considered filed by the due date. If the due date falls on a weekend or holiday
the audit report shall be postmarked by the following business day.
(2) As
soon as the IPA becomes aware that circumstances exist that will make the local
public body’s AUP report be submitted after the applicable due date, the
auditor shall notify the state auditor of the situation in writing. This notification shall consist of a letter,
not an email. However, a scanned version
of the official letter sent via email is acceptable. The late AUP notification letter is subject
to the confidentiality requirements detailed at Subsection M of 2.2.2.10 NMAC. This does not prevent the state auditor from
notifying the legislative finance committee or applicable oversight agency
pursuant to Subsections F and G of Section 12-6-3 NMSA 1978. There shall be a separate notification for
each late AUP report. The notification
shall include a specific explanation regarding why the report will be late,
when the IPA expects to submit the report and a concurring signature by the
local public body. If the IPA will not
meet the expected report submission date, then the IPA shall send a revised notification
letter. If the contract was signed after
the report due date, the notification letter shall still be submitted to the
OSA explaining the reason the AUP report will be submitted after the report due
date. The late report notification
letter is not required if the report was submitted to the OSA for review by the
deadline, and then rejected by the OSA, making the report late when
resubmitted.
(3) Local public body personnel shall not
release information to the public relating to the AUP engagement until the
report is released and has become a public record pursuant to Section 12-6-5
NMSA 1978. At all times during the
engagement and after the AUP report becomes a public record, the IPA shall
follow applicable professional standards and 2.2.2 NMAC regarding the release
of any information relating to the AUP engagement.
I. Findings: All AUP engagements shall report as findings
any fraud, illegal acts, non-compliance or internal control deficiencies,
consistent with Section 12-6-5 NMSA 1978.
The findings shall include the required content listed at Subparagraph
(d) of Paragraph (1) of Subsection L of 2.2.2.10 NMAC.
J. Review of AUP reports
and related workpapers: AUP shall be reviewed by the OSA for
compliance with professional standards and the professional services
contract. Noncompliant reports shall be
rejected and not considered received.
Such reports shall be returned to the firm and a copy of the rejection
letter shall be sent to the local public body.
If the OSA rejects and returns an AUP report to the IPA, the report
shall be corrected and resubmitted to the OSA by the due date, or the IPA shall
include a finding for non-compliance with the due date. The IPA shall submit an electronic version of
the corrected rejected report for OSA review.
The name of the electronic file shall be “corrected rejected report”
followed by the agency name and fiscal year.
The OSA encourages early submission of reports to avoid findings for
late reports. After its review of the
AUP report for compliance with professional standards and the professional
services contract, the OSA shall authorize the IPA to print and submit the final
report. An electronic version of the AUP
report, in PDF format, as described at Subsection B of 2.2.2.9 NMAC, shall all
be delivered to the OSA within five business days. The OSA shall not release the AUP report
until the electronic version of the report is received by the OSA. The OSA shall provide the local public body
with a letter authorizing the release of the report after the required five-day
waiting period. Released reports may be
selected by the OSA for comprehensive report and workpaper reviews. After such a comprehensive report and
workpaper review is completed, the OSA shall issue a letter to advise the IPA
about the results of the review. The IPA
shall respond to all review comments as directed. If during the course of its review, the OSA
finds significant deficiencies that warrant a determination that the engagement
was not performed in accordance with provisions of the contract, applicable
AICPA standards, or the requirements of this rule, any or all of the following
action(s) may be taken:
(1) the
IPA may be required to correct the deficiencies in the report or audit
documentation, and reissue the AUP report to the agency and any others
receiving copies;
(2) the
IPA’s eligibility to perform future engagements may be limited in number or
type of engagement pursuant to Subsection D of 2.2.2.8 NMAC;
(3) for
future reports, for some or all contracts, the IPA may be required to submit
working papers with the reports for review by the OSA prior to the release of
the report; or
(4) the
IPA may be referred to the New Mexico public accountancy board for possible
licensure action.
K. IPA
independence:
IPAs shall maintain independence with respect to
their client agencies in accordance with the requirements of the current
government auditing standards.
[2.2.2.16 NMAC -
Rp, 2.2.2.16 NMAC, 4/21/2026]
HISTORY of 2.2.2 NMAC:
Pre-NMAC
Regulatory Filing History: The material
in this part was derived from that previously filed with the State Records
Center and Archives under SA Rule No. 71-1, Regulations of State Auditor
Relating to Audit Contracts with Independent Auditors by State Agencies, filed
5/14/1971; SA Rule No. 71-2, Regulations of State Auditor for Audits by
Independent Auditors, filed 5/27/1971; SA Rule No. 72-1, Regulations of State
Auditor Relating to Audit Contracts With Independent Auditors by Agencies of
the State of New Mexico, filed 6/1/1972; SA Rule No. 72-2, Regulations of State
Auditor for Audits by Independent Auditors, filed 6/1/1972; SA Rule No. 74-1,
Regulations of State Auditor Relating to Reporting Statutory Violations, filed
2/28/1974; SA Rule No. 74-2, Rotation of Assignments, filed 2/28/1974; SA No.
78-1, Regulations Governing the Auditing of New Mexico Governmental Agencies,
filed 11/3/1978; Amendment No. 1 to SA Rule 78-1, Regulations Governing the
Auditing of New Mexico Governmental Agencies, filed 5/28/1980; SA Rule No.
82-1, Regulation Governing the Auditing of New Mexico Governmental Agencies,
filed 12/17/1982; SA Rule No. 84-1, Regulations Governing the Auditing of
Agencies of the State of New Mexico, filed 4/10/1984; SA Rule No. 85-1, Regulations
Governing the Auditing of Agencies of the State of New Mexico, filed 1/28/1985;
SA Rule No. 85-3, Regulation for State Agencies Concerning NCGA Statement No. 4
- Accounting and Financial Reporting Principles for Claims and Judgements and
Compensated Absences, filed 4/16/1980; SA Rule No. 85-4, Regulations Governing
the Auditing of Housing Authorities of the State of New Mexico, filed
6/12/1985; SA Rule No. 85-5, Regulations Pertaining to Single Audits of State
Agencies and Local Public Bodies, filed 6/17/1985; SA Rule No. 85-6, Audits of
Grants to Subrecipients, filed 6/17/1985; SA Rule 86-1, Regulations Governing
the Audits of Agencies of the State of New Mexico, filed 1/20/1986; SA Rule No.
86-2, Regulation Governing Violations of Criminal Statutes in Connection with
Financial Affairs, filed 3/20/1986; SA Rule No. 86-3, Professional Services
Contracts, filed 7/9/1986; SA Rule 87-1, Regulations Governing the Audits of
Agencies of the State of New Mexico, filed 2/13/1987; SA Rule 87-2, Approval of
Audit Contracts, filed 4/2/1987; SA Rule 87-3, Audit Requirements for Deferred
Compensation, Retirement Plans, Budget and Public Money for the State of New
Mexico, filed 8/14/1987; SA Rule 88-1, Regulations Governing the Audits of
Agencies of the State of New Mexico, filed 2/10/1988; SA Rule 89-1, Regulations
Governing the Audits of Agencies of the State of New Mexico, filed 3/10/1989;
SA Rule 90-1, Regulations Governing the Audits of Agencies of the State of New
Mexico, filed 3/1/1990; SA Rule 90-3, Auditor's Responsibilities Related to
Fees Collected on Convictions Relating to Intoxicating Liquor and Controlled
Substances, filed 5/7/1990; SA Rule 91-1, Regulations Governing the Audits of
Agencies of the State of New Mexico, filed 3/13/1991; SA Rule 92-1, Regulations
Governing the Audits of Agencies of the State of New Mexico, filed 3/6/1992; SA
Rule 93-1, Regulations Governing the Audits of Agencies of the State of New
Mexico, filed 2/25/1993; SA Rule 94-1, Regulations Governing the Audits of
Agencies of the State of New Mexico, filed 2/25/1994; Amendment 1 to SA Rule
94-1, Regulations Governing the Audits of Agencies of the State of New Mexico,
filed 5/16/1994; SA Rule 95-1, Regulations Governing the Audits of Agencies of
the State of New Mexico, filed 3/16/1995; and 2 NMAC 2.2, Requirements for
Contracting and Conducting Audits of Agencies, filed 4/2/1996.
History of Repealed Material:
2 NMAC 2.2, Requirements for Contracting and Conducting Audits of
Agencies - Repealed, 3/30/2001.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 3/29/2002.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 4/30/2003.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 3/31/2004.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 5/13/2005.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 3/16/2006.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 4/16/2007.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 4/15/2008.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 2/27/2009.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 2/12/2010.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 2/28/2011.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 2/15/2012.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 2/28/2013.
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies
- Repealed, 2/28/2014.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed,
3/16/2015.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed,
3/15/2016.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed,
3/14/2017.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed,
2/27/2018.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed,
3/10/2020.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed,
3/23/2021.
2.2.2
NMAC Requirements for Contracting and Conducting Audits of Agencies - Repealed,
3/22/2022.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed, 3/28/2023
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies - Repealed, 4/21/2026.
Other
History:
2 NMAC 2.2, Requirements for Contracting and Conducting Audits of
Agencies, filed 3/13/1997, is replaced by
2.2.2 NMAC Requirements for Contracting and Conducting Audits of Agencies,
effective 3/20/2001.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
3/15/2001, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 3/29/2002.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
3/19/2002, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 4/30/2003.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
4/15/2003, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 3/31/2004.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
3/16/2004, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 5/13/2005.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed 5/2/2005,
is replaced by 2.2.2 NMAC Requirements for Contracting and Conducting Audits of
Agencies, effective 3/31/2006..
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
3/16/2006, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 4/16/2007.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed 4/2/2007,
is replaced by 2.2.2 NMAC Requirements for Contracting and Conducting Audits of
Agencies, effective 4/15/2008.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
4/12/2008, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 2/27/2009.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
2/17/2009, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 2/12/2010.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed 2/1/2010,
is replaced by 2.2.2 NMAC Requirements for Contracting and Conducting Audits of
Agencies, effective 2/28/2011.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
2/15/2011, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 2/15/2012.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed 2/1/2012,
is replaced by 2.2.2 NMAC Requirements for Contracting and Conducting Audits of
Agencies, effective 2/28/2013.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
2/15/2013, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 2/28/2014.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
2/13/2014, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 3/16/2015.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed 3/2/2015,
is replaced by 2.2.2 NMAC Requirements for Contracting and Conducting Audits of
Agencies, effective 3/15/2016.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed 3/1/2016,
is replaced by 2.2.2 NMAC Requirements for Contracting and Conducting Audits of
Agencies, effective 3/14/2017.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed 3/1/2017,
is replaced by 2.2.2 NMAC Requirements for Contracting and Conducting Audits of
Agencies, effective 2/27/2018.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
2/27/2020, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 3/23/2021.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
3/11/2021, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective
3/22/2022
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
3/10/2022, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 3/28/2023.
2.2.2 NMAC
Requirements for Contracting and Conducting Audits of Agencies, filed
3/15/2023, is replaced by 2.2.2 NMAC Requirements for Contracting and
Conducting Audits of Agencies, effective 4/21/2026.