Many nonprofits prepare a request for proposal (RFP) or bid to be sent to CPAs/accountants in the community or region. Coming up with a list of those who have performed nonprofit audits or have received the necessary continued professional education for federal nonprofit audits can take a while. Do some research. Talk with other NPOs in your area and see who they are using. Ask if they are they satisfied. Contact the local United Way, the National Association of Nonprofits for your state (http://www.ncna.org/index.cfm?fuseaction=Page.viewPage&pageId=772) and any other umbrella organizations you may be affiliated with for their advice.
TIP: You want to foster competition for the good of the organization. Seek at least three bids - that may require contacting more than three to file RFPs with you, however. Some states are very specific about how the solicitation is to be made, for instance, by invitation or publishing the RFP in a newspaper(s) of general circulation. There may be no prohibition publishing it on your web site, but give that careful consideration. For me that would be a bit too public.
What are the values of an RFP? My experience in using the RFP process in moderate-sized communities such as Youngstown OH and Atlantic City NJ is that
- The bids addressed the audit factors we wanted covered
- The cost from the previous year’s audit decreased
- The bidders showed they had the training and certifications our funders required
- They understood in advance what our requirements are for a contract
- The board had an active role in the process
- It was somewhat difficult gleaning from the Yellow Pages and recommendations to whom we would send an RFP
- We had to spend hours in preparing both the RFP and the draft contract (we’ll see samples in another issue)
- It cost us in time and money preparing and sending out the material
- It cost time and money reviewing the responses and making a decision
The board of trustees/directors has the ultimate legal obligation for the operation of the organization including an emphasis on the fiscal elements. Utah’s Audit Requirements for Nonprofit Organizations is an example of states that now make it clear it rests with the board:
- The governing body of each political subdivision [and nonprofit organization] is responsible to ensure that the political subdivision obtains a quality audit of its financial records.
- The governing body may appoint an audit committee with the responsibility of making recommendations to the governing body for selection of an auditor, ensuring that the auditor meets qualification requirements, and ensuring that the auditor complies with professional standards.
- If the governing body appoints a separate audit committee, then the governing body shall review the recommendations of the audit committee and make the selection of the auditor.
- The audit committee will report its assessment of the auditor's compliance with professional standards to the governing body.
- The auditor shall report the results of the audit to the governing body.
- The governing body shall respond to the specific recommendations included in the auditor's letter to management. This response shall be remitted with the audited financial statements to the state auditor.
TIP: Check your state law which may have similar language about nonprofit audits. The growing sense of transparency and accountability is not only a concern of the IRS. Your state may also be responding to the protection of the community, consumers and supporters.
BoardSource addresses reasons why audits are required and suggests a rule of thumb on how much revenue could trigger a full audit:
While it is too onerous to demand that all nonprofit organizations undertake a full audit, the board is responsible for assessing the potential benefits and costs of an independent audit. Nonprofits that expend more than $500,000 of federal funds are required to conduct an annual audit. In addition, participating in the Combined Federal Campaign requires an audit at $100,000. Any other charitable organization with $1 million or more in total annual revenues (excluding houses of worship or other organizations that are exempt from filing Form 990) should have an audit conducted of their financial statements and consider attaching a copy to their Form 990 or 990-PF. Smaller charities with revenues of at least $250,000 should choose a review or at least have their financial statements compiled by a professional accountant. The boards of nonprofit organizations that forego an audit should evaluate that decision periodically.
All nonprofit organizations that conduct outside audits, particularly medium to large organizations, should consider forming an audit committee and should separate the audit committee from the finance committee.
The process of issuing this RFP should be directed and overseen by the board with help from staff. Developing such a request will take some thinking. It should reflect what you want done, when you want it done and when a decision will be made. There can be a request for professional references, accreditations, certifications and they should be checked and verified. Membership organizations for potential auditors may also have codes of conduct and ethical standards that you should review in advance.
For a brief article about How To Purchase Audit Services by Joanne Fritz, http://nonprofit.about.com/od/nonprofitmanagement/ht/audit.htm
What To Expect from Your Auditors, http://www.ecfa.org/Documents/WhattoExpectfromyourAuditors.pdf
The board should also develop and approve a draft contract detailing what it wants from the auditor – more on this soon in this blog. Most CPAs and accountants have a form contract. That contract may not address all issues you want such as adherence to your own workplace policies, so it is helpful to have a draft for negotiation purposes. I always included the draft contract as an attachment to the RFP so that the bidders knew when they bid what we wanted.
The RFP can state that the successful bidder will be required to follow your organization's policies on drugs and alcohol in the workplace, no smoking, recycling, anti-sexual harassment, safety in the workplace, use of equipment and equal opportunity employment (within federal and state laws), if you have such written policies. If you want to do this, include a copy of the policies as attachments to the RFP. I had one audit firm’s staff member performing the audit who was hitting on the women at our office who felt harassed. He was replaced immediately.
Tip: The Federal Sarbanes-Oaxley Act does not generally apply to nonprofit tax exempt organizations. But there are several sections do. One provision addresses the creation of a board’s independent and competent audit committee. Another one of those sections is how an organization is to deal with a whistle blower. Review the provisions of SOX that apply to your nonprofit organization. http://www.boardsource.org/clientfiles/sarbanes-oxley.pdf
Your state law may have similar provisions to SOX or rules on handling the RFP process. Here are three examples from state laws:
See the Utah law on preparing an RFP:
The entity shall distribute a "request for proposal" to all auditors who meet the qualification criteria set by the procuring organization interested in bidding for the audit. As a minimum, the request for proposal shall contain the following:
(1) the name and address of the entity requesting the audit and its designated contact person,
(2) the entity to be audited, the scope of services to be provided, and specific reports, etc. to be delivered,
(3) the period to be audited,
(4) the format in which the proposals should be prepared,
(5) the date and time proposals are due, and
(6) the criteria to be used in evaluating the bid.
See Florida’s Single Audit Financial Reporting Package Submittal Checklist:
New (8/18/2008) regulations in Connecticut http://www.sde.ct.gov/sde/lib/sde/pdf/Audit/A133Instructions-NonProf.pdf
Some NPOs require that the auditor provide a draft audit and management letter before the final versions. The audit committee/staff meets with the auditor prior to a final audit to review the drafts to be sure that they cover all aspects. It was my experience that details could be missed in the draft about one funder or other. I preferred to catch errors before a final was completed. In every instance there were errors that were correctable.
The audit committee or the full board should receive the final audit and have a debriefing meeting with the auditor to go over findings and recommendations, if any. I was always present although the auditor and board were offered the opportunity to ask that I not attend. If corrected action is required or suggested, the board should oversee the steps taken and the time for those corrections.
TIP: Some states may consider the opening of the envelopes with bids by nonprofits is a pubic act under the Sunshine law. State law will also dictate whether the review of the RFPs and the final selection are also to be public. It may fall under the limited items for an executive session for the board with the public announcement at the board meeting of the selection.
For a sample Management Letter see http://www.myflorida.com/audgen/pages/pdf_files/management_letter_nfp_%20fp.pdf
TIP: Copies of the audit should go to requisite organizations that provide funds. The board members should all receive a copy. The organization should have a file for each annual audit. Be sure to list how many copies are needed in the RFP.
A discouraging word – how the failure to have an audit can become big anti-publicity:
Seattle Times, June 23, 2007, No audit at Bellevue Arts Museum since 2003 http://seattletimes.nwsource.com/html/localnews/2003759438_bam23e.html
Nonprofit, Now Defunct, Faces Audit, 9 July, 2008, http://www.redorbit.com/news/education/1470174/nonprofit_now_defunct_faces_audit/index.html
See the previous list for the Second Shelf
Your Nonprofit Library Second Shelf – Considering An Audit
Article by Jeffrey S. Gittler, CPA for Guidestar in August 2011, Roles and Responsibilities of Nonprofit Audit Committee Members