There’s an old saying that To a Hammer, Everything Looks Like a Nail. To an auditor, everything can look like an audit—even when it’s not an audit, but a subrecipient monitoring review.
​
​Although there is overlap, auditing and subrecipient monitoring are distinctly different professions governed by different rules. When it comes to risk assessments, this is especially important. That’s because Single Audits—required of agencies accepting federal funds—and other audits routinely find that pass-through entities “violate” risk assessment procedures in determining what organizations to monitor. This results in the dreaded audit finding.

​
​

​These are valid points for discussion, but there’s a problem: the auditor’s preferred methodology is not prescribed in any authority that governs monitoring. And citing an agency for failing to follow methodologies that the auditor created—even when they might be logical—is patently unfair. It’s the classic conundrum: How can an auditee be cited for failing to follow a rule that doesn’t exist? 

​The proper way to handle what auditors perceive as inadequate risk assessments is to raise the issue, but without creating a finding. Kudos to the Office of the Inspector General for the U.S. Department of the Interior for doing just that. In a December 11, 2018 Audit Report,  auditors noted the importance of formalized and documented risk assessments, but acknowledged that the regulatory language is not explicit in requiring them. Instead, it recommended that the federal agency provide additional program guidance.