External Quality Control Review - Auditing, 12/18/09

System Review Report

December 18, 2009

Peggy E, Gustafson, Inspector General
U.S. Small Business Administration

We have reviewed the SBA Office of Inspector General audit organization's system of quality control in effect for the year ended March 31, 2009. A system of quality control encompasses SBA OIG's organizational structure and the policies adopted and procedures established to provide it with reasonable assurance of conforming to Government Auditing Standards. The elements of quality control are described in Government Auditing Standards. SBA OIG is responsible for designing a system of quality control and complying with it to provide SBA OIG with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects. Our responsibility is to express an opinion on the design of the system of quality control and SBA OIG's compliance therewith based on our review.

Our review was conducted in accordance with Government Auditing Standards and guidelines established by the Council of the Inspectors General on Integrity and Efficiency (CIGIE). During our review, we interviewed SBA OIG personnel and obtained an understanding of the nature of the SBA OIG audit organization, and the design of SBA OIG's system of quality control sufficient to assess the risks implicit in its audit function. Based on our assessments, we selected engagements and administrative files to test for conformity with professional standards and compliance with SBA OIG's system of quality control. The engagements selected represented a reasonable cross-section of SBA OIG's audit organization, with emphasis on higher-risk engagements. Prior to concluding the review, we reassessed the adequacy of the scope of the peer review procedures and met with SBA OIG management to discuss the results of our review. We believe that the procedures we performed provide a reasonable basis for our opinion.

In performing our review, we obtained an understanding of the system of quality control for SBA OIG's audit organization. In addition, we tested compliance with SBA OIG's quality control policies and procedures to the extent we considered appropriate. These tests covered the application of SBA OIG's policies and procedures on selected engagements. Our review was based on selected tests; therefore, it would not necessarily detect all weaknesses in the system of quality control or all instances of noncompliance.

There are inherent limitations in the effectiveness of any system of quality control, and therefore noncompliance with the system of quality control may occur and not be detected. Projection of any evaluation of a system of quality control to future periods is subject to the risk that the system of quality control may become inadequate due to changes in conditions, or because the degree of compliance with the policies or procedures may deteriorate.

The enclosure to this report identifies the offices of SBA OIG that we visited and the engagements that we reviewed.

In our opinion, the SBA OIG audit organization's system of quality control in effect for the year ended March 31, 2009, has been suitably designed and complied with to provide SBA OIG with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects. Federal audit organizations can receive a rating of Pass, Pass with Deficiencies, or Fail. SBA OIG has received a peer review rating of Pass.

As is customary, we have issued a letter, dated December 15,2009, that sets forth a finding that was not considered to be of sufficient significance to affect our opinion expressed in this report.

In addition to reviewing its system of quality control to ensure adherence with Government Auditing Standards, we applied certain limited procedures in accordance with guidance established by CIGIE related to SBA OIG's monitoring of engagements performed under contract by an independent public accountant (IPA), where the IPA served as the principal auditor. It should be noted that monitoring of engagements performed by IPAs is not an audit and therefore is not subject to the requirements of Government Auditing Standards. The purpose of our limited procedures was to determine whether SBA OIG had controls to ensure IPAs performed contracted work in accordance with professional standards. However, our objective was not to express an opinion and accordingly, we do not express an opinion, on SBA OIG's monitoring of work performed by IPAs.

We did not make any comments related to the SBA OIG's monitoring of engagements performed by IPAs in the above-referenced letter dated December 15,2009.

[FOIA ex. 6]

Todd J. Zinser, Inspector General

Scope and Methodology

Scope and Methodology

We tested compliance with the SBA OIG audit organization's system of quality control to the extent we considered appropriate. We reviewed 6 of 16 audit reports issued during the period April 1, 2008, and March 31, 2009. We also reviewed the internal quality control reviews performed by the SBA OIG during the same period.

In addition, we reviewed the SBA OIG's monitoring of engagements performed by IPAs during the period of April 1, 2008, and March 31, 2009, where the IPA served as the principal auditor. During this period, SBA OIG contracted with an IPA to audit its agency's fiscal year 2008 financial statements, which resulted in 3 reports.

We used the CIGIE Guide for Conducting External Peer Reviews of the Audit Organizations of Federal Offices of Inspector General, dated March 2009, in this review. We conducted the review at SBA OIG's headquarters office in Washington, D.C.

Reviewed Audits Performed by SBA OIG

Report Number Report Date Report Title
8-12 5/9/08 Oversight of SBA Supervised Lenders
8-19 9/12/08 Early-Defaulted Gulf Coast Disaster Hurricane Loans
9-01 10/6/08 SBA's Implementation of an HSPD-12 Card Issuance System
9-08 1/30/09 Audit of the Liquidation Process at the National Guaranty Process Center
9-09 3/31/09 Review of Borrower Eligibility for Gulf Coast Disaster Loans
9-10 3/26/09 Audit of Improper Payments in the Disaster Assistance Program

Reviewed SBA OIG Monitoring Files for Contracted Engagements

Report Number Report Date Report Title
9-03 11/14/08 Audit of SBA' s Fiscal Year 2008 Financial Statements
9-04 11/14/08 GFRS for FY2008
9-05 12/17/08 Audit of SBA's Fiscal Year 2008 Financial Statements-Management Letter