Charities Bureau
Guidance Document
Issue date: September 2018
AUDIT COMMITTEE REQUIREMENTS AND RESPONSIBILITIES UNDER
NEW YORK’S NOT-FOR-PROFIT CORPORATION LAW
AS AMENDED THROUGH 2017
New York’s Executive Law requires most organizations that solicit charitable contributions in New York to register with the Attorney General’s Charities Bureau pursuant to Article 7-A of the
Executive Law. Organizations that are required to register with the Charities Bureau and whose revenues exceed the thresholds described later in this guidance are required to submit audited financial statements
“in conformity with generally accepted accounting principles, including compliance with all pronouncements of the financial accounting standards board and the American Institute of Certified Public Accountants.” The audit must be submitted to the Charities Bureau with New York’s Annual Filing for Charitable Organizations (Form CHAR500) and Internal Revenue Service Form 990. To enhance compliance with the audit requirement, the Nonprofit Revitalization Act of 2013 (“NPRA”) added section 712-a to the Not-for-Profit Corporation Law (“N-PCL”) setting forth the audit oversight responsibilities of not-for-profit corporations and section 8-1.9 to the Estates, Powers and Trusts Law (“EPTL”) setting forth the responsibilities of trusts that are subject to the audit requirements. EPTL section 8-1.9 specifically makes applicable to charitable trusts a number of sections of the NPRA, including the provisions addressing audit oversight, as well as related party transactions and mandatory conflict of interest and whistleblower policies. This guidance reflects amendments to the NPRA that were adopted in November of 2016 and, with one exception, became effective on May 27, 2017.
New York’s legislature enacted NPRA’s audit provisions to require a nonprofit’s review of its auditor’s report to be independent of management and to be conducted by individuals who have no financial interest in the nonprofit and whose families have no such interests. NPRA also requires certain internal controls to be implemented to strengthen the oversight of nonprofits’ assets. Likewise, by mandating the formation of Audit Committees by nonprofits and requiring the independence of nonprofits’ auditors, NPRA was enacted to assure nonprofits’ are accountable for the use and protection of charitable assets, and to provide direction on use of the services of an independent auditor and the work of a committee of independent directors formed for those purposes.
The independent professional auditor is the only professional who, pursuant to the N-PCL, not-forprofit corporations are required to engage. The independent auditor has a dual responsibility - the public responsibility to provide reasonable assurance that financial statements detailing the sources and uses of charitable funds are complete and accurate, and a responsibility to those charged with governance to provide the benefit of information obtained during their audit work. Review by competent and responsible auditors - based on their expertise, systems, and experience with other organizations - can provide a significant benefit to those charged with governance by identifying best practices and opportunities for organizational improvement.
This guidance has been prepared to assist nonprofits in implementing audit oversight procedures or revising procedures already in place, and to help them make effective use of the independent audit process. It should not, however, be viewed as a substitute for advice from an organization’s attorney, accountant, or the opinion of the independent auditor.
Establishing or Modifying the Audit Committee
Effective with the adoption of the NPRA, on July 1, 2014, a corporation or trust required by Article 7-A of the Executive Law to file an independent certified public accountant’s audit, must have either a designated Audit Committee consisting entirely of “independent” directors or the Board of Directors (with only independent members participating in the deliberations or voting) oversee the audit of the corporation’s financial statements. N-PCL section 712-a (b) requires additional oversight responsibilities of nonprofits that have annual revenue of over one million dollars.
The Charities Bureau recognizes that Audit Committees and Boards may require assistance from individuals with expertise in accounting and financial matters who are not members of the Board or Audit Committee. However, participation in the Audit Committee’s formal deliberations and voting must be limited to the independent director members. Nothing in the law or this guidance precludes the Board or the Audit Committee from seeking advice from such non-members, or from providing some honorific designation to persons who provide such services. However, members of current management, who are responsible for developing and maintaining financial controls, should not also be involved in the Audit Committee’s performance of its duties as set forth in N-PCL Section 712-a (b).
Only independent directors may participate in any board or committee deliberations or voting relating to the matters set forth in Section 712-a (b). However, nothing in the NPRA or any guidance shall prevent members of the Board who are not independent directors from receiving or hearing the report of the Audit Committee’s activities to the Board as set forth in N-PCL Section 712-a(b)(4).
Hiring an Independent Certified Public Accountant
The board (or audit committee) of a nonprofit required to file an audit with its form CHAR500 must engage an independent Certified Public Accountant (“CPA”) to perform the annual financial statement audit. An independent CPA (also commonly referred to as an “auditor”) is an individual or company that does not have a financial or familial relationship with the nonprofit. For example, the CPA cannot be a member of the organization’s board, a paid employee, a relative of an employee or have other professional or financial transactions with the organization. The American Institute of CPAs’ (“AICPA”) Code of Professional Conduct as revised, effective December 15, 2014 guides the CPA in meeting independence requirements. (http://www.aicpa.org/Research/Standards/CodeofConduct/Pages/default.aspx)
According to the AICPA Code of Professional Conduct, independence consists of two elements,
defined as follows:
(a) Independence of mind is the state of mind that permits a member to perform an attest service without being affected by influences that compromise professional judgment, thereby allowing an individual to act with integrity and exercise objectivity and professional skepticism, and
(b) Independence in appearance is the avoidance of circumstances that would cause a reasonable and informed third party who has knowledge of all relevant information, including the safeguards applied, to conclude reasonably that the integrity, objectivity, or professional skepticism of a firm or member of the attest engagement team is compromised. For example, an auditor cannot independently evaluate its own firm's work, including, for example, maintaining the client’s general ledger, even if performed by another unit or group in the auditing organization.
Among other considerations, the audit committee or board should consider when hiring or re-appointing an auditor, is the reputation of the CPA (both the firm and the individuals assigned to the engagement), references provided, expertise or familiarity with nonprofit accounting and the fee structure for the engagement. Staff continuity of the audit team, the expected timeline and delivery of services, and other benefits of engaging a particular firm should also be considered.
Before engaging an auditor, the Audit Committee should also inquire whether the audit firm or predecessor firms have been sanctioned or been the subject of a government investigation, prosecution, or settlement in connection with its audit work, and, if so, the circumstances and outcome of such investigation, prosecution, or settlement.
The nonprofit should also ask for a copy of the CPA’s most recent peer review report, to ensure that its standing with the AICPA and in the marketplace is solid. See generally,
http://www.aicpa.org/InterestAreas/PeerReview/Pages/PeerReviewHome.aspx. The Charities Bureau recommends, as a best practice, regular rotation of a nonprofit’s auditors, for example, every five years. However, there is no legal requirement for such rotation in the New York Not-for-Profit Corporation Law.
The Role of the CPA Auditor or CPA Audit Firm
The purpose of an audit is to provide users of a financial statement with an opinion prepared by the auditor in accordance with the professional standards established by the American Institute of Certified Public Accountants (AICPA) as to whether the financial statements of the entity are presented fairly, in all material respects, in accordance with an applicable financial reporting framework (e.g., generally accepted accounting principles, usually referred to as “GAAP”). An audit includes performing procedures to obtain evidence about the amounts and disclosures in the financial statements, assessing the risks of material misstatements in the financial statements, and considering internal controls relevant to the preparation and fair presentation of the financial statements. Financial statements typically consist of the statement of financial position (balance sheet), statement of activities, statement of functional expenses (if applicable), statement of cash flows, and notes to financial statements.
In addition to certifying the financial statements, as part of the audit process the CPA is required to communicate to “those charged with governance” (independent members of the board or the Audit Committee acting on behalf of the Board) certain internal control or other issues identified during the audit that concern the processing of financial information of the organization. Since the audit process does not encompass a comprehensive evaluation of an organization’s internal controls, the board should decide if additional review of the organization’s internal control procedures is warranted, and if so, by whom. It is also extremely important that issues identified in the auditor’s prior year’s communication to the board – management letters, identification of issues of fraud, internal control deficiencies, violations of law, or issues that may impact the nonprofit’s functioning as a going concern - have been addressed to the satisfaction of the Audit Committee and the Independent Auditor.
Independent auditors are required by their professional AICPA standards to prepare complete documentation of each audit engagement, including summaries of certain oral communications with management and with the Audit Committee concerning the audit, and to maintain these records after completion of the audit engagement. These required communications include discussions of suspicion of fraud, violations of law, lack of integrity or false statements by management, and risks to the organization as a going concern. It is important for members of the Audit Committee to be aware that conversations with the independent auditor are never “off the record.” although they may not be in formal written communications to the client, the Audit Committee, or management.
The Role of the Audit Committee or the Board
The audit committee or the board is responsible for overseeing the accounting and financial reporting processes of the organization and the audit of its financial statements. The NPRA requires that a designated audit committee, made up of independent directors, or the board itself, with only independent directors participating, fulfill the oversight responsibility. An independent director, as more fully described in section 102(a)(21) of the N-PCL and section 8-1.9(a)(7) of the EPTL, is an individual who:
1) is not, and has not been during the prior three years, an employee or key person of the organization or any of its affiliates,
2) has not received over $10,000 from such organizations during that period, and
3) does not have a relative who has been a key person of or received over $10,000 from such organizations during that period. (Note, though, that a director’s independence is not affected if the director has a relative who is an employee but not a “key person” in the organization or any affiliate.)
In addition, in order to be independent, neither the director nor his relatives may have certain relationships with entities with which the organization conducts a certain level of business activity. In particular, pursuant to the 2016 amendments, a director is not independent if all three of the following are true:
1) he or she is a current employee of or has a substantial financial interest in (or has a relative who is a current officer of or has a substantial financial interest in) an entity, and
2) that entity has provided payments, property or services to, or received payments, property or services from, the corporation or an affiliate, and
3) the amount paid by the corporation to the entity or received by the corporation from the entity for such property or services, in any of the last three fiscal years, exceeded these thresholds:
See https://www.charitiesnys.com/pdfs/AuditCommittees.pdf for current thresholds
The 2016 amendments provide that, in determining the independence of a board member, “payments” do not include:
1) charitable contributions,
2) dues or fees paid for services that are part of a nonprofit’s programs as long as such services are available to the public on the same terms,
3) payments made by the corporation at fixed or non-negotiable rates or amounts for services received, if the services are available to individual members of the public on the same terms, and any services received by the corporation are not available from another source.
It is important to note that a member of the board is considered independent even if he or she receives reimbursement for expenses reasonably incurred as a director or reasonable compensation for service as a director.
N-PCL section 713(f) permits an employee to be the chair of a nonprofit’s board if elected by a two-thirds vote of the entire board and the basis of that vote is documented in writing. However, no such employee may be an independent director.
In determining whether a director is independent, the board should make reasonable efforts to determine whether a director is independent and adopt procedures for making such a determination. Organizations may take guidance from the following instructions for completing line 1b (number of voting members of the governing body of who are independent) of Part VI of IRS form 990 and the Charities Bureau guidance on conflict of interest and related party transactions posted at www.charitiesnys.com:
Reasonable effort. The organization need not engage in more than a reasonable effort to obtain the necessary information to determine the number of independent voting members of its governing body and can rely on information provided by such members. For instance, the organization can rely on information it obtains in timely signed responses to the mandatory questionnaire sent annually to each member of the governing body that includes the member's name and title, blank lines for the member's signature and signature date, and the pertinent instructions and definitions for line 1b of IRS form 990, to determine whether the member is or isn't independent.
While not mandated by the NPRA, having audit committee members who have sufficient financial expertise or practical experience to understand these processes is a desirable goal.
The NPRA requires the audit committee or independent members of the board to:
1) Retain or renew the retention of the CPA to conduct the annual financial statement audit,
2) Review the completed audit with the CPA, and
3) Review with the CPA the communications to those charged with governance (including but not limited to any management letter) resulting from the audit. The term “review” as used here requires a conversation between the Committee and the independent auditor in which audit committee members participate. It does not require a face-to-face meeting, which can add significantly to the cost for small organizations.
For any fiscal year in which the organization expects to have over $1 million in revenue (or if it had over $1 million in the prior year), the audit committee or independent members of the board must also:
1) Prior to commencement of the audit, review with the CPA the scope and planning of the audit;
2) When the audit has been completed, review and discuss with the CPA:
i. Material risks and weaknesses in internal controls identified by the CPA;
ii. Any restrictions on the scope of the CPA’s activities or access to requested information;
iii. Any significant disagreements between the CPA and management; and
iv. The adequacy of accounting and financial reporting processes of the organization; and
3) Annually review the performance and independence of the CPA
If an audit committee performs the above responsibilities, the committee must report to the board the results of these procedures. N-PCL § 712-a “Audit Oversight.”
The audit committee should also maintain records of its meetings, including minutes with the names of all present, and how each voted – accepted, objected or abstained - on a motion to accept the audit; copies of board books and other material submitted to the committee before or during its meetings. Maintaining minutes and other records of the audit committee (or the board) is important in demonstrating that the oversight process is appropriate.
In addition to the audit committee’s role in the audit process, the board, the audit committee, or another committee must identify and monitor related party transactions and review the conflicts of interest, ethics, whistleblower and related party disclosure policies periodically and updating as needed.[4]
The board or a committee of the board’s responsibilities should also include (but are not limited to) the following:
1) Ensuring that proper federal and state compliance and tax filings are submitted timely, including payroll taxes, sales taxes, unrelated business income taxes, and foreign filings (if applicable), and that any taxes due have been paid or provided for;
2) Reviewing the organization’s internal and financial controls on a periodic basis;
3) Assuring the conduct of appropriate risk assessments and risk response plans;
4) Monitoring any legal matters that could impact the reputation and financial health and reporting of the organization;
5) Instituting and overseeing any special investigatory work as needed, and assuring responses to investigations; and
6) Periodically reviewing the organization’s insurance coverage and determining its adequacy.
The audit committee should also maintain minutes of its meetings. Maintaining minutes of the audit
committee (or the board) is important in demonstrating that the oversight process is appropriate.
When an organization’s revenue reaches the threshold at which an audit is required (see “Revenue Thresholds Requiring a CPA’s Audit” below), it will have to take steps to comply with N-PCL § 712-a, including establishing an audit committee or designating independent members of the board to assume that function, making appropriate changes to its by-laws and engaging to the appropriate Certified Public Accountant. The Charities Bureau recommends that organizations take these steps as soon as they realize that their revenue will reach the audit threshold so that appropriate procedures are in place before the audit process begins.
Revenue Thresholds Requiring a CPA’s Audit
Over a period of seven years, from July 1, 2014 to July 1, 2021, the NPRA raised the revenue thresholds that trigger the audit requirement for organizations that, pursuant to Article 7-A of the Executive Law, are required to file a CPA’s audit report with the Charities Bureau. The revenue threshold, which was $250,000 before enactment of the NPRA, will rise to $1,000,000 in 2021. As a result, fewer organizations will be required to file CPA audit reports with the Charities Bureau.
Current NYS Charity Audit Thresholds - For nonprofit charities subject to NY audit requirements
Please note that organizations that have revenue over $250,000, but under the above audit thresholds, and are required to register with the Attorney General’s Charities Bureau pursuant to Article 7-A of the Executive Law, must file a CPA's review report. For information about the CPA financial statement review report requirements see Executive Law § 172-b and the Charities Bureau’s guidance