N.M. Admin. Code § 2.2.2.8 - THE PROCUREMENT AND AUDIT PROCESS

A. Firm profiles: For an IPA to be included on the OSA's list of approved firms to perform audits, AUPs, and other attestation engagements, an IPA shall submit a firm profile online annually on the fifth business day in January, in accordance with the guidelines set forth herein. The OSA shall review each firm profile for compliance with the requirements set forth in this rule. IPAs shall notify the state auditor of changes to the firm profile as information becomes available. The state auditor shall approve contracts for audit, AUPs, and other attestation engagements only with IPAs who have submitted a complete and correct firm profile that has been approved by the OSA, and who have complied with all the requirements of this rule, including but not limited to:

(1) Subsection A of 2.2.2.14 NMAC, continuing professional education requirements for all staff that the firm will use on any New Mexico governmental engagements;

(2) for IPAs who have audited agencies under this rule in the past, they shall have previously complied with: 2.2.2.9 NMAC, report due dates, including notifying the state auditor regarding late audit reports and 2.2.2.13 NMAC, review of audit reports and audit documentation.

B. List of approved firms: The state auditor shall maintain a list of independent public accounting (IPA) firms that are approved and eligible to compete for audit contracts, AUPs, and other attestation engagements with agencies. The state auditor's list of approved firms shall be reviewed and updated on an annual basis. An IPA on the list of approved firms is approved to perform government audits, AUPs, and other attestation engagements for agencies and local public bodies until the list of approved firms is published for the following year; provided that the OSA may restrict firms at any time for failure to submit firm profile updates timely. An IPA that is included on the state auditor's list of approved firms for the first time may be subject to an OSA quality control review of the IPA's working papers for audits, AUPs and other attestation engagements. This review shall be conducted as soon as the documentation completion date, as defined by AU-C Section 230, has passed (60 days after the report release date, as posted on the OSA's audit reports website). The state auditor shall approve contracts for audits, AUPs and other attestation engagements only with IPA firms that have submitted a complete and correct firm profile complying with all the requirements set forth in this rule and that has been approved by the OSA. The OSA shall inform all IPAs whose firm profiles were submitted by the due date whether they are on the list of approved firms for audits, AUPs and other attestation engagements and shall publish the list of approved firms concurrent with notification to government agencies to begin the procurement process to obtain an IPA to conduct the agency's annual financial audit. Firms that only perform non-attestation engagements, or otherwise do not meet applicable requirements, shall not be included on the list of approved firms.

C. Disqualified firms: An IPA firm may not be included on the list of approved firms for audits, AUPs, and other attestation engagements if any of the following applies to that IPA:

(1) the firm received a peer review rating of "failed";

(2) the firm does not have a current New Mexico firm permit to practice, if applicable;

(3) the firm profile does not include at least one certified public accountant with a current CPA certificate who has met the GAGAS CPE requirements described at Subsection A of 2.2.2.14 NMAC, to perform GAGAS audits (however, firms seeking to contract only for AUP engagements will not be disqualified if GAGAS CPE requirements have not been met);

(4) the IPA has been restricted in the past and has not demonstrated improvement (this includes submitting excessively deficient audit reports or having excessively deficient workpapers);

(5) the IPA made false statements in their firm profile or any other official communication with the OSA that were misleading enough to merit disqualification; or

(6) any other reason determined by the state auditor to serve the interest of the state of New Mexico.

D. Restriction:

(1) IPAs may be placed on restriction based on the OSA's review of the firm profile and deficiency considerations as described below. Restriction may take the form of limiting either the type of engagements or the number of audit contracts, or both, that the IPA may hold. The OSA may impose a corrective action plan associated with the restriction. The restriction remains in place until the OSA notifies the IPA that the restriction has been modified or removed. The deficiency considerations include, but are not necessarily limited to:

(a) failure to submit reports in accordance with report due dates provided in Subsection A of 2.2.2.9 NMAC, or the terms of their individual agency contract(s);

(b) failure to submit late report notification letters in accordance with Subsection A of 2.2.2.9 NMAC;

(c) failure to comply with this rule;

(d) poor quality reports as determined by the OSA;

(e) poor quality working papers as determined by the OSA;

(f) a peer review rating of "pass with deficiencies" with the deficiencies being related to governmental audits;

(g) failure to contract through the OSA for New Mexico governmental audits or AUP engagements;

(h) failure to inform agency in prior years that the IPA is restricted;

(i) failure to comply with the confidentiality requirements of this rule;

(j) failure to invite the state auditor or the auditor's designee to engagement entrance conferences, progress meetings or exit conferences after receipt of related notification from the OSA;

(k) failure to comply with OSA referrals or requests in a timely manner;

(l) suspension or debarment by the U.S. general services administration;

(m) false statements in the IPA's firm profile or any other official communication with the OSA;

(n) failure to cooperate timely with requests from successor IPAs, such as reviewing workpapers;

(o) failure to have required contracts approved by the OSA; or

(p) any other reason determined by the state auditor to serve the interest of the state of New Mexico.

(2) The OSA shall notify any IPA that it proposes to place under restriction. If the proposed restriction includes a limitation on the number of engagements that an IPA is eligible to hold, the IPA shall not submit proposals or bids to new agencies if the number of multi-year proposals the IPA possesses at the time of restriction is equal to or exceeds the limitation on the number of engagements for which the IPA is restricted.

(3) An IPA under restriction is responsible for informing the agency whether the restricted IPA is eligible to engage in a proposed contract.

(4) If an agency or local public body submits an unsigned contract to the OSA for an IPA that was ineligible to perform that contract due to its restriction, the OSA shall reject the unsigned contract.

E. Procedures for imposition of restrictions:

(1) The state auditor may place an IPA under restriction in accordance with Subsection D of 2.2.2.8 NMAC.

(a) The state auditor or the auditor's designee shall cause written notice of the restriction to be sent by email and certified mail, return receipt requested, to the IPA, which shall take effect as of the date of the letter of restriction. The letter shall contain the following information:

(i) the nature of the restriction;

(ii) the conditions of the restriction;

(iii) the reasons for the restriction;

(iv) the action to place the IPA on restriction is brought pursuant to Subsection A of Section 12-6-3 NMSA 1978 and these regulations;

(v) the IPA may request, in writing, reconsideration of the proposed contract restriction which shall be received by the OSA within 15 calendar days from the date of the letter of restriction; and

(vi) the e-mail or street address where the IPA's written request for reconsideration shall be delivered, and the name of the person to whom the request shall be sent.

(b) The IPA's written request for reconsideration shall include sufficient facts to rebut on a point for point basis each deficiency noted in the OSA's letter of restriction. The IPA may request an opportunity to present in person its written request for reconsideration and provide supplemental argument as to why the OSA's determination should be modified or withdrawn. The IPA may be represented by an attorney licensed to practice law in the state of New Mexico.

(c) The IPA shall have forfeited its opportunity to request reconsideration of the restriction(s) if the OSA does not receive a written request for reconsideration within 15 calendar days of the date of the letter of restriction. The state auditor may grant, for good cause shown, an extension of the time an IPA has to submit a request for reconsideration.

(2) The OSA shall review an IPA's request for reconsideration and shall make a determination on reconsideration within 15 calendar days of the IPA response letter unless the IPA has asked to present its request for reconsideration in person, in which case the OSA shall make a determination within 15 calendar days from the date of the personal meeting. The OSA may uphold, modify or withdraw its restriction pursuant to its review of the IPA's request for reconsideration, and shall notify the IPA of its final decision in writing which shall be sent to the IPA via email and certified mail, return receipt requested.

F. Procedures to obtain professional services from an IPA: Concurrent with publication of the list of approved firms, the OSA shall authorize agencies to select an IPA to perform their annual audit or AUP engagement. Agencies are prohibited from beginning the process of procuring IPA services for annual audits or AUPs pursuant to Section 12-6-3 NMSA 1978 until they receive the OSA authorization. Agencies that wish to begin the IPA procurement process for their annual audit or AUP pursuant to Section 12-6-3 NMSA 1978 prior to receiving OSA authorization may request an exception, however any such exceptions granted by OSA are subject to changes in the final audit rule applicable to the annual audit or AUP pursuant to Section 12-6-3 NMSA 1978 and changes in restrictions to, or disqualifications of, IPAs. The notification shall inform the agency that it shall consult its prospective IPA to determine whether the prospective IPA has been restricted by the OSA as to the type of engagement or number of contracts it is eligible to perform. Agencies that may be eligible for the tiered system shall complete the evaluation to determine the level of financial reporting described in Subsection B of 2.2.2.16 NMAC. Agencies that receive and expend federal awards shall follow the uniform guidance procurement requirements from 2 CFR 200.317 to 200.327 and 200.509 and shall also incorporate applicable guidance from the following requirements. Agencies shall comply with the following procedures to obtain professional services from an IPA for an audit or AUP engagement.

(1) Upon receipt of written authorization from the OSA to proceed, and at no time before then unless OSA has granted an exception, the agency shall identify all elements or services to be solicited pursuant to this rule and conduct a procurement that includes each applicable element of the annual financial and compliance audit, special audit, attestation engagement, performance audit, forensic audit or AUP engagement.

(2) Quotations or proposals for annual financial audits shall contain each of the following elements:

(a) financial statement audit;

(b) federal single audit (if applicable);

(c) financial statement preparation so long as the IPA has considered any threat to independence and mitigated it;

(d) other non-audit services (if applicable and allowed by current government auditing standards); and

(e) other (i.e., audits of component units such as housing authorities, charter schools, foundations and other types of component units).

(3) Auditor rotation rule: An IPA may not provide services to an agency or LPB consecutively for more than eight years. After the eighth consecutive year, the agency or LPB must obtain a proposal for another IPA for at least two years before returning to the prior IPA.

(4) The agency is encouraged to request multiple year proposals for audit and AUP services, however the term of the contract shall be for one year only. The parties shall enter a new audit contract each year. The agency is responsible for procuring IPA services in accordance with all applicable laws and regulations which may include, but are not limited to, the State Procurement Code (Chapter 13, Article 1 NMSA 1978) or equivalent home rule procurement provisions; GSD Rule 1.4.1 NMAC, Procurement Code Regulations, if applicable; DFA Rule, 2.40.2 NMAC, Governing the Approval of Contracts for the Purchase of Professional Services; Uniform Guidance; and Section 13-1-191.1 NMSA 1978 regarding campaign contribution disclosure forms. If either of the parties to the contract elects not to contract for all of the years contemplated by a multiple year proposal, or the state auditor disapproves the contract, the agency shall use the procedures described above to procure services from a different IPA.

(5) If the agency is a component unit of a primary government, the agency's procurement for audit services shall include the AU-C 600 (group audits) requirements for the IPA to communicate and cooperate with the group engagement partner and team, and the primary government. This requirement applies to agencies and universities that are part of the statewide ACFR, other component units of the statewide ACFR and other component units of any primary government that use a different audit firm from the primary government's audit firm. Costs for the IPA to cooperate with the group engagement partner and team, and the primary government, caused by the requirements of AU-C 600 (group audit) may not be charged in addition to the cost of the engagement, as the OSA views this in the same manner as compliance with any other applicable standard.

(6) Agencies are encouraged to include representatives of the offices of separately elected officials such as county treasurers, and component units such as charter schools and housing authorities, in the IPA selection process. As part of their evaluation process, the OSA recommends that agencies consider the following when selecting an IPA for their annual audit or AUP pursuant to Section 12-6-3 NMSA 1978:

(a) responsiveness to the request for proposal (the firm's integrity, record of past performance, financial and technical resources);

(b) relevant experience, availability of staff with professional qualifications and technical abilities;

(c) results of the firm's peer and external quality control reviews; and

(d) weighting the price criteria less than fifteen percent of the total criteria taken into consideration by the evaluation process or selection committee.

Upon the OSA's request, the agency shall make accessible to the OSA all of the IPA procurement and selection documentation.

(7) After selecting an IPA for their annual audit or AUP pursuant to Section 12-6-3 NMSA 1978, each agency shall enter the appropriate requested information online on the OSA-Connect website at osaconnect.osa.nm.gov. To do this, the agency shall register on OSA-Connect and obtain a user-specified password. The agency's user shall then use OSA-Connect to enter information necessary for the contract and for the OSA's evaluation of the IPA selection. After the agency enters the information, the OSA-Connect system generates a draft contract containing the information entered. The agency shall submit to the OSA for approval a copy of the unsigned draft contract by following the instructions on OSA-Connect.

(8) The OSA shall notify the agency as to the OSA's approval or rejection of the selected IPA and contract. The OSA's review of audit contracts does not include evaluation of compliance with any state or local procurement laws or regulations; each agency is responsible for its own compliance with applicable procurement laws, regulations or policies. After the agency receives notification of approval of the selected IPA and contract from the OSA, the agency is responsible for getting the contract signed and sent to any oversight agencies for approval (if applicable). The OSA shall not physically sign the contract. After the agency obtains all the required signatures and approvals of the contract, the agency shall, within three weeks of OSA's approval of the contract, submit a copy of the fully executed contract in an electronic portable document format (PDF) by uploading it in OSA-Connect.

(9) The agency shall submit the unsigned contract generated by OSA-Connect to the OSA by the due date shown below; submission prior to the due date shown below is permissible. If the due date falls on a weekend or holiday, the due date shall be the next business day. If the unsigned contract is not submitted to the state auditor by these due dates, the IPA may, according to professional judgment, include a finding of non-compliance with Subsection F of 2.2.2.8 NMAC in the audit report or AUP report.

(a) RECs, cooperative educational services, independent housing authorities, hospitals and special hospital districts: April 15;

(b) school districts, counties, and higher education: May 1;

(c) incorporated counties (of which Los Alamos is the only one), local workforce investment boards and local public bodies with a June 30 year end that do not qualify for the tiered system: May 15;

(d) councils of governments, district courts, district attorneys, state agencies: June 1 and the state of New Mexico ACFR: July 31;

(e) local public bodies that qualify for the tiered system pursuant to Subsections A and B of 2.2.2.16 NMAC with a June 30 fiscal year end: July 30;

(f) local public bodies that qualify for the tiered system pursuant to Subsections A and B of 2.2.2.16 NMAC with a fiscal year end other than June 30 shall use a due date 30 days after the end of the fiscal year;

(g) agencies and local public bodies that do not qualify for the tiered system with a fiscal year end other than June 30 shall use a due date 30 days before the end of the fiscal year;

(h) component units that are being separately audited: on the primary government's due date;

(i) Charter schools that are chartered by the PED and agencies that are subject to oversight by the HED have the additional requirement of submitting their audit contract to PED or HED for approval (Section 12-6-14 NMSA 1978); and

(j) If the agency's unsigned contract is submitted to the OSA, but is not approved by the state auditor, the state auditor shall promptly communicate the decision, including the reason(s) for disapproval, to the agency, at which time the agency shall promptly submit a contract with a different IPA using OSA-Connect. This process shall continue until the state auditor approves an unsigned contract. During this process, whenever an unsigned contract is not approved by the state auditor, the agency may submit a written request to the state auditor for reconsideration of the disapproval. The agency shall submit its request no later than 15 calendar days after the date of the disapproval and shall include documentation in support of its IPA selection. If warranted, after review of the request, the state auditor may hold an informal meeting to discuss the request. The state auditor shall set the meeting in a timely manner with consideration given to the agency's circumstances.

(10) The agency shall retain all procurement documentation, including completed evaluation forms, for five years and in accordance with applicable public records laws.

(11) If the agency fails to submit an unsigned contract by the due date set forth in this rule, or, if no due date is applicable, within 60 days of notification from the state auditor to engage an IPA, the state auditor may conduct the audit or select the IPA for that agency. The reasonable costs of such an audit shall be borne by the agency audited unless otherwise exempted pursuant to Section 12-6-4 NMSA 1978.

(12) In selecting an IPA for an agency pursuant to Subsection F of 2.2.2.8 NMAC the state auditor shall at a minimum consider the following factors, but may consider other factors in the state auditor's discretion that serve the best interest of the state of New Mexico and the agency:

(a) the IPA shall be drawn from the list of approved IPAs maintained by the state auditor;

(b) an IPA subject to restriction pursuant to Subsection D of 2.2.2.8 NMAC, is ineligible to be selected under this paragraph;

(c) whether the IPA has conducted one or more audits of similar government agencies;

(d) the physical proximity of the IPA to the government agency to be audited;

(e) whether the resources and expertise of the IPA are consistent with the audit requirements of the government agency to be audited;

(f) the IPA's cost profile, including examination of the IPA's fee schedule and blended rates;

(g) the state auditor shall not select an IPA in which a conflict of interest exists with the agency or that may be otherwise impaired, or that is not in the best interest of the state of New Mexico.

(13) The state auditor shall consider, at a minimum, the following factors when considering which agencies shall be subject to the state auditor's selection of an IPA:

(a) whether the agency is demonstrating progress in its own efforts to select an IPA;

(b) whether the agency has funds to pay for the audit;

(c) whether the agency is on the state auditor's "at risk" list;

(d) whether the agency is complying with the requirements imposed on it by virtue of being on the state auditor's "at risk" list;

(e) whether the agency has failed to timely submit its e-mailed draft unsigned contract copy in accordance with the audit rule on one or more occasions;

(f) whether the agency has failed to timely submit its annual financial audit report in accordance with the audit rule due dates on one or more occasions.

(14) The state auditor may appoint a committee of the state auditor's staff to make recommendations for the state auditor's final determination as to which IPAs shall be selected for each government agency subject to the discretion of the state auditor.

(15) Upon selection of an IPA to audit a government agency subject to the discretion of the state auditor, the state auditor shall notify the agency in writing regarding the selection of an IPA to conduct its audit. The notification letter shall include, at a minimum, the following statements:

(a) the agency was notified by the state auditor to select an IPA to perform its audit or AUP engagement;

(b) 60 days or more have passed since such notification, or the applicable due date in this rule has passed, and the agency failed to deliver its draft contract in accordance with this subsection;

(c) pursuant to Subsection A of Section 12-6-14 NMSA 1978, the state auditor is selecting the IPA for the agency;

(d) delay in completion of the agency's audit is contrary to the best interest of the state and the agency, and threatens the functioning of government and the preservation or protection of property;

(e) in accordance with Section 12-6-4 NMSA 1978, the reasonable costs of such an audit shall be borne by the agency unless otherwise exempted; and

(f) selection of the IPA is final, and the agency shall immediately take appropriate measures to procure the services of the selected IPA.

G. State auditor approval/rejection of unsigned contract: The state auditor shall use discretion and may reject unsigned contracts as follows:

(1) An unsigned audit contract, special audit contract, attestation engagement contract, performance audit contract, forensic accounting engagement contract or AUP professional services contract under 2.2.2.16 NMAC that does not serve the best interests of the public or the agency or local public body because of one or more of the following reasons:

(a) lack of experience of the IPA;

(b) failure to meet the auditor rotation requirements as follows: the IPA is prohibited from conducting the agency audit for a period of two years because the IPA already conducted those services for that agency for a period of six consecutive years;

(c) lack of competence or staff availability;

(d) circumstances that may cause untimely delivery of the audit report or AUP report;

(e) unreasonably high or low cost to the agency or local public body;

(f) terms in the proposed contract that the state auditor considers to be unfavorable, unfair, unreasonable, or unnecessary;

(g) lack of compliance with the procurement code, the audit act, or this rule;

(h) the agency giving too much consideration to the price of the IPA's response to the request for bids or request for proposals in relation to other evaluation criteria;

(i) newness of the IPA to the state auditor's list of approved firms;

(j) noncompliance with the requirements of Section 12-6-3 NMSA 1978 of the Audit Act by the agency for previous fiscal years; or

(k) any other reason determined by the state auditor to be in the best interest of the state of New Mexico.

(2) An audit contract, special audit contract, attestation engagement contract, performance audit contract, or forensic accounting engagement contract or AUP contract of an IPA that has:

(a) breached a prior-year contract;

(b) failed to deliver an audit or AUP report on time;

(c) failed to comply with state laws or regulations of the state auditor;

(d) performed non-audit services (including services related to fraud) for an agency or local public body it is performing an audit, special audit, attestation engagement, performance audit, forensic accounting engagement or an AUP for, without prior approval of the state auditor;

(e) performed non-audit services under a separate contract for services that may be disallowed by GAGAS independence standards;

(f) failed to respond, in a timely and acceptable manner, to an OSA audit, special audit contract, attestation engagement contract, performance audit contract, forensic accounting engagement contract, AUP report review or working paper review;

(g) impaired independence during an engagement;

(h) failed to cooperate in providing prior-year working papers to successor IPAs;

(i) not adhered to external quality control review standards as defined by GAGAS and 2.2.2.14 NMAC;

(j) has a history of excessive errors or omissions in reports or working papers;

(k) released the audit report or AUP report to the agency, local public body or the public before the audit release letter or the OSA letter releasing the AUP report was received from the OSA;

(l) failed to submit a completed signed contingency subcontractor form, if required;

(m) failed to submit a completed firm profile as required by Subsection A of 2.2.2.8 NMAC or failed to include all staff in the firm profile who would be working on the firm's engagements;

(n) reached the limit of contracts to which the state auditor restricted the IPA;

(o) failed to respond to communications from the OSA or engagement clients within a reasonable amount of time; or

(p) otherwise, in the opinion of the state auditor, the IPA was unfit to be awarded a contract.

(3) An audit contract, special audit contract, attestation engagement contract, performance audit contract, forensic accounting engagement contract or AUP contract for an IPA received by the OSA, which the state auditor decides to perform himself with or without the assistance of an IPA, and pursuant to Section 12-6-3 NMSA 1978, even if the agency or local public body was previously designated for audit or AUP to be performed by an IPA.

H. Audit contract requirements: The agency shall use OSA-Connect at osaconnect.osa.nm.gov to submit the appropriate audit or AUP engagement contract. The OSA may provide audit or AUP engagement contract forms to the agency via facsimile, e-mail, or U.S. mail if specifically requested by the agency. Only contract templates generated through OSA-Connect shall be accepted and shall:

(1) be completed and submitted in its unsigned form by the due date indicated at Subsection F of 2.2.2.8 NMAC;

(2) for all agencies whose contracts are approved through the GSD's contracts review bureau, have the IPA's business tax identification number verified by the New Mexico taxation and revenue department after approval by the state auditor; and

(3) in the compensation section of the contract, include the dollar amount that applies to each element of the contracted procedures that shall be performed;

(4) in the "other" section of the contract additional services shall be related to the scope of work, but not included in previous categories in the compensation section. Such costs shall be fully detailed and sufficiently describe the required audit related work in the "other provisions" section of the contract.

I. Professional liability insurance: The IPA shall maintain professional liability insurance covering any error or omission committed during the term of the contract. The IPA shall provide proof of such insurance to the state auditor with the firm profile. The amount maintained should be commensurate with the risk assumed. The IPA shall provide to the state auditor, prior to expiration, updated insurance information.

J. Breach of contract: A breach of any terms of the contract shall be grounds for immediate termination of the contract. The injured party may seek damages for such breach from the offending party. Any IPA who knowingly makes false statements, assurances, or disclosures may be disqualified from conducting audits or AUP engagements of New Mexico governmental agencies.

K. Subcontractor requirements:

(1) Audit firms that have only one individual qualified to supervise a GAGAS audit and issue the related audit report pursuant to Section 61-28B-17 NMSA 1978 shall submit with the firm profile, a completed contingency subcontractor form that is dated to be effective until the date the next firm profile shall be submitted. The form shall indicate which IPA on the state auditor's current list of approved IPA's shall complete the IPA's audits if the one individual with the qualifications described above becomes incapacitated and unable to complete the audit. See the related contingency subcontractor form available at osa.nm.gov. The OSA shall not approve audit contracts for such a firm without the required contingency subcontractor form.

(2) If an IPA chooses to use a subcontractor to assist the IPA in working on a specific audit, then the IPA shall submit a subcontract with the reason for subcontracting a portion of the audit work to the OSA for approval. The IPA may subcontract only with IPAs on the approved IPA list. Subcontractors are subject to an independence analysis, which may include the auditor rotation rule requirements of Subsection F of 2.2.2.8 NMAC.

(3) "Technical review contracts" are considered subcontracting and are subject to the requirements of this section. The audit contract shall specify subcontractor responsibility, who shall sign the report(s), and how the subcontractor shall be paid. For additional information see the subcontract work section of the OSA website.

L. IPA independence: IPAs shall maintain independence with respect to their client agencies in accordance with the requirements of the current government auditing standards.

M. Progress Payments: The state auditor shall approve progress and final payments for the annual audit contract as follows:

(1) Subsection A of Section 12-6-14 NMSA 1978 (contract audits) provides that "payment of public funds may not be made to an independent auditor unless a contract is entered into and approved as provided in this section."

(2) Subsection B of Section 12-6-14 NMSA 1978 (contract audits) provides that "based upon demonstration of work in progress, the state auditor may authorize progress payments to the independent auditor by the agency being audited under contract." Such payments shall be made on the basis of evidence of the percentage of audit work completed as of the date of the request for partial payment.

(3) Progress payments up to seventy percent do not require state auditor approval provided that the agency certifies the receipt of services before any payments are made to the IPA. If the report has been submitted, progress payments up to eighty-five percent do not require state auditor approval. The agency shall monitor audit progress and make progress payments only up to the percentage that the audit is completed. If requested by the state auditor, the agency or the IPA shall provide a copy of the approved invoices and progress billing(s). Progress payments between seventy percent and ninety-five percent if no report has been submitted, or eighty-five and ninety-five percent if a report has been submitted, require state auditor approval after being approved by the agency. When component unit audits are part of a primary government's audit contract, requests for progress payments on the component unit audit(s) shall be included within the primary government's request for progress payment approval. In this situation, the OSA shall not process separate progress payment approvals submitted by the component unit.

(4) The state auditor may limit progress payments allowed to be made without state auditor approval for an IPA whose previous audits were submitted after the due date specified in Subsection A of 2.2.2.9 NMAC to only the first fifty percent of the total fee.

(5) Section 12-6-14 NMSA 1978 (contract audits) provides that final payment under an audit contract may be made by the agency to the IPA only after the state auditor has determined, in writing, that the audit has been made in a competent manner in accordance with contract provisions and this rule. The state auditor's determination with respect to final payment shall be communicated as follows:

(a) stated in the letter accompanying the release of the report to the agency; or

(b) in the case of ongoing law enforcement investigations, stated in a letter prior to the release of the report to the agency.

In no circumstance may the total billed by the IPA under the audit contract exceed the total contract amount, as amended if applicable. Further, as the compensation section of the contract shall include the dollar amount that applies to each element of the contracted procedures that shall be performed, if certain procedures, such as a single audit, are determined to be unnecessary and are not performed, the IPA may not bill the agency for these services. Final payment to the IPA by the agency prior to review and release of the audit report by the state auditor is considered a violation of Section 12-6-14 NMSA 1978 and this rule and shall be reported as an audit finding in the audit report of the agency. If this statute is violated, the IPA may be removed from the state auditor's list of approved auditors.

N. Contract amendment requirements:

(1) Contract amendments to contracts for audit services, AUP services, or non-attestation services shall be submitted to the OSA regarding executed contracts. Contracts may not be amended after they expire. The contract should be amended prior to the additional work being performed or as soon as practicable thereafter. The agency shall use OSA-Connect at osaconnect.osa.nm.gov to submit the appropriate draft audit or AUP engagement contract amendment. The OSA's review of audit contracts and amendments does not include an evaluation of compliance with the state procurement code or other applicable requirements. Although the parties may amend the delivery dates in a contract, audit report regulatory due dates cannot be modified by amendment. The OSA's review of audit contract amendments does not include evaluation of compliance with any state or local procurement laws or regulations; each agency is responsible for its own compliance with applicable procurement laws, regulations, or policies.

(2) Contract amendments submitted for state auditor approval shall include a detailed explanation of:

(a) the work to be performed and the estimated hours and fees required for completion of each separate professional service contemplated by the amendment; and

(b) how the work to be performed relates to the scope of work outlined in the original contract.

(3) Because annual financial audit contracts are fixed-price contracts, contract amendments for fee increases shall only be approved if there is a significant change in the scope of an audit. For example, if an audit contract did not include a federal single audit, a contract amendment shall be approved if a single audit is required. Other examples of significant changes in the scope of an audit include: the addition of a new program, function or individual fund that is material to the government-wide financial statements; the addition of a component unit; and the addition of special procedures required by this rule, a regulatory body or a local, state, or federal grantor. Contract amendments shall not be approved to perform additional procedures to achieve an unmodified opinion. The state auditor shall also consider the auditor independence requirements of Subsection L of 2.2.2.8 NMAC when reviewing contract amendments for approval. The OSA shall review amendment requests and respond to the agency and the IPA within 30 calendar days of receipt.

(4) If a proposed contract amendment is rejected for lack of adequate information, the IPA and agency may submit a corrected version for reconsideration.

O. Termination of audit contract requirements:

(1) The state auditor may terminate an audit contract to be performed by an IPA after determining that the audit has been unduly delayed, or for any other reason, and perform the audit entirely or partially with IPAs contracted by the OSA. The OSA shall provide written notice of the contract termination to the IPA and the agency or LPB.

(2) If the agency or IPA terminates the audit or AUP engagement contract pursuant to the termination paragraph of the contract, the OSA shall be notified of the termination immediately. The party sending out the termination notification letter shall simultaneously send a copy of the termination notification letter to the OSA with an appropriate cover letter, addressed to the state auditor.

(a) The agency is responsible for procuring the services of a new IPA in accordance with all applicable laws and regulations, and this rule.

(b) The unsigned contract for the newly procured IPA shall be submitted to the OSA within 30 calendar days of the date of the termination notification letter.

(c) As indicated in Subsection A of 2.2.2.9 NMAC, the state auditor shall not grant extensions of time to the established regulatory due dates.

(d) If the IPA does not expect to deliver the engagement report by the regulatory due date, the IPA shall submit a written notification letter to the state auditor and oversight agency as required by Subsection A of 2.2.2.9 NMAC or Subsection H of 2.2.2.16 NMAC.

Notes

N.M. Admin. Code § 2.2.2.8

2.2.2.8 NMAC - Rp, 2.2.2.8 NMAC, 2-28-14, Adopted by New Mexico Register, Volume XXVI, Issue 05, March 16, 2015, eff. 3/16/2015, Adopted by New Mexico Register, Volume XXVII, Issue 05, March 15, 2016, eff. 3/15/2016, Adopted by New Mexico Register, Volume XXVIII, Issue 05, March 14, 2017, eff. 3/14/2017, Adopted by New Mexico Register, Volume XXIX, Issue 04, February 27, 2018, eff. 2/27/2018, Amended by New Mexico Register, Volume XXX, Issue 05, March 12, 2019, eff. 3/12/2019, Adopted by New Mexico Register, Volume XXXI, Issue 05, March 10, 2020, eff. 3/10/2020, Adopted by New Mexico Register, Volume XXXII, Issue 06, March 23, 2021, eff. 3/23/2021, Adopted by New Mexico Register, Volume XXXIII, Issue 06, March 22, 2022, eff. 3/22/2022, Adopted by New Mexico Register, Volume XXXIV, Issue 06, March 28, 2023, eff. 3/28/2023, Amended by New Mexico Register, Volume XXXV, Issue 13, July 16, 2024, eff. 7/16/2024, Amended by New Mexico Register, Volume XXXVI, Issue 11, June 10, 2025, eff. 6/10/2025