OAR 732-040-0015: Audit and Compliance Review Requirements

(1) Recipients shall conduct an annual financial audit of the STIF moneys received using the document entitled “Agreed Upon Procedures” made available by the Agency on the Public Transportation Division Website. A Recipient that is a Qualified Entity shall ensure any Sub-Recipient conducts an annual financial audit of STIF moneys received using the Agreed Upon Procedures. (2) Recipients shall submit the report of the annual financial audit of STIF moneys received to the Agency within 30 calendar days after the auditee receives of the auditor’s final report(s) or nine months after the end of the Recipient’s audit period, whichever is earlier. (3) Recipients shall be subject to periodic on-site compliance reviews by the Agency. The purpose of the compliance site review is to ensure that Recipients have appropriate, adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF moneys. Compliance reviews may cover the following topics, as applicable: program management; financial management; operations management, procurement, use and maintenance of equipment; records retention; compliance with state and federal civil rights laws; compliance with FTA drug and alcohol regulations; and compliance with the ADA. (4) Recipients shall permit the Agency, the Secretary of State of the State of Oregon, or their authorized representatives, upon reasonable notice, access to all data and records relating to STIF moneys received or disbursed and to inspect the STIF Plans and Projects financed with STIF moneys including, but not limited to, the financial records, physical premises and Capital Assets used to deliver public transportation services. (5) Recipients shall ensure that their agreements or contracts with Sub-Recipients or contractors, as identified by the Recipient pursuant to OAR 732-042-0055, include provisions which permit the Agency, the Secretary of State of Oregon, or their authorized representative, access to data and records held by the Sub-Recipient or contractor as described in section (4) of this rule.