(a) General. (1) The audit, the data collection form, and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's report(s) or nine months after the end of the audit period (whichever is earlier). The cognizant agency for audit or oversight agency for audit (in the absence of a cognizant agency for audit) may authorize an extension when the nine-month timeframe would place an undue burden on the auditee. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day.

(2) The auditee must make copies available for public inspection unless restricted by Federal statute or regulation. Auditees and auditors must ensure that their respective parts of the reporting package do not include protected personally identifiable information.

(b) Data collection. The FAC is the repository of record for subpart F reporting packages and the data collection form. All Federal agencies, pass-through entities and others interested in a reporting package and data collection form must obtain it by accessing the FAC.

(1) The auditee must submit the required data collection form described in Appendix X of this part. This form provides information about the auditee, its Federal programs, the results of the audit, and whether the audit was completed in accordance with this part. The form must include all information required by this part that is necessary for Federal agencies to use the audit to ensure the integrity of Federal programs. The form includes data elements and a format that OMB must approve, is available from the FAC, and include collections of information from the reporting package described in paragraph (c).

(2) A senior-level representative of the auditee (for example, a State controller, director of finance, chief executive officer, or chief financial officer) must sign a statement to be included as part of the data collection form stating that the auditee complied with the requirements of this part, including that:

(i) The data collection form was prepared in accordance with this part (and the instructions accompanying the form);

(ii) The reporting package does not include protected personally identifiable information;

(iii) The information included in its entirety is accurate and complete; and

(iv) The FAC is authorized to make the reporting package and the form publicly available on a website.

(3) An auditee that is an Indian Tribe or a tribal organization (as defined in the Indian Self-Determination, Education and Assistance Act (ISDEAA), 25 U.S.C. 450b(l)) may opt not to authorize the FAC to make the reporting package publicly available on a website. To opt-out, an Indian Tribe or tribal organization must exclude the authorization described in paragraph (b)(2)(iv) of this section. In these instances, the Indian Tribe is responsible for submitting the reporting package directly to any pass-through entities through which it has received a Federal award and to pass-through entities for which the summary schedule of prior audit findings reported the status of any findings related to those Federal awards that the pass-through entity provided. Unless restricted by Federal statute or regulation, if the Indian Tribe opts not to authorize publication, it must make copies of the reporting package available for public inspection.

(4) The auditor must complete the applicable data elements of the data collection form using the information included in the reporting package described in paragraph (c) of this section. The auditor must sign a statement to be included as part of the data collection form stating:

(i) The source of information included in the data collection form;

(ii) The auditor's responsibility for the information;

(iii) The data collection form is not a substitute for the reporting package described in paragraph (c); and

(iv) The content of the form is limited to the collection of information prescribed by OMB.

(c) Reporting package. The reporting package must include the following:

(1) Financial statements and schedule of expenditures of Federal awards discussed in § 200.510(a) and (b), respectively;

(2) Summary schedule of prior audit findings discussed in § 200.511(b);

(3) Auditor's report(s) discussed in § 200.515; and

(4) Corrective action plan discussed in § 200.511(c).

(d) Submission to FAC. The auditee must electronically submit the data collection form described in paragraph (b) of this section and the reporting package described in paragraph (c) of this section to the FAC.

(e) Requests for management letters issued by the auditor. Auditees must submit, when requested by a Federal agency or pass-through entity, a copy of any management letters issued by the auditor.

(f) Report retention requirements. Auditees must keep a copy of the data collection form described in paragraph (b) of this section and a copy of the reporting package described in paragraph (c) on file for three years from the date of submission to the FAC. Copies of audit records must be maintained in accordance with § 200.336.

(g) FAC responsibilities. The FAC must make available the reporting packages received in accordance with paragraph (c) of this section and § 200.507(c) to the public, except for Indian Tribes exercising the option in paragraph (b)(3) of this section, and maintain a database of completed audits, provide appropriate information to Federal agencies, and follow up with known auditees that have not submitted the required data collection forms and reporting packages.

(h) Electronic filing. Nothing in this part must preclude electronic submissions to the FAC in such a manner as may be approved by OMB.