It depends on the program we're auditing. When it's a smaller agency, we often audit all financial management. With a department, we believe there is a lower risk, particularly since public disclosure has become a reality. Generally speaking, departments have good controls in that regard.
There is probably a higher risk where the smaller agencies are concerned, because people may be less familiar with policies, and so on.