The 2022 Compliance Supplement sets the single audit requirements auditors use when reviewing organizations that spent federal grant money during fiscal years beginning after June 30, 2021. Formally Appendix XI to 2 CFR Part 200, it consolidates the compliance rules for hundreds of federal programs into one reference so auditors don’t have to chase down each program’s statute, regulation, and award terms separately.1eCFR. Title 2 CFR Appendix XI to Part 200 – Compliance Supplement If your audit period falls after that window, use the current supplement instead; the 2025 version reflects rule changes that took effect October 1, 2024.
Who Had to Get a Single Audit Under the 2022 Rules
When the 2022 supplement was in force, any non-federal entity that spent $750,000 or more in federal awards during its fiscal year had to undergo a single audit or a program-specific audit. That threshold has since risen to $1,000,000 for fiscal years beginning on or after October 1, 2024.2eCFR. 2 CFR 200.501 – Audit Requirements Organizations that once triggered the audit requirement under the older figure may now fall below it.
“Non-federal entity” is broad: state and local governments, tribal governments, colleges and universities, and nonprofits that receive federal funds either directly or as subrecipients through a pass-through entity. The trigger looks at total federal expenditures across every program, not any single award on its own. Falling below the threshold means no federal audit is required for that year, though federal agencies can still request access to records.
The Twelve Compliance Requirements Auditors Test
Part 2 of the supplement, the matrix, is the heart of the document. It maps each covered federal program against twelve active compliance requirement types, lettered A through N (D and K are reserved).3Office of Management and Budget. 2 CFR Part 200, Appendix XI Compliance Supplement Only the types marked for a given Assistance Listing Number get tested for that program, which keeps auditors focused on rules that actually apply.
- A — Activities Allowed or Unallowed: whether spending aligns with the program’s authorized purposes.
- B — Allowable Costs/Cost Principles: whether individual expenditures meet federal cost principles.
- C — Cash Management: whether the recipient minimizes time between drawing down federal funds and disbursing them.
- E — Eligibility: whether participants or beneficiaries meet the program’s criteria.
- F — Equipment and Real Property Management: whether property purchased with federal funds is tracked and used properly.
- G — Matching, Level of Effort, Earmarking: whether cost-sharing or spending-level commitments are met.
- H — Period of Performance: whether costs fall within the award’s authorized time period.
- I — Procurement and Suspension and Debarment: whether purchasing follows federal standards and excludes debarred parties.
- J — Program Income: whether income the program generates is handled correctly.
- L — Reporting: whether required financial and performance reports are accurate and timely.
- M — Subrecipient Monitoring: whether the recipient oversees organizations it passes federal funds to.
- N — Special Tests and Provisions: program-specific requirements that don’t fit the other categories.
Part 3 explains what each type means in practice and what counts as a finding. Part 4 then layers on the program-specific detail for each Assistance Listing Number, organized by federal agency.
How Auditors Choose Which Programs to Test
Auditors don’t test every federal program a recipient runs. Under 2 CFR 200.518, they use a risk-based approach to pick the “major programs” that get the full compliance workup.4eCFR. 2 CFR 200.518 – Major Program Determination
Step one classifies each program as Type A (larger) or Type B (smaller) based on total federal awards expended. The Type A threshold scales with the entity’s size. For organizations spending between $1,000,000 and $34 million, every program above $1,000,000 is Type A. For entities spending between $34 million and $100 million, the threshold is 3% of total expenditures. For those between $100 million and $1 billion, it’s a flat $3 million.
Step two identifies which Type A programs are low-risk. A Type A program counts as low-risk only if it was audited as a major program in at least one of the two most recent periods and had no material weaknesses, modified opinions, or questioned costs exceeding 5% of the program’s expenditures. Step three uses auditor judgment to flag high-risk Type B programs, subject to a cap in the regulations. Step four assembles the final list: all high-risk Type A programs, the high-risk Type B programs from step three, and enough additional programs to meet the percentage-of-coverage rule. That rule requires major programs to account for at least 20% of total federal expenditures for low-risk auditees, or 40% for everyone else.
What the 2022 Version Added
The 2022 supplement was the first to fold in programs created by the American Rescue Plan Act and the Infrastructure Investment and Jobs Act, which together sent hundreds of billions of dollars in new federal funding to state and local governments, nonprofits, and educational institutions.3Office of Management and Budget. 2 CFR Part 200, Appendix XI Compliance Supplement Programs such as the Coronavirus State and Local Fiscal Recovery Funds got their own detailed Part 4 guidance, matching the complex spending rules and reporting timelines those grants carried.5U.S. Department of the Treasury. Coronavirus State and Local Fiscal Recovery Funds
Many of these newer programs were flagged as higher risk, which meant auditors were more likely to pull them in as major programs regardless of dollar size. That reflects the reality that recipients were often new to the money and that eligibility and spending rules were unusually complicated.
Documentation Recipients Have to Produce
The centerpiece is the Schedule of Expenditures of Federal Awards, or SEFA. It lists every federal program the organization participated in and the amount expended during the audit period. At minimum, the SEFA has to group programs by federal agency, include the Assistance Listing Number for each program, identify pass-through entities and their assigned identifying numbers for subawards, and provide total federal awards expended.6eCFR. 2 CFR 200.510 – Financial Statements The notes describe significant accounting policies and disclose whether the organization uses the de minimis indirect cost rate.
Beyond the SEFA, auditors will sample and test the records behind the compliance types identified in the matrix. That typically means payroll records for staff charged to federal awards, eligibility documentation for program participants, procurement files showing how contracts were awarded, and the financial and performance reports submitted to awarding agencies. Internal control documentation, including written policies, procedures, and segregation-of-duties evidence, needs to show how the organization prevents errors and fraud in handling federal funds.
Deadline and Where the Report Goes
The completed audit package, including the auditor’s reports, financial statements, the SEFA, and the SF-SAC data collection form, is submitted electronically to the Federal Audit Clearinghouse. The deadline is 30 calendar days after the auditee receives the auditor’s report, or nine months after the end of the audit period, whichever comes first.7eCFR. 2 CFR 200.512 – Report Submission If that date lands on a weekend or federal holiday, the submission is due the next business day. The cognizant or oversight agency can authorize an extension when the nine-month deadline would impose an undue burden, but blanket extensions are no longer granted.8Federal Audit Clearinghouse. How Do I Request an Extension on the Due Date
Once accepted, the reports go into a publicly accessible database. Federal awarding agencies, pass-through entities, and the general public can review findings, questioned costs, and the type of opinion issued. Agencies use those results to decide whether recipients are managing funds responsibly and whether to continue, modify, or terminate awards.
What Happens If You Skip or Fail the Audit
Under 2 CFR 200.505, when an entity is unable or unwilling to have a required audit conducted, federal awarding agencies and pass-through entities must take appropriate remedial action.9eCFR. 2 CFR 200.505 – Remedies for Audit Noncompliance Options include withholding a percentage of federal awards until the audit is completed, disallowing overhead costs, suspending current awards, or terminating the award. Agencies have the authority to use these remedies and, for recipients getting meaningful funding, the motivation to do so.
Findings during an audit also carry financial risk. When an auditor identifies costs that appear to violate federal rules, lack supporting documentation, or seem unreasonable, those amounts are reported as questioned costs. Once questioned costs on a program exceed $25,000, the auditor has to include them in a formal finding. The awarding agency then decides whether to require repayment, disallow the costs going forward, or work with the recipient on corrective action. Recipients that pile up findings across multiple years can also be classified as high-risk, which triggers more intensive audit coverage and closer day-to-day oversight.
Which Supplement to Use Now
The 2022 supplement is not the current version. If you’re preparing for an audit of a fiscal year ending in 2025 or 2026, reference the 2025 Compliance Supplement, released in late 2025 and available through the Office of Management and Budget’s website.10The White House. Compliance Supplement It reflects the revised Uniform Guidance thresholds that took effect for awards starting on or after October 1, 2024:
- Single audit threshold raised from $750,000 to $1,000,000.
- Equipment capitalization threshold raised from $5,000 to $10,000.
- De minimis indirect cost rate raised to up to 15%, from the previous flat 10%.
- Fixed-amount subaward threshold raised from $250,000 to $500,000.
The 2022 version still governs audits of fiscal years within its own effective window, so it remains the right reference for cleaning up late or reissued audits of those earlier periods. For anything current, work from the 2025 supplement and the updated thresholds.