GAGAS Audit Requirements: Preparation, Opinions, and Filing

GAGAS audit requirements apply to any state or local government, nonprofit, or university that spends $1,000,000 or more in federal awards during a fiscal year, and they require an independent auditor working under the Government Accountability Office’s Yellow Book to examine the organization’s financial statements, internal controls, and compliance with federal award terms.¹ The current threshold took effect for fiscal periods beginning on or after October 1, 2024, and a revised version of the standards governs engagements covering periods that begin on or after December 15, 2025.²

Who Is Required to Get One

The trigger is set by the Single Audit Act and 2 CFR Part 200 Subpart F. If your organization spends $1,000,000 or more in federal awards during its fiscal year, counting all grants, loans, and other assistance combined rather than any single program, you must arrange either a single audit or a program-specific audit.¹

The requirement most often lands on:

State and local government departments, agencies, and instrumentalities running federal programs.
Nonprofits, including charities, foundations, and pass-through recipients of federal funding.
Colleges and universities receiving federal financial aid, research grants, or other awards.³

For-profit companies sit outside Subpart F. When a for-profit business receives federal funding as a subrecipient, the pass-through entity that awarded the money is the one responsible for monitoring compliance, and that entity decides whether to require pre-award audits, ongoing oversight, or a post-award audit.⁴

A narrower program-specific audit is available if you spend federal funds under just one program (other than research and development) and the program’s statutes and award terms do not already require a financial statement audit. For R&D funding, this alternative works only when all awards came from the same agency, or the same agency and pass-through, and that agency approves the approach ahead of time.

The Type of Engagement You Will Likely Face

The Yellow Book covers three categories of work. Most entities crossing the spending threshold receive a financial audit in the form of a single audit: the auditor issues an opinion on whether financial statements are presented fairly under GAAP, and then reports separately on internal controls over financial reporting and on compliance with laws, regulations, and grant agreements that could materially affect those statements.²

Performance audits are a separate category that evaluates whether a program is achieving its goals — effectiveness, efficiency, and economy — along with internal controls and compliance. They are usually launched by an oversight body in response to specific concerns rather than on an annual cycle. Attestation engagements cover financial and nonfinancial claims measured against defined criteria at three assurance levels (examination, review, and agreed-upon procedures). Neither category replaces the single audit obligation.

Standards Your Auditor Must Meet

You cannot satisfy GAGAS requirements by hiring any CPA. The Yellow Book imposes conditions on the audit firm that go beyond ordinary private-sector work, and confirming these before signing an engagement letter is part of the entity’s responsibility.

Auditors must be independent in fact and appearance. Before starting, they evaluate threats to objectivity — financial interests in the audited entity, close personal ties to management, or prior involvement in the programs under review — and decline the work if the threats cannot be reduced with safeguards.

Every auditor working on planning, performing, or reporting must complete at least 80 hours of continuing professional education every two years, with at least 24 of those hours in government auditing, the government operating environment, or the specific environment of the entity being audited, and at least 20 hours in each year of the cycle.²

The audit firm itself must go through an external peer review at least once every three years, and a firm new to GAGAS work must have its first peer review cover a period ending no later than three years after its first GAGAS engagement.² Ask for the peer review report before hiring.

What You Need to Have Ready

Fieldwork moves faster and costs less when documentation is assembled before the auditors arrive.

Financial Statements and the SEFA

You need complete financial statements for the year under review. For a single audit, you also prepare a Schedule of Expenditures of Federal Awards. The SEFA lists every federal program you participated in, the federal assistance listing number, the awarding agency, and the amount spent under each program. Auditors use it to identify which programs are large enough to be treated as major programs and subjected to detailed compliance testing.⁵

Internal Control Documentation

Auditors want to see written policies covering cash handling, purchasing, payroll, grant drawdowns, and cost allocation. Federal entities follow the GAO’s Green Book, Standards for Internal Control in the Federal Government, which adapts the COSO framework to government use. Non-federal entities typically apply COSO directly, and auditors will look for the same underlying principles either way.

Prior Findings and Corrective Actions

If earlier audits produced findings, the current auditor will check whether the problems were actually fixed. Keep a summary schedule of prior audit findings and evidence of the corrective steps taken. Unresolved items draw extra scrutiny and shift the entity’s risk profile.

Grant and Program Records

Expect requests for grant agreements, contracts, award notices, draw-down records, time-and-effort documentation, and subrecipient monitoring files. The OMB Compliance Supplement, published annually, tells auditors which specific requirements to test for each major federal program, so pulling records aligned to that supplement is a good use of preparation time.⁶

How the Engagement Runs

An entrance conference opens the audit. Management and auditors set scope, timeline, and logistics, and this is the moment to raise unusual transactions, new programs, or staffing changes. Problems flagged now cause less trouble than problems the auditor uncovers on their own mid-fieldwork.

Fieldwork tests financial data and evaluates internal controls. For a single audit, that means identifying major programs from the SEFA and a risk assessment, testing compliance with federal requirements for those programs, and sampling specific transactions such as payroll charges to a grant, procurement files, and eligibility determinations to confirm that the rules were followed in practice.

An exit conference gives management a chance to respond to preliminary findings, supply additional documentation, and discuss disagreements before anything is finalized. Corrections or context provided here can change what appears in the final report.

The reporting phase produces the opinion on the financial statements, a report on internal controls and compliance, and — for single audits — a schedule of findings and questioned costs.

What the Opinions Mean

Four outcomes are possible on the financial statements:

Unmodified: statements are presented fairly in all material respects. The clean result.
Qualified: statements are generally fair, but specific misstatements were found or evidence was missing in a particular area. Material but not pervasive.
Adverse: misstatements are both material and pervasive; the statements cannot be relied on.
Disclaimer: the auditor could not gather enough evidence to form any conclusion, and the potential impact could be material and pervasive. This usually points to serious record-keeping failures or a lack of cooperation.

In a single audit, the auditor also issues a separate compliance opinion on each major program. Any modification of that compliance opinion becomes a reportable finding on its own and can trigger federal agency follow-up.

Findings and What They Cost You

Problems identified during a single audit are documented in the schedule of findings and questioned costs. Under 2 CFR 200.516, the auditor must report:

Material weaknesses and significant deficiencies in internal controls. A material weakness means there is a reasonable chance that a significant misstatement would go undetected; a significant deficiency is less severe but still merits attention from leadership.
Material non-compliance with federal statutes, regulations, or award terms that is significant enough to affect a major program opinion.
Questioned costs exceeding $25,000, meaning expenditures where the auditor found evidence that the spending may not have been allowable, adequately documented, or in line with program rules.
Known or likely fraud involving federal award funds.⁷

When a federal agency or pass-through decides that findings cannot be resolved through routine corrective action, 2 CFR 200.339 lays out the available remedies: temporarily withholding payments, disallowing costs tied to the non-compliant activity, suspending or terminating the award, withholding future funding, and initiating debarment that can shut the entity out of federal awards entirely.⁸

Material weaknesses carry additional weight. They disqualify the entity from low-risk auditee status, expand the scope of future audits, and signal to federal agencies that closer monitoring may be needed. Significant deficiencies do not trigger those automatic effects, but they still require a formal corrective action plan and appear on the public audit record.

Earning Low-Risk Auditee Status

A clean track record reduces future audit coverage, which means less testing, faster fieldwork, and lower fees. Under 2 CFR 200.520, low-risk status requires that, for each of the two preceding audit periods, all of the following were true:

Annual single audits were performed and submitted on time.
The auditor issued unmodified opinions on both the financial statements and the SEFA.
No material weaknesses were identified.
The auditor did not raise substantial doubt about the entity’s ability to continue operating.
No Type A major program had material weakness findings, a modified compliance opinion, or questioned costs above five percent of the program’s total expenditures.⁹

Losing that status, whether from a single material weakness or a late submission, forces the auditor to test a larger share of major programs in the following year, which directly raises the audit fee.

Filing With the Federal Audit Clearinghouse

The completed audit package is due at the Federal Audit Clearinghouse within 30 calendar days after you receive the auditor’s report, or within nine months after the end of the audit period, whichever comes first. If the due date lands on a weekend or federal holiday, it moves to the next business day. The cognizant or oversight agency for audit can grant an extension if the nine-month deadline would impose an undue burden.¹⁰

Submissions go through fac.gov. The entity fills out a series of web forms, uploads a PDF of the complete reporting package, and submits the data collection form as workbooks.¹ Once submitted, the audit becomes part of the public record, searchable by federal agencies, pass-through entities, and anyone else evaluating the organization for future funding.

A missed deadline is not just administrative. Late submissions disqualify the entity from low-risk status for the next two audit periods, and the federal agency may treat the delay itself as a compliance failure subject to the same remedies available for other violations, including withheld payments or a suspended award.

1
Federal Audit Clearinghouse. About This Guide and the Federal Audit Clearinghouse
2
Government Accountability Office. Government Auditing Standards 2024 Revision
3
U.S. Department of Education Office of Inspector General. Non-Federal Audits
4
eCFR. 2 CFR Part 200 Subpart F – Audit Requirements
5
U.S. Department of Health and Human Services Office of Inspector General. Single Audits FAQs
6
The White House. Compliance Supplement
7
eCFR. 2 CFR 200.516 – Audit Findings
8
eCFR. 2 CFR 200.339 – Remedies for Noncompliance
9
eCFR. 2 CFR 200.520 – Criteria for a Low-Risk Auditee
10
eCFR. 2 CFR 200.512 – Report Submission