A nonprofit audit checklist covers five categories of records you need to assemble before your auditor starts fieldwork: financial statements and accounting records, organizational and legal documents, written internal control policies, grant and revenue documentation, and payroll and tax filings. The full process — from selecting an auditor through receiving the final report — typically runs two to six months, so the practical starting point is three to four months before your fiscal year-end, not the week the auditor calls to schedule fieldwork.
Below is what to gather in each category, what triggers a mandatory audit in the first place, and what to do with the auditor’s findings once the report arrives.
Do You Actually Need an Audit This Year
Three things force an audit: federal funding, state charitable solicitation law, or a funder’s contract. If none apply, you may not need a full independent audit at all.
On the federal side, any organization that spends $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit (or a program-specific audit if only one federal program is involved) under 2 CFR Part 200, Subpart F.1eCFR. 2 CFR Part 200 Subpart F – Audit Requirements That threshold rose from $750,000 to $1,000,000 for audit periods beginning on or after October 1, 2024.2Office of Inspector General – HHS.gov. Single Audits FAQs A Single Audit goes beyond a standard financial statement audit: it tests your compliance with each major federal program and reports on your internal controls over federal awards, and the auditor must follow Government Auditing Standards (Yellow Book / GAGAS).
States that regulate charitable solicitation set their own revenue or contribution thresholds, ranging from around $500,000 in annual contributions in some states to $2,000,000 in gross revenue in others. Some states accept a review or compilation instead of a full audit depending on the dollar amount. Check with your state attorney general’s office or the agency that oversees charitable registrations for the exact threshold and filing deadline.
Even if you fall below every legal threshold, read your grant agreements. Individual foundations, government grantors, or major donors often require an independent audit as a funding condition, and some specify GAGAS rather than standard auditing rules, which changes both the scope and which firms can do the work.
Start With the Timeline and the Auditor
Begin the search at least three to four months before your fiscal year-end. Nonprofit audits are seasonal, and experienced firms book up fast. The board or audit committee — not management — should drive selection. An audit committee of board members with financial literacy is the standard oversight structure, and its core responsibilities include hiring the auditor, reviewing results, and serving as the communication channel between the auditor and the board.
Independence is the qualification you cannot compromise on. The auditor and the firm cannot hold a financial interest in your organization, serve as a director or officer, or perform management functions like authorizing transactions or preparing your source records. An auditor who did your bookkeeping last year cannot audit those same books. If a partner at the firm sits on your board in any capacity, that arrangement needs a hard look before you engage the firm.
When you evaluate firms, ask specifically about their nonprofit experience, familiarity with your funding sources (federal grants, state contracts, foundation awards), and whether they have staff qualified to perform a Single Audit if your federal spending crosses the threshold. Get an engagement letter that spells out scope, timeline, deliverables, and fees before fieldwork begins.
Financial Records to Pull Together
The auditor builds the entire engagement around your financial data. Missing or incomplete records here stall the audit faster than anything else.
Draft Financial Statements
A complete GAAP set of audited nonprofit financial statements has four documents, and the auditor expects clean drafts of all four before fieldwork:
- Statement of Financial Position — the nonprofit version of a balance sheet, showing assets, liabilities, and net assets at fiscal year-end.
- Statement of Activities — revenue, expenses, and change in net assets for the period.
- Statement of Cash Flows — cash movement classified by operating, investing, and financing activities. Most nonprofits use the indirect method, starting from the change in net assets and adjusting for non-cash items like depreciation.
- Statement of Functional Expenses — all spending split among program services, management and general administration, and fundraising. Shared costs like rent or salaries need a documented, consistent allocation methodology. This statement also feeds directly into your Form 990.
The auditor will test and adjust these, but starting from clean drafts saves weeks of back-and-forth.
General Ledger, Trial Balance, and Journal Entries
The final adjusted trial balance is the foundation of the audit. Export your full-period general ledger so the auditor can trace individual transactions. Any journal entries made after the year-end close — reclassifications, accruals, corrections — should sit in a separate log with a written explanation for each. Unexplained adjusting entries are a red flag auditors will dig into.
Bank Reconciliations
Provide year-end reconciliations for every account: operating, savings, money market, certificates of deposit, and investment accounts. Each reconciliation should show the bank statement ending balance, the ledger balance, and a clear list of outstanding checks and deposits in transit. Label each one with the institution and account purpose.
Receivables and Payables
Prepare an aged accounts receivable schedule listing every outstanding amount owed to the organization, broken down by payer, invoice date, and aging bucket. Do the same for accounts payable — every unpaid vendor invoice as of year-end with vendor name, invoice date, and amount. The auditor uses these to verify that receivables and payables on the balance sheet are real and properly valued.
Fixed Asset Register
Keep a complete list of property and equipment showing description, date acquired, original cost, useful life, depreciation method, and accumulated depreciation through year-end. Document any disposals or retirements with the date, method, and any gain or loss. The auditor will reconcile this register to the fixed-asset lines on your financial statements.
Governance and Legal Documents
These records establish that your nonprofit exists as a legal entity, operates under proper governance, and maintains its tax-exempt status.
Formation and Exemption
Have your IRS determination letter on hand, along with your articles of incorporation and current bylaws. The determination letter confirms tax-exempt status under Section 501(c)(3) of the Internal Revenue Code.3Office of the Law Revision Counsel. 26 U.S. Code 501 – Exemption From Tax on Corporations, Certain Trusts, Etc. The auditor uses these to verify the organization’s purpose, confirm the governance structure matches actual practice, and check for amendments during the year.
Board and Committee Minutes
Provide minutes for every board and committee meeting held during the fiscal year. The auditor is looking for documented approval of the annual budget, significant contracts, executive compensation decisions, new programs, debt agreements, and any action with financial consequences. Gaps in the meeting record raise governance concerns. Include a current board roster with names, titles, and terms, and note any members who joined or departed during the year.
Payroll and Employment Tax Filings
The auditor will reconcile your payroll register to your quarterly Form 941 filings. Have a summary for each quarter showing total wages paid, federal income tax withheld, Social Security and Medicare wages, and total tax deposits. Resolve and document any discrepancies between your payroll system and your 941s before the audit. Year-end W-2s and 1099s should be available, along with documentation of employee benefit costs.
Contracts, Leases, and Legal Matters
Disclose any pending or threatened litigation, claims, or assessments so the auditor can evaluate whether the financial statements should carry a contingent liability. Have current leases for office space, equipment, or vehicles ready, along with significant contracts, loan agreements, and lines of credit.
Internal Control Policies the Auditor Will Test
Written policies are not paperwork for the file cabinet. Auditors test whether the organization actually follows them, and weak or missing controls can produce findings in the management letter or, in serious cases, a qualified opinion.
Accounting Procedures Manual
This is your playbook for how money moves: who initiates transactions, who records them, who approves them, and how the work is separated so no single person controls a financial process end to end. Segregation of duties is the internal control auditors evaluate most carefully, especially at smaller nonprofits where one or two people handle everything. If your staff size makes full segregation impossible, document the compensating controls — for instance, having the board treasurer review bank statements directly.
Signature Authority and Spending Controls
Document who can sign checks, approve wire transfers, and use organizational credit cards. Most nonprofits set a dollar threshold above which two signatures are required. The specific threshold matters less than having it written down and consistently enforced. Keep bank signature cards current and update them immediately when authorized signers change.
Credit card policy should specify who gets a card, allowed purchases, spending limits per transaction or billing cycle, and the requirement to submit itemized receipts. Petty cash needs a designated custodian, a maximum fund balance, and receipts for every disbursement.
Expense Reimbursement
Spell out what costs the organization reimburses, the documentation employees must submit (receipts above a stated amount, mileage logs, purpose of expenditure), and the approval chain. The auditor will sample reimbursements and check whether the policy was followed. Reimbursements without receipts or pre-approval are exactly what ends up in the management letter.
Conflict of Interest
The IRS encourages every 501(c)(3) to adopt a conflict of interest policy, and Form 1023 specifically asks whether one exists.4Internal Revenue Service. Form 1023 – Purpose of Conflict of Interest Policy The policy should require board members and key employees to disclose any financial interest that could conflict with the organization’s mission, such as voting on a contract with a business they own. Keep signed annual disclosure forms from every board member and officer. The auditor reviews these to confirm the policy is active, not just on paper.
Whistleblower Policy
A whistleblower policy is not legally mandated for most nonprofits, but the IRS encourages boards to adopt one, and Form 990 asks whether the organization has a written policy for handling employee complaints about suspected financial impropriety. Separately, the Sarbanes-Oxley Act’s whistleblower retaliation protections apply to nonprofits regardless of whether you have a formal policy. A written policy that describes how employees can report concerns confidentially, and that prohibits retaliation, satisfies the Form 990 question and strengthens your governance posture.
Grant and Revenue Documentation
Revenue recognition is one of the more complex areas in a nonprofit audit, especially when funding comes with strings attached.
Grant Agreements and Award Letters
Organize every active grant agreement, award letter, and government or foundation contract. The auditor needs the full terms: award amount, performance period, eligible costs, reporting deadlines, and any matching or cost-sharing requirements. For multi-year grants, include amendments and budget modifications. These documents determine whether revenue was recognized in the correct period and whether restricted funds were spent according to grant terms.
Restricted and Unrestricted Contributions
Prepare a summary that separates contributions by restriction type: unrestricted, temporarily restricted (donor-imposed purpose or time restriction), and permanently restricted (endowment-type gifts where only earnings can be spent). For restricted funds, document how you tracked spending against the restriction and when you released the funds to unrestricted net assets. The auditor will match specific expenses to the corresponding grant or donor restriction to confirm compliance.
A detailed schedule of all contributions, broken down by individual donations, corporate sponsorships, foundation grants, and government awards, helps the auditor assess concentration risk and verify classification.
In-Kind Contributions
Donated goods, services, and use of facilities need their own documentation. Under GAAP, contributed nonfinancial assets must appear as a separate line item on the statement of activities.5PwC Viewpoint. Not for Profit Entities (Topic 958) For each category of in-kind contributions, your records should include a description, the fair market value at receipt, the valuation method used, whether the contribution was monetized or used in programs, and any donor restrictions. Contributed services can only be recognized if they require specialized skills (like legal or accounting work) and would have been purchased if not donated.
Schedule B Records
If your organization files Form 990 or 990-EZ, you may need to complete Schedule B (Schedule of Contributors). The general rule requires reporting contributions of $5,000 or more from a single contributor. For 501(c)(3) organizations meeting the one-third public support test, the threshold is $5,000 or more only when the contribution also exceeds 2% of total contributions reported on the return.6Internal Revenue Service. Instructions for Schedule B (Form 990) Keep donor records organized with contribution amounts by individual so the schedule can be prepared accurately.
What Happens During Fieldwork
Once the documentation is assembled, the auditor moves through planning, fieldwork, and reporting.
Planning is a risk assessment: budget size, funding complexity, control strength, and changes from the prior year (new programs, leadership turnover, growth) determine which accounts get the most scrutiny. If you cross the Single Audit threshold, the auditor also identifies major federal programs and plans the compliance testing required under 2 CFR Part 200.1eCFR. 2 CFR Part 200 Subpart F – Audit Requirements
Fieldwork is the hands-on phase. Expect the auditor to pull samples of transactions and trace them from the original invoice or receipt through the general ledger to the financial statements, confirm bank balances directly with your financial institutions, send confirmation letters to major donors or grantors, and test a selection of journal entries. Designate one staff person as the primary liaison so questions get answered quickly.
Near the end, management signs a representation letter confirming that all records were made available, all transactions have been recorded, management is responsible for internal controls over fraud, and any known fraud or noncompliance has been disclosed. Refusing to sign it prevents the auditor from issuing an opinion. An exit conference with the board or audit committee walks through findings before the final report goes out.
After the Report: Turn Findings Into Next Year’s Checklist
Alongside the audit report, the auditor usually issues a management letter describing internal control weaknesses, inefficiencies, and other observations that do not rise to the level of a financial statement finding but still need attention. Treat it as a to-do list. Working through the items before next year’s audit demonstrates responsiveness and often reduces the following year’s scope and cost.
The report itself is also a credibility tool. Share it with your board, major funders, and state regulators as required. Many grant applications ask for the most recent audited financial statements, and having them ready signals financial stewardship. Build the management letter recommendations into your next fiscal year’s priorities, update any policies the auditor flagged as outdated, and keep your document organization system running year-round rather than rebuilding it each audit season. Organizations that treat the audit as an annual tune-up consistently spend less time and money on the process than those that treat it as a crisis.