Nonprofit audit requirements come from three separate places, and any one of them can force an organization to hire an independent CPA: federal rules tied to grant spending, state charitable solicitation laws, and private demands from funders, lenders, or the nonprofit’s own board. The most common federal trigger is spending $1,000,000 or more in federal awards during a fiscal year. State thresholds vary, and many nonprofits end up audited not because of any law but because a foundation or bank asks for it.
When Federal Law Requires an Audit
Any nonprofit that spends $1,000,000 or more in federal awards during its fiscal year must undergo a Single Audit, or in limited cases a program-specific audit.1eCFR. 2 CFR Part 200 Subpart F – Audit Requirements The threshold rose from $750,000 to $1,000,000 for fiscal years starting on or after October 1, 2024, so every nonprofit operating in 2026 works from the higher number.2Federal Audit Clearinghouse. About This Guide and the Federal Audit Clearinghouse Below $1,000,000 in federal spending, there is no federal audit requirement, though records must still be available if a federal agency asks to see them.
The rules live in 2 CFR Part 200, the Uniform Guidance. “Federal awards” is broader than most people assume. It covers grant expenditures, loan proceeds, surplus property received from the government, food commodity distributions, and interest subsidies, whether the nonprofit got the money directly from a federal agency or through a pass-through entity like a state government.1eCFR. 2 CFR Part 200 Subpart F – Audit Requirements Pass-through funding is what trips up organizations that don’t think of themselves as federal grant recipients.
A Single Audit is more than a standard financial statement audit. The auditor tests whether federal funds went to their intended purposes, whether the nonprofit followed the cost principles in the Uniform Guidance, and whether internal controls are strong enough to prevent misuse. Single Audits must follow Government Auditing Standards (the Yellow Book), issued by the U.S. Government Accountability Office, which layer additional independence, continuing education, and compliance-reporting requirements on top of standard auditing rules. The completed audit package goes to the Federal Audit Clearinghouse within 30 days of receiving the auditor’s report, or nine months after the fiscal year ends, whichever is earlier.2Federal Audit Clearinghouse. About This Guide and the Federal Audit Clearinghouse
When a State Requires an Audit
Most states require nonprofits to register before soliciting donations from residents, typically with the Attorney General’s office or the Secretary of State. Many of those states require an independent audit once annual revenue or contributions cross a set threshold. Based on publicly available state requirements, thresholds run from roughly $750,000 to $2,000,000, with $1,000,000 being a common trigger. Some states impose no audit requirement at all. Others use a tiered system: a less expensive financial review at a lower threshold, a full audit at a higher one.
The point of these laws is to protect residents from fraudulent or wasteful solicitation. Regulators use the audit to check that donated funds actually go to charitable purposes and that the organization is financially stable. Missing a required audit can bring fines, suspension of your registration, or revocation of your right to solicit donations in that state.
Multi-state fundraising complicates this fast. A nonprofit that solicits online and takes donations from residents of multiple states may need to register and meet audit requirements in each of them. Advisory guidelines used by state charity officials suggest registration obligations apply when an out-of-state nonprofit specifically targets residents of a state or receives donations from that state on a repeated and ongoing basis. A growing organization can go from one state’s rules to a dozen sets of thresholds, deadlines, and audit expectations within a few years.
Audit, Review, or Compilation
Not every financial examination is a full audit, and the label on the requirement matters. States and funders may ask for one of three levels, and submitting the wrong one can get a filing rejected.
- A compilation is the lightest option. A CPA formats your financial records into proper statements but does not test transactions, examine source documents, or evaluate internal controls, and provides no assurance the numbers are accurate.
- A review is a middle level. The CPA performs analytical procedures to check whether the statements are consistent with generally accepted accounting principles but does not dig into individual transactions or test internal controls. The result is limited assurance: the CPA reports whether anything came to their attention that suggests material changes are needed.
- An audit is the full examination. The CPA tests transactions, confirms balances with third parties, and evaluates internal controls, then issues a formal opinion on whether the financial statements are fairly presented.
Many state schemes use tiered thresholds where a review is required at a lower revenue level and an audit at a higher one. Grant agreements often specify the level too. Read the exact language, because “audited financial statements” means something specific and a review or compilation will not satisfy that phrase.
When Grantors, Lenders, or the Board Require an Audit
Plenty of nonprofits get audited for reasons that have nothing to do with government mandates. A nonprofit’s bylaws may call for an annual independent audit, giving the board a tool to keep the organization financially sound regardless of what any law requires. Some states encourage or require larger nonprofits to set up an audit committee, a board subgroup that hires the auditor, reviews findings, and oversees corrections.
Private foundations and corporate grantors routinely require audited financial statements as a condition of funding. Before releasing a six-figure grant, a funder wants independent verification that the organization manages money responsibly. Expect this to appear in grant agreements with a specific deadline for delivering the report.
Banks impose similar requirements when a nonprofit applies for a loan or line of credit. The audit report helps the lender judge the organization’s ability to repay debt, manage cash flow, and maintain reserves. Organizations carrying significant debt often see annual audited statements written into the loan for its full life.
The IRS itself does not require nonprofits to be audited, but Form 990 puts the question on public record. Part IV asks whether the organization obtained separate, independent audited financial statements for the tax year.3Internal Revenue Service. Form 990 Return of Organization Exempt From Income Tax If yes, the organization must complete Schedule D, Parts XI and XII, which reconcile differences between the audited statements and the revenue and expenses reported on Form 990.4Internal Revenue Service. Instructions for Schedule D (Form 990) Because Form 990 is public, donors, grantors, and watchdog groups can see whether your nonprofit is audited, and the answer functions as a credibility signal even though no IRS rule compels it.
What the Audit Itself Involves
The process starts when the board or its audit committee selects an independent Certified Public Accountant. Both sides sign an engagement letter setting out the auditor’s responsibilities, the timeline, the fee, and the applicable standard. A standard financial statement audit follows generally accepted auditing standards (GAAS). Once federal spending crosses the $1,000,000 line, Yellow Book standards apply on top.
Fieldwork is the hands-on stage. The auditor tests a sample of transactions, confirms account balances directly with banks and third parties, inspects physical records, and evaluates internal controls. In a Single Audit, the auditor also tests compliance with the specific requirements of each major federal program. The stage typically runs several weeks depending on organizational size.
The report the auditor issues contains an opinion, and the type of opinion tells readers how much weight to give the numbers. An unmodified (clean) opinion means the statements are fairly presented in all material respects. A qualified opinion means the auditor found material issues that are not so widespread as to undermine the overall picture. An adverse opinion means the misstatements are significant and pervasive enough that the statements cannot be relied upon; this is a serious red flag for any funder or regulator. A disclaimer of opinion means the auditor could not obtain enough evidence to form any opinion, which is rare and usually points to badly kept records.
The report may also flag control problems. A significant deficiency is a weakness worth the board’s attention but not severe enough that material errors are likely to slip through. A material weakness is more serious: there is a reasonable chance a significant error could go undetected. Funders and regulators watch material weaknesses closely, and repeated findings can jeopardize future funding.
What Happens If You Skip a Required Audit
The consequences run from financial penalties to losing tax-exempt status.
On the federal side, a nonprofit that fails to file Form 990 by its due date, including extensions, faces a penalty of $20 per day the return is late, up to a maximum of $12,000 or 5% of gross receipts, whichever is less. For organizations with gross receipts over $1,208,500, the penalty jumps to $120 per day with a maximum of $60,000.5Internal Revenue Service. Late Filing of Annual Returns These accumulate quickly.
The larger risk is automatic revocation. An organization that fails to file its required annual return for three consecutive years automatically loses its tax-exempt status under Section 6033(j) of the Internal Revenue Code.6Internal Revenue Service. Automatic Revocation of Exemption Revocation means donations are no longer tax-deductible, and the organization owes income tax on its revenue. Reinstating exempt status requires a new application, a user fee, and often several months of processing.
For Single Audit non-compliance, the Uniform Guidance authorizes federal agencies to withhold current funding, disallow costs, or suspend and debar the organization from receiving future federal awards.1eCFR. 2 CFR Part 200 Subpart F – Audit Requirements At the state level, failing to submit a required audit with a charitable registration can bring administrative fines or revocation of the right to solicit donations, which effectively shuts down fundraising in that state.
What a Nonprofit Audit Costs
Audit fees vary widely with organizational size, complexity, and the number of federal programs involved. Small nonprofits with straightforward finances typically pay $5,000 to $10,000. Mid-sized organizations with multiple funding streams generally see fees of $10,000 to $25,000. Large nonprofits with complex operations, international programs, or numerous federal awards can pay $25,000 to $50,000 or more. A Single Audit almost always costs more than a standard financial statement audit because of the added compliance testing.
Reviews and compilations cost significantly less. A review might run 40% to 60% of what a full audit would cost. A compilation is cheaper still. Before assuming you need a full audit, check the exact requirement in the statute or agreement. Paying for a higher level of service than the rule actually demands is one of the most common budgeting mistakes smaller nonprofits make.