A nonprofit financial audit is an independent examination of your organization’s books by a CPA, resulting in a formal opinion on whether your financial statements fairly present how money came in and how it was spent. Because tax-exempt organizations rely on donor trust and public subsidy, they face a higher transparency standard than private businesses. An audit may be required by your state, by federal grant rules, or by a private funder’s contract, and the consequences of skipping a required one range from disallowed costs to loss of tax-exempt status. What follows is when you actually need one, what it costs, what happens during it, and what you have to do with the results.
When Your Nonprofit Actually Needs an Audit
Three separate systems can trigger an audit requirement, and any one of them is enough on its own.
State Revenue Thresholds
Most states tie the requirement to annual gross revenue, but the dollar figures vary widely. California requires audited financial statements once gross revenue reaches $2 million. New York sets the threshold at $1 million. Organizations below the state cutoff may only need a less rigorous review or compilation, and some states allow a review in a middle revenue band before stepping up to a full audit at a higher one. If you are registered to fundraise in multiple states, check each state’s charity registration rules separately. The lowest applicable threshold controls.
The Federal Single Audit
Any nonprofit that spends $1,000,000 or more in federal awards during a single fiscal year must undergo a Single Audit or a program-specific audit under the Uniform Guidance.1eCFR. 2 CFR 200.501 – Audit Requirements Organizations that spend less than that amount are exempt. A Single Audit goes further than a standard financial statement audit: the auditor evaluates internal controls over federal programs and checks compliance with each grant’s specific terms, following the Yellow Book standards.2U.S. Government Accountability Office. Yellow Book: Government Auditing Standards
Skipping a required Single Audit is not a paperwork problem. Federal agencies can withhold payments, disallow costs, suspend or terminate the award, or start debarment proceedings that block future federal funding entirely.3eCFR. 2 CFR 200.339 – Remedies for Noncompliance
Grant and Funder Contracts
Private foundations and institutional funders often require audited financial statements as a condition of a grant, regardless of any statutory threshold. A nonprofit with $400,000 in revenue may fall well below every state mandate and still face an audit requirement because one foundation grant demands it. Read the compliance clauses in every grant agreement before you sign.
The IRS Does Not Require an Audit
One boundary worth stating plainly: the IRS itself does not require nonprofits to be audited. Your audit obligation comes from states, federal awarding agencies, or funders, not from the tax code.
Audit, Review, or Compilation: These Are Not Interchangeable
A CPA can perform three different levels of engagement. When a state law or grant says “audit,” a cheaper engagement will not satisfy it.
- An audit is the most thorough. The auditor tests transactions, confirms balances with third parties, evaluates internal controls, and issues an opinion on whether the financial statements are fairly presented. This is what regulators and major funders mean when they use the word.
- A review is mid-level. The CPA performs analytical procedures to assess whether the statements conform with generally accepted accounting principles but does not test individual transactions or controls. The report states whether anything material needs modification. It is not an opinion on the statements as a whole.
- A compilation is the lightest engagement. The CPA reformats your data into proper financial statement format and looks for obvious errors. No verification, no opinion, no assurance.
Confirm the specific language before assuming a less expensive engagement will meet the requirement.
Preparing for the Audit
Choosing an Independent Auditor
The auditor must be an independent CPA or firm with no financial ties to the organization beyond the engagement itself. If your organization receives federal funds, the Yellow Book independence rules for nonaudit services are stricter than the general AICPA rules. As a practical matter, the firm auditing your books generally should not also be doing your bookkeeping, designing your financial systems, or providing management consulting.
Hiring the auditor is a board-level decision, not a staff function. The board or its audit committee should solicit proposals, evaluate candidates, and approve the choice. When management picks its own auditor, the independence the audit is supposed to provide is already compromised.
Documents to Have Ready
Once engaged, the auditor sends a “prepared by client” list. Getting these organized early is the single biggest lever on the final bill, because auditors charge for time and disorganized records slow the whole engagement.
- Statement of financial position and statement of activities for the fiscal year under review
- Monthly bank reconciliations for every account
- Grant agreements and documentation showing restricted funds were spent on their designated purposes
- Payroll registers, tax filings, and benefit documentation
- Board meeting minutes reflecting approval of financial decisions
- Written internal control policies covering check signing, expenditure approval, system access, and contract authorization
What It Costs
Fees depend on your size, the complexity of your funding streams, and how many programs you run. Smaller nonprofits with straightforward finances can expect fees starting around $5,000 to $10,000. Mid-sized organizations commonly pay $10,000 to $25,000. Large nonprofits with multiple programs, international operations, or significant federal funding can see $25,000 to $50,000 or more.
The Management Representation Letter
Near the end of the audit, leadership signs a management representation letter confirming that the financial statements are fairly presented, that all transactions have been recorded, that any known fraud has been disclosed, that estimates are reasonable, and that no material subsequent events would change the picture. This is not a formality. Signing while knowing the letter contains false statements creates serious legal exposure for the individuals who sign.
How the Audit Runs
Fieldwork
During fieldwork, the auditor pulls samples of transactions and traces them to supporting evidence. A donation is matched to the deposit and acknowledgment. An expense is matched to the invoice, the approval, and the canceled check. The auditor also tests whether internal controls you claim to have are actually operating: if the policy requires two signatures on checks over $5,000, the auditor pulls a sample and looks for both. Fieldwork can take a few days for a small organization or several weeks for a large one, on-site or remote.
The Exit Conference
Before issuing the report, the auditor walks leadership through preliminary findings. This is your chance to explain apparent discrepancies, produce missing documentation, or get clarity on what the auditor found. It is not adversarial, and context from management often resolves questions that looked worse on paper.
The Four Possible Opinions
- An unmodified (clean) opinion means the financial statements are fairly presented in all material respects. This is the goal.
- A qualified opinion means the statements are fairly presented except for a specific, limited issue.
- An adverse opinion means the statements are materially misstated and do not fairly represent the organization’s financial position. This is a serious red flag for funders and regulators.
- A disclaimer of opinion means the auditor could not obtain enough evidence to form any opinion. It typically signals significant problems with record-keeping or cooperation.
Anything other than an unmodified opinion will draw questions from funders and can jeopardize future grant eligibility.4Public Company Accounting Oversight Board. AS 3105 – Departures From Unqualified Opinions and Other Reporting Circumstances
Responding to Findings
Beyond the opinion, auditors issue a management letter identifying internal control weaknesses. A significant deficiency is important enough to warrant the board’s attention but does not mean the financial statements are likely wrong. A material weakness is more serious: there is a reasonable chance a significant error could go undetected.5Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements Even findings that do not affect the opinion still matter, because funders and regulators read management letters closely.
For Single Audits, the rules are more specific. Auditors must flag material noncompliance with federal program requirements, questioned costs exceeding $25,000 for any major program, and any known or likely fraud affecting a federal award.6eCFR. 2 CFR 200.516 – Audit Findings
If you receive Single Audit findings, you must prepare a formal corrective action plan. Federal regulations specify what it must include: a reference number for each finding, the person responsible for correcting it, the specific corrective steps, and an anticipated completion date. If you disagree with a finding, you still address it, with a detailed explanation of why you believe it is incorrect or unnecessary.7eCFR. 2 CFR 200.511 – Audit Findings Follow-Up
Even outside the Single Audit context, treat every management letter finding as an action item. Fixing last year’s problems before this year’s audit is one of the strongest signals you can send to funders. Ignoring findings tends to escalate them: a significant deficiency in year one can become a material weakness in year two.
Board Oversight
The board bears ultimate responsibility for the integrity of financial reporting. Larger nonprofits handle day-to-day audit oversight through an audit committee composed of board members independent of management, ideally with at least one person with financial expertise. The committee selects and hires the auditor, reviews the audit report and management letter, and confirms that findings get addressed.
Two provisions of the Sarbanes-Oxley Act apply to all organizations, including nonprofits, and are not optional. It is illegal to retaliate against an employee who reports suspected fraud or accounting irregularities, whether through termination, demotion, suspension, or harassment. And it is a federal crime to alter, destroy, or conceal documents to prevent their use in a federal investigation or legal proceeding. Both provisions carry criminal penalties. Many governance experts also recommend that nonprofits voluntarily rotate the lead audit partner every five years and bar the audit firm from simultaneously providing bookkeeping or consulting services.
Reporting the Audit on Form 990
If you did receive audited financial statements, you must report that on Form 990, Part IV, line 12, and complete the reconciliation schedules in Schedule D, Parts XI and XII, which tie the audited numbers to the return.8Internal Revenue Service. Exempt Organizations Annual Reporting Requirements – Form 990, Part VIII-IX and Schedule D (Financial Information) Organizations that prepared financial statements but were not audited may complete the same reconciliations voluntarily.9Internal Revenue Service. 2025 Instructions for Form 990
Public Inspection
Every tax-exempt organization must make its Form 990 available for public inspection at its principal office during regular business hours and provide copies on request for three years after filing.10Internal Revenue Service. Public Disclosure and Availability of Exempt Organization Returns and Applications The application for exemption (Form 1023 or 1024) is subject to the same requirement. Donor names and addresses on Schedule B are excluded. Federal law requires disclosure of the Form 990, not the audited statements themselves, though some states do require public availability of audited financials, and many organizations post both online voluntarily.
Penalties for Late or Incomplete Filing
For most organizations, filing late costs $25 per day up to a maximum of $13,000 or 5% of gross receipts, whichever is smaller. Organizations with annual gross receipts exceeding approximately $1.3 million face $130 per day up to $65,000.9Internal Revenue Service. 2025 Instructions for Form 990 If the IRS demands a corrected return and the responsible individual does not comply, that person can be charged an additional $10 per day up to $6,500. Denying public inspection carries its own penalty of $25 per day up to $13,000 per return.11Office of the Law Revision Counsel. 26 USC 6652 – Failure to File Certain Information Returns, Registration Statements, Etc. States impose their own late-filing penalties, often including monthly fees and loss of the right to solicit donations.
Automatic Revocation After Three Years
The most severe consequence is not a fine. An organization that fails to file a required Form 990 for three consecutive years automatically loses its tax-exempt status. Revocation takes effect on the original filing due date of the third missed return.12Internal Revenue Service. Automatic Revocation of Exemption Reinstatement requires filing a new application for exemption, with no guarantee of approval. Three years of inattention can undo decades of exempt status.