What Are Government Auditing Standards (GAGAS)?

The Government Auditing Standards, known as GAGAS or the “Yellow Book,” are the professional rules the U.S. Government Accountability Office issues for auditors who examine government entities and organizations that spend government money. They set the ethics, independence, competence, fieldwork, quality, and reporting requirements that a government audit must meet to be considered credible. The current version is the 2024 Revision, which took effect for all engagement types beginning on or after December 15, 2025.¹

Who Has to Follow GAGAS

GAGAS applies to auditors of government entities, auditors of organizations that receive government funding, and any other auditor required by law or contract to use the standards. Three federal statutes drive most of the mandatory use:

The Inspector General Act of 1978 requires federal inspectors general to conduct their audits under GAGAS, including work they contract out to non-federal auditors.
The Chief Financial Officers Act of 1990, as expanded by the Government Management Reform Act of 1994 and the Accountability of Tax Dollars Act of 2002, requires GAGAS for audits of most executive branch agencies’ financial statements.
The Single Audit Act Amendments of 1996 require GAGAS for audits of state and local governments and nonprofits that receive federal awards.¹

Outside those mandates, CPA firms with government clients, contract auditors handling federal acquisitions, and state and local audit offices routinely adopt GAGAS because their jurisdiction requires it or because the standards carry professional weight.

The Three Types of GAGAS Engagements

GAGAS covers three engagement types, and the specific fieldwork and reporting rules differ by type.

Financial Audits

Financial audits under GAGAS build on the American Institute of Certified Public Accountants’ Statements on Auditing Standards and add government-specific requirements on top.² Auditors have to communicate directly with those charged with governance, such as legislative committees or oversight boards, about the audit’s scope and timing. They have to evaluate prior engagements and follow up on whether the entity acted on earlier findings. They also have to design procedures giving reasonable assurance of detecting material misstatements caused by noncompliance with laws, regulations, contracts, or grant agreements, because public funds usually come with spending restrictions and eligibility rules that a private-sector audit would never test.

Beyond the opinion on the financial statements, a GAGAS financial audit produces a separate written report on internal controls, compliance, and any instances of fraud.¹ That compliance report is often what legislators and oversight bodies care about most.

Attestation Engagements and Reviews

Attestation engagements examine or review a specific assertion or subject matter rather than a full set of financial statements. Chapter 7 recognizes three forms. Examinations provide a high level of assurance and end in an opinion on whether the subject matter meets established criteria. Reviews provide moderate assurance through inquiries and analytical procedures. Agreed-upon procedures involve the auditor performing specific tasks a third party has requested and reporting factual findings without an opinion. A typical example is an engagement examining whether an agency followed its procurement rules on a specific construction project.²

Performance Audits

Performance audits are where GAGAS departs most visibly from traditional financial auditing. Instead of asking whether the numbers are right, a performance audit asks whether the program is working. These engagements evaluate whether government programs achieve their objectives efficiently and effectively, producing analysis for management, oversight bodies, and the public.²

Chapter 8 requires performance auditors to gather sufficient, appropriate evidence to support their findings, to assess internal controls tied to the audit objectives, and to evaluate the risk of fraud, waste, and noncompliance. When evidence of potential fraud or illegal activity surfaces, auditors have to expand their procedures to determine the scope of the problem.³

Ethics and Independence

Every GAGAS engagement rests on the auditor’s ethics, independence, and professional judgment. Independence has two dimensions: independence of mind, meaning the auditor is actually unbiased, and independence in appearance, meaning a reasonable outside observer would see no reason to doubt the auditor’s objectivity. If either fails, the engagement lacks credibility.

Rather than list every possible conflict, GAGAS uses a conceptual framework. Auditors identify threats as they arise, assess how serious each one is, and apply safeguards to eliminate the threat or reduce it to an acceptable level. The standards group threats into seven categories: self-interest, self-review, bias, familiarity, undue influence, management participation, and structural threats tied to where the audit organization sits inside a government entity. Auditors have to reevaluate these threats whenever new information surfaces or circumstances change during the engagement.³

Non-audit services are a common independence pressure point. Audit organizations sometimes provide consulting or technical assistance to entities they also audit. GAGAS allows this in limited circumstances but draws a hard line: auditors cannot perform management functions, make management decisions, or audit their own work.⁴ That means no setting policy for the audited entity, no custody of its assets, no responsibility for its internal controls, no maintaining its basic accounting records, and no deciding which audit recommendations get implemented.¹

Competence and Continuing Education

Audit teams must collectively have the technical knowledge each assignment requires. Individual auditors who plan, direct, perform procedures for, or report on a GAGAS engagement must complete at least 80 hours of continuing professional education every two years, with a minimum of 20 hours in each individual year.¹ Of the 80 hours, at least 24 must cover topics directly related to the government environment, government auditing, or the audited entity’s operating environment.⁵ The other 56 hours can cover any subject that enhances the auditor’s professional expertise for engagements.

There is no formal pre-approval process for CPE courses. Auditors use professional judgment to decide whether a program qualifies and have to document that determination. If your CPE records cannot demonstrate compliance during a peer review, the consequences fall on you and your organization.

Quality Management and Peer Review

The 2024 Revision’s biggest structural change replaced the old quality control framework with a risk-based quality management system. Chapter 5 now covers “Quality Management, Engagement Quality Reviews, and Peer Review.” Audit organizations were required to design and implement a compliant quality management system by December 15, 2025, and must complete their first evaluation of that system by December 15, 2026.¹

Under the new approach, an audit organization establishes quality objectives, identifies and assesses quality risks that threaten those objectives, and designs responses to address the risks. The revision also introduces a more flexible approach for firms performing both GAGAS and non-GAGAS work, stronger monitoring expectations, and optional engagement quality reviews to address specific risks.

External peer review remains mandatory at least once every three years. An organization starting its first GAGAS engagement must obtain a peer review covering a period ending no later than three years from that start date. The peer review team must collectively have adequate knowledge of GAGAS and government auditing, and every team member must be independent of the organization being reviewed.⁶ For federal inspectors general, the Inspector General Act requires that peer reviews be conducted by another federal audit entity.

Reporting Requirements

Every GAGAS report must state that the engagement was conducted in accordance with GAGAS. The report then has to lay out the audit objectives, scope, methodology, and any limitations. When auditors identify problems, the standards call for structured findings that can include up to four elements: the condition (what the auditor found), the criteria (what should have been happening), the cause (why the problem occurred), and the effect (what harm or risk resulted). Not every finding needs all four; auditors develop whichever are relevant to the objectives.¹

Reports must identify significant deficiencies and material weaknesses in internal controls, along with any instances of fraud, illegal acts, or significant violations of contracts or grant provisions. Findings go to the audited entity’s management and to those charged with governance. Finished reports are distributed to the appropriate officials and to legislative bodies with oversight authority, and in most cases they are made available to the public. Distribution may be restricted only when the report contains sensitive security information or data protected by federal law.

How GAGAS Reaches Federal Grant Recipients

For many organizations, the most common encounter with GAGAS happens through the Single Audit Act. A non-federal entity, whether a state government, local government, or nonprofit, that spends $1,000,000 or more in federal awards during a fiscal year must undergo a single audit conducted under GAGAS.⁷ Entities spending less than that threshold are exempt from federal audit requirements for that year.

The Uniform Guidance at 2 CFR Part 200, Subpart F, implements the Single Audit Act and expressly requires GAGAS. The audit must determine whether the entity’s financial statements are fairly presented, test internal controls, and evaluate compliance with the laws and grant conditions governing each major federal program. A single audit conducted under the Uniform Guidance satisfies any other federal audit requirement the entity might face, though a federal agency can require additional work if the single audit doesn’t fully cover its needs.⁸ For the thousands of state agencies, cities, counties, school districts, and nonprofits that receive federal grants, GAGAS directly governs the audits they are legally required to obtain.

1
Government Accountability Office. Government Auditing Standards 2024 Revision
2
U.S. Government Accountability Office. Government Auditing Standards
3
Government Accountability Office. Government Auditing Standards 2018 Revision
4
Government Accountability Office. Government Auditing Standards Amendment No. 3 – Nonaudit Services
5
Government Accountability Office. Guidance on GAGAS Requirements for Continuing Professional Education
6
Government Accountability Office. Government Auditing Standards 2024 Revision
7
eCFR. 2 CFR Part 200 Subpart F – Audit Requirements
8
Office of the Law Revision Counsel. 31 USC 7502 – Audit Requirements