What Is a Municipal Audit? Standards, Opinions, and Reports

A municipal audit is an independent examination of a local government’s financial records, internal controls, and operations, carried out to confirm that taxpayer money was spent as authorized and that the city or county’s published financial figures are reliable. The result is a public report that residents, bond investors, and state and federal oversight agencies use to judge how local officials are managing public funds.

Local governments do not grade their own homework. An outside auditor, working under national standards, tests the books, flags problems, and issues an opinion that travels with the municipality for years, shaping its borrowing costs and its eligibility for grants.

The Three Types of Municipal Audits

Not every audit asks the same question. Local governments typically encounter three kinds, sometimes bundled into a single engagement.

Financial Audits

This is the most common type. The auditor examines whether the government’s financial statements are presented fairly under Generally Accepted Accounting Principles.1Office of Justice Programs. Generally Accepted Accounting Principles (GAAP) Guide Sheet That means verifying account balances, revenues, expenditures, and debt figures against what actually happened during the fiscal year. The product is an opinion letter that citizens and bond investors rely on when sizing up the municipality’s financial health.

Compliance Audits

A compliance audit asks a narrower question: did the municipality follow the specific rules attached to the money it received? Grant money comes with strings, and this review checks whether funds were spent on the intended programs, whether required matching contributions were made, and whether eligibility rules for beneficiaries were followed. Violations can lead the federal government to demand its money back or restrict future funding.

Performance Audits

Performance audits go beyond the numbers to evaluate whether a government program is actually achieving its goals at a reasonable cost. An auditor might assess whether a public works department’s fleet maintenance program is cost-effective, or whether a housing assistance program is reaching the people it was designed to serve. The output is typically a set of specific recommendations for improving service delivery.

Who Performs the Audit

Independence is the whole point. The people reviewing the books cannot be the same people who prepared them. Three kinds of auditors handle the work.

Most municipalities hire an independent Certified Public Accounting firm for the external audit. The firm is usually selected by the legislative body (a city council or county commission) rather than by the finance department under review. Firms doing government work must participate in quality control and peer review programs to show they meet the specialized professional standards.

In some states, a state-level auditor or comptroller performs municipal audits directly, which is especially common for smaller jurisdictions that cannot absorb the cost of a private firm. State auditors also often oversee the CPA firms operating within their state, reviewing completed reports for quality.

Larger cities and counties sometimes maintain internal audit departments staffed by full-time government employees. These teams monitor controls year-round and flag operational issues, but they do not replace the external audit. The official opinion must come from an independent party.

The Rules That Govern a Municipal Audit

Municipal audits run on a layered rulebook. Federal standards set the floor; state law frequently adds requirements on top.

Government Auditing Standards (The Yellow Book)

The primary framework is the Generally Accepted Government Auditing Standards, commonly called the Yellow Book, published by the U.S. Government Accountability Office. These standards apply to audits of government organizations and entities receiving government funding.2U.S. Government Accountability Office. Yellow Book Government Auditing Standards GAGAS is tougher than private-sector auditing standards in one key way: auditors must report on internal controls and compliance with laws and regulations regardless of whether they find problems.3U.S. Government Accountability Office. Government Auditing Standards 2024 Revision In private-sector work, the auditor can often skip that reporting when nothing turned up. Under GAGAS, it is mandatory every time.

The Single Audit Threshold

Any municipality that spends $1,000,000 or more in federal awards during a fiscal year must undergo a “single audit.”4eCFR. 2 CFR 200.501 – Audit Requirements This bundles the financial statement review and compliance testing of major federal programs into one engagement, so the municipality is not audited separately for each grant. The auditor identifies which federal programs qualify as “major” based on dollar thresholds and risk factors, then tests those for compliance with program-specific requirements.5eCFR. 2 CFR 200.514 – Scope of Audit Governments below the $1,000,000 threshold are exempt, though their records must still be available if a federal agency wants to review them.

State Requirements

State laws add their own layer. Many states require annual audits regardless of whether a municipality takes any federal money and regardless of jurisdiction size. Some mandate a specific accounting basis, require particular reporting on local tax collections, or maintain lists of CPA firms approved for governmental work. Submission deadlines vary, but most states require the completed audit within a few months to nine months after the fiscal year ends.

How the Audit Actually Unfolds

A municipal audit follows a structured sequence built to concentrate the auditor’s time where the risk of error or misuse is highest.

Planning and Materiality

The engagement opens with planning. The auditor learns the municipality’s operations, governance, major revenue sources, and financial environment, then zeroes in on the areas most likely to contain material misstatements. A material misstatement is an error large enough to change a reasonable person’s view of the financial statements.

Setting the materiality threshold is one of the auditor’s most consequential early calls. It is a dollar amount, calculated during planning, that drives which accounts get tested, how heavily, and whether uncorrected errors will affect the opinion. The number blends quantitative factors like total revenues or expenditures with qualitative considerations like whether an error involves fraud or touches a politically sensitive program.

Fieldwork and Testing

Fieldwork is where the evidence gets gathered. Auditors pull samples of transactions and trace them from authorization through recording to verify accuracy. They test internal controls to see whether the municipality’s safeguards against fraud and error are actually functioning. The team physically inspects assets, confirms account balances with banks and third parties, and interviews key finance staff. For single audits, they also test compliance with the requirements of each major federal program.

Review and Communication

Before the report is finalized, the audit team walks management through its findings. Control deficiencies, compliance violations, and other issues are presented so officials can supply context or correct errors before the report becomes public. The engagement partner reviews the complete file to confirm it meets GAGAS and professional standards. A management letter typically accompanies the report, covering less severe operational suggestions.

Reading the Audit Report

The audit report is the public-facing document that tells residents and investors whether the municipality’s financial picture holds up. Knowing how to read it is the difference between informed oversight and trusting numbers on faith.

The Annual Comprehensive Financial Report

The audit opinion appears inside a larger document called the Annual Comprehensive Financial Report, or ACFR. This is the municipality’s official annual financial publication, prepared under standards set by the Governmental Accounting Standards Board.

The financial section opens with a Management’s Discussion and Analysis, a narrative overview where officials explain the year’s financial highlights in plain language.6Governmental Accounting Standards Board. Summary – Statement No. 34 Then come the basic financial statements: government-wide statements showing total assets, liabilities, and activities, followed by fund financial statements breaking the numbers down by individual funds like the general fund, special revenue funds, and enterprise funds. The independent auditor’s report, containing the opinion, sits at the front of this section.

The Four Possible Opinions

The opinion is the bottom line. There are four possibilities.

  • Unmodified (clean) opinion. The financial statements are presented fairly in all material respects. This is the best outcome and the one most municipalities receive.
  • Qualified opinion. The statements are generally fair, but one specific area does not conform to GAAP or the auditor could not gather enough evidence to verify it.
  • Adverse opinion. The financial statements are materially misstated and should not be relied on. This is rare and severe.
  • Disclaimer of opinion. The auditor could not perform enough work to form any opinion at all, usually because access to records or personnel was severely restricted.

Anything other than an unmodified opinion is a serious red flag. Bond rating agencies, state oversight bodies, and federal grantor agencies all watch the opinion closely, and a qualified or adverse result can directly raise a municipality’s borrowing costs and jeopardize grant eligibility.

Findings and Corrective Action Plans

The report often includes findings that describe specific problems with internal controls or compliance. In a single audit, findings are formally reported in the Schedule of Findings and Questioned Costs, which must identify significant deficiencies, material weaknesses, noncompliance with federal program requirements, and questioned costs over $25,000 per compliance area.7eCFR. 2 CFR 200.516 – Audit Findings

When findings appear, the municipality has to respond. Federal regulations require the auditee to prepare a corrective action plan addressing each one. The plan must name the person responsible, describe the corrective steps, and set an anticipated completion date.8eCFR. 2 CFR 200.511 – Audit Findings Follow-Up If the municipality disagrees with a finding, the plan must explain why. This requirement gives findings real weight. They are not observations to be filed away but documented problems that demand a formal, trackable fix.

Where to Find a Municipality’s Audit

Municipal audit reports are public records, and in most cases you do not need to file a records request to see one.

Most cities and counties post the ACFR on their website, usually under the finance department or city clerk page. State auditors’ offices also maintain online repositories where local government audit reports are centrally filed and searchable.

For municipalities that have issued bonds, there is an additional disclosure layer. The Electronic Municipal Market Access system, known as EMMA, is the SEC-designated official source for municipal securities disclosure documents.9Municipal Securities Rulemaking Board. Continuing Disclosure Under SEC Rule 15c2-12, bond issuers generally agree to provide ongoing financial disclosures to the Municipal Securities Rulemaking Board, which publishes them on EMMA for free public access.

Single audit reports go to a separate federal repository. The Federal Audit Clearinghouse, at fac.gov, collects all single audit reporting packages and makes them publicly searchable.10Federal Audit Clearinghouse. The Federal Audit Clearinghouse The completed audit must be submitted within 30 days of receiving the auditor’s report or nine months after the fiscal year ends, whichever comes first.11eCFR. 2 CFR 200.512 – Report Submission Between the municipality’s own website, the state repository, EMMA, and the Federal Audit Clearinghouse, most residents have several ways to pull the audit and read it for themselves.