What Is a Yellow Book Audit and When Is One Required?

A Yellow Book audit is an engagement performed under the Government Accountability Office’s Government Auditing Standards (GAGAS), the rulebook that governs how audits of public funds are conducted.¹ The name comes from the color of the publication’s cover. These standards apply to federal, state, and local government entities, and they also reach private nonprofits, universities, and other organizations once they accept federal money. The most common trigger for a non-governmental entity is spending $1,000,000 or more in federal awards during a single fiscal year, which pulls the organization into the Single Audit requirement.²

What Makes It Different From a Regular Audit

A standard private-sector audit follows the American Institute of CPAs’ auditing standards and asks a single question: are the financial statements fairly presented? A Yellow Book audit incorporates those AICPA standards and then adds requirements on top.³ The additions show up in three places.

Scope widens. On top of the financial statement question, the auditor tests whether the entity complied with the laws, regulations, contracts, and grant agreements that govern how it spent public money. Internal controls over financial reporting are evaluated and reported on separately, not just considered as part of planning the audit.

Independence tightens. GAGAS uses a conceptual framework that forces auditors to identify threats to their objectivity and apply safeguards, with some services simply off-limits. An auditor cannot design the entity’s financial information system, operate its financial IT systems, or supervise its ongoing internal control monitoring and then audit the same entity.³

Reporting expands. Instead of a single opinion letter, the auditor issues a package: an opinion on the financial statements, a separate report on internal controls over financial reporting, and a separate report on compliance.

When a Yellow Book Audit Is Required

Federal agencies, state departments, counties, and municipalities are subject to GAGAS as a matter of course because they spend public funds directly.¹

For everyone else, the question usually comes down to how much federal money changed hands. Any non-federal entity that spends $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit conducted in accordance with the Yellow Book.² That threshold was $750,000 until an April 2024 revision of the Uniform Guidance raised it to $1,000,000 for audit periods beginning on or after October 1, 2024.⁴ Spend less than that and you are exempt from the federal audit requirement for that year, though federal agencies and the GAO retain the right to review your records.

Individual grant agreements can impose a GAGAS audit requirement independently of the dollar threshold, so the grant terms are worth reading before relying on the $1,000,000 line alone.

The Three Types of GAGAS Engagements

Not every Yellow Book engagement is a financial audit. GAGAS covers three distinct engagement types, each answering a different question.¹

Financial Audits

A financial audit asks whether the financial statements are presented fairly under the applicable accounting framework. Under GAGAS, the auditor also reports on internal controls over financial reporting and tests compliance with laws, regulations, and grant agreements that could materially affect those statements.³ This is the engagement type most organizations mean when they say they need a Yellow Book audit.

Attestation Engagements

Attestation engagements provide assurance on a specific assertion. A state agency might assert that it distributed 95% of disaster relief funds within 60 days, and the auditor examines, reviews, or performs agreed-upon procedures on the evidence supporting that claim. The level of assurance ranges from an examination (high) to a review (moderate) to agreed-upon procedures that simply report factual findings.³

Performance Audits

Performance audits ask whether a program is working. Is a public works project cost-effective? Are benefits reaching the intended recipients on time? The auditor evaluates program effectiveness, economy, and efficiency, then provides recommendations. Legislators and agency leaders use these audits to decide whether a program deserves continued funding.

What the Auditor Delivers

A Yellow Book financial audit produces a package of reports, each serving a different audience.

The internal control report describes the auditor’s understanding of controls over financial reporting and the results of testing them. Any significant deficiencies or material weaknesses are identified in writing to management and those charged with governance. A significant deficiency is a control problem serious enough to merit attention but not quite severe enough to be a material weakness. Reporting at this lower threshold is one of the ways GAGAS catches problems earlier than a standard audit would.

The compliance report covers whether the entity followed the laws, regulations, contracts, and grant agreements that could materially affect its financial statements. Instances of noncompliance are detailed in the report and communicated to the governing body and, where applicable, the funding agency. For grant recipients this is where the stakes are highest, because a finding of noncompliance can lead to corrective action requirements or loss of future funding.

Audit findings themselves follow a structured format built on four elements: criteria, condition, cause, and effect.³ Criteria is what the entity should have done. Condition is what the auditor found. Cause is why the gap exists. Effect is the real-world consequence, such as overpayments or missed program goals. Not every finding requires all four, and the auditor develops the elements that fit the audit’s objectives.

Submission Deadlines for Single Audits

Organizations subject to a Single Audit face a firm filing deadline. The completed audit, data collection form, and full reporting package must be submitted to the Federal Audit Clearinghouse within 30 calendar days after receiving the auditor’s report, or nine months after the end of the audit period, whichever comes first.⁵ A deadline falling on a weekend or federal holiday shifts to the next business day. The cognizant or oversight agency for audit can grant an extension if the nine-month timeframe creates an undue burden, but the entity has to request one and demonstrate the need. Extensions are not automatic.

What Happens If You Skip or Miss the Audit

Federal agencies monitor submission status, and the Uniform Guidance gives them a range of enforcement tools when a required audit is late, missing, or produces unresolved findings:⁶

Temporarily withholding payments until the entity takes corrective action.
Disallowing costs, meaning the entity must repay funds associated with the noncompliant activity.
Suspending or terminating the award, in part or in full.
Initiating debarment proceedings to bar the entity from future federal awards.
Denying new awards or continuation funding for the program.

These remedies apply after the agency determines that imposing specific conditions on the award was not enough to fix the problem. In practice, agencies typically start with corrective action plans and escalate from there.

The 2024 Revision and When It Takes Effect

The GAO released a major revision of Government Auditing Standards in 2024, superseding the 2018 edition. The 2024 revision takes effect for financial audits, attestation engagements, and performance audits with periods beginning on or after December 15, 2025. Early adoption is permitted.⁷

Two changes matter most for audited entities. The independence rules now explicitly address IT services: designing an audited entity’s financial information system, making significant modifications to its source code, or operating its network or financial systems impairs independence when those systems play a significant role in the area being audited.³ If your current auditor also provides these services, that relationship needs to be re-examined before the new standards apply. The revision also replaces the old “quality control” framework with a “quality management” model that requires audit firms to run risk assessments and have leadership actively manage engagement quality, with systems designed and implemented by December 15, 2025, and the first evaluation completed by December 15, 2026.

Auditor continuing education requirements are unchanged: 80 hours every two years, with at least 24 hours in government-specific topics and a minimum of 20 hours in each individual year.³ If you are hiring a firm, confirm that the audit team meets these thresholds and that the firm has a current passing peer review on file, since GAGAS requires an external peer review at least once every three years.⁸

1
U.S. Government Accountability Office. Government Auditing Standards
2
eCFR. 2 CFR 200.501 – Audit Requirements
3
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision
4
Office of Inspector General, U.S. Department of Health and Human Services. Single Audits FAQs
5
eCFR. 2 CFR 200.512 – Report Submission
6
eCFR. 2 CFR 200.339 – Remedies for Noncompliance
7
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision
8
U.S. Government Accountability Office. Peer Review Reports