What Is GAGAS and Who Must Follow It: Engagements, Ethics, and Penalties

GAGAS stands for Generally Accepted Government Auditing Standards, the rulebook the U.S. Government Accountability Office issues for audits of government organizations and federally funded programs. It is more commonly called the Yellow Book. The standards cover auditor ethics, independence, qualifications, fieldwork, quality management, and reporting, and the most recent 2024 revision takes effect for engagements beginning on or after December 15, 2025.¹

Who Has to Follow GAGAS

GAGAS applies to federal agencies, state and local governments, and nonprofit organizations that receive federal financial assistance. For most non-federal entities, the trigger is the Single Audit Act, codified at 31 U.S.C. §§ 7501–7507, which sets specific audit procedures for recipients of federal funds.²

The dollar threshold sits in the OMB Uniform Guidance. Any non-federal entity that spends $1,000,000 or more in federal awards during a fiscal year must undergo a single audit or program-specific audit conducted under GAGAS.³ The 2024 Uniform Guidance revision raised that floor from $750,000, so fewer small organizations now face the full requirement. The rule applies whether the money comes directly from a federal agency or through a pass-through entity such as a state government.

If your organization spends less than $1 million in federal awards in a fiscal year, it is exempt from the federal audit mandate. Federal agencies and the GAO can still review its records.

The Three Types of Engagements GAGAS Covers

The Yellow Book covers three broad categories of work, and the specific standards that apply depend on which one you are doing.⁴

Financial audits assess whether an entity’s financial statements are presented fairly under recognized accounting standards. The auditor also reports on internal controls over financial reporting and on compliance with laws and grant agreements that could materially affect the statements.⁵

Attestation engagements come in two levels of assurance. An examination provides the same level of confidence as a financial audit. A review provides limited assurance based on less extensive procedures.⁶

Performance audits evaluate whether a program is achieving its goals, operating efficiently, or complying with applicable laws. They focus on program effectiveness and operational results rather than financial statement accuracy.⁵ A performance audit might examine whether a federal jobs program actually placed people in jobs, or whether a grant-funded construction project came in on budget.

Independence and Ethics

Integrity and objectivity sit at the core of every GAGAS engagement. Auditors must prioritize the public interest and avoid conduct that could undermine confidence in their work.⁷

Independence is the standard that draws the most scrutiny. GAGAS requires independence both in fact and in appearance, meaning the auditor must actually be free of conflicts and must also be perceived as unbiased by a reasonable outside observer. The standards use a conceptual framework that requires auditors to identify and evaluate specific categories of threats:

Self-interest: a financial stake or personal interest that could influence judgment.
Self-review: the risk that an auditor will not objectively evaluate work their own organization previously performed.
Bias: political, ideological, or social convictions that could compromise objectivity.
Familiarity: a close or longstanding relationship with the people being audited.
Undue influence: external pressure that affects objectivity.
Management participation: taking on a management role at the entity being audited.
Structural: the audit organization’s placement within a government entity it is supposed to audit.

When a threat is identified, the auditor must eliminate it or apply safeguards to reduce it to an acceptable level. If neither is possible, the auditor cannot perform the engagement.⁸

Some activities are prohibited outright because no safeguard can fix the threat they create. The 2024 Yellow Book lists specific management responsibilities auditors cannot take on, including setting the entity’s strategic direction, having custody of its assets, designing or maintaining its internal controls, and serving as a voting member of its governing board. On the accounting side, auditors cannot change journal entries or approve transactions without management sign-off, and they cannot accept responsibility for preparing the financial statements they are about to audit.⁵

Qualifications and Continuing Education

Every member of the audit team must bring the technical knowledge the engagement requires. GAGAS does not demand that every individual be an expert in every area, but the team as a whole must have the collective competence to complete the work. Audit organizations routinely bring in specialists for complex areas such as information technology or actuarial analysis.

Continuing education is mandatory. Auditors must complete 80 hours of continuing professional education every two years, with at least 24 of those hours directly related to government auditing, the government environment, or both.⁴ Falling short can disqualify an auditor from leading or participating in GAGAS engagements. The government-specific 24-hour requirement matters because a CPA who spends most of their time on private-sector work will not naturally stay current on federal compliance requirements.

Quality Management and Peer Review

One of the most significant changes in the 2024 Yellow Book is the shift from quality control to quality management. The old approach was a set of policies and procedures the audit organization had to maintain. The new framework is risk-based: organizations must identify quality risks and design responses tailored to their circumstances.¹

Under the 2024 standards, audit organizations must establish quality objectives, assess the risks that could prevent them from meeting those objectives, and design responses to address the risks. The system must be designed and implemented by December 15, 2025, and the organization must complete its evaluation of the system by December 15, 2026.⁶ The approach is scalable. A small two-person shop does not need the same infrastructure as a large Inspector General’s office, but both must actively manage their quality risks.

Every audit organization must also undergo an external peer review at least once every three years. An independent review team examines the organization’s quality management system and a sample of completed engagements to determine whether the work meets GAGAS requirements.⁴ The review produces one of three ratings:

Pass: the system is suitably designed and provides reasonable assurance of compliance with applicable standards.
Pass with deficiencies: the system is generally sound but has one or more deficiencies that need correction, which the report describes.
Fail: the system has significant deficiencies that prevent it from providing reasonable assurance of compliance. An organization that receives a fail rating cannot credibly claim its work meets GAGAS.

A passing peer review is a prerequisite for conducting Yellow Book audits.⁹

What Audit Findings Can Cost You

GAGAS findings can trigger real financial consequences. Under the Uniform Guidance, auditors must report questioned costs whenever known or likely noncompliant spending exceeds $25,000 for a major program.¹⁰ Questioned costs include expenditures that violate federal rules, lack adequate documentation, or appear unreasonable. The federal awarding agency reviews these findings and can demand repayment.

Entities with serious or repeated compliance failures also risk suspension or debarment from future federal awards. Under the government-wide debarment rules at 2 CFR Part 180, a federal agency can bar an entity from receiving federal funds for causes that include willful failure to perform under a public agreement, a history of unsatisfactory performance, or failure to pay disallowed costs owed to the federal government.¹¹ For organizations that depend on federal funding, debarment is existential.

Even findings that do not lead to repayment or debarment create obligations. Audited entities must prepare a corrective action plan addressing each finding and track their progress in resolving prior-year findings. Federal agencies and pass-through entities use these plans to decide whether an organization can be trusted with continued funding. Ignoring findings or misrepresenting the status of prior issues is itself a reportable finding in the next audit cycle.¹⁰

1
U.S. GAO. Government Auditing Standards 2024 Revision
2
Office of the Law Revision Counsel. 31 USC Ch. 75 – Requirements for Single Audits
3
eCFR. 2 CFR 200.501 – Audit Requirements
4
U.S. GAO. Yellow Book: Government Auditing Standards
5
U.S. GAO. Government Auditing Standards 2024 Revision
6
U.S. GAO. Government Auditing Standards 2024 Revision
7
U.S. GAO. Updating Government Auditing Standards – The 2024 Yellow Book
8
U.S. GAO. Government Auditing Standards 2018 Revision
9
U.S. GAO. Guidance for Understanding the New Peer Review Ratings
10
eCFR. 2 CFR 200.516 – Audit Findings
11
eCFR. 2 CFR Part 180 – OMB Guidelines to Agencies on Governmentwide Debarment and Suspension