Nonprofit organizations are audited by four independent parties, each looking at a different piece of the operation: an outside certified public accountant firm that examines the financial statements, the Internal Revenue Service that reviews tax-exempt compliance through the annual Form 990, the state attorney general or charities bureau that protects charitable assets and honest fundraising, and — for organizations that spend $1,000,000 or more in federal grant money in a year — a CPA firm performing a federal Single Audit. Together they form a layered accountability structure that helps ensure donated funds reach their intended purpose.
Independent CPA Firms
The most familiar nonprofit audit is a financial statement audit performed by an outside CPA. The auditor examines the books, checks bank reconciliations, reviews expense records, tests whether revenue was recorded properly, and then issues a formal opinion on whether the financial statements present a fair picture of the organization’s finances. That opinion follows Generally Accepted Auditing Standards and tells donors, grantors, and lenders how much confidence to place in the reported numbers.1University of Mississippi eGrove. Audit Risk and Materiality in Conducting an Audit – Statement on Auditing Standards 047
Independence is the point. The CPA who audits the organization cannot also keep its books, authorize its transactions, or make management decisions for it. Those rules keep the auditor from reviewing their own work. If the firm provides a non-audit service such as payroll processing to a nonprofit it also audits, the organization’s own management must take full responsibility for overseeing that service and accepting the results, or the firm’s independence is compromised and the audit opinion loses its value.
CPA firms that perform audits face their own quality checks. Almost every firm doing accounting or auditing work goes through a peer review every three years, in which another firm evaluates its audit processes. Firms that fail and cannot fix the problems can lose their license to practice.
Audit, Review, or Compilation
Not every nonprofit needs, or can afford, a full audit. CPAs offer three tiers of service, and it’s worth knowing which one an organization is actually receiving before calling it “audited.”
- An audit is the highest level of assurance. The CPA independently verifies financial information, tests individual transactions, examines internal controls, and issues a formal opinion on whether the statements are fairly presented. Many states and grantors require this once revenue passes a certain threshold.
- A review provides limited assurance. The CPA analyzes the statements and looks for obvious departures from generally accepted accounting principles, but does not test individual transactions or examine internal controls. The final report notes whether the CPA found any issues requiring changes; it does not include an opinion on the statements as a whole. Reviews cost less than audits and can be a useful step for newer or smaller organizations preparing for a first full audit.
- A compilation provides no assurance. The CPA reformats the organization’s records into standard financial statement format and checks for obvious errors, but does not verify balances, test accuracy, or examine controls. It’s the least expensive option and may fit very small organizations with simple finances.
State law, grant agreements, and the organization’s own bylaws often dictate which level applies. When none of them requires a full audit, a review can still give the board and donors some independent oversight of the finances at a lower cost.
The Internal Revenue Service
The IRS monitors tax-exempt organizations primarily through their annual information returns. Under Internal Revenue Code Section 6033, most organizations exempt under Section 501(a) must file an annual return reporting income, expenses, and activities.2Office of the Law Revision Counsel. 26 U.S.C. 6033 – Returns by Exempt Organizations Which version of Form 990 applies depends on size:
- Form 990-N (the e-Postcard) is available to organizations with gross receipts normally $50,000 or less. It’s a brief electronic notice with basic identifying information.3Internal Revenue Service. Annual Electronic Filing Requirement for Small Exempt Organizations – Form 990-N (e-Postcard)
- Form 990-EZ is available to organizations with gross receipts under $200,000 and total assets under $500,000.4Internal Revenue Service. 2025 Instructions for Form 990-EZ
- The full Form 990 is required for organizations that exceed those thresholds — gross receipts of $200,000 or more, or total assets of $500,000 or more.4Internal Revenue Service. 2025 Instructions for Form 990-EZ
Field Examinations and Intermediate Sanctions
When the IRS identifies red flags in a filing, such as insiders receiving above-market compensation or the organization engaging in political campaign activity, it can open a field examination. A 501(c)(3) organization faces an absolute prohibition on participating or intervening in any political campaign for or against a candidate for public office, and a violation can result in revocation of tax-exempt status and excise taxes.5Internal Revenue Service. Restriction of Political Campaign Intervention by Section 501(c)(3) Tax-Exempt Organizations
When an insider receives an excessive financial benefit, such as inflated compensation or a below-market deal on property, the IRS can impose intermediate sanctions instead of, or in addition to, revoking exempt status. The person who received the excess benefit owes an excise tax of 25 percent of that benefit. If they fail to return the excess amount within the allowed timeframe, a second-tier tax of 200 percent applies. Any organization manager who knowingly approved the transaction owes a separate tax of 10 percent of the excess benefit.6Office of the Law Revision Counsel. 26 U.S. Code 4958 – Taxes on Excess Benefit Transactions
Automatic Revocation for Failure to File
The most preventable IRS consequence is automatic revocation. If an organization fails to file its required Form 990, 990-EZ, or 990-N for three consecutive years, its tax-exempt status is automatically revoked by law. There is no warning letter and no discretion to waive the revocation.7Internal Revenue Service. Automatic Revocation of Exemption for Non-Filing – Frequently Asked Questions
Once revoked, the organization becomes a taxable entity and owes income tax on its revenue. Reinstatement requires a new exemption application (Form 1023 for 501(c)(3) organizations) and payment of the associated user fee. Organizations that act within 15 months of the revocation notice and meet certain conditions may qualify for retroactive reinstatement, restoring their exempt status back to the revocation date. Those that wait longer face a gap during which donations were not tax-deductible and the organization owed income tax.8Internal Revenue Service. Automatic Revocation – How to Have Your Tax-Exempt Status Reinstated
Public Disclosure
Federal law also requires nonprofits to make their Form 990 returns available for public inspection. Any person can request a copy at the organization’s principal office during regular business hours, and regional offices with three or more employees must also honor inspection requests. The organization may charge a reasonable fee for reproduction and mailing but cannot otherwise restrict access.9Office of the Law Revision Counsel. 26 U.S.C. 6104 – Publicity of Information Required From Certain Exempt Organizations and Certain Trusts The inspection obligation covers the three most recent annual returns; the original exemption application and its supporting materials remain open to public inspection permanently. A responsible person who fails to provide these documents faces a penalty of $20 per day for as long as the failure continues, up to $10,000 for each annual return, with no cap on the penalty for failing to provide the exemption application.10Internal Revenue Service. Penalties for Noncompliance
State Attorneys General and Charities Bureaus
At the state level, the attorney general or a dedicated charities bureau is the primary regulator of nonprofits. These offices focus on preventing the misuse of charitable assets and ensuring that fundraising practices are honest.11National Association of Attorneys General. Charities Regulation 101 Most states require nonprofits that solicit donations to register before fundraising begins and to file annual financial reports afterward.
Registration thresholds, required financial disclosures, and fees vary widely by state. Some states require a full independent audit once revenue passes a set level; others accept a review or compilation for smaller organizations. Annual charitable registration fees also range widely by jurisdiction and organization size. A nonprofit that solicits in multiple states may need to register in each one, which can create a significant administrative burden.
State regulators have broad enforcement tools. When they suspect mismanagement or deceptive fundraising, they can launch investigations and demand financial records. Failure to comply with registration and reporting rules can bring daily fines. In the most serious cases, such as outright fraud or persistent misuse of charitable assets, the attorney general can seek court orders to remove board members or dissolve the organization entirely to protect any remaining funds.11National Association of Attorneys General. Charities Regulation 101
Federal Single Audits for Grant Recipients
Nonprofits that spend $1,000,000 or more in federal award money during a single fiscal year must undergo a Single Audit under 2 C.F.R. Part 200, Subpart F.12eCFR. 2 CFR 200.501 – Audit Requirements The threshold was raised from $750,000 for fiscal years starting on or after October 1, 2024, so many organizations that previously triggered the requirement may now be exempt.13Federal Audit Clearinghouse. Submission Guide – About This Guide and the Federal Audit Clearinghouse Organizations below the threshold are exempt from the federal audit mandate but must still keep grant-related records available for review.14National Institutes of Health. Audit Requirements
A Single Audit goes beyond a standard financial statement audit. In addition to reviewing overall finances, the CPA firm tests whether the nonprofit complied with the specific terms and conditions attached to each federal award, including rules on how grant money can be spent, procurement requirements, and reporting obligations. Results are submitted to the Federal Audit Clearinghouse, where they are available to all federal agencies that awarded funds to the organization.
Problems found during a Single Audit can trigger repayment of improperly spent funds, suspension from future federal grants, or referral for investigation. Organized records kept throughout the grant period, rather than pulled together at audit time, are the most effective protection.
The Board’s Internal Oversight Role
The board of directors is not an outside auditor, but it sits at the top of the accountability structure and hires the ones who are. Directors have a fiduciary duty to manage the nonprofit’s assets with care and loyalty, which includes making sure financial reporting is accurate, risks are monitored, and operations comply with the law. Larger nonprofits assign these tasks to a dedicated audit committee of independent board members; smaller organizations handle them through the full board.
The audit committee selects and manages the relationship with the external CPA firm, reviews the auditor’s findings, and monitors whether management follows the organization’s internal financial policies. It also receives reports directly from the auditor rather than through staff, which helps surface problems management might otherwise downplay. On the governance side, the IRS asks every organization filing Form 990 whether it has adopted a written conflict of interest policy, and the policy must be in place by the end of the tax year to answer “yes.”15IRS.gov. Form 990 Part VI – Governance, Management, and Disclosure Frequently Asked Questions The IRS does not technically require the policy, but answering “no” draws scrutiny and signals weak governance to donors and grantors reviewing the publicly available return.
Preparing for an Audit
Whichever type of audit applies, preparation makes the process faster and cheaper. Start with a pre-audit meeting with the CPA firm to set a timeline, clarify which documents the auditors will need, and confirm the preferred file format. Many firms provide an audit preparation checklist, sometimes called a “prepared by client” list, that spells out the specific records to gather.
Auditors typically request a comparative trial balance, year-end bank statements and reconciliations, and aging schedules for receivables and payables; board meeting minutes, a list of current board members, and any new or updated policies; quarterly payroll tax reports, accrued leave schedules, and IRS correspondence; grant award letters, quarterly reports, drawdown records, and a schedule showing each grant’s period, funding amount, and expenditures; and copies of leases, loan agreements, and a memo describing any outstanding legal issues along with contact information for the organization’s attorneys.
Keeping these records organized throughout the year, rather than scrambling at audit time, reduces auditor hours and keeps costs down. Placing everything in a single electronic folder that mirrors the auditor’s checklist is one of the simplest ways to keep the process moving.