A college that takes federal student aid has two audit obligations that sound alike and are not the same. One is a compliance audit of its Title IV transactions. The other is an audit of its financial statements. Both flow from one regulation, 34 CFR 668.23, and the auditor's engagement letter should name each. This guide covers what the regulation requires, the dates that matter and the points in the file where aid audits go wrong.
Who is the auditor
Section 668.23(a)(1) defines an independent auditor as an independent certified public accountant or a government auditor, and requires a government auditor to meet the Government Auditing Standards qualification and independence standards. For a CPA firm, the same standards reach the engagement through 668.23(b)(2) and (d)(1), which require the compliance audit and the financial statement audit to follow Government Auditing Standards. The firm needs to meet the Yellow Book competence and independence rules, not only AICPA rules. See GAGAS 2024 independence.
Two audits each year
Under 668.23(a)(2), an institution must at least annually have an independent auditor conduct a compliance audit, and it must also have an audit of its general purpose financial statements. The compliance audit covers, on a fiscal year basis, all Title IV program transactions since the period covered by the prior compliance audit (668.23(b)(1)). It follows Government Auditing Standards and the procedures in the audit guides of the Department of Education's Office of Inspector General (668.23(b)(2)).
The Department treats an audit performed under 2 CFR part 200 or the Inspector General's audit guides, whichever applies to the entity, as meeting the submission requirements, so long as the audit covers the federal student aid functions the entity performs (668.23(a)(5)). A public or private nonprofit institution with a Single Audit can therefore meet the compliance audit requirement through it if the Title IV functions are in scope. The scoping decision belongs in the planning memo.
The deadline
Except as provided by the Single Audit Act, 668.23(a)(4) requires the institution to submit its compliance audit and audited financial statements annually by the earlier of two dates: 30 days after the later of the date of the auditor's report for the compliance audit and the date of the auditor's report for the audited financial statements, or six months after the last day of the institution's fiscal year. Where the two reports carry different dates, the later one starts the 30 days.
For an institution outside the Single Audit Act exception, build the timetable from the six-month date. A June 30 fiscal year gives a December 31 outer date.
Third-party servicers
A servicer follows the audit guides of the Department's Office of Inspector General (668.23(a)(3)). A servicer that works for only one institution may skip its own compliance audit if the institution's audit covers every aspect of the servicer's administration for that institution (668.23(c)(1)). A servicer with several institutions may submit one report covering all of them (668.23(c)(2)), and it submits its compliance audit annually no later than six months after its fiscal year-end (668.23(c)(3)).
Audited financial statements
Section 668.23(d)(1) requires acceptable financial statements when the Department requests them. The requirements include:
- A fiscal year-end that matches the entity's IRS annual return, for fiscal years beginning on or after July 1, 2024.
- Accrual-basis GAAP statements audited under Government Auditing Standards and either 2 CFR part 200 or the Inspector General's audit guides.
- A detailed description of related entities under ASC 850, with broader disclosure than ASC 850 itself requires.
- If there are no related party transactions or balances, a note from management saying so.
Under 668.23(d)(2), the Department may require audited consolidated, combined or related party statements of entities that can significantly influence or control the institution, and an institution with at least 50 percent foreign ownership must document the owning entity's legal status, with English translations.
The 90/10 footnote
For a proprietary institution, 668.23(d)(3) requires the audited statements to disclose in a footnote the percentage of revenues derived from federal funds. The footnote also reports the dollar amounts of the numerator and denominator of the 90/10 ratio, and the revenue amounts listed in appendix C to the regulation. The footnote is part of the audited statements, and its revenue categories come from the regulation, not from the institution's chart of accounts.
Records access and consequences
Institutions and servicers must give the Secretary and the Inspector General access to records needed to review the audit, and must require their auditors to give access to records and workpapers (668.23(e)(1)). The firm's workpapers are therefore reachable by the Department. The engagement letter should say so.
On the findings, the Secretary determines the amount of liability, if any, based on the audit findings and the institution's response (668.23(f)(1)). Repayment is due within 45 days of the Secretary's notice unless the institution appeals or the Secretary allows more time (668.23(g)(1)). Where liabilities are upheld on appeal, repayment is due within 30 days of the final decision unless the Secretary permits a longer period (668.23(g)(3)). A finding in the compliance report is therefore a potential cash liability, not only a reporting matter.
Worked example: the 90/10 footnote
Pinecrest Career Institute, a proprietary school, has a fiscal year ended June 30, 2025. In the audit the following arise.
- Deadline. The compliance report is dated November 10, 2025 and the financial statement report November 17, 2025. The later date plus 30 days is Wednesday, December 17, 2025. Six months after June 30, 2025 is December 31, 2025. The earlier date, December 17, 2025, governs.
- Footnote. Management drafts the 90/10 footnote with federal revenue of $7.2 million over total qualifying revenue of $8.4 million, or 85.7 percent. The auditor traces the numerator and denominator to the appendix C categories and to the general ledger, and finds that the denominator in the draft footnote exceeds the ledger revenue population by $310,000. Management recomputes from the regulation's categories, and the auditor re-tests the revised footnote.
- Related parties. The school leases its campus from an entity owned by its majority shareholder. The auditor checks that the ASC 850 note describes the related entity in detail, as 668.23(d)(1) requires, and that the lease balances agree to the lessor's statements.
- Records access. The engagement letter records that the Department and the Inspector General may access the workpapers.
Procedures to build into the file
- Confirm scope: which Title IV programs the institution participates in and what the OIG guide procedures require for each.
- Obtain the institution's fiscal year and compare it with the IRS return year-end.
- Test the footnote numerators and denominators to the appendix C categories.
- Read the related party note against the ownership chart and the ASC 850 description. See ASC 850 related party disclosures.
- Calendar the six-month date and the 30-day trigger from the later report.
- Record access to workpapers in the engagement letter.
Related reading
For the broader higher education audit, including revenue recognition and the 90/10 test, see higher education audit guide: tuition discounts and Title IV. For the Single Audit side, see Single Audit walkthrough. For the Yellow Book reporting that accompanies the compliance report, see GAGAS reports on internal control and compliance.
Where CORAA fits
CORAA prepares ready-to-review audit files for US CPA firms, including aid reconciliations and footnote tie-outs. The firm keeps the client, the review and the signature. See /us.
Sources
- Legal Information Institute, 34 CFR 668.23, Compliance audits and audited financial statements: https://www.law.cornell.edu/cfr/text/34/668.23
Part of CORAA University · Government, single audit and nonprofits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error