Compliance Supplement Part 3: How the Audit Objectives and Suggested Procedures Work

Part 3 of the Compliance Supplement has a repeating shape. Each compliance requirement type opens with a description, names the source of the governing requirements, lists audit objectives, and gives suggested procedures for internal control and for compliance. Once a staff member learns the shape, the 2025 Part 3 reads quickly. The 2025 Supplement is effective for audits of fiscal years beginning after June 30, 2024, and as of November 6, 2026 it is the latest edition OMB's Compliance Supplement page lists; a 2026 edition had not been posted. This guide explains the shape, shows how the procedures connect to the Uniform Guidance, and offers a way to document a major program test that a reviewer can follow.

The five-part pattern

Take Activities Allowed or Unallowed, section A of Part 3.1. It has these blocks:

1. Compliance requirements. What the requirement is. For activities allowed or unallowed, the Supplement says the specific requirements are unique to each program and sit in federal statutes, regulations and the terms and conditions of the award. For programs listed in the Supplement, the specific requirements are in Part 4 or Part 5.
2. Source of governing requirements. Program legislation, federal awarding agency regulations and award terms.
3. Audit objectives.
4. Suggested audit procedures for internal control.
5. Suggested audit procedures for compliance.

The same skeleton recurs in the section for eligibility, period of performance and the others.

Objective one is always internal control

The first audit objective in each requirement is the same: obtain an understanding of internal control, assess risk, and test internal control as required by 2 CFR 200.514(c). The compliance objectives follow. For activities allowed or unallowed, the second objective is to determine whether federal awards were expended only for allowable activities. For eligibility, there are three: whether required eligibility determinations were made, with any required documentation or verification, and only eligible participants or groups took part; whether subawards went only to eligible subrecipients; and whether amounts provided to or for participants were calculated according to program requirements.

The internal control procedures

The suggested internal control procedures read the same across the sections the Supplement states them for:

1. Perform procedures to understand internal control sufficiently to plan the audit to support a low assessed level of control risk for the program.
2. Plan the testing of internal control over compliance to support a low assessed level of control risk for that requirement, and perform it as planned. If controls over some or all of the compliance requirements are likely to be ineffective, use the alternative procedures in 2 CFR 200.514(c)(4): report a significant deficiency or material weakness under 2 CFR 200.516, assess control risk at the maximum, and consider whether additional compliance tests and reporting are needed because of ineffective control.
3. Consider the results of the control testing in assessing the remaining risk of noncompliance, and use that as the basis for the nature, timing and extent of substantive compliance tests, such as the number of transactions to select.

The second step is the decision point. A team that cannot support a low assessed level of control risk does not stop. It moves to the maximum control risk and expands compliance testing, and it may report a deficiency. Document which path was taken for each requirement of each major program.

The compliance procedures differ by requirement

The compliance procedures are where the content changes.

Activities allowed or unallowed (A). Identify the activities that the statutes, regulations and award terms specifically allow or prohibit. When allowability is determined on summary-level data, verify that the activities were allowable and that individual transactions were properly classified and accumulated into the activity total. When it is determined on individual transactions, sample the transactions and verify each was for an allowable activity. The auditor should be alert for large transfers of funds out of program accounts, which may have been used to fund unallowable activities.

Eligibility (E). Where a large number of people receive benefits, the entity often runs a computer system, separate from its accounting system, to determine eligibility and deliver benefits. The Supplement lists the typical functions of such a system: calculating who is eligible and how much, paying benefits, maintaining eligibility records, tracking the period of eligibility, matching to other databases to verify eligibility, controlling who can approve benefits and producing exception reports. Each function is a control or a source of evidence, and the auditor tests the system as part of the work, not only the transactions it produced.

Period of performance (H). Review the award documents for date requirements. Test costs recorded at the beginning of the period for charges before the start date unless authorized, test costs recorded late in and after the period for charges outside it, and test liquidation of obligations against the 120-day limit for a recipient or the 90-day limit for a subrecipient.

Special tests and provisions (N). The internal control block is generic, with the program-specific objectives in Parts 4 and 5. For a program that is not in the Supplement, the auditor develops the objectives and procedures from the award documents.

Part 3.1 and Part 3.2

The 2025 Part 3 is two parts. Part 3.1 applies to awards under the Uniform Guidance in effect before October 1, 2024, and carries a warning that its citations are to that earlier version, so the section numbers may not match the current version in the electronic CFR. Part 3.2 applies to awards under the 2024 revisions. The Supplement directs auditors to use Part 3.2 for new awards made as of October 1, 2024 where the agency implemented the 2024 revisions and for existing awards to which the revisions were expressly applied, and Part 3.1 for existing awards where the agency had not yet implemented them. Auditors must not apply 2024 requirements to an award the agency has not brought under the revisions. The work paper for each major program should say which part governs each award and why, with the award terms as evidence.

A documentation template

For each major program and each applicable requirement:

Worked example: eligibility

Delmar Community Services administers a program that serves households. Its case system calculates eligibility and writes payments.

1. Control understanding. The auditor documents the system functions listed in the Supplement and identifies the approval control that stops an eligibility record from being released without a supervisor's sign-on.
2. Control test. The auditor tests 25 case files for supervisor approval before payment. Two lack approval evidence, which is 8 percent. The auditor concludes control cannot be supported at a low assessed level.
3. Consequence. Under the 200.514(c)(4) path, the auditor assesses control risk at the maximum, increases the compliance sample from 40 to 60 case files and evaluates whether the control exceptions are a significant deficiency.
4. Compliance test. For each selected case, the auditor re-performs the eligibility determination from the source documents and recalculates the amount.
5. Conclusion. Any payment to an ineligible household is a questioned cost, and the exceptions go to the finding.

Where the work goes wrong

• Testing transactions without documenting the control path.
• Using Part 3.1 steps on an award governed by the 2024 revisions.
• Treating Part 4 as optional reading when it names the special tests.
• Leaving the "why" of the sample size out of the file.

Related reading

See the twelve types of compliance requirements, the OMB Compliance Supplement standards page, major program determination and AU-C 935.

Where CORAA fits

CORAA prepares ready-to-review audit files for US CPA firms, including major program test matrices built to the Part 3 pattern. The firm keeps the client, the review and the signature. See /us.

Sources

• OMB, Compliance Supplement 2025, Part 3, Compliance Requirements: https://www.whitehouse.gov/wp-content/uploads/2025/05/Part-3-Compliance-Requirements.pdf
• OMB, Compliance Supplement 2025, Part 1, Background, Purpose, and Applicability: https://www.whitehouse.gov/wp-content/uploads/2025/05/Part-1-Background-Purpose-and-Applicability.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error