Financial Audit vs Single Audit vs Yellow Book Audit: What Each Requires

These three terms describe nested engagements, not three separate products. A single audit contains a Yellow Book audit of the financial statements. A Yellow Book audit contains a GAAS audit. Each layer adds requirements, reports and auditor obligations.

Clients mix the terms up and engagement letters inherit the confusion. This guide separates them, shows what is added at each layer, and gives decision rules for choosing the right engagement.

What is a financial statement audit under GAAS?

A financial statement audit under US generally accepted auditing standards follows the AU-C sections issued by the AICPA's Auditing Standards Board. The auditor expresses an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework. The output is the auditor's report, and where applicable, communications with those charged with governance and about internal control deficiencies under AU-C 265. The GAAS guide covers the standards.

A GAAS audit is required by whoever needs the opinion: lenders, investors, regulators, state law, bonding companies or the entity's own governance.

What is a Yellow Book audit?

Generally Accepted Government Auditing Standards, known as GAGAS or the Yellow Book, are issued by the Comptroller General of the United States through GAO. They contain standards for financial audits, attestation engagements, performance audits and reviews of financial statements, plus requirements for individual auditors and audit organizations. A law, regulation, grant agreement or contract can require that an audit be performed under them.

A GAGAS financial audit is performed in accordance with both GAAS and GAGAS. GAGAS adds to GAAS in these areas:

• Reporting. A GAGAS financial audit requires a report on internal control over financial reporting and on compliance with laws, regulations, contracts and grant agreements that could have a material effect on the financial statements, in addition to the opinion on the statements.
• Independence. GAGAS has its own independence requirements, including rules on nonaudit services that are more restrictive in some cases than the AICPA Code. They apply any time the auditor performs a Yellow Book audit, including audits of nonprofit and private entities.
• Competence and CPE. Auditors who plan, direct, perform procedures for or report on a GAGAS engagement must complete at least 80 hours of CPE in each two-year period, with at least 20 hours in each year, and at least 24 of the 80 hours must relate to government auditing or the government environment. See the GAO page on continuing professional education.
• Quality management and external peer review. The audit organization must be subject to an external peer review at least once every three years.

The 2024 revision of the Yellow Book is effective for financial audits, attestation engagements and reviews of financial statements for periods beginning on or after December 15, 2025, and for performance audits beginning on or after that date, with early implementation permitted. Until then, the 2018 revision applies. The Yellow Book guide gives the detail.

What is a single audit?

A single audit is the audit required by the Single Audit Act and 2 CFR Part 200, Subpart F, of non-federal entities that expend $1,000,000 or more in federal awards in a fiscal year (2 CFR 200.501). The threshold applies to fiscal years beginning on or after October 1, 2024; the earlier threshold was $750,000.

A single audit combines three pieces:

1. A GAGAS audit of the financial statements, as 2 CFR 200.514(a) requires the audit to be conducted in accordance with GAGAS.
2. An opinion on the schedule of expenditures of federal awards in relation to the financial statements as a whole. See the SEFA guide.
3. An audit of compliance with the requirements that could have a direct and material effect on each major program, together with testing of internal control over compliance, as 200.514(c) and (d) require. This is a compliance audit under AU-C 935.

The auditor determines the major programs using a risk-based approach in 2 CFR 200.518, starting with the Type A threshold. The Type A threshold is $1,000,000 when total federal awards expended are between $1,000,000 and $34 million, and rises on a sliding scale above that. The Type A and Type B programs entry explains the mechanics.

The single audit also produces additional deliverables: the schedule of findings and questioned costs, the auditee's summary schedule of prior audit findings and corrective action plan, a reporting package and the data collection form submitted to the Federal Audit Clearinghouse. The package is due within 30 calendar days after the auditee receives the auditor's reports or nine months after the end of the audit period, whichever is earlier (2 CFR 200.512(a)). The walkthrough goes through the steps.

Side-by-side comparison

How to decide which engagement a client needs

Work through these questions in order:

1. Does the client expend $1,000,000 or more in federal awards in the fiscal year? Include pass-through awards and count by the basis in 2 CFR 200.502. If yes, a single audit is required unless a program-specific audit election under 200.501(c) or (d) applies.
2. Does any grant, contract, loan agreement or state law require an audit under Government Auditing Standards? Many state and local governments, school districts and state-funded nonprofits do. If yes, the financial audit must be done under both GAAS and GAGAS even when federal awards are below the threshold.
3. Does a lender, board or regulator require an audit under GAAS only? Then a standard financial statement audit is enough.
4. If the client expends less than $1,000,000, is there a different state single-audit rule? Some states set their own thresholds. The federal exemption does not remove those.

If the answer to question 1 is yes, the audit is both a Yellow Book and a single audit. Say so in the engagement letter. The single audit engagement letter template is built for that.

Worked example (illustrative)

A nonprofit has a June 30 fiscal year. In the year ended June 30, 2026 it expends $640,000 in federal awards directly, $330,000 through a state pass-through and $40,000 through a county, and the county agreement requires a GAGAS audit.

• Federal awards expended: $640,000 + $330,000 + $40,000 = $1,010,000, above $1,000,000. Its fiscal year began July 1, 2025, after October 1, 2024, so the $1,000,000 threshold applies. A single audit is required.
• The firm performs a GAGAS financial audit, tests the SEFA, determines major programs and issues a compliance report on each.
• In the year before, with $740,000 expended and a year beginning before October 1, 2024, there was no single audit requirement. The county's agreement alone would still have required a GAGAS audit. The engagement type depends on the trigger.

Mistakes to avoid

• Quoting a GAAS audit when the client's grant requires GAGAS. The scope, staffing and independence tests are different.
• Treating a single audit as a financial statement audit with a schedule. The compliance audit and the reporting package are significant work.
• Missing pass-through awards when counting the threshold.
• Assuming the firm's peer review and CPE cover Yellow Book work without checking.

Frequently asked questions

Is a single audit the same as a Yellow Book audit?

No. A single audit includes a Yellow Book audit of the financial statements, plus the SEFA opinion and a compliance audit of major programs under the Uniform Guidance.

Does a Yellow Book audit always involve federal awards?

No. GAGAS can be required by state or local law, a grant agreement or a contract, with no federal award involved.

What is the single audit threshold?

$1,000,000 in federal awards expended for fiscal years beginning on or after October 1, 2024. For earlier years it was $750,000.

Do I need extra CPE for a Yellow Book engagement?

Yes. GAGAS requires 80 hours of CPE every two years for auditors working on GAGAS engagements, including 24 hours related to government auditing or the government environment.

Sources

• GAO, Government Auditing Standards (Yellow Book), 2024 revision and effective dates: https://www.gao.gov/yellowbook/overview
• GAO, Yellow Book continuing professional education requirements: https://gaoinnovations.gov/yellowbook/continuing-professional-education.html
• OMB, 2 CFR 200.501, 200.512, 200.514, 200.518: https://www.ecfr.gov/current/title-2/part-200/subpart-F
• OMB Uniform Guidance 2024 revisions, summary of effective dates: https://marcumllp.com/insights/omb-issues-most-substantial-revision-to-uniform-guidance-in-10-years
• AICPA, AU-C Section 935, Compliance Audits; AU-C Section 265

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error