GASB 102 Concentrations and Constraints Disclosures: Audit Approach

Most governmental accounting standards ask what to record. GASB Statement 102 asks what the government knows and has not yet said. It requires a note when a concentration or constraint, together with an event that has happened or is likely, makes the government vulnerable to a substantial impact. It changes no recognition or measurement, so the numbers on the face of the statements stay the same. The audit risk is an omission: a known risk that never reaches the notes. This guide follows the Statement, with BDO and Sensiba summaries for the examples. Paragraph references are to Statement 102 (December 2023).

Scope and effective date

GASB issued Statement 102 in December 2023. It is effective for fiscal years beginning after June 15, 2024, and all reporting periods thereafter, with earlier application encouraged (paragraph 10). It need not be applied to immaterial items. For a June 30 year-end, the first year affected is the year ended June 30, 2025.

The Statement covers risks that come from concentrations or constraints (paragraphs 4 to 6). BDO states that risks tied to the nature of operations and to the use of estimates are outside it. That differs from FASB ASC 275, which also covers those two risk types for nongovernmental entities (Statement 102, paragraph A1).

The definitions

Concentration. A lack of diversity related to an aspect of a significant inflow or outflow of resources, that is, revenue or expense (paragraph 5). The Statement's examples include the composition of employers, industries, inflows of resources, workforce covered by collective bargaining agreements, providers of financial resources, and suppliers of material, labor or services.

Constraint. A limitation imposed by an external party or by formal action of the government's highest level of decision-making authority (paragraph 6). The Statement's examples are limitations on raising revenue, on spending and on the incurrence of debt, and mandated spending.

The three criteria

A government discloses a concentration or constraint when all three conditions in paragraph 7 are met:

1. It is known before the financial statements are issued.
2. It makes the government vulnerable to the risk of a substantial impact.
3. An associated event that could cause a substantial impact has occurred, has begun to occur, or is more likely than not to begin to occur within 12 months of the date the financial statements are issued.

More likely than not means a likelihood of more than 50 percent (footnote 3). Sensiba notes that the 12-month window runs from issuance, tying it to the auditor's report date, which differs from the going concern look-forward.

Existence alone is not enough. Sensiba's example: a general obligation debt limit applies to every government, but only governments near the limit are vulnerable.

What the note says

For each concentration or constraint that meets all three criteria, paragraph 9 requires descriptions of:

• the concentration or constraint;
• each associated event that could cause a substantial impact if the event had occurred or had begun to occur before issuance; and
• the actions the government took before issuance to mitigate the risk.

Paragraph 8 adds limits: only the current period is covered where statements are comparative, the note is combined with related disclosures to avoid duplication, and information is given for each reporting unit that meets all the criteria, combining what is the same for more than one unit. The assessment covers the primary government reporting unit and all other reporting units that report a liability for revenue debt (paragraph 7).

Mitigation counts only if it already happened

If mitigating actions the government took before issuance cause any of the criteria not to be met, none of the paragraph 9 note disclosures is required (paragraph 7). Sensiba states that only actions taken before issuance count, and planned mitigation may not be included in the note. BDO's illustration: a college hit its debt cap, but legislation raising the cap was signed before the statements were issued, so the constraint no longer applied and no note was needed.

Where the audit risk sits

• Identification. The government has to inventory its concentrations and constraints. Management and the governing board know about many of them and the notes do not.
• The vulnerability judgment. Whether a concentration makes the government vulnerable to a substantial impact needs a measure, such as the percentage of revenue, the percentage of payroll or the headroom below a limit.
• The event judgment. The event has to be one that could cause a substantial impact and that has occurred, has begun to occur, or is more likely than not to begin within 12 months of issuance.
• Timing. Information arrives between the year-end and issuance. The assessment runs to the issuance date.
• Mitigation evidence. Management may describe steps as taken that are only planned.

Audit procedures

1. Obtain management's inventory of concentrations and constraints, with the revenue, expense and limit data behind each.
2. Challenge completeness. Read the minutes of the governing body and its finance committee, debt documents, major contracts and collective bargaining agreements, budget documents, and correspondence with the state or other external parties. Ask the finance director and the governing body's chair about known risks.
3. Test the vulnerability analysis. Recompute the percentages and headroom management used and compare them with the entity's own trend data.
4. Test the event analysis. For each candidate, identify events that have occurred or begun, and evaluate whether one is more likely than not within 12 months of the issuance date. Inquire up to the report date.
5. Test mitigation. Obtain evidence that each action was taken before issuance, such as signed legislation, executed contracts and board resolutions.
6. Evaluate the note. Read it against the three required elements, the reporting unit and the period.
7. Document the no-disclosure conclusion. Where management concludes no note is needed, the file shows the analysis. A blank is not evidence.
8. Representations. Include the matter in the management representation letter. See AU-C 580.

Worked example

Cedar Valley County has an issuance date of December 12, 2025 for its fiscal year ended June 30, 2025.

Concentration. A paper mill pays 18 percent of the county's property tax levy. The mill's parent announced in October 2025 that it will idle the plant in spring 2026.

• Known: yes, public since October 2025.
• Vulnerable: the loss of 18 percent of the levy is a substantial impact on the general fund.
• Event within 12 months of December 12, 2025: the idling is announced and scheduled, so it is more likely than not.
• Mitigation before issuance: the board adopted a budget cut of 4 percent of expenditures in November 2025. The cut offsets part of the loss but the remaining exposure is still substantial.

Result: the county discloses the concentration, the planned idling and the action already taken, the budget cut, and does not describe a tax increase the board has only discussed.

Constraint. The county's charter caps general obligation debt at a fixed ratio of assessed value. The county is at 72 percent of the cap. A road bond planned within the following 12 months would add 8 percent, taking the county to 80 percent of the cap.

• Vulnerable: no. The county has headroom beyond the project.
• No note is needed, and the file records the headroom calculation.

Auditor's tests. The auditor reads the mill's announcement and the minutes, recomputes the 18 percent from the tax roll, confirms the November 2025 budget amendment, and obtains a written representation. For the debt limit, the auditor recomputes headroom from the assessed value report and the debt schedule.

Common misses

• Waiting for the event to happen before considering the note.
• Counting planned actions as mitigation.
• Disclosing every concentration regardless of the criteria.
• Applying a year-end date for the assessment instead of the issuance date.

Related reading

For how subsequent events and going concern interact, see subsequent events under AU-C 560 and going concern assessment. The private-sector risk note is covered in ASC 275 risks and uncertainties.

Where CORAA fits

CORAA prepares ready-to-review audit files for US CPA firms, including concentration schedules and issuance-date roll-forward checklists. The firm keeps the client, the review and the signature. See /us.

Sources

• GASB, Statement No. 102, Certain Risk Disclosures (December 2023): https://d2x0djib3vzbzj.cloudfront.net/GASBS%20102.pdf
• BDO, GASB 102, Certain Risk Disclosures: https://www.bdo.com/insights/industries/government-public-sector/gasb-102-certain-risk-disclosures
• Sensiba, Understanding the Impact of GASB Statement No. 102, Certain Risk Disclosures: https://sensiba.com/resources/alerts/gasb-statement-no-102-certain-risk-disclosures/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error