Major Program Determination: Type A, Type B and the Risk-Based Approach Under 2 CFR 200.518

The scope of a single audit is set by one decision: which federal programs the auditor tests as major programs. Every compliance test, every opinion and most of the fee flow from it. 2 CFR 200.518 prescribes the method, and the method is risk-based: size sorts programs into Type A and Type B, risk narrows the list, and coverage percentages set the floor.

This post goes deeper than the major program step in the single audit walk-through. The starting point, the schedule of expenditures of federal awards, must be complete first, because every threshold below is a function of SEFA totals.

Step 1: Label Type A and Type B programs

Type A programs are federal programs with federal awards expended during the audit period exceeding the levels in Table 1 of 2 CFR 200.518(b)(1). All other programs are Type B.

The $1,000,000 floor follows the threshold for fiscal years beginning on or after October 1, 2024; see the 2024 revisions post. A program is labeled by its own expenditures against the table. A program with exactly $1,000,000 expended does not exceed the threshold, so it is Type B.

Example: an auditee expends $7,200,000 across seven programs. The Type A threshold is $1,000,000. Programs at $2,400,000, $1,800,000 and $1,150,000 are Type A. The four programs at or below $1,000,000, including one at exactly $1,000,000, are Type B.

Step 2: Identify low-risk Type A programs

The auditor does not have to audit every Type A program. A Type A program is low-risk under 200.518(c)(1) only if it meets both of these tests:

• It was audited as a major program in at least one of the two most recent audit periods (the most recent period, for a biennial audit).
• In the most recent audit period, it had none of the following: internal control deficiencies identified as material weaknesses in the report on internal control, a modified opinion on the program in the report on major programs, or known or likely questioned costs exceeding five percent of the total federal awards expended for the program.

Even a program that meets both tests is not low-risk if the 200.519(c) oversight criteria, the results of audit follow-up, or changes in personnel or systems affecting the program indicate significantly increased risk. A program that was never audited as major cannot be low-risk, however clean the file looks. The auditor documents the prior-year results for each Type A program that is classed low-risk.

Step 3: Assess risk on Type B programs

The auditor must identify high-risk Type B programs using professional judgment and the criteria in 2 CFR 200.519. The criteria fall into three groups:

• Current and prior audit experience. Weaknesses in internal control over federal programs indicate higher risk. Prior audit findings that could significantly affect a program or remain uncorrected raise risk. A program not recently audited as major carries more risk than one recently audited without findings.
• Oversight by federal agencies and pass-through entities. Monitoring that disclosed significant problems indicates higher risk. Clean recent reviews by an oversight entity indicate lower risk.
• Inherent risk of the program. Programs that disburse funds through third-party contracts or have eligibility criteria carry higher risk, and complexity of the program counts. New programs, programs with interim regulations, significant changes to statutes or award terms, and start-up or close-out years raise risk. A larger Type B program is riskier than a substantially smaller one.

Two limits keep the work proportionate:

• Except for a known material weakness in internal control or a compliance problem, a single risk criterion would rarely cause a Type B program to be considered high-risk.
• The auditor is only required to perform risk assessments on Type B programs that exceed 25 percent (0.25) of the Type A threshold. At a $1,000,000 Type A threshold, Type B programs at or under $250,000 are outside the required risk assessment.

The auditor is also not required to identify more high-risk Type B programs than at least one-fourth of the number of low-risk Type A programs identified as low-risk. If four Type A programs are low-risk, the minimum that must be identified is one.

Step 4: Select major programs and test coverage

Major programs are the Type A programs not classed low-risk, plus the high-risk Type B programs identified in step 3. The coverage test then sets the floor under 200.518(f):

• 20 percent coverage. If the auditee qualifies as low-risk, the auditor audits those major programs only, provided they encompass at least 20 percent (0.20) of total federal awards expended.
• 40 percent coverage. Otherwise, the major programs must encompass at least 40 percent (0.40) of total federal awards expended.

When the selected programs fall short of the percentage, the auditor adds programs until the coverage test is met. Coverage is measured against total expenditures on the SEFA, which is why a SEFA error moves the scope.

Run the numbers on the earlier example: total expended $7,200,000. Assume the $1,800,000 and $1,150,000 Type A programs are low-risk and no high-risk Type B program is identified, so only the $2,400,000 program is major so far. At 40 percent, major programs must cover at least $2,880,000. The $2,400,000 program alone falls short. With the $1,800,000 program added, coverage is $4,200,000, or 58.3 percent, and the floor is met. At 20 percent, the floor is $1,440,000, and the $2,400,000 program alone meets it.

Low-risk auditee status

Whether the 20 percent or 40 percent rule applies is set by 2 CFR 200.520. To be a low-risk auditee, the entity must meet all of the following in each of the two preceding audit periods:

• Single audits performed annually, with the data collection form and reporting package submitted to the FAC on time. An entity with biennial audits does not qualify.
• Unmodified opinions on the financial statements and on the SEFA.
• No internal control deficiencies identified as material weaknesses under GAGAS.
• No substantial doubt about going concern reported by the auditor.
• For Type A programs: no material weakness findings, no modified opinion on a major program and no known or likely questioned costs above 5 percent of total federal awards expended.

One late FAC submission in either of the two preceding years removes the status, and the 40 percent rule applies. The submission deadlines are covered in the due dates post.

Documenting the determination

The major program workpaper carries five items: the SEFA total, the Type A threshold computation, the low-risk Type A analysis with prior-year support, the Type B risk assessment with the 200.519 criteria applied to each program above 25 percent of the threshold, and the coverage calculation with the percentage applied. A reviewer reads that file front to back and should find every program labeled and every exclusion supported.

Rotation follows from the rules above. A Type A program tested clean in year one is low-risk in year two and drops from the major list unless coverage requires it, and it stays eligible for low-risk status in year three. Once two audit periods pass without the program being audited as major, it loses that status and returns to the major list. The audit plan for each year cites the prior two years.

Sources

• 2 CFR 200.518 Major program determination, eCFR
• 2 CFR 200.519 Criteria for Federal program risk, eCFR
• 2 CFR 200.520 Criteria for a low-risk auditee, eCFR

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error