Nonprofit Audit Requirements: When a Nonprofit Needs an Audit and When a Single Audit Applies

Nonprofit clients often ask a simple question: "Do we need an audit?" The answer depends on several overlapping sources: federal grant rules, state charitable solicitation laws, funder agreements, lenders and the organization's own bylaws. For CPA firms, settling the question at acceptance avoids under-scoping an engagement that turns out to be a single audit.

This guide covers the main sources of nonprofit audit requirements, the federal single audit under the Uniform Guidance, and the areas auditors focus on in a not-for-profit financial statement audit. It paraphrases the regulations and standards.

Is a nonprofit legally required to have an audit?

There is no single federal rule that requires every nonprofit to be audited. The IRS does not require audited financial statements to file Form 990. The requirement, when it exists, comes from one or more of these sources:

1. Federal awards. A non-federal entity that spends federal awards above the single audit threshold must have a single audit or program-specific audit under the Uniform Guidance.
2. State law. Many states require charities that register to solicit contributions to submit audited, reviewed or compiled financial statements once revenue or contributions exceed state-set thresholds (state requirements vary).
3. State and local grants. State agencies and local governments often require audits or reviews as a condition of funding, sometimes at levels below the federal threshold.
4. Private funders. Foundations and United Way agencies frequently require audited statements for larger grants.
5. Lenders and bond documents. Loan covenants and tax-exempt bond agreements often require annual audits.
6. Governing documents. Bylaws or board policy may require an annual audit.
7. Accreditation or membership bodies, for example in higher education or health care.

State audit requirements vary

State charitable registration rules differ widely. The thresholds that trigger an audit, a review or a compilation, the measure used (total revenue, gross contributions or something else) and the exemptions (for example, for religious organizations or certain educational institutions) all vary by state. Some states have no financial statement requirement for charities at all.

An organization that solicits in several states may have to satisfy each state's rules. Each state's charity regulator or attorney general publishes its current requirements, and thresholds change by statute or rule.

The single audit under the Uniform Guidance

What is a single audit?

A single audit is an organization-wide audit of a non-federal entity's financial statements and its federal awards, performed under Subpart F of the Uniform Guidance (2 CFR Part 200). It combines:

• an audit of the financial statements under GAAS and Government Auditing Standards (the Yellow Book)
• an audit of compliance for each major program with the compliance requirements that could have a direct and material effect, together with consideration and testing of internal control over compliance

Non-federal entities include nonprofits, states, local governments, Indian tribes and institutions of higher education. For-profit entities are generally outside Subpart F, although a federal agency can impose audit requirements on them through the award.

The single audit threshold

Under 2 CFR 200.501, a non-federal entity that expends $1,000,000 or more in federal awards during its fiscal year must have a single audit (or, in limited cases, a program-specific audit). The threshold applies to fiscal years beginning on or after October 1, 2024, following OMB's 2024 revisions to the Uniform Guidance. The previous threshold was $750,000.

For a calendar-year nonprofit, the $1,000,000 threshold first applies to the fiscal year beginning January 1, 2025. For a June 30 year-end, it first applies to the fiscal year beginning July 1, 2025.

An entity that expends less than the threshold is exempt from federal audit requirements for that year, but its records must remain available for review or audit by federal agencies, pass-through entities and the Government Accountability Office (2 CFR 200.501(e)).

"Expended," not "received"

The threshold is based on federal awards expended during the year, not received or awarded. Expenditure is determined under the rules in 2 CFR 200.502, which address items such as loan and loan guarantee programs, noncash assistance and amounts passed through to subrecipients. Federal awards include awards received directly from federal agencies and awards received through pass-through entities, such as a state agency passing through federal funds.

Auditors should obtain and test the schedule of expenditures of federal awards (SEFA) early. Misclassified grants, such as federal funds recorded as state funds, can cause an entity that thought it was below the threshold to need a single audit.

Program-specific audits

When an auditee expends federal awards under only one federal program (excluding research and development) and the program's laws, regulations or award terms do not require a financial statement audit, the auditee may elect a program-specific audit instead. This is uncommon for most nonprofits.

What a single audit produces

A single audit reporting package typically includes:

• the financial statements and SEFA, with the auditor's opinion on the financial statements and an in-relation-to opinion on the SEFA
• the Yellow Book report on internal control over financial reporting and on compliance and other matters
• the Uniform Guidance report on compliance for each major program and on internal control over compliance
• the schedule of findings and questioned costs
• the auditee's summary schedule of prior audit findings and corrective action plan

The auditee submits the reporting package and data collection form to the Federal Audit Clearinghouse (now operated by the General Services Administration at fac.gov). The deadline is the earlier of 30 calendar days after the auditee receives the auditor's reports or nine months after the end of the audit period. If the due date falls on a weekend or federal holiday, it moves to the next business day, and the cognizant or oversight agency may authorize an extension when the nine-month period would place an undue burden on the auditee (2 CFR 200.512).

The AICPA framework

In addition to the Uniform Guidance and the Yellow Book, AU-C 935, Compliance Audits, applies to the compliance portion. The OMB Compliance Supplement identifies the compliance requirements for many programs and suggested audit procedures. The AICPA Audit Guide Government Auditing Standards and Single Audits is the main practice resource.

Major program determination, risk assessment of programs, and the type A and type B program rules are set out in 2 CFR 200.518 and related sections; the 2024 revisions changed several dollar amounts, so older templates do not apply.

Key areas in a nonprofit financial statement audit

Not-for-profit entities report under ASC 958. Several areas need particular attention.

Net asset classification

Since ASU 2016-14, net assets are presented in two classes: with donor restrictions and without donor restrictions. The auditor tests whether contributions with donor-imposed restrictions are classified correctly and whether releases from restriction are supported by actual satisfaction of the purpose or time restriction. Board designations are part of net assets without donor restrictions.

Contributions vs exchange transactions

ASU 2018-08 clarified how to determine whether a grant or contract is a contribution (ASC 958-605) or an exchange transaction (often ASC 606), and whether a contribution is conditional, meaning it has both a barrier to entitlement and a right of return or release. Many government grants are conditional contributions recognized as the barrier is overcome, usually as qualifying expenses are incurred. Misapplying these rules can cause revenue to be recognized in the wrong period.

Pledges receivable

Unconditional promises to give are recognized when made, measured at fair value, and, for multi-year pledges, discounted. The auditor considers confirmations with donors, collectibility and whether conditions exist.

Contributed nonfinancial assets

ASU 2020-07 requires presentation of contributed nonfinancial assets as a separate line item and expanded disclosures, including whether they were monetized or used and the valuation technique. Donated services are recognized only when specific criteria are met.

Functional expense allocation

Nonprofits must present expenses by both nature and function (program, management and general, fundraising), in a statement or in the notes. Auditors test the reasonableness of allocation methods, such as time records for salaries or square footage for occupancy. Users focus on program-expense ratios, so the allocation carries qualitative weight under AU-C 320 and AU-C 450.

Liquidity disclosures

ASU 2016-14 also requires qualitative and quantitative information about liquidity and the availability of financial assets to meet general expenditures within one year.

Revenue recognition fraud risk

The presumed fraud risk in revenue recognition under AU-C 240 applies to nonprofits too. The risk can arise in the timing of grant revenue, the classification of contributions, or the recognition of conditional grants.

Related parties and governance

Board members, officers and their businesses often transact with the organization. Inquire, review minutes and Form 990 Schedule L, and test disclosures.

Planning tips for firms

• Ask for the SEFA at acceptance and roll it forward with budgets so the single audit question is answered before the engagement letter is signed.
• Check staff qualifications. Yellow Book engagements carry specific CPE requirements, and engagements performed under Government Auditing Standards are among the engagements the AICPA peer review program requires reviewers to select.
• Use risk assessment under AU-C 315 to target net asset restrictions, grant revenue and functional allocation.
• Plan sampling for compliance testing under AU-C 530 and AU-C 935, aligned with the Compliance Supplement.
• Calendar the FAC deadline at planning.

Frequently asked questions

What is the single audit threshold for 2025 and later?

For fiscal years beginning on or after October 1, 2024, a non-federal entity that expends $1,000,000 or more in federal awards in its fiscal year must have a single audit under 2 CFR 200.501. Earlier fiscal years used the $750,000 threshold.

Does a nonprofit under $1,000,000 in federal spending need an audit?

It does not need a single audit, but it may still need a financial statement audit, review or compilation because of state charity registration rules, state or local grant terms, private funders, lenders or its own bylaws.

Do PPP loans or other COVID-era funds count toward the single audit threshold?

The treatment depends on the program. Some pandemic-era programs were excluded from the single audit expenditure base, while others were included. The Compliance Supplement and the awarding agency's guidance address each program and year.

Is a single audit the same as a Yellow Book audit?

No. A Yellow Book audit is a financial statement audit performed under Government Auditing Standards. A single audit includes a Yellow Book financial statement audit plus a compliance audit of major federal programs under the Uniform Guidance.

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Sources

• 2 CFR 200.501 (audit requirements, $1,000,000 threshold), 200.502 (federal awards expended), 200.507 (program-specific audits), 200.512 (report submission), 200.518 (major program determination): https://www.ecfr.gov/current/title-2/part-200/subpart-F
• OMB, 2 CFR Part 200 revisions (89 Fed. Reg. 30046, April 22, 2024), effective October 1, 2024
• OMB Compliance Supplement
• Federal Audit Clearinghouse: https://www.fac.gov
• AICPA, AU-C Section 935, Compliance Audits; GAO, Government Auditing Standards (2024 Revision, GAO-24-106786)
• FASB ASC 958 (net asset classes, functional expenses, liquidity); ASU 2016-14, ASU 2018-08, ASU 2020-07
• AICPA, AU-C Sections 240, 315, 320, 450 and 530; AICPA Peer Review Program Standards (must-select engagements)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error