Single Audit Data Collection Form and Due Dates: 2 CFR 200.512, SF-SAC and the FAC

A single audit is not finished when the auditor signs the reports. It is finished when the data collection form and the reporting package reach the Federal Audit Clearinghouse (FAC) on time. The deadline lives in 2 CFR 200.512, and it also feeds the low-risk auditee test, so a missed date has consequences beyond the late filing itself.

This post covers the deadline math, what goes into the package, who submits, and the retention rule. The full engagement flow is in the single audit walk-through.

The deadline: the earlier of two dates

Under 2 CFR 200.512(a)(1), the audit, the data collection form and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's report(s), or nine months after the end of the audit period, whichever is earlier.

Two clocks run at once, and the earlier one controls:

The second row shows why a late report compresses the window: the 30-day clock would run past the nine-month date, so the nine-month date wins. Treat the nine-month date as the outer limit and the report date as the trigger for the inner one. If the due date falls on a Saturday, Sunday or Federal holiday, the package is due the next business day, and the cognizant or oversight agency may authorize an extension when the nine-month timeframe would place an undue burden on the auditee.

Practical consequences for the engagement calendar:

• A June 30 year end has a March 31 outer date. A September 30 year end has a June 30 outer date. A December 31 year end has a September 30 outer date.
• The clock starts when the auditee receives the report, not when the auditor dates it. Record the delivery date in the file.
• Agree in the engagement letter who files and who supplies which part of the submission.

What the reporting package contains

2 CFR 200.512(c) lists the reporting package. It must include:

• Financial statements and the schedule of expenditures of federal awards (SEFA).
• The summary schedule of prior audit findings.
• The auditor's report(s).
• The corrective action plan.

The auditor's reports cover the financial statements, internal control and compliance under Government Auditing Standards, and the compliance opinion on major programs. The schedule of findings and questioned costs belongs to the auditor's reporting. Writing it is covered in the findings post.

The summary schedule of prior audit findings and the corrective action plan are auditee documents prepared under 2 CFR 200.511. They are separate from the auditor's reports and are not drafted by the auditor on the auditee's behalf. The summary schedule reports the status of each prior finding. The corrective action plan is a separate document naming the responsible contact person(s), the corrective action and the anticipated completion date.

The data collection form and the SF-SAC

2 CFR 200.512(b) requires a data collection form that covers the auditee, its federal programs and the audit results, and includes the information federal agencies need to ensure program integrity. The form is called the SF-SAC. On the FAC site, the SF-SAC workbooks are part of the audit submission.

The form draws on three sources: auditee identification and fiscal period, the program-by-program data from the SEFA, and the audit results, including the major program labels, the opinions and the findings. Finding reference numbers on the form must match the schedule of findings and questioned costs.

The form, the SEFA and the schedule of findings must agree. A program that the SEFA lists as $1,420,000 and the form lists as $1,240,000 is a transposition caught only by tying the two. Add that tie-out to the file as a named procedure. The SEFA guide covers how the schedule is built.

Submitting through the FAC

Under 2 CFR 200.512(b), the FAC is the repository of record for Subpart F reporting packages and the data collection form. Anyone who wants these documents obtains them through the FAC.

The FAC is operated by the General Services Administration. Submitting information requires authentication through Login.gov. The site hosts submission resources and a submission guide, a searchable audit database and CSV downloads.

Set up the logins before the due date, not on it.

Retention

Under 2 CFR 200.512(f), the auditee keeps a copy of the data collection form and the reporting package on file for three years from the date of submission to the FAC. Set the retention clock from the submission date in the file index, not from the report date. The firm's own working paper retention is a separate rule; see audit record retention.

Why the date matters beyond the filing

Low-risk auditee status under 2 CFR 200.520 requires single audits performed annually, with the data collection form and reporting package submitted on time, in each of the two preceding audit periods. A late filing therefore costs the auditee the 20 percent coverage rule for the following two audits and moves it to 40 percent coverage; see the major program determination post. Plan for that at the start of the engagement.

Filing checklist

1. Calendar the nine-month date at engagement acceptance.
2. Record the date the auditee received each report.
3. Confirm FAC and Login.gov access for the auditor and auditee contacts.
4. Complete the SF-SAC workbooks from the SEFA and the final schedule of findings.
5. Tie program totals, major program labels and finding reference numbers across the three documents.
6. Confirm the package holds all four required components.
7. Submit, save the confirmation, and set the three-year retention date from the submission date.

Sources

• 2 CFR 200.512 Report submission, eCFR
• 2 CFR 200.511 Audit findings follow-up, eCFR
• 2 CFR 200.520 Criteria for a low-risk auditee, eCFR
• Federal Audit Clearinghouse

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error