Single Audit Late Submission and the Remedies Federal Agencies Can Apply

A Single Audit is not finished when the auditor signs the report. The reporting package has to reach the Federal Audit Clearinghouse (FAC) on time, and the clock starts running before the audit team has finished the file. When a package is late, the auditee has a compliance problem of its own, and the federal government has a set of tools for dealing with it.

This guide covers the deadline, the division of work between auditee and auditor, the extension route and the remedies in 2 CFR 200.339. It paraphrases the regulations; read 2 CFR 200.512 and 200.339 for the controlling text.

The deadline

Under 2 CFR 200.512, the reporting package is due within 30 calendar days after the auditee receives the auditor's report or, if earlier, nine months after the end of the audit period. The earlier of the two dates governs. When the due date falls on a weekend or a federal holiday, the package is due the next business day.

Two practical consequences follow.

The nine-month date is the real constraint for most engagements. A December 31 year-end gives a September 30 outer date. If the auditor delivers the report late in that window, the 30-day clock never gets a chance to matter, because the nine-month date arrives first.

The 30-day clock starts on early delivery. If the auditor delivers the report early, the auditee has 30 days from receipt, not nine months from year-end. A firm that releases a report two months before the outer date should tell the client in writing that the 30-day clock has started.

Who does what

The auditee electronically submits the data collection form and the reporting package to the FAC. The auditor completes the applicable data elements of the form and signs a statement covering the source of the information and the auditor's responsibility for it.

The split matters in the engagement letter and in the exit meeting:

• The auditee owns the submission, the certification and the timing.
• The auditor owns the accuracy of the auditor-completed data elements and the auditor's signed statement.
• Neither side can complete the other's step.

Submission requires an account with Login.gov on the FAC site, which GSA operates. Old Census FAC credentials do not work in the current system, so a client whose last submission predates the move needs a new sign-in before the due date, not on it.

Public access

The FAC is the repository of record for subpart F reporting packages and the data collection form. Federal agencies, pass-through entities and other interested parties retrieve these materials through the FAC. The auditee must also make copies of the reporting package available for public inspection unless a federal statute or regulation prohibits it. The FAC makes received packages available to the public, except for Tribes that opt out of online publication.

For a subrecipient, this means the pass-through entity can see the package without asking. A late filing is visible to every pass-through entity that funds the auditee.

Extensions

The cognizant or oversight agency for audit may authorize an extension when the nine-month timeframe would place an undue burden on the auditee. The extension is the agency's decision, not the auditor's and not the auditee's.

A usable request does three things:

1. It is made before the deadline.
2. It states the specific cause, such as a delayed audit of a component unit or a records problem that stems from a disruption.
3. It proposes a date for completion that the auditee can meet.

Keep the correspondence in the permanent file. If the auditor is asked later why the package was submitted after the nine-month date, the extension letter is the answer.

The remedies in 2 CFR 200.339

When the federal agency or pass-through entity determines that specific conditions cannot remedy a recipient's or subrecipient's noncompliance, 2 CFR 200.339 lets it take one or more of these actions:

• Temporarily withhold payments until the noncompliance is corrected.
• Disallow costs for all or part of the activity associated with the noncompliance.
• Suspend or terminate the federal award in part or in its entirety.
• Initiate suspension or debarment proceedings, or, for a pass-through entity, recommend that the federal agency do so.
• Withhold further federal awards for the project or program.
• Pursue other legally available remedies.

The regulation frames these as responses to a failure to comply with the U.S. Constitution, federal statutes, regulations or the terms and conditions of the award, and lets the agency first try specific conditions under 2 CFR 200.208. For audits specifically, 2 CFR 200.505 says that when a non-federal entity shows continued inability or unwillingness to have an audit conducted under subpart F, federal agencies and pass-through entities must take appropriate action as provided in 200.339. The choice among remedies belongs to the agency or pass-through entity, and the regulation does not tie a particular remedy to a particular number of days late.

For a CPA firm, the point to make to clients is simple: the cost of a late package is not a fixed penalty. It is a risk that payments stop or that new awards are withheld, and for an organization that depends on federal reimbursements, a withheld payment is a cash-flow event.

Engagement planning that prevents a late package

Late packages are mostly a planning failure. A firm can control several variables.

• Set the report date backwards from the outer date. Put the nine-month date in the planning memo and work back through exit conference, management responses, report release and package assembly.
• Fix the corrective action plan and the summary schedule of prior findings early. These are management documents that the package needs. See the corrective action plan guide.
• Confirm the data collection form inputs. The auditee's Assistance Listing numbers, award identifiers and major program list have to agree with the report. See the data collection form guide.
• Confirm the Login.gov account. The person who certifies for the auditee needs access before the day of submission.
• Agree who hits submit. Document it in the engagement letter.

What to document when a package is late

If the due date passes, the file should show the cause, the communication with the cognizant or oversight agency, the date the auditor delivered the report and the date the auditee submitted. The auditor's responsibility under GAGAS and the Uniform Guidance is limited to the audit and the auditor-completed data elements, but a clear record protects the firm when the client or an agency asks how the delay arose.

Related reading

The Federal Audit Clearinghouse standards page covers the filing system itself. The Single Audit walkthrough places submission in the full sequence of the engagement.

CORAA prepares ready-to-review audit files for US CPA firms, including the schedules and tie-outs that feed the reporting package. The firm keeps the client, the review and the signature. See /us.

Sources

• Legal Information Institute, 2 CFR 200.512, Report submission: https://www.law.cornell.edu/cfr/text/2/200.512
• Legal Information Institute, 2 CFR 200.339, Remedies for noncompliance: https://www.law.cornell.edu/cfr/text/2/200.339
• Legal Information Institute, 2 CFR 200.505, Remedies for audit noncompliance: https://www.law.cornell.edu/cfr/text/2/200.505
• General Services Administration, Federal Audit Clearinghouse: https://www.fac.gov/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error