Single Audit and Uniform Guidance Walk-Through: Major Programs, SEFA and Reporting

A single audit is an audit of an entity's financial statements and of its compliance with federal program requirements, performed under Subpart F of the Uniform Guidance, 2 CFR Part 200. For firms new to them, the work looks like a financial statement audit with a second audit layered on top: a compliance audit of selected federal programs.

This walk-through follows the order of the engagement. For when a nonprofit needs an audit at all, and for state requirements, see nonprofit audit requirements. For the auditing standards behind the work, see Yellow Book (GAGAS).

Step 1: Confirm a single audit is required

Under 2 CFR 200.501, a non-federal entity that expends $1,000,000 or more in federal awards in its fiscal year must have a single audit or, in limited cases, a program-specific audit. The $1,000,000 threshold applies to fiscal years beginning on or after October 1, 2024. The earlier threshold was $750,000.

The test is expenditures, not awards received or awards made. Expenditure is determined under 2 CFR 200.502. Awards include direct awards and federal funds passed through a state or other entity. Loans, loan guarantees and noncash assistance have their own rules, so read 200.502 when the entity has any of them.

Before accepting the engagement, confirm the entity's year-end, the awards received, and whether any awards are federal funds passed through a state agency and recorded by the client as state grants. That last case is easy to miss.

Engagement letter and team

The engagement letter should describe the single audit, the reports to be issued, the audit being under GAAS and Government Auditing Standards, and the client's responsibilities for the schedule of expenditures of federal awards, the corrective action plan and the submission. See the audit engagement letter guide. Under GAGAS, the auditor and the team must also meet the independence and continuing education requirements of the Yellow Book.

Step 2: The schedule of expenditures of federal awards

The auditee prepares the schedule of expenditures of federal awards (SEFA) under 2 CFR 200.510(b). It lists individual federal programs by federal agency, with clusters shown together, and includes:

• the assistance listing number, formerly the CFDA number, and the program name
• the identifying number assigned by the pass-through entity, where awards come through one
• total federal awards expended for each program, and the cluster name and total where programs are clustered
• the amount provided to subrecipients
• notes to the schedule, including the significant accounting policies used and whether the entity elected the de minimis indirect cost rate, plus balances outstanding at year-end for any loans or loan guarantees

The SEFA is the foundation of everything that follows. If it is incomplete, the major program determination is wrong. Obtain it early, tie it to the general ledger and to award documents, and test completeness: grants listed in the revenue accounts, reimbursements from state agencies, loan programs, and funds for which the client acts as a pass-through to others.

The auditor also reports on the SEFA in relation to the financial statements as a whole, in accordance with the AU-C standards on supplementary information. This is not a separate audit opinion on the schedule.

Step 3: Determine major programs

The auditor must use a risk-based approach to determine major programs under 2 CFR 200.518. The steps are as follows.

Classify Type A and Type B programs

Type A programs are those with federal awards expended above a threshold that depends on the total. Under 200.518(b), the thresholds are:

Programs that are not Type A are Type B.

Identify low-risk Type A programs

A Type A program is low-risk if it was audited as a major program in at least one of the two most recent audit periods and, in the most recent period, it had no material weaknesses in internal control over compliance, no modified opinion on the program, and no known or likely questioned costs above five percent of the program's federal awards expended. The auditor also considers other risk factors and whether personnel or systems have changed in a way that raises risk.

Risk-assess Type B programs

The auditor performs a risk assessment of the larger Type B programs under 200.518(d). Risk assessments are required only for Type B programs above 25 percent of the Type A threshold, and the auditor selects as major the Type B programs identified as high-risk. The auditor need not identify more high-risk Type B programs than one-fourth of the number of low-risk Type A programs. Document the risk factors used, such as program complexity, prior audit results, the volume of awards, whether the auditee has experience with the program, and any known risk from the pass-through entity.

Apply the coverage rule

Major programs must together cover at least 40 percent of total federal awards expended, or 20 percent if the auditee qualifies as a low-risk auditee under 2 CFR 200.520. Low-risk auditee status depends on a record of timely single audits, unmodified opinions and no significant problems in the prior periods. If the identified programs do not reach the coverage level, the auditor selects additional programs.

Document the determination in a workpaper that lists every program, its type, its dollar amount, the risk assessment and the final designation.

Step 4: Plan and perform the compliance audit

Compliance requirements

For each major program, the auditor identifies the compliance requirements that could have a direct and material effect on the program, using the OMB Compliance Supplement for the audit period. The Supplement lists the types of compliance requirements, such as allowable activities, allowable costs, cash management, eligibility, period of performance, procurement and suspension and debarment, reporting, subrecipient monitoring and special tests and provisions. It also describes audit objectives and suggested procedures for the programs it covers.

For a program the Supplement does not cover, the auditor reads the award agreement and applicable laws and regulations to identify the requirements and develops procedures.

Internal control over compliance

The auditor obtains an understanding of internal control over compliance for each major program and tests operating effectiveness, unless the auditor decides to assess control risk at maximum. At small entities, controls may exist without being written down, such as a program director who approves timesheets or a finance manager who reviews drawdowns against expenditures. The work is to document what happens and test whether it works.

Testing

Typical compliance testing includes:

• selecting expenditure transactions and testing them for allowability, documentation, approval, allocation and period of performance
• testing eligibility for participants or beneficiaries where the program makes payments to or for individuals
• testing drawdown and cash management against expenditures
• testing procurement files for competition, suspension and debarment checks and documentation
• testing subrecipient monitoring and pass-through requirements
• testing reports submitted to the awarding agency against the underlying records

Sampling for these tests follows AU-C 530. The audit sample size calculator can support the sample size, but the Compliance Supplement and the audit program may call for specific minimums.

Step 5: Reports and findings

A single audit ordinarily produces these auditor's reports:

• the independent auditor's report on the financial statements, with an opinion under GAAS
• the report on internal control over financial reporting and on compliance and other matters, as required by Government Auditing Standards
• the report on compliance for each major program and on internal control over compliance, with an opinion on compliance for each major program

The auditor also prepares the schedule of findings and questioned costs under 2 CFR 200.515. It summarizes the results, lists findings related to the financial statements, and lists findings and questioned costs for federal awards. Findings are reported when they meet the criteria in 200.516, which includes significant deficiencies and material weaknesses in internal control over major programs, material noncompliance, known questioned costs when known or likely questioned costs exceed $25,000 for a type of compliance requirement for a major program, known questioned costs above $25,000 for a program that is not audited as major, and known or likely fraud affecting a federal award.

The auditee prepares the summary schedule of prior audit findings and the corrective action plan. Management owns these. The auditor reads the summary schedule and reports if it materially misstates the status of prior findings.

Step 6: Submit the reporting package

The audit, the data collection form and the reporting package are due to the Federal Audit Clearinghouse within 30 calendar days after the auditee receives the auditor's reports, or nine months after the end of the audit period, whichever comes first. The reporting package includes the financial statements and SEFA, the summary schedule of prior audit findings, the auditor's reports and the corrective action plan.

The auditee and the auditor each have responsibilities in the data collection form. Build the due date backward, because the nine-month deadline can arrive quickly for a year-end that falls in busy season.

Practical points for small firms

• Treat the first single audit as a learning engagement: allow time to read 2 CFR 200.500 through 200.521 and the Compliance Supplement for each program before fieldwork.
• Consider an engagement quality review for single audits. Some firms set their quality management policies to require one. See the SQMS 1 guide.
• Audits under Government Auditing Standards, including single audits, can be must-select engagements in a system review. See the peer review guide.
• Keep a permanent file on each program: the award documents, the Compliance Supplement excerpt and prior-year work.

Frequently asked questions

What is the single audit threshold now?

$1,000,000 in federal awards expended during the fiscal year, for fiscal years beginning on or after October 1, 2024. The earlier threshold was $750,000.

How is a major program determined?

The auditor classifies programs as Type A or Type B using a dollar threshold that depends on total federal awards expended, identifies low-risk Type A programs, risk-assesses larger Type B programs, and selects major programs so they cover at least 40 percent of total federal awards expended, or 20 percent for a low-risk auditee.

When is the single audit due?

Within 30 calendar days after the auditee receives the auditor's reports or nine months after the end of the audit period, whichever is earlier.

Who prepares the SEFA?

The auditee prepares the schedule of expenditures of federal awards. The auditor tests it and reports on it in relation to the financial statements as a whole.

Is a single audit the same as a Yellow Book audit?

No. A single audit includes a financial statement audit under GAAS and Government Auditing Standards, plus a compliance audit of major programs. A Yellow Book audit of financial statements alone is not a single audit.

Sources

• 2 CFR 200.501, Audit requirements (threshold $1,000,000; effective for fiscal years beginning on or after October 1, 2024 under the April 2024 OMB revisions to 2 CFR 200, 89 FR 30046): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-F
• 2 CFR 200.502 (Basis for determining Federal awards expended); 200.510 (Financial statements; SEFA); 200.512 (Report submission); 200.514 (Scope of audit); 200.515 (Audit reporting); 200.516 (Audit findings); 200.518 (Major program determination); 200.520 (Criteria for a low-risk auditee)
• OMB, 2 CFR Part 200 Appendix XI, Compliance Supplement (current year)
• GAO, Government Auditing Standards: 2024 Revision (GAO-24-106786)
• AICPA, AU-C Section 725, Supplementary Information in Relation to the Financial Statements as a Whole; AU-C Section 530, Audit Sampling
• AICPA, Peer Review Standards (must-select engagements, including audits under Government Auditing Standards)

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error