Yellow Book (GAGAS): A Practical Guide for CPA Firms

The Yellow Book is the common name for Government Auditing Standards, issued by the US Government Accountability Office (GAO). The standards it contains are called generally accepted government auditing standards (GAGAS). Many small and mid-size CPA firms meet the Yellow Book for the first time through a nonprofit client that receives federal grants, a local government, a housing authority or a school district.

For a financial audit, GAGAS does not replace GAAS. It incorporates the AICPA's auditing standards and adds requirements on top: stricter independence rules, specific CPE, peer review, and extra reporting on internal control and compliance. This guide covers the parts that change how a CPA firm plans, staffs and reports on an engagement. It paraphrases the standards; the full text is published free by GAO at gao.gov (GAO-24-106786).

What is the Yellow Book?

The Yellow Book sets standards for audits of government entities, entities that receive government awards, and other audits where law, regulation, contract or policy calls for GAGAS. It covers three main types of engagement:

1. Financial audits, including audits of financial statements.
2. Attestation engagements and reviews of financial statements, including examinations, reviews and agreed-upon procedures.
3. Performance audits, which assess program effectiveness, efficiency, internal control or compliance.

Most CPA firm work under GAGAS is financial statement audits, often combined with a Single Audit.

Which edition is in effect

GAO revises the Yellow Book periodically. The 2018 revision (with its April 2021 technical update) governed most engagements in recent years. GAO issued the 2024 revision (GAO-24-106786) in February 2024. It is effective for financial audits, attestation engagements and reviews of financial statements for periods beginning on or after December 15, 2025, so a calendar-year 2026 audit falls under it. An audit organization's system of quality management had to be designed and implemented by December 15, 2025, with the first evaluation of the system completed by December 15, 2026. The newer edition aligns the quality management requirements more closely with the AICPA's quality management standards (SQMS No. 1), so update your firm's GAGAS policies accordingly.

When does GAGAS apply?

GAGAS applies when a law, regulation, contract, grant agreement or policy requires it. CPA firms usually encounter it through:

• Single Audits under the Single Audit Act and the Uniform Guidance (2 CFR 200, Subpart F). A non-federal entity that expends federal awards at or above the threshold in a fiscal year must have a Single Audit, which includes a financial statement audit performed under GAGAS. The Uniform Guidance revisions issued in 2024 raised the threshold from $750,000 to $1,000,000 for fiscal years beginning on or after October 1, 2024.
• State and local government audits, where state law or the oversight agency requires GAGAS.
• Program-specific audits and audits required by particular federal agencies, such as HUD for certain housing programs.
• Grant agreements or contracts that name GAGAS as the audit standard.

An entity can also ask for a GAGAS audit voluntarily. Once the auditor states that the engagement was performed under GAGAS, all applicable GAGAS requirements apply.

Does a Single Audit change the financial statement audit?

The financial statement audit portion follows GAAS plus GAGAS. The compliance audit of major federal programs follows the Uniform Guidance and AU-C 935, Compliance Audits, in addition. The Single Audit adds its own reports, including the auditor's report on compliance for each major program and on internal control over compliance, and the schedule of findings and questioned costs.

How GAGAS adds to GAAS

For a financial audit, GAGAS incorporates AICPA's Statements on Auditing Standards by reference and adds requirements in these areas:

Independence under the Yellow Book

The conceptual framework

GAGAS uses a conceptual framework for independence. The auditor identifies threats, evaluates their significance, and applies safeguards to eliminate them or reduce them to an acceptable level. The threat categories include self-interest, self-review, bias, familiarity, undue influence, management participation and structural threats.

GAGAS independence requirements apply in addition to the AICPA Code of Professional Conduct. Where the two differ, the auditor follows the more restrictive one.

Nonaudit services

GAGAS nonaudit services rules are generally more restrictive than the AICPA Code. Key points:

• Management responsibilities. Auditors may not assume management responsibilities, such as making decisions, approving transactions, or having custody of assets.
• Skills, knowledge and experience. Before providing a nonaudit service, the auditor determines that management has designated an individual with suitable skill, knowledge or experience (often called SKE) to oversee the service, evaluate its adequacy and accept responsibility for the results. The individual does not need to be able to perform the service.
• Significant threats. The Yellow Book treats certain services as creating significant threats that require safeguards. Under the 2024 revision (para. 3.88), preparing the financial statements in their entirety from a client-provided trial balance or underlying accounting records creates significant threats; the auditor documents the threats and the safeguards applied, or declines the service. Determining or changing journal entries or account classifications without management's approval, authorizing transactions, and changing source documents without approval impair independence (para. 3.87). Other services related to preparing accounting records and financial statements are identified as threats to evaluate (para. 3.89). Safeguards might include having a professional who was not on the audit team perform the service, or having the work reviewed by such a professional.
• Prohibited services. Some services impair independence regardless of safeguards, for example certain internal audit services, some IT system design and implementation services, and others listed in the standard.
• Documentation. The auditor documents the threats identified, the safeguards applied, the evaluation of management's SKE, and the understanding with management about the nonaudit service.

For a small firm that drafts its client's financial statements, these rules mean the file needs more than a checkbox. Document who on management has the SKE, why, and what safeguards were applied.

Practical steps

1. List every nonaudit service provided to the audited entity, including tax and bookkeeping.
2. Evaluate each against the GAGAS rules, not just the AICPA Code.
3. Identify management's designated individual and document the basis for concluding that person has suitable SKE.
4. Apply and document safeguards for significant threats.
5. Revisit the evaluation if the services change during the year.

CPE requirements: the 80/24 rule

GAGAS requires auditors who plan, direct, perform engagement procedures for, or report on GAGAS engagements to maintain competence through continuing professional education. Under the 2024 revision (paragraphs 4.16 and 4.17):

• 80 hours every two years, of which
• at least 24 hours must directly relate to government auditing, the government environment, or the specific or unique environment in which the audited entity operates, and
• at least 20 hours must be completed in each year of the two-year period.

The audit organization may exempt an auditor from the 56-hour portion, but not the 24 hours, only if the auditor both charges less than 20 percent of their time annually to GAGAS engagements and is involved only in performing engagement procedures, not in planning, directing or reporting on the engagement. Nonsupervisory auditors who charge less than 40 hours a year to GAGAS engagements may be exempted from the CPE requirement altogether. Specialists and some others have different requirements.

The 24 hours can include topics such as the Yellow Book itself, the Uniform Guidance, governmental accounting under GASB standards, and the program environment of the audited entity. Hours on general auditing topics count toward the 56-hour category, not the 24.

GAO publishes separate guidance on GAGAS CPE that explains what qualifies. Track GAGAS hours separately from state licensing CPE, since the measurement periods and subject requirements may not line up. The CPE chapter also covers proration for auditors assigned to GAGAS work partway through a period.

Quality management and peer review

Audit organizations performing GAGAS engagements must have a system of quality management and undergo an external peer review at least once every three years. For CPA firms enrolled in the AICPA Peer Review Program, a peer review covering GAGAS engagements typically satisfies this, provided at least one GAGAS engagement is selected for review where the firm performs them.

Peer review results matter beyond the firm. GAGAS requires an external audit organization to make its most recent peer review report publicly available, and to give the party contracting for GAGAS services its most recent peer review report, and any later ones during the contract, when requested (paras. 5.172 and 5.174).

Reporting on internal control and compliance

The additional report

For a financial audit under GAGAS, the auditor reports on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts and grant agreements that have a material effect on the financial statements. This report can be included in the auditor's report on the financial statements or issued separately. A separate report is a common choice, with a title along the lines of "Report on Internal Control Over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards."

The report does not express an opinion on internal control or on compliance. It describes the scope of the auditor's testing, states that the testing was not designed to provide an opinion, and reports deficiencies and instances of noncompliance found.

What gets reported

• Significant deficiencies and material weaknesses in internal control, defined as in AU-C 265.
• Instances of noncompliance with provisions of laws, regulations, contracts or grant agreements that have a material effect on the financial statements.
• Fraud that is material, either quantitatively or qualitatively, to the financial statements.
• Waste and abuse are not something the auditor must perform procedures to detect in a financial audit. Under the 2024 revision, if they come to the auditor's attention, the auditor may consider whether and how to communicate them, and considers whether they indicate fraud or noncompliance.

Elements of a finding

GAGAS findings are written with specific elements, to the extent relevant:

1. Criteria: what should be, such as the law, policy or control requirement.
2. Condition: what the auditor found.
3. Cause: why the condition occurred.
4. Effect or potential effect: the consequence, or the risk if uncorrected.

Recommendations and the views of responsible officials are also included. Obtain management's written response early so that it does not delay report release.

The GAGAS statement in the report

The auditor's report on the financial statements states that the audit was conducted in accordance with GAAS and GAGAS. If a GAGAS requirement was not followed, the report includes a modified compliance statement explaining the departure, the reason, and its effect on the engagement.

Fieldwork points that differ from a pure GAAS audit

• Previous engagements. Evaluate whether the entity has taken corrective action on findings and recommendations from previous engagements that could have a significant effect on the subject matter, and use that in assessing risk.
• Noncompliance and fraud. Extend procedures when information indicates noncompliance with provisions of contracts or grant agreements, or fraud, that could be material.
• Findings development. Gather enough evidence to support each element of a finding.
• Documentation. GAGAS adds documentation requirements on top of AU-C 230, for example documenting any departures from GAGAS requirements and their effect.

Materiality still comes from AU-C 320, though for a government entity materiality is typically considered by opinion unit, and the public accountability of the entity and the needs of report users bear on the judgment. Risk assessment follows AU-C 315.

FAQ

Does GAGAS replace GAAS for a financial statement audit?

No. GAGAS incorporates the AICPA auditing standards and adds requirements. A GAGAS financial audit is a GAAS audit plus the additional Yellow Book requirements.

Who needs the 80 hours of Yellow Book CPE?

Everyone who plans, directs, performs procedures for or reports on a GAGAS engagement needs 80 hours every two years, with at least 24 related to government and at least 20 in each year. The only reduction to 24 hours is for auditors who charge less than 20 percent of their time to GAGAS work and only perform procedures, without planning, directing or reporting; nonsupervisory auditors under 40 GAGAS hours a year may be exempted entirely.

Is financial statement preparation a prohibited service under GAGAS?

Not automatically. Under both the 2018 and 2024 revisions, preparing the financial statements in their entirety from a client-provided trial balance or records creates significant threats that need safeguards and documentation, and management must have a designated individual with suitable skill, knowledge or experience to oversee the service.

Does the report on internal control include an opinion?

No. The GAGAS report on internal control and compliance describes the scope of testing and any findings but does not express an opinion on internal control or on compliance.

Where can I read the Yellow Book?

GAO publishes Government Auditing Standards free on its website, gao.gov, along with related guidance on CPE and independence.

Sources

• GAO, Government Auditing Standards: 2024 Revision (GAO-24-106786), issued February 1, 2024; effective for periods beginning on or after December 15, 2025 (chapters 3, 4, 5 and 6): https://www.gao.gov/yellowbook
• GAO, Government Auditing Standards: 2018 Revision (GAO-18-568G), with April 2021 technical update (GAO-21-368G)
• 2 CFR 200.501, Audit requirements (Single Audit threshold of $1,000,000 for fiscal years beginning on or after October 1, 2024): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-F
• AICPA, AU-C Section 935, Compliance Audits; AU-C Section 265; AU-C Section 230; AU-C Section 315; AU-C Section 320
• AICPA, SQMS No. 1, A Firm's System of Quality Management

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error