A single audit does not test every Federal program. The auditor tests the programs that the rules classify as major, and the rules for classifying them sit in 2 CFR 200.518. Two neighboring sections supply the criteria: 200.519 covers Federal program risk and 200.520 covers the low-risk auditee. Getting the determination wrong is expensive in both directions. Too few major programs fails the coverage rule and can invalidate the audit. Too many adds compliance testing the rules did not require.
The numbering trips people up. The major program process is in 200.518. Section 200.520 is the low-risk auditee test that decides whether coverage is 20% or 40%. This page paraphrases the regulation as it reads on eCFR. Read 2 CFR part 200, Subpart F, for the full text.
What is the approach?
The auditor must use a risk-based approach that considers current and prior audit experience, oversight by Federal agencies and pass-through entities, and the inherent risk of the Federal program. The process in paragraphs (b) through (h) of 200.518 must be followed, and the auditor must document the risk analysis in the audit documentation (paragraph (g)).
Step one: label Type A and Type B programs
Type A programs are the larger programs, defined by Federal awards expended exceeding the level in Table 1 of paragraph (b)(1):
| Total Federal awards expended by the auditee | Type A threshold |
|---|---|
| $1,000,000 to $34 million | $1,000,000 |
| Over $34 million to $100 million | Total expended x 0.03 |
| Over $100 million to $1 billion | $3 million |
| Over $1 billion to $10 billion | Total expended x 0.003 |
| Over $10 billion to $20 billion | $30 million |
| Over $20 billion | Total expended x 0.0015 |
Programs that are not Type A are Type B. A cluster of programs is treated as one program.
Large loans. A program providing loans is a large loan program when it exceeds four times the largest non-loan program, and a program counts as a loan program only if loans make up 50% or more of its Federal awards expended. Each large loan program is a Type A program, and its value is excluded when determining the threshold for the other programs, so large loans do not push other programs down to Type B.
For biennial audits, Type A and B are based on awards expended over the two-year audit period.
Step two: identify low-risk Type A programs
For a Type A program to be low-risk it must have been audited as a major program in at least one of the two most recent audit periods (the most recent period for a biennial audit), and in the most recent audit period it must not have had any of these:
- internal control deficiencies identified as material weaknesses in the auditor's report on internal control for major programs
- a modified opinion on the program in the report on major programs
- known or likely questioned costs exceeding 5% of the total Federal awards expended for the program
The auditor must also consider whether the 200.519(c) oversight criteria, audit follow-up results, or changes in personnel or systems indicate significantly increased risk. OMB can approve a Federal agency request that a particular Type A program not be treated as low-risk for a given recipient, with notice to the auditee at least 180 calendar days before fiscal year end.
Step three: identify high-risk Type B programs
The auditor identifies high-risk Type B programs using professional judgment and the criteria in 200.519. The auditor need not identify more high-risk Type B programs than at least one-fourth of the number of low-risk Type A programs found in step two. A single risk criterion would rarely make a Type B program high-risk, except for a known material weakness in internal control or compliance problems.
The auditor performs risk assessments only on Type B programs that exceed 25% of the Type A threshold. Smaller programs are not assessed.
Section 200.519 groups the risk criteria into current and prior audit experience (control weaknesses, prior audit findings, programs not recently audited as major), oversight by Federal agencies and pass-through entities, and the inherent risk of the program (complexity, extent of contracting out, program phase in its lifecycle at the agency and at the auditee, and larger Type B programs being higher risk than substantially smaller ones). Programs made up mainly of payroll may carry high risk on the time-and-effort rules in 200.430 and low risk otherwise.
Step four: select the major programs
At a minimum the auditor audits as major:
- all Type A programs not identified as low-risk in step two
- all Type B programs identified as high-risk in step three
- additional programs as needed to meet the percentage of coverage rule
The coverage rule and the low-risk auditee
Under paragraph (f), the audit must cover at least 40% of total Federal awards expended in the aggregate through major programs. If the auditee meets the criteria in 200.520, coverage drops to 20%.
To be a low-risk auditee under 200.520, the auditee must meet all of these conditions for each of the two preceding audit periods:
- single audits were performed annually under Subpart F, including timely submission of the data collection form and reporting package to the Federal Audit Clearinghouse (biennial audit auditees do not qualify)
- the opinion on the financial statements and the in-relation-to opinion on the schedule of expenditures of Federal awards were unmodified
- no internal control deficiencies were identified as material weaknesses under GAGAS
- no substantial doubt about going concern was reported
- no Federal program had, in either of the two preceding audit periods in which it was classified Type A, a material weakness in the major program report, a modified opinion on a major program, or known or likely questioned costs exceeding 5% of the program's Federal awards expended
A worked illustration
Illustrative numbers only. An auditee expended $12,000,000 in Federal awards across six programs: A at $5,000,000, B at $3,000,000, C at $2,200,000, D at $900,000, E at $600,000 and F at $300,000. The total is $5,000,000 + $3,000,000 + $2,200,000 + $900,000 + $600,000 + $300,000 = $12,000,000.
| Step | Result |
|---|---|
| Type A threshold | $12,000,000 is within $1,000,000 to $34 million, so the threshold is $1,000,000 |
| Type A | A, B, C (each exceeds $1,000,000) |
| Type B | D, E, F |
| Low-risk Type A | B was audited as major last year with no findings and no other flags, so it is low-risk. A and C are not low-risk |
| Type B risk assessment floor | 25% x $1,000,000 = $250,000, so D, E and F are all assessed |
| High-risk Type B | The auditor judges D high-risk because of a weak subrecipient monitoring system |
| Major programs | A, C and D |
| Coverage | $5,000,000 + $2,200,000 + $900,000 = $8,100,000, which is 67.5% of $12,000,000 |
That is above both 40% and 20%, so no additional programs are needed. If the auditee had not been low-risk and D had not been high-risk, A and C alone would give $7,200,000, or 60%, still above 40%.
What are the common problems?
Practice observations built from the text, not requirements of the regulation:
- Low-risk status assumed, not tested. A program is low-risk only with a prior major audit and a clean most recent period. Check the prior year's report.
- Biennial audit and low-risk auditee. A biennial auditee cannot meet 200.520(a).
- Risk analysis missing from the file. Paragraph (g) requires the analysis in the audit documentation. The major program determination worksheet records each step.
- Clusters counted as separate programs or the reverse, which moves the Type A line.
- Large loan treatment forgotten. Include the 50% and four-times tests when a loan program is present.
- Late filing of the reporting package in either of the two preceding years removes low-risk auditee status. See the 200.501 threshold and reporting deadline.
Frequently asked questions
What is the Type A threshold for a small auditee?
For total Federal awards expended from $1,000,000 up to $34 million, the Type A threshold is $1,000,000. Programs exceeding that level are Type A.
How much of the auditee's Federal awards must major programs cover?
At least 40%, or 20% when the auditee qualifies as low-risk under 200.520.
Can the auditor skip a low-risk Type A program?
Yes, a Type A program identified as low-risk under step two need not be audited as major unless needed to meet the percentage of coverage rule.
Can a Federal agency challenge the auditor's major program determination?
The auditor's judgment is presumed correct when the determination was performed and documented in accordance with Subpart F. Challenges by a Federal agency or pass-through entity are limited to clearly improper use of the requirements.
Sources
- eCFR, 2 CFR 200.518, 200.519 and 200.520 (current text, retrieved November 2026): ecfr.gov
- OMB, Guidance for Federal Financial Assistance, 89 Fed. Reg. 30046 (April 22, 2024)
Related
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error