AU-C section 935, Compliance Audits, is the AICPA standard for an audit of an entity's compliance with specified requirements, where a governmental audit requirement calls for an opinion on that compliance. It came from SAS No. 117 (effective for compliance audits for fiscal periods ending on or after June 15, 2010) and now sits in the AU-C codification. It does not stand alone. The auditor applies it together with GAAS, with GAGAS when the audit requirement calls for it, and with the governmental audit requirement itself.
The most common governmental audit requirement is the single audit under 2 CFR Part 200, Subpart F. This page covers AU-C 935's role in that audit and elsewhere. The program-level mechanics are in the OMB Compliance Supplement and the single audit walkthrough. For the broader compliance audit and attestation picture, see the compliance audit guide and checklist.
When does AU-C 935 apply?
It applies when the auditor is engaged, or required by law, regulation or contract, to perform a compliance audit under GAAS and a governmental audit requirement that calls for an opinion on compliance. The Uniform Guidance is the largest example. State and local programs, HUD and other agency requirements can also call for it. If the engagement only requires an opinion on financial statements, AU-C 935 does not come into play.
The compliance audit usually runs alongside a financial statement audit. The auditor reports on both, and the documentation shows which standard each procedure serves.
How does it fit with the Uniform Guidance and GAGAS?
2 CFR 200.514 sets the scope for a single audit. The audit must follow GAGAS and, beyond GAGAS, the auditor must:
- understand internal control over federal programs well enough to plan the audit to support a low assessed level of control risk for major programs, then plan and perform tests of that control, unless internal control is likely to be ineffective for particular requirements;
- determine whether the auditee complied with statutes, regulations and award terms that have a direct and material effect on each major program, and obtain sufficient appropriate audit evidence to support an opinion on compliance;
- follow up on all prior audit findings, assess the reasonableness of the auditee's summary schedule of prior audit findings, and report as a current-year finding if that schedule materially misrepresents the status of a prior finding; and
- complete and sign specified sections of the data collection form.
AU-C 935 provides the AICPA's framework for the compliance portion: understanding the applicable compliance requirements and internal control over compliance, assessing the risk of material noncompliance, performing further procedures, obtaining management's representations, and forming and reporting the opinion. Where the Uniform Guidance adds a requirement, the auditor performs it in addition.
What reports does a single audit produce?
2 CFR 200.515 lists the reporting. The reports may be combined or separate and must state that the audit was conducted in accordance with Part 200:
- An opinion (or disclaimer) on whether the financial statements are presented fairly, and a determination whether the schedule of expenditures of federal awards is fairly stated in relation to the financial statements as a whole.
- A report on internal control over financial reporting and compliance and other matters, describing the scope and results of those tests.
- A report on internal control over compliance for major programs, with an opinion (or disclaimer) on whether the auditee complied with the federal requirements that could have a direct and material effect on each major program.
- A schedule of findings and questioned costs, with a summary of the auditor's results, financial statement findings and federal award findings and questioned costs.
The summary of the auditor's results includes the type of opinion on the financial statements, whether significant deficiencies or material weaknesses were disclosed for the financial statements and for major programs, whether material noncompliance was disclosed, the type of opinion on major program compliance, each major program identified, the dollar threshold separating type A and type B programs, and whether the auditee qualified as low-risk. See the schedule of findings and questioned costs template.
Which AU-C sections do not apply to a compliance audit?
The appendix to AU-C 935 lists AU-C sections, and individual paragraphs of others, that are not applicable. The listing as shown in SAS 150 includes the entire sections on:
- AU-C 250, consideration of laws and regulations
- AU-C 505, external confirmations
- AU-C 540, accounting estimates
- AU-C 550, related parties
- AU-C 570, going concern
- AU-C 701, key audit matters, and AU-C 703, ERISA plan audits
- AU-C 708, 720, 725 and 730, covering consistency, other information, supplementary information and required supplementary information
- AU-C 800, 805, 806, 810, 910, 915, 920, 925, 930, 940 and 945
It also excludes designated paragraphs of AU-C 210, 240, 315, 330, 510, 560, 600A, 700, 705 and 706. An auditor may apply an excluded section or paragraph if doing so provides appropriate evidence for the compliance opinion. In a combined engagement, the financial statement audit still applies those sections to the financial statements. So AU-C 570 applies to the going concern evaluation in the financial statement audit even though it is not part of the compliance audit.
What amendments are in the pipeline?
- SAS 148 updated the appendix and made conforming changes after SAS 142 (audit evidence) and SAS 145 (risk assessment). The AU-C 501 change in the appendix is effective for compliance audits for fiscal periods ending on or after December 15, 2022, and the rest for fiscal periods ending on or after December 15, 2023.
- SAS 146 amended AU-C 935 to conform to the quality management standard for engagements, effective for compliance audits for fiscal periods ending on or after December 15, 2025. See SAS 146.
- SAS 150 amends the AU-C 935 appendix, effective for compliance audits for fiscal periods ending on or after December 15, 2028. See AU-C 505.
How does the opinion get modified?
A material instance of noncompliance with a requirement for a major program leads to a modification of the compliance opinion, following the reporting framework in AU-C 935 and the principles in AU-C 705. Material weaknesses and significant deficiencies in internal control over compliance are reported in the internal control report and as findings.
Illustration (illustrative)
A county has three major programs. The auditor finds that one program drew down funds before the cash was needed, and the Part 3 requirement for cash management is subject to audit. If the cash management failures are material to that program, the compliance report carries a qualified opinion identifying the program and the requirement, and the opinion on the other two programs stays unmodified. The finding appears in the schedule of findings and questioned costs with a cause, criteria, condition and effect, and in the data collection form. If the same finding also affects the financial statements, it appears in both sections of the schedule.
Common problems
These are practice observations, not findings from a published source:
- Treating AU-C 935 as a checklist add-on rather than the standard that governs the compliance opinion.
- Using the financial statement materiality level for compliance testing.
- Assuming AU-C 250 or AU-C 505 applies to the compliance audit because they apply to the financial statement audit.
- Documenting the compliance risk assessment at the entity level only, with no link to each major program's requirements.
- Not documenting which procedures serve the financial statement audit and which serve the compliance audit.
Frequently asked questions
What is the difference between AU-C 935 and AT-C 315?
AU-C 935 is a compliance audit under GAAS in which the auditor expresses an opinion on compliance as part of an audit-type engagement where a governmental audit requirement calls for it. AT-C 315 is a compliance attestation engagement under the attestation standards. See the compliance audit guide.
Does a single audit use AU-C 935?
Yes. A single audit combines a GAAS and GAGAS financial statement audit with a compliance audit under AU-C 935 and 2 CFR Part 200, Subpart F.
Do the AU-C 570 going concern requirements apply to the compliance audit?
No. The appendix excludes AU-C 570 from the compliance audit, but it applies to the financial statement audit.
When does SAS 146 affect compliance audits?
For compliance audits for fiscal periods ending on or after December 15, 2025.
Which opinion does the auditor give on major programs?
An opinion, or a disclaimer, on whether the auditee complied with the federal requirements that could have a direct and material effect on each major program, under 2 CFR 200.515.
Sources
- AICPA, SAS No. 117, Compliance Audits, as amended (AU-C section 935), in AICPA Professional Standards.
- AICPA, SAS No. 150, External Confirmations (July 2026), Appendix A: amendment to AU-C 935, including the appendix of AU-C sections not applicable to compliance audits.
- AICPA, SAS No. 146 (June 2022), amendment to AU-C 935 and its effective date.
- AICPA, SAS No. 148 (August 2022), amendment to AU-C 935; Journal of Accountancy, February 2022, on the proposal.
- 2 CFR 200.514 and 200.515, Standards and scope of audit; audit reporting. https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-F
Related
- OMB Compliance Supplement
- Single audit walkthrough
- Compliance audit guide and checklist
- Yellow Book 2024 revision
- Single audit
- Uniform Guidance
- Single audit engagement letter template
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error