Federal Audit Clearinghouse: How to File the Single Audit Data Collection Form

The single audit is not finished when the auditor signs the reports. Under Subpart F of the Uniform Guidance, the auditee must also send the reporting package and a data collection form to the Federal Audit Clearinghouse (FAC), the federal government's repository of record for single audit reports. The rule is 2 CFR 200.512. This page covers the filing step: what goes in, who certifies, when it is due, and how corrections work. For the audit itself, see the single audit walk-through and the 2 CFR 200 overview.

What does 2 CFR 200.512 require?

The audit, the data collection form and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's report or nine months after the end of the audit period, whichever is earlier. If the due date falls on a Saturday, Sunday or federal holiday, the package is due the next business day. The cognizant agency for audit, or the oversight agency for audit where there is no cognizant agency, may authorize an extension when the nine-month deadline would place an undue burden on the auditee.

Two points follow from the wording.

• The 30 days run from when the auditee receives the report, not from the report date. In practice the auditor delivers the signed reports and the auditee's clock starts. Record the delivery date in the file.
• "Whichever is earlier" means a late-finishing audit can be late at filing even if the reports were delivered promptly. For a calendar-year entity the nine-month date is September 30 of the following year.

The auditee, not the auditor, is responsible for submission. 2 CFR 200.508 lists arranging the audit and ensuring it is "properly performed and submitted" as auditee duties. Most firms still guide the client through the FAC steps because the auditor certifies part of the form.

What is in the reporting package?

Section 200.512(c) defines it. The package has four components:

1. The financial statements and the schedule of expenditures of federal awards (SEFA)
2. The summary schedule of prior audit findings
3. The auditor's reports
4. The corrective action plan

The auditor's reports include the opinion on the financial statements, the in-relation-to opinion on the SEFA, the Yellow Book report on internal control and compliance, and the report on major program compliance and internal control, which 2 CFR 200.515 prescribes. The summary schedule of prior audit findings and the corrective action plan are the auditee's documents, not the auditor's. Section 200.511 requires the corrective action plan to be separate from the auditor's findings, and to name a contact person, the planned action and an anticipated completion date. See the summary schedule of prior audit findings template and the schedule of findings and questioned costs template.

Auditees must keep a copy of the data collection form and the reporting package for three years from the date of submission to the FAC (200.512(f)). The package is public unless a federal statute or regulation restricts it, and both auditee and auditor must make sure their parts contain no protected personally identifiable information. Indian Tribes and tribal organizations may opt out of public posting by omitting the authorization statement on the form.

What is the data collection form?

The form is the SF-SAC. Section 200.512(b) says it carries information about the auditee, its federal programs, the audit results and whether the audit was completed in accordance with Subpart F, using data elements and a format OMB approves. Two signed statements sit inside it.

• Auditee statement. A senior-level representative, such as the chief financial officer or chief executive officer, states that the form was prepared in accordance with Part 200, that the reporting package contains no protected personally identifiable information, that the information is accurate and complete, and that the FAC may publish the package and form.
• Auditor statement. The auditor completes the applicable data elements from the reporting package and states the source of the information, the auditor's responsibility for it, that the form does not replace the reporting package, and that the form's content is limited to what OMB prescribed.

On FAC.gov the SF-SAC is submitted as a set of Excel workbooks, alongside web forms and a PDF of the audit report. The FAC lists eight workbooks: federal awards (section 1), notes to the SEFA (2), federal awards findings (3), findings text (4) and the corrective action plan (5) are required. Additional UEIs (6), secondary auditors (7) and additional EINs (8) are optional and are needed only when the audit covers those facts.

How does a submission move through FAC.gov?

The FAC's own submission guide describes the sequence.

1. Accounts. Everyone who edits or certifies a submission needs a Login.gov account. Access is granted by entering the person's email address, and it must match the Login.gov email. The FAC does not notify people they were added, so tell them.
2. Start the audit. The FAC identifies entities by the 12-character Unique Entity ID (UEI) assigned through SAM.gov. You cannot start without a valid UEI. Enter the fiscal period start and end dates for the expenditures covered by the audit.
3. Eligibility. The FAC asks whether the entity meets the single audit criteria, using $750,000 for fiscal years beginning before October 1, 2024 and $1,000,000 for fiscal years beginning on or after that date.
4. Webforms and workbooks. Complete the general information form, the audit information form and the SF-SAC workbooks. The audit information form asks for the Type A/Type B dollar threshold, which cannot be below the threshold for the fiscal year, and whether the audit identified deficiencies, material weaknesses or material noncompliance.
5. Upload and validate. Upload the PDF of the audit report and the workbooks, then complete pre-certification validation.
6. Certify. The Auditor Certifying Official certifies first. The Auditee Certifying Official certifies last.
7. Submit. Only the Auditee Certifying Official can confirm the final submission. The date that official confirms is the FAC acceptance date. Processing can take up to 24 hours.

Each submission has one Auditee Certifying Official and one Auditor Certifying Official, and they must be different people. Anyone with access can change the roles, but the user must log out and back in for the change to take effect. Any change after certification must be re-validated and re-certified by both officials.

Credentials from the old Census Bureau system do not work on the GSA-run FAC. The FAC opened for audit year 2023 submissions on October 1, 2023.

How do you correct a filed submission?

A submission that the FAC has accepted cannot be edited. The FAC's resubmission guide offers three paths.

• Material change to the audit report PDF. This produces a new FAC acceptance date. The guide lists reasons that fall here, among them major program determination errors, audit findings errors or omissions, SEFA and federal program reporting errors, missing reporting package components, and low-risk auditee determination errors.
• Non-material change to the PDF. The acceptance date stays the same. Examples the guide gives include Assistance Listing number corrections where the SF-SAC is accurate.
• SF-SAC-only change. The acceptance date stays the same and the PDF cannot be edited.

Both certifying officials must re-certify. The UEI cannot be changed through resubmission and must match the auditee's UEI in SAM.gov. A material change that resets the acceptance date matters because a late acceptance date can affect the low-risk auditee test: 2 CFR 200.520(a) requires that the package was filed within the 200.512 timeframe in each of the preceding two audit periods.

What goes wrong at filing time?

Practice observations, not requirements:

• A UEI that is expired or does not match the SAM.gov registration, discovered after the audit is complete. Check it at planning.
• The Auditee Certifying Official is a person with no Login.gov account or an email that does not match, so certification stalls on the last day.
• SEFA workbook data that disagrees with the SEFA in the PDF, such as total expenditures, Assistance Listing numbers or cluster names.
• Findings in the schedule of findings and questioned costs with reference numbers that are missing from the findings workbook. Section 200.516(c) requires each finding to carry a reference number in the format the data collection form needs.
• A corrective action plan produced late by the client, so the reporting package is incomplete at the deadline.

FAQ

Who files the single audit with the FAC, the auditor or the client?

The auditee is responsible under 2 CFR 200.508 and 200.512. In practice both sides work in the FAC system. The auditor completes and certifies its part, and the auditee's certifying official confirms the final submission.

Does a program-specific audit go to the FAC too?

Yes. The FAC accepts both single audits and program-specific audits, and 2 CFR 200.512 applies to both. For a program-specific audit, the FAC guide says to answer "No" to the deficiency questions that do not apply and to enter the threshold amount for the fiscal year as a placeholder. See 2 CFR 200.507 for what a program-specific audit requires.

What if the audit will not be finished in time?

The cognizant agency for audit or the oversight agency for audit may authorize an extension of the nine-month period where it would place an undue burden on the auditee. Request it before the deadline and keep the approval in the file.

Does the form go to the FAC if the entity spent less than $1,000,000?

No Subpart F audit is required for fiscal years in which an entity expends less than $1,000,000 in federal awards, under 2 CFR 200.501(e), so there is nothing to file for that requirement. Records must still be available for review by federal officials, pass-through entities and GAO.

Sources

• eCFR, 2 CFR 200.512 Report submission, 200.508 Auditee responsibilities, 200.511 Audit findings follow-up, 200.515 Reporting, 200.516 Audit findings, 200.520 Criteria for a low-risk auditee: https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-F
• Federal Audit Clearinghouse, Audit submission resources and submission guide: https://www.fac.gov/audit-resources/
• Federal Audit Clearinghouse, Starting an audit, Completing an audit, Submitting an audit, Resubmitting an audit, SF-SAC workbooks, Managing user access: https://www.fac.gov/audit-resources/submission-guide/about/
• Federal Audit Clearinghouse, Frequently asked questions: https://www.fac.gov/faq/

Related

• Single audit and Uniform Guidance walk-through
• 2 CFR 200 Uniform Guidance overview
• Yellow Book (GAGAS)
• Single audit major program determination worksheet
• Single audit management representation letter
• Single audit glossary entry

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error