The Compliance Supplement, published by OMB as Appendix XI to 2 CFR Part 200, tells auditors which compliance requirements the federal government expects them to test for each federal program in a single audit. Without it, an auditor would research laws and regulations program by program. The 2025 edition describes it as identifying existing compliance requirements that could have a direct and material effect on a program, and says that for single audits it replaces agency audit guides for individual programs.
This page explains the structure, how to use it, and the limits on relying on it. For the engagement as a whole, see the single audit walkthrough and AU-C 935.
Which edition applies?
OMB's page lists the 2025 Compliance Supplement (November 2025) as the current edition, and it states that this supplement is effective for audits of fiscal years beginning after June 30, 2024 and supersedes the 2024 edition (dated May 2024). A June 30, 2025 year end is the first under it; a calendar-year 2025 audit uses it.
The same Part 1 notes the Uniform Guidance changes behind the update. OMB revised 2 CFR Part 200, Subpart F in April 2024, raising the single audit threshold to $1,000,000 for auditee fiscal years beginning on or after October 1, 2024 (from $750,000).
What is in the Supplement?
Part 1 describes the parts:
- Part 1, Background, purpose and applicability. Includes the effective date and the rules on safe harbor.
- Part 2, Matrix of compliance requirements. Lists federal programs, the agency, the Assistance Listing number and which of 12 types of compliance requirements are subject to audit, marked "Y" or "N."
- Part 3, Compliance requirements. Describes the 12 types and, except for special tests and provisions, the audit objectives and suggested procedures, including internal control objectives. For 2025 it is split into Part 3.1, for awards subject to the Uniform Guidance as it stood before the 2024 revisions, and Part 3.2, for awards subject to the 2024 revisions.
- Part 4, Agency program requirements. For each included program, the objectives, procedures and compliance requirements, plus the audit objectives and procedures for special tests and provisions. It also lists other clusters.
- Part 5, Clusters of programs. Research and Development, Student Financial Assistance and a list of other clusters in Part 4.
- Part 6, Internal control. Objectives, principles and components based on GAO's Green Book and the COSO 2014 framework, with illustrations of entity-wide controls and controls for each compliance requirement.
- Part 7, Programs not included. Guidance to identify requirements and design tests.
- Part 8, Appendices. Including the list of changes, higher-risk designated programs, program-specific audit guides, audit advisories and agency contacts.
What are the 12 compliance requirement types?
The Part 3 types are lettered: A activities allowed or unallowed, B allowable costs and cost principles, C cash management, E eligibility, F equipment and real property management, G matching, level of effort and earmarking, H period of performance, I procurement and suspension and debarment, J program income, L reporting, M subrecipient monitoring, and N special tests and provisions. The Supplement treats A and B as one requirement for counting purposes.
What is the six-requirement limit?
The Supplement continues a practice begun in 2019 of limiting the compliance requirements subject to audit for each program to six. A and B together count as one. The Research and Development cluster has seven. An agency may choose fewer than six. Programs not in the Supplement are not subject to the six-requirement limit.
How does the auditor use the Supplement?
- Identify major programs under 2 CFR 200.518. See type A and type B programs.
- Find each major program in Part 2. Read the "Y" requirements across the matrix.
- Read the program's Part 4 or Part 5 section for program objectives, procedures and special tests.
- Use the right Part 3. Part 3.1 or 3.2 depending on which Uniform Guidance version governs the award. The Supplement tells auditors not to apply 2024 revision requirements where the federal agency has not implemented them for the award. Federal agencies implemented the revisions at different times, from as early as June 21, 2024 for new awards, to as late as October 1, 2025, and HHS adopted specific sections on October 1, 2024 with the rest on October 1, 2025. A client with awards from several agencies can have both versions in one audit.
- Perform reasonable procedures to confirm currency. Laws change between Supplement updates. The Supplement says reasonable procedures include inquiry of recipient or subrecipient management and a review of the awards for the major programs.
- Design the tests. The suggested audit procedures are general. The auditor decides whether they achieve the stated audit objectives.
- Test internal control. Subpart F requires an understanding of internal control over federal programs sufficient to plan the audit to support a low assessed level of control risk for major programs, and unless internal control is likely to be ineffective, to perform the planned testing. Part 6 supports that.
When is the Supplement a safe harbor?
Not for procedures. The Supplement says the auditor cannot treat the suggested procedures as a safe harbor. For the identification of compliance requirements for included programs, the auditor can consider it a safe harbor if the auditor (1) performs the reasonable procedures to confirm currency and look for additional award provisions, and (2) augments the Supplement's requirements as appropriate.
A requirement marked "N" in the matrix is not subject to the audit and is not expected to be tested. The Supplement is explicit about two limits on that: auditors still have responsibilities under GAAS and GAGAS for noncompliance with laws, regulations, contracts and grant agreements that may have a direct and material effect on the financial statements, and for fraud and abuse considerations.
Illustration (illustrative)
A nonprofit's major program shows "Y" for procurement and suspension and debarment and "N" for matching. The grant agreement sets a 20% match, and the auditor notices it in the file. Under the Supplement's own examples, because matching is "N," the auditor is not expected to consider the match provisions in the compliance audit. Because procurement is "Y," the auditor does inquire of management and reads the award for added procurement conditions, such as a specific award condition under 2 CFR 200.208, before finalizing the program's audit program. The 20% match remains a matter for management and the grantor, and the auditor still considers whether non-compliance with it could have a direct and material effect on the financial statements.
What if the program is not in the Supplement?
Part 7 applies. The auditor uses the types of compliance requirements in Part 3 to identify requirements that could have a direct and material effect, and designs tests accordingly. For program-specific audits performed under a federal agency's audit guide, the auditor follows that guide.
Common problems
These are practice observations, not findings from a published source:
- Using last year's Supplement because the file template points to it.
- Using Part 3.2 for every award without checking whether the agency has implemented the 2024 revisions on that specific award.
- Treating the matrix "Y" as a complete audit program and not reading the Part 4 special tests.
- Not documenting the currency procedures that support the safe harbor.
- Reading "N" as permission to ignore a grant condition that bears on the financial statements.
Frequently asked questions
What is the current Compliance Supplement?
The 2025 edition, published as Appendix XI to 2 CFR Part 200, effective for audits of fiscal years beginning after June 30, 2024.
Is the Compliance Supplement mandatory?
The 2025 Supplement states that use of the Supplement is mandatory and that adherence to it satisfies the requirements of 2 CFR Part 200, Subpart F. Auditors must also consider the referenced laws, regulations and 2 CFR Part 200.
How many compliance requirements are tested per program?
At most six per program, with A and B counted as one. The Research and Development cluster has seven.
What do I use for a program not in the Supplement?
Part 7 of the Supplement and the types of compliance requirements in Part 3.
What is the single audit threshold in the 2025 Supplement?
$1,000,000 for auditee fiscal years beginning on or after October 1, 2024.
Sources
- Office of Management and Budget, 2025 Compliance Supplement (2 CFR Part 200 Appendix XI), Part 1, Background, Purpose, and Applicability. https://www.whitehouse.gov/omb/compliance-supplement/
- 2 CFR Part 200, Subpart F, Audit Requirements, and Appendix XI. https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
- 89 Fed. Reg. 30046 (April 22, 2024), OMB revisions to 2 CFR Part 200.
Related
- Single audit walkthrough under the Uniform Guidance
- AU-C 935 compliance audits
- Yellow Book 2024 revision
- Schedule of expenditures of federal awards
- Schedule of findings and questioned costs template
- Single audit engagement letter template
- Nonprofit audit requirements
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Government, single audit and nonprofits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error