Government Auditing Standards, the Yellow Book, is issued by the Comptroller General of the United States through GAO. The 2024 revision (GAO-24-106786, February 2024) supersedes the 2018 revision as updated in April 2021 (GAO-21-368G). Auditors who perform single audits, HUD and state-required audits, and audits of governments and nonprofits that take federal money follow it alongside AICPA standards, so a CPA firm with any of that work has a transition to manage.
This page is a change log. For what GAGAS is and how it layers on GAAS, see Yellow Book (GAGAS) explained and the GAGAS glossary entry.
When does the 2024 Yellow Book apply?
GAO's own statement on the cover of the standards sets the dates:
- Financial audits, attestation engagements and reviews of financial statements: periods beginning on or after December 15, 2025.
- Performance audits: audits beginning on or after December 15, 2025.
- System of quality management: required to be designed and implemented by December 15, 2025. The audit organization should complete its evaluation of the system by December 15, 2026.
- Early implementation: permitted.
The trigger for a financial audit is the start of the period under audit, not its end, and that differs from how AICPA effective dates are usually written ("periods ending on or after"). GAO's yellowbook page also notes that, because of a lapse in federal funding in 2025, federal government audit organizations could defer designing and implementing their system until March 16, 2026. That relief is for federal audit organizations, not CPA firms.
Illustration (illustrative dates)
A county has a June 30 fiscal year. The year ending June 30, 2026 began July 1, 2025, which is before December 15, 2025, so the 2018 revision (with the 2021 update) governs that audit unless the firm chose early implementation. The year ending June 30, 2027 began July 1, 2026, which is after the cutoff, so the 2024 revision governs. A calendar-year nonprofit's audit of the year beginning January 1, 2026 is the first under the 2024 revision. A calendar-year audit for 2025 began January 1, 2025 and stays under the 2018 edition.
What is the major change?
GAO describes the 2024 revision as containing major changes in one area. Chapter 5, "Quality Management, Engagement Quality Reviews, and Peer Review," replaces the old chapter 5, "Quality Control and Peer Review." The approach moves from quality control to quality management. The stated themes are:
- Leadership responsibility for proactively managing quality on engagements.
- A quality management risk assessment process: set quality objectives, identify and assess quality risks, and design responses to those risks (paragraph 5.04).
- Scalability. The nature, extent and formality of the system varies with size, offices, personnel experience, engagement complexity and cost-benefit (paragraph 5.12).
- Proactive monitoring that is tailored, giving a sufficient basis for the organization's evaluation of its system.
- Optional engagement quality reviews used to address quality risks.
- Flexibility for organizations that must use GAGAS for some engagements and another standard setter's quality management standards for the rest, so they do not run two systems.
The only other substantive addition GAO names is application guidance in chapter 6, "Standards for Financial Audits," on key audit matters.
What does a CPA firm already under SQMS 1 have to add?
Paragraph 5.07 answers this. A nongovernment audit organization subject to the quality management standards of the AICPA, the IAASB or the PCAOB follows that body's requirements plus three GAGAS paragraphs:
- 5.55c: if an engagement ends before completion and no audit report is issued, document the work done to the date of termination and why the engagement was terminated.
- 5.55d: if the engagement objectives change during the engagement, document the revised objectives and the reasons.
- 5.74c: auditors performing GAGAS work meet the CPE requirements.
A firm that is not subject to one of those bodies' standards applies paragraphs 5.05 through 5.138 (and the engagement quality review paragraphs, 5.139 through 5.154, if it uses reviews). Most CPA firms issuing GAAS audits are under the AICPA's SQMS No. 1, so the practical work is to extend the firm's SQMS 1 system with the three additions and keep the GAGAS-specific CPE tracking. For the AICPA side, see SQMS 1 for small firms.
What do the quality management paragraphs require of an organization that applies them?
For government audit organizations and any nongovernment organization outside the recognized standards, paragraph 5.05 requires a system that gives reasonable assurance that the organization and its personnel meet their responsibilities under professional standards and law, and perform and report on engagements accordingly. Paragraphs 5.13 and 5.14 call for assigning ultimate accountability to a senior-level official and operational responsibility to named individuals who have the experience, authority and time for the job. The system is evaluated and a conclusion reached under paragraph 5.130.
How does the engagement quality review work?
Under the 2024 revision an engagement quality review is a risk response rather than an automatic requirement. The audit organization may decide it is appropriate for all GAGAS engagements, for specific types, or for specifically identified engagements, or that none is needed to address its quality risks (paragraph 5.141). Where it uses them, it sets eligibility criteria for reviewers. For the AICPA mechanics, see the engagement quality review guide and AU-C 220.
What about peer review?
The peer review requirement carries into chapter 5. An audit organization not already subject to a peer review requirement obtains an external peer review at least once every three years, with the first covering a review period ending no later than three years from when it began its first GAGAS engagement (paragraph 5.179). The paragraph applies to organizations "not already subject to" a peer review requirement, which is why a firm already enrolled in a peer review program looks first to that program's terms.
What does the key audit matter guidance say?
Paragraph 6.39 says GAGAS itself does not require communicating key audit matters in the auditor's report. It adds application guidance for the situation where law, regulation or the engagement terms require them for audits of government entities and entities that receive government financial assistance. Report content for GAAS audits is in AU-C 700.
What did not change?
GAO lists no change to the independence framework, the continuing professional education rules or the financial audit reporting requirements beyond the items above. The CPE rule remains at least 80 hours in every two-year period for auditors who plan, direct, perform procedures for or report on GAGAS engagements, with at least 24 hours in subject matter directly related to the government environment, government auditing or the audited entity's specific environment (chapter 4). Single audit mechanics under the Uniform Guidance are separate; see the single audit walkthrough and AU-C 935 compliance audits.
Where do firms get stuck in the transition?
These are practice observations, not findings from a published source:
- Assuming the "periods ending" convention applies, and so mis-assigning June 30 and September 30 year-end clients.
- Updating the audit report's GAGAS reference and the checklist but not the firm's quality management policies.
- Treating the December 15, 2026 evaluation as a peer review item rather than a deliverable the firm must produce itself.
- Missing the three additional paragraphs (5.55c, 5.55d, 5.74c) because the firm assumes SQMS 1 covers everything.
- Not tracking GAGAS CPE separately from the firm's general CPE records.
Frequently asked questions
Is the 2024 Yellow Book effective for periods beginning or ending after December 15, 2025?
Beginning. For financial audits, attestation engagements and reviews of financial statements it applies to periods beginning on or after December 15, 2025. For performance audits it applies to audits beginning on or after that date.
Did the independence rules change in the 2024 revision?
GAO's summary of changes does not list independence. It lists the chapter 5 rewrite and the new chapter 6 application guidance on key audit matters. Apply the 2024 text of chapter 3 for any engagement that falls under it.
Does my firm need a separate GAGAS quality management system if it follows SQMS 1?
No. Paragraph 5.07 has a nongovernment audit organization subject to AICPA quality management standards follow those requirements plus paragraphs 5.55c, 5.55d and 5.74c.
Can I adopt the 2024 revision early?
Yes. Early implementation is permitted, so a firm can apply it to an audit of a period that began before December 15, 2025 if it is ready.
Do the 2024 changes affect the single audit report?
The changes are to quality management and to chapter 6 guidance. Single audit reporting still follows GAGAS, AU-C 935 and 2 CFR 200 Subpart F.
Sources
- U.S. Government Accountability Office, Government Auditing Standards: 2024 Revision, GAO-24-106786 (February 2024): cover statement on effective dates; Letter (summary of changes); chapter 4 (CPE); chapter 5 paragraphs 5.04, 5.05, 5.07, 5.12-5.14, 5.55, 5.74, 5.130, 5.139-5.141, 5.179; chapter 6 paragraph 6.39. https://www.gao.gov/yellowbook
- U.S. Government Accountability Office, Yellow Book overview and implementation page, including the federal organization deferral and GAO-26-108710 (FAQs on establishing and maintaining a system of quality management). https://www.gao.gov/yellowbook/overview
- AICPA, SQMS No. 1 (QM 10), A Firm's System of Quality Management, in AICPA Professional Standards.
Related
- Yellow Book (GAGAS) explained
- Single audit walkthrough under the Uniform Guidance
- SQMS 1 quality management guide
- AU-C 935 compliance audits
- Governmental audit
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Government, single audit and nonprofits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error