Government Auditing Standards: the Yellow Book overlay on a single audit

• State the effective dates of the 2024 revision of Government Auditing Standards
• Apply the GAGAS independence framework to nonaudit services for a single audit client
• Identify the GAGAS CPE and peer review requirements that apply to auditors and firms
• Explain the additional GAGAS reporting on internal control and compliance

Why GAGAS applies

2 CFR 200.514(a) requires a single audit to be conducted under GAGAS, the Government Auditing Standards issued by the Comptroller General (the Yellow Book). For a financial audit, GAGAS incorporates the AICPA's generally accepted auditing standards and adds requirements on ethics, independence, competence, quality management and reporting. So every single audit is a GAAS audit plus GAGAS plus Subpart F, with AU-C 935 governing the compliance opinion.

The 2024 revision and its dates

GAO issued the 2024 revision (GAO-24-106786) in February 2024. It is effective for financial audits, attestation engagements and reviews of financial statements for periods beginning on or after December 15, 2025, and for performance audits beginning on or after December 15, 2025. Systems of quality management must be designed and implemented by December 15, 2025, with the evaluation due by December 15, 2026. Early implementation was permitted.

The main change is chapter 5. "Quality Control and Peer Review" became "Quality Management, Engagement Quality Reviews, and Peer Review," a risk-based, scalable approach that mirrors the AICPA's shift to quality management. A firm that designs its system under SQMS No. 1 still has to add the GAGAS-specific requirements, such as CPE, independence and peer review. The 2024 Yellow Book revision page summarizes the other changes.

Independence and nonaudit services

GAGAS uses a conceptual framework: identify threats to independence, evaluate their significance, and apply safeguards to eliminate them or reduce them to an acceptable level. Single audit clients often ask the auditor to prepare the SEFA, the financial statements or the data collection form, or to help with indirect cost work. Under GAGAS:

• the auditor may not assume management responsibilities;
• before providing a nonaudit service, the auditor determines that the entity has designated an individual with suitable skill, knowledge or experience to oversee the service and that management accepts responsibility for it;
• preparing the financial statements in their entirety from a client-provided trial balance or underlying records creates significant threats, so the auditor documents the threats and the safeguards applied; and
• the evaluation and safeguards are documented.

GAGAS independence rules are in addition to the AICPA Code. Where they differ, the auditor complies with both. The GAGAS 2024 independence guide covers the threat categories.

Competence and CPE

Auditors who plan, direct, perform engagement procedures for, or report on a GAGAS engagement must complete 80 hours of CPE every two years. At least 24 of those hours must directly relate to government auditing, the government environment or the specific or unique environment in which the audited entity operates. The Yellow Book CPE guide covers who is in scope and how firms track it.

Peer review

An audit organization performing GAGAS engagements must obtain an external peer review at least once every three years and make the report available, which is why 200.509(a) tells auditees to request it during procurement.

GAGAS reporting

In addition to the AU-C 700 opinion, a GAGAS financial audit includes a report on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts and grant agreements, describing the scope of testing and its results. In a single audit this becomes the report required by 200.515(b). GAGAS also sets requirements for reporting fraud and noncompliance with provisions of laws, regulations, contracts and grant agreements, and the report states that the audit was conducted under GAGAS.

Common file mistakes

• No documented independence evaluation for SEFA or financial statement preparation.
• Staff on the engagement without the 24 government-related CPE hours.
• The firm's quality management documentation ignores GAGAS-specific requirements.
• The auditor's report cites the wrong edition of GAGAS for the period.

Which Yellow Book applies, and is the senior covered?