Yes, nonprofits do get audited, and the requirement usually comes from one of three places: federal grant spending, state charity registration laws, or a condition written into a grant agreement or loan. The single clearest federal trigger is spending $1,000,000 or more in federal awards during a fiscal year, which requires a Single Audit under the Uniform Guidance.1eCFR. 2 CFR 200.501 – Audit Requirements State thresholds vary widely, and a funder can require an audit even when no law does. Plenty of small nonprofits go their whole existence without one; plenty of others get audited every year.
The IRS itself, worth noting up front, is not the usual driver here. Form 990 asks whether the organization’s financial statements were audited by an independent accountant and whether a Single Audit was required, but federal tax law does not by itself force most tax-exempt organizations to obtain an independent financial audit.2Internal Revenue Service. 2025 Instructions for Form 990 The requirements come from elsewhere.
The Federal Single Audit Threshold
Any nonprofit that spends $1,000,000 or more in federal awards during its fiscal year must complete a Single Audit under 2 CFR Part 200, Subpart F.1eCFR. 2 CFR 200.501 – Audit Requirements The number to watch is spending, not receipts: an organization that draws down federal award money slowly can stay under the line even with a large grant on the books, while one that spends aggressively can cross it. The threshold was raised from $750,000 as part of the 2024 Uniform Guidance revisions and applies to fiscal years beginning on or after October 1, 2024.3Election Assistance Commission. 2024 Uniform Guidance Revisions Organizations spending less than $1,000,000 in federal awards are exempt from the Single Audit requirement, though their records must still be available for federal agency and Government Accountability Office review.
A Single Audit is not the same as a standard financial statement audit. The auditor also tests compliance with the specific terms attached to each major federal program the organization received, following the Office of Management and Budget’s annual Compliance Supplement.4The White House. Compliance Supplement That extra compliance testing is what makes Single Audits more expensive than ordinary audits.
The completed report and a data collection form must be submitted to the Federal Audit Clearinghouse within 30 days after the auditor delivers the report or nine months after the end of the audit period, whichever comes first.5eCFR. 2 CFR 200.512 – Report Submission Miss the deadline or skip the audit and future federal funding is at risk. Form 990 asks directly whether a required Single Audit was actually performed, and the answer is publicly visible.2Internal Revenue Service. 2025 Instructions for Form 990
State Charity Audit Thresholds
Most states require charities that solicit donations to register with the state attorney general or secretary of state and to submit financial reports each year. Once gross revenue or contributions cross a certain line, that reporting requirement escalates from basic financial statements to a full audit conducted by an independent CPA.
The specific dollar figure differs significantly from state to state. Some states set the bar at $500,000 in annual contributions or revenue. Others don’t require an audit until gross revenue exceeds $1,000,000, or even $2,000,000. A handful tie the requirement to whether the organization uses professional fundraisers rather than to a revenue number alone.
Which state’s rule applies isn’t always obvious. Nonprofits registered to solicit in multiple states are subject to each state’s threshold separately, so an organization comfortably below the audit line at home can be above it in a state where it also solicits. Failing to meet a state’s audit requirement can lead to penalties, delayed registration renewals, and loss of good standing with state charity regulators. Check the specific rule with each state’s attorney general or secretary of state.
Some states will accept a review (a lower-assurance engagement, described further below) in place of a full audit for organizations that fall between a lower reporting floor and the full audit threshold. That option can save meaningful money if it applies.
Audits Required by Funders and Lenders
Even when no law requires an audit, many nonprofits face one because a private funder or lender demands it. Large private foundations routinely require grantees to provide audited financial statements as a condition of funding, especially for multi-year grants or awards above a certain dollar amount. Banks and other lenders extending credit to a nonprofit often require annual audited statements to assess financial health and repayment capacity.
These requirements catch smaller organizations off guard more than any other trigger. A group that has never needed an audit can find one attached to its first major grant. Building the cost and timeline into the grant budget before accepting the award is far cheaper than scrambling for a CPA later.
When an Audit Isn’t Required: Reviews, Compilations, and Preparations
An audit is the highest tier of CPA engagement, but it isn’t the only one. State laws and funders sometimes accept a lower level of assurance, and understanding the differences helps in reading a state statute or a grant agreement.
Audit
An audit provides the highest level of assurance. The CPA firm confirms account balances with banks and other third parties, inspects assets, examines supporting documents for transactions, and evaluates internal controls. The end product is a formal opinion on whether the financial statements are fairly presented in accordance with Generally Accepted Accounting Principles.6Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
Review
A review provides limited assurance. The CPA performs analytical procedures and asks management questions about the financial statements but does not confirm balances with outside parties, inspect assets, or test internal controls. The report states that the CPA is not aware of any material changes needed for the statements to conform with GAAP. Many states accept a review in place of an audit for organizations that fall below the full audit threshold but above a lower reporting floor.
Compilation
A compilation provides no assurance at all. The CPA helps management format financial information into proper financial statement form but does not verify or test any of the underlying data. The report states that the statements have not been audited or reviewed. Compilations are generally useful only for internal purposes or organizations with minimal external reporting needs.
Preparation
A preparation engagement is more basic still. Under AR-C Section 70, the CPA prepares financial statements from information management provides, but issues no report. Each page must include a notation that “no assurance is provided.” Preparation engagements carry no weight with regulators or funders who require any level of independent assurance.
What a Nonprofit Audit Actually Examines
Nonprofit accounting follows specialized rules under FASB Accounting Standards Codification Topic 958, and those rules create audit focus areas that don’t exist in the for-profit world. Knowing where an auditor will look helps an organization know whether its records are ready.
Net Asset Classification
Nonprofits must separate net assets into two categories: those with donor restrictions and those without. A donor restriction exists when the donor specifies that a gift must be used for a particular purpose or after a particular date.7Financial Accounting Standards Board. ASU 2018-08 – Not-for-Profit Entities (Topic 958) Auditors verify that restricted funds were spent in accordance with the donor’s terms and that the organization only released the restriction when the conditions were genuinely satisfied. Getting this wrong overstates the money available to spend freely and misleads the board, donors, and regulators.
Functional Expense Reporting
Nonprofits must report expenses by function, split into program services, management and general, and fundraising. Auditors examine the methodology used to allocate shared costs like rent, utilities, and executive salaries across those categories. An organization that pushes too many shared costs into the program column to make its overhead ratio look better will draw scrutiny. The allocation method must be systematic and applied consistently.
Revenue Recognition for Contributions
Contributions follow different rules than fees for services. Under ASC 958, unconditional promises to give (pledges) are recognized as revenue when the promise is made, not when the cash arrives.7Financial Accounting Standards Board. ASU 2018-08 – Not-for-Profit Entities (Topic 958) Conditional contributions aren’t recognized until the barrier or condition is overcome. Auditors test whether the organization drew this line correctly, because recording a conditional grant as revenue too early inflates the financial statements. In-kind donations add complexity: donated goods and services must be properly valued, and only qualifying contributed services can be recorded.
Internal Controls
Auditors evaluate whether the organization has adequate safeguards against errors and fraud in its financial reporting. For small nonprofits with limited staff, this often comes down to segregation of duties. The person who opens the mail and logs incoming checks should not also make bank deposits. The person who prepares payroll should not distribute paychecks. Someone independent of the bookkeeping function should review bank statements regularly. When controls have weaknesses, the auditor reports them to management and the board.
What a Nonprofit Audit Costs
Audit fees for small to mid-sized nonprofits generally fall in the range of $5,000 to $20,000 or more, depending on revenue, number of programs, funding complexity, and geographic footprint. Single Audits cost more than standard financial statement audits because of the added compliance testing. Organizations with clean records, well-organized documentation, and strong internal controls pay less, because the auditor can work more efficiently. First-year audits are almost always more expensive than subsequent years, since the auditor has to build an understanding of the organization from scratch.
Some funders allow audit costs to be included as a direct or indirect expense in grant budgets. For organizations that anticipate a Single Audit, building the cost into federal award budgets from the outset is far better than absorbing it from unrestricted funds afterward.
Whether Your Audit Status Is Public
It is. Form 990 Part XII asks whether the organization’s financial statements were compiled, reviewed, or audited by an independent accountant, and whether a Single Audit was required and completed. The answers are visible on the return, and Form 990s are broadly accessible online through sites like Candid (formerly GuideStar).8Office of the Law Revision Counsel. 26 U.S. Code 6104 – Publicity of Information Required From Certain Exempt Organizations and Certain Trusts2Internal Revenue Service. 2025 Instructions for Form 990 Form 990 does not generally require the audited financial statements themselves to be attached; that requirement applies only to hospital organizations filing Schedule H.9Internal Revenue Service. Form 990 Attachments: Permitted and Impermissible Attachments
State charity registration filings, including audited financial statements submitted to a state attorney general or secretary of state, are generally public records. Single Audit reports filed with the Federal Audit Clearinghouse are publicly accessible as well. An organization that answers “no” to the audit question on Form 990 when funders or state law expected a “yes” creates an immediate credibility problem, because anyone comparing the return to the applicable requirement can see the mismatch.
The short version: a nonprofit gets audited when federal award spending, a state charity law, or a funder’s contract says it must. Check federal spending against the $1,000,000 threshold, check each state where the organization is registered, and read every grant agreement for an audit clause before signing.