Single Audit: Requirements, Thresholds, and Reporting

If your organization spent $1,000,000 or more in federal awards during its fiscal year, federal law requires a single audit: one combined review of your financial statements and your compliance with the rules attached to every federal program you touched. The single audit requirements sit in the Office of Management and Budget’s Uniform Guidance at 2 CFR Part 200, Subpart F, and they apply to states, local and tribal governments, nonprofits, and colleges and universities alike.¹ The $1,000,000 floor is new: it replaced the old $750,000 threshold for fiscal years beginning on or after October 1, 2024, so some organizations that used to trigger the requirement now fall below it.²

When You Need a Single Audit

The trigger is total federal awards expended in a fiscal year, not awarded and not received. Money sitting unspent in your account doesn’t count toward the threshold. Money you passed through to a subrecipient does.²

Both direct federal funding and indirect funding count. A grant that came straight from a federal agency and a grant that reached you through a state pass-through both add to the same total.³ Fall below $1,000,000 and you’re exempt from the audit requirement for that year, though federal agencies and the Government Accountability Office still have the right to review your records.

How Federal Loans Count

Loans can push you over the line without any new grant money hitting your books. When the federal government carries risk until a loan is repaid, the expenditure figure includes new loans made or received during the audit period, the beginning-of-year balance of older loans that still carry federal compliance obligations, and any interest subsidy or administrative cost allowance you received.¹ Older loans that impose no continuing compliance requirement beyond repayment don’t count. For student loans issued by outside lenders, only new loans during the audit period count toward the university’s threshold.

The Program-Specific Audit Alternative

If you cross $1,000,000 but every dollar of that spending is under a single federal program, you can elect a program-specific audit instead of a full single audit. This narrower option is only available when there is one federal program (excluding research and development) and that program’s own rules don’t independently require a financial statement audit.²

How Often, and What Happens If You Skip It

Single audits are annual. The one carve-out: a state, local, or tribal entity whose constitution or statutes required less-frequent audits as of January 1, 1987, can conduct a biennial audit covering both fiscal years.⁴

Skipping a required audit isn’t a paperwork problem. Federal agencies and pass-throughs can withhold a percentage of payments until you complete the audit, disallow overhead costs, or suspend the award. Continued refusal can lead to termination of current funding and ineligibility for future awards.¹

The Two Parts of a Single Audit

Every single audit has a financial statement audit and a compliance audit. The financial statement piece follows Generally Accepted Government Auditing Standards and asks whether your financial statements are fairly presented under generally accepted accounting principles (or a permitted special-purpose framework such as cash basis), and whether there are any material weaknesses in your internal controls over financial reporting.⁵

The compliance piece is what sets a single audit apart. Your auditor tests whether you actually followed the rules attached to your federal programs: were funds spent on allowable activities, did recipients meet eligibility criteria, did cash management practices meet federal requirements, were required reports accurate and on time. The 2025 OMB Compliance Supplement lists 12 types of compliance requirements that may apply, and its matrix maps which ones attach to each federal program, so auditors test only the requirements relevant to your programs.⁶ Categories include allowable activities and costs, cash management, eligibility, equipment and real property management, matching and earmarking, period of availability, procurement, program income, reporting, subrecipient monitoring, and special tests.

The Schedule of Expenditures of Federal Awards

Before compliance testing starts, you prepare the Schedule of Expenditures of Federal Awards, or SEFA. It lists every federal program you spent money on that year, organized by federal agency and Assistance Listing Number, with total expenditures per program.⁷ The SEFA is the auditor’s roadmap for deciding what gets tested in depth. Leaving programs off it, or misclassifying them, is one of the most common reasons an engagement runs late.

How Major Programs Get Picked

Your auditor doesn’t test every program on the SEFA. The Uniform Guidance uses a risk-based method to identify “major programs” that receive detailed compliance testing. Every program is first classified as Type A (larger) or Type B (smaller). For entities spending between $1,000,000 and $34 million, the Type A floor is $1,000,000; for larger entities, the floor rises through tiers up to 0.15 percent of total federal expenditures for entities spending more than $20 billion.⁸

All Type A programs are presumed major unless the auditor concludes they’re low risk. The auditor then pulls in high-risk Type B programs. Total coverage of major programs must reach at least 40 percent of federal expenditures for most entities, or 20 percent for entities that qualify as low-risk auditees.¹

Why Low-Risk Auditee Status Is Worth Chasing

Qualifying as a low-risk auditee cuts required coverage in half. Less testing means shorter fieldwork and lower fees. To earn the status, your organization must meet all of these conditions for each of the two preceding audit periods:⁹

Single audits were performed annually and filed with the Federal Audit Clearinghouse on time. Entities on a biennial schedule don’t qualify.
The auditor issued unmodified opinions on both the financial statements and the SEFA.
No internal control deficiencies were identified as material weaknesses under GAGAS.
The auditor didn’t report substantial doubt about the entity’s ability to continue as a going concern.
No Type A program had material control weaknesses, modified opinions, or questioned costs above 5 percent of that program’s total expenditures.

Losing the status because of one bad year means two consecutive clean audits to get it back, which is why organizations tend to fix findings quickly rather than let them recur.

Selecting an Auditor

You can’t simply add a single audit to your regular CPA’s engagement letter. The Uniform Guidance requires you to follow federal procurement standards to hire the auditor, which generally means a competitive process: issue a request for proposals and evaluate firms on experience, staff qualifications, and technical approach rather than defaulting to the lowest bid.¹

One requirement people miss: you must request a copy of each prospective firm’s peer review report. GAGAS makes audit firms undergo periodic external quality reviews, and those results should feed into your decision.¹

Fees vary widely. Organizations with a few programs and clean records may pay in the range of $10,000 to $20,000; large entities with dozens of programs run well into six figures. Disorganized records push costs higher regardless of size, because the auditor spends more hours reconstructing transactions.

The Reporting Package and the Filing Deadline

The audit produces a reporting package that includes the auditor’s opinions on the financial statements and on federal program compliance, reports on internal controls, the SEFA, and the Schedule of Findings and Questioned Costs.

That schedule is the heart of the package. It documents financial statement findings, internal control findings related to federal awards, and compliance findings related to federal awards.¹⁰ Questioned costs above $25,000 for a compliance requirement type within a major program must be reported as findings.¹¹ For any current-year finding, you prepare a corrective action plan naming what will be fixed, who is responsible, and when it will be done. The package also carries a summary schedule of prior audit findings so agencies can track whether problems are being resolved or repeating.

The full package plus a data collection form and your certification go to the Federal Audit Clearinghouse at fac.gov, the central repository federal agencies and pass-throughs use to access audit results. The deadline is the earlier of 30 calendar days after you receive the auditor’s report or nine months after the end of the audit period. For a June 30 fiscal year-end, that’s March 31. Extensions exist but must be authorized by the cognizant or oversight agency. Miss the deadline and you can lose low-risk auditee status and draw sanctions from federal awarding agencies.¹²

What Happens After a Finding

Findings don’t just sit in the report. The federal awarding agency or pass-through entity responsible for the program must issue a management decision within six months of the FAC accepting the audit.¹³ The decision tells you whether questioned costs are sustained (disallowed) or allowed, and what corrective action the agency expects.

When costs are disallowed, repayment typically happens through a reduction in future grant payments or a direct payment back to the agency. Your corrective action plan is the baseline the agency uses to track progress, and you’re expected to begin acting on findings immediately rather than waiting for the formal management decision.

If You Pass Money to Subrecipients

Passing federal funds to a subrecipient makes you a pass-through entity, and that role carries monitoring obligations that go past writing the check. Under the Uniform Guidance, you must evaluate each subrecipient’s risk of noncompliance before making the subaward, weighing experience, prior audit results, staffing changes, and the complexity of the program.¹⁴

Ongoing monitoring means reviewing financial and performance reports, ensuring the subrecipient takes corrective action on problems (including single audit findings related to your subaward), and confirming that subrecipients over the expenditure threshold actually get audited. You also verify in SAM.gov that potential subrecipients aren’t suspended or debarred. When a subrecipient’s single audit surfaces findings tied to your subaward, you issue the management decision on those findings and resolve them.¹⁴ Failing to monitor subrecipients is itself a finding that will land in your own single audit.

1
eCFR. 2 CFR Part 200 Subpart F – Audit Requirements
2
eCFR. 2 CFR 200.501 – Audit Requirements
3
Office of the Law Revision Counsel. 31 USC Chapter 75 – Requirements for Single Audits
4
eCFR. 2 CFR 200.504 – Frequency of Audits
5
U.S. Department of Health and Human Services Office of Inspector General. Single Audits Frequently Asked Questions
6
Federal Audit Clearinghouse. 2025 Compliance Supplement
7
eCFR. 2 CFR 200.510 – Financial Statements
8
eCFR. 2 CFR 200.518 – Major Program Determination
9
eCFR. 2 CFR 200.520 – Criteria for a Low-Risk Auditee
10
eCFR. 2 CFR Part 200 Subpart F – Auditors
11
eCFR. 2 CFR 200.516 – Audit Findings
12
eCFR. 2 CFR 200.512 – Report Submission
13
eCFR. 2 CFR 200.521 – Management Decisions
14
eCFR. 2 CFR 200.332 – Requirements for Pass-Through Entities