What Is a Yellow Book Audit and When Is One Required?

A Yellow Book audit is an engagement performed under Government Auditing Standards (GAGAS), the framework the U.S. Government Accountability Office publishes to govern how public funds are audited.¹ The nickname comes from the yellow cover of the publication. These standards apply to audits of federal, state, and local government entities, and to private organizations that receive federal funding. Compared with a standard financial audit, a Yellow Book engagement demands broader testing, stricter auditor independence, and additional written reports.

How It Differs From a Standard Audit

Most private-sector audits follow the American Institute of Certified Public Accountants’ standards. A Yellow Book audit incorporates those AICPA standards by reference and adds requirements on top of them.² The added weight lands in three places.

Scope is broader. A standard audit asks whether the financial statements are fairly presented. A Yellow Book audit asks that same question and then tests whether the entity complied with the laws, regulations, contracts, and grant agreements that govern how it spends public money.

Independence is stricter. GAGAS limits the non-audit services an auditor can provide to the same entity it audits, and it requires the auditor to document an independence assessment for every engagement.

Reporting is expanded. The auditor issues separate written reports on internal controls over financial reporting and on compliance, in addition to the opinion on the financial statements themselves.

Who Needs a Yellow Book Audit

Federal agencies, state departments, county offices, and municipal governments are subject to GAGAS as a matter of course because they spend public funds directly.¹

The requirement also reaches private nonprofits, universities, and other non-governmental organizations that accept federal grants, contracts, or subcontracts. Once federal money is on the books, the strings attached often include a GAGAS-compliant audit for the funded activities.

The Single Audit Threshold

For non-federal entities, the most common trigger is the Single Audit requirement under the Uniform Guidance. Any non-federal entity that spends $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit conducted in accordance with the Yellow Book.³ The threshold was $750,000 until an April 2024 revision of the Uniform Guidance raised it to $1,000,000 for audit periods beginning on or after October 1, 2024.⁴ Organizations that spend below the threshold are exempt from federal audit requirements for that year, though federal agencies and the GAO can still review their records.

The Three Engagement Types

GAGAS covers three distinct engagement types, each answering a different question about how public resources are managed.¹

Financial Audits

A financial audit determines whether the entity’s financial statements are presented fairly under the applicable accounting framework. Under GAGAS, the auditor also reports on internal controls over financial reporting and tests compliance with laws, regulations, and grant agreements that could materially affect the financial statements.² That dual focus is the core difference from a private-sector financial audit.

Attestation Engagements

Attestation engagements provide assurance on a specific assertion someone else has prepared. A state agency might assert that it distributed 95% of disaster relief funds within 60 days, and the auditor examines or reviews the evidence supporting that claim. The level of assurance ranges from high (an examination) to moderate (a review) to reporting factual findings (agreed-upon procedures).² The scope is limited to whatever assertion the engagement is designed to evaluate.

Performance Audits

Performance audits are the broadest category and the one most unique to the public sector. Instead of asking whether the numbers are right, a performance audit asks whether a program is working. Is a public works project cost-effective? Are benefits reaching the intended recipients on time? Are resources being wasted? The auditor evaluates program effectiveness, economy, and efficiency, then provides recommendations for improvement.

Requirements Placed on the Auditor

The Yellow Book holds auditors to a higher standard than a typical commercial engagement. If you are hiring a firm to perform GAGAS work, these are the qualifications the firm must be able to demonstrate.

Independence

GAGAS uses a conceptual framework to evaluate auditor independence. Rather than simply listing prohibited relationships, the framework requires auditors to identify threats to their objectivity and then determine whether safeguards can reduce those threats to an acceptable level.² Some threats are considered so significant that no safeguard can fix them. An auditor who supervises an entity’s ongoing internal control monitoring or designs the entity’s financial information system cannot audit that same entity. The 2024 revision specifically addresses IT services: designing, significantly modifying, or operating an audited entity’s financial or operational IT systems impairs independence when those systems play a significant role in the area being audited.

Continuing Professional Education

Every auditor who plans, directs, performs procedures for, or reports on a GAGAS engagement must complete at least 80 hours of continuing professional education every two years, with a minimum of 20 hours in each individual year.² At least 24 of those 80 hours must cover topics directly related to government auditing, the government environment, or the specific environment in which the audited entity operates. The remaining 56 hours can cover broader professional topics.

Peer Review

Every audit organization performing GAGAS work must undergo an external peer review at least once every three years.⁵ The review examines whether the firm’s quality management system is properly designed and whether the firm is actually following it, and produces a public report with a rating of pass, pass with deficiencies, or fail.⁶ A firm with a failing rating is effectively disqualified from continuing GAGAS work for federal and state agencies until the deficiencies are resolved. Before you engage a firm, ask for its most recent peer review report.

The Reports You Receive

A Yellow Book financial audit produces a package of reports rather than a single opinion letter. The auditor issues an opinion on the financial statements, a separate report on internal controls over financial reporting, and a separate report on compliance with laws, regulations, and grant agreements.

The internal control report describes the auditor’s understanding of the entity’s controls over financial reporting and the results of testing them. Any significant deficiencies or material weaknesses must be identified and communicated in writing to management and those charged with governance. A significant deficiency is a control problem serious enough to merit attention but not severe enough to be classified as a material weakness. Reporting at this lower threshold is one of the ways GAGAS surfaces problems earlier than a standard audit would.

The compliance report covers whether the entity followed the laws, regulations, contracts, and grant agreements that could materially affect its financial statements. Instances of noncompliance are detailed and communicated to the entity’s governing body and, where applicable, to the funding agency. A finding of noncompliance can trigger consequences ranging from corrective action plans to loss of future funding.

Single Audit Submission Deadlines

Organizations subject to a Single Audit face a firm submission deadline. The completed audit, data collection form, and full reporting package must be submitted to the Federal Audit Clearinghouse within 30 calendar days after receiving the auditor’s report, or nine months after the end of the audit period, whichever comes first.⁷ If the deadline falls on a weekend or federal holiday, it shifts to the next business day. The cognizant or oversight agency for audit can grant an extension when the nine-month timeframe would create an undue burden, but extensions require a request and a demonstrated need.

What Happens If You Skip the Audit

When a non-federal entity cannot or will not complete a required audit, the federal agency or pass-through entity has a range of enforcement tools under the Uniform Guidance:⁸

Withholding payments until the entity takes corrective action.
Disallowing costs associated with the noncompliant activity, requiring repayment.
Suspending or terminating the award, partially or fully.
Initiating debarment proceedings to bar the entity from receiving future federal awards.
Denying new awards or continuation funding for the program.

These remedies apply after the agency determines that imposing specific conditions was not enough to fix the problem. Agencies typically start with corrective action plans and escalate from there.

The 2024 Yellow Book Revision

The GAO released a major revision of Government Auditing Standards in 2024, superseding the 2018 edition. The 2024 revision takes effect for financial audits, attestation engagements, and performance audits with periods beginning on or after December 15, 2025. Early adoption is permitted.⁹

The biggest structural change is the shift from quality control to quality management. The previous framework asked audit organizations to maintain a set of policies; the new framework requires leadership to take an active role in managing quality through risk assessments, tailored monitoring, and optional engagement quality reviews for higher-risk work.² Audit organizations must have their quality management systems designed and implemented by December 15, 2025, and must complete their first evaluation of those systems by December 15, 2026.

The independence rules received targeted updates as well. The revision explicitly addresses IT services and clarifies that supervising an entity’s ongoing internal control monitoring creates an unacceptable threat to independence regardless of safeguards. The CPE requirements are unchanged.

1
U.S. Government Accountability Office. Government Auditing Standards
2
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision
3
eCFR. 2 CFR 200.501 – Audit Requirements
4
Office of Inspector General, U.S. Department of Health and Human Services. Single Audits FAQs
5
U.S. Government Accountability Office. Peer Review Reports
6
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision
7
eCFR. 2 CFR 200.512 – Report Submission
8
eCFR. 2 CFR 200.339 – Remedies for Noncompliance
9
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision