Single Audit Requirements: Who Needs One, What It Covers and What Happens After

Single audit requirements decide whether a state agency, county, city, school district, tribe, university or nonprofit must put its financial statements and federal award files in front of an independent auditor for the year, and what it must file afterward.

A single audit is an annual audit of the whole organization that tests its financial statements and, in the same engagement, its compliance with the rules of its major federal programs, which the auditor selects by risk. The rules sit in Subpart F of the Uniform Guidance, and most of the paperwork belongs to the auditee: the schedule of federal expenditures, the corrective action plan and the filing.

Quick Answer: What Are the Single Audit Requirements?

A government, university or nonprofit that expends $1,000,000 or more in federal awards in a fiscal year starting on or after October 1, 2024 needs a single audit of its financial statements and major programs. The package is due at the Federal Audit Clearinghouse 30 days after receiving the auditor's report or nine months after year end, whichever comes first.

Who Needs a Single Audit: Threshold and Exemptions

An entity needs a single audit when it expends $1,000,000 or more in federal awards during its fiscal year (2 CFR 200.501(a), eCFR, current as of October 2026). Below that amount it is exempt from the federal audit requirements for the year, but its records must stay available to the federal agency, the pass-through entity and the Government Accountability Office (2 CFR 200.501(e), eCFR, current as of October 2026).

The single audit threshold for 2026 is $1,000,000 for any fiscal year that started on or after October 1, 2024, and $750,000 for a fiscal year that started before that date (FAC Audit Submission Guide, read October 2026).

The increase from $750,000 came from OMB's 2024 revision of the Uniform Guidance, published April 22, 2024 and effective October 1, 2024 (89 FR 30046, Federal Register, April 22, 2024). Because the test follows the start of the fiscal year, an entity whose year began July 1, 2024 is still measured against $750,000, and one whose year began July 1, 2025 is measured against $1,000,000 (FAC Audit Submission Guide dates, read October 2026). Audited financial statements a funder may request are a separate question, covered in audited financials required for grants.

Uniform Guidance Audit Requirements: Who Counts as an Auditee

The audit rules apply to a state, local government, Indian tribe, institution of higher education or nonprofit organization that carries out a federal award as a recipient or subrecipient (2 CFR 200.1, eCFR, current as of October 2026). Subawards count toward your total. Payments you receive as a contractor for goods or services under a federal award do not (2 CFR 200.501(g), eCFR, current as of October 2026).

Subpart F does not apply to for-profit organizations. When a for-profit receives a subaward, the pass-through entity sets its compliance requirements in the subaward, and the methods may include pre-award audits, monitoring and post-award audits (2 CFR 200.501(i), eCFR, current as of October 2026). An SBIR startup or other company is therefore outside the single audit, though its award or subaward may still carry audit terms of its own.

Counting What You Expended

The test counts federal awards expended, not awards received. An award is expended when the activity related to it occurs, which includes expenditures, disbursements to subrecipients and use of loan proceeds, and Medicare payments for patient care do not count (2 CFR 200.502, eCFR, current as of October 2026).

Program-Specific Audits and Audit Frequency

An entity that expends federal awards under only one program, other than research and development, may elect a program-specific audit if that program's rules do not require a financial statement audit (2 CFR 200.501(c), eCFR, current as of October 2026). For research and development, the election needs all awards from one agency (or one agency through one pass-through entity) and advance approval (2 CFR 200.501(d)). Audits are annual; biennial audits survive only for governments and nonprofits that met conditions dating from 1987 and 1995 (2 CFR 200.504, eCFR, current as of October 2026).

OMB's 2026 Proposal Is Not the Rule

OMB proposed a rewrite of Part 200 on May 29, 2026 (91 FR 32198, Federal Register, May 29, 2026). Its audit changes touch additional audits in 2 CFR 200.503, compliance supplement wording and internal control references, and it proposes no change to 200.501 or the $1,000,000 threshold (Federal Register text, read October 2026). The current text controls unless OMB finalizes a rule.

What Is a Single Audit? What It Covers and What the Auditor Reports

A single audit tests two things at once: whether the financial statements are fairly presented and the schedule of expenditures of federal awards is fairly stated in relation to them, and whether the entity complied with the rules of each major program (2 CFR 200.514, eCFR, current as of October 2026). It follows government auditing standards and covers the entity's entire operations, or a series of audits of its departments and units.

How Major Programs Are Chosen

A major program is a federal program the auditor selects for full compliance testing using a risk-based approach (2 CFR 200.518, eCFR, current as of October 2026). The auditor first labels the larger programs Type A, using a cutoff that depends on the entity's total federal awards expended.

The auditor must audit every Type A program not judged low-risk and every high-risk Type B program. Together the major programs must cover at least 40 percent of total federal awards expended, or 20 percent when the entity qualifies as a low-risk auditee (2 CFR 200.518(e) and (f), eCFR, current as of October 2026). Among other conditions, a low-risk auditee filed annual single audits on time, with unmodified opinions and no material weaknesses, in each of the two preceding audit periods, and an entity with biennial audits never qualifies (2 CFR 200.520, eCFR, current as of October 2026).

A federal agency may also ask, at least 180 calendar days before year end, for a particular program to be audited as major, and the auditee must add it if the agency agrees to pay the full incremental cost (2 CFR 200.503(e), eCFR, current as of October 2026).

The Single Audit Report: What the Auditor Delivers

The auditor's report may be combined or separate, and it must include four parts (2 CFR 200.515, eCFR, current as of October 2026).

The compliance rules the auditor tests come from the compliance supplement, an annually updated source that identifies the requirements the federal government expects auditors to consider (2 CFR 200.1, eCFR, current as of October 2026).

What Counts as a Finding

The auditor must report significant deficiencies and material weaknesses in internal control over major programs, material noncompliance with a major program's requirements, known or likely fraud, known questioned costs when known or likely questioned costs exceed $25,000 for a type of compliance requirement in a major program, and known questioned costs above $25,000 in a program not audited as major (2 CFR 200.516, eCFR, current as of October 2026). Each finding also carries the views of the auditee's responsible officials, so the auditee can answer in the report itself.

Single Audit Process, Reporting Package and Deadline

The single audit process runs from hiring an auditor to filing with the FAC, and the auditee owns most of the steps: it arranges the audit, prepares the financial statements and schedule, gives the auditor access to records, and follows up on findings (2 CFR 200.508, eCFR, current as of October 2026).

The auditee buys the audit under the federal procurement standards and must ask for the firm's peer review report (2 CFR 200.509, eCFR, current as of October 2026). An auditor who prepared the indirect cost proposal or cost allocation plan may not perform the audit when the auditee recovered more than $1 million in indirect costs in the prior year (2 CFR 200.509(b)).

What Goes in the Reporting Package

The reporting package holds the financial statements and schedule of expenditures, the summary schedule of prior audit findings, the auditor's reports and the corrective action plan (2 CFR 200.512, eCFR, current as of October 2026). With it goes a data collection form, signed by a senior representative of the auditee, such as a director of finance, and by the auditor.

When the Single Audit Is Due

The package is due within 30 calendar days after the auditee receives the auditor's report or nine months after the end of the audit period, whichever is earlier (2 CFR 200.512(a)(1), eCFR, current as of October 2026). The cognizant or oversight agency for audit may authorize an extension when the nine-month limit would be an undue burden, and a due date that falls on a weekend or federal holiday moves to the next business day.

Filing With the Federal Audit Clearinghouse

Filers complete a series of webforms, upload the reporting package as a PDF and submit the SF-SAC as XLSX workbooks, and everyone who edits or certifies a submission needs a Login.gov account (FAC Audit Submission Guide, read October 2026). Keep your copy of the form and package for three years from the date of submission (2 CFR 200.512(f), eCFR, current as of October 2026).

After the Audit: Findings, Corrective Action and Management Decisions

After the audit, the auditee owes a corrective action plan for each current finding and a status report on every earlier one (2 CFR 200.511, eCFR, current as of October 2026).

Both documents carry the reference numbers the auditor assigned, in the format "YYYY-###", and the FAC's corrective action plan workbook is needed only when there are federal awards findings (FAC corrective action plan workbook, read October 2026). An earlier finding may be treated as no longer warranting action only when two years have passed since the report reached the FAC, the agency or pass-through entity is not following up, and no management decision was issued (2 CFR 200.511(b)(3), eCFR, current as of October 2026).

Management Decisions

A management decision states whether the finding is sustained, the reasons, and what the auditee must do to repay disallowed costs, make adjustments or take other action. The awarding agency issues it for findings on its awards, and a pass-through entity for findings on its subawards, within six months of the FAC's acceptance of the report (2 CFR 200.521, eCFR, current as of October 2026). Corrective action should begin no later than receipt of the audit report.

What Happens if an Entity Does Not Comply

Where an entity continues to be unable or unwilling to have a compliant audit, agencies and pass-through entities must act under the remedies rule (2 CFR 200.505, eCFR, current as of October 2026), which runs from specific conditions and withheld payments to disallowed costs, termination and debarment (2 CFR 200.339). A pass-through entity must also verify that its subrecipients are audited as required (2 CFR 200.332(g)), a duty covered in the guide to pass-through grant management.

What a Single Audit Costs and Who Pays

No federal rule sets an audit fee. The price depends on the auditor you procure, the size of your operations and how many major programs the audit must cover, and price is only one factor in choosing the firm, alongside relevant experience, staff qualifications and peer review results (2 CFR 200.509(a), eCFR, current as of October 2026).

The rules do decide who bears the cost. A reasonably proportionate share of a required single audit is allowable under federal awards. Costs are unallowable when a required audit was not conducted, or not conducted in accordance with the requirements, and auditing an entity exempt because it spent under $1,000,000 is unallowable except in one case (2 CFR 200.425, eCFR, current as of October 2026): a pass-through entity may charge awards for agreed-upon procedures engagements that monitor exempt subrecipients, if it arranges and pays for them and limits their scope to the four areas the rule lists (2 CFR 200.425(c)). A federal agency that arranges an additional audit of its own must fund its full cost (2 CFR 200.503(d), eCFR, current as of October 2026).

How to Prepare for a Single Audit: A Readiness Table

Preparation is mostly record keeping done on a schedule, because the auditor tests transactions and expects documentation for them (2 CFR 200.514(d)(4), eCFR, current as of October 2026). Each task in the table traces to a rule.

Start with the award register. If agency, program number and pass-through details sit in different inboxes, every later step begins with a search.

The register can live in a spreadsheet or in grant software. In GrantCue, every plan includes a kanban-style pipeline with tasks, deadlines and notes for each grant, and the Team plan adds custom fields and post-award budget versus actuals (grantcue.com pricing page, October 2026), so the agency, program number and pass-through entity can sit next to each award's spending. GrantCue does not perform the audit, prepare the schedule or replace the auditor. Its setup for government teams is on the public sector solutions page.

For award-phase duties beyond the audit, use the federal grant compliance checklist and the grant closeout checklist; county and city finance teams can also read the guide to local government grant management.

FAQ

What is the single audit threshold in 2026?

The threshold is $1,000,000 in federal awards expended during the entity's fiscal year, for fiscal years starting on or after October 1, 2024 (FAC Audit Submission Guide, read October 2026). Earlier fiscal years use $750,000 (FAC, read October 2026). An entity below the threshold is exempt for that year but must keep its records available for federal review (2 CFR 200.501(e), eCFR, current as of October 2026).

Does a nonprofit need a single audit?

A nonprofit needs one when it expends $1,000,000 or more in federal awards in its fiscal year, counting awards received as a subrecipient (2 CFR 200.1 and 200.501, eCFR, current as of October 2026). Below that, it is exempt from the federal audit rules for the year. A for-profit company is not covered by the single audit rules at all, though its award terms may require an audit.

Where can you find a published single audit report?

The Federal Audit Clearinghouse is the repository of record for single audit reporting packages, and federal agencies and pass-through entities must obtain packages there (2 CFR 200.512(b), eCFR, current as of October 2026). The FAC makes packages available to the public, except for tribes that opt out of publication, and the auditee must also make copies available for public inspection (2 CFR 200.512(a)(2) and (g)).

When is the single audit due?

It is due 30 calendar days after the auditee receives the auditor's report or nine months after the end of the audit period, whichever comes first (2 CFR 200.512(a)(1), eCFR, current as of October 2026). The cognizant or oversight agency can authorize an extension, and a weekend or federal holiday deadline moves to the next business day.

Who pays for the single audit?

The auditee arranges and procures the audit (2 CFR 200.508(a), eCFR, current as of October 2026). Federal awards may bear a reasonably proportionate share of its cost, while the costs of a required audit that was not done, or not done properly, are unallowable (2 CFR 200.425). When a federal agency asks for a program to be audited as major, the auditee adds it only if the agency agrees to pay the incremental cost (2 CFR 200.503(e)).

What happens if a single audit has a finding?

The auditee writes a corrective action plan with a responsible contact, the action and a completion date, and reports the finding's status in the next summary schedule of prior findings (2 CFR 200.511, eCFR, current as of October 2026). The awarding agency or pass-through entity issues a management decision within six months of the FAC accepting the report (2 CFR 200.521, eCFR, current as of October 2026).

Dates to Calendar When the Fiscal Year Closes

The deadline is the earlier of two dates, so work it out as soon as the fiscal year ends rather than when the audit report arrives.

Illustrative figures, not data from a real organization.

If the same report arrived on September 3, 2027, the 30-day date would fall on October 3, so the nine-month date of September 30, 2027 would govern (2 CFR 200.512(a)(1), eCFR, current as of October 2026). Put both dates on the finance calendar at year end, and request any extension before the nine-month date passes.