Single Audit and 2 CFR 200 Compliance Explained

A single audit is an organization-wide audit that a non-Federal entity must have when it expends $1,000,000 or more in federal awards during its fiscal year. It is required by Subpart F of 2 CFR 200, the Uniform Guidance, and the Single Audit Act. In one engagement, an independent auditor audits your financial statements and your schedule of federal expenditures, tests internal control over federal programs, and gives an opinion on whether you complied with the requirements of your major programs. The results are filed with the Federal Audit Clearinghouse, where federal agencies and pass-through entities read them.

The 2024 revision of the Uniform Guidance raised the threshold from $750,000 to $1,000,000 for fiscal years beginning on or after October 1, 2024. Many guides, and some auditors' marketing, still quote the old figure.

Does your organization need one?

Four questions decide it.

Are you a non-Federal entity? States, local governments, Indian tribes, institutions of higher education and nonprofits are. For-profit organizations are not covered by Subpart F; if you pass federal funds to a for-profit, your subaward sets whatever compliance requirements apply, which may include a different kind of audit.

How much did you expend, not receive? The test is federal awards expended in your fiscal year, across all programs combined. A $1.5 million award spread over three years may keep annual spending below the threshold. Expenditures generally count when the underlying activity happens, such as incurring costs, paying subrecipients, using loan proceeds, or receiving and distributing noncash assistance.

Which money counts? Funds you receive directly from federal agencies and federal funds passed through a state or another organization both count, when you receive them as a recipient or subrecipient. Payments you receive as a contractor selling goods or services under someone else's federal award do not.

When does your fiscal year start? The $1,000,000 threshold applies to fiscal years beginning on or after October 1, 2024. A calendar-year organization used it first for 2025; an organization with a July fiscal year, for the year beginning July 1, 2025.

If you expend less than $1,000,000, you are exempt from federal audit requirements for that year, though your records must still be available to the agency, pass-through entity and the Government Accountability Office. Your funders may require an audit anyway.

Track federal expenditures monthly, by assistance listing number, so you know months ahead of year-end whether you will cross the line. Most grant management software can report spending by award and funding source.

Single audit or program-specific audit

Most entities have a single audit. Subpart F allows a program-specific audit instead in two cases: you expend federal awards under only one federal program (excluding research and development) and the program's rules do not require a financial statement audit; or, for research and development, you expend awards only from one federal agency and that agency, or the pass-through entity, approves it in advance.

What the auditor tests

The engagement has a financial half and a compliance half.

Financial statements and the SEFA. The auditor gives an opinion on the financial statements and an "in relation to" opinion on the schedule of expenditures of federal awards (SEFA), which you prepare. The SEFA lists every federal program by assistance listing number with the amount expended, including amounts passed to subrecipients. A wrong or incomplete SEFA is a common source of findings.

Major programs. The auditor does not test every program. Using a risk-based process, they label larger programs as Type A. For entities expending between $1,000,000 and $34 million, the Type A threshold is $1,000,000. Type A programs are assessed for risk, and higher-risk Type B programs are added, until the major programs together cover at least 40% of total federal expenditures, or 20% for a low-risk auditee. You qualify as low-risk if, for each of the two preceding audit periods, your audits were filed on time, opinions were unmodified, there were no material weaknesses, and certain findings on Type A programs did not occur.

Compliance requirements. For each major program, the auditor tests the requirements in the OMB Compliance Supplement (Appendix XI to 2 CFR 200), which OMB updates periodically. It groups them into types such as:

• activities allowed or unallowed, and allowable costs and cost principles;
• cash management, including whether drawdowns match actual needs;
• eligibility;
• equipment and real property management;
• matching, level of effort and earmarking;
• period of performance;
• procurement, suspension and debarment;
• program income;
• reporting, such as the Federal Financial Report and performance reports;
• subrecipient monitoring;
• special tests and provisions unique to each program.

The cost principles behind those tests are covered in our overview of 2 CFR 200.

What gets filed, and when

The reporting package includes the financial statements, the SEFA, the auditor's reports, a schedule of findings and questioned costs, your summary schedule of prior audit findings, and your corrective action plan for any current findings. Together with the data collection form, it is submitted to the Federal Audit Clearinghouse at fac.gov:

• within 30 calendar days after you receive the auditor's report, or
• nine months after the end of your fiscal year,

whichever comes first. If the due date falls on a weekend or federal holiday, it moves to the next business day. Late filing costs you low-risk status for the following two years, which means more testing and usually a higher fee.

Preparing all year

Organizations that get through a single audit cleanly do the same things every month, not in the weeks before fieldwork:

1. Reconcile drawdowns to the ledger so federal cash on hand matches immediate needs.
2. Document personnel charges with records that reflect the work actually performed, as 2 CFR 200.430 requires. Budget estimates alone do not support salary charges.
3. Write down your cost allocation method in a way an outsider can follow, and apply it consistently.
4. Keep procurement files showing the method used, quotes or bids, and any sole-source justification.
5. Keep a subrecipient file for every pass-through relationship: risk assessment, subaward terms, monitoring and follow-up.
6. File reports on time and keep the support, because auditors trace reported figures back to the ledger. Our guide to federal reporting requirements covers schedules.
7. Maintain the SEFA as you go, by assistance listing number, instead of reconstructing it after year-end.

When these records exist as you go, the audit is a sampling exercise. When they have to be rebuilt, every gap becomes a finding. Most of this is ordinary post-award grant management done consistently.

Findings and corrective action

A finding documents a problem: an unallowable or unsupported cost, a control weakness, a late report, missing subrecipient monitoring. You respond with a corrective action plan naming what will change, who is responsible, and by when. The federal agency or pass-through entity then issues a management decision on each finding.

Next year, the summary schedule of prior audit findings reports whether each one was fixed. Repeat findings are what draw attention: they can cost you low-risk status, and agencies can respond with specific conditions on future awards, such as more frequent reporting or reimbursement-only payments. The goal is not only to pass this year but to retire findings so they do not come back.