Yellow Book (GAGAS) Audits: When Are They Required?

A yellow book audit is required any time a federal law, state statute, or grant agreement mandates that the audit be conducted under Government Auditing Standards (GAGAS), the set of standards published by the U.S. Government Accountability Office. The most common trigger is expending $1,000,000 or more in federal awards in a single fiscal year, which requires a Single Audit performed under GAGAS. Beyond that threshold, dozens of federal programs, state laws, and individual grant agreements also require GAGAS compliance regardless of total spending.

What Is a Yellow Book Audit?

The “Yellow Book” is the informal name for the GAO’s *Government Auditing Standards*. The name comes from the yellow cover of earlier printed editions. The standards are formally abbreviated GAGAS (Generally Accepted Government Auditing Standards).

GAGAS builds on the AICPA’s generally accepted auditing standards (GAAS) but adds three layers of requirements that go beyond a standard commercial audit:

• Independence standards that are stricter than AICPA rules, including a conceptual framework for evaluating threats and a prohibition on providing many non-audit services to an audited entity.
• Continuing professional education (CPE) of 80 hours every two years for auditors who charge time to GAGAS engagements, with at least 24 of those hours specifically covering government auditing, the government environment, or the subject matter of the entity audited.
• Additional reporting on internal control over financial reporting and on compliance with laws, regulations, contracts, and grant agreements. This reporting, often called the “Yellow Book report,” appears alongside the audited financial statements and is not part of a standard GAAS audit.

The current governing version is the 2018 Yellow Book (GAO-18-568G, with an April 2021 technical update). The 2024 revision was issued February 1, 2024, and is effective for financial audits, attestation engagements, and reviews of financial statements for periods beginning on or after December 15, 2025; performance audits beginning on or after that same date also fall under the 2024 standards. Early adoption is permitted.

Four Types of GAGAS Engagements

GAGAS covers four distinct engagement types. Knowing which category applies to your organization matters because the scope, deliverables, and specific technical requirements differ.

Financial Audits

A GAGAS financial audit expresses an opinion on whether financial statements are presented fairly in accordance with the applicable financial reporting framework. The scope is the same as a GAAS audit in one sense, but GAGAS requires the auditor to also report on internal control and compliance, producing a separate written report on each. State and local governments, public universities, housing authorities, and nonprofits that receive federal awards most often undergo GAGAS financial audits.

Single Audits (Subset of Financial Audits)

A Single Audit combines a financial statement audit with a separate audit of the entity’s federal programs. Any non-federal entity (state, local government, nonprofit, tribal organization, institution of higher education) that expends $1,000,000 or more in federal awards during its fiscal year must have a Single Audit under 2 CFR Part 200, Subpart F. This $1,000,000 threshold applies to fiscal years beginning on or after October 1, 2024; the prior threshold was $750,000. The Single Audit must be conducted in accordance with GAGAS.

The Single Audit produces a Schedule of Expenditures of Federal Awards (SEFA), an auditor’s opinion on the financial statements, reports on internal control and compliance, a Schedule of Findings and Questioned Costs, and a Corrective Action Plan from management. These reports are submitted to the Federal Audit Clearinghouse.

Performance Audits

Performance audits evaluate whether programs are achieving their intended results and whether government resources are used economically and efficiently. They can examine program effectiveness, economy, efficiency, equity, internal controls, or compliance with laws and regulations. Performance audits are often initiated by legislative bodies, inspectors general, or funding agencies. They do not necessarily result in a financial opinion; instead, the auditor reports findings, conclusions, and recommendations.

Attestation Engagements

Attestation engagements under GAGAS include examinations, reviews, and agreed-upon procedures. Common uses include reporting on compliance with specific contract provisions, verifying cost representations submitted by a contractor, or examining whether a grantee’s reported performance measures are reliable.

When Is a Yellow Book Audit Required?

The triggers fall into three categories:

Federal Expenditure Thresholds

As noted above, the most common trigger is the Single Audit threshold. If your organization expends $1,000,000 or more in federal awards in a fiscal year, a Single Audit is required, and that audit must follow GAGAS. The $1,000,000 figure counts all federal funding expended, including pass-through awards received from a state or another prime recipient, not just direct federal grants.

An entity that crosses the $1,000,000 threshold but expends federal awards under only one federal program may elect a program-specific audit under 2 CFR 200.507 instead of a full Single Audit, provided the program’s statute or regulation does not require a financial statement audit. The threshold to trigger an audit is the same $1,000,000 either way; the program-specific option only narrows the scope of what is audited, not the dollar figure that triggers it. That program-specific audit must also comply with GAGAS.

For fiscal years that began before October 1, 2024, the older $750,000 threshold still controls; the $1,000,000 figure only applies to fiscal years beginning on or after that date.

Statute, Regulation, or Agency Requirement

Many federal programs require GAGAS audits for their recipients independent of the Single Audit threshold. Examples include:

• Public housing authorities receiving HUD funding, which must comply with the HUD Consolidated Audit Guide and GAGAS.
• Recipients of certain Department of Education programs, where program statutes reference GAGAS.
• State and local government entities subject to state law that incorporates GAGAS, even when federal funding is below the Single Audit threshold.
• Federal contractors and subrecipients where agency-specific regulations reference Government Auditing Standards.

The relevant law or program handbook will specify whether GAGAS applies. When in doubt, the grant agreement, the funding agency’s audit guide, or eCFR should be the first source to check.

Grant Agreement or Funder Requirement

Funders can write GAGAS requirements directly into grant agreements. A nonprofit receiving a $400,000 federal award is below the Single Audit threshold but may still be contractually required to provide a GAGAS financial audit as a condition of the grant. Some state and local government grantors also require GAGAS audits even when their funds are not federal pass-through.

Organizations should review grant agreements carefully before the audit engagement begins. Failing to conduct the required type of audit can constitute a material noncompliance finding or jeopardize future funding.

Key Differences from a Standard GAAS Audit

The table below summarizes how a GAGAS financial audit differs from a standard commercial audit.

Area	GAAS Audit	GAGAS Financial Audit
Governing standard	AICPA AU-C sections	GAO Yellow Book + AICPA AU-C sections
Independence	AICPA rules	AICPA rules + GAGAS conceptual framework; nonaudit services more restricted
Internal control report	Not required	Required (separate written report)
Compliance report	Not required	Required (separate written report)
CPE for auditors	AICPA/state requirements	80 hours per 2 years; 24 hours in government topics
Reporting on findings	Not required	Schedule of Findings and Questioned Costs for Single Audits
Submission to clearinghouse	Not required	Required for Single Audits

A standard audit of a private company produces one auditor’s report. A GAGAS financial audit produces at minimum three: the financial statement opinion, an internal control report, and a compliance report.

Who Typically Needs a Yellow Book Audit?

GAGAS audits touch a wide range of organizations. The most common include:

• Nonprofits receiving federal grants for social services, housing, education, healthcare, or workforce development. If cumulative federal expenditures cross $1,000,000, a Single Audit is required. Learn more about audit and assurance services for nonprofits.
• State and local governments, including counties, cities, school districts, and special districts, that receive federal funding or are subject to state law requiring GAGAS.
• Universities and community colleges that administer Title IV student aid, federal research grants, or other federal program funds.
• Public housing authorities and community development entities receiving HUD funding.
• Healthcare organizations and community health centers receiving federal grants from HHS or HRSA.
• Tribal organizations that administer federal programs under self-governance compacts.
• Pass-through recipients receiving sub-awards from a state or other prime recipient, when the aggregate exceeds the threshold.

Private companies generally do not need a yellow book audit unless they are a subrecipient of federal awards and their expenditures exceed the applicable threshold, or their contract or grant requires GAGAS compliance explicitly.

What the Audit Process Looks Like

A GAGAS financial audit follows the same broad phases as a standard financial audit, but with additional steps built in for compliance testing and internal control evaluation. Planning includes risk assessment specific to the federal programs. Fieldwork includes testing over compliance with laws, regulations, contracts, and grant agreements directly affecting the financial statements, as well as tests of controls over federal program compliance for a Single Audit. Reporting results in separate deliverables: the financial statement opinion, the internal control over financial reporting and compliance report, and for a Single Audit, the reports on major programs under Uniform Guidance.

The additional reporting scope means a yellow book audit typically takes longer and requires more documentation than a comparable GAAS-only engagement. Working with a firm that understands the federal compliance requirements and can organize evidence efficiently makes a practical difference in timeline and friction. Modus’s approach of source-linked workpapers and structured evidence collection is particularly well-suited to the documentation-intensive nature of GAGAS engagements.

Related reading: Nonprofit Audit Requirements: Does Your Organization Need One?

Frequently Asked Questions

What triggers a yellow book audit?

A yellow book audit is triggered when an organization expends $1,000,000 or more in federal awards during a fiscal year (for fiscal years beginning on or after October 1, 2024), when a federal statute or program regulation requires GAGAS compliance, when a state law mandates government auditing standards, or when a grant agreement specifically requires a GAGAS audit.

Is a yellow book audit the same as a Single Audit?

Not exactly. All Single Audits must be conducted under GAGAS (the Yellow Book), but not all Yellow Book audits are Single Audits. A Single Audit is a specific type of GAGAS financial audit that also includes a compliance audit of federal programs under 2 CFR Part 200, Subpart F. An organization might require a GAGAS financial audit without meeting the threshold or structure that triggers a full Single Audit.

What is the current Single Audit threshold?

For non-federal entity fiscal years beginning on or after October 1, 2024, the Single Audit threshold is $1,000,000 in federal awards expended. For fiscal years that began before that date, the prior threshold of $750,000 applies. The $1,000,000 figure was established by OMB’s April 2024 revision to the Uniform Guidance (2 CFR Part 200, Subpart F).

Does a private company ever need a yellow book audit?

Yes, in limited circumstances. A private company that is a sub-recipient of federal awards and expends $1,000,000 or more in a fiscal year must have a Single Audit. A private contractor may also be required by a specific federal agency or grant agreement to conduct a GAGAS audit or attestation engagement, particularly in defense, housing, or social services contracting.

What is the current version of the Yellow Book?

The 2018 revision (GAO-18-568G, updated April 2021) is currently in effect. The 2024 revision was issued February 1, 2024, and becomes mandatory for engagements covering periods beginning on or after December 15, 2025. Early adoption of the 2024 standards is permitted.

How do auditors qualify to perform yellow book audits?

Auditors performing GAGAS engagements must complete 80 hours of CPE every two years, with at least 24 of those hours in subjects directly related to government auditing, the government environment, or the specific subject matter of the entity audited. Audit organizations must also meet GAGAS independence requirements, which are stricter than AICPA rules, particularly regarding non-audit services provided to an audited entity.