An audit is one of the few moments when your organization’s financial practices face external, independent scrutiny, and the stakes are real: funder confidence, board accountability, and in some cases, future grant eligibility. A good nonprofit audit checklist helps you walk into it prepared.
Most checklists stop at documents. Gather your bank statements. Reconcile your accounts. Have your 990 ready. That is not wrong, but it is incomplete. What finance directors actually need to know is what auditors are looking for beneath the documents, specifically which patterns of weakness appear most often in nonprofit management letters and what they signal about an organization’s internal controls and compliance practices.
What You’ll Learn
• The specific findings that appear most often in nonprofit audit management letters and what they signal about your financial controls
• Why internal control weaknesses and grant documentation gaps are the two highest-risk areas for most nonprofit organizations going into an audit
• What a single audit involves and which nonprofits are required to have one
• The exact documents and records your organization needs to have in order before audit fieldwork begins
• How a proactive audit readiness review can close gaps before an auditor identifies them as findings
What a Nonprofit Audit Actually Reviews
A nonprofit financial statement audit is an independent examination of your organization’s financial statements, conducted by a licensed CPA, to determine whether those statements are presented fairly and in accordance with generally accepted accounting principles (GAAP).
In practice, the process goes well beyond that definition.
Auditors do more than verify revenue and expense balances. As part of planning and performing the audit, they consider the internal controls and processes relevant to financial reporting, assess risks of material misstatement, and examine supporting documentation. Depending on the organization and the engagement, this may include matters involving restricted contributions, grant activity, related-party transactions, and governance documentation.
Specifically, a nonprofit financial statement audit typically covers:
• Financial statement accuracy and presentation (statement of financial position, statement of activities, statement of functional expenses, and statement of cash flows)
• Revenue recognition, including the distinction between conditional and unconditional contributions
• Internal controls relevant to financial reporting and the auditor’s assessment of risk
• Grant compliance, particularly whether restricted funds were spent according to funder terms
• Board governance documentation, including meeting minutes, conflict of interest disclosures, and financial oversight procedures
• Related-party transactions and whether they were disclosed appropriately
Many nonprofit leaders also confuse a financial statement audit with a financial review or an agreed-upon procedures engagement. These are distinct services with different scope and different levels of assurance. A review provides limited assurance and involves analytical procedures rather than the full testing of an audit. Agreed-upon procedures are even narrower, applying only to specific items the organization and the CPA agree to examine in advance.
If a funder or your state requires an audit, confirm which type of engagement they mean, since it determines the scope, cost, and timeline of the work.
For our Bay Area clients and other California nonprofits, state rules add a layer. California charities with gross revenue of $2 million or more are generally required to have their financial statements independently audited, with revenue from government grants and contracts that require their own accounting excluded from that figure. These state requirements sit alongside any federal obligations, and our audit and assurance services are designed to help organizations meet both.
What Do Auditors Flag Most Often in Nonprofit Management Letters?
This is the section most nonprofit audit checklists skip. The management letter is the document that matters most to your board and your funders, and the findings in it tend to follow predictable patterns. That makes many of them preventable.
The most common nonprofit audit finding is not a missing document. It is a process gap: an approval that was not documented, a reconciliation that was not reviewed, or a grant expenditure that was not supported by the right records.
Here are the categories auditors cite most consistently across nonprofit audits.
Internal Control Weaknesses
Internal control deficiencies are among the most frequently cited findings in nonprofit audits. In a small nonprofit, the root cause is usually staffing: there are not enough people to segregate duties properly, so the same person who processes payments also reconciles the bank account, or the person who approves grant expenditures is also the one recording them.
Common internal control findings include:
• Lack of segregation of duties in cash handling, accounts payable, or payroll processing
• Bank reconciliations that are not prepared or reviewed monthly
• Journal entries that are posted without independent review or approval
• Physical access to cash or checks without compensating controls
• Absence of a documented approval process for expenditures above a defined threshold
Small nonprofits with limited staff are not expected to eliminate all segregation of duty risks. But auditors expect compensating controls: board oversight, executive director review, or other mechanisms that reduce the risk of undetected errors or misappropriation. If those compensating controls are not documented, the finding stands.
Revenue Recognition Errors
Revenue recognition is a persistent audit risk for nonprofits, primarily because the accounting rules are more nuanced than many finance directors realize.
The critical distinction is between conditional and unconditional contributions. Under GAAP, a donor-imposed condition generally involves both a barrier the recipient must overcome and a right of return of transferred assets or release from the donor’s obligation if the barrier is not overcome. Conditional contributions generally are recognized as revenue when the conditions are substantially met.
Other revenue recognition issues auditors flag include:
• Recording multi-year pledges at face value rather than present value
• Misclassifying restricted contributions as unrestricted
• Failing to release net assets from donor restrictions appropriately when those restrictions are satisfied
• Inconsistent treatment of in-kind donations across fiscal years
Grant Compliance Documentation Gaps
Grant compliance failures are the most consequential category of audit findings, not because they are the most common, but because the downstream effects are the most serious. Findings related to grant compliance can affect future funding eligibility, trigger funder review, and require repayment of funds already spent.
The grant compliance audit checklist items that generate the most findings include:
• Time-and-effort documentation for employees whose salaries are charged to federal grants
• Allowable cost determinations: whether expenditures charged to a grant meet the cost principles under 2 CFR Part 200
• Matching requirement documentation, particularly where the funder requires a cost share from the organization
• Sub-recipient monitoring: if your organization passes funds to another entity, you are responsible for monitoring their compliance
• Procurement procedures for purchases funded by federal awards
Governance Documentation Gaps
Governance documentation can also become relevant during a nonprofit financial statement audit, and auditors find gaps more often than boards expect.
Items that generate management letter comments include:
• Board meeting minutes that do not reflect financial oversight activity, such as review of financial statements or budget variances
• Conflict of interest policies that exist on paper but have no annual disclosure process attached to them
• Budget approvals that are not documented in board minutes
• Lack of a whistleblower policy or document retention policy, particularly for organizations of a size where these are expected
• Related-party transactions that were not disclosed to or approved by the board
A board that reviews financial statements quarterly and documents those reviews in its minutes is far less likely to generate governance findings than one that reviews them annually or not at all.
Where Grant Compliance Audits Add Another Layer
A nonfederal entity that expends $1,000,000 or more in federal awards during a fiscal year beginning on or after October 1, 2024, generally must undergo a single audit under the Uniform Guidance (2 CFR Part 200). A single audit includes an audit of the financial statements plus additional procedures testing compliance with federal program requirements.
Single audit readiness for nonprofits is a specific preparation exercise, distinct from general audit readiness. The differences matter.
| Component | Financial Statement Audit | Single Audit |
| Scope | Full financial statements | Financial statements plus federal program compliance |
| Trigger | State law, bylaws, or funder requirement | $1,000,000+ in federal expenditures in a fiscal year |
| Output | Auditor’s report on financial statements | Financial statements + Schedule of Expenditures of Federal Awards (SEFA) + compliance reports per major program |
| Findings | Management letter | Management letter + Findings and Questioned Costs schedule |
| Reporting | To board and funders | To board, funders, and Federal Audit Clearinghouse |
If your organization is approaching the $1,000,000 threshold or has crossed it for the first time, you need to understand what a single audit involves before fieldwork begins. The SEFA, the schedule that lists all federal expenditures by program, requires a level of tracking and categorization that many organizations are not set up for without advance preparation.
Our nonprofit audit support covers both financial statement audits and single audit engagements, including organizations going through a single audit for the first time.
The Nonprofit Audit Preparation Checklist
This is the practical section. The items below represent records auditors commonly request during fieldwork and that, if missing or incomplete, may lead to additional audit procedures, findings, or delays. Working through this list before fieldwork begins is the most direct way to reduce the risk of management letter comments.
Financial Records
• [ ] Trial balance reconciled to the general ledger as of the fiscal year end
• [ ] Bank statements for all accounts, reconciled monthly through year end
• [ ] Investment statements for all accounts, with supporting schedules
• [ ] Support for all journal entries posted during the year
• [ ] Schedule of accounts receivable and payable with aging
• [ ] Payroll records reconciled to W-2 and tax filings
Revenue and Contribution Documentation
• [ ] Grant agreements for all active awards, including any amendments
• [ ] Correspondence confirming whether grants are conditional or unconditional
• [ ] Pledge documentation for multi-year gifts
• [ ] Support for in-kind contributions received and recorded
• [ ] Net asset release schedules showing how restricted funds were released as donor restrictions were satisfied
Expense and Grant Compliance Documentation
• [ ] Invoices and receipts supporting all material expenditures
• [ ] Time-and-effort records for employees whose salaries are charged to grants, particularly federal grants
• [ ] Documentation of procurement procedures for purchases funded by federal awards
• [ ] Sub-recipient agreements and monitoring records, if applicable
• [ ] Matching documentation if any grants require a cost share
Governance Documentation
• [ ] Board meeting minutes for the full fiscal year, signed and approved
• [ ] Annual conflict of interest disclosure forms completed by board members and key staff
• [ ] Board-approved operating budget for the fiscal year
• [ ] Conflict of interest, whistleblower, and document retention policies
• [ ] Documentation of board financial oversight activity during the year
Compliance and Regulatory
• [ ] Prior year audit report and management letter, with management responses
• [ ] Documentation of corrective actions taken on prior year findings
• [ ] California Attorney General annual registration filing confirmation, if applicable
• [ ] Schedule of federal expenditures by program if a single audit applies
• [ ] IRS Form 990 for the prior year and any state filings
How to Address Audit Findings Before the Auditor Finds Them
Audit findings do not only affect your audit opinion. They affect funder confidence, board accountability, and in serious cases, future grant eligibility, which is why addressing them proactively rather than reactively matters.
The most effective approach is to treat your own nonprofit audit preparation steps as a pre-audit internal review: go through your records and documentation before fieldwork begins, using the same lens an auditor would apply.
For organizations that have never had an audit before, or that are coming off a year with management letter findings, an audit readiness assessment is a structured way to find gaps before they become findings. We offer this assessment to give nonprofit leadership a clear picture of where the organization stands before auditors arrive. Any audit readiness or advisory work performed for an audit client must be structured in accordance with applicable auditor independence requirements.
The assessment typically covers:
• Review of internal control design and whether compensating controls are in place
• Grant compliance documentation review, particularly for federal awards
• Revenue recognition assessment against current GAAP guidance
• Governance documentation review against audit expectations
• Prior year findings follow-up to confirm corrective actions were implemented
The assessment is not a substitute for the audit. It gives your finance director and board an honest picture of where things stand while there is still time to act.
If your organization has an audit coming up and you are not sure where the gaps are, the right next step is a conversation with our team. Contact us to talk through your situation.
Key Takeaways
• A nonprofit audit looks beyond the numbers on the page, often extending to internal controls, grant activity, and governance documentation
• Internal control weaknesses and grant compliance documentation gaps are the two highest-risk areas for most nonprofit organizations
• The single audit threshold is $1,000,000 in federal expenditures in a fiscal year, and it adds compliance testing requirements beyond the standard financial statement audit
• Most audit findings in management letters reflect process gaps, not intentional errors, and many can be identified and resolved before fieldwork begins
• Working through a structured preparation checklist in advance significantly reduces the risk of findings and the time fieldwork takes
If your organization has an upcoming audit and you want a clear picture of where you stand before fieldwork begins, our team works with nonprofits through every stage of the audit preparation process. Learn more about how we work with nonprofit organizations through our audit and assurance services.
Questions Nonprofit Finance Directors Ask About Audit Preparation
What triggers a nonprofit audit?
Nonprofit audits are typically required by funders, state law, or organizational bylaws when a nonprofit reaches a certain revenue threshold. In California, charities with gross revenue of $2 million or more (excluding certain government grant and contract revenue) are generally required to have a financial statement audit. Federal grant recipients who expend $1,000,000 or more in federal awards in a single fiscal year are also required to undergo a single audit under the Uniform Guidance. Some funders impose audit requirements below these thresholds as a condition of grant awards.
What is the difference between a nonprofit audit and a single audit?
A financial statement audit reviews whether a nonprofit’s financial statements are presented fairly and in accordance with generally accepted accounting principles. A single audit includes that financial statement audit but adds compliance testing specific to the federal grant programs the organization receives. Nonprofits that expend $1,000,000 or more in federal awards in a fiscal year are required to have a single audit, and the results are reported to the Federal Audit Clearinghouse in addition to the organization’s own board and funders.
What are the most common findings in a nonprofit audit?
The most frequently cited findings in nonprofit management letters relate to internal control weaknesses, grant compliance gaps, revenue recognition errors, and missing or incomplete governance documentation. Many of these findings reflect staffing limitations in small nonprofits rather than intentional errors, but boards and funders will expect a clear plan to address them regardless of the cause.
What happens if our nonprofit has audit findings?
Audit findings are typically documented in the auditor’s management letter, and most organizations provide written management responses explaining how each finding will be addressed and by when. In a single audit, findings must also be accompanied by a corrective action plan. Findings do not automatically affect your audit opinion, but repeated or material findings can raise concerns with funders, regulatory bodies, and the board. Significant findings in a single audit may be reported to federal oversight agencies and can affect future award eligibility.
How long does a nonprofit audit take?
A nonprofit financial statement audit typically takes four to eight weeks from the start of fieldwork to the issuance of the final report, depending on the complexity of the organization’s finances and the level of preparation when fieldwork begins. Organizations that arrive at fieldwork with reconciled accounts, complete documentation, and responsive staff tend to move through the process considerably faster.
How do I know if my nonprofit is audit ready?
Audit readiness means your financial records are reconciled, grant expenditures are documented and allowable, your board has approved the budget and reviewed financial statements during the year, your internal controls are documented, and your compliance obligations are current. An audit readiness assessment with a qualified CPA firm can identify gaps before fieldwork begins and significantly reduce the risk of findings appearing in the management letter.
The earlier preparation starts, the smoother fieldwork tends to go. If your organization has an audit coming up, or if you are approaching the single audit threshold for the first time, a direct conversation with our team is the right starting point. We work with nonprofit organizations through the full audit process, from preparation through to final report. Contact us to talk through your situation.
