Nonprofit Audit Requirements by State and the Single Audit Threshold

Three different parties can require one, and they do not share a threshold. The federal government requires a single audit once you spend enough federal money. Your state charity regulator requires an audit or a CPA review once revenue or contributions pass its line. A lender, a major funder or your own bylaws can ask for one at any size.

IRS Form 990 asks about the statements and the federal audit. Part XII, lines 2a to 2c ask whether the financial statements were compiled, reviewed or audited by an independent accountant, and whether a committee oversees that work. Lines 3a and 3b ask whether a federal award required an audit under the Uniform Guidance and whether it was done (Instructions for Form 990, 2025 edition, checked 2026-10-19).

One trap sits in those same instructions. They still carry a note saying the Uniform Guidance audit applies at $750,000. That note is stale: 2 CFR 200.501 on eCFR says $1,000,000, and when a form instruction and a regulation disagree, the regulation controls.

Our guide to nonprofit accounting and Form 990 covers the return itself and fund accounting. This page covers the audit questions: the federal rule first, then a state table, then the paperwork an auditor will ask you to produce.

It is $1,000,000 for fiscal years that began on or after October 1, 2024, and $750,000 for fiscal years that began before that date. Paragraph (a) of 2 CFR 200.501 says a non-Federal entity that expends $1,000,000 or more in Federal awards during its fiscal year must have a single or program-specific audit.

OMB published the revision on April 22, 2024 and set a government-wide effective date of October 1, 2024. Its notice says OMB "increased the single audit threshold from $750,000 to $1,000,000" (89 FR 30046). The regulation prints only the new figure. The fiscal-year-start rule comes from pass-through entities: Pennsylvania's Office of the Budget, for one, applies $750,000 to subrecipients with a fiscal year starting before October 1, 2024.

Applying that start-date rule gives this mapping. It is illustrative, so confirm an edge case with your pass-through entity or cognizant agency.

Nothing in force lowers it. As of 2026-10-19, eCFR shows the last amendment of section 200.501 dated 2024-10-01. OMB's proposed rewrite of 2 CFR 200, published May 29, 2026 with comments closed July 13, 2026 (91 FR 32198), discusses subpart F changes to section 200.503, and its Federal Register notice does not mention section 200.501.

Awards expended count, and the timing follows the activity. Section 200.502 says an award is expended when the activity related to it occurs: spending on grants and cooperative agreements, disbursements to subrecipients, use of loan proceeds, receipt of property, receipt or use of program income, and the period insurance is in force.

Several items stay out. Medicare payments for patient care are not federal awards expended (200.502(h)). Payments for goods or services you provided as a contractor are not subject to audit (200.501(g)). Free rent received by itself does not count, though free rent that comes as part of an award to carry out a program does (200.502(f)).

Awards add up across agencies. Two $600,000 grants from different agencies put you over the line even though neither reaches $1,000,000 alone. Illustrative example, which foots:

That nonprofit needs a single audit. A second nonprofit with $480,000 and $410,000 across two programs expended $890,000 and is exempt for the year. It is still bound by 200.501(e): its records must be available for review by the federal agency, the pass-through entity and the Government Accountability Office.

Once you are in, the auditor classifies programs by size. For total expenditures from $1,000,000 up to $34 million, a program above $1,000,000 expended is Type A (200.518(b)), which is why one large program can dominate the audit.

The audit covers your whole organization, follows Government Auditing Standards (the Yellow Book), and the package is due the earlier of 30 calendar days after you receive the auditor's report or nine months after the audit period ends. Section 200.514 requires the auditor to state whether the financial statements and the schedule of expenditures of federal awards are fairly presented, and to test internal control over compliance for major programs.

You carry the preparation. Under 200.508 the auditee arranges the audit, prepares the financial statements and the schedule, follows up on findings, and gives the auditor access to people, books and records. When you request proposals, 200.509 says to ask for the audit organization's peer review report.

The deadline is in 200.512(a)(1). A cognizant agency can allow more time where nine months is an undue burden, and a due date on a weekend or federal holiday moves to the next business day. For a calendar-year nonprofit, nine months after December 31, 2025 was September 30, 2026; for fiscal 2026 it is September 30, 2027.

You file electronically with the Federal Audit Clearinghouse. The submission has two parts: the data collection form, which a senior-level representative of the auditee signs, and the reporting package. The package holds the financial statements and schedule, the summary schedule of prior audit findings, the auditor's reports and your corrective action plan. Keep copies for three years from the date of submission, and make copies available for public inspection.

The timeline below shows the order of events for a calendar-year nonprofit. The two dates in the "package to FAC" step are alternatives, and the earlier one governs.

The SEFA is the schedule of expenditures of federal awards, and your management prepares it. Section 200.510(b) says the auditee prepares the schedule for the period its financial statements cover. The independent auditor then tests it and gives an opinion on whether it is stated fairly in relation to the financial statements as a whole.

The rule lists what the schedule must contain.

Build the schedule from expenditures, not from revenue. Grant revenue recognized in a period can differ from federal awards expended in it, so the schedule needs its own reconciliation back to the general ledger by award. Assistance Listing numbers and pass-through identifiers are easy to miss because they sit in award letters rather than in the books.

We organize the SEFA and records your independent auditor tests. In practice that means award letters and budgets filed by award, expenditure detail tied to the ledger, subrecipient payments listed, and the schedule drafted from those records for your management to review and own. Our grant compliance support page describes the monthly tracking that keeps this work from landing in one month.

A management letter response is a written reply to each comment the auditor made about your controls or practices: do you agree, who owns the fix, and by when. It is a different document from the single audit's formal findings response.

Three documents get confused, so separate them.

• Management letter. The auditor's written comments on controls and practices. In a single audit, a federal agency or pass-through entity can ask for a copy, and the auditee must submit it (200.512(e)). New Jersey goes further and requires any management letters to accompany the audited statements filed with the charity's annual report (N.J.S.A. 45:17A-24).
• Corrective action plan. Required for each current-year finding in the auditor's report. Section 200.511(c) says it is a separate document that names the contact person, the corrective action and the expected completion date, or explains in detail why you disagree.
• Summary schedule of prior audit findings. The status of last year's findings. Fully corrected items are listed with a note that action was taken; items not corrected need the reason they recurred and the planned action (200.511(b)).

A usable response is short and specific. For each comment, state whether you agree, name one owner, give a date, and say what evidence will show it is fixed. Illustrative example: "Bank reconciliations were signed after the next month's close. We agree. The finance manager will sign within 10 business days of month end, starting with the first close after board review; the treasurer will initial the file." Then take the letter and your reply to the board or its audit committee.

Each state sets its own line and measures it on its own base, so the same nonprofit can land in different tiers in two states. The table covers seven states whose statute or regulator page was read on 2026-10-19. States where we could not open a primary source are named after the table, not guessed.

Michigan prints $500,000 and $250,000, but subsection (3) adds $25,000 for registrations filed from 2015 through 2019 and another $25,000 for each later five-year period from January 1, 2020, which gives $575,000 and $325,000 for registrations filed from 2025 through 2029. That is our arithmetic from the statute; confirm it with the Attorney General's Charitable Trust Section.

Florida's statute adds that audits follow generally accepted auditing standards and reviews follow the Statements on Standards for Accounting and Review Services, and that its department can demand an audit or review of any statement that shows discrepancies. It also lets a charity file its IRS Form 990 and schedules in place of the financial statement (496.407(2)); at $500,000 or more in contributions that return must be prepared by a CPA or another professional who prepares such returns in the ordinary course of business. Pennsylvania accepts an independent licensed public accountant as well as a CPA for reviews and audits.

California. A charitable corporation, unincorporated association or trustee that must register with the Attorney General and accrues $2,000,000 or more in gross revenue in a fiscal year must have GAAP financial statements audited by an independent CPA under generally accepted auditing standards. The audited statements must be available for inspection by the Attorney General and the public within nine months after the fiscal year closes. Government grants are left out of the $2,000,000 count if the nonprofit must account to the grantor for how it used the funds. A charitable corporation over the line must also keep an audit committee appointed by the governing board; staff, including the CEO and CFO, cannot sit on it. If the audit firm also provides non-audit services, it must follow the Yellow Book's independence standards. This comes from the Registry's audit summary, which cites Government Code 12586(e). The Registry's delinquency FAQ words the trigger as "$2 million or more in total revenue," so use the Registry's own definition when you sit near the line.

Illinois. The test is contributions received in a 12-month fiscal period, not total revenue. Above $500,000, the annual report must carry an opinion signed by an independent CPA. Between $300,000 and $500,000, an organization whose fundraising is done only by staff and volunteers files reviewed financial statements instead. A charity that uses paid fundraising help is held to a much lower audit line of $25,000, which the Attorney General's notice says did not change. The reports are due June 30 for calendar-year books, or within six months after the fiscal year ends. The Attorney General may accept IRS returns as part of the annual report, but the statute says there is no substitute for the CPA's opinion (225 ILCS 460/4).

The Illinois changes took effect January 1, 2024 and apply to reports with an initial due date after that day (Attorney General notice). The statute also says the changes made by Public Act 103-121 are inoperative on and after January 1, 2029, so re-read the section before reports due in that year.

Massachusetts, Texas and North Carolina are not in the table because we could not open a primary source that states the audit rule clearly on 2026-10-19. We could not confirm a current primary source for any of the three that day. We left those states out rather than repeat a figure from a firm's blog, because blogs lag behind statutes: New Jersey changed its line in January 2022 and Illinois in January 2024.

Finding your own state takes three steps.

1. Start with where you register. Charity regulation follows the states where you solicit, not only where you are based, so a nonprofit registered in three states can have three different filings.
2. Read the base before the line. Revenue, contributions and gross revenue in monetary donations are different numbers. Government grants, in-kind gifts and capital gains are treated differently from state to state.
3. Check the date. A threshold that moved is common. Look for a notice or an effective date on the regulator's page, and compare against the statute when the page is silent.

An audit can also be required by someone other than a regulator. Lenders write audited statements into covenants, large funders write them into award terms, and bylaws can require one at a lower size than the state does. Our nonprofits industry page shows how we organize books for organizations that carry those requirements.

For retirement plans, a different rule applies: see when a 401(k) plan needs an audit.

Finbryn does the bookkeeping and record work the audit stands on; an independent CPA practice does the audit. Finbryn is not a CPA firm and does not issue audit, review or compilation reports.

On our side, the work is year-round and plain. Grants and funds are tracked in separate classes in your accounting system. Award letters, budgets and drawdown requests are filed by award. The ledger is reconciled to the SEFA, and a prepared-by-client list is built so the auditor's request on day one is answered from files, not from inboxes. Where New Jersey asks for the management letters, or a single audit needs a corrective action plan, we help you organize the evidence behind each answer. We organize the SEFA and records your independent auditor tests.

On the auditor's side, the engagement, the opinion and the independence judgment all belong to the independent CPA practice you hire. Single audits follow the Yellow Book, and California's Attorney General spells out that an audit firm giving non-audit services must meet its independence standards. That is why we do not choose your auditor or sit between you and them.

On request we introduce independent licensed CPA practices; you engage the one you choose directly, under its own engagement letter. Finbryn receives no fee or commission tied to any audit.

Our audit, review and compilation cost guide lists practice-published ranges with dates; none of them is a quote.