Grant Audit Preparation Guide & Checklist (2026)

If you're a grants manager or finance director preparing for a federal grant audit, the single best thing you can do is read this guide before audit season, not during it. Audit preparation isn't a two-week sprint before the auditors arrive. It's a year-round practice that makes the actual audit a confirmation of work already done, not a scramble to find missing documents.

The difference between organizations that breeze through audits and those that end up with pages of findings usually comes down to one thing: whether they maintained their documentation and controls throughout the year or tried to reconstruct them at year-end.

According to 2 CFR 200 Subpart F, non-federal entities that meet the single audit expenditure threshold must complete an audit under federal rules; see Subpart F (opens in a new tab). According to EPA's summary of the 2024 Uniform Guidance revision, the single audit threshold increased to $1,000,000 for fiscal years beginning on or after October 1, 2024; see EPA's revision summary (opens in a new tab). According to 2 CFR 200.334, federal award records generally must be retained for three years from the date the final financial report is submitted, with exceptions. The Federal Audit Clearinghouse (opens in a new tab) is now run by GSA, which began collecting single audits in October 2023 after the Census Bureau, and accepted audit packages become searchable there after submission processing.

Where official sources stop: 2 CFR 200, EPA's revision summary, and the Federal Audit Clearinghouse define the audit system, but they don't tell a grants team which evidence file will prevent the next finding. Grantsights checked the current text of 2 CFR 200.501, 200.512, 200.516 and 200.520 in eCFR, the Federal Register notice for the 2025 Compliance Supplement, and 77,831 finding records the FAC holds for audit year 2024. The advice below starts with the failure mode: SEFA tie-out, report review, cash draw timing, procurement file, subrecipient monitoring, equipment inventory, or corrective action follow-up. A team should build the file around the likely finding, not around a generic binder.

October 2026 Source Check: Audit Rules That Still Matter

The October 17, 2026 source check confirmed 6 rules and sources that affect file building. Under 2 CFR 200.501, a non-federal entity that spends $1,000,000 or more in federal awards during its fiscal year must have a single audit or program-specific audit. Under 2 CFR 200.512, the audit, data collection form, and reporting package go to the FAC within 30 calendar days after you receive the auditor's report or nine months after the audit period ends, whichever is earlier. Under 2 CFR 200.516, auditors must report known questioned costs above $25,000 for a type of compliance requirement on a major program, along with significant deficiencies, material weaknesses, and material noncompliance. Under 2 CFR 200.334, records generally must be retained for three years from the final financial report date, with longer periods for litigation, claims, audit findings, property, equipment, and indirect-cost records.

The 2026 Supplement delay is a real scheduling risk. According to the AICPA's Governmental Audit Quality Center, OMB released a draft 2026 Supplement for planning, but as of October 2, 2026 the final version was still under review with no issuance date. The 2025 Supplement wasn't announced until November 26, 2025, per the Federal Register notice. If your fiscal year ended June 30, 2026, ask your auditor now whether fieldwork can finish on the draft and when the report can be released, because the nine-month FAC deadline under 200.512 doesn't move on its own; only your cognizant or oversight agency for audit can grant an extension.

What FAC Data Shows: Audit-Year 2024 Findings by Compliance Type

Grantsights analysis of Federal Audit Clearinghouse data found that 8,225 of the 46,721 single audits filed for audit year 2024 (17.6%) reported at least one federal award finding. Method: on October 17, 2026, Grantsights pulled all 77,831 finding rows for audit year 2024 from the public FAC API (opens in a new tab), grouped them into 16,165 unique findings by report and reference number, and counted each finding once for every compliance type letter the auditor assigned, using the letter codes in the FAC data dictionary.

Shares add up to more than 100% because one finding can carry several compliance types. Three more numbers from the same records matter for planning: 35.1% of findings (5,676) were flagged as repeat findings, 36.5% (5,894) were classified as material weaknesses, and 16.8% (2,708) involved questioned costs. Late filers can still add audit-year 2024 records, so these counts reflect what the FAC held on October 17, 2026.

What this changes: reporting deserves the first slot in your readiness file, and procurement findings show up in nearly as many audits (1,614) as allowable-cost findings (1,660). Subrecipient monitoring was tagged far less often than many audit checklists suggest, but if you pass money through, it's still a finding auditors test on every major program that has subawards. A repeat rate above one in three is the strongest argument for treating the corrective action plan as a working document, not a form.

Audit Trust Comes From Evidence Files

Weak audit preparation can lead to repayment, extra award conditions, or board-level risk. According to 2 CFR 200 Subpart F, the audit requirement turns on federal award expenditures and audit rules, not on whether an organization feels ready. According to EPA's 2024 Uniform Guidance summary, the single audit threshold increased to $1,000,000 for fiscal years beginning on or after October 1, 2024. According to 2 CFR 200.334, federal award records generally must be kept for three years from the final financial report date, with exceptions.

Those rules turn into five file-level readiness checks:

The better answer isn't "keep good records." It's "build the file that answers the finding before the auditor asks." That's the practical difference between audit preparation and audit panic.

Use the table as a review map before audit season: each evidence file should answer eligibility, expenditure, approval, timing, and follow-up questions without relying on staff memory.

---

5-Route Best Fit and Bad Fit Audit Readiness Checklist

Audit preparation fails when teams treat every review the same. A single audit, desk review, pass-through monitoring visit, and OIG review all require different evidence packages.

For example, a nonprofit with a late SF-425 finding shouldn't write a general promise to improve reporting. It should build a 15-day pre-deadline review calendar, name the preparer and backup, reconcile each report to the ledger, and keep evidence of CFO review. For teams comparing federal grant compliance and funding rules side by side, the Grantsights grants database can help identify which active awards carry the highest monitoring burden.

---

Understanding the Grant Audit System: 6 Review Types

Federal grant recipients face several types of audits and monitoring activities. Understanding which ones apply to you determines your preparation priorities.

Types of Grant Audits

Most federal grant recipients deal primarily with the single audit and periodic federal agency monitoring visits. OIG and GAO involvement is less common but can be triggered by complaints, patterns of findings, or congressional interest.

For the thresholds, major program selection, and FAC filing steps behind the first row of that table, see our single audit requirements guide, which walks through how auditors pick the programs they test.

The 8-Step Audit Readiness Checklist

This 8-step checklist covers what you should verify before auditors arrive.

Step 1: Reconcile Your SEFA

The Schedule of Expenditures of Federal Awards is the foundation of your single audit. Reconcile it against:

• General ledger: Do grant expenditures in your accounting system match the SEFA?
• Federal drawdown reports: Do total drawdowns from PMS, ASAP, or agency systems match?
• Award documents: Are all active awards listed? Are ALN numbers correct?
• Subaward tracking: Are funds passed to subrecipients identified?

Common SEFA errors include wrong ALN numbers, missing subawards, omitted awards, and timing differences between expenditures and drawdowns. Fix these before the auditor asks.

Step 2: Review All Financial Reports

Verify that all required financial reports (SF-425, agency-specific forms) have been:

• Submitted on time
• Reconciled to the general ledger
• Accurately reflecting expenditures for the reporting period

Reporting was the compliance type tagged most often in audit-year 2024 FAC findings, on 3,938 findings across 2,849 audits. Pull a list of all submission deadlines and confirm each report was filed, then check that each one ties to the ledger for its period.

Step 3: Test Procurement Documentation

For a risk-based sample of purchases, verify:

• Documentation of the procurement route required by your written procedures and current 2 CFR 200.320
• Whether the transaction used micro-purchase, simplified, formal, or noncompetitive procedures under the applicable threshold authority
• Competition, conflict-of-interest, price or rate reasonableness, and required noncompetitive justification evidence
• Suspension and debarment checks (SAM.gov (opens in a new tab) exclusion verification for all contractors)
• Written procurement policies that align with 2 CFR 200.318-327

Procurement and suspension and debarment showed up in 1,614 audit-year 2024 audits, because the federal requirements differ from most organizations' normal purchasing habits. Our procurement standards guide for federal grants lays out the method thresholds and the documentation each one needs.

Step 4: Verify Cost Allowability

Review a sample of charged expenditures for compliance with:

• 2 CFR 200 Subpart E cost principles (is the cost allowable, allocable, reasonable, and consistent?)
• Award-specific terms (are there special restrictions on certain cost categories?)
• Approved budget (is the expenditure within an approved budget category?)
• Period of performance (was the cost incurred within the authorized dates?)

Pay special attention to common unallowable costs: entertainment, alcohol, lobbying, fines and penalties, contingency funds, and costs not in the approved budget. The allowable costs guide for federal grants covers the four tests and the selected-item rules in 2 CFR 200 Subpart E that auditors cite most.

Step 5: Confirm Subrecipient Monitoring

If you pass federal funds to subrecipients, document:

• Risk assessment for each subrecipient (before or at the time of subaward)
• Subaward agreements with all required elements from 2 CFR 200.332
• Monitoring activities during the subaward period (desk reviews, site visits, financial reviews)
• Subrecipient single audit review (did you obtain and review their single audit reports?)
• Follow-up on findings (if their audit had findings on your program, did you follow up?)

Subrecipient monitoring was tagged on 720 audit-year 2024 findings (4.5%), far fewer than reporting or allowable costs. A common mistake is assuming that a signed subaward agreement is enough: many pass-through entities have subawards but no written monitoring plan. Our subrecipient monitoring guide has a risk assessment template and the 2 CFR 200.332 checklist.

Step 6: Verify Equipment and Property Records

For equipment purchased with federal funds:

• Inventory records: Is each item tracked with description, serial number, source of funding, acquisition date, cost, and location?
• Physical inventory: Has a physical inventory been conducted and reconciled to property records within the past two years, as 2 CFR 200.313 requires?
• Disposition records: For items disposed of, is there documentation of the disposition method and federal agency approval (if required)?
• Usage records: Is federally funded equipment being used for the authorized purpose?

Step 7: Confirm Cash Management Compliance

Review your drawdown practices:

• Are you drawing federal funds as close as possible to the time of disbursement?
• Are you minimizing the time between drawdown and payment?
• If you use an advance payment method, are advances limited to immediate needs?
• Can you show that interest earned on federal advances is handled correctly? Under 2 CFR 200.305, you may keep up to $500 a year for administrative expenses and must return the rest to HHS's Payment Management System.

Step 8: Organize Your Files

Before auditors arrive, organize:

• Award documents (notice of award, budget, modifications)
• All financial reports submitted
• All progress reports submitted
• Procurement files with competitive bidding documentation
• Personnel files with effort certifications
• Subrecipient monitoring files
• Equipment inventory records
• Cost sharing documentation (if applicable)
• Prior audit reports and corrective action status

5 Common Audit Findings: What Auditors Find Most Often

These 5 finding types cut across most federal programs, and four of them (reporting, allowable costs, procurement, and cash management) sit in the top eight compliance types in the audit-year 2024 FAC data above. Special tests and provisions (21.6% of findings) is the other large category, but its tests differ by program, so check the program's section of the Compliance Supplement. You can search real findings by entity and program in the Federal Audit Clearinghouse (opens in a new tab).

Finding Category 1: Reporting Deficiencies

What auditors look for: Were SF-425s, progress reports, and other required reports submitted accurately and on time?

Why organizations fail: Staff turnover disrupts institutional knowledge of deadlines. Report preparers don't reconcile to the general ledger. Management doesn't review reports before submission.

Prevention: Create a master calendar of all reporting deadlines. Assign backup responsibility for each report. Reconcile every report to your accounting records before submission.

Finding Category 2: Subrecipient Monitoring

What auditors look for: Written monitoring plan, risk assessments, monitoring activities during the subaward, single audit report review, and follow-up on findings.

Why organizations fail: Pass-through entities often view subrecipients as "their problem" and don't establish formal monitoring. The monitoring requirements in 2 CFR 200.332 are detailed, and many organizations don't know the full scope.

Prevention: Document a written subrecipient monitoring policy. Assess risk at the start of each subaward. Schedule monitoring activities (desk reviews at minimum, site visits for high-risk subrecipients). Review subrecipient single audit reports within 30 days of receipt.

Finding Category 3: Procurement Non-Compliance

What auditors look for: Evidence of competitive procedures, conflict of interest policies, contractor responsibility checks in SAM, and compliance with your own procurement policies.

Why organizations fail: Staff don't understand that federal procurement rules override organizational purchasing policies. Small purchases don't seem worth documenting. SAM exclusion checks aren't performed consistently.

Prevention: Train all staff who make purchases on federal procurement requirements. Create a procurement checklist that maps to 2 CFR 200.318-327. Verify SAM status for every contractor before executing an agreement.

Finding Category 4: Allowable Costs

What auditors look for: Unallowable costs charged to grants, costs outside the approved budget, costs outside the period of performance, costs that aren't reasonable or necessary.

Why organizations fail: Staff don't know what's unallowable. Budget monitoring is reactive rather than proactive. Costs get coded to the wrong account.

Prevention: Train all project staff on basic cost allowability. Review expenditures monthly against the approved budget. Flag any unusual or questionable charges for review by grants management.

Finding Category 5: Cash Management

What auditors look for: Excessive time between federal drawdowns and actual disbursement. Interest earned on federal advances. Advance payments not limited to immediate cash needs.

Why organizations fail: Organizations draw down based on budget projections rather than actual disbursements. Automated drawdown schedules aren't aligned with payment cycles.

Prevention: Draw funds based on actual disbursements, not projections. Under 2 CFR 200.305 (opens in a new tab), advance payments must be limited to the minimum amounts needed and timed with actual, immediate cash requirements.

Desk Review vs. On-Site Audit

Desk reviews and on-site audits ask for the same 5 things (award documents, reports, ledger support, procurement files, and monitoring records); what changes is how fast you need to produce them.

Desk Reviews

A desk review is a remote monitoring activity. The federal agency or auditor requests specific documents, you provide them electronically, and they review without visiting your location.

What to expect:

• Request letter listing specific documents needed
• A response deadline set in the request letter, often a few weeks
• Follow-up questions are common
• Results communicated in a monitoring letter or report

Best practices:

• Respond promptly and completely to every request
• Organize documents clearly (label files, provide a cover memo)
• If you can't locate a document, say so immediately rather than delaying
• Provide context where helpful (e.g., "The attached procurement file includes the sole-source justification approved by the grants management office on 3/15/2025")

On-Site Audits

On-site audits involve auditors or agency staff visiting your offices, typically for a few days depending on scope.

What to expect:

• Entrance conference to review scope and logistics
• Document review and testing of transactions
• Staff interviews (grants manager, PI/project director, finance staff)
• Physical observation (equipment verification, facility use)
• Exit conference to discuss preliminary findings
• Written report after the visit (ask the review team for its expected timeline)

Best practices:

• Designate one person as the audit liaison
• Set up a dedicated work space for auditors
• Provide requested documents within hours, not days
• Brief key staff on what to expect from interviews
• Take notes during the exit conference
• Don't argue during the visit; use the formal response process

Writing Effective Corrective Action Plans

When findings are identified, 2 CFR 200.511 requires 2 documents from you: a corrective action plan (CAP) for current-year findings and a summary schedule of prior audit findings. The CAP is your chance to show you have a concrete plan to fix the problem.

CAP Template

For each finding:

``` Finding Reference: [Number from audit report] Program: [Federal program name and ALN]

Management Response: [Agree/Disagree with brief rationale]

Corrective Action Steps:

1. [Specific action] - Responsible: [Name, Title] - Due: [Date]
2. [Specific action] - Responsible: [Name, Title] - Due: [Date]
3. [Specific action] - Responsible: [Name, Title] - Due: [Date]

Interim Measures Already Taken: [What you've done since the finding was identified]

Ongoing Monitoring: [How you'll verify the corrective action is working] ```

Strong vs. Weak Corrective Actions

A CAP that closes a finding names the documents an auditor can test next year. Since 2 CFR 200.334 ties retention to audit findings, keep CAP evidence until the finding is resolved; our grant records retention guide explains when each retention clock starts and stops.

Building an Audit-Ready Culture: 4 Operating Habits

The organizations that consistently have clean audits share these 4 habits, plus clear ownership:

Year-Round Compliance Habits

• Monthly reconciliation of grant expenditures to the general ledger
• Quarterly internal reviews of a sample of grant transactions
• Annual training for all staff involved in grant administration
• Real-time documentation (creating records when activities happen, not reconstructing later)
• Proactive communication with federal program officers about issues or questions

Roles and Responsibilities

What OMB Doesn't Tell You About Audit Preparation

The Uniform Guidance tells you what the rule is. It doesn't tell you how audit pressure feels when the finance team is short-staffed, program staff changed mid-year, and the auditor asks for five years of procurement history by Friday. It also doesn't tell you when the Compliance Supplement will arrive: the 2025 edition wasn't announced until November 26, 2025, and the 2026 edition was still unissued in October 2026.

The audit starts before the auditor arrives. If the SEFA, drawdown records, general ledger, and subaward list don't agree, the audit team will expand testing. That means more document requests, higher fees, and more management time.

The first missing file changes the tone of the review. Auditors don't expect perfection, but they do expect a control system. One missing invoice can be handled. A pattern of missing approvals tells the auditor that the organization may not know whether grant costs were allowable.

Unsupported costs turn into refund demands. Case in point: in report A-02-18-02011 (May 2021), the HHS Office of Inspector General (opens in a new tab) found that Gateway Community Action Partnership, a Head Start grantee, claimed $932,607 in unallowable costs: $356,121 in indirect costs, $338,363 in vendor credits, $208,600 for equipment not bought under federal open-competition procurement rules, and $29,523 for use of company vehicles. Gateway agreed to refund only the $29,523, and OIG kept its findings. The $208,600 equipment piece is the kind of finding a documented competitive purchase file prevents.

Corrective action plans are judged by specificity. "We will train staff" is rarely enough. A stronger answer names the control, owner, due date, evidence, and follow-up testing. In report A-05-18-00008 (September 2019), HHS OIG (opens in a new tab) recommended that Next Door Foundation refund $142,104 in unallowable indirect costs, sign contracts before services begin, and fully document cost transfers; OIG lists those recommendations as implemented as of March 17, 2022. Each fix was a specific control an auditor could test, which is the model to copy.

---

What Auditors Wish You Knew

Here are 4 points auditors commonly stress, drawn from the Uniform Guidance audit rules:

Organized files save everyone time and money. Audit fees are partly based on hours. If auditors spend three days trying to locate documents that should be in organized files, your audit costs more and takes longer. A well-organized audit binder or electronic folder structure reduces both fees and findings.

Being honest about problems is better than hiding them. If you know something is wrong, like a late report or a questionable cost, tell the auditor early and show what you've already done to fix it. The corrective action plan and summary schedule under 2 CFR 200.511 give you a formal place to document that work.

Internal controls matter more than individual transactions. Auditors test transactions to evaluate your internal controls. One coding error is a mistake. A pattern of coding errors is a control weakness. If you have good controls (segregation of duties, management review, reconciliation procedures), occasional errors are understood as normal. Without good controls, even small errors signal systemic risk.

Prior year findings get extra attention. Your summary schedule of prior audit findings must report the status of every prior finding, and auditors follow up on it; 2 CFR 200.516 makes a materially misstated schedule its own finding. In the audit-year 2024 FAC data, 35.1% of findings were repeats. Under 2 CFR 200.520 (opens in a new tab), a material weakness, a modified opinion on a major program, or questioned costs above 5% of a Type A program's expenditures in either of the two prior audit periods costs you low-risk auditee status and its reduced audit coverage. An agency can also add specific conditions to your award under 2 CFR 200.208. See our 2 CFR 200 Uniform Guidance guide for the full regulatory framework that these audit rules sit inside.

Audit Preparation Timeline

This 9-row timeline assumes a single audit and the 9-month FAC deadline in 2 CFR 200.512.

Related Guides

• Subrecipient Monitoring for Federal Grants
• The Single Audit

Sources

• 2 CFR 200 Subpart F (eCFR), checked October 17, 2026 for the $1,000,000 threshold in 200.501, the filing deadline in 200.512, and finding rules in 200.516 (opens in a new tab)
• 2 CFR 200.520 Criteria for a low-risk auditee (opens in a new tab)
• EPA: What's new in the 2024 revision of 2 CFR Part 200 (opens in a new tab)
• Federal Register notice of the 2025 Compliance Supplement, November 26, 2025 (opens in a new tab)
• AICPA GAQC note on the 2026 Compliance Supplement delay (October 2, 2026) (opens in a new tab)
• Federal Audit Clearinghouse data (GSA) (opens in a new tab) and FAC API (opens in a new tab), source of the audit-year 2024 finding counts
• GAO Government Auditing Standards (Yellow Book), 2024 revision (opens in a new tab)
• 2 CFR 200.334 Record Retention Requirements (opens in a new tab)
• 2 CFR 200.318-327 Procurement Standards (opens in a new tab)
• HHS OIG report A-02-18-02011, Gateway Community Action Partnership (opens in a new tab)
• HHS OIG Single Audit FAQs (opens in a new tab)
• U.S. Department of Education OIG Single Audits (opens in a new tab)