Does your nonprofit actually need an audit? The triggers that make one required

The direct answer

Not every nonprofit needs an audit, and federal tax law does not require one just because you are tax-exempt. An audit becomes required when your organization spends enough federal grant money to trigger a single audit, when a grant agreement, contract or lender requires audited statements, or when your own bylaws say so. Many boards also choose an audit voluntarily once the organization reaches a size where donors and grantors expect one.

At Malnory, McNeal & Company, nonprofit organizations are a named service area, and I work in the firm's audit and assurance practice. The question I hear most from executive directors and treasurers is not how an audit works but whether they need one this year, and if so, what kind. This guide walks through the triggers in the order I check them. Treat it as general information; the right answer for your organization depends on your documents, so talk to a licensed CPA before you decide.

The federal threshold that triggers a single audit

Under the federal Uniform Guidance, 2 CFR 200.501, a non-federal entity that spends $1,000,000 or more in federal awards during its fiscal year must have a single audit, or in limited cases a program-specific audit, for that year. The test is money expended, not money awarded, so a large multi-year grant does not trigger the requirement until the spending crosses the line within a single fiscal year.

Federal money often arrives indirectly. If your organization receives funds from a state agency, a city or a larger nonprofit, and those funds originated as a federal grant, they generally count toward the threshold. Your grant agreement should identify the federal source. If you are not sure whether a grant is federal, ask the funder for the program details before your fiscal year closes, because the single audit is broader than a standard financial statement audit and needs planning.

In practical terms, the single audit adds work on top of the financial statement audit. The auditor also looks at whether the organization complied with the requirements of its major federal programs and at the internal controls over those programs. That means grant files, time records for staff charged to grants, procurement documents and reimbursement requests all need to be in order. Organizations that approach the threshold for the first time are often surprised by how much documentation the federal side requires, so if your federal spending is rising, start the conversation a year before you expect to cross the line.

Grant agreements, contracts and your own bylaws

Below the federal threshold, the most common trigger is paper you already signed. Foundations, corporate funders and government contracts frequently require audited financial statements as a condition of the award, sometimes above a certain grant size and sometimes for every grantee. Lenders do the same for nonprofits that borrow. Some state laws and licensing bodies also set requirements for certain types of organizations, so check what applies to yours.

Then read your bylaws and any board policies. Organizations often adopt an annual audit requirement early, when a founding board wanted to signal accountability, and nobody revisits it as the organization changes. If your bylaws require an audit, the board either commissions one or formally amends the bylaws; ignoring the provision is a governance problem in its own right.

Pay attention to timing as well as the requirement itself. Many grant agreements set a deadline for submitting the audit report after year-end, and some funders will not release the next payment until they receive it. Work backward from that date: the auditor needs time for planning, fieldwork and the report, and your staff needs time to close the books first. Organizations that miss funder deadlines usually started the audit too late, not too slowly.

• Pull every active grant agreement and search for the words audit, audited, reviewed and financial statements.
• Check loan agreements and lines of credit for reporting requirements.
• Read the bylaws and board-approved financial policies.
• Ask your largest funders what they expect at renewal, not just what the current agreement says.

What Form 990 asks, and what it does not require

The IRS annual return depends on size. According to the IRS, an organization that normally has gross receipts of $50,000 or less may file the Form 990-N e-Postcard; Form 990-EZ is available when gross receipts are under $200,000 and total assets are under $500,000; and organizations at or above either of those levels file the full Form 990. Filing any of these does not by itself require an audit.

The full Form 990 does ask whether the organization's financial statements were compiled, reviewed or audited by an independent accountant, and whether a committee oversees that work and selects the accountant. The IRS instructions are explicit that a compilation or review is not an audit. Donors, grantors and watchdog readers see those answers, so the question is worth thinking about even when no rule forces an audit. Our firm prepares Forms 990 and 990-T alongside its audit and accounting work for nonprofits.

When a review or compilation will do

If no grant, lender, regulation or bylaw requires an audit, a review may give your board and funders the comfort they need at lower cost. A review provides limited assurance based on analytical procedures and inquiry; a compilation presents your statements in proper form with no assurance. Some funders specifically accept reviewed statements below a certain grant size, so ask before assuming the answer is an audit.

A useful approach for a growing organization is to start with a review and move to an audit when funding or governance calls for it. That gives the board a year or two of cleaner books and better controls before the more demanding engagement. The three levels are explained in more detail in what audited financial statements involve.

Reasons a board commissions an audit anyway

Even without a requirement, there are situations where I would encourage a board to consider an audit. None of these means something is wrong. Each one means the board would benefit from an independent look.

Board members also carry fiduciary responsibility for the organization's assets. An annual audit, or at least a review, is one of the clearest ways for a board to show it took that responsibility seriously, and the auditor's report on internal controls gives the board concrete items to follow up on.

• The finance director or bookkeeper changed, and the new person inherited books nobody has tested.
• Revenue grew quickly, or a single large gift changed the size of the organization.
• You are applying for funding from sources that expect audited statements.
• Restricted gifts have become a significant share of revenue and need careful tracking.
• One person handles most of the money, from receiving donations to reconciling the bank account.
• Board members have asked questions about the numbers that nobody can answer with confidence.

What auditors look at in a nonprofit

A nonprofit audit covers the same ground as any financial statement audit, plus areas specific to tax-exempt organizations. The IRS uses specific revenue and expense classifications, and the statements must show expenses by function, separating program services from management and general and fundraising costs. Gifts with donor restrictions have to be tracked and released properly. Grant revenue must be recognized under the right terms, and in-kind contributions need support.

Internal controls get close attention, especially in smaller organizations where a few people handle everything. Federal award recipients are expected to establish and maintain effective internal control over those awards, and even organizations without federal money benefit from the same discipline. If you want to strengthen controls before an auditor tests them, practical internal controls for a small office is a good starting list.

Getting ready for a first audit

The first audit takes the most effort, mainly because opening balances and prior-year activity have to be supported. Organizations that prepare well save time and fees, and they learn a great deal about their own records in the process.

Schedule early. Audit firms plan their calendars months ahead, and the period after many organizations close their fiscal year is busy. Once you know an audit is required, contact firms well before year-end so the engagement letter is signed, the request list is in hand and your staff knows what is coming. The list below is the core of what we ask for at the start.

• Reconcile every bank, investment and credit card account through year-end.
• Gather grant agreements, award letters and any reports already filed with funders.
• List restricted gifts with the donor's terms and how much has been spent.
• Collect board minutes, bylaws, policies and the most recent Form 990.
• Document fixed assets and any debt, with supporting agreements.
• Name one staff member and one board member as the audit contacts.

Starting the conversation

If you are unsure whether an audit is required, bring your grant agreements, bylaws, latest Form 990 and most recent financial statements to a first conversation. We will read the requirements with you, tell you whether an audit, a review or better bookkeeping is the right next step, and explain the timeline if an audit is needed. Our partners' experience includes audits of nonprofits, school districts, cities, counties and benefit plans.

Our Dallas office serves organizations across the Dallas–Fort Worth area, and our Paris, Texas office serves Northeast Texas. If your board is still choosing among firms, how to check a CPA firm's license and peer review explains what to verify first. The aim is a report your funders accept, a board that understands its numbers, and a second year that is easier than the first.

Questions people ask me