How to Read a Single Audit Report to Spot Finance Gaps

The short version

• Single audit findings appear in the auditor's schedule of findings and questioned costs, each with a reference number, the program affected, the condition and cause, any questioned costs, and whether it repeats a prior year finding (2 CFR 200.516(b)).
• The reporting package holds the financial statements, the schedule of expenditures of federal awards (SEFA), the summary schedule of prior audit findings, the auditor's reports, and a corrective action plan (2 CFR 200.512(c)). It is filed with the Federal Audit Clearinghouse (FAC) with Form SF-SAC.
• Submission is due within 30 calendar days after the auditee receives the auditor's reports or nine months after the end of the audit period, whichever is earlier (2 CFR 200.512(a)).
• On app.fac.gov you can filter audits by finding type, including material weakness, significant deficiency, questioned costs, and repeat finding.
• A finding tells you a control or compliance area needed attention in a past year. It is not proof the organization needs or wants outside help today.

What is in a Single Audit reporting package

A Single Audit applies to a nonprofit that expends $1,000,000 or more in federal awards in a fiscal year (2 CFR 200.501), for fiscal years starting on or after October 1, 2024; earlier years used $750,000. See our Single Audit threshold guide.

Under 2 CFR 200.512(c), the reporting package must include four things:

The corrective action plan is written by the auditee, separate from the auditor's findings, and must explain any disagreement. It is often the most revealing page: the organization describing its own fix in its own words.

The Data Collection Form (SF-SAC)

The auditee also submits the data collection form described in Appendix X of Part 200 (2 CFR 200.512(b)), which the FAC calls Form SF-SAC. A senior official, such as a director of finance or chief financial officer, certifies that it is accurate and complete and that the FAC may publish it.

The SF-SAC is what makes findings searchable. Its Section 3 workbook records each finding's type of compliance requirement and Y or N flags for modified opinion, other matters, material weakness, significant deficiency, other findings, questioned costs, and repeat finding (with the prior year reference number). A finding cannot be both a material weakness and a significant deficiency. Treat the flags as an index, then read the finding text in the PDF.

Material weakness vs significant deficiency

Both are classifications of a deficiency in internal control. A deficiency in internal control over compliance exists when the design or operation of a control does not allow staff, in the normal course of their work, to prevent, or detect and correct, noncompliance on a timely basis. The AICPA's illustrative Uniform Guidance auditor's reports define the two levels this way:

Auditors report on internal control over financial reporting and over compliance for major programs, and the summary of auditor's results states whether either had significant deficiencies or material weaknesses (2 CFR 200.515(d)(1)). In our interpretation, the first tends to point toward close and reporting processes, the second toward how a specific program is administered.

Single audit findings: compliance and questioned costs

Under 2 CFR 200.516(a), the auditor must report as findings, among other things:

• Significant deficiencies and material weaknesses in internal control over major programs
• Material noncompliance with federal statutes, regulations, or award terms related to a major program
• Known questioned costs when known or likely questioned costs exceed $25,000 for a type of compliance requirement for a major program
• Known or likely fraud affecting a federal award

A questioned cost is an amount that, in the auditor's judgment, is noncompliant or suspected noncompliant, lacked adequate documentation, or appeared unreasonable (2 CFR 200.1). Undocumented amounts are calculated as if confirmed noncompliant. An internal control deficiency alone creates no questioned cost.

Each finding is tagged with a lettered type of compliance requirement. Among the FAC's list: B. allowable costs and cost principles; C. cash management; I. procurement and suspension and debarment; L. reporting; M. subrecipient monitoring. In our reading, these tend to map most directly to accounting and documentation work; read the condition and cause before assuming anything.

Low-risk auditee status

The summary of auditor's results must state whether the auditee qualified as a low-risk auditee (2 CFR 200.515(d)(1)(ix)). Under 2 CFR 200.520, an auditee qualifies only if, for each of the preceding two audit periods:

• Annual Single Audits were submitted to the FAC on time
• The financial statement opinion and the in-relation-to opinion on the SEFA were unmodified
• No material weaknesses in internal control under GAGAS, and no going concern doubt
• No Type A program had a material weakness, a modified opinion, or questioned costs above five percent of its federal awards expended

Low-risk status changes audit coverage: major programs must cover at least 20 percent of federal awards expended for a low-risk auditee, otherwise 40 percent (2 CFR 200.518(f)). Losing it is visible in the report; whether it worries the organization is unknown.

Repeat findings

Each finding must say whether it repeats one from the immediately prior audit, with the prior reference number (2 CFR 200.516(b)(9)). For findings not fully corrected, the summary schedule of prior audit findings must explain the recurrence and the planned corrective action (2 CFR 200.511(b)(2)).

Read the two together. A repeat finding with a generic plan suggests the fix has been hard to land; a detailed plan with a near completion date suggests it is in hand. Both are inferences. The awarding agency or pass-through entity's management decision, due within six months of FAC acceptance (2 CFR 200.521(d)), is not in the public package.

The due date, and what it means for timing

The audit, data collection form, and reporting package are due within 30 calendar days after the auditee receives the auditor's reports or nine months after the end of the audit period, whichever is earlier. A due date on a weekend or federal holiday moves to the next business day, and the cognizant or oversight agency for audit may authorize an extension (2 CFR 200.512(a)).

For a June 30 year end, the nine-month outer date is March 31; for a December 31 year end, September 30. The FAC releases data on final submission, so a finding you read may describe a year that ended many months earlier.

How to search the Federal Audit Clearinghouse

FAC data is free and public, with audit years back to 2016. At app.fac.gov/dissemination/search:

1. Enter a UEI or EIN, or a whole word from the name (name search matches whole words only).
2. Narrow by audit year, state, fiscal year end month, and entity type (Non-profit).
3. Under Audit findings, choose Any findings or specific types: material weakness, significant deficiency, questioned costs, repeat finding, and others.
4. Optionally filter by Assistance Listing number or type of compliance requirement.
5. Open the summary page to download the SF-SAC summary and the PDF report.

Audits submitted before April 2022 are keyed by EIN; later ones by UEI. Pair what you find with federal award data and the Form 990.

Using findings as a conversation signal

A public finding is a factual starting point, not a diagnosis. Label what you know:

• VerifiedWhat the filing states. "The fiscal year 2025 audit reports finding 2025-001, a significant deficiency in reporting, flagged as a repeat."
• InferredA reasonable reading. "Federal reporting may be stretched across a small team."
• UnknownWhether it is already fixed, who is fixing it, and whether they want help.

Some practical rules:

• Reference the corrective action plan, their own framing, not your judgment.
• Do not imply misconduct. Questioned costs are the auditor's judgment and may be resolved in the management decision.
• Ask, do not tell. "We saw the corrective action plan on reporting timelines in your filed audit. How is that work going?" is fair. "You clearly need a controller" is not.
• Check the next filing's summary schedule of prior audit findings before assuming a finding is still open.

A short research checklist

1. Note audit year, fiscal year end, and FAC acceptance date.
2. Read the summary of auditor's results: opinions, deficiency statements, low-risk status.
3. List each finding: program, requirement type, questioned costs, repeat flag.
4. Read the condition, cause, and the corrective action plan's owner and date.
5. Check the summary schedule of prior audit findings for recurrence.
6. Label every claim Verified, Inferred, or Unknown before you reach out.

How AwardNote uses this

Sources

All retrieved October 29, 2026.

• 2 CFR Part 200, Subpart F, Audit Requirements (eCFR): ecfr.gov
• 2 CFR 200.1, Definitions (eCFR): ecfr.gov
• 2 CFR 200.501, Audit requirements (eCFR): ecfr.gov
• 2 CFR 200.510, Financial statements (eCFR): ecfr.gov
• 2 CFR 200.511, Audit findings follow-up (eCFR): ecfr.gov
• 2 CFR 200.512, Report submission (eCFR): ecfr.gov
• 2 CFR 200.515, Audit reporting (eCFR): ecfr.gov
• 2 CFR 200.516, Audit findings (eCFR): ecfr.gov
• 2 CFR 200.518, Major program determination (eCFR): ecfr.gov
• 2 CFR 200.520, Criteria for a low-risk auditee (eCFR): ecfr.gov
• 2 CFR 200.521, Management decisions (eCFR): ecfr.gov
• Federal Audit Clearinghouse, About our data: fac.gov
• Federal Audit Clearinghouse, Search filters: fac.gov
• Federal Audit Clearinghouse, Search results guide: fac.gov
• Federal Audit Clearinghouse, SF-SAC Section 3: Federal awards audit findings: fac.gov
• Federal Audit Clearinghouse, Eligibility and thresholds: fac.gov
• Federal Audit Clearinghouse, Audit search: app.fac.gov
• AICPA, Illustrative Auditor's Reports Under the Uniform Guidance (2024): AICPA report (PDF)

FAQ