Single Audit Season: Preparing for Uniform Guidance Scrutiny With AI

Does Your Organization Need a Single Audit This Year?

The trigger is set out in 2 CFR 200.501. A non-federal entity that expends $1,000,000 or more in federal awards during its fiscal year must have a Single Audit, or in narrow circumstances a program-specific audit. That figure is new. The 2024 revision of the Uniform Guidance raised the threshold from $750,000 to $1,000,000 for fiscal years beginning on or after October 1, 2024. For a nonprofit with a calendar fiscal year, that means fiscal year 2025 was the first year under the higher threshold. For a June 30 year end, it is the fiscal year that ended June 30, 2026, which is precisely the audit cycle many organizations are entering now. If your organization fell between $750,000 and $1,000,000 in federal expenditures, you may have dropped out of Single Audit coverage entirely, though your funders and pass-through entities may still require other reviews.

The key word in the rule is "expends," not "receives" or "is awarded." A three-year, $2.4 million award does not automatically trigger a Single Audit in its first year if you only spent $600,000 of it. Conversely, an organization whose total awards look modest can cross the line in a year when spending accelerates. Expenditure is generally measured when the activity related to the award occurs, such as when allowable costs are incurred, and the rules in 200.502 add special handling for loans, loan guarantees, noncash assistance, and certain other items. Federal money you receive as a subrecipient through a state agency, county, or larger nonprofit counts the same as money you receive directly from a federal agency. Payments you receive as a contractor for goods or services, however, generally do not count, which is why the distinction between a subaward and a contract matters so much.

This determination is the first place AI is genuinely useful. Most organizations do not have one clean list of every federal dollar. They have a grants tracker, a set of award letters, and a general ledger coded by fund or class. An AI model can read your award documents and extract, for each one, the federal agency, the Assistance Listing number, whether the money is direct or passed through, the pass-through entity's identifying number, and whether the agreement reads like a subaward or a contract. It can then compare that list to your expenditure totals by grant and give you a first estimate of total federal expenditures. That estimate is a working draft, not a determination. Ambiguous agreements, especially ones that look like contracts but carry federal flow-down terms, belong in a conversation with your auditor early in the year, not in the final week.

How Auditors Choose Major Programs, and Why You Should Model It

A Single Audit does not test every federal program you run. The auditor uses a risk-based process in 2 CFR 200.518 to select "major programs," and those programs receive the compliance testing and the opinion on compliance. Understanding the process will not let you steer the auditor, nor should it. It will let you anticipate which programs are likely to be tested, which means you know where to focus your preparation months in advance.

The process starts by sorting programs into Type A and Type B using a dollar threshold. For organizations with total federal expenditures between $1 million and $34 million, which covers most nonprofits that undergo a Single Audit, the Type A threshold is $1,000,000; the 2024 revision raised it from $750,000. Any program at or above that threshold is Type A. Everything smaller is Type B. The auditor then assesses risk. A Type A program is generally considered low risk if it was audited as a major program in at least one of the two most recent audit periods and had no significant problems, such as a material weakness, a modified opinion, or substantial questioned costs. Type A programs that are not low risk become major programs. The auditor then assesses larger Type B programs for high risk, considering factors such as the program's complexity, prior findings, and how recently it was tested, and selects a limited number of high-risk Type B programs as major.

Finally, the percentage of coverage rule applies. The major programs together must account for at least 40 percent of total federal awards expended, or 20 percent if the organization qualifies as a low-risk auditee under 2 CFR 200.520. Low-risk status requires, for each of the two preceding audit periods, annual Single Audits filed on time, unmodified opinions on the financial statements and the SEFA, no material weaknesses in internal control, no going concern doubt, and no Type A program with a material weakness, modified compliance opinion, or known or likely questioned costs above 5 percent of the program's expenditures. Low-risk status is worth protecting. It reduces audit coverage, which reduces audit cost and staff burden. A single late filing can cost it for two years.

AI can help you model this. Once the draft SEFA exists, ask a model to sort programs into Type A and Type B using the applicable threshold, mark which Type A programs were tested as major in the last two audits from your prior reporting packages, list prior findings by program, and estimate which programs are most likely to be selected and whether coverage requirements are met. The output is a preparation priority list, not a prediction to argue with your auditor. It tells you that the large program with last year's procurement finding will almost certainly be tested again, and that you should start there.

Internal Control Over Compliance and Pre-Testing Your Own Samples

A Single Audit tests two things for each major program: whether you complied with the applicable requirements, and whether you had internal controls designed and operating to make compliance likely. The second part trips up small organizations more often than the first. The Uniform Guidance requires recipients to establish effective internal control over federal awards and points to the GAO's Green Book and the COSO framework as the reference standards. In practice, auditors want to see that a control exists for each direct and material requirement, that someone performs it consistently, and that there is evidence it was performed. A finance director who personally checks every invoice against the budget is exercising judgment. Unless that check leaves a trace, such as an initialed approval, a system workflow record, or a reviewed report, the auditor cannot test it as a control.

Auditors test both controls and compliance through sampling. For each major program and requirement, they select a sample of transactions or items, often drawing on the sampling guidance in the AICPA's audit guide for government auditing standards and Single Audits, and examine each one. For allowable costs they might pull payroll charges, vendor invoices, and journal entries and check that each was allowable, allocable, reasonable, properly approved, and charged within the period of performance. For reporting they compare submitted reports to the ledger. For procurement they check that the right method was used and that suspension and debarment was verified before contracting. A single exception in a small sample can produce a finding, and a pattern of exceptions can produce a material weakness.

The best preparation is to run that test on yourself first. Pull your own sample of transactions from each likely major program, and use AI as a structured checker. For each transaction, give the model the relevant compliance requirement in plain language, the award's budget and period of performance, and a description of the supporting documentation you have, and ask it to evaluate the item against each attribute the auditor will test and to note what is missing. For payroll charges, does the charge rest on documentation that meets the standards for personnel costs? Our article on time and effort reporting for federal grants covers what that documentation should look like. For indirect costs, was the charge computed at the approved or de minimis rate, on the correct base? See our guide to indirect cost rates and our article on cost allocation plans. For subawards, can you show a risk assessment, monitoring activity, and review of the subrecipient's audit? Our article on subrecipient monitoring with AI covers that program in depth.

The point of pre-testing is not to clean up the files before the auditor arrives in a way that changes the record. Creating documentation after the fact and presenting it as contemporaneous is a serious problem that can turn a minor finding into something much worse. The point is to find control gaps early enough to fix the process for the rest of the year, to gather documentation that genuinely exists but is scattered, and to be ready to explain honestly any exceptions you found. If pre-testing reveals that one person both approves and records grant disbursements, our article on segregation of duties in a small finance office describes compensating controls that auditors can accept.

Prior Findings, Corrective Action Plans, and Responses That Hold Up

Findings are part of Single Audit life. What distinguishes a well-run organization is not the absence of findings but what happens next. The Uniform Guidance assigns the auditee two documents in 2 CFR 200.511. The summary schedule of prior audit findings reports the status of every finding from the prior audit's schedule of findings, with the auditor's reference number and the fiscal year in which each finding first occurred. Fully corrected findings need only be listed with a statement that corrective action was taken. Findings not corrected or only partly corrected must describe the reasons the finding recurred, the planned corrective action, and any partial action taken. If the action taken differs significantly from what was previously reported, the schedule must explain why. A finding can be described as no longer valid only if two years have passed since the report containing it was submitted to the Federal Audit Clearinghouse, no federal agency or pass-through entity is following up, and no management decision was issued.

The corrective action plan addresses each current-year finding. It must be a separate document from the auditor's findings, and for each finding it must name the responsible contact person, describe the corrective action planned, and give the anticipated completion date. If you disagree with a finding or believe no corrective action is required, the plan must explain your reasons in detail. The auditor will test the summary schedule next year, and federal agencies and pass-through entities use both documents in issuing management decisions. A vague plan, such as "management will strengthen controls," invites a repeat finding and erodes credibility with funders.

AI is particularly good at drafting these documents well, because a good corrective action plan has a predictable structure. Give the model the finding exactly as the auditor wrote it, including the criteria, condition, cause, effect, and recommendation, along with your honest description of what went wrong and what you intend to change. Ask it to draft a response that addresses the stated cause rather than the symptom, names a specific control with an owner and a frequency, sets a realistic completion date, and describes the evidence that will show the fix is working. Ask it to compare a recurring finding to last year's response and to explain plainly why the previous corrective action did not work, since that is exactly what the summary schedule must disclose. It can also flag language that over-promises or that concedes more than the facts support.

Two limits apply. First, the response is management's statement, and leadership must agree with every word before it goes to the auditor. Second, if you disagree with a finding, the AI can help structure your reasoning, but the decision to contest a finding, and the substance of the disagreement, should involve your executive director, your board finance committee where appropriate, and sometimes counsel. Disputing a finding is legitimate. Doing it on the strength of a confident model output that misreads the requirement is not.

What AI Must Not Do in a Single Audit

The value of AI in Single Audit preparation is real, and so are the ways it can go wrong. The first and most important limit is that AI must never create or alter evidence. It can find documents, summarize them, check them against requirements, and draft new documents that are clearly current, such as a corrective action plan or a policy adopted today. It must not generate a timesheet certification, a procurement memo, a monitoring report, or an approval that should have existed at the time of the transaction and did not. Backdated or fabricated documentation in a federal audit can expose an organization to far more than a finding, including potential False Claims Act liability. If a document is missing, the honest answer is that it is missing.

The second limit is that AI does not decide. It does not determine whether an agreement is a subaward or a contract, whether a cost is allowable, whether a program is clustered, or whether a finding should be contested. It surfaces questions and drafts reasoning, and people with the authority and the expertise make the call, with the auditor and federal or pass-through officials where the rules require it. Language models are fluent and confident, and federal compliance questions often have a right-sounding answer that misses one decisive detail in the award terms. Treat model conclusions as hypotheses to verify against the source.

The third limit is data. Grant files contain payroll records, Social Security numbers on personnel documents, client eligibility information, and other sensitive material. Use only AI tools your organization has approved for that category of data, under terms that do not allow the vendor to train on your inputs, and strip personal details from anything you can before analysis. Much of the SEFA, compliance matrix, and corrective action work can be done with award-level data and descriptions that contain nothing sensitive.

The fourth limit concerns the auditor relationship. The SEFA, the summary schedule, and the corrective action plan are management's responsibility. Preparing them yourself with AI support is appropriate, and it generally reduces the nonattest services you would otherwise ask your auditor to provide, which is good for independence. Be transparent with your auditor about how schedules were prepared, keep the source data and reconciliations that support them, and never present AI-generated analysis as though it were the output of a control that a person performed. Finally, keep a simple record of what AI was used for in the preparation, in line with any AI audit trail practices your organization has adopted.