Compliance Audit Services
Nonprofit compliance audit services for California grant-funded and public organizations: grant, contract and federal compliance testing and controls.
Schedule a Consultation
Nonprofit Compliance Audit Services for Grant-Funded Organizations
Grant agreements, contracts, statutes and program rules set specific conditions on how an organization spends, documents and reports the money it receives. RTN CPA's nonprofit compliance audit services give boards, funders and oversight agencies an independent answer to a focused question: did the organization comply with the requirements within the engagement's scope?
A clean financial statement audit opinion does not mean every grant term, procurement rule or reporting deadline was tested. A compliance audit addresses identified criteria for a defined program, award or period. It is one of the services of our assurance practice, which specializes in nonprofit and governmental organizations, including grant-funded and mission-driven entities.
What Is a Compliance Audit?
A compliance audit is an independent engagement in which an auditor gathers evidence about whether an entity complied with specified requirements, such as regulations, award terms, contract provisions or program rules, and reports the results. It covers only the requirements, programs and period defined for the engagement, not every law that applies to the organization.
- Governmental audit requirements. When a requirement such as the Uniform Guidance calls for an opinion on compliance, the auditor follows AICPA AU-C section 935, Compliance Audits.
- Examinations of compliance. When a grantor, contract or regulator asks for an opinion on compliance with specified requirements outside a governmental audit requirement, the engagement is generally an examination under AICPA attestation standards (AT-C section 315).
- Agreed-upon procedures. Some funders ask only for specific procedures and a report of findings, with no opinion on compliance.
A policy review or consulting assessment is not a compliance audit. Before work begins, the organization, the requesting party and the auditor should agree on the criteria, the period and the expected report.
The 12 Types of Federal Compliance Requirements
For federal programs, OMB's annual Compliance Supplement (2 CFR Part 200, Appendix XI) groups compliance requirements into 12 types and identifies which apply to each program it covers.
Not every type applies to every program, and a stand-alone grant compliance audit may use different criteria altogether.
Compliance Audit vs. Financial Statement Audit
The two engagements often draw on the same records but answer different questions. A financial statement audit addresses whether the financial statements are presented fairly, in all material respects, under the applicable reporting framework. A compliance audit addresses whether the organization met specified requirements for a program, award or contract.
- Criteria: accounting standards such as U.S. GAAP, versus laws, regulations and agreement terms.
- Materiality: the financial statements as a whole, versus the compliance requirements and program audited.
- Internal control: control over financial reporting, versus control over compliance. They overlap but are not the same.
- Report: an opinion on the financial statements, versus a report on compliance, often with findings.
An organization can receive an unmodified financial statement opinion and still have compliance findings, such as unsupported grant charges or a late required report.
- Activities allowed or unallowed
- Allowable costs/cost principles
- Cash management
- Eligibility
- Equipment and real property management
- Matching, level of effort, earmarking (cost sharing, including matching, for awards under the 2024 revisions)
- Period of performance
- Procurement and suspension and debarment
- Program income
- Reporting
- Subrecipient monitoring
- Special tests and provisions
Compliance Audit vs. Single Audit
A Single Audit is a specific federal engagement. Under 2 CFR 200.501, a non-federal entity that expends $1,000,000 or more in federal awards in a fiscal year beginning on or after October 1, 2024 ($750,000 for earlier fiscal years) must have a Single Audit or, in limited cases, a program-specific audit. It combines a financial statement audit performed under Government Auditing Standards with a compliance audit of major federal programs, including tests of internal control over compliance (2 CFR 200.514). That compliance work covers requirements that may have a direct and material effect on each major program, not all of the organization's compliance.
A separate compliance audit or examination may be appropriate when a state agency, county, foundation or contract requires one, or when management wants assurance on a specific program. For threshold, major program and SEFA questions, see our Uniform Guidance and Single Audit services.
Internal Control Over Compliance
Internal controls make compliance routine rather than accidental. For federal awards, 2 CFR 200.303 requires recipients and subrecipients to establish, document and maintain effective internal control that provides reasonable assurance the award is managed in compliance with federal statutes, regulations and award terms, which should align with GAO's Green Book or the COSO framework.
A written policy is only the starting point; there should be evidence the control operated. Small finance teams that cannot fully segregate duties can often reduce risk through management or board review.
- Approval of expenditures before they are charged to an award
- Time and effort records supporting payroll allocated to programs
- Reconciliation of funder reports to the general ledger
- Procurement procedures, including required quotes and SAM.gov exclusion checks
- Tracking of award budgets, periods of performance and report due dates
- Monitoring of subrecipients, where funds are passed to others
Findings, Questioned Costs and Corrective Action
A useful finding states the criteria, the condition found, the cause and the effect, with a recommendation. Federal rules require this structure for Single Audit findings (2 CFR 200.516), and it helps in any engagement.
In federal award audits, a questioned cost is an amount expended or received from a federal award that, in the auditor's judgment, is noncompliant or suspected noncompliant, lacked adequate documentation at the time of the audit, or appeared unreasonable (2 CFR 200.1). A control deficiency alone does not create a questioned cost.
Management owns the response. For federal audits, the auditee prepares a corrective action plan, separate from the auditor's findings, naming the responsible contact, the planned action and the expected completion date (2 CFR 200.511). Auditors explain findings and recommend improvements, but deciding which recommendations to implement remains management's responsibility under independence rules.
Preparing for a Compliance Audit
Preparation reduces disruption and the chance that a finding results from missing paperwork rather than an actual compliance failure. Practical steps for management:
- Assemble every award, subaward, contract and amendment in scope, with approved budgets.
- List each funding source's requirements, including report due dates and record-retention periods.
- Reconcile award expenditures to the general ledger and to reports submitted to funders.
- Organize invoices, approvals, payroll and time records, and procurement files for transactions charged to awards.
- Update the status of prior findings and corrective actions.
- Involve program staff, who often carry out eligibility and reporting requirements.
A clear audit trail lets a reviewer trace each reported amount to its transactions, approvals, supporting records and the funding rule that permits it.
- Costs charged to an award without adequate support
- Payroll allocated to grants without supporting time records
- Purchases made without required procurement steps
- Reports that were late or did not agree to the accounting records
- Prior-year findings that were not fully corrected
Compliance Considerations for California Organizations
California nonprofits, special districts and public agencies often work under several layers of requirements. One program may combine federal funds passed through a state department or county, state funding and local contract terms.
Scope should be built from the actual agreements, not from assumptions about a type of California grant. We work with organizations throughout California, including the Sacramento region; see also our article Grant Audit Services Help Organizations Succeed in Sacramento and Los Angeles.
Why RTN CPA for Compliance Audits
Our assurance practice specializes in nonprofit and governmental organizations, including grant-funded and mission-driven entities. Compliance audits complement our broader nonprofit auditing services.
- Scope first. We confirm what report your funder or oversight body expects and which standards apply.
- Clear findings. Results are explained in plain language, with the criteria and evidence behind each finding.
- Practical recommendations. Suggestions are sized to your staffing and systems.
- Responsive communication. We stay accessible during fieldwork and throughout the year.
Every engagement is subject to professional independence requirements and our engagement-acceptance procedures. Any readiness assistance is limited to what those rules permit; management remains responsible for its records, controls and corrective actions.
- Pass-through awards carry added terms. Under 2 CFR 200.332, each subaward must state the federal requirements and any requirements the pass-through entity adds, and must require the subrecipient to give the pass-through entity and auditors access to its records.
- State contracts include audit clauses. California's standard General Terms and Conditions (GTC 02/2025) let the awarding department, the Department of General Services and state auditors review contract records, which must be kept at least three years after final payment unless a longer period is stipulated.
Compliance Requirements an Audit May Cover
Scope depends on the engagement. These categories come up most often in grant compliance audits and federal compliance audits.
- Grant Agreements: Terms of foundation, state and local grants, including approved budgets, allowable activities, spending deadlines, budget-change rules and any audit or reporting clauses in the agreement.
- Federal Award Conditions: Requirements from federal statutes, 2 CFR Part 200, agency regulations and each award or subaward, including conditions a pass-through entity adds for its own oversight.
- State and Local Requirements: Conditions attached to state, county and city funding. They vary by program and agreement, so the scope should cite specific requirements rather than state law in general.
- Contract Requirements: Service-delivery, billing, rate, deliverable and records-access provisions in government and agency contracts, and whether amounts billed are supported by documented work.
- Allowable Costs: Whether charges to an award are allowable, allocable, reasonable and documented under the applicable cost principles and approved budget, including payroll and indirect costs.
- Reporting Obligations: Whether financial, performance and special reports submitted to funders were complete, accurate, supported by the accounting records and filed on time.
- Required Documentation: Eligibility determinations, procurement files, time and effort records, approvals and other support the agreement or regulation requires the organization to create and keep.
- Financial Controls: Approvals, reconciliations and monitoring that help prevent or detect noncompliance, known as internal control over compliance, and whether they operate as described.
How Compliance Testing Generally Works
Procedures are tailored to each engagement's requirements and assessed risk. These steps describe the general flow, not a fixed checklist.
- 1. Define scope and criteria: Identify the awards, contracts, periods and specific requirements in scope, the intended report users and the professional standards that apply.
- 2. Understand the program and its controls: Learn who approves charges, how eligibility is documented, and how funder reports are prepared and reviewed.
- 3. Assess risk of material noncompliance: Consider prior findings, program complexity, staff turnover, new systems and funder monitoring results to decide where testing should focus.
- 4. Test compliance and related controls: Examine evidence such as award documents, invoices, payroll and time records, eligibility files, procurement documentation and submitted reports. Samples vary with the requirement and risk.
- 5. Evaluate exceptions: Decide whether each exception is noncompliance, a control deficiency or a questioned cost, and weigh its significance individually and in the aggregate.
- 6. Report and communicate: Issue the required report and discuss results with management and those charged with governance, including the criteria and evidence behind each finding.
Explore related assurance services
Detailed guides to each engagement we provide.
Serving organizations across our markets
RTN CPA works with nonprofit organizations in these areas. Choose a location to see local requirements and how we help.
Discuss Your Compliance Audit Requirements
Received an audit request in a grant or contract, or unsure what type of report a funder expects? Talk with RTN CPA. We will review the requirements, the intended users and the appropriate type of independent engagement with you.
Frequently Asked Questions
Is a compliance audit the same as a financial statement audit?
No. A financial statement audit addresses whether the financial statements are fairly presented under the applicable framework. A compliance audit addresses whether the organization met specified requirements, such as grant terms, contract provisions or program regulations. A clean financial statement opinion does not mean every compliance requirement was tested.
Does every grant require a compliance audit?
No. Whether an audit is required, and what kind, depends on the award agreement, the funding source, applicable regulations and the organization's circumstances. Some grants require only financial and performance reports; others call for an audit, a compliance report or agreed-upon procedures. Check the audit clause in each agreement.
How does a compliance audit relate to a Single Audit?
A Single Audit includes a compliance audit of major federal programs, plus a financial statement audit under Government Auditing Standards and reporting on the schedule of expenditures of federal awards. It applies when federal expenditures reach $1,000,000 in a fiscal year beginning on or after October 1, 2024. Other compliance audits are driven by state, local or contract requirements.
Can a compliance audit cover a single grant or program?
Often, yes. When the funder's requirement allows it, the scope can be limited to one award, program, contract or period, and the report describes that scope. The results then say nothing about awards outside it. If a federal Single Audit is required, its scope is set by 2 CFR Part 200 rather than by the organization's choice.
Is an agreed-upon procedures engagement a compliance audit?
No. In an agreed-upon procedures engagement, the practitioner performs specific procedures and reports findings without an opinion or conclusion on compliance. Pass-through entities sometimes use these engagements to monitor subrecipients. A compliance audit or examination is designed to support an opinion on whether the organization complied, in all material respects, with specified requirements.
Who is responsible for corrective action after a finding?
Management. The organization decides how to respond, makes the changes and, for federal audits, prepares the corrective action plan and the summary schedule of prior audit findings. The auditor reports findings, may recommend improvements and follows up in later audits, but does not decide which recommendations to adopt.
Call (888) 616-8070 or schedule a consultation to get started.
Schedule a Consultation