Yellow Book Audit Standards for Government Contractors (2024 GAGAS)

A Yellow Book audit is an audit, attestation engagement or review performed under Government Auditing Standards (GAGAS), the rules the U.S. Government Accountability Office publishes with a yellow cover. If your company spends federal grant money, holds cost-type federal contracts, or works for a state or local agency that writes GAGAS into the contract, you will eventually face one. The standards sit on top of the AICPA's auditing rules and add stricter independence, extra reporting on internal control and compliance, and specific training rules for the audit team.

The rules changed recently. GAO issued the 2024 revision of the Yellow Book on February 1, 2024, and it now governs most engagements covering 2026.

What the Yellow Book is, and which revision applies now

GAO first issued the standards in 1972 and revises them every few years. The 2018 revision governed audits for most of the last decade. The 2024 revision replaced it on these dates, per GAO's Yellow Book page:

In practice, a contractor with a calendar-year 2026 fiscal year gets a 2024-revision audit. A nonprofit or contractor with a fiscal year that began July 1, 2025 is still audited under the 2018 revision unless the audit firm chose early implementation.

The biggest change is chapter 5. Audit organizations moved from "quality control" to a risk-based quality management system, scaled to the firm's size, with engagement quality reviews left optional. Firms that already comply with the AICPA's SQMS No. 1 can use that system for GAGAS work. Chapter 6 also gained guidance on key audit matters for government audits. For you as the auditee, the visible effect is that your audit firm is documenting more about how it manages quality, and it may ask more pointed questions about risk at planning.

When is a Yellow Book audit required?

GAGAS applies when a law, regulation, contract, grant agreement or policy says it does. Nothing in the standards themselves forces a private company into a Yellow Book audit. The common triggers are below.

Federal awards at or above $1 million (the Single Audit)

Under 2 CFR 200.501, a non-federal entity (state, local government, tribe, college, nonprofit) that expends $1,000,000 or more of federal awards in its fiscal year needs a Single Audit or program-specific audit. The 2024 Uniform Guidance raised that figure from $750,000 for fiscal years beginning on or after October 1, 2024. Single Audits must follow GAGAS. If you are still quoting the $750,000 number, you are out of date for most entities. Our breakdown of Single Audit requirements for federal awards walks through major program selection and the data collection form.

Two points catch contractors out. The test is federal dollars expended, not awarded or received. And under 2 CFR 200.512 the reporting package is due the earlier of 30 days after you receive the auditor's report or nine months after year end.

For-profit subrecipients

Subpart F of the Uniform Guidance does not apply to for-profit organizations. When a state or prime awardee passes federal money to a for-profit company, the pass-through entity sets the compliance requirements in the subaward. Those can include a pre-award audit, monitoring or a post-award audit, and many pass-through agreements specify GAGAS. Read the subaward terms before you assume you are exempt.

Vendors versus subrecipients

A company selling goods or services to a grantee is usually a contractor (vendor), and federal award compliance requirements normally do not flow down to it. The line is whether you are carrying out part of the federal program or just supplying it. Get that classification in writing, because it decides whether you are audited at all.

DCAA and other agency audits of federal contractors

The Defense Contract Audit Agency performs its contract audits (incurred cost submissions, forward pricing, accounting system reviews) under GAGAS. Here the government's auditors apply the Yellow Book to you, so you do not hire anyone. Cost-type and time-and-materials contractors see this most often.

State and local government contracts

Many state agencies, housing authorities and transit districts write a GAGAS audit clause into contracts and grants funded with their own or federal pass-through money. The requirement lives in the contract, so it can apply below the $1 million threshold.

Types of Yellow Book engagements

GAGAS covers four engagement types. Contractors mostly see the first two.

• Financial audits. An opinion on financial statements, plus GAGAS reporting on internal control over financial reporting and on compliance with laws, regulations, contracts and grant agreements.
• Attestation engagements. Examinations, reviews or agreed-upon procedures on a specific subject, such as an indirect cost rate proposal, a billing system or compliance with contract terms.
• Reviews of financial statements. Limited assurance under GAGAS, added as a distinct category in the 2018 revision.
• Performance audits. Assessments of a program's effectiveness, efficiency or internal control. These are mostly done by inspectors general and government audit shops.

If you are unsure where an attestation engagement sits relative to a full audit, our comparison of financial statement audit vs review vs compilation explains the assurance levels.

Yellow Book audit vs a standard GAAS audit

GAGAS incorporates the AICPA's generally accepted auditing standards for financial audits and adds requirements. If you know GAAS standards, these are the differences that change your audit:

The CPE rule is what usually disqualifies a firm. Every auditor who plans, directs, performs or reports on the engagement needs 80 hours of CPE in each two-year period, and 24 of those must relate directly to government auditing, the government environment or the specific program. A firm that has not tracked those hours cannot sign a GAGAS report.

Independence and nonaudit services

Yellow Book independence is stricter than most contractors expect. The auditor may not take on management responsibilities: setting policies, approving transactions, owning your accounting records or designing your internal controls. Other nonaudit services, such as preparing the financial statements from your trial balance, are allowed only after the auditor evaluates the threat, applies safeguards and confirms your staff has the skill to oversee the work.

This matters when the same firm does your bookkeeping and your audit. Separate those roles before year end. Many contractors keep an outside close team for monthly accounting and use the audit firm only for assurance. Outsourced audit support works on the auditor's side of that line, helping CPA firms staff GAGAS engagements without adding headcount.

What auditors test at government contractors

These areas produce most findings:

1. Cost allowability. Every charged cost must be allowable under FAR Part 31 (contracts) or 2 CFR 200 Subpart E (grants), allocable to the award and supported. Alcohol, entertainment, lobbying and bad debts are unallowable and must be screened out of billed pools.
2. Labor charging. Timesheets must match billed hours and labor categories, with supervisor approval. Effort reporting for grant-funded staff gets close attention.
3. Indirect rates. Pools and allocation bases must be consistent year to year, and provisional billing rates need reconciling to actual rates. Sound cost accounting makes the indirect rate defensible.
4. Procurement. Grantees must follow 2 CFR 200 procurement standards: competition, price or cost analysis above thresholds, and suspension and debarment checks on SAM.gov.
5. Records retention. Uniform Guidance generally requires records for three years from submission of the final expenditure report. FAR contracts generally require three years after final payment, with longer periods in some agencies.

Weak internal controls testing shows up across all five. Segregation of duties in a small finance team is the most common finding we see written up.

A worked example

A nonprofit health clinic has a June 30 fiscal year. For the year ended June 30, 2026, it expended $940,000 in federal grants. Because its fiscal year began July 1, 2025, after October 1, 2024, the $1,000,000 threshold applies and no Single Audit is required. If the clinic's state contract requires a GAGAS audit anyway, the engagement covers a period that began before December 15, 2025, so the 2018 revision applies unless the firm implemented 2024 early.

For the year ending June 30, 2027, federal spending rises to $1.3 million. Now a Single Audit is required, it follows the 2024 GAGAS revision, and the reporting package is due 30 days after the auditor's report or March 31, 2028 (nine months after year end), whichever comes first. The clinic's nonprofit accounting records need a schedule of expenditures of federal awards built from the general ledger by assistance listing number.

How contractors prepare

• Read every award and contract for audit clauses. List which ones require GAGAS, the due date and who receives the report.
• Build the schedule of federal expenditures monthly. Reconciling it to the general ledger at year end is where audits stall.
• Write cost policies down. Timekeeping, travel, procurement and cost allocation each need a short written policy that staff actually follow.
• Clean up indirect cost pools before fieldwork. Remove unallowable costs and document the allocation base.
• Prepare the request list early. Our PBC request list template adapts well to GAGAS audits once you add award files and procurement support.
• Vet the audit firm. Ask for its latest peer review report, its GAGAS CPE tracking and how it designed its quality management system for the 2024 revision.

Expect the auditor to set lower thresholds for federal programs than for your overall statements. Materiality and risk in audits explains why a small dollar error can still produce a compliance finding. If this is your first audit of any kind, start with our guide to preparing for your first external audit. Regulated entities have their own variants, covered in our credit union audit requirements piece.

FAQ

Who publishes the Yellow Book and where do I get it?

The U.S. Government Accountability Office publishes it. The 2024 revision (GAO-24-106786) is free on GAO's website in PDF and in an online version, and printed copies are sold through the Government Publishing Office.

Does a for-profit company ever need a Single Audit?

Not under Subpart F, which excludes for-profit organizations. A for-profit company can still be required to get a GAGAS audit through its subaward or contract terms, and DCAA can audit it under GAGAS.

Can our regular CPA firm do a Yellow Book audit?

Only if every team member meets the 80-hour and 24-hour CPE rule, the firm has had an external peer review within the last three years, and the firm is independent under GAGAS. If it also keeps your books, that independence question needs an answer before the engagement starts.

How much more does a Yellow Book audit cost than a regular audit?

There is no published benchmark. The added cost comes from the internal control and compliance reports, compliance testing of major programs in a Single Audit, and the firm's GAGAS overhead. Ask for a separate quote on the compliance work so you can compare firms.

What happens after a Yellow Book audit finds questioned costs?

The finding goes to the awarding agency or pass-through entity with your corrective action plan. The agency issues a management decision, which can disallow the cost and require repayment, or accept your documentation and close the finding. Unresolved findings carry into the next year's summary schedule of prior audit findings, so fix the underlying control quickly.

Is the 2018 Yellow Book still used?

Yes, for engagements covering periods that began before December 15, 2025, unless the firm adopted the 2024 revision early. Fiscal years starting mid-2025 are the main group still on 2018 rules, so expect both revisions in use through 2026.

Next step

Madras Accountancy supports CPA firms on GAGAS and Single Audit fieldwork, and helps contractors and nonprofits keep award schedules, indirect rates and close files audit-ready. Talk to our team about your next Yellow Book audit.