What Is a Yellow Book Audit? Government Auditing Standards Explained

The term "Yellow Book audit" sounds arcane, but for any organization receiving federal or state funding, it describes a critically important audit standard. The Yellow Book -- officially titled Government Auditing Standards -- is published by the U.S. Government Accountability Office (GAO) and establishes enhanced requirements for auditors working in government environments. Understanding what the Yellow Book requires, who must follow it, and how it connects to the federal Single Audit is essential knowledge for CFOs and executive directors at nonprofits, government contractors, and public institutions.

What Is the Yellow Book?

The Government Auditing Standards (GAGAS) publication earned its informal "Yellow Book" name from the color of its cover -- a tradition that has persisted through multiple editions even as the publication has moved online. The GAO publishes revised editions periodically, with the most recent significant revision issued in 2018 (and effective for periods beginning on or after July 1, 2019). GAGAS applies to financial audits, attestation engagements, and performance audits conducted by government audit organizations and CPA firms when auditing government entities, programs, activities, and functions, or entities that receive government assistance.

GAGAS vs. GAAS: What the Yellow Book Adds

The Yellow Book incorporates all of the requirements of generally accepted auditing standards (GAAS) and then adds additional requirements in several key areas. It is important to understand that a Yellow Book audit is a GAAS audit plus more -- not a different audit. The additional requirements fall into three main categories: independence, continuing professional education, and reporting. Independence under GAGAS is stricter than under GAAS. GAGAS prohibits auditors from performing non-audit services (bookkeeping, payroll processing, financial statement preparation) for the entities they audit when those services would impair audit independence. This creates practical complications for small nonprofits whose CPA firm both prepares their financial statements and audits them -- under GAGAS, the auditor generally cannot perform both services for the same entity.

CPE Requirements Under GAGAS

Auditors who perform Yellow Book engagements must complete 80 hours of continuing professional education every two years, of which at least 24 hours must be directly related to government auditing, the government environment, or the specific type of entity being audited. This enhanced CPE requirement ensures that Yellow Book auditors maintain current knowledge of government-specific accounting and auditing developments. When selecting a CPA firm for a Yellow Book engagement, verify that the audit staff assigned to your engagement have met the GAGAS CPE requirements. Firms that primarily serve private-sector clients may not have sufficient government audit CPE to qualify for Yellow Book engagements.

The Additional Reports Required

The most visible difference between a standard GAAS audit and a Yellow Book audit is the additional reports that GAGAS requires. A standard GAAS audit produces one opinion: the auditor's report on the financial statements. A Yellow Book financial audit produces three reports: the report on the financial statements (same as GAAS); a report on internal control over financial reporting, which describes any material weaknesses and significant deficiencies identified during the audit; and a report on compliance with applicable laws, regulations, contracts, and grant agreements. These additional reports are what grantors and awarding agencies use to assess the financial management capabilities and compliance culture of funded organizations. A "clean" Yellow Book engagement means all three reports are unmodified -- a significant achievement that reflects well on the organization.

Who Must Follow GAGAS

GAGAS is required when three conditions are present: the entity being audited has received government financial assistance (federal, state, or local); the grant agreement, contract, or applicable law specifies that the audit be conducted in accordance with Government Auditing Standards; and the auditor has accepted the engagement on those terms. In practice, GAGAS applies to: all Single Audits under 2 CFR Part 200 (which expressly require GAGAS); audits of state and local governments and their component units; audits of nonprofit organizations where the grant agreement specifies GAGAS; and some performance audits of government programs. If your grant agreement contains language requiring an audit "in accordance with Government Auditing Standards" or "GAGAS," your auditor must follow the Yellow Book.

The Connection to the Single Audit

The federal Single Audit (required when an organization expends $1,000,000 (raised from $750,000 effective for fiscal years beginning on or after October 1, 2024) or more in federal awards in a fiscal year) is always conducted under both GAGAS and the requirements of 2 CFR Part 200. The Uniform Guidance requires that the financial statement audit portion of the Single Audit follow GAGAS, and the compliance portion (testing major program compliance and internal controls over compliance) follows the additional requirements of 2 CFR Part 200, Subpart F. This means that every Single Audit auditor must be Yellow Book qualified -- they must have met the GAGAS independence, CPE, and reporting requirements. When selecting an auditor for a Single Audit engagement, Yellow Book qualification is non-negotiable.

Independence Implications: The Self-Review Threat

The GAGAS independence requirements create real practical challenges for some nonprofits. Under GAGAS, if your CPA firm prepares your financial statements, then audits those same statements, a "self-review threat" to independence exists. The auditor is, in essence, auditing their own work. GAGAS requires that auditors evaluate this threat and, if it cannot be reduced to an acceptable level, decline the audit engagement. For small nonprofits that rely on a single CPA firm for all financial services, this means either having the firm audit financial statements that management prepared (requiring the nonprofit to have staff capable of preparing GAAP financial statements) or engaging a different firm for the audit. This separation of roles is more complex to manage but is a fundamental requirement of Yellow Book independence.

Finding a Yellow Book-Qualified Auditor in DC, Maryland, and Virginia

Not every CPA firm that performs financial statement audits is qualified to perform Yellow Book audits. When evaluating firms for a GAGAS engagement, ask specifically: How many of your auditing staff have completed the 80-hour GAGAS CPE requirement in the current two-year cycle? How many Yellow Book audits did your firm complete in the past year? Can you provide references from nonprofit clients with similar federal funding profiles? Do you have experience with our specific major federal programs (Title I, CDBG, Head Start, etc.)? A firm with deep Yellow Book experience in the DC area will have auditors who regularly participate in AICPA Government Audit Quality Center (GAQC) training, attend GAO-sponsored updates, and stay current on federal program compliance supplement changes.