Auditor selection guide

    How to Choose a Nonprofit Auditor in DC, Maryland & Virginia (2026 Guide + Free RFP Builder)

    Reviewed by the Your Virtual CPA audit team · Last reviewed September 2026

    Quick answer

    In the DMV, only Maryland sets a statutory audit threshold: a review at $400,000 and an audit at $1,000,000 of charitable contributions (from July 1, 2026). DC and Virginia set none. Everywhere, $1,000,000 in federal expenditures triggers a Single Audit. Confirm your requirement, vet firms with our checklist, and send one RFP.

    Jump to the free RFP builder

    Step 1: Audit, review, or compilation — which do you need?

    Before you ask firms for proposals, confirm the level of service your funders, lenders, regulators and bylaws require. An audit provides reasonable assurance, a review provides limited assurance, and a compilation provides no assurance. Compare the three.

    Maryland

    Under Md. Code, Bus. Reg. § 6-402, as amended by 2026 Md. Laws ch. 394 (effective July 1, 2026): a CPA audit at $1,000,000+ and a CPA review at $400,000–$999,999 of gross income from charitable contributions. Government grants are excluded from the count.

    Maryland nonprofit audit requirements →

    Washington DC

    No statutory audit or review threshold for the charitable solicitation license. Audits come from funders, DC grant terms, lenders, bylaws, the DC Public Charter School Board (for charter schools), or the Single Audit rule.

    DC nonprofit audit requirements →

    Virginia

    No statutory audit or review threshold for charitable registration. VDACS accepts the Form 990 (or audited statements). Audits come from funders, grant terms, lenders, bylaws, or the Single Audit rule.

    Virginia nonprofit audit requirements →

    Federal Single Audit (all states)

    Expending $1,000,000 or more in federal awards in a fiscal year beginning on or after October 1, 2024 requires a Single Audit under 2 CFR 200.501 ($750,000 for earlier fiscal years). A review or compilation never satisfies this requirement.

    Single Audit checker →

    Organizations that solicit across the region must follow each jurisdiction where they solicit — a DC or Virginia nonprofit raising money from Maryland residents registers in Maryland and can fall under its review or audit tiers.

    Audit Requirement Checker Single Audit Checker

    Step 2: Auditor selection checklist

    • Peer review report

      Ask for the firm’s most recent peer review report (and letter of response, if any). A “pass” rating is the baseline; confirm the review covered the kind of engagement you need.

    • Yellow Book CPE for government audits

      If you need a Single Audit or GAGAS audit, the team must meet Yellow Book CPE: 80 hours every two years, including 24 hours directly related to government auditing.

    • Independence

      The firm should confirm in writing that it is independent of your organization. If it also prepares your books or Form 990, ask how it manages those non-attest services.

    • Team bios and continuity

      Get names and experience for the partner, manager, and in-charge — and how many of them will stay on your engagement year to year.

    • Multi-year fee proposal

      Request fees for each year of a two- or three-year term, what’s included, and how extra work is billed, so you can compare proposals on the same basis.

    • Timeline that meets your deadlines

      Map report dates to funder, lender, state registration, and Federal Audit Clearinghouse deadlines before you sign.

    • References from similar organizations

      Call two or three current clients of similar size and funding mix. Ask about responsiveness, surprises, and how findings were communicated.

    Step 3: Build your audit RFP (free)

    Answer a few questions and we’ll generate a professional request for proposals — scope, background, required proposal contents, timeline and evaluation criteria — that you can send to any firm. Transparent, fair fees — quoted upfront.

    Nothing is sent until you choose to send it.

    Frequently asked questions

    Plan on 8–12 weeks: 1–2 weeks to draft the RFP, 3–4 weeks for firms to respond, 2–3 weeks for interviews and reference checks, and a board or audit committee vote. Start at least three to four months before fiscal year-end so the new firm can plan before fieldwork.

    There is no universal legal requirement for nonprofits to change audit firms. Many boards re-bid the audit every three to five years to confirm fees and quality, and some funders or government bodies set their own rotation rules. Rotating the engagement partner can also refresh the perspective without changing firms.

    A peer review is an independent evaluation of a CPA firm’s accounting and auditing practice, performed by another CPA firm, generally every three years. Firms that perform audits and other attest work must enroll to be AICPA members and, in most states, to hold a firm license; Yellow Book audits also require an external peer review.

    It depends on who is asking for the report. The federal Single Audit rule, Maryland’s charitable registration tiers, grant agreements, lenders, and your bylaws each set their own requirement. An audit gives reasonable assurance, a review gives limited assurance, and a compilation gives none.

    For Single Audits, 2 CFR 200.509 directs auditees to follow procurement standards and to consider responsiveness, relevant experience, staff qualifications, the results of peer and external quality control reviews, and price.

    Related audit resources

    Auditor selection guides by area

    Reviewed by the Your Virtual CPA audit team. Last reviewed September 2026. This guide is general information, not legal advice; confirm requirements with your funders, lenders, governing documents and state regulator.

    Send a messageFree consultation