Yellow Book Audit Services — GAGAS for DC, MD & VA Organizations
What is a Yellow Book audit and when is it required?
A Yellow Book audit is an audit performed under Government Auditing Standards (GAGAS), issued by the U.S. Government Accountability Office. It is required for every Single Audit and whenever a government grant or contract specifies GAGAS. Yellow Book audits add internal control and compliance reporting; the 2024 revision applies to periods beginning on or after December 15, 2025.
Why Organizations Come to Us
Our grant requires 'Yellow Book' but we don't know what that means
Government grants often specify 'Government Auditing Standards' or 'Yellow Book' in their audit requirements clause. This is a common source of confusion — and a compliance risk if your CPA isn't Yellow Book-qualified.
Our regular CPA isn't GAGAS-qualified
Yellow Book auditors must complete 80 hours of CPE every 2 years, including 24 hours specific to government auditing. Many general CPAs lack this credential, making their Yellow Book opinions invalid.
We got a finding about 'noncompliance with laws and regulations'
GAGAS requires auditors to report on compliance with laws, regulations, and grant provisions — this produces findings that GAAS audits don't. Organizations are often surprised by the broader scope.
Our prior auditor's independence is in question
Yellow Book independence standards are stricter than GAAS. CPAs who provide bookkeeping, payroll, or management functions to an audit client may be prohibited from performing the Yellow Book audit. This can retroactively invalidate prior-year audits.
Our state grant requires Yellow Book but our federal grant requires Single Audit
These often overlap. We perform both simultaneously — the GAGAS report is incorporated into the Single Audit report package, avoiding duplicate audit procedures and cost.
Ready to talk it through?
Key Yellow Book Terms
- GAGAS (Generally Accepted Government Auditing Standards)
- Auditing standards published by the U.S. Comptroller General in the 'Yellow Book.' GAGAS incorporates GAAS but adds requirements for auditor independence, continuing professional education, audit quality, and expanded reporting on internal controls and compliance.
- Management Letter
- A written communication from the auditor to management identifying control deficiencies and operational improvements noted during the audit. Yellow Book audits require communication of deficiencies not significant enough to be 'findings' but still worth management's attention.
Standard Audit vs. Yellow Book Audit
| Feature | GAAS (Standard Audit) | Yellow Book / GAGAS |
|---|---|---|
| Governing standards | AICPA AU-C Sections | GAO Government Auditing Standards + GAAS |
| Required for | Any financial statement audit | Government grants specifying GAGAS; Single Audits |
| Reports issued | 1 opinion report | FS opinion + GAGAS internal controls report + compliance report |
| Auditor CPE | 120 hours/3 years (general) | 80 hours/2 years (GAGAS-specific, 24 hrs government) |
| Independence rules | GAAS independence | Stricter — no management functions, broader threats |
| Cost vs. GAAS | Baseline | +20–40% premium for GAGAS procedures |
Our Process
Independence Assessment
We confirm GAGAS independence before engagement, reviewing any consulting or bookkeeping services to ensure no prohibited non-audit services.
Risk Assessment & Planning
We assess risks under both GAAS and GAGAS standards, identifying areas requiring expanded internal control testing and compliance procedures.
Expanded Audit Procedures
Beyond financial statement testing, we evaluate the design and operating effectiveness of internal controls over financial reporting and compliance with laws and grant requirements.
GAGAS Reporting
We issue the additional GAGAS reports required: a report on internal controls over financial reporting, and a report on compliance with provisions of laws, regulations, contracts, and grant agreements.
DC, Maryland & Virginia Specifics
Many DC, Maryland, and Virginia state/local grants specify Yellow Book in the audit requirement clause. Examples: DC DHHS grants, Maryland MSDE and DHS grants, Virginia DMAS and DSS grants. If your organization received HUD, EPA, or DOE pass-through funding from state agencies, Yellow Book likely applies.
Washington DC
DC DHHS and Office of Grants Management frequently specify GAGAS in grant agreements. Check your award document's audit requirement clause before engaging a non-GAGAS CPA.
Maryland
Maryland MSDE and DHS grants commonly require Yellow Book. Organizations receiving BRAC, CDBG, or HOME funds through the state should verify GAGAS requirements in their agreements.
Virginia
Virginia DMAS and DSS grants often require Yellow Book compliance. Government contractors receiving VDOT or VDOE subgrants should also confirm audit standard requirements.
Related Nonprofit Services
Frequently Asked Questions
Let's Get Started
A short call. No pressure. Licensed CPAs serving DC, Maryland, and Virginia.