Yellow Book Audit Services — GAGAS for DC, MD & VA Organizations

    What is a Yellow Book audit and when is it required?

    A Yellow Book audit is an audit performed under Government Auditing Standards (GAGAS), issued by the U.S. Government Accountability Office. It is required for every Single Audit and whenever a government grant or contract specifies GAGAS. Yellow Book audits add internal control and compliance reporting; the 2024 revision applies to periods beginning on or after December 15, 2025.

    Why Organizations Come to Us

    Our grant requires 'Yellow Book' but we don't know what that means

    Government grants often specify 'Government Auditing Standards' or 'Yellow Book' in their audit requirements clause. This is a common source of confusion — and a compliance risk if your CPA isn't Yellow Book-qualified.

    Our regular CPA isn't GAGAS-qualified

    Yellow Book auditors must complete 80 hours of CPE every 2 years, including 24 hours specific to government auditing. Many general CPAs lack this credential, making their Yellow Book opinions invalid.

    We got a finding about 'noncompliance with laws and regulations'

    GAGAS requires auditors to report on compliance with laws, regulations, and grant provisions — this produces findings that GAAS audits don't. Organizations are often surprised by the broader scope.

    Our prior auditor's independence is in question

    Yellow Book independence standards are stricter than GAAS. CPAs who provide bookkeeping, payroll, or management functions to an audit client may be prohibited from performing the Yellow Book audit. This can retroactively invalidate prior-year audits.

    Our state grant requires Yellow Book but our federal grant requires Single Audit

    These often overlap. We perform both simultaneously — the GAGAS report is incorporated into the Single Audit report package, avoiding duplicate audit procedures and cost.

    Ready to talk it through?

    Key Yellow Book Terms

    GAGAS (Generally Accepted Government Auditing Standards)
    Auditing standards published by the U.S. Comptroller General in the 'Yellow Book.' GAGAS incorporates GAAS but adds requirements for auditor independence, continuing professional education, audit quality, and expanded reporting on internal controls and compliance.
    Management Letter
    A written communication from the auditor to management identifying control deficiencies and operational improvements noted during the audit. Yellow Book audits require communication of deficiencies not significant enough to be 'findings' but still worth management's attention.

    Standard Audit vs. Yellow Book Audit

    FeatureGAAS (Standard Audit)Yellow Book / GAGAS
    Governing standardsAICPA AU-C SectionsGAO Government Auditing Standards + GAAS
    Required forAny financial statement auditGovernment grants specifying GAGAS; Single Audits
    Reports issued1 opinion reportFS opinion + GAGAS internal controls report + compliance report
    Auditor CPE120 hours/3 years (general)80 hours/2 years (GAGAS-specific, 24 hrs government)
    Independence rulesGAAS independenceStricter — no management functions, broader threats
    Cost vs. GAASBaseline+20–40% premium for GAGAS procedures

    Our Process

    1

    Independence Assessment

    We confirm GAGAS independence before engagement, reviewing any consulting or bookkeeping services to ensure no prohibited non-audit services.

    2

    Risk Assessment & Planning

    We assess risks under both GAAS and GAGAS standards, identifying areas requiring expanded internal control testing and compliance procedures.

    3

    Expanded Audit Procedures

    Beyond financial statement testing, we evaluate the design and operating effectiveness of internal controls over financial reporting and compliance with laws and grant requirements.

    4

    GAGAS Reporting

    We issue the additional GAGAS reports required: a report on internal controls over financial reporting, and a report on compliance with provisions of laws, regulations, contracts, and grant agreements.

    DC, Maryland & Virginia Specifics

    Many DC, Maryland, and Virginia state/local grants specify Yellow Book in the audit requirement clause. Examples: DC DHHS grants, Maryland MSDE and DHS grants, Virginia DMAS and DSS grants. If your organization received HUD, EPA, or DOE pass-through funding from state agencies, Yellow Book likely applies.

    Washington DC

    DC DHHS and Office of Grants Management frequently specify GAGAS in grant agreements. Check your award document's audit requirement clause before engaging a non-GAGAS CPA.

    Maryland

    Maryland MSDE and DHS grants commonly require Yellow Book. Organizations receiving BRAC, CDBG, or HOME funds through the state should verify GAGAS requirements in their agreements.

    Virginia

    Virginia DMAS and DSS grants often require Yellow Book compliance. Government contractors receiving VDOT or VDOE subgrants should also confirm audit standard requirements.

    Frequently Asked Questions

    Not exactly. A Single Audit requires Yellow Book/GAGAS as its audit standard — so every Single Audit is a Yellow Book audit. But Yellow Book can also be required for audits that don't meet the $1M federal threshold. Yellow Book is the standard; Single Audit is the engagement type.

    Check the audit requirements section of your grant agreement. Common language includes: "audit must be performed in accordance with Government Auditing Standards," "GAGAS," or "Yellow Book." If unclear, we can review your grant agreement and advise.

    Yes. Yellow Book auditors must complete 80 hours of CPE every 2 years, of which 24 hours must be directly related to government auditing, the government environment, or the specific environment of the audited entity. Our CPAs maintain current Yellow Book qualifications.

    Yellow Book independence standards are stricter than GAAS. Auditors may never assume management responsibilities, and nonaudit services such as preparing the financial statements, bookkeeping or payroll create a self-review threat that must be evaluated and documented; if safeguards cannot reduce it to an acceptable level, the auditor cannot perform the service. Many organizations therefore prepare their own statements or use a separate firm. We discuss independence before any engagement begins.

    GAGAS auditors must report all significant deficiencies and material weaknesses in internal controls, and all instances of noncompliance with laws, regulations, and grant provisions that are material to the financial statements. These are reported in separate GAGAS reports beyond the standard financial statement opinion.

    GAGAS applies when a law, regulation, grant agreement or contract requires it. In practice that includes every Single Audit under 2 CFR 200 Subpart F, audits of state and local governments, and many nonprofit, charter school and housing audits where the funder specifies Government Auditing Standards in the award.

    In addition to the opinion on the financial statements, the auditor issues a report on internal control over financial reporting and on compliance and other matters based on the audit. When a Single Audit applies, a third report covers compliance for each major federal program and related internal control.

    GAO issued the 2024 revision of Government Auditing Standards (GAO-24-106786). For financial audits, attestation engagements and reviews of financial statements it is effective for periods beginning on or after December 15, 2025; earlier periods follow the 2018 revision as amended.

    Yellow Book audit fees depend on the size of the organization, the number of federal programs, and the quality of your records. We are transparent and charge fair fees quoted upfront after a short call. Compared with a GAAS-only audit, the additional effort reflects expanded independence requirements, additional reporting, and the specialized expertise required.

    Yes — when your organization is subject to a Single Audit, the GAGAS procedures are performed as part of the Single Audit package. You don't pay for two separate audits. The GAGAS reports are incorporated into the Single Audit report package.

    If prior-year audits were performed without proper GAGAS qualifications, those audits may not satisfy your grant requirements. This can trigger findings, require re-auditing, or jeopardize grant compliance. We can review prior-year reports and advise on remediation.

    Let's Get Started

    A short call. No pressure. Licensed CPAs serving DC, Maryland, and Virginia.