What should a nonprofit organization's financial audit checklist contain?

What does the checklist contain?

This is the organization's preparation checklist. Each row produces a schedule or document; the auditor runs a separate testing program over them and draws the conclusions, so preparing the schedules is not the audit. Settle the first two rows before assembling anything:

Which level of examination is required, and who requires it?

The AICPA's standards for compilations and reviews (AR-C sections 80 and 90) separate the three levels this way:

The document that compels the engagement sets the level and the deadline:

State rules differ. California's Attorney General summarizes the Nonprofit Integrity Act's audit provisions, effective January 1, 2005 (Government Code section 12586(e)(1)), this way: charitable corporations, unincorporated associations and trustees required to register and file reports with the Attorney General must have annual financial statements audited by an independent CPA in any fiscal year in which they accrue $2 million or more in gross revenue, excluding government grants whose use the nonprofit must account for. The statements must use generally accepted accounting principles, the CPA must follow generally accepted auditing standards, a firm that also provides non-audit services must follow the Yellow Book's independence standards, and the audited statements must be available to the Attorney General and the public within nine months after the fiscal year closes. The same summary requires charitable corporations that must register and file reports with the Attorney General to establish and maintain an audit committee, appointed by the governing board, in any fiscal year in which they accrue $2 million or more in gross revenue, with the same grant exclusion (Government Code section 12586(e)(2)). Confirm the current text with the Attorney General's Registry of Charitable Trusts before relying on it. Where several parties require an engagement, prepare to the highest level and the earliest deadline. A lender's request for reviewed or audited statements is covered separately.

Could federal or pass-through funding require a single audit?

Estimate this fiscal year's Federal expenditures across all awards, including pass-through awards, when each award is signed, and re-total them as spending is recorded through the year. Under 2 CFR 200.501, a non-Federal entity that expends $1,000,000 or more in Federal awards during its fiscal year must have a single or program-specific audit for that year, the program-specific option being an election available only under conditions the section sets. OMB's 2025 Compliance Supplement dates the threshold: it was raised to $1,000,000 for auditee fiscal years beginning on or after October 1, 2024, from the $750,000 set for fiscal years beginning on or after December 26, 2014.

Section 200.501 also says that, unless a program is exempt by Federal statute, awards expended as a subrecipient are subject to audit just as awards expended as a recipient are, while payments received as a contractor for goods or services are not. Below the threshold, an entity is exempt from Federal audit requirements for that year, except as noted in 2 CFR 200.503, but its records must remain available for review or audit by the Federal agency, the pass-through entity and the Government Accountability Office.

Under 2 CFR 200.302, every recipient's and subrecipient's financial management system must provide for the first three records below; a single audit adds the rest:

• Award register. Under 2 CFR 200.302, a recipient's or subrecipient's financial management system must identify every Federal award received and expended, including, as applicable, the Assistance Listings title and number, award identification number, year issued and Federal agency or pass-through entity.
• Spending records. The same section requires records identifying the amount, source and expenditure of Federal funds, supported by source documentation, and a comparison of expenditures with budget for each award.
• Written procedures. The same section requires written procedures to implement the requirements of 2 CFR 200.305 and for determining the allowability of costs in accordance with subpart E and the terms and conditions of the Federal award; keep the versions in force during the period.
• Schedule of expenditures of Federal awards. Under 2 CFR 200.508, the auditee must arrange the audit, prepare financial statements including this schedule, and give the auditor access to personnel, accounts, books, records and supporting documentation.
• Award documents. OMB's Compliance Supplement counts a review of the federal awards for programs selected for testing among the auditor's reasonable procedures.
• Findings follow-up. Section 200.508 also requires prompt corrective action on audit findings, including a summary schedule of prior audit findings and a corrective action plan.

How do you tell conditional, restricted and unrestricted gifts apart?

FASB's Accounting Standards Update 2016-14 has nonprofits report net assets with donor restrictions and net assets without donor restrictions, the first being the part subject to donor-imposed restrictions, and disclose the composition of net assets with donor restrictions at period end.

A condition is not a restriction. Under ASU 2018-08, a contribution is conditional when the agreement includes a barrier that must be overcome and either a right of return of assets transferred or a right of release of the promisor's obligation, a right that must be determinable from the agreement or a document it references; a measurable performance-related barrier is one indicator. Conditional contributions are held as a liability or left unrecognized until the barriers are overcome, while other contributions are recognized immediately, with or without donor restrictions. ASU 2020-07 quotes FASB's definition of a contribution, which includes unconditional promises to give.

Classify each gift from its instrument:

Booking a conditional grant as revenue on signing overstates revenue and net assets until the barrier is met.

How is one restricted gift traced from gift letter to release?

ASU 2016-14 has a restriction expire when the stipulated time has elapsed, when the stipulated purpose has been fulfilled, or both. Where a gift carries both a time and a purpose restriction, the ASU has the release recognized in the period the last of them expires, and a time restriction makes the amount unavailable to support expenses until it expires. Under the same ASU, an expense incurred for a purpose for which both restricted and unrestricted net assets are available fulfills the restriction to the extent of the expense, unless the expense is for a purpose directly attributable to another specific external source of revenue. In this example, a donor gives $30,000 for the literacy program's tutor salaries and books this fiscal year:

1. Gift instrument. The signed letter names the purpose and the current fiscal year, so the gift is available to spend now; it contains no barrier or right of return, so it is restricted, not conditional. The letter and the deposit record are the evidence.
2. Classification. Record it as a contribution with donor restrictions under its own fund code.
3. Tracking. A monthly roll-forward shows the amount received, spending, releases and the balance.
4. Spending. Tutor salaries of $16,000 and books of $6,000 are coded to the program and the fund. Timesheets, payroll registers and invoices are the evidence.
5. Release. Reclassify $22,000 to net assets without donor restrictions, citing the step 4 expenses.
6. Year-end. The $8,000 still restricted traces back to the letter, and each release traces forward to an expense.

The accrual-basis entries are:

Step 4 is not a separate entry: payroll and payables post the $16,000 of salaries and $6,000 of books; code those postings to the literacy program and the restricted fund.

Tracking a restricted award through the year in more detail is covered separately.

What supports contributed goods, services and property?

Under ASU 2020-07, contributed nonfinancial assets appear as a separate line item in the statement of activities, apart from contributions of cash and other financial assets, and the notes disaggregate them by category. For each category the notes state whether the assets were monetized or utilized during the period and, if utilized, the programs or activities that used them; the policy (if any) on monetizing rather than utilizing; any donor-imposed restrictions; and the valuation techniques and inputs used to arrive at a fair value measure. The ASU counts services and unconditional promises of such assets as nonfinancial assets.

Services are recognized narrowly. FASB's summary of its guidance in ASU 2013-06 says contributed services are recognized only if they create or enhance nonfinancial assets, or require specialized skills, are provided by individuals possessing those skills, and typically would need to be purchased if not donated. Under paragraph 958-605-50-1B as ASU 2020-07 amends it, contributed services must be disclosed whether or not they are recognized as revenue, and their nature and extent can be described with nonmonetary information such as donated hours.

Keep these for every item received:

• A register showing the item, its category and whether it was sold or used
• The valuation source for each recognized item, such as a price list, quote or appraisal
• For services, volunteer logs showing hours, tasks and any professional skill relied on

What must sit behind the functional expense split?

ASU 2016-14 requires amounts of expenses by both natural and functional classification, presented in one location, and disclosure of the methods used to allocate costs among program and support functions. An allocation the auditor can test rests on three records:

• A written method naming each shared cost and its allocation base
• The data behind each base, such as time records, square footage or usage counts
• Evidence that the same bases were applied throughout the period

Percentages set at year-end with no data behind them cannot be tested, yet they drive the program and fundraising figures donors and funders read.

Which event and giving records must tie to the books?

For events with significant direct costs, keep an event summary tying gross receipts, sponsorships and each cost to the ledger. ASU 2016-14 keeps costs such as facility rental for special events, reported as direct benefits to donors, in the functional expense analysis by their natural classification. Record the value of what attendees received as well: IRS guidance on quid pro quo contributions, payments made partly as a contribution and partly for goods or services, requires a disclosure statement, furnished with the solicitation or the receipt, when the payment is more than $75, telling the donor that the deductible amount is limited to the excess over the value received and giving a good faith estimate of that value. No statement is required where an exception the IRS lists applies, such as goods or services of insubstantial value; keep the statements, or the exception relied on, with the event summary.

For individual giving, IRS guidance sets what the written acknowledgment required to substantiate a contribution of $250 or more must contain; that content is covered separately. Keep the acknowledgments issued, and reconcile the donor database to recorded contribution totals, explaining each difference, such as pledges, noncash gifts or timing.

What grant compliance evidence should be ready?

For each award, keep the signed agreement and amendments, the approved budget, every report sent to the funder, and a reconciliation of reported spending to the ledger with the cost support behind it. For federal awards, 2 CFR 200.302 requires financial management systems, including records documenting compliance, sufficient to permit the preparation of required reports and the tracking of expenditures to establish that funds were used in accordance with Federal statutes, regulations and the terms and conditions of the award.

What governance records does the audit examine?

These records sit outside the accounting system. Form 990's Part VI questions show what to have on file:

• Contemporaneous documentation of meetings held or written actions taken by the governing body and each committee with authority to act for it
• A written conflict-of-interest policy, annual disclosures by officers, directors, trustees and key employees of interests that could give rise to conflicts, and evidence of regular and consistent monitoring and enforcement
• For the compensation of the top management official and other officers or key employees, evidence of review and approval by independent persons, comparability data, and contemporaneous substantiation of the deliberation and decision

Form 990's Part VI, Section B, which holds the conflict-of-interest and compensation questions, asks about policies the Internal Revenue Code does not require, so keep on file what the organization adopted and what its bylaws, policies or funders require. Where an audit committee is required or exists, keep the board action appointing it and its minutes.

Add a related-party list reconciled to those disclosures and to vendor and grantee files: AICPA's AU-C section 580 has the auditor request management's written representation that it has disclosed all related parties and the related party relationships and transactions it knows of. Check each compensation approval against the bylaws to confirm the approving body was empowered to give it.

How are endowment and board-designated funds kept apart?

Under ASU 2016-14, endowment funds are established either by a donor or by a governing board and can be with or without donor restrictions, and a board-designated endowment fund, which generally results from an internal designation, is generally classified as net assets without donor restrictions. Board designations are disclosed as self-imposed limits, and endowment disclosures show donor-restricted funds separately from board-designated funds and describe the spending policy.

Their evidence comes from different records:

• Donor-restricted. Keep the gift instrument for each fund and the board minutes appropriating amounts for spending.
• Board-designated. Keep the board resolution creating the designation and any later resolution changing it.

For a donor-restricted endowment, ASU 2016-14 has the restriction expire to the extent of an amount the board appropriates for expenditure, as long as all time restrictions have lapsed and all purpose restrictions have been met; otherwise the amount stays with donor restrictions until the purpose restrictions are satisfied. Laws on the use of donor-restricted endowment funds vary by jurisdiction, and the ASU requires the organization to assess its gifts and its relevant laws, so keep the board's documented reading of its state's endowment law with the spending policy, the investment policy and custodian statements for each fund. Treating a board-designated fund as donor-restricted, or the reverse, misstates what the organization is free to spend.

What filing and registration evidence should be on hand?

This step confirms that evidence exists; it does not decide what the organization had to file. The IRS says every organization exempt under section 501(a) must file an annual information return, apart from listed exceptions, so keep a copy of each Form 990-series return filed for the period with its submission or acceptance record. Form 990 asks for the states with which a copy is required to be filed and whether a federal award required a Subpart F audit, so for each state keep the registration or renewal and the annual report filed, with the regulator's acknowledgment, and, where a single audit applied, keep the Federal Audit Clearinghouse submission record. Chase any missing record before fieldwork.

What should be ready before fieldwork starts?

Work through these in order:

1. Close and reconcile. Reconcile bank, investment, payroll, pledges receivable, payables and deferred revenue accounts, and roll forward each net asset class.
2. Produce the schedules. Build each schedule in the checklist and tie it to the trial balance.
3. List the confirmations. List the third parties the auditor may confirm: banks, investment custodians, lenders, grantors and donors with open pledges, with contact details.
4. Track requests. Keep one log of each request, its owner, the date asked and the date delivered.

A first audit reaches back. An AICPA resource page on initial audits, written for employee benefit plans, describes AU-C section 510 as covering opening balances in an initial audit engagement, and explains that opening balances reflect the effects of prior periods' transactions and accounting policies and include matters requiring disclosure that existed at the start of the period, such as contingencies and commitments. Assemble the prior-year statements and any review or compilation report, the gift instruments behind restricted balances at the start of the year, the board actions behind designations, and pledge, fixed-asset and debt detail. Running the net asset, allocation and grant rows monthly avoids rebuilding them before fieldwork.

How does the audit close out?

Review each proposed adjustment, post the ones you accept to the audited year, keep the entries, and confirm the current year's opening balances agree with the audited statements. For misstatements left uncorrected, AU-C section 580 has the auditor request management's written representation about whether it believes their effects are immaterial, individually and in the aggregate, to the financial statements as a whole, with a summary of those items included in or attached to it.

AU-C 580 also has the auditor request representations that management has provided all relevant information and access agreed in the engagement terms and that all transactions have been recorded, in a representation letter addressed to the auditor and dated as of the date of the auditor's report. It also has the auditor request a written representation that management has fulfilled its responsibility, as set out in the engagement terms, for the preparation and fair presentation of the financial statements and for the internal control relevant to preparing them. If management does not provide the representations about those responsibilities and about information, access and completeness, the auditor disclaims an opinion or withdraws.

If a single audit applies, 2 CFR 200.512 requires the audit, the data collection form and the reporting package to be submitted within 30 calendar days after the auditee receives the auditor's report or nine months after the end of the audit period, whichever is earlier, to the Federal Audit Clearinghouse, which the section names as the repository of record for reporting packages and the data collection form. The cognizant agency for audit (or, absent one, the oversight agency for audit) may authorize an extension when the nine-month timeframe would place an undue burden on the auditee.

Keep the final trial balance, the posted adjustments and every schedule and reconciliation, and start next year's roll-forwards from the audited closing balances.