Reading a single audit and management letter without flinching

# Reading a single audit and management letter without flinching

A county workforce agency in the Midwest once returned $2.3 million in federal grant money because someone in the finance office reused the same beneficiary ID for two different training programs. No fraud, no theft, just a broken control. The auditor called it a "material weakness." That single phrase, buried on page 47 of a document nobody in leadership had read closely, triggered a corrective action plan, a board-level briefing, and a year of enhanced monitoring from the federal agency. This lesson teaches you to spot that phrase before it finds you.

What a single audit actually is

A Single Audit is the annual compliance and financial audit required of any US state, local government, tribe, university, or nonprofit that spends $1,000,000 or more in federal awards in a fiscal year (this threshold, raised from $750,000, took effect for fiscal years starting after October 1, 2024, per the Office of Management and Budget, OMB). It is governed by the Single Audit Act and detailed in the Uniform Guidance, codified at 2 CFR Part 200, Subpart F.

Instead of a federal agency auditing every grant recipient separately, one audit covers all federal funding an entity receives, tested against a Compliance Supplement the OMB updates annually. Auditors follow Generally Accepted Government Auditing Standards (GAGAS), often called the "Yellow Book," published by the US Government Accountability Office (GAO).

In Europe, the closest analogue is the work of national Supreme Audit Institutions (SAIs) and the European Court of Auditors (ECA), which audits EU budget spending and issues an annual "Statement of Assurance" on the legality and regularity of transactions. The logic is the same: public money carries a duty of demonstrated stewardship.

The document you're actually reading

A Single Audit reporting package has a predictable skeleton. Learn it once, and every one you read afterward takes ten minutes instead of two hours.

• Independent Auditor's Report: opinion on whether financial statements are fairly presented.
• Schedule of Expenditures of Federal Awards (SEFA): lists every federal program and dollar amount spent, by CFDA/Assistance Listing Number (the catalog number identifying each federal grant program).
• Report on Internal Control over Financial Reporting: this is where "material weakness" and "significant deficiency" live.
• Report on Compliance for Major Programs: tests whether grant rules (procurement, eligibility, cash management) were actually followed.
• Schedule of Findings and Questioned Costs: the heart of the document, and your focus here.
• Corrective Action Plan: management's promised fix, with a named owner and date.

The full text of the Uniform Guidance is available free at the Electronic Code of Federal Regulations, and the GAO's Yellow Book standards are free at gao.gov.

Decoding the schedule of findings and questioned costs

Each finding follows a template. Learn the four fields:

1. Condition: what actually happened (e.g., "23 of 40 sampled payroll files lacked timesheets signed by a supervisor").

2. Criteria: the rule that was broken (a specific Uniform Guidance section, or the grant agreement itself).

3. Cause: why it happened (staff turnover, no written procedure, system limitation).

4. Effect and Questioned Costs: the dollar exposure. A questioned cost is spending an auditor flags as potentially unallowable, unsupported, or unreasonable under the grant terms. It is not automatically a loss. It is a red flag the grantor agency must resolve.

The severity ladder

This is the part that makes boards nervous, so get precise:

• Control deficiency: a minor gap, noted informally, often not even in the report.
• Significant deficiency: a control gap important enough to merit attention by those charged with governance, but less severe than the next category.
• Material weakness: a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. This is the phrase that ends up in board minutes and sometimes in local news coverage.

The distinction is about the *severity of the control gap*, not the dollar size of any one transaction. A $500 questioned cost tied to a broken approval process can still be labeled a material weakness if the process failure is pervasive.

A worked example

Say a state agency's SEFA shows $40 million in federal expenditures across 6 major programs. The auditor samples 60 transactions in the largest program ($18 million) and finds 4 with missing supporting documentation, averaging $12,000 each.

Questioned costs = 4 x $12,000 = $48,000 disclosed in the finding.

That $48,000 is small next to $18 million. But if the auditor's narrative says the missing documentation stems from "no consistent file retention policy across three regional offices," that cause statement, not the dollar figure, is what can escalate the finding from significant deficiency to material weakness. Dollar size matters for *questioned costs*; systemic reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → matters for *severity*.

The management letter: the part nobody circulates

Beyond the formal findings, auditors often issue a management letter (sometimes called a "letter of comments" or, in GAGAS language, communications about matters not required to be reported). This covers smaller observations: a stale bank reconciliation process, an IT access control gap, a budget variance nobody explained.

It is not part of the formal opinion, has no legal filing requirement, and is easy to shred. That is exactly why a finance professional should ask for it. Management letters are where next year's material weakness is incubating.

What it actually costs an agency

A material weakness rarely means a criminal referral. It usually triggers:

• Enhanced monitoring from the federal awarding agency: more frequent reporting, site visits, sometimes withheld draw-downs of grant cash.
• Reputational cost with the governing board, city council, or state legislature, especially if local media picks it up.
• Bond rating scrutiny: rating agencies like Moody's and S&P review audit findings as part of governance risk when rating municipal debt; a pattern of repeat findings is a negative credit factor, though rarely decisive alone (this is a directional, well-established practice, not a specific rating formula).
• Possible repayment: if questioned costs are ultimately disallowed by the federal awarding agency after review, the entity must repay from non-federal funds.

The workforce agency in the opening example did not lose its grant. It lost a year of unrestricted discretion over how it drew down funds, and every reimbursement request after that got extra scrutiny.

Practical due-diligence checklist

If you are a board member, lender, or oversight staffer reviewing one of these packages, work through this sequence:

1. Check the opinion first. "Unmodified" (clean) is good. "Qualified," "adverse," or "disclaimer of opinion" are escalating red flags on the financial statements themselves.

2. Scan the Schedule of Findings for repeat findings. A finding that appeared last year and reappears this year, sometimes flagged "prior year finding not corrected," is a much bigger governance signal than a first-time deficiency.

3. Read the Corrective Action Plan for specificity. "We will improve training" is vague and unconvincing. "We will implement dual sign-off in [named system] by Q2, owned by [named role]" is credible.

4. Cross-check questioned costs against total federal award size. Ratio matters more than raw dollars.

5. Ask for the management letter separately if it is not attached; many entities file it only on request.

Single Audit reports for most federal grant recipients are searchable free at the Federal Audit Clearinghouse, run by the US Census Bureau on behalf of OMB. This is the single best public tool for benchmarking one agency's findings against peers.

🎬 [VIDEO: "Understanding the Single Audit" - youtube.com/results?search_query=understanding+the+single+audit+uniform+guidance - search for AICPA or state auditor training walkthroughs explaining the Schedule of Findings structure step by step]

Key Takeaways

• A Single Audit is mandatory for US entities spending $1M+ in federal awards annually (2 CFR Part 200, Subpart F); the Schedule of Findings and Questioned Costs is its most consequential section.