Reading a single audit and management letter without flinching

The document you're actually reading

A Single Audit reporting package has a predictable skeleton. Learn it once, and every one you read afterward takes ten minutes instead of two hours.

• Independent Auditor's Report: opinion on whether financial statements are fairly presented.
• Schedule of Expenditures of Federal Awards (SEFA): lists every federal program and dollar amount spent, by CFDA/Assistance Listing Number (the catalog number identifying each federal grant program).
• Report on Internal Control over Financial Reporting: this is where "material weakness" and "significant deficiency" live.
• Report on Compliance for Major Programs: tests whether grant rules (procurement, eligibility, cash management) were actually followed.
• Schedule of Findings and Questioned Costs: the heart of the document, and your focus here.
• Corrective Action Plan: management's promised fix, with a named owner and date.

The full text of the Uniform Guidance is available free at the Electronic Code of Federal Regulations, and the GAO's Yellow Book standards are free at gao.gov.

Decoding the schedule of findings and questioned costs

Each finding follows a template. Learn the four fields:

1. Condition: what actually happened (e.g., "23 of 40 sampled payroll files lacked timesheets signed by a supervisor").

2. Criteria: the rule that was broken (a specific Uniform Guidance section, or the grant agreement itself).

3. Cause: why it happened (staff turnover, no written procedure, system limitation).

4. Effect and Questioned Costs: the dollar exposure. A questioned cost is spending an auditor flags as potentially unallowable, unsupported, or unreasonable under the grant terms. It is not automatically a loss. It is a red flag the grantor agency must resolve.

The severity ladder

This is the part that makes boards nervous, so get precise:

• Control deficiency: a minor gap, noted informally, often not even in the report.
• Significant deficiency: a control gap important enough to merit attention by those charged with governance, but less severe than the next category.
• Material weakness: a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. This is the phrase that ends up in board minutes and sometimes in local news coverage.

The distinction is about the *severity of the control gap*, not the dollar size of any one transaction. A $500 questioned cost tied to a broken approval process can still be labeled a material weakness if the process failure is pervasive.

A worked example

Say a state agency's SEFA shows $40 million in federal expenditures across 6 major programs. The auditor samples 60 transactions in the largest program ($18 million) and finds 4 with missing supporting documentation, averaging $12,000 each.

Questioned costs = 4 x $12,000 = $48,000 disclosed in the finding.

That $48,000 is small next to $18 million. But if the auditor's narrative says the missing documentation stems from "no consistent file retention policy across three regional offices," that cause statement, not the dollar figure, is what can escalate the finding from significant deficiency to material weakness. Dollar size matters for *questioned costs*; systemic reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → matters for *severity*.

The management letter: the part nobody circulates

Beyond the formal findings, auditors often issue a management letter (sometimes called a "letter of comments" or, in GAGAS language, communications about matters not required to be reported). This covers smaller observations: a stale bank reconciliation process, an IT access control gap, a budget variance nobody explained.

It is not part of the formal opinion, has no legal filing requirement, and is easy to shred. That is exactly why a finance professional should ask for it. Management letters are where next year's material weakness is incubating.

What it actually costs an agency

A material weakness rarely means a criminal referral. It usually triggers:

• Enhanced monitoring from the federal awarding agency: more frequent reporting, site visits, sometimes withheld draw-downs of grant cash.
• Reputational cost with the governing board, city council, or state legislature, especially if local media picks it up.
• Bond rating scrutiny: rating agencies like Moody's and S&P review audit findings as part of governance risk when rating municipal debt; a pattern of repeat findings is a negative credit factor, though rarely decisive alone (this is a directional, well-established practice, not a specific rating formula).
• Possible repayment: if questioned costs are ultimately disallowed by the federal awarding agency after review, the entity must repay from non-federal funds.

The workforce agency in the opening example did not lose its grant. It lost a year of unrestricted discretion over how it drew down funds, and every reimbursement request after that got extra scrutiny.

Practical due-diligence checklist

If you are a board member, lender, or oversight staffer reviewing one of these packages, work through this sequence:

1. Check the opinion first. "Unmodified" (clean) is good. "Qualified," "adverse," or "disclaimer of opinion" are escalating red flags on the financial statements themselves.

2. Scan the Schedule of Findings for repeat findings. A finding that appeared last year and reappears this year, sometimes flagged "prior year finding not corrected," is a much bigger governance signal than a first-time deficiency.

3. Read the Corrective Action Plan for specificity. "We will improve training" is vague and unconvincing. "We will implement dual sign-off in [named system] by Q2, owned by [named role]" is credible.

4. Cross-check questioned costs against total federal award size. Ratio matters more than raw dollars.

5. Ask for the management letter separately if it is not attached; many entities file it only on request.

Single Audit reports for most federal grant recipients are searchable free at the Federal Audit Clearinghouse, run by the US Census Bureau on behalf of OMB. This is the single best public tool for benchmarking one agency's findings against peers.

🎬 [VIDEO: "Understanding the Single Audit" - youtube.com/results?search_query=understanding+the+single+audit+uniform+guidance - search for AICPA or state auditor training walkthroughs explaining the Schedule of Findings structure step by step]

Key Takeaways

• A Single Audit is mandatory for US entities spending $1M+ in federal awards annually (2 CFR Part 200, Subpart F); the Schedule of Findings and Questioned Costs is its most consequential section.
• "Material weakness" describes the severity of a control failure, not the dollar amount involved; a small questioned cost tied to a systemic process gap can still be classified as material.
• Questioned costs are provisional flags, not confirmed losses; the awarding federal agency decides whether to disallow and demand repayment.
• Repeat findings across audit years are a stronger red flag than a single first-time deficiency, and vague corrective action plans should be treated skeptically.
• The Federal Audit Clearinghouse and the GAO Yellow Book are free, primary-source tools for checking any agency's audit history before you sit on its board or extend it credit.